The configuration files of the swh services are not consistent between the services.
Some are accessible to all the users, but some not.
Some services have passwords configured on these files so the access should be more limited.
For example:
bad:
https://forge.softwareheritage.org/source/puppet-swh-site/browse/production/site-modules/profile/manifests/swh/deploy/counters/journal_client.pp$19
good:
https://forge.softwareheritage.org/source/puppet-swh-site/browse/production/site-modules/profile/manifests/swh/deploy/rpc_server.pp$56