From 9893a5f503ac46e6011e255a789ff9f35d32f9af Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 12 Oct 2026 10:35:20 +0200
Subject: [PATCH] fix(seeding): stop writing CA certificates to servers on
 startup

Remove the CA certificate seeder from production seeding. Add a regression
test verifying no CA certificate is created or remote task queued.
---
 database/seeders/ProductionSeeder.php  |  1 -
 tests/Feature/ProductionSeederTest.php | 35 ++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 tests/Feature/ProductionSeederTest.php

diff --git a/database/seeders/ProductionSeeder.php b/database/seeders/ProductionSeeder.php
index 4d492a2973..f1c1848b53 100644
--- a/database/seeders/ProductionSeeder.php
+++ b/database/seeders/ProductionSeeder.php
@@ -219,6 +219,5 @@ uZx9iFkCELtxrh31QJ68AAAAEXNhaWxANzZmZjY2ZDJlMmRkAQIDBA==
         $this->call(PopulateSshKeysDirectorySeeder::class);
         $this->call(SentinelSeeder::class);
         $this->call(RootUserSeeder::class);
-        $this->call(CaSslCertSeeder::class);
     }
 }
diff --git a/tests/Feature/ProductionSeederTest.php b/tests/Feature/ProductionSeederTest.php
new file mode 100644
index 0000000000..9e179c8516
--- /dev/null
+++ b/tests/Feature/ProductionSeederTest.php
@@ -0,0 +1,35 @@
+<?php
+
+use App\Jobs\CoolifyTask;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\User;
+use Database\Seeders\ProductionSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+use Illuminate\Support\Facades\Storage;
+
+uses(RefreshDatabase::class);
+
+it('does not contact every server on start to write the CA certificate', function () {
+    DB::table('instance_settings')->insert(['id' => 0]);
+    $user = User::factory()->create();
+    $team = $user->teams()->first();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => PrivateKey::factory()->create(['team_id' => $team->id])->id,
+    ]);
+
+    config()->set('constants.coolify.self_hosted', false);
+    Process::fake();
+    Queue::fake();
+    Storage::fake('ssh-keys');
+    Storage::fake('ssh-mux');
+
+    app(ProductionSeeder::class)->run();
+
+    expect($server->sslCertificates()->where('is_ca_certificate', true)->exists())->toBeFalse();
+    Queue::assertNotPushed(CoolifyTask::class);
+});