Describe the bug

On hosts where the IPv6 address family is unavailable (kernel booted with ipv6.disable=1, IPv6 module not loaded, or a Kubernetes pod netns the CNI provisioned without IPv6), the authentik worker (and intermittently the server) crash-loop at startup.

The Rust ak-axum server binds the configured listen addresses literally, and those default to the IPv6 wildcard [::] since 2026.5 (#20930). When AF_INET6 cannot be created, the bind fails with Address family not supported by protocol (os error 97) and the arbiter aborts the process (exit 1). There is no fallback to IPv4.

The default listen changed from 0.0.0.0 to [::] in #20930 (2026.5), which is when IPv6-disabled hosts began failing.

Impact is larger than "a server will not start." Because the worker never stays up, the scheduled blueprints_discovery never runs, so mounted blueprints are never (re)applied. That silently breaks config as code (OAuth2 providers, proxy outposts) after an upgrade, even while the server may intermittently keep serving. We also observed an affected worker that did not exit but instead left the Rust health server answering probes while the Python task worker was down, so the pod reports Ready and stops restarting while doing no work, which masks the outage.

How to reproduce

Minimal and self-contained. A seccomp profile makes socket(AF_INET6) return EAFNOSUPPORT, simulating a kernel without IPv6 (no cluster required):

cat > no-ipv6.json <<'JSON'
{ "defaultAction": "SCMP_ACT_ALLOW",
  "syscalls": [ { "names": ["socket"], "action": "SCMP_ACT_ERRNO", "errnoRet": 97,
    "args": [ { "index": 0, "value": 10, "op": "SCMP_CMP_EQ" } ] } ] }
JSON

docker run --rm --security-opt seccomp=no-ipv6.json ghcr.io/goauthentik/server:2026.5.4 worker
# -> Address family not supported by protocol (os error 97)
#    run_plain(metrics, [::]:9300) / run_plain(worker, [::]:9000) -> exit 1

Equivalently, on a Kubernetes node booted with ipv6.disable=1 (or a CNI that gives pods a netns without IPv6), deploy authentik and the worker enters CrashLoopBackOff.

I believe setting AUTHENTIK_LISTEN__HTTP=0.0.0.0:9000, AUTHENTIK_LISTEN__HTTPS=0.0.0.0:9443, AUTHENTIK_LISTEN__METRICS=0.0.0.0:9300 works around it by forcing it to ipv4.

Expected behavior

When binding the configured or default listen address fails because the IPv6 family is unavailable, authentik should fall back to IPv4 (bind 0.0.0.0) rather than aborting, which is what Go's net.Listen does automatically. At minimum the [::] default should not hard fail on IPv6-disabled hosts, and the need to set AUTHENTIK_LISTEN__*=0.0.0.0 should be documented.

Screenshots

No response

Additional context

No response

Deployment Method

Kubernetes

Version

2026.5.4

Relevant log output

{"level":"info","target":"authentik_axum::server","timestamp":"2026-07-22T06:03:47.913880","addr":"\"/dev/shm/authentik.sock\" (pathname)","event":"starting worker server"}
{"level":"info","target":"authentik_axum::server","timestamp":"2026-07-22T06:03:47.913831","addr":"[::]:9000","event":"starting worker server"}
{"level":"info","target":"authentik_common::arbiter","timestamp":"2026-07-22T06:03:47.913833","event":"arbiter has been told to shutdown gracefully"}
{"level":"error","target":"authentik","line_number":121,"timestamp":"2026-07-22T06:03:47.916377","event":"authentik encountered errors","err":"Address family not supported by protocol (os error 97) ... run_plain(metrics, [::]:9300) ... Address family not supported by protocol (os error 97) ... run_plain(worker, [::]:9000) ..."}


Rendered stderr:

Error:
   0: Errors encountered: [
         0: Address family not supported by protocol (os error 97)
      Location:
         packages/ak-axum/src/server.rs:30
         0: tokio::task::runtime.spawn with kind=task task.name=authentik_axum::server::run_plain(metrics, [::]:9300) task.id=21 loc.file="packages/ak-axum/src/server.rs" loc.line=56
      ...,
         0: Address family not supported by protocol (os error 97)
      Location:
         packages/ak-axum/src/server.rs:30
         0: tokio::task::runtime.spawn with kind=task task.name=authentik_axum::server::run_plain(worker, [::]:9000) task.id=29 loc.file="packages/ak-axum/src/server.rs" loc.line=56
      ]
Location:
   src/main.rs:122