# OpenBao

Secrets you host. OpenBao is MPL-2.0 — the Linux Foundation Vault fork. Current HashiCorp Vault is BSL, not OSI open source.

**Replaces:** HashiCorp Vault

**Tier:** Medium

## Problem

HashiCorp Vault on the IBM HashiCorp Cloud Platform is a hosted secrets meter. Vault itself moved to BSL 1.1 in 2023 — that is not an OSI open-source license. OpenBao is the MPL-2.0 fork: KV secrets, Transit, PKI, and the API many Vault clients already speak.

## Stack

- [OpenBao](https://openbao.org) — MPL-2.0 secrets manager (Vault API-compatible fork)

## Estimated SaaS cost saved

| You stop paying | Typical / year | Self-host instead |
|---|---:|---|
| HCP Vault / Vault Enterprise (small team) | $2,400 | OpenBao + a volume |

**About $2,400 / year** on a small team, before you count lock-in.

## Deploy on Railway

Placeholder: OpenBao + a volume (or integrated storage / Raft) and TLS. No one-click template in this repo yet — Start on Railway. App login stays on /stacks/auth-without-the-bill; workforce SSO on /stacks/keycloak-idp.

[Start on Railway](https://c17.io/go/railway/openbao-secrets?from=%2Fstacks%2Fopenbao-secrets.md)

[Vaultwarden if this is a password vault, not app secrets](https://c17.io/stacks/vaultwarden-passwords)

## AGENT_PROMPT

```
Replace HashiCorp Vault / HCP Vault with OpenBao (https://openbao.org).

Do not install current HashiCorp Vault and call it open source — it is BSL.
- Persist Raft / file storage on a volume. Bind the API. Enable KV v2. Create one policy and one token.
- Point one existing Vault client at the new address. Confirm a read and a write.
- Write AGENT_PROMPT.md. This holds secrets — treat the volume like production.
```

## FAQ

### Is this official Vault?

No. OpenBao is the community fork after Vault's BSL change. Many Vault APIs still work — test the engines you use (KV, Transit, PKI) before you cut over.

### Why not Vaultwarden?

Vaultwarden is a password manager (Bitwarden protocol). This page is application secrets and encryption keys. Different job.

Source: https://c17.io/stacks/openbao-secrets