From 2f7a063f989b88f2a3636edb8ed019dbcccf669d Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Mon, 20 Jul 2026 22:23:38 +0300 Subject: protonbridge: switch to attachable CLI mode, persist self-updated binary, add startupProbe - Run bridge via 'protonmail-bridge --cli' with stdin/tty enabled so the CLI is attachable (kubectl attach) for first-time account login instead of a separate --cli process against the gRPC daemon. - Install libfido2-1 at container start (runtime dependency). - Persist /root/.local (Bridge's self-updated binary) on the data PVC. - Add a startupProbe (tcp 1143, 30x10s) so slow first starts aren't killed by the livenessProbe; update the login/setup comments accordingly. --- .../helm-chart/templates/deployment.yaml | 33 ++++++++++++++-------- 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/f3s/protonbridge/helm-chart/templates/deployment.yaml b/f3s/protonbridge/helm-chart/templates/deployment.yaml index a14619c..833a810 100644 --- a/f3s/protonbridge/helm-chart/templates/deployment.yaml +++ b/f3s/protonbridge/helm-chart/templates/deployment.yaml @@ -72,35 +72,35 @@ spec: mountPath: /bridge-data containers: - name: protonbridge - # Bridge v3 in non-interactive daemon mode. The gRPC server embedded in bridge - # allows a separate CLI client process to connect for initial login and management. - # - # FIRST-TIME SETUP (run once after pod is Running): - # 1. Get pod name: kubectl get pod -n services -l app=protonbridge - # 2. Connect the interactive CLI to the running bridge daemon: - # kubectl exec -it -n services -- /usr/lib/protonmail/bridge/bridge --cli - # 3. At the bridge> prompt: type 'login' - # 4. Enter ProtonMail email and password when prompted - # 5. After login, run: info (note the IMAP/SMTP bridge passwords) - # 6. Type: quit (exits CLI; bridge daemon keeps running) + # Bridge v3 CLI kept open with an attachable TTY so it can run headlessly. # # Session persists in pass on NFS PVC; subsequent restarts reconnect automatically. # + # ACCOUNT LOGIN (when Bridge reports no active accounts): + # 1. Get pod name: kubectl get pod -n services -l app=protonbridge + # 2. Attach to the Bridge CLI: kubectl attach -it -n services + # 3. At the bridge> prompt, type 'login' and follow the prompts + # 4. Type 'quit'; the pod restarts and reconnects with the saved session + # # EMAIL CLIENT SETUP (after login): # IMAP: :30143, STARTTLS, accept self-signed cert # SMTP: :30025, STARTTLS, accept self-signed cert # Username: your ProtonMail address # Password: bridge-generated password (from 'info' in the CLI above) image: shenxn/protonmail-bridge:latest + stdin: true + tty: true command: - /bin/bash - -c - | export GNUPGHOME=/bridge-data/.gnupg export PASSWORD_STORE_DIR=/bridge-data/.password-store + apt-get update -qq + apt-get install -y -qq --no-install-recommends libfido2-1 socat TCP-LISTEN:25,fork TCP:127.0.0.1:1025 & socat TCP-LISTEN:143,fork TCP:127.0.0.1:1143 & - exec /usr/lib/protonmail/bridge/bridge --noninteractive + exec protonmail-bridge --cli env: - name: GNUPGHOME value: /bridge-data/.gnupg @@ -121,11 +121,20 @@ spec: # The container runs as root so HOME=/root; mount a subpath for the bridge config. mountPath: /root/.config subPath: dot-config + - name: protonbridge-data + # Persist Bridge's self-updated binary across pod restarts. + mountPath: /root/.local + subPath: dot-local readinessProbe: tcpSocket: port: 1143 initialDelaySeconds: 30 periodSeconds: 15 + startupProbe: + tcpSocket: + port: 1143 + periodSeconds: 10 + failureThreshold: 30 livenessProbe: tcpSocket: port: 1143 -- cgit v1.2.3