grafana: forward the host env to the logs datasource plugin

nix/module-eval/grafana.nix

@@ -426,6 +426,22 @@ let
         && logs.jsonData.httpHeaderName1 == "Authorization"
         && logs.secureJsonData.httpHeaderValue1 == metrics.secureJsonData.httpHeaderValue1;
     }
+    {
+      # An external plugin inherits only Grafana's proxy variables unless its
+      # id is listed here, and without `SSL_CERT_FILE` every logs query fails
+      # `x509: unknown authority`. Compared against the provisioned
+      # datasource's `type`, so renaming one side without the other fails.
+      name = "the logs datasource's plugin is handed Grafana's environment";
+      ok =
+        let
+          grafana = grafanaWithAuthelia.containers.swarm-grafana.config.services.grafana;
+          logs = lib.findFirst (
+            d: d.uid == "swarm-victorialogs"
+          ) null grafana.provision.datasources.settings.datasources;
+        in
+        logs != null
+        && lib.elem logs.type (lib.toList (grafana.settings.plugins.forward_host_env_vars or [ ]));
+    }
     {
       # The reader's half of the same mapping. The collector writes a severity
       # TEXT; nothing downstream reads it as a level unless the datasource is