Deploying OpenBao

sudo apt update && sudo apt upgrade -y
sudo apt install -y ca-certificates curl gnupg

# Add Docker's official GPG key
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

# Add the Docker repository
echo "deb [arch=$(dpkg --print-architecture) \
  signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo $VERSION_CODENAME) stable" \
  | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

sudo mkdir -p /opt/openbao/{config,data,logs}
sudo chown -R 100:1000 /opt/openbao

cluster_name = "ramnode-openbao"

ui = true

storage "raft" {
  path    = "/openbao/file"
  node_id = "node1"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = true  # We will add TLS in Section 11
}

api_addr     = "http://YOUR_SERVER_IP:8200"
cluster_addr = "http://YOUR_SERVER_IP:8201"

default_lease_ttl = "168h"
max_lease_ttl     = "720h"

disable_mlock = true

services:
  openbao:
    image: openbao/openbao:latest
    container_name: openbao
    restart: unless-stopped
    cap_add:
      - IPC_LOCK
    ports:
      - "8200:8200"
      - "8201:8201"
    volumes:
      - /opt/openbao/config:/openbao/config:ro
      - /opt/openbao/data:/openbao/file
      - /opt/openbao/logs:/openbao/logs
    environment:
      BAO_ADDR: "http://127.0.0.1:8200"
      BAO_API_ADDR: "http://YOUR_SERVER_IP:8200"
    command: server
    mem_swappiness: 0

cd /opt/openbao
sudo docker compose up -d

# Verify the container is running
sudo docker compose logs -f openbao

# Install dependencies
sudo apt update && sudo apt install -y gpg wget

# Add the OpenBao GPG key and repository
wget -O- https://pkg.openbao.org/gpg.key \
  | sudo gpg --dearmor -o /usr/share/keyrings/openbao-keyring.gpg

echo "deb [signed-by=/usr/share/keyrings/openbao-keyring.gpg] \
  https://pkg.openbao.org/deb stable main" \
  | sudo tee /etc/apt/sources.list.d/openbao.list

sudo apt update
sudo apt install -y openbao

bao version
# Expected output: OpenBao v2.5.0 (...)

cluster_name = "ramnode-openbao"

ui = true

storage "raft" {
  path    = "/var/lib/openbao/data"
  node_id = "node1"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = true
}

api_addr     = "http://YOUR_SERVER_IP:8200"
cluster_addr = "http://YOUR_SERVER_IP:8201"

default_lease_ttl = "168h"
max_lease_ttl     = "720h"

sudo mkdir -p /var/lib/openbao/data
sudo chown -R openbao:openbao /var/lib/openbao

sudo systemctl enable openbao
sudo systemctl start openbao
sudo systemctl status openbao

# Add to ~/.bashrc or ~/.profile
export BAO_ADDR="http://127.0.0.1:8200"

# Reload your shell
source ~/.bashrc

# Docker method:
sudo docker exec openbao bao operator init

# Native method:
bao operator init

# Docker method:
sudo docker exec -it openbao bao operator unseal

# Native method:
bao operator unseal

# Docker method:
sudo docker exec openbao bao status

# Native method:
bao status

# Docker method:
sudo docker exec -e BAO_TOKEN="YOUR_ROOT_TOKEN" \
  openbao bao token lookup

# Native method:
bao login YOUR_ROOT_TOKEN

http://YOUR_SERVER_IP:8200

# Enable the KV v2 secrets engine at the 'secret' path
bao secrets enable -path=secret kv-v2

bao kv put secret/myapp/config \
  db_host="db.example.com" \
  db_user="appuser" \
  db_password="s3cur3P@ssw0rd"

# Read the secret
bao kv get secret/myapp/config

# Get a specific field
bao kv get -field=db_password secret/myapp/config

# Output as JSON (useful for scripts)
bao kv get -format=json secret/myapp/config

# View metadata and version history
bao kv metadata get secret/myapp/config

# Read a specific version
bao kv get -version=1 secret/myapp/config

# Allow read access to application secrets
path "secret/data/myapp/*" {
  capabilities = ["read", "list"]
}

# Allow the app to renew its own token
path "auth/token/renew-self" {
  capabilities = ["update"]
}

bao policy write myapp myapp-policy.hcl

# Verify
bao policy read myapp

bao token create -policy=myapp -ttl=24h

# Enable AppRole auth
bao auth enable approle

# Create a role for your application
bao write auth/approle/role/myapp \
  token_policies=myapp \
  token_ttl=1h \
  token_max_ttl=4h \
  secret_id_ttl=10m

# Get the Role ID
bao read auth/approle/role/myapp/role-id

# Generate a Secret ID
bao write -f auth/approle/role/myapp/secret-id

# Authenticate (from your application)
bao write auth/approle/login \
  role_id=YOUR_ROLE_ID \
  secret_id=YOUR_SECRET_ID

# For Docker deployments:
bao audit enable file file_path=/openbao/logs/audit.log

# For native deployments:
bao audit enable file file_path=/var/log/openbao/audit.log

bao audit list -detailed

/var/log/openbao/audit.log {
  daily
  rotate 30
  compress
  missingok
  notifempty
  postrotate
    /bin/kill -HUP $(cat /var/run/openbao.pid 2>/dev/null) 2>/dev/null || true
  endscript
}

sudo apt install -y nginx certbot python3-certbot-nginx

server {
    listen 443 ssl http2;
    server_name bao.yourdomain.com;

    ssl_certificate     /etc/letsencrypt/live/bao.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/bao.yourdomain.com/privkey.pem;

    location / {
        proxy_pass          http://127.0.0.1:8200;
        proxy_set_header    Host $host;
        proxy_set_header    X-Real-IP $remote_addr;
        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto $scheme;
    }
}

sudo ln -s /etc/nginx/sites-available/openbao /etc/nginx/sites-enabled/
sudo certbot --nginx -d bao.yourdomain.com
sudo systemctl reload nginx

listener "tcp" {
  address       = "0.0.0.0:8200"
  tls_cert_file = "/path/to/fullchain.pem"
  tls_key_file  = "/path/to/privkey.pem"
}

# Create a snapshot
bao operator raft snapshot save backup.snap

# Automate with cron (daily at 2 AM)
0 2 * * * /usr/bin/bao operator raft snapshot save \
  /opt/openbao/backups/bao-$(date +\%Y\%m\%d).snap

# Restore (requires initialized and unsealed server)
bao operator raft snapshot restore backup.snap