From 43741f17e4f3fc2993f0c0a1425044caf9cd7052 Mon Sep 17 00:00:00 2001
From: Hermes <hermes@hermes.local>
Date: Sat, 6 Jun 2026 18:17:29 +0000
Subject: [PATCH] fix: add ob-shell and org-confirm-babel-evaluate to
 tangle-deploy block in infrastructure.org

The tangle-deploy.sh is tangled FROM infrastructure.org, but the org
block was missing (require 'ob-shell) and org-confirm-babel-evaluate nil.
This caused the CrowdSec noweb block (sh src) to evaluate as nil,
making crowdsecLapiKey = nil in dynamic.yaml and blocking ALL traffic
through the CrowdSec bouncer with 403.

Fix the org block so the system is self-consistent: tangle always
produces a correct tangle-deploy.sh that can load ob-shell and
evaluate noweb blocks without confirmation prompts.
---
 infrastructure.org | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/infrastructure.org b/infrastructure.org
index 5c9b7e9..f2a9a15 100644
--- a/infrastructure.org
+++ b/infrastructure.org
@@ -73,7 +73,8 @@ fi
 echo "=== Tangling $ORG_FILE ==="
 emacs --batch -Q --load /usr/share/emacs/28.2/lisp/org/org-loaddefs.el \
   --eval "(require 'org)" \
-  --eval "(org-babel-tangle-file \"$ORG_FILE\")" 2>&1
+  --eval "(require 'ob-shell)" \
+  --eval '(let ((org-confirm-babel-evaluate nil)) (org-babel-tangle-file "'"$ORG_FILE"'"))' 2>&1
 echo "=== Restarting services ==="
 cd /docker/compose
 if [ -f /docker/appdata/traefik/traefik.yaml ] || \