I would never expose it outside my network. The password used for authentication is too easy to brute force. If you really want to access it from anywhere, set it up for access within your network and then maybe use a VPN tunnel for devices outside the network. But anyway, setting up local access is problematic because it binds to localhost and gives you no option to change the binding address. There are several ways around this:

• Set it up behind a reverse proxy (I didn’t want to bother with this)
• Build the bridge from source after changing the binding address in the source code see https://github.com/ProtonMail/proton-bridge/pull/270 (seemed like the best option, but then I decided option 3 was better)
• Easiest option in my opinion: Set up local port forwarding with a redirection tool like rinetd, bind it to 0.0.0.0, only allow local IPs (you’d need port forwarding to access from outside anyway, but…), and redirect traffic from a particular port to the IMAP/SMTP server ports, for example: 0.0.0.0 1142 127.0.0.1 1143 (bindaddress bindport connectaddress connectport); last step was to set it up as a systemd service.

I went with the third option and it seemed like so much hassle for such a simple requirement, honestly. If you decide you want to do this, feel free to ask for my configuration files.

I use Proton as well and it’s been great, but setting up their bridge for IMAP access in a way that worked for my setup was needlessly annoying (run on a headless server and access it from other devices within the network and docker containers on said server).

This one stuck with me and resurfaces in my mind every now and then, particularly nowadays:

“We’ve arranged a global civilization in which the most crucial elements profoundly depend on science and technology. We have also arranged things so that almost no one understands science and technology. This is a prescription for disaster.” ~ Carl Sagan