Allows the bridge to be in a separate server not just localhost by gastonmorixe · Pull Request #519 · ProtonMail/proton-bridge

gastonmorixe · 2025-08-13T15:33:25Z

Caution

This is not a recommended change nor use

For very few cases and advanced users or devs, this changes the hard-coded 127.0.0.1 IP from multiple parts exposing the bridge to the whole network allowing connections from anywhere by changing the hard-coded IP to 0.0.0.0.

Do not use. Do not merge. It's just a reference for anyone who may need it for advanced or special cases.

Then build it with:

$ make build-nogui

Ignore local certificates, service script, build artifacts, and research docs to prevent accidental commits of sensitive files.

Copilot

Pull request overview

This PR aims to allow the Bridge (and related helper tools) to be accessible beyond localhost by replacing multiple hard-coded 127.0.0.1 values with 0.0.0.0 across Go and C++ components.

Changes:

Replaces loopback addresses with 0.0.0.0 in several server listeners and client connection targets.
Updates GUI/Focus/gRPC components to use 0.0.0.0 for hostnames and URLs.
Expands .gitignore entries (coverage output, local certs/scripts, research artifacts).

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
utils/smtp-send/main.go	Changes default SMTP client server address to `0.0.0.0`.
utils/port-blocker/port-blocker.go	Binds port-blocker listeners to all interfaces (`0.0.0.0`).
internal/frontend/grpc/service.go	Binds gRPC listener to all interfaces (`0.0.0.0:0`).
internal/frontend/bridge-gui/bridgepp/bridgepp/GRPC/GRPCClient.cpp	Changes GUI gRPC client target/override host to `0.0.0.0`.
internal/frontend/bridge-gui/bridgepp/bridgepp/FocusGRPC/FocusGRPCClient.cpp	Changes focus client hostname to `0.0.0.0`.
internal/frontend/bridge-gui/bridge-gui/main.cpp	Changes default API URL host to `0.0.0.0`.
internal/frontend/bridge-gui/bridge-gui-tester/GRPCServerWorker.cpp	Binds test gRPC server to all interfaces (`0.0.0.0:0`).
internal/focus/service.go	Changes focus service bind host constant to `0.0.0.0`.
internal/constants/constants.go	Changes shared Host constant to `0.0.0.0`.
internal/clientconfig/applemail_test.go	Updates disabled Apple Mail config test to use `0.0.0.0`.
internal/certs/tls.go	Changes generated TLS cert CN/SAN and tls.Config ServerName to `0.0.0.0`.
internal/bridge/debug.go	Changes diagnostic IMAP client dial address to `0.0.0.0`.
.gitignore	Adds ignores for coverage dir, certs/pems, scripts, research, and `/bridge`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-10T20:13:54Z

utils/port-blocker/port-blocker.go


 	for port := startPort; port <= endPort; port++ {
-		listener, err := net.Listen("tcp", "127.0.0.1:"+strconv.Itoa(port))
+		listener, err := net.Listen("tcp", "0.0.0.0:"+strconv.Itoa(port))


Binding the port blocker to 0.0.0.0 opens listeners on all network interfaces, which can unexpectedly expose the machine to inbound connections and interfere with other processes that expect only loopback binding. If the goal is to reserve ports locally for tests, bind to 127.0.0.1; if both behaviors are needed, add a flag to select the bind address.

Suggested change

listener, err := net.Listen("tcp", "0.0.0.0:"+strconv.Itoa(port))

listener, err := net.Listen("tcp", "127.0.0.1:"+strconv.Itoa(port))

Copilot · 2026-02-10T20:13:55Z

internal/frontend/bridge-gui/bridgepp/bridgepp/GRPC/GRPCClient.cpp

+            chanArgs.SetSslTargetNameOverride("0.0.0.0"); // for file socket, we skip name verification to avoid a confusion localhost/127.0.0.1
        } else {
-            address = QString("127.0.0.1:%1").arg(config.port);
+            address = QString("0.0.0.0:%1").arg(config.port);


Using 0.0.0.0 as the gRPC client destination address is incorrect: 0.0.0.0 is not a valid remote endpoint, so connections will typically fail. The client should connect to a concrete host (e.g., 127.0.0.1/localhost by default) and, to support a separate server, the service config needs to include a host/address field that the client uses.

