# Proton Mail Setup for NeoMutt

Because Proton Mail uses end-to-end encryption, standard email clients cannot connect directly to Proton Mail servers using normal IMAP/SMTP.

To access Proton Mail via NeoMutt, you must run a **bridge service** locally that decrypts/encrypts messages on your machine and exposes local IMAP/SMTP endpoints for NeoMutt.

---

## 1. Prerequisites: Bridge Service Options

There are two primary ways to run the bridge on Linux:

### Option A: Official Proton Mail Bridge (Recommended for paid accounts)
The official desktop/CLI bridge provided by Proton.

1. Download and install **Proton Mail Bridge** from the official site or package manager:
   ```bash
   # Arch Linux (AUR)
   yay -S protonmail-bridge
   
   # Debian / Ubuntu (via official DEB package)
   sudo dpkg -i protonmail-bridge_*.deb
   ```
2. Open Proton Mail Bridge and log in with your Proton credentials.
3. Note down the local IMAP/SMTP credentials generated by Bridge (typically):
   - **IMAP Host**: `127.0.0.1` (Port `1143`, STARTTLS)
   - **SMTP Host**: `127.0.0.1` (Port `1025`, STARTTLS)
   - **Username**: Your full Proton email address
   - **Password**: Bridge-generated app password (not your main Proton password)

---

### Option B: Hydroxide (Open-Source CLI Bridge)
A lightweight third-party open-source CLI bridge written in Go. Works great on headless servers.

1. Install Hydroxide:
   ```bash
   # Arch Linux
   sudo pacman -S hydroxide
   ```
2. Authenticate with Proton Mail:
   ```bash
   hydroxide auth <your-username>
   ```
3. Start Hydroxide services:
   ```bash
   hydroxide imap &
   hydroxide smtp &
   ```
4. Generate bridge status/credentials:
   ```bash
   hydroxide card
   ```

---

## 2. NeoMutt Configuration (`~/.config/neomutt/neomuttrc`)

Add the following profile block to your `~/.config/neomutt/neomuttrc` (or create a dedicated profile file like `~/.config/neomutt/profiles/proton`):

```muttrc
# ==============================================================================
# Proton Mail Account Settings
# ==============================================================================
set realname = "Your Name"
set from = "your.email@proton.me"
set use_from = yes

# Authentication details (Proton Bridge local credentials)
set imap_user = "your.email@proton.me"
set imap_pass = "your-bridge-generated-password"

# Local Bridge IMAP Settings
set folder = "imap://127.0.0.1:1143/"
set spoolfile = "+INBOX"
set postponed = "+Drafts"
set record = "+Sent"
set trash = "+Trash"

# Local Bridge SMTP Settings
set smtp_url = "smtp://your.email@proton.me@127.0.0.1:1025/"
set smtp_pass = "your-bridge-generated-password"

# Disable SSL verification for localhost STARTTLS (Bridge handles encryption)
set ssl_starttls = yes
set ssl_force_tls = no

# Mailboxes for NeoMutt Sidebar
named-mailboxes "Inbox"   "+INBOX"
named-mailboxes "Drafts"  "+Drafts"
named-mailboxes "Sent"    "+Sent"
named-mailboxes "Archive" "+Archive"
named-mailboxes "Spam"    "+Spam"
named-mailboxes "Trash"   "+Trash"

# Cache Directories
set header_cache = "~/.cache/neomutt/proton/headers"
set message_cachedir = "~/.cache/neomutt/proton/bodies"
```

Ensure the local cache directories exist:
```bash
mkdir -p ~/.cache/neomutt/proton/headers ~/.cache/neomutt/proton/bodies
```

---

## 3. Securing Bridge Credentials with GPG

As with Gmail, encrypt your local Bridge password using GPG:

1. Store password in encrypted file:
   ```bash
   echo "your-bridge-generated-password" | gpg -e -r "your.email@proton.me" -o ~/.config/neomutt/proton_pass.gpg
   ```
2. In `~/.config/neomutt/neomuttrc`, dynamically set credentials:
   ```muttrc
   set imap_pass = `gpg --batch --quiet --decrypt ~/.config/neomutt/proton_pass.gpg`
   set smtp_pass = `gpg --batch --quiet --decrypt ~/.config/neomutt/proton_pass.gpg`
   ```

---

## 4. Running as a Background Service (Systemd)

To make sure the Bridge runs automatically in the background so NeoMutt can connect anytime:

Create `~/.config/systemd/user/proton-bridge.service`:

```ini
[Unit]
Description=Proton Mail Bridge
After=network.target

[Service]
ExecStart=/usr/bin/protonmail-bridge --non-interactive
Restart=on-failure

[Install]
WantedBy=default.target
```

Enable and start the service:
```bash
systemctl --user daemon-reload
systemctl --user enable --now proton-bridge
```