[{"data":1,"prerenderedAt":547},["ShallowReactive",2],{"docs-nav":3,"docs:\u002Fdocs\u002Fopenbao":139},[4,7,10,13,16,19,22,25,28,31,34,37,40,43,46,49,52,55,58,61,64,67,70,73,76,79,82,85,88,91,94,97,100,103,106,109,112,115,118,121,124,127,130,133,136],{"path":5,"title":6},"\u002Fdocs\u002Faccess-gating","Protect a local route",{"path":8,"title":9},"\u002Fdocs\u002Farchitecture\u002Fsecurity-and-trust","Security and trust",{"path":11,"title":12},"\u002Fdocs\u002Fconcepts\u002Fbuilds-and-deployments","Build and deploy",{"path":14,"title":15},"\u002Fdocs\u002Fconcepts\u002Fconfiguration-ownership","Where configuration belongs",{"path":17,"title":18},"\u002Fdocs\u002Fconcepts\u002Fenvironments-and-secrets","Environment values and secrets",{"path":20,"title":21},"\u002Fdocs\u002Fconcepts\u002Fmental-model","How projects fit together",{"path":23,"title":24},"\u002Fdocs\u002Fconcepts\u002Fplans-and-apply","Plans and apply",{"path":26,"title":27},"\u002Fdocs\u002Fconcepts\u002Ftargets-and-runtimes","Choose a target and runtime",{"path":29,"title":30},"\u002Fdocs\u002Fcontribute\u002Freleases","Publish a release",{"path":32,"title":33},"\u002Fdocs\u002Fdevelopment-mounts","Development mounts",{"path":35,"title":36},"\u002Fdocs\u002Fgetting-started","Getting started",{"path":38,"title":39},"\u002Fdocs\u002Fhelp\u002Ffaq","FAQ",{"path":41,"title":42},"\u002Fdocs\u002Fhelp\u002Ftroubleshooting","Troubleshooting",{"path":44,"title":45},"\u002Fdocs\u002Fhow-to\u002Fdeploy-production","Prepare a deployment environment",{"path":47,"title":48},"\u002Fdocs\u002Fhow-to\u002Fswarm-cluster","Run on a multi-node Swarm",{"path":50,"title":51},"\u002Fdocs","mm documentation",{"path":53,"title":54},"\u002Fdocs\u002Fjobs-and-schedules","Jobs and schedules",{"path":56,"title":57},"\u002Fdocs\u002Flocal-dashboard","Local dashboard",{"path":59,"title":60},"\u002Fdocs\u002Flocal-https","Local HTTPS",{"path":62,"title":63},"\u002Fdocs\u002Flocal-services","Local services",{"path":65,"title":66},"\u002Fdocs\u002Fmcp","Let an AI agent work on your project",{"path":68,"title":69},"\u002Fdocs\u002Fmulti-project-hosts","Run multiple projects on one host",{"path":71,"title":72},"\u002Fdocs\u002Fonboarding","Set up a project",{"path":74,"title":75},"\u002Fdocs\u002Fopenbao","Use OpenBao",{"path":77,"title":78},"\u002Fdocs\u002Fproject\u002Fcontributing","Contributing",{"path":80,"title":81},"\u002Fdocs\u002Fproject\u002Flicense","License",{"path":83,"title":84},"\u002Fdocs\u002Fproject\u002Fsecurity","Security",{"path":86,"title":87},"\u002Fdocs\u002Freference\u002Fcapability-matrix","Supported features and platforms",{"path":89,"title":90},"\u002Fdocs\u002Freference\u002Fcli","CLI command reference",{"path":92,"title":93},"\u002Fdocs\u002Freference\u002Fconfiguration","Configuration",{"path":95,"title":96},"\u002Fdocs\u002Freference\u002Fenvironment-variables","Environment variables",{"path":98,"title":99},"\u002Fdocs\u002Freference\u002Ferrors-and-exit-codes","Errors and exit codes",{"path":101,"title":102},"\u002Fdocs\u002Freference\u002Fknown-issues","Known limitations",{"path":104,"title":105},"\u002Fdocs\u002Fremote-access","Manage remote access",{"path":107,"title":108},"\u002Fdocs\u002Fremote-daemon","Set up a remote host",{"path":110,"title":111},"\u002Fdocs\u002Fruntime-observability","Status, logs, and commands",{"path":113,"title":114},"\u002Fdocs\u002Fsecret-delivery","Pass