---
title: "Deploy OpenBao"
description: "Open-source secrets manager: store, rotate and control access to secrets"
category: "Other"
url: https://railway.com/deploy/openbao-2
---

# Deploy OpenBao

Open-source secrets manager: store, rotate and control access to secrets

**[Deploy OpenBao on Railway](https://railway.com/template/openbao-2)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/openbao-2/manifest.json

- **Creator:** zer0person's Projects
- **Category:** Other
- **Total deploys:** 1

## Template content

### OpenBao

- **Image:** openbao/openbao:latest
- **Start command:** `sh -c 'mkdir -p /openbao/file && printf '\''ui = true\nstorage "raft" {\n  path = "/openbao/file"\n  node_id = "railway"\n}\nlistener "tcp" {\n  address = "0.0.0.0:8080"\n  tls_disable = true\n}\napi_addr = "https://%s"\ncluster_addr = "http://127.0.0.1:8201"\n'\'' "$RAILWAY_PUBLIC_DOMAIN" > /tmp/c.hcl && exec bao server -config=/tmp/c.hcl'`
- **Public domain:** Yes

## Documentation

# Deploy and Host OpenBao on Railway

[OpenBao](https://github.com/openbao/openbao) is an open-source secrets manager (a Vault fork): it stores secrets, issues dynamic credentials and encrypts data.

## About Hosting OpenBao

This template runs the official `openbao/openbao` image with file storage on a volume at `/openbao/file`. The vault starts sealed and uninitialized. Open the URL right after deploy and initialize it in the UI: save the unseal keys and root token somewhere safe, because they are shown only once and anyone who reaches the URL first can initialize it. After a restart the vault must be unsealed again.

## Common Use Cases

- Central store for application secrets
- Dynamic database credentials and PKI
- Encryption as a service

## Dependencies for OpenBao Hosting

- One service with a volume; nothing else

### Deployment Dependencies

- [OpenBao on GitHub](https://github.com/openbao/openbao)

## Why Deploy OpenBao on Railway?

Railway gives you a public HTTPS URL, a persistent volume and automatic restarts. Initialize the vault immediately after deploying.


## Similar templates

- [Rocky Linux](https://railway.com/deploy/rocky-linux) — Hosted Rocky Linux 9 workspace with SSH and persistent storage. 🚀
- [Foundry Virtual Tabletop](https://railway.com/deploy/X5tR6G) — A Self-Hosted & Modern Roleplaying Platform
- [Letta Code Remote](https://railway.com/deploy/letta-code-remote) — Run a Letta Code agent 24/7. No inbound ports, just deploy.

Open this page in a browser: https://railway.com/deploy/openbao-2