extract-fw-host-vars.py: abort if a conf file cannot be read; add --from-dir. Migrate cl-test.

Previously an unreadable file (e.g. /etc/ipt-firewall is 0750 after the
role ran) silently produced almost empty host_vars. The script now exits
with an error and writes nothing. --from-dir reads the conf files from a
local directory, e.g. fetched with ansible using the vaulted become
password.

Add host_vars for cl-test.oopen.de (fw_manage_config: true).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

extract-fw-host-vars.py

@@ -6,7 +6,7 @@ Reads /etc/ipt-firewall/{interfaces,main}_ipv{4,6}.conf via SSH,
 maps all variables to Ansible fw_* names, and writes a host_vars file.
 
 Usage:
-    ./extract-fw-host-vars.py <hostname> [--user USER] [--port PORT] [--dry-run]
+    ./extract-fw-host-vars.py <hostname> [--user USER] [--port PORT] [--sudo] [--from-dir DIR] [--output FILE] [--dry-run]
 
 Example:
     ./extract-fw-host-vars.py cl-01.oopen.de
@@ -749,6 +749,9 @@ def main():
     parser.add_argument("--output", "-o", default=None, help="Output file (default: stdout)")
     parser.add_argument("--sudo", "-s", action="store_true",
                         help="Read files via sudo (prompts for sudo password once)")
+    parser.add_argument("--from-dir", "-d", default=None,
+                        help="Read the conf files from this local directory instead of via SSH "
+                             "(e.g. fetched with: ansible HOST -b -m fetch ...)")
     parser.add_argument("--dry-run", action="store_true", help="Print SSH commands without executing")
     args = parser.parse_args()
 
@@ -767,18 +770,33 @@ def main():
             print(f"ssh {args.user}@{hostname} {cmd} {path}")
         return
 
-    sudo_password = None
-    if args.sudo:
-        import getpass
-        sudo_password = getpass.getpass(f"sudo password for {args.user}@{hostname}: ")
-
-    print(f"Connecting to {hostname} as {args.user} ...", file=sys.stderr)
-
     contents = {}
-    for key, path in files.items():
-        print(f"  Reading {path} ...", file=sys.stderr)
-        content = ssh_cat(hostname, args.user, args.port, path, sudo_password=sudo_password)
-        contents[key] = content or ""
+    if args.from_dir:
+        for key, path in files.items():
+            local = Path(args.from_dir) / Path(path).name
+            print(f"  Reading {local} ...", file=sys.stderr)
+            try:
+                contents[key] = local.read_text()
+            except OSError as e:
+                print(f"  WARNING: could not read {local}: {e}", file=sys.stderr)
+                contents[key] = None
+    else:
+        sudo_password = None
+        if args.sudo:
+            import getpass
+            sudo_password = getpass.getpass(f"sudo password for {args.user}@{hostname}: ")
+
+        print(f"Connecting to {hostname} as {args.user} ...", file=sys.stderr)
+
+        for key, path in files.items():
+            print(f"  Reading {path} ...", file=sys.stderr)
+            contents[key] = ssh_cat(hostname, args.user, args.port, path, sudo_password=sudo_password)
+
+    # An unreadable file would silently produce (nearly) empty host_vars
+    if any(c is None for c in contents.values()):
+        print("ERROR: not all config files could be read — nothing written "
+              "(try --sudo or --from-dir)", file=sys.stderr)
+        sys.exit(1)
 
     all_warnings = []
     parsed = {}