authelia: allow only the collector to write to the log store's ingest path

nix/host-modules/swarm-authelia.nix

@@ -134,6 +134,16 @@ let
       }
     ];
 
+  # The log store's ingest routes: the collector's client, nobody else. A
+  # prefix rather than the one route the vhost serves, so no spelling of it,
+  # and no route added under `/insert/`, reaches `default_policy`. The rest of
+  # the name (read API, vmui) stays open to any authenticated caller; its
+  # `/metrics` is covered by `metricsRules`.
+  logsStoreRules = collectorOnly {
+    domain = config.services.hyperhive.swarm.victorialogs.domain;
+    resources = [ "^/insert/.*" ];
+  };
+
   # One pair per `swarm.otel.publishedScrapeTargets` entry, read off the same
   # URL the collector requests and its token is minted for, so a target
   # cannot be published without the rules that confine it to the collector.
@@ -1342,6 +1352,7 @@ in
                   # reasoning for both halves lives.
                   metricsRules
                   ++ metricsStoreRules
+                  ++ logsStoreRules
                   # The swarm UI on the apex. Not keyed to a deploy flag: its
                   # vhost is on the swarm controller's host, which need not
                   # be this one. Guarded on the domain being set: without it