---
# Host firewall (nftables) behaviour knobs. Shared topology (firewall_catalog/
# firewall_zones) lives in group_vars/all, not here. See docs/decisions/020-firewall.md.
base__firewall_mgmt_interface: wt0   # SSH accepted only on this iface (NetBird, ADR-016)
base__firewall_control_addr: ""      # control-node LAN address (ubongo); SSH allowed from it
                                     # as the guaranteed-management-plane `ssh-from-control`
                                     # source (ADR-021). Empty = no rule. Set in group_vars
                                     # once ubongo exists.
base__firewall_ssh_port: 22
base__firewall_rollback_timeout: 45  # seconds before the auto-revert fires on a bad apply
base__firewall_confirm_timeout: 20   # seconds to re-establish a fresh connection post-apply
base__firewall_dropin_dir: /etc/nftables.d
base__firewall_apply: true           # set false to render+validate without applying (CI/Molecule)