Suggested change

address = QString("0.0.0.0:%1").arg(config.port);

address = QString("127.0.0.1:%1").arg(config.port);

Copilot · 2026-02-10T20:13:55Z

internal/frontend/bridge-gui/bridgepp/bridgepp/FocusGRPC/FocusGRPCClient.cpp


 Empty empty; ///< Empty protobuf message, re-used across calls.
-QString const hostname = "127.0.0.1"; ///< The hostname of the focus service.
+QString const hostname = "0.0.0.0"; ///< The hostname of the focus service.


Setting the focus service hostname to 0.0.0.0 will usually prevent the client from connecting (wildcard listen address is not a destination). Use 127.0.0.1/localhost by default, and if remote focus is a goal, include the host/address in the focus service config file instead of hard-coding it in the client.

Suggested change

QString const hostname = "0.0.0.0"; ///< The hostname of the focus service.

QString const hostname = "127.0.0.1"; ///< The hostname of the focus service.

Copilot · 2026-02-10T20:13:56Z

internal/frontend/bridge-gui/bridge-gui/main.cpp

    url.setScheme("http");
-    url.setHost("127.0.0.1");
+    url.setHost("0.0.0.0");
    url.setPort(1042);


Defaulting the API base URL host to 0.0.0.0 will break requests because 0.0.0.0 is not a valid destination address. Keep the default as 127.0.0.1/localhost, and if you need to support a remote bridge, extend the prefs override to include a host (not just a port).

Copilot · 2026-02-10T20:13:56Z

internal/clientconfig/applemail_test.go

+		(&AppleMail{}).Configure(`0.0.0.0`, 1143, 1025, true, false, `user&>>`, `<<abc&&'"def>>`, `user&a`, []byte(`ir8R9vhdNXyB7isWzhyEkQ`)),
 	)


This (disabled) Apple Mail configuration test now uses 0.0.0.0 as the hostname, but mail clients cannot connect to 0.0.0.0. Keep 127.0.0.1/localhost here, and if testing remote host behavior is desired, pass an explicit concrete IP/hostname.

Copilot · 2026-02-10T20:13:58Z

internal/focus/service.go


 const (
-	Host                 = "127.0.0.1"
+	Host                 = "0.0.0.0"


Host is now set to 0.0.0.0 (all interfaces), but the NewService doc comment below says the focus service “listens on the local host”. Either keep Host as loopback by default or introduce separate bind vs advertised host values and update the documentation accordingly.

Suggested change

Host = "0.0.0.0"

Host = "127.0.0.1"

Copilot · 2026-02-10T20:13:58Z

internal/certs/tls.go

+		IPAddresses:           []net.IP{net.ParseIP("0.0.0.0")},
 		NotBefore:             time.Now(),


Including 0.0.0.0 in the certificate IP SANs is not appropriate (it’s an unspecified/wildcard address, not a host clients connect to). Add SAN entries for real connect addresses (typically 127.0.0.1 and/or a configured external IP/hostname) instead of 0.0.0.0.

Copilot · 2026-02-10T20:13:58Z

utils/smtp-send/main.go


 var (
-	serverURL    = flag.String("server", "127.0.0.1:1025", "SMTP server address:port")
+	serverURL    = flag.String("server", "0.0.0.0:1025", "SMTP server address:port")


Defaulting the SMTP client to connect to 0.0.0.0 will fail on most systems because 0.0.0.0 is a wildcard listen address, not a routable destination. Keep the default as 127.0.0.1/localhost, and if remote SMTP is needed, require the user to pass an explicit --server host/IP.

