bine VS sslh

That is a bummer, although for now I guess it would be better than nothing to reach out to api.protonmail.ch through Tor. I'd be more motivated if it were an onion though. I had a look at the likely places it would need to be modified: https://github.com/ProtonMail/proton-bridge/search?q=dial and I think all it would take is to make a struct that extends https://github.com/cretz/bine so that it implements TLSDialer to make a drop-in Tor based connection. That would be very thorough and pretty escape-proof. I'm steadily talking myself into doing it...

Sure. I wrote https://github.com/cretz/bine (though I admittedly don't work on it much these days). I just have a few-line daemon that starts an HTTP (or gRPC or whatever) server on ephemeral onion service. Then I use that onion ID to access it (via TorBrowser or Orbot or a client built with the same library).

> Or a self-hosted option where the API could be deployed to the company's cloud of choice?

Can put it on Tor and give an ephemeral onion link (I wrote https://github.com/cretz/bine to help w/ just these use cases). So people could access via Tor browser or via the same CLI with a "client"/"get" command. Can even have the ephemeral server determine its been HTTP "GET"d and kill itself. Then you don't even need a public website.

Shameless plug, I also wrote a simple lib that makes onion services easy: https://github.com/cretz/bine (OP's project uses a fork of it and I plan on putting more time into it soon)

https://github.com/ipsn/go-libtor and https://github.com/cretz/bine are excellent libraries to get you started. They do exactly what you are asking.

That already has a (brutal) solution now - sslh https://www.rutschle.net/tech/sslh/README.html - the current version is more sophisticated, but it was originally just a perl script that would send the connection to sshd or the https web server, based on regex matching on an initial string (and I probably timing out and going to sshd if it didn't see one? Something like that, I haven't dug out the old code to check.)

Maybe something like https://github.com/yrutschle/sslh would work? Although it will probably break mobile client as well.

I think you're looking for sslh.

However, there is a hacky tool that should fit your use case, you could try that: https://www.rutschle.net/tech/sslh/README.html

I haven’t tried it but have a look here. TBH I didn’t even know sslh supported UDP!