grafana: forward the host env to the logs datasource plugin

nix/host-modules/swarm-grafana.nix

@@ -1340,6 +1340,14 @@ in
               # from anything that mentions Grafana.
               metrics.enabled = true;
 
+              # Grafana hands an external backend plugin only an allow-list of
+              # its environment (the proxy variables), so without this the logs
+              # datasource never sees the unit's `SSL_CERT_FILE` and rejects the
+              # log store's certificate as `x509: unknown authority`. The value
+              # is plugin ids, not variable names: each listed plugin gets the
+              # whole environment.
+              plugins.forward_host_env_vars = "victoriametrics-logs-datasource";
+
               users.auto_assign_org_role = cfg.oidc.role;
 
               # ⚠️ `$__file{}`, and required rather than optional: nixpkgs