feat(base): shared firewall catalog/zones + firewall defaults

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

inventories/production/group_vars/all/firewall.yml

@@ -0,0 +1,15 @@
+---
+# Shared firewall topology — single source of truth for the host nftables layer
+# (base role) and OPNsense (future). See docs/decisions/020-firewall.md.
+
+# Zone → subnet (from ADR-007).
+firewall_zones:
+  mgmt: 10.10.0.0/24
+  srv: 10.20.0.0/24
+  lan: 10.30.0.0/24
+  iot: 10.40.0.0/24
+  guest: 10.50.0.0/24
+
+# Service catalog: <name> → placement (host | group | hosts) + ingress[].
+# Empty until services are built; hosts still get default-deny + the management plane.
+firewall_catalog: {}

inventories/staging/group_vars/all/firewall.yml

@@ -0,0 +1,15 @@
+---
+# Shared firewall topology — single source of truth for the host nftables layer
+# (base role) and OPNsense (future). See docs/decisions/020-firewall.md.
+
+# Zone → subnet (from ADR-007).
+firewall_zones:
+  mgmt: 10.10.0.0/24
+  srv: 10.20.0.0/24
+  lan: 10.30.0.0/24
+  iot: 10.40.0.0/24
+  guest: 10.50.0.0/24
+
+# Service catalog: <name> → placement (host | group | hosts) + ingress[].
+# Empty until services are built; hosts still get default-deny + the management plane.
+firewall_catalog: {}

roles/base/defaults/main.yml

@@ -1 +1,8 @@
 ---
+# Host firewall (nftables) behaviour knobs. Shared topology (firewall_catalog/
+# firewall_zones) lives in group_vars/all, not here. See docs/decisions/020-firewall.md.
+base__firewall_mgmt_interface: wt0   # SSH accepted only on this iface (NetBird, ADR-016)
+base__firewall_ssh_port: 22
+base__firewall_rollback_timeout: 45  # seconds before the auto-revert fires on a bad apply
+base__firewall_dropin_dir: /etc/nftables.d
+base__firewall_apply: true           # set false to render+validate without applying (CI/Molecule)