ansible-base-debian

Generic Debian baseline: base OS, sysctl, and the single-owner nftables firewall that apps extend by declaring firewall_allow_tcp / firewall_trust_iifnames / firewall_forward_policy. base never references an app and never flushes nftables.

Run

direnv allow   # or: export ANSIBLE_CONFIG=$PWD/ansible.cfg
ansible-galaxy collection install -r requirements.yml
ansible-playbook -i inventory/hosts.yml site.yml

Firewall contract

management_cidrs (admin SSH sources), firewall_allow_tcp (public TCP), firewall_allow_tcp_mgmt (mgmt-only TCP, default 22), firewall_trust_iifnames (trusted input ifaces, e.g. podman*), firewall_forward_policy. base owns inet base_filter; fail2ban/crowdsec own their own tables.