Fix Hermes plugin config: use config file instead of env vars

Hermes plugins don't inherit container env vars. Switch the Miniflux
plugin to read credentials from a config.json written by Ansible,
and drop requires_env / container env vars.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/ansible/playbook.yml

@@ -365,6 +365,21 @@
       notify: Restart Hermes
       tags: hermes
 
+    - name: Write Miniflux plugin config
+      copy:
+        dest: /opt/hermes/plugins/miniflux/config.json
+        owner: root
+        group: root
+        mode: '0600'
+        content: |
+          {
+            "base_url": "http://miniflux:8080",
+            "api_key": "{{ hermes_miniflux_api_key }}"
+          }
+      no_log: true
+      notify: Restart Hermes
+      tags: hermes
+
     - name: Write Hermes .env
       copy:
         dest: /opt/hermes/.env
@@ -375,7 +390,6 @@
           OPENROUTER_API_KEY={{ hermes_openrouter_api_key }}
           TELEGRAM_BOT_TOKEN={{ hermes_telegram_bot_token }}
           TELEGRAM_ALLOWED_USERS={{ hermes_telegram_allowed_users }}
-          MINIFLUX_API_KEY={{ hermes_miniflux_api_key }}
       no_log: true
       tags: hermes
 

infra/hermes/docker-compose.yml

@@ -19,8 +19,6 @@ services:
       OPENROUTER_API_KEY: "${OPENROUTER_API_KEY}"
       TELEGRAM_BOT_TOKEN: "${TELEGRAM_BOT_TOKEN}"
       TELEGRAM_ALLOWED_USERS: "${TELEGRAM_ALLOWED_USERS}"
-      MINIFLUX_API_KEY: "${MINIFLUX_API_KEY}"
-      MINIFLUX_BASE_URL: "http://miniflux:8080"
     env_file:
       - .env
 

infra/hermes/plugins/miniflux/plugin.yaml

@@ -1,10 +1,6 @@
 name: miniflux
 version: 1.0.0
 description: Read feeds and entries from the local Miniflux RSS reader
-requires_env:
-  MINIFLUX_API_KEY:
-    description: Miniflux API key (generate in Miniflux → Settings → API Keys)
-    secret: true
 provides_tools:
   - list_feeds
   - get_unread_entries

infra/hermes/plugins/miniflux/tools.py

@@ -1,10 +1,14 @@
 import json
-import os
 import urllib.request
 import urllib.error
+from pathlib import Path
 
-MINIFLUX_BASE = os.environ.get("MINIFLUX_BASE_URL", "http://miniflux:8080")
+_PLUGIN_DIR = Path(__file__).parent
-MINIFLUX_KEY = os.environ.get("MINIFLUX_API_KEY", "")
+with open(_PLUGIN_DIR / "config.json") as _f:
+    _CONFIG = json.loads(_f.read())
+
+MINIFLUX_BASE = _CONFIG.get("base_url", "http://miniflux:8080")
+MINIFLUX_KEY = _CONFIG.get("api_key", "")
 
 
 def _request(path):