diff --git a/inventories/production/group_vars/all/firewall.yml b/inventories/production/group_vars/all/firewall.yml
new file mode 100644
index 0000000..f0ad76b
--- /dev/null
+++ b/inventories/production/group_vars/all/firewall.yml
@@ -0,0 +1,15 @@
+---
+# Shared firewall topology — single source of truth for the host nftables layer
+# (base role) and OPNsense (future). See docs/decisions/020-firewall.md.
+
+# Zone → subnet (from ADR-007).
+firewall_zones:
+  mgmt: 10.10.0.0/24
+  srv: 10.20.0.0/24
+  lan: 10.30.0.0/24
+  iot: 10.40.0.0/24
+  guest: 10.50.0.0/24
+
+# Service catalog: <name> → placement (host | group | hosts) + ingress[].
+# Empty until services are built; hosts still get default-deny + the management plane.
+firewall_catalog: {}
diff --git a/inventories/staging/group_vars/all/firewall.yml b/inventories/staging/group_vars/all/firewall.yml
new file mode 100644
index 0000000..f0ad76b
--- /dev/null
+++ b/inventories/staging/group_vars/all/firewall.yml
@@ -0,0 +1,15 @@
+---
+# Shared firewall topology — single source of truth for the host nftables layer
+# (base role) and OPNsense (future). See docs/decisions/020-firewall.md.
+
+# Zone → subnet (from ADR-007).
+firewall_zones:
+  mgmt: 10.10.0.0/24
+  srv: 10.20.0.0/24
+  lan: 10.30.0.0/24
+  iot: 10.40.0.0/24
+  guest: 10.50.0.0/24
+
+# Service catalog: <name> → placement (host | group | hosts) + ingress[].
+# Empty until services are built; hosts still get default-deny + the management plane.
+firewall_catalog: {}
diff --git a/roles/base/defaults/main.yml b/roles/base/defaults/main.yml
index ed97d53..0fdb354 100644
--- a/roles/base/defaults/main.yml
+++ b/roles/base/defaults/main.yml
@@ -1 +1,8 @@
 ---
+# Host firewall (nftables) behaviour knobs. Shared topology (firewall_catalog/
+# firewall_zones) lives in group_vars/all, not here. See docs/decisions/020-firewall.md.
+base__firewall_mgmt_interface: wt0   # SSH accepted only on this iface (NetBird, ADR-016)
+base__firewall_ssh_port: 22
+base__firewall_rollback_timeout: 45  # seconds before the auto-revert fires on a bad apply
+base__firewall_dropin_dir: /etc/nftables.d
+base__firewall_apply: true           # set false to render+validate without applying (CI/Molecule)