[{"data":1,"prerenderedAt":551},["ShallowReactive",2],{"docs-nav":3,"docs:\u002Fdocs\u002Fvault":139},[4,7,10,13,16,19,22,25,28,31,34,37,40,43,46,49,52,55,58,61,64,67,70,73,76,79,82,85,88,91,94,97,100,103,106,109,112,115,118,121,124,127,130,133,136],{"path":5,"title":6},"\u002Fdocs\u002Faccess-gating","Protect a local route",{"path":8,"title":9},"\u002Fdocs\u002Farchitecture\u002Fsecurity-and-trust","Security and trust",{"path":11,"title":12},"\u002Fdocs\u002Fconcepts\u002Fbuilds-and-deployments","Build and deploy",{"path":14,"title":15},"\u002Fdocs\u002Fconcepts\u002Fconfiguration-ownership","Where configuration belongs",{"path":17,"title":18},"\u002Fdocs\u002Fconcepts\u002Fenvironments-and-secrets","Environment values and secrets",{"path":20,"title":21},"\u002Fdocs\u002Fconcepts\u002Fmental-model","How projects fit together",{"path":23,"title":24},"\u002Fdocs\u002Fconcepts\u002Fplans-and-apply","Plans and apply",{"path":26,"title":27},"\u002Fdocs\u002Fconcepts\u002Ftargets-and-runtimes","Choose a target and runtime",{"path":29,"title":30},"\u002Fdocs\u002Fcontribute\u002Freleases","Publish a release",{"path":32,"title":33},"\u002Fdocs\u002Fdevelopment-mounts","Development mounts",{"path":35,"title":36},"\u002Fdocs\u002Fgetting-started","Getting started",{"path":38,"title":39},"\u002Fdocs\u002Fhelp\u002Ffaq","FAQ",{"path":41,"title":42},"\u002Fdocs\u002Fhelp\u002Ftroubleshooting","Troubleshooting",{"path":44,"title":45},"\u002Fdocs\u002Fhow-to\u002Fdeploy-production","Prepare a deployment environment",{"path":47,"title":48},"\u002Fdocs\u002Fhow-to\u002Fswarm-cluster","Run on a multi-node Swarm",{"path":50,"title":51},"\u002Fdocs","mm documentation",{"path":53,"title":54},"\u002Fdocs\u002Fjobs-and-schedules","Jobs and schedules",{"path":56,"title":57},"\u002Fdocs\u002Flocal-dashboard","Local dashboard",{"path":59,"title":60},"\u002Fdocs\u002Flocal-https","Local HTTPS",{"path":62,"title":63},"\u002Fdocs\u002Flocal-services","Local services",{"path":65,"title":66},"\u002Fdocs\u002Fmcp","Let an AI agent work on your project",{"path":68,"title":69},"\u002Fdocs\u002Fmulti-project-hosts","Run multiple projects on one host",{"path":71,"title":72},"\u002Fdocs\u002Fonboarding","Set up a project",{"path":74,"title":75},"\u002Fdocs\u002Fopenbao","Use OpenBao",{"path":77,"title":78},"\u002Fdocs\u002Fproject\u002Fcontributing","Contributing",{"path":80,"title":81},"\u002Fdocs\u002Fproject\u002Flicense","License",{"path":83,"title":84},"\u002Fdocs\u002Fproject\u002Fsecurity","Security",{"path":86,"title":87},"\u002Fdocs\u002Freference\u002Fcapability-matrix","Supported features and platforms",{"path":89,"title":90},"\u002Fdocs\u002Freference\u002Fcli","CLI command reference",{"path":92,"title":93},"\u002Fdocs\u002Freference\u002Fconfiguration","Configuration",{"path":95,"title":96},"\u002Fdocs\u002Freference\u002Fenvironment-variables","Environment variables",{"path":98,"title":99},"\u002Fdocs\u002Freference\u002Ferrors-and-exit-codes","Errors and exit codes",{"path":101,"title":102},"\u002Fdocs\u002Freference\u002Fknown-issues","Known limitations",{"path":104,"title":105},"\u002Fdocs\u002Fremote-access","Manage remote access",{"path":107,"title":108},"\u002Fdocs\u002Fremote-daemon","Set up a remote host",{"path":110,"title":111},"\u002Fdocs\u002Fruntime-observability","Status, logs, and commands",{"path":113,"title":114},"\u002Fdocs\u002Fsecret-delivery","Pass secrets to your app",{"path":116,"title":117},"\u002Fdocs\u002Fsecret-providers","Choose a secret store",{"path":119,"title":120},"\u002Fdocs\u002Fstart\u002Finstall","Install mm",{"path":122,"title":123},"\u002Fdocs\u002Fterminal-ui","Terminal UI",{"path":125,"title":126},"\u002Fdocs\u002Ftutorials\u002Fdotnet-web-api",".NET web API example",{"path":128,"title":129},"\u002Fdocs\u002Ftutorials\u002Ffirst-local-app","First local app",{"path":131,"title":132},"\u002Fdocs\u002Ftutorials\u002Flaravel-rust","Laravel and Rust example",{"path":134,"title":135},"\u002Fdocs\u002Ftutorials\u002Fnode-fullstack","Node full stack example",{"path":137,"title":138},"\u002Fdocs\u002Fvault","Use HashiCorp Vault",{"id":140,"title":138,"body":141,"description":544,"extension":545,"meta":546,"navigation":547,"path":137,"seo":548,"stem":549,"__hash__":550},"docs\u002Fdocs\u002Fvault.md",{"type":142,"value":143,"toc":539},"minimark",[144,159,164,167,170,174,309,316,377,381,456,464,529,532,535],[145,146,147,148,152,153,158],"p",{},"Use an existing Vault server or let mm run a local development instance. Give\nthe connection a name such as ",[149,150,151],"code",{},"team-secrets","; secret declarations refer to that\nname. See ",[154,155,157],"a",{"href":156},"secret-providers","secret stores"," for the common workflow.",[160,161,163],"h2",{"id":162},"license-and-server-support","License