Ever since I posted these two articles (here and here) about using ProtonMail Bridge on a headless WordPress/Linux server, ProtonMail Bridge has changed quite a bit.
It now has more support for non-graphical environments. For example, gnome-keyring can be replaced with a command-line password manager called pass. And ProtonMail Bridge now also has a --noninteractive option so it can run without interaction.
All this means that using ProtonMail Bridge on headless WordPress/Linux servers is now fairly easy. So I wrote this post to update how I currently use ProtonMail Bridge on my server.
pass is friendlier to headless environments than gnome-keyring. However, pass requires a GPG key. And when using ProtonMail Bridge with pass on a headless server, it is better to use a GPG key that does not require a passphrase.
That is why I had been reluctant to write this update: there is a lot to cover. I am still reluctant to explain all the details, so I only include the commands needed to create a passphrase-free GPG key, set up pass, and run ProtonMail Bridge in a headless environment using the updated approach.
Disclaimer: the practice described in this post is not safe. If the server is hacked, the ProtonMail credential may be easily obtained by hackers. So make sure the server is secure.
Prerequisites
- pass — most Linux distributions should have this in their official repositories
- GnuPG — I guess most Linux distributions should already have this
- ProtonMail Bridge v1.2.7 — I’m not sure whether all distributions provide this package. If not, one option was to download the
.debpackage for Debian-based distributions. Update: as of Sep. 07, 2021, v1.2.7 is no longer available. Please download the latest release from Bridge’s official webpage or its GitHub page. For Arch-based systems, there are several packages in AUR. Another option is to compile it from the source code on GitHub.
Step 1: Create a passphrase-free GPG key non-interactively
$ gpg --batch --passphrase '' --quick-gen-key 'ProtonMail Bridge' default default neverThe command above creates a basic GPG key, and its ID is ProtonMail Bridge. This key does not have a passphrase, so pass does not need to ask for one whenever it tries to use the key. The key does not expire.
Do not use this key for other things, such as encryption, signing, or identity. It is not safe for those purposes. Note: make sure the server has a firewall and is secure. If a hacker gets into the server, they can freely use this key to open the ProtonMail credential saved in pass. So be careful.
Step 2: set up pass
Initialize pass with a key called “ProtonMail Bridge”:
$ pass init "ProtonMail Bridge"This creates a new password database in pass (pass calls the database a password store). The GPG key ProtonMail Bridge can then be used to open that database.
If the server is multi-purpose, or even a machine for daily work, do not save other passwords or credentials in this database. Because of the passphrase-free GPG key, this database does not need a passphrase to open.
After this step, we could continue using the old way of running ProtonMail Bridge in the background, as described in this post. Alternatively, we can use the newer way described in the following steps.
Step 3: Start ProtonMail Bridge in command-line and interactive mode, then set it up
The new way to run ProtonMail Bridge in the background does not allow users to interact with the protonmail-bridge daemon. We have to set up protonmail-bridge interactively in advance. First, start protonmail-bridge in command-line mode:
$ protonmail-bridge --cliLog in to your ProtonMail account with the login command and record the username and password of the local SMTP server. Please refer to step 1 in the old post for details if you are not familiar with this. After setting up protonmail-bridge and obtaining the required information (SMTP username and password), we can now use exit to leave the interactive interface.
Step 4: Run ProtonMail Bridge in the background
This step is where it differs from the old way. Now we just execute the following two commands to start protonmail-bridge:
$ nohup protonmail-bridge --noninteractive > bridge_log.txt 2>&1 &$ disownThe commands above also redirect the output of protonmail-bridge to a file called bridge_log.txt. We can use $ cat bridge_log.txt to read that output.
One important thing is that the protonmail-bridge daemon is now non-interactive, which means there is no way to send commands to the background daemon. If we want to control or change anything in protonmail-bridge, we have to kill the daemon and then do the work through the interactive interface. This is a major drawback compared with the old method.
For example, if protonmail-bridge logs us out for some reason and requires us to sign in to the ProtonMail account again, in the old method we could just do $ echo "login" > bridge_input && echo "*ProtonMail account*" > bridge_input && echo "*ProtonMail password*" > bridge_input to log in again. With the --noninteractive method, however, we have to kill the protonmail-bridge daemon, start $ protonmail-bridge --cli, log in, exit, and then start the background daemon again.
Another example is checking the status of the daemon. In the old method, we could just do $ echo "info" > bridge_input && cat bridge_output to see whether the daemon was still working. With the --noninteractive method, we cannot issue the info command to the daemon.
Finally, we can continue with step 3 and step 4 in the old post to set up the WP Mail SMTP plugin as usual.
Also… to reduce GUI-related dependencies
For those who don’t like to install a lot of GUI-related dependencies on a server, we can compile and build protonmail-bridge from the source code on GitHub. Just build the build-nogui target with make. See the PKGBUILD of this AUR package.