---
title: "Deploy OpenBao"
description: "OpenBao 2.7 secrets manager with auto-unseal, admin login and KV store."
category: "Authentication"
url: https://railway.com/deploy/openbao-1
---

# Deploy OpenBao

OpenBao 2.7 secrets manager with auto-unseal, admin login and KV store.

**[Deploy OpenBao on Railway](https://railway.com/template/openbao-1)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/openbao-1/manifest.json

- **Creator:** Agaz Self-Host
- **Category:** Authentication

## Template content

### openbao https://github.com/openbao.png

- **Image:** openbao/openbao:2.7.0
- **Start command:** `docker-entrypoint.sh server`
- **Health check:** /v1/sys/health
- **Public domain:** Yes

## Documentation

# Deploy and Host OpenBao on Railway

OpenBao is an open-source secrets manager and a Linux Foundation fork of HashiCorp Vault under the MPL license. It stores and encrypts secrets, issues dynamic database credentials, signs certificates, encrypts data as a service and controls access with policies. Existing Vault clients, SDKs and the Vault API work with it.

## About Hosting OpenBao

This template deploys OpenBao v2.7.0 from the official image with integrated Raft storage on a Railway volume. It unseals itself on every start with a generated static key, and self-initializes on first boot: it enables username and password login with an `admin` user, creates an admin policy, mounts a KV v2 engine at `secret/` and revokes the root token. The web UI and API run on your Railway domain. OpenBao is light and fits the Hobby plan. Keep `BAO_UNSEAL_KEY` safe, because without it the stored data cannot be decrypted. Back up the volume regularly.

## Common Use Cases

- Central secrets storage for apps, CI pipelines and infrastructure
- Dynamic, short-lived database credentials
- Encryption as a service and internal certificate authorities

## Dependencies for OpenBao Hosting

- `openbao/openbao:2.7.0` (official image)
- A Railway volume at `/openbao/file` for Raft storage

### Deployment Dependencies

- [OpenBao documentation](https://openbao.org/docs/)
- [OpenBao v2.7.0 release](https://github.com/openbao/openbao/releases/tag/v2.7.0)
- [Declarative self-initialization](https://openbao.org/docs/configuration/self-init/)
- [Railway volumes](https://docs.railway.com/reference/volumes)

### Implementation Details

| Service | Image | Networking | Storage |
| --- | --- | --- | --- |
| openbao | `openbao/openbao:2.7.0` | public domain on 8200; private | volume at `/openbao/file` |

```bash
export BAO_ADDR=https://
bao login -method=userpass username=admin
bao kv put secret/my-app db_password=s3cret
bao kv get secret/my-app
```

| Variable | Default | Purpose |
| --- | --- | --- |
| `BAO_UNSEAL_KEY` | generated (64 hex) | Static seal key; never change or lose it |
| `BAO_ADMIN_PASSWORD` | generated | Password for the `admin` user, set at initialization |
| `BAO_LOCAL_CONFIG` | JSON config | Listener, Raft storage, seal and self-init requests |

Notes:

- The static seal protects data at rest with a key stored in Railway variables; for stricter setups, move to a KMS-based seal.
- Self-initialization only runs once, on an empty volume.

This is a community-maintained deployment package and does not imply affiliation with or endorsement by the OpenBao project or its maintainers.

## Why Deploy OpenBao on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying OpenBao on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.


## Similar templates

- [Keycloak](https://railway.com/deploy/mSwigX) — Keycloak template with keywind theme + apple and discord providers
- [lua-protector](https://railway.com/deploy/lua-protector) — Test deployed my project first
- [bknd](https://railway.com/deploy/p4nTYL) — Feature-rich yet lightweight backend

Open this page in a browser: https://railway.com/deploy/openbao-1