OpenBao Cluster (Raft HA)

OSS

HashiCorp Vault–compatible OpenBao on systemd (no Docker). Installs from pinned official release assets without GitHub API calls, renders /etc/openbao/openbao.hcl with integrated Raft storage, cross-node retry_join for HA, and can auto-init + unseal every node on the first run.

by opensible ✓· ⬇ 0 installs· Security & Secrets· v1.0.0· template openbao-systemd

#secrets #openbao #vault #raft #systemd

Use in the OpenSible console

Open Infrastructure → Stack Hub Blueprints, switch the source to Cloud hub, then pick OpenBao Cluster (Raft HA) and press Use.

Default variables

defaults.json

{
  "ui": true,
  "nodes": [
    {
      "ip": "",
      "name": "bao-1",
      "ssh_port": "",
      "ssh_user": ""
    },
    {
      "ip": "",
      "name": "bao-2",
      "ssh_port": "",
      "ssh_user": ""
    },
    {
      "ip": "",
      "name": "bao-3",
      "ssh_port": "",
      "ssh_user": ""
    }
  ],
  "become": true,
  "version": "2.6.0",
  "data_dir": "/opt/openbao/data",
  "auto_init": true,
  "log_level": "info",
  "cluster_id": "opensible-bao",
  "api_address": "",
  "tls_disable": true,
  "raft_node_id": "{{ inventory_hostname }}",
  "tls_key_file": "/etc/openbao/tls/tls.key",
  "disable_mlock": true,
  "tls_cert_file": "/etc/openbao/tls/tls.crt",
  "listen_address": "0.0.0.0:8200",
  "cluster_address": "",
  "storage_backend": "raft",
  "health_http_port": 8280,
  "ssh_port_default": 22,
  "ssh_user_default": "root",
  "health_http_enabled": true
}

Versions (1)

v1.0.0playbook.yml