extract-fw-host-vars.py: use the SSH user from ~/.ssh/config unless --user is given.

Previously "-l chris" was always passed, which overrode per-host users in
~/.ssh/config (e.g. the so36 hosts).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

extract-fw-host-vars.py

@@ -748,7 +748,8 @@ def render_yaml(hostname, host_vars, all_warnings):
 def main():
     parser = argparse.ArgumentParser(description="Extract ipt-firewall host_vars from a remote host")
     parser.add_argument("hostname", help="Target hostname (must be in SSH config or known_hosts)")
-    parser.add_argument("--user", "-u", default="chris", help="SSH user (default: chris)")
+    parser.add_argument("--user", "-u", default=None,
+                        help="SSH user (default: as configured in ~/.ssh/config)")
     parser.add_argument("--port", "-p", type=int, default=None, help="SSH port (default: 22)")
     parser.add_argument("--output", "-o", default=None,
                         help="Output file, '-' for stdout "
@@ -771,10 +772,12 @@ def main():
         "main_v6":  f"{conf_dir}/main_ipv6.conf",
     }
 
+    target = f"{args.user}@{hostname}" if args.user else hostname
+
     if args.dry_run:
         cmd = "sudo -S -p '' cat" if args.sudo else "cat"
         for key, path in files.items():
-            print(f"ssh {args.user}@{hostname} {cmd} {path}")
+            print(f"ssh {target} {cmd} {path}")
         return
 
     # Determine the output file first, so an existing file aborts before any SSH
@@ -806,9 +809,9 @@ def main():
         sudo_password = None
         if args.sudo:
             import getpass
-            sudo_password = getpass.getpass(f"sudo password for {args.user}@{hostname}: ")
+            sudo_password = getpass.getpass(f"sudo password for {target}: ")
 
-        print(f"Connecting to {hostname} as {args.user} ...", file=sys.stderr)
+        print(f"Connecting to {target} ...", file=sys.stderr)
 
         for key, path in files.items():
             print(f"  Reading {path} ...", file=sys.stderr)