Proton Mail Setup for NeoMutt

Because Proton Mail uses end-to-end encryption, standard email clients cannot connect directly to Proton Mail servers using normal IMAP/SMTP.

To access Proton Mail via NeoMutt, you must run a bridge service locally that decrypts/encrypts messages on your machine and exposes local IMAP/SMTP endpoints for NeoMutt.

1. Prerequisites: Bridge Service Options

There are two primary ways to run the bridge on Linux:

Option A: Official Proton Mail Bridge (Recommended for paid accounts)

The official desktop/CLI bridge provided by Proton.

Download and install Proton Mail Bridge from the official site or package manager:

# Arch Linux (AUR)
yay -S protonmail-bridge

# Debian / Ubuntu (via official DEB package)
sudo dpkg -i protonmail-bridge_*.deb

Open Proton Mail Bridge and log in with your Proton credentials.
Note down the local IMAP/SMTP credentials generated by Bridge (typically):
- IMAP Host: 127.0.0.1 (Port 1143, STARTTLS)
- SMTP Host: 127.0.0.1 (Port 1025, STARTTLS)
- Username: Your full Proton email address
- Password: Bridge-generated app password (not your main Proton password)

Option B: Hydroxide (Open-Source CLI Bridge)

A lightweight third-party open-source CLI bridge written in Go. Works great on headless servers.

Install Hydroxide:
```
# Arch Linux
sudo pacman -S hydroxide
```
Authenticate with Proton Mail:
```
hydroxide auth <your-username>
```
Start Hydroxide services:
```
hydroxide imap &
hydroxide smtp &
```
Generate bridge status/credentials:
```
hydroxide card
```

2. NeoMutt Configuration (`~/.config/neomutt/neomuttrc`)

Add the following profile block to your ~/.config/neomutt/neomuttrc (or create a dedicated profile file like ~/.config/neomutt/profiles/proton):

# ==============================================================================
# Proton Mail Account Settings
# ==============================================================================
set realname = "Your Name"
set from = "your.email@proton.me"
set use_from = yes

# Authentication details (Proton Bridge local credentials)
set imap_user = "your.email@proton.me"
set imap_pass = "your-bridge-generated-password"

# Local Bridge IMAP Settings
set folder = "imap://127.0.0.1:1143/"
set spoolfile = "+INBOX"
set postponed = "+Drafts"
set record = "+Sent"
set trash = "+Trash"

# Local Bridge SMTP Settings
set smtp_url = "smtp://your.email@proton.me@127.0.0.1:1025/"
set smtp_pass = "your-bridge-generated-password"

# Disable SSL verification for localhost STARTTLS (Bridge handles encryption)
set ssl_starttls = yes
set ssl_force_tls = no

# Mailboxes for NeoMutt Sidebar
named-mailboxes "Inbox"   "+INBOX"
named-mailboxes "Drafts"  "+Drafts"
named-mailboxes "Sent"    "+Sent"
named-mailboxes "Archive" "+Archive"
named-mailboxes "Spam"    "+Spam"
named-mailboxes "Trash"   "+Trash"

# Cache Directories
set header_cache = "~/.cache/neomutt/proton/headers"
set message_cachedir = "~/.cache/neomutt/proton/bodies"

Ensure the local cache directories exist:

mkdir -p ~/.cache/neomutt/proton/headers ~/.cache/neomutt/proton/bodies

3. Securing Bridge Credentials with GPG

As with Gmail, encrypt your local Bridge password using GPG:

Store password in encrypted file:

echo "your-bridge-generated-password" | gpg -e -r "your.email@proton.me" -o ~/.config/neomutt/proton_pass.gpg

In ~/.config/neomutt/neomuttrc, dynamically set credentials:

set imap_pass = `gpg --batch --quiet --decrypt ~/.config/neomutt/proton_pass.gpg`
set smtp_pass = `gpg --batch --quiet --decrypt ~/.config/neomutt/proton_pass.gpg`

4. Running as a Background Service (Systemd)

To make sure the Bridge runs automatically in the background so NeoMutt can connect anytime:

Create ~/.config/systemd/user/proton-bridge.service:

[Unit]
Description=Proton Mail Bridge
After=network.target

[Service]
ExecStart=/usr/bin/protonmail-bridge --non-interactive
Restart=on-failure

[Install]
WantedBy=default.target

Enable and start the service:

systemctl --user daemon-reload
systemctl --user enable --now proton-bridge