bao reader policy, responder units and docs for the per-surface grant

nix/host-modules/swarm-bao.nix

@@ -1219,7 +1219,7 @@ let
 
   # The log store's auth responders: the agent one checks the secret an agent
   # presents against the one stored for it (the same `+` leaf as the queue
-  # responder's), the other checks the bearer Grafana presents against
+  # responder's) and reads the agent's mirrored `logs`/`metrics` grant, the other checks the bearer Grafana presents against
   # Grafana's metrics bearer; and the store container's journal forwarder
   # reads its own client secret under the same leaf. Nothing else.
   logsAuthReaders = [
@@ -1229,6 +1229,7 @@ let
       batchToken = true;
       policyText =
         readStanza "${credentialMountPath}/data/swarm/agents/+/queue"
+        + readStanza "${credentialMountPath}/data/swarm/agents/+/observability"
         + readStanza "${credentialMountPath}/data/${grafanaMetricsBearerLeaf}"
         # The journal forwarder in the store's container, under this same leaf.
         + readStanza "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.victorialogs.otel.clientId}/oidc/client";
@@ -1237,7 +1238,7 @@ let
 
   # The metrics store's responders under one leaf: the agent one checks the
   # secret an agent presents against the one stored for it (the same `+` leaf
-  # as the log store's), the other checks the bearer Grafana presents; and the
+  # as the log store's) and reads the agent's mirrored grant, the other checks the bearer Grafana presents; and the
   # host unit that fetches the store container's journal forwarder secret.
   # Nothing else.
   metricsAuthReaders = [
@@ -1247,6 +1248,7 @@ let
       batchToken = true;
       policyText =
         readStanza "${credentialMountPath}/data/swarm/agents/+/queue"
+        + readStanza "${credentialMountPath}/data/swarm/agents/+/observability"
         + readStanza "${credentialMountPath}/data/${grafanaMetricsBearerLeaf}"
         # The metrics store container's journal forwarder, fetched on its host.
         + readStanza "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.victoriametrics.otel.clientId}/oidc/client";

nix/host-modules/swarm-victorialogs.nix

@@ -216,8 +216,9 @@ in
       without reading the secret store. A denial is never remembered.
 
       This is also how long a re-minted or deleted queue secret keeps working
-      at the log store's query route after its last successful check. `0`
-      checks the store on every query.
+      at the log store's query route after its last successful check. It is
+      equally how long a revoked `logs` permission keeps working. `0` checks
+      the store on every query.
     '';
   };
 
@@ -514,6 +515,7 @@ in
           "--socket ${logsAuthSocket}"
           # The role ./swarm-bao.nix writes on the store's `cert` mount.
           "--store-cert-role swarm-logs-auth"
+          "--surface logs"
           "--verdict-ttl ${toString deployCfg.victorialogs.authVerdictTtl}"
         ];
         # Paths only: `argv` is world-readable via /proc/<pid>/cmdline.

nix/host-modules/swarm-victoriametrics.nix

@@ -295,8 +295,9 @@ in
       remembered.
 
       This is also how long a re-minted or deleted queue secret keeps working
-      at the metrics store's read API after its last successful check. `0`
-      checks the store on every query.
+      at the metrics store's read API after its last successful check. It is
+      equally how long a revoked `metrics` permission keeps working. `0` checks
+      the store on every query.
     '';
   };
 
@@ -610,6 +611,7 @@ in
           "${deployCfg.victoriametrics.agentAuthPackage}/bin/swarm-logs-auth"
           "--socket ${agentAuthSocket}"
           "--store-cert-role swarm-metrics-auth"
+          "--surface metrics"
           "--verdict-ttl ${toString deployCfg.victoriametrics.agentAuthVerdictTtl}"
         ];
         LoadCredential = lib.mapAttrsToList (id: path: "${id}:${path}") metricsAuthStoreFiles;