Stacks / Auth
OpenBao
Secrets you host. OpenBao is MPL-2.0 — the Linux Foundation Vault fork. Current HashiCorp Vault is BSL, not OSI open source.
The problem
HashiCorp Vault on the IBM HashiCorp Cloud Platform is a hosted secrets meter. Vault itself moved to BSL 1.1 in 2023 — that is not an OSI open-source license. OpenBao is the MPL-2.0 fork: KV secrets, Transit, PKI, and the API many Vault clients already speak.
Replaces
HashiCorp Vault
Estimated SaaS saved
$2,400
per year, small team, before lock-in
Start on RailwayVaultwarden if this is a password vault, not app secrets
Placeholder: OpenBao + a volume (or integrated storage / Raft) and TLS. No one-click template in this repo yet — Start on Railway. App login stays on /stacks/auth-without-the-bill; workforce SSO on /stacks/keycloak-idp.
The stack
- OpenBao
MPL-2.0 secrets manager (Vault API-compatible fork)
Cost table
| You stop paying | Typical / year | Self-host instead |
|---|---|---|
| HCP Vault / Vault Enterprise (small team) | $2,400 | OpenBao + a volume |
Agent setup prompt
Replace HashiCorp Vault / HCP Vault with OpenBao (https://openbao.org). Do not install current HashiCorp Vault and call it open source — it is BSL. - Persist Raft / file storage on a volume. Bind the API. Enable KV v2. Create one policy and one token. - Point one existing Vault client at the new address. Confirm a read and a write. - Write AGENT_PROMPT.md. This holds secrets — treat the volume like production.
Also as markdown: /stacks/openbao-secrets.md
FAQ
- Is this official Vault?
- No. OpenBao is the community fork after Vault's BSL change. Many Vault APIs still work — test the engines you use (KV, Transit, PKI) before you cut over.
- Why not Vaultwarden?
- Vaultwarden is a password manager (Bitwarden protocol). This page is application secrets and encryption keys. Different job.