diff --git a/group_vars/all.yml b/group_vars/all.yml
new file mode 100644
index 0000000..acb81e8
--- /dev/null
+++ b/group_vars/all.yml
@@ -0,0 +1,4 @@
+---
+# Shared non-secret defaults across all hosts go here.
+# Secrets live in the vault (see host_vars / a vaulted file), not in this file.
+org_name: "MakerFLOSS"
diff --git a/group_vars/mikrotik.yml b/group_vars/mikrotik.yml
new file mode 100644
index 0000000..278ec97
--- /dev/null
+++ b/group_vars/mikrotik.yml
@@ -0,0 +1,12 @@
+---
+ansible_connection: ansible.netcommon.network_cli
+ansible_network_os: community.routeros.routeros
+ansible_user: admin
+ansible_ssh_private_key_file: "~/.ssh/id_ed25519"
+
+# Domain enable-flags (day-2 play). Override per-host if needed.
+switch_identity_enabled: true
+switch_users_enabled: true
+switch_vlans_enabled: true
+switch_backup_enabled: true
+switch_firmware_enabled: false   # opt-in; upgrades are disruptive
diff --git a/inventories/prod/hosts.yml b/inventories/prod/hosts.yml
new file mode 100644
index 0000000..f406752
--- /dev/null
+++ b/inventories/prod/hosts.yml
@@ -0,0 +1,7 @@
+---
+all:
+  children:
+    mikrotik:
+      hosts:
+        crs310-maker:
+          ansible_host: 192.168.88.1   # temp mgmt IP until Task 4 sets the real one