Deploy and Host OpenBao on Railway

OpenBao is an open-source secrets manager and a Linux Foundation fork of HashiCorp Vault under the MPL license. It stores and encrypts secrets, issues dynamic database credentials, signs certificates, encrypts data as a service and controls access with policies. Existing Vault clients, SDKs and the Vault API work with it.

About Hosting OpenBao

This template deploys OpenBao v2.7.0 from the official image with integrated Raft storage on a Railway volume. It unseals itself on every start with a generated static key, and self-initializes on first boot: it enables username and password login with an admin user, creates an admin policy, mounts a KV v2 engine at secret/ and revokes the root token. The web UI and API run on your Railway domain. OpenBao is light and fits the Hobby plan. Keep BAO_UNSEAL_KEY safe, because without it the stored data cannot be decrypted. Back up the volume regularly.

Common Use Cases

Central secrets storage for apps, CI pipelines and infrastructure
Dynamic, short-lived database credentials
Encryption as a service and internal certificate authorities

Dependencies for OpenBao Hosting

openbao/openbao:2.7.0 (official image)
A Railway volume at /openbao/file for Raft storage

Deployment Dependencies

Implementation Details

Service	Image	Networking	Storage
openbao	`openbao/openbao:2.7.0`	public domain on 8200; private	volume at `/openbao/file`

export BAO_ADDR=https://
bao login -method=userpass username=admin
bao kv put secret/my-app db_password=s3cret
bao kv get secret/my-app

Variable	Default	Purpose
`BAO_UNSEAL_KEY`	generated (64 hex)	Static seal key; never change or lose it
`BAO_ADMIN_PASSWORD`	generated	Password for the `admin` user, set at initialization
`BAO_LOCAL_CONFIG`	JSON config	Listener, Raft storage, seal and self-init requests

Notes:

The static seal protects data at rest with a key stored in Railway variables; for stricter setups, move to a KMS-based seal.
Self-initialization only runs once, on an empty volume.

This is a community-maintained deployment package and does not imply affiliation with or endorsement by the OpenBao project or its maintainers.

Why Deploy OpenBao on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying OpenBao on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.