secrets to your app",{"path":116,"title":117},"\u002Fdocs\u002Fsecret-providers","Choose a secret store",{"path":119,"title":120},"\u002Fdocs\u002Fstart\u002Finstall","Install mm",{"path":122,"title":123},"\u002Fdocs\u002Fterminal-ui","Terminal UI",{"path":125,"title":126},"\u002Fdocs\u002Ftutorials\u002Fdotnet-web-api",".NET web API example",{"path":128,"title":129},"\u002Fdocs\u002Ftutorials\u002Ffirst-local-app","First local app",{"path":131,"title":132},"\u002Fdocs\u002Ftutorials\u002Flaravel-rust","Laravel and Rust example",{"path":134,"title":135},"\u002Fdocs\u002Ftutorials\u002Fnode-fullstack","Node full stack example",{"path":137,"title":138},"\u002Fdocs\u002Fvault","Use HashiCorp Vault",{"id":140,"title":75,"body":141,"description":540,"extension":541,"meta":542,"navigation":543,"path":74,"seo":544,"stem":545,"__hash__":546},"docs\u002Fdocs\u002Fopenbao.md",{"type":142,"value":143,"toc":536},"minimark",[144,159,164,299,302,363,374,378,453,461,526,529,532],[145,146,147,148,152,153,158],"p",{},"Use an existing OpenBao server or let mm run a local development instance.\nGive the connection a name such as ",[149,150,151],"code",{},"team-secrets","; secret declarations refer\nto that name. See ",[154,155,157],"a",{"href":156},"secret-providers","secret stores"," for the common workflow.",[160,161,163],"h2",{"id":162},"external-configuration","External configuration",[165,166,171],"pre",{"className":167,"code":168,"language":169,"meta":170,"style":170},"language-yaml shiki shiki-themes mm","providers:\n  team-secrets:\n    driver: openbao\n    scope: project\n    mode: external\n    address: https:\u002F\u002Fbao.example.internal:8200\n    namespace: engineering # optional\n    storage-mount: mm-kv\n    automation-auth-mount: mm-approle\n    trust-bundle: company-bao-ca.pem\n    expected-trust-sha256: sha256:HEX_DIGEST\n","yaml","",[149,172,173,186,194,207,218,229,240,255,266,277,288],{"__ignoreMap":170},[174,175,178,182],"span",{"class":176,"line":177},"line",1,[174,179,181],{"class":180},"sWZmh","providers",[174,183,185],{"class":184},"sIbZ0",":\n",[174,187,189,192],{"class":176,"line":188},2,[174,190,191],{"class":180},"  team-secrets",[174,193,185],{"class":184},[174,195,197,200,203],{"class":176,"line":196},3,[174,198,199],{"class":180},"    driver",[174,201,202],{"class":184},":",[174,204,206],{"class":205},"sv8ni"," openbao\n",[174,208,210,213,215],{"class":176,"line":209},4,[174,211,212],{"class":180},"    scope",[174,214,202],{"class":184},[174,216,217],{"class":205}," project\n",[174,219,221,224,226],{"class":176,"line":220},5,[174,222,223],{"class":180},"    mode",[174,225,202],{"class":184},[174,227,228],{"class":205}," external\n",[174,230,232,235,237],{"class":176,"line":231},6,[174,233,234],{"class":180},"    address",[174,236,202],{"class":184},[174,238,239],{"class":205}," https:\u002F\u002Fbao.example.internal:8200\n",[174,241,243,246,248,251],{"class":176,"line":242},7,[174,244,245],{"class":180},"    namespace",[174,247,202],{"class":184},[174,249,250],{"class":205}," engineering",[174,252,254],{"class":253},"sP7nD"," # optional\n",[174,256,258,261,263],{"class":176,"line":257},8,[174,259,260],{"class":180},"    storage-mount",[174,262,202],{"class":184},[174,264,265],{"class":205}," mm-kv\n",[174,267,269,272,274],{"class":176,"line":268},9,[174,270,271],{"class":180},"    