From bd100c15e7d934f7fadf4e93db04d7a9c5496a15 Mon Sep 17 00:00:00 2001
From: Hermes Agent service account
 <hermes@carousel-of-progress.local.mk-labs.cloud>
Date: Sun, 31 May 2026 21:09:27 -0500
Subject: [PATCH] hermes: add hermes-dashboard systemd unit (port 9119, fronted
 by Traefik)

---
 ansible/roles/hermes/defaults/main.yml        | 13 +++++-
 ansible/roles/hermes/tasks/main.yml           | 43 +++++++++++++++++++
 .../templates/hermes-dashboard.service.j2     | 24 +++++++++++
 3 files changed, 79 insertions(+), 1 deletion(-)
 create mode 100644 ansible/roles/hermes/templates/hermes-dashboard.service.j2

diff --git a/ansible/roles/hermes/defaults/main.yml b/ansible/roles/hermes/defaults/main.yml
index f1e0b97..1149942 100644
--- a/ansible/roles/hermes/defaults/main.yml
+++ b/ansible/roles/hermes/defaults/main.yml
@@ -8,8 +8,19 @@ hermes_home: /home/hermes
 # Set to true if you don't need browser automation (skips Playwright/Chromium)
 hermes_skip_browser: false
 
-# systemd service name
+# systemd service name (gateway)
 hermes_service_name: hermes
 
 # Path where hermes binary will be accessible system-wide
 hermes_bin_symlink: /usr/local/bin/hermes
+
+# -----------------------------------------------------------------------------
+# Hermes Web UI (dashboard) — fronted by Traefik on lightning-lane via the
+# 'jarvis' service. Binds to 0.0.0.0 so Traefik can reach it from upstream;
+# --insecure is acceptable because TLS + auth are terminated at Traefik.
+# -----------------------------------------------------------------------------
+hermes_dashboard_enabled: true
+hermes_dashboard_service_name: hermes-dashboard
+hermes_dashboard_host: 0.0.0.0
+hermes_dashboard_port: 9119
+hermes_dashboard_insecure: true
diff --git a/ansible/roles/hermes/tasks/main.yml b/ansible/roles/hermes/tasks/main.yml
index ad4acb8..c9e252f 100644
--- a/ansible/roles/hermes/tasks/main.yml
+++ b/ansible/roles/hermes/tasks/main.yml
@@ -154,3 +154,46 @@
     enabled: true
     state: stopped
   become: true
+
+# ---------------------------------------------------------------------------
+# 7. Install systemd service unit for the Hermes Web UI (dashboard)
+#    Separate unit from the gateway so the UI can be restarted / disabled
+#    independently. Fronted upstream by Traefik (jarvis service) on
+#    lightning-lane, so binding 0.0.0.0 with --insecure is intentional.
+# ---------------------------------------------------------------------------
+
+- name: Deploy hermes-dashboard systemd service unit
+  ansible.builtin.template:
+    src: hermes-dashboard.service.j2
+    dest: /etc/systemd/system/{{ hermes_dashboard_service_name }}.service
+    owner: root
+    group: root
+    mode: "0644"
+  become: true
+  register: hermes_dashboard_unit
+  when: hermes_dashboard_enabled
+
+- name: Reload systemd to pick up hermes-dashboard unit changes
+  ansible.builtin.systemd:
+    daemon_reload: true
+  become: true
+  when:
+    - hermes_dashboard_enabled
+    - hermes_dashboard_unit is changed
+
+- name: Enable and start hermes-dashboard service
+  ansible.builtin.systemd:
+    name: "{{ hermes_dashboard_service_name }}"
+    enabled: true
+    state: started
+  become: true
+  when: hermes_dashboard_enabled
+
+- name: Restart hermes-dashboard on unit change
+  ansible.builtin.systemd:
+    name: "{{ hermes_dashboard_service_name }}"
+    state: restarted
+  become: true
+  when:
+    - hermes_dashboard_enabled
+    - hermes_dashboard_unit is changed
diff --git a/ansible/roles/hermes/templates/hermes-dashboard.service.j2 b/ansible/roles/hermes/templates/hermes-dashboard.service.j2
new file mode 100644
index 0000000..eb229bf
--- /dev/null
+++ b/ansible/roles/hermes/templates/hermes-dashboard.service.j2
@@ -0,0 +1,24 @@
+[Unit]
+Description=Hermes Dashboard (Web UI)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User={{ hermes_user }}
+Group={{ hermes_group }}
+WorkingDirectory={{ hermes_home }}
+Environment="HOME={{ hermes_home }}"
+Environment="PATH={{ hermes_home }}/.local/bin:/usr/local/bin:/usr/bin:/bin"
+Environment="HERMES_HOME={{ hermes_home }}/.hermes"
+ExecStart={{ hermes_home }}/.hermes/hermes-agent/venv/bin/hermes dashboard --host {{ hermes_dashboard_host }} --port {{ hermes_dashboard_port }}{% if hermes_dashboard_insecure %} --insecure{% endif %}
+
+TimeoutStopSec=30
+Restart=on-failure
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=hermes-dashboard
+
+[Install]
+WantedBy=multi-user.target