ProtonMail is a secure email service that offers end-to-end encryption. However, it doesn't support IMAP/SMTP without the use of Proton Bridge, which is a desktop application. In this guide, I'll show you how I setup Proton Bridge as a headless service to integrate it with my home lab setup and access my emails securely using IMAP/SMTP.

Prerequisites

This guide assumes you are using a debian based linux distro (e.g., Ubuntu) and have some familiarity with the command line.

Install some dependencies

sudo apt install pass libsecret-1-dev pkg-config gnupg dbus-x11 build-essential

Install golang (prefferably not from apt)

wget https://go.dev/dl/go1.26.3.linux-amd64.tar.gz
sudo tar -C /usr/local -xzf go1.26.3.linux-amd64.tar.gz
echo "export PATH=$PATH:/usr/local/go/bin" >> ~/.bashrc
source ~/.bashrc
 
# Verify installation
go version
# go version go1.26.3 linux/amd64

Clone Proton Bridge Repo

git clone https://github.com/ProtonMail/proton-bridge.git

Setup the User Account

We'll create a dedicated user account for running the Proton Bridge service.

sudo useradd -s /bin/false proton
sudo mkdir /home/proton
sudo chown proton: /home/proton
 
# Create a directory for Proton Bridge logs
sudo mkdir /var/log/proton-bridge
sudo chown proton: /var/log/proton-bridge

You may want to add your user to the proton group for ease of management.

sudo usermod -aG proton $USER

Create Keystore

sudo -u proton gpg --batch --passphrase '' --quick-gen-key 'ProtonMail Bridge' default default never

This will create a GPG key for the Proton Bridge service. You can verify the key creation with:

sudo -u proton gpg --list-keys

Then we'll need to setup a new password store for the Proton Bridge service:

sudo -u proton pass init "ProtonMail Bridge"
# Verify the password store is working
sudo -u proton pass ls

Compiling from Source

Now that we have all the prerequisites in place, we can begin to compile the Proton Bridge from source.

cd proton-bridge

They offer a .deb artifact, but the deb package comes with lots of graphical dependencies that we don't need for a headless setup. However, compiling from source allows us to use the make target build-nogui setup in their Makefile which excludes all the graphical dependencies and results in a much smaller binary.

Before we compile you have a decision to make, do you want to run the Proton Bridge on 127.0.0.1 or 0.0.0.0 - exposing the bridge to the internet through your server.

You can compile to 0.0.0.0 but please be aware of the possible security implications of exposing the Proton Bridge to the internet, even with strong credentials. If you choose to compile to 0.0.0.0, make sure to implement additional security measures such as firewall rules, IP whitelisting, and strong authentication to protect your email data from unauthorized access.

# Changing host to 0.0.0.0
nano internal/constants/constants.go

	// KeyChainName is the name of the entry in the OS keychain.
	KeyChainName = "bridge-v3"
 
	// Host is the hostname of the bridge server.
-	Host = "127.0.0.1"
+	Host = "0.0.0.0"
)

Actually Compiling

Ensure you are in the root of the cloned repo and run make build-nogui to compile. This should create a binary without all the GUI dependencies.

After running make build-nogui you should now have a compiled bridge binary in the root of the repo.

If you run into issues, please see troubleshooting at the end of this guide.

Verify the binary is working by running ./bridge --version and you should see the version output.

Proton Mail Bridge 3.24.2+git

If all has gone well so far, you should now have a working bridge binary that you can run. The next step would be to move the binary to a more appropriate location (e.g., /usr/local/bin) and set up a systemd service to manage the Proton Bridge as a headless service.

sudo mv bridge /usr/local/bin/proton-bridge
# OR if you want to keep the binary in the repo for whatever reason
sudo ln -s $(pwd)/bridge /usr/local/bin/proton-bridge

Authentication

It's time we finally get the Proton Bridge up and running. Execute the binary with the --cli flag to enter an interactive CLI mode.

sudo -u proton proton-bridge --cli

Use the login command and enter your ProtonMail details to authenticate. You can then use the info command to verify that you are logged in and the correct address is being used.

>>> login
Username: someone@pm.me
Password:
Authenticating ... 
Account someone was added successfully.
>>> A sync has begun for someone.
Sync (someone): 25.0% (Elapsed: 1.1s, ETA: 2.2s)
Sync (someone): 50.0% (Elapsed: 7.7s, ETA: 5.5s)
A sync has finished for someone.
>>>  # You may have to press enter to get back to the prompt after the sync finishes
>>> info
Configuration for someone@pm.me
IMAP Settings
Address:   127.0.0.1
IMAP port: 1143
Username:  someone@pm.me
Password:  superSecretPassword!
Security:  STARTTLS
 
SMTP Settings
Address:   127.0.0.1
SMTP port: 1025
Username:  someone@pm.me
Password:  superSecretPassword!
Security:  STARTTLS

Daemonizing the Service

sudo nano /etc/systemd/system/proton-bridge.service

[Unit]
Description=ProtonMail Bridge
After=network.target
 
[Service]
User=proton
ExecStart=/usr/local/bin/proton-bridge --noninteractive
StandardOutput=append:/var/log/proton-bridge/activity.log
StandardError=append:/var/log/proton-bridge/error.log
 
[Install]
WantedBy=multi-user.target

After saving and closing that file:

sudo systemctl daemon-reload
sudo systemctl enable proton-bridge --now
# Or if you want to start it without enabling it on boot
sudo systemctl start proton-bridge

Summary

You should now have a fully working headless Proton Bridge service running on your server. You can connect to the IMAP/SMTP server using the credentials provided in the info command of the CLI. This allows you to securely access your ProtonMail emails using any email client that supports IMAP/SMTP, while keeping the Proton Bridge service running in the background on your server.

Troubleshooting

Package 'libfido2', required by 'virtual:world', not found

sudo apt-get update
sudo apt-get install libfido2-dev libcbor-dev libssl-dev libcrypto++-dev
 
# Re-attempt compilation
make build-nogui