Nomploy Nomad Packs

← All packs

openbao v0.1.0

Secrets

OpenBao — an open-source (MPL-2.0) secrets manager forked from HashiCorp Vault: store, access, and distribute secrets, tokens, and certificates. Deployed as a host-networked Nomad service with file storage on a persistent volume. Requires a one-time initialize + unseal after first deploy.

nomad-pack run openbao --registry nomploy

Source ↗ Project ↗ ★ 7.5k

2 tasks http 8200 1 volume image openbao/openbao:latest
Pairs with vaultwarden
Variables 8
values.hcl

Save as values.hcl, edit, then run:

nomad-pack run openbao -f values.hcl --registry nomploy
# The name of the Nomad job.
job_name = "openbao"

# The Nomad namespace to deploy into.
namespace = "default"

# The datacenters to deploy to.
datacenters = ["*"]

# The OpenBao container image. Pin a tag in production.
image = "openbao/openbao:latest"

# Host port for the OpenBao API / UI.
port = 8200

# Docker named volume for OpenBao's file storage (/openbao/file) — encrypted secrets live here. A prestart task chowns it to the openbao user (uid 100). Back it up (and store your unseal keys separately).
data_volume = "openbao_data"

# Placement constraints — pin to one node so the local storage volume stays put. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
constraints = []

# The task resources.
resources = {
    cpu    = 300
    memory = 256
  }
NameTypeDefaultDescription
job_name string 
"openbao"
 The name of the Nomad job.
namespace string 
"default"
 The Nomad namespace to deploy into.
datacenters list 
["*"]
 The datacenters to deploy to.
image string 
"openbao/openbao:latest"
 The OpenBao container image. Pin a tag in production.
port number 
8200
 Host port for the OpenBao API / UI.
data_volume string 
"openbao_data"
 Docker named volume for OpenBao's file storage (/openbao/file) — encrypted secrets live here. A prestart task chowns it to the openbao user (uid 100). Back it up (and store your unseal keys separately).
constraints list 
[]
 Placement constraints — pin to one node so the local storage volume stays put. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
resources object 
{
    cpu    = 300
    memory = 256
  }
 The task resources.
Readme

openbao

OpenBao — an open-source (MPL-2.0) secrets manager forked from HashiCorp Vault: store and control access to tokens, passwords, certificates, and API keys, with dynamic secrets, leasing, and an audit trail. Host-networked Nomad service with file storage on a persistent volume.

Usage

nomad-pack registry add nomploy github.com/Nomploy/nomad-packs
nomad-pack run openbao --registry nomploy

In nomploy: create a Compose service, type Nomad Pack, pack openbao, custom registry github.com/Nomploy/nomad-packs, then Deploy.

Required one-time setup (initialize + unseal)

OpenBao starts sealed and empty — you must initialize and unseal it once:

export BAO_ADDR=http://<node-ip>:8200
bao operator init          # prints 5 unseal keys + an initial root token
bao operator unseal        # run 3 times, each with a different unseal key

(Or do it in the web UI at http://<node-ip>:8200/ui.) Save the unseal keys and root token somewhere safe and separate — without them the data is unrecoverable. After any restart, OpenBao is sealed again and must be unsealed.

Key variables

Variable Default Notes
image openbao/openbao:latest Pin a tag in production.
port 8200 API / UI.
data_volume openbao_data Encrypted file storage. Back it up.
constraints [] Pin to a node so the local storage stays put.
resources cpu 300 / mem 256 Lightweight.

Notes