English
OpenBao Hosting
OpenBao is an open-source secrets manager, forked from Vault, for storing tokens, encryption keys, and short-lived credentials.
- One click deploy
- 25 GB Disk Space Needed
- 2 GB RAM Memory needed
- From 5 € Price
No setup fees
Official links
OpenBao’s official links and original website
- Go to Repository
OpenBao GitHub
- More
OpenBao Website
What you get
on AvaHost
One-click deployment, a custom domain, free HTTPS, automatic application updates, and scheduled backups come with every Cloud App. You can run multiple apps on one server, and terminal access is included.
This template does not include a database container.
Tech
- Docker image
- openbao/openbao:latest
- Default port
- 0
How OpenBao works
OpenBao is the open-source secrets manager forked from Vault after HashiCorp's licence change. It exposes an HTTP API and a UI for secrets, encryption, and dynamic credentials. Official images are published as openbao/openbao on Docker Hub, GHCR, and Quay. The install page also offers packages and a binary. Integrated storage keeps data inside OpenBao's own raft data, so this baseline does not add PostgreSQL or MariaDB. The Docker note on the install page asks for memory swappiness set to 0 on the container. That is a runtime flag, not a second service.
Initialization produces unseal keys and a root token. Those must be stored by you, offline from the only copy on the server. If they exist only on the VPS and the disk is lost, the platform backup may restore ciphertext you still cannot unseal. This page will not pretend otherwise. A single-node integrated-storage install is the baseline. Multi-node raft and external storage backends are upstream options for later.
Key OpenBao features
You enable auth methods and secrets engines the way Vault operators expect, and you should read current OpenBao docs for which engines you rely on, because parity is a moving target. Policies decide which tokens can read which paths. Audit devices are optional and are the right place for an access trail. TLS belongs on the hostname. The UI is convenient and is also a high-value target, so restrict who can reach it.
AvaHost updates the container automatically and backs up the data directory on a schedule. You still follow OpenBao's upgrade notes and you still test unseal after a change. Application mail is not included with OpenBao. A dedicated public IP is not required if the API is reached through the HTTPS hostname.
OpenBao vs HashiCorp Vault
OpenBao
OpenBao is the community-governed fork you can run without Vault's current vendor licence. HashiCorp Vault is the vendor product, with its own releases, support, and licence terms. Choose Vault when a contract or a specific enterprise feature requires it. Choose OpenBao when you want the self-hosted secrets server under the fork's governance.
HashiCorp Vault
Do not assume every Vault enterprise feature exists here. Check the engine you need in the OpenBao docs before you migrate a production path.
Who uses OpenBao
Platform teams who already think in policies and unseal keys use OpenBao. It is a poor fit if nobody will store the unseal material, and it is a poor fit as a casual password notebook. The 2 GB baseline is a modest production starting point, not a large raft cluster.
Self-hosting OpenBao: requirements and cost
The baseline is 2048 MB of RAM and 1 CPU core, image openbao/openbao, integrated storage, no separate database container. On AvaHost the recommended minimum for OpenBao is Plan 2 at €5. The OpenBao package includes one-click deployment, a hostname, automated HTTPS, automatic updates, and scheduled backups of the data directory. You supply and safeguard unseal keys. Application mail is not included with OpenBao.
F.A.Q
OpenBao starts at €5 on Plan 2. The price covers the server and its integrated storage, not a multi-node raft and not a support contract. Audit logs and a large number of dynamic leases can justify more disk or RAM. Anything your applications still buy from a cloud KMS stays on that cloud bill.
Yes. Put the API and UI on a hostname you control, with automated HTTPS. Clients and jobs should use that name, not a raw address. You manage DNS, the policies, and who may open the UI. A dedicated public IP is not required for this HTTPS service.
AvaHost updates OpenBao automatically and backs up the data directory on a schedule. Restoring files does not recreate unseal keys that were not saved. Store those keys outside the VPS. After an update, unseal, sign in, and read one non-production secret before you call the upgrade finished.
Unseal and recovery material. The server can be healthy and still be unreadable if those keys are gone. Integrated storage avoids a separate database, and it concentrates risk in that data directory plus the keys. This baseline is a single node. A raft cluster is a later design, not the Plan 2 minimum.