add generate new tls host cert

.gitea/workflows/prod-docker-images.yml

@@ -3,7 +3,6 @@ on:
   push:
     branches:
       - main
-  workflow_dispatch:
 
 jobs:
   build-and-push:
@@ -33,7 +32,7 @@ jobs:
       - name: Build and push Docker image
         uses: docker/build-push-action@v7
         with:
-          context: .
+          context: ./build
           push: true
           tags: |
             ${{ vars.DOCKER_REGISTRY_URL }}/${{ env.REPO_OWNER_LC }}/protonmail-bridge:latest

VERSION

@@ -1 +1 @@
-v3.25.0
+v3.22.0

build/Dockerfile

@@ -32,15 +32,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 # Copy bash scripts
 COPY gpgparams entrypoint.sh /protonmail/
-COPY scripts/generate_new_certs.sh /root/generate_new_certs.sh
+COPY generate_new_certs.sh /root/generate_new_certs.sh
 WORKDIR /protonmail/
 
-# Copy Proton Mail Bridge.
+# Copy protonmail
-# Important: use the patched nogui `bridge` binary as both executable names.
+COPY --from=build /build/proton-bridge/bridge /usr/bin/
-# The upstream `proton-bridge` launcher can auto-update into an official binary
+COPY --from=build /build/proton-bridge/proton-bridge /usr/bin/
-# that still binds IMAP/SMTP to 127.0.0.1, bypassing our 0.0.0.0 patch.
+COPY --from=build /build/proton-bridge/vault-editor /usr/bin/
-COPY --from=build /build/proton-bridge/bridge /usr/bin/bridge
-COPY --from=build /build/proton-bridge/bridge /usr/bin/proton-bridge
-COPY --from=build /build/proton-bridge/vault-editor /usr/bin/vault-editor
 
 ENTRYPOINT ["bash", "/protonmail/entrypoint.sh"]

build/entrypoint.sh

@@ -18,29 +18,20 @@ if [ ! -d "/root/.password-store" ]; then
   pass init "$KEY"
 fi
 
-# Avoid launching Proton's auto-updated upstream binary from the persisted
-# /root volume. Those official binaries bind IMAP/SMTP to 127.0.0.1. This image
-# deliberately runs the patched nogui binary from /usr/bin, built with host
-# constant 0.0.0.0.
-rm -rf /root/.local/share/protonmail/bridge-v3/updates
-
-BRIDGE_BIN=/usr/bin/bridge
-
 # Initialize
 if [[ "$1" == "init" ]]; then
   # Kill the other instance as only one can be running at a time.
   # This allows users to run entrypoint init inside a running conainter
   # which is useful in a k8s environment.
   # || true to make sure this would not fail in case there is no running instance.
-  pkill bridge || true
+  pkill protonmail-bridge || true
-  pkill proton-bridge || true
 
   # Run any ProtonMail Bridge Command - Login
-  "$BRIDGE_BIN" --cli "$@"
+  proton-bridge --cli "$@"
 else
   # Start ProtonMail Bridge
   # Fake a terminal, so it does not quit because of EOF...
   rm -f faketty
   mkfifo faketty
-  cat faketty | "$BRIDGE_BIN" --cli "$@"
+  cat faketty | proton-bridge --cli "$@"
 fi