Community Apps

OpenBao

By OrcVole

Open source secrets management that survives restarts

2.7.1 1024MB Updated 22 Oct 2026
Package Website Documentation
security secrets vault encryption
Install this app
In your Cloudron dashboard, open the App Store, choose "Community apps" and paste this URL:
https://raw.githubusercontent.com/OrcVole/openbao-cloudron/main/CloudronVersions.json

Description

2.7.1

OpenBao is an open source identity-based secrets and encryption management system, a community-driven fork of HashiCorp Vault stewarded by the Linux Foundation under the OpenSSF. It provides a central, audited place to store, generate and control access to secrets: API keys, passwords, certificates and encryption keys, with a web UI, a CLI and a Vault-compatible HTTP API.

This package is built for unattended operation on Cloudron:

  • Auto-unseal by default. The package configures OpenBao's built-in static key seal, so the instance comes back serving secrets after every restart and automatic update with no human intervention. (Self-hosted Vault and OpenBao installations normally require an operator to paste unseal key shares after every restart.)
  • Initialised out of the box. On first start the package initialises OpenBao, enables the KV v2 secrets engine and a file audit device, and leaves the root token and recovery keys for you in /app/data/.secrets.
  • Consistent backups. Integrated raft storage is snapshotted hourly with OpenBao's own snapshot mechanism, and the snapshots ride Cloudron backups. Restores and clones rebuild the store from the newest snapshot automatically.
  • Honest health reporting. A sealed instance reports unhealthy to Cloudron instead of pretending all is well.
  • Cloudron sign-on and app integration. Cloudron accounts can log in to the UI via OIDC (with no access to secrets until granted), and other apps consume the Vault-compatible API with AppRole credentials.

The convenience of auto-unseal has a stated cost: the unseal key lives on the same server as the data it protects. Read the post-install notes for the threat model and the hardening steps (off-server copies of the recovery material and encrypted Cloudron backups). A manual-unseal (Shamir) mode is available for operators who prefer it.

This is an unofficial community package. It is not affiliated with or endorsed by the OpenBao project, the Linux Foundation, or Cloudron. OpenBao is distributed unmodified under the Mozilla Public License 2.0; source code is at https://github.com/openbao/openbao.

Screenshot

Recent Changes

  • OpenBao 2.6.4 to 2.7.1. Why now: upstream support for the 2.6 line is ending. This is not a security

  • catch-up: 2.6.4 already carried the fixes of 2.7.0 and 2.7.1 (the same fifteen advisories).

  • LDAP, RADIUS and Kerberos auth and the LDAP secrets engine are now bundled plugins. OpenBao 2.7

  • removed these four engines from the main program. This package ships all four as the upstream

  • openbao-plugins v0.1.0 releases (auth-ldap, auth-radius, auth-kerberos, secrets-ldap), each

  • verified at build time against OpenBao's release signing key and a pinned checksum, installed in a

  • read-only directory and registered on every start. They are first releases (v0.1.0).

  • Existing mounts carry over. If your install already has an LDAP, RADIUS or Kerberos auth mount, or an

  • LDAP secrets mount, it is switched to the bundled plugin automatically on the first start after this

  • update (the log says [plugins] ... now runs plugin v0.1.0). Its configuration, users, group mappings,

  • policies and entity ids are untouched; the same users sign in with the same policies. The step needs the

  • stored root token (/app/data/.secrets/root-token); if you deleted it, the log says so, and you run

  • bao auth tune -plugin-version=v0.1.0 <mount>/ (or bao secrets tune ... for the LDAP secrets engine)

  • yourself with any token allowed to tune the mount. A mount that shows in bao auth list but fails every

  • request after an update is this case.

  • Command line: LDAP login. The 2.7 bao client no longer has the ldap login method (upstream

  • openbao-plugins issue 145, open at the time of writing), so bao login -method=ldap fails, on the

  • bao in this app and on your own machine if it is 2.7. Workaround, same result:

  • bao login -method=userpass -path=<your ldap mount> (for example -path=ldap), and enter your LDAP

  • username and password. The web UI and the API (/v1/auth/<mount>/login/<user>) are unaffected.

  • PKI: a certificate name ending in a trailing dot (example.com.) is no longer accepted by the PKI engine

  • (upstream 2.7.0). The package does not enable PKI; this only matters if you did.

  • Config: the package now sets plugin_directory and plugin_auto_register in its managed config file.

  • Do not set plugin_directory in main.hcl.

  • Base image cloudron/base 6.0.0 to 6.0.1: Ubuntu security updates, including the removal of the

  • compromised eMudhra emSign ECC Root CA - G3 from the trusted certificates.