feat: make SSH agent forwarding and identity agent configurable

[megheaiulian]

Summary

• Replace hardcoded -A -o IdentityAgent=$SSH_AUTH_SOCK in nixos-rebuild with two configurable variables: forward_agent and identity_agent
• Fix SSH error when SSH_AUTH_SOCK is empty/unset — the -o IdentityAgent= (with empty value) causes SSH to fail
• Pass both variables through from nixos-deploy module

Details

New variables

Variable	Type	Default	Description
forward_agent	bool	false	Controls the -A SSH flag for agent forwarding
identity_agent	bool	true	Controls -o IdentityAgent=$SSH_AUTH_SOCK, guarded with bash ${SSH_AUTH_SOCK:+...}

How it works

The SSH options are now built dynamically using compact/join:

locals {
  ssh_opts = join(" ", compact([
    var.forward_agent ? "-A" : "",
    var.identity_agent ? "$${SSH_AUTH_SOCK:+-o IdentityAgent=$$SSH_AUTH_SOCK}" : "",
    "-o StrictHostKeyChecking=no",
    "-o UserKnownHostsFile=/dev/null",
  ]))
}

• identity_agent = true (default): Uses bash parameter expansion ${SSH_AUTH_SOCK:+-o IdentityAgent=$SSH_AUTH_SOCK} so the option is only added when SSH_AUTH_SOCK is actually set and non-empty
• forward_agent = false (default): Agent forwarding is off — not needed for standard nixos-rebuild --target-host deploys where all SSH is local→remote

Bug fixed

Previously, when SSH_AUTH_SOCK was empty (e.g. in Terraform local-exec without agent), the command expanded to -o IdentityAgent= which is an SSH error. The bash guard ${SSH_AUTH_SOCK:+...} prevents this.

Affected modules

• modules/nixos-rebuild — new locals block, updated local-exec command, two new variables
• modules/nixos-deploy — passthrough of forward_agent and identity_agent to inner nixos-rebuild module