protonbridge: switch to attachable CLI mode, persist self-updated binary, add startupProbe

- Run bridge via 'protonmail-bridge --cli' with stdin/tty enabled so the
  CLI is attachable (kubectl attach) for first-time account login instead
  of a separate --cli process against the gRPC daemon.
- Install libfido2-1 at container start (runtime dependency).
- Persist /root/.local (Bridge's self-updated binary) on the data PVC.
- Add a startupProbe (tcp 1143, 30x10s) so slow first starts aren't killed
  by the livenessProbe; update the login/setup comments accordingly.

1 files changed, 21 insertions, 12 deletions

diff --git a/f3s/protonbridge/helm-chart/templates/deployment.yaml b/f3s/protonbridge/helm-chart/templates/deployment.yaml
index a14619c..833a810 100644
--- a/f3s/protonbridge/helm-chart/templates/deployment.yaml
+++ b/f3s/protonbridge/helm-chart/templates/deployment.yaml
@@ -72,35 +72,35 @@ spec:
           mountPath: /bridge-data
       containers:
       - name: protonbridge
-        # Bridge v3 in non-interactive daemon mode. The gRPC server embedded in bridge
-        # allows a separate CLI client process to connect for initial login and management.
-        #
-        # FIRST-TIME SETUP (run once after pod is Running):
-        #   1. Get pod name: kubectl get pod -n services -l app=protonbridge
-        #   2. Connect the interactive CLI to the running bridge daemon:
-        #        kubectl exec -it -n services <pod-name> -- /usr/lib/protonmail/bridge/bridge --cli
-        #   3. At the bridge> prompt: type 'login'
-        #   4. Enter ProtonMail email and password when prompted
-        #   5. After login, run: info   (note the IMAP/SMTP bridge passwords)
-        #   6. Type: quit  (exits CLI; bridge daemon keeps running)
+        # Bridge v3 CLI kept open with an attachable TTY so it can run headlessly.
         #
         # Session persists in pass on NFS PVC; subsequent restarts reconnect automatically.
         #
+        # ACCOUNT LOGIN (when Bridge reports no active accounts):
+        #   1. Get pod name: kubectl get pod -n services -l app=protonbridge
+        #   2. Attach to the Bridge CLI: kubectl attach -it -n services <pod-name>
+        #   3. At the bridge> prompt, type 'login' and follow the prompts
+        #   4. Type 'quit'; the pod restarts and reconnects with the saved session
+        #
         # EMAIL CLIENT SETUP (after login):
         #   IMAP: <any-r-vm-lan-ip>:30143, STARTTLS, accept self-signed cert
         #   SMTP: <any-r-vm-lan-ip>:30025, STARTTLS, accept self-signed cert
         #   Username: your ProtonMail address
         #   Password: bridge-generated password (from 'info' in the CLI above)
         image: shenxn/protonmail-bridge:latest
+        stdin: true
+        tty: true
         command:
         - /bin/bash
         - -c
         - |
           export GNUPGHOME=/bridge-data/.gnupg
           export PASSWORD_STORE_DIR=/bridge-data/.password-store
+          apt-get update -qq
+          apt-get install -y -qq --no-install-recommends libfido2-1
           socat TCP-LISTEN:25,fork TCP:127.0.0.1:1025 &
           socat TCP-LISTEN:143,fork TCP:127.0.0.1:1143 &
-          exec /usr/lib/protonmail/bridge/bridge --noninteractive
+          exec protonmail-bridge --cli
         env:
         - name: GNUPGHOME
           value: /bridge-data/.gnupg
@@ -121,11 +121,20 @@ spec:
           # The container runs as root so HOME=/root; mount a subpath for the bridge config.
           mountPath: /root/.config
           subPath: dot-config
+        - name: protonbridge-data
+          # Persist Bridge's self-updated binary across pod restarts.
+          mountPath: /root/.local
+          subPath: dot-local
         readinessProbe:
           tcpSocket:
             port: 1143
           initialDelaySeconds: 30
           periodSeconds: 15
+        startupProbe:
+          tcpSocket:
+            port: 1143
+          periodSeconds: 10
+          failureThreshold: 30
         livenessProbe:
           tcpSocket:
             port: 1143