blob: b4c2fb3ed9c349ba24338c6464e80037d678e2b3 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
#+TITLE: Proton Bridge: disable the package systemd service in favor
#+SOURCE: from .emacs.d
#+DATE: 2026-05-22 13:35:21 -0500
Proton Bridge: disable the package systemd service in favor of the Hyprland GUI autostart
ISSUE
The protonmail-bridge package ships an enabled systemd USER service at /usr/lib/systemd/user/protonmail-bridge.service (ExecStart=/usr/bin/protonmail-bridge-core --noninteractive, Restart=always). hyprland.conf already autostarts the GUI build (exec-once = protonmail-bridge --no-window, line ~46). At login both fire and conflict:
1. No tray icon. The headless service grabs the IMAP/SMTP ports (127.0.0.1:1143 / :1025) before the GUI '--no-window' instance can bind, so the GUI build that would show a StatusNotifierItem tray icon never fully starts. Bridge ends up running headless with no tray and no entry feel in the session.
2. TLS cert mismatch breaks mail clients. The headless --noninteractive service can't reach gnome-keyring (it starts outside the graphical session), so it falls back to its OWN self-signed TLS cert. ~/.config/protonbridge.pem is exported from the GUI build's keychain cert, so mbsync (mu4e) and the work project's cmail-action.py both fail STARTTLS against the headless service with: SSL CERTIFICATE_VERIFY_FAILED: self-signed certificate. Looks like a 'rotated/stale cert' but is not — it's two different certs from two different bridge instances.
SOLUTION (applied on this machine 2026-05-22)
systemctl --user disable --now protonmail-bridge.service
That leaves the Hyprland exec-once GUI autostart as the sole bridge: tray icon appears, and the served cert matches ~/.config/protonbridge.pem. Verified: 'echo | openssl s_client -starttls imap -connect 127.0.0.1:1143 -CAfile ~/.config/protonbridge.pem' returns 'Verify return code: 0 (ok)', and 'mbsync -a' syncs all accounts (incl. cmail/Proton) with no TLS error.
ARCHSETUP ACTION
The fix is a per-machine systemctl state change that a fresh install would undo (the package re-enables its service). Make it durable in the setup: either mask/disable protonmail-bridge.service as part of the install, or document that the Hyprland 'exec-once = protonmail-bridge --no-window' is the intended bridge launcher and the package service must stay disabled. Don't run both.
|