automation-auth-mount",[174,273,202],{"class":184},[174,275,276],{"class":205}," mm-approle\n",[174,278,280,283,285],{"class":176,"line":279},10,[174,281,282],{"class":180},"    trust-bundle",[174,284,202],{"class":184},[174,286,287],{"class":205}," company-bao-ca.pem\n",[174,289,291,294,296],{"class":176,"line":290},11,[174,292,293],{"class":180},"    expected-trust-sha256",[174,295,202],{"class":184},[174,297,298],{"class":205}," sha256:HEX_DIGEST\n",[145,300,301],{},"Use an initialized, unsealed OpenBao 2.3.x or 2.4.x server reachable over HTTPS.\nReplace the example address, public CA file, and fingerprint with your server's\ndetails. Setup creates an AppRole (the credential mm uses to access the server)\nlimited to the configured environment and secret locations. The setup token is\nentered through a hidden prompt and is not saved.",[165,303,307],{"className":304,"code":305,"language":306,"meta":170,"style":170},"language-sh shiki shiki-themes mm","mm secret provider add team-secrets --driver openbao --mode external --scope project --bootstrap\nmm secret provider test team-secrets\n","sh",[149,308,309,349],{"__ignoreMap":170},[174,310,311,315,318,321,324,327,331,334,337,340,343,346],{"class":176,"line":177},[174,312,314],{"class":313},"svrjQ","mm",[174,316,317],{"class":205}," secret",[174,319,320],{"class":205}," provider",[174,322,323],{"class":205}," add",[174,325,326],{"class":205}," team-secrets",[174,328,330],{"class":329},"sbRf1"," --driver",[174,332,333],{"class":205}," openbao",[174,335,336],{"class":329}," --mode",[174,338,339],{"class":205}," external",[174,341,342],{"class":329}," --scope",[174,344,345],{"class":205}," project",[174,347,348],{"class":329}," --bootstrap\n",[174,350,351,353,355,357,360],{"class":176,"line":188},[174,352,314],{"class":313},[174,354,317],{"class":205},[174,356,320],{"class":205},[174,358,359],{"class":205}," test",[174,361,362],{"class":205}," team-secrets\n",[145,364,365,366,369,370,373],{},"Omit ",[149,367,368],{},"--bootstrap"," when KV v2 and AppRole mounts already exist. For automation,\n",[149,371,372],{},"--stdin --yes"," reads the token after review without placing it in arguments.",[160,375,377],{"id":376},"managed-configuration","Managed configuration",[165,379,381],{"className":167,"code":380,"language":169,"meta":170,"style":170},"providers:\n  local-secrets:\n    driver: openbao\n    scope: installation\n    mode: managed\n    installation: local-secrets\n    release: \"2.4\"\n    management-port: 18200\n",[149,382,383,389,396,404,413,422,432,442],{"__ignoreMap":170},[174,384,385,387],{"class":176,"line":177},[174,386,181],{"class":180},[174,388,185],{"class":184},[174,390,391,394],{"class":176,"line":188},[174,392,393],{"class":180},"  local-secrets",[174,395,185],{"class":184},[174,397,398,400,402],{"class":176,"line":196},[174,399,199],{"class":180},[174,401,202],{"class":184},[174,403,206],{"class":205},[174,405,406,408,410],{"class":176,"line":209},[174,407,212],{"class":180},[174,409,202],{"class":184},[174,411,412],{"class":205}," installation\n",[174,414,415,417,419],{"class":176,"line":220},[174,416,223],{"class":180},[174,418,202],{"class":184},[174,420,421],{"class":205}," managed\n",[174,423,424,427,429],{"class":176,"line":231},[174,425,426],{"class":180},"    installation",[174,428,202],{"class":184},[174,430,431],{"class":205}," local-secrets\n",[174,433,434,437,439],{"class":176,"line":242},[174,435,436],{"class":180},"    release",[174,438,202],{"class":184},[174,440,441],{"class":205}," \"2.4\"\n",[174,443,444,447,449],{"class":176,"line":257},[174,445,446],{"class":180},"    management-port",[174,448,202],{"class":184},[174,450,452],{"class":451},"s1Wbj"," 18200\n",[145,454,455,456,460],{},"Set up ",[154,457,459],{"href":458},".