Suggested change

serverURL = flag.String("server", "0.0.0.0:1025", "SMTP server address:port")

serverURL = flag.String("server", "127.0.0.1:1025", "SMTP server address:port")

Copilot · 2026-02-10T20:13:59Z

internal/constants/constants.go

 	// Host is the hostname of the bridge server.
-	Host = "127.0.0.1"
+	Host = "0.0.0.0"
 )


Changing constants.Host to 0.0.0.0 is problematic because it’s used both for server binds (net.Listen) and for client-facing configuration (CLI output, Apple Mail profiles, gRPC Hostname() response). 0.0.0.0 is not a valid address for clients to connect to, so this can break client configuration. Split this into separate constants/config values (e.g., ListenHost default 127.0.0.1 vs BindAllInterfaces bool, plus AdvertisedHost/ConnectHost), keeping the advertised/connect default as loopback.

Copilot · 2026-02-10T20:13:59Z

internal/certs/tls.go

 	return &tls.Config{
 		Certificates: []tls.Certificate{c},
-		ServerName:   "127.0.0.1",
+		ServerName:   "0.0.0.0",
 		ClientAuth:   tls.VerifyClientCertIfGiven,


Setting tls.Config.ServerName to 0.0.0.0 will cause hostname verification issues because clients won’t connect using 0.0.0.0, and the SNI/verification name should match a real hostname/IP present in the certificate SANs. Prefer using localhost/127.0.0.1 (or a configured advertised host) consistently between cert SANs, ServerName, and the client dial target.

ilmc888 · 2026-02-22T23:41:41Z

Might be nice to make this configurable? Can be hidden away as advanced option to avoid accidents, but would be more convenient than compiling and keeping the patch up to date.

I have been playing with systemd socket to forward requests, so my paperless container can connect to it, but stranded at a mismatch of the hostname in the certificate (127.0.0.1 vs host.containers.internal).

waTeim · 2026-02-24T04:13:36Z

Yea, just add --bind <ip>; it's for containers, kubernetes, agents. Very soon the majority will not care about the UI.

MoralCode mentioned this pull request Aug 17, 2025

Connection issues from thunderbird flatpak flathub/ch.protonmail.protonmail-bridge#162

Closed

gastonmorixe added 2 commits February 10, 2026 15:20

make it local

b9e11b7

chore: add gitignore rules for local files

a4735d1

Ignore local certificates, service script, build artifacts, and research docs to prevent accidental commits of sensitive files.

Copilot AI review requested due to automatic review settings February 10, 2026 20:08

gastonmorixe force-pushed the local-3 branch from 7367978 to a4735d1 Compare February 10, 2026 20:08

Copilot started reviewing on behalf of gastonmorixe February 10, 2026 20:09 View session

Copilot AI reviewed Feb 10, 2026

View reviewed changes

	listener, err := net.Listen("tcp", "0.0.0.0:"+strconv.Itoa(port))
	listener, err := net.Listen("tcp", "127.0.0.1:"+strconv.Itoa(port))

	address = QString("0.0.0.0:%1").arg(config.port);
	address = QString("127.0.0.1:%1").arg(config.port);

	QString const hostname = "0.0.0.0"; ///< The hostname of the focus service.
	QString const hostname = "127.0.0.1"; ///< The hostname of the focus service.

		(&AppleMail{}).Configure(`0.0.0.0`, 1143, 1025, true, false, `user&>>`, `<<abc&&'"def>>`, `user&a`, []byte(`ir8R9vhdNXyB7isWzhyEkQ`)),
		)

		IPAddresses: []net.IP{net.ParseIP("0.0.0.0")},
		NotBefore: time.Now(),

	serverURL = flag.String("server", "0.0.0.0:1025", "SMTP server address:port")
	serverURL = flag.String("server", "127.0.0.1:1025", "SMTP server address:port")

Conversation

gastonmorixe commented Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

ilmc888 commented Feb 22, 2026

Uh oh!

waTeim commented Feb 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

gastonmorixe commented Aug 13, 2025 •

edited

Loading