Skip to content
mm
Install

Use OpenBao

Connect an OpenBao server or run one for local development.

Use an existing OpenBao server or let mm run a local development instance. Give the connection a name such as team-secrets; secret declarations refer to that name. See secret stores for the common workflow.

External configuration

yaml
providers:
  team-secrets:
    driver: openbao
    scope: project
    mode: external
    address: https://bao.example.internal:8200
    namespace: engineering # optional
    storage-mount: mm-kv
    automation-auth-mount: mm-approle
    trust-bundle: company-bao-ca.pem
    expected-trust-sha256: sha256:HEX_DIGEST

Use an initialized, unsealed OpenBao 2.3.x or 2.4.x server reachable over HTTPS. Replace the example address, public CA file, and fingerprint with your server's details. Setup creates an AppRole (the credential mm uses to access the server) limited to the configured environment and secret locations. The setup token is entered through a hidden prompt and is not saved.

sh
mm secret provider add team-secrets --driver openbao --mode external --scope project --bootstrap
mm secret provider test team-secrets

Omit --bootstrap when KV v2 and AppRole mounts already exist. For automation, --stdin --yes reads the token after review without placing it in arguments.

Managed configuration

yaml
providers:
  local-secrets:
    driver: openbao
    scope: installation
    mode: managed
    installation: local-secrets
    release: "2.4"
    management-port: 18200

Set up local services first. Managed OpenBao supports local Docker Compose and rootless Podman Compose, not Swarm or remote lifecycle operations. This is a development setup. Supported releases are 2.3 and 2.4; the supported upgrade path is 2.3 to 2.4.

sh
mm secret provider plan local-secrets --operation install
mm secret provider apply local-secrets --operation install --plan PLAN_HASH --yes
mm secret provider status local-secrets

The management API is available only on loopback. Normal removal keeps the server's data volume so the same instance can reuse it later. Purging deletes it.

mm stores the initial root token and unseal key in its private Age-encrypted store. Back up the Age identity separately from the provider instance; losing both can make recovery impossible. A production OpenBao deployment needs its own recovery and unsealing setup.