\u002Flocal-services","local services"," first. Managed OpenBao supports local\nDocker Compose and rootless Podman Compose, not Swarm or remote lifecycle\noperations. This is a development setup. Supported releases are 2.3 and 2.4;\nthe supported upgrade path is 2.3 to 2.4.",[165,462,464],{"className":304,"code":463,"language":306,"meta":170,"style":170},"mm secret provider plan local-secrets --operation install\nmm secret provider apply local-secrets --operation install --plan PLAN_HASH --yes\nmm secret provider status local-secrets\n",[149,465,466,486,513],{"__ignoreMap":170},[174,467,468,470,472,474,477,480,483],{"class":176,"line":177},[174,469,314],{"class":313},[174,471,317],{"class":205},[174,473,320],{"class":205},[174,475,476],{"class":205}," plan",[174,478,479],{"class":205}," local-secrets",[174,481,482],{"class":329}," --operation",[174,484,485],{"class":205}," install\n",[174,487,488,490,492,494,497,499,501,504,507,510],{"class":176,"line":188},[174,489,314],{"class":313},[174,491,317],{"class":205},[174,493,320],{"class":205},[174,495,496],{"class":205}," apply",[174,498,479],{"class":205},[174,500,482],{"class":329},[174,502,503],{"class":205}," install",[174,505,506],{"class":329}," --plan",[174,508,509],{"class":205}," PLAN_HASH",[174,511,512],{"class":329}," --yes\n",[174,514,515,517,519,521,524],{"class":176,"line":196},[174,516,314],{"class":313},[174,518,317],{"class":205},[174,520,320],{"class":205},[174,522,523],{"class":205}," status",[174,525,431],{"class":205},[145,527,528],{},"The management API is available only on loopback. Normal removal keeps the\nserver's data volume so the same instance can reuse it later. Purging deletes it.",[145,530,531],{},"mm stores the initial root token and unseal key in its private Age-encrypted\nstore. Back up the Age identity separately from the provider instance; losing\nboth can make recovery impossible. A production OpenBao deployment needs its\nown recovery and unsealing setup.",[533,534,535],"style",{},"html pre.shiki code .sWZmh, html code.shiki .sWZmh{--shiki-default:var(--mm-code-key)}html pre.shiki code .sIbZ0, html code.shiki .sIbZ0{--shiki-default:var(--mm-code-punctuation)}html pre.shiki code .sv8ni, html code.shiki .sv8ni{--shiki-default:var(--mm-code-string)}html pre.shiki code .sP7nD, html code.shiki .sP7nD{--shiki-default:var(--mm-code-comment)}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .svrjQ, html code.shiki .svrjQ{--shiki-default:var(--mm-code-function)}html pre.shiki code .sbRf1, html code.shiki .sbRf1{--shiki-default:var(--mm-code-option)}html pre.shiki code .s1Wbj, html code.shiki .s1Wbj{--shiki-default:var(--mm-code-constant)}",{"title":170,"searchDepth":188,"depth":188,"links":537},[538,539],{"id":162,"depth":188,"text":163},{"id":376,"depth":188,"text":377},"Connect an OpenBao server or run one for local development.","md",{},true,{"title":75,"description":540},"docs\u002Fopenbao","oC45Of1TSGr40qPcIY84i2a6ArgXhsoPEl_tr7onuQI",1794512546198]