From 4bdf03db692d87340f5a706581e16a24a37e111a Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 5 Nov 2026 11:26:31 +0100
Subject: [PATCH] fix(keys): generate 4096-bit RSA keys

GitHub rejects new RSA SSH keys smaller than 3072 bits, and phpseclib
made 2048-bit keys by default, so new RSA deploy keys from Coolify
could not authenticate.

Closes #12461

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 bootstrap/helpers/shared.php      |  5 ++++-
 tests/Unit/GenerateSshKeyTest.php | 15 +++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 tests/Unit/GenerateSshKeyTest.php

diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index 5afb07319a..4a22597ec6 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -743,10 +743,13 @@ function generate_random_name(?string $cuid = null): string
 
     return Str::kebab("{$generator->getName()}-$cuid");
 }
+/**
+ * RSA keys get 4096 bits: GitHub rejects new RSA SSH keys smaller than 3072 bits, and phpseclib makes 2048-bit keys by default.
+ */
 function generateSSHKey(string $type = 'rsa')
 {
     if ($type === 'rsa') {
-        $key = RSA::createKey();
+        $key = RSA::createKey(4096);
 
         return [
             'private' => $key->toString('PKCS1'),
diff --git a/tests/Unit/GenerateSshKeyTest.php b/tests/Unit/GenerateSshKeyTest.php
new file mode 100644
index 0000000000..526dc000fb
--- /dev/null
+++ b/tests/Unit/GenerateSshKeyTest.php
@@ -0,0 +1,15 @@
+<?php
+
+use phpseclib3\Crypt\PublicKeyLoader;
+use phpseclib3\Crypt\RSA;
+
+it('generates RSA keys that GitHub accepts (at least 3072 bits)', function () {
+    $keyPair = generateSSHKey('rsa');
+
+    $privateKey = PublicKeyLoader::load($keyPair['private']);
+    $publicKey = PublicKeyLoader::load($keyPair['public']);
+
+    expect($privateKey)->toBeInstanceOf(RSA\PrivateKey::class)
+        ->and($privateKey->getLength())->toBeGreaterThanOrEqual(3072)
+        ->and($publicKey->getLength())->toBe($privateKey->getLength());
+});