From fb60615a306e94c0896cfdbd2463a015242a696f Mon Sep 17 00:00:00 2001
From: Rasmus Larsen <rasmus.larsen@alexandra.dk>
Date: Sat, 31 Oct 2026 11:20:24 +0000
Subject: [PATCH] ops: the Grafana session check drops the panel-action header

Grafana marks a panel action's request with X-Grafana-Action and refuses
such requests on its own API with 405. auth_request forwarded the header
to /api/user, so every signed-in control answered 500.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 scripts/ops/configure_hetzner_sdk_ingress.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/scripts/ops/configure_hetzner_sdk_ingress.sh b/scripts/ops/configure_hetzner_sdk_ingress.sh
index 10b9e022..9fc581da 100755
--- a/scripts/ops/configure_hetzner_sdk_ingress.sh
+++ b/scripts/ops/configure_hetzner_sdk_ingress.sh
@@ -350,6 +350,9 @@ map \$http_upgrade \$ucloud_connection_upgrade {
         proxy_pass_request_body off;
         proxy_set_header Content-Length \"\";
         proxy_set_header Host \$host;
+        # Grafana marks panel actions' requests with this header and refuses
+        # them on its own API (405), the session check included.
+        proxy_set_header X-Grafana-Action \"\";
     }
 
     # Panel actions send only GET or POST: POST .../undrain is DELETE .../drain.