OpenBao: Secrets Management, Openly Governed
OpenBao stores secrets so they are not in your configuration files, your environment variables, or your Git history. It is a fork of HashiCorp Vault created after Vault moved to the Business Source License, and it is governed under the Linux Foundation.
The problem
Every application needs credentials: database passwords, API keys, certificates. Those end up in a .env file, a Compose file, or a repository, where they are readable by anyone with access and impossible to rotate without redeploying.
OpenBao holds them encrypted, hands them out to authenticated callers, and logs every access.
What it does beyond storage
Dynamic secrets are the feature worth understanding. Rather than storing a database password, OpenBao creates a new short-lived database user on request and revokes it when the lease expires. A leaked credential is useless within hours and nothing needs rotating manually because nothing is long-lived.
Encryption as a service lets applications encrypt and decrypt data through OpenBao without ever holding the key themselves.
Certificate authority functionality issues short-lived internal certificates, which is a reasonable answer to TLS on a private network where Let’s Encrypt cannot help.
Audit logging records every access, which is often the actual compliance requirement.
Unsealing
At rest, the storage is encrypted and OpenBao starts sealed. It needs unseal keys before it will serve anything, and by default those are split so several are required.
That is a genuine operational consideration: a restart means an unseal step. Auto-unseal against a cloud KMS or a hardware module removes the manual step and moves the trust somewhere else.
The lighter alternative
For a homelab, OpenBao is often more than the situation requires. Infisical is friendlier for straightforward application secrets, and a well-permissioned file may be adequate for a single-user setup.
OpenBao earns its complexity when you need dynamic credentials, audit trails, or many applications and people sharing controlled access.
License
OpenBao is released under the Mozilla Public License 2.0.