Incorrect SSH key permissions (0660) set by Weblate GUI causing Git operations to fail

Describe the issue

When using Weblate's GUI to manage repositories, it creates SSH keys with incorrect permissions (0660) in the /app/data/ssh/ directory.

This causes SSH operations to fail with the following error:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0660 for '/app/data/ssh/id_rsa' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "/app/data/ssh/id_rsa": bad permissions
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0660 for '/app/data/ssh/id_ed25519' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "/app/data/ssh/id_ed25519": bad permissions
git@gitlab.com: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
 (128) 

I already tried

• I've read and searched the documentation.
• I've searched for similar filed issues in this repository.

Steps to reproduce the behavior

Steps to Reproduce

1. Deploy Weblate 5.9 official Docker image in a Kubernetes cluster
2. Use Weblate GUI to manage repository settings
3. Attempt to perform Git operations using SSH
4. Observe the permission denied errors in logs

Note: Limited reproduction steps available as the exact trigger is not fully identified.

Expected behavior

Weblate should set the correct permissions (0600) when generating or managing SSH keys to ensure they work properly with Git operations.

Screenshots

No response

Exception traceback

How do you run Weblate?

Docker container

Weblate versions

5.9

Weblate deploy checks

Additional context

Current Workaround

To fix this issue, users need to manually access the container shell via kubectl and run:

chmod 600 /app/data/ssh/id_rsa
chmod 600 /app/data/ssh/id_ed25519

Start by inspecting the Helm chart templates and values related to Weblate's /app/data/ssh/ directory and SSH key generation or mounting. Reproduce the Docker deployment in Kubernetes, verify the generated key permissions, and confirm that Git operations succeed without the unprotected private key error.