and server support",[145,165,166],{},"mm and its integration code use mm's MIT license. HashiCorp Vault and its\ncontainer images are separate products under HashiCorp's terms, including the\nBusiness Source License for supported releases. mm does not redistribute or\nrelicense Vault.",[145,168,169],{},"The driver uses Community KV v2, AppRole, Raft storage, health\u002Fseal APIs, and\nRaft snapshots. An external instance sends an Enterprise namespace only when\nexplicitly configured; this does not imply any other Enterprise capability.",[160,171,173],{"id":172},"external-configuration","External configuration",[175,176,181],"pre",{"className":177,"code":178,"language":179,"meta":180,"style":180},"language-yaml shiki shiki-themes mm","providers:\n  team-secrets:\n    driver: vault\n    scope: project\n    mode: external\n    address: https:\u002F\u002Fvault.example.internal:8200\n    namespace: engineering # optional Enterprise namespace\n    storage-mount: mm-kv\n    automation-auth-mount: mm-approle\n    trust-bundle: company-vault-ca.pem\n    expected-trust-sha256: sha256:HEX_DIGEST\n","yaml","",[149,182,183,196,204,217,228,239,250,265,276,287,298],{"__ignoreMap":180},[184,185,188,192],"span",{"class":186,"line":187},"line",1,[184,189,191],{"class":190},"sWZmh","providers",[184,193,195],{"class":194},"sIbZ0",":\n",[184,197,199,202],{"class":186,"line":198},2,[184,200,201],{"class":190},"  team-secrets",[184,203,195],{"class":194},[184,205,207,210,213],{"class":186,"line":206},3,[184,208,209],{"class":190},"    driver",[184,211,212],{"class":194},":",[184,214,216],{"class":215},"sv8ni"," vault\n",[184,218,220,223,225],{"class":186,"line":219},4,[184,221,222],{"class":190},"    scope",[184,224,212],{"class":194},[184,226,227],{"class":215}," project\n",[184,229,231,234,236],{"class":186,"line":230},5,[184,232,233],{"class":190},"    mode",[184,235,212],{"class":194},[184,237,238],{"class":215}," external\n",[184,240,242,245,247],{"class":186,"line":241},6,[184,243,244],{"class":190},"    address",[184,246,212],{"class":194},[184,248,249],{"class":215}," https:\u002F\u002Fvault.example.internal:8200\n",[184,251,253,256,258,261],{"class":186,"line":252},7,[184,254,255],{"class":190},"    namespace",[184,257,212],{"class":194},[184,259,260],{"class":215}," engineering",[184,262,264],{"class":263},"sP7nD"," # optional Enterprise namespace\n",[184,266,268,271,273],{"class":186,"line":267},8,[184,269,270],{"class":190},"    storage-mount",[184,272,212],{"class":194},[184,274,275],{"class":215}," mm-kv\n",[184,277,279,282,284],{"class":186,"line":278},9,[184,280,281],{"class":190},"    automation-auth-mount",[184,283,212],{"class":194},[184,285,286],{"class":215}," mm-approle\n",[184,288,290,293,295],{"class":186,"line":289},10,[184,291,292],{"class":190},"    trust-bundle",[184,294,212],{"class":194},[184,296,297],{"class":215}," company-vault-ca.pem\n",[184,299,301,304,306],{"class":186,"line":300},11,[184,302,303],{"class":190},"    expected-trust-sha256",[184,305,212],{"class":194},[184,307,308],{"class":215}," sha256:HEX_DIGEST\n",[145,310,311,312,315],{},"Use an initialized, unsealed Vault Community 1.18.x or 1.19.x server reachable\nover HTTPS. Replace the example address, public CA file, and fingerprint with\nyour server's details. Setup configures KV v2 secret storage and AppRole\nauthentication. The setup token is entered through a hidden prompt and is not\nsaved. Add ",[149,313,314],{},"--bootstrap"," when those mounts need to be created.",[175,317,321],{"className":318,"code":319,"language":320,"meta":180,"style":180},"language-sh shiki shiki-themes mm","mm secret provider add team-secrets --driver vault --mode external --scope project --bootstrap\nmm secret provider test team-secrets\n","sh",[149,322,323,363],{"__ignoreMap":180},[184,324,325,329,332,335,338,341,345,348,351,354,357,360],{"class":186,"line":187},[184,326,328],{"class":327},"svrjQ","mm",[184,330,331],{"class":215}," secret",[184,333,334],{"class":215}," provider",[184,336,337],{"class":215}," add",[184,339,340],{"class":215}," team-secrets",[184,342,344],{"class":343},"sbRf1"," --driver",[184,346,347],{"class":215}," vault",[184,349,350],{"class":343}," --mode",[184,352,353],{"class":215}," external",[184,355,356],{"class":343}," --scope",[184,358,359],{"class":215}," project",[184,361,362],{"class":343}," --bootstrap\n",[184,364,365,367,369,371,374],{"class":186,"line":198},[184,366,328],{"class":327},[184,368,331],{"class":215},[184,370,334],{"class":215},[184,372,373],{"class":215}," test",[184,375,376],{"class":215}," team-secrets\n",[160,378,380],{"id":379},"managed-configuration","Managed configuration",[175,382,384],{"className":177,"code":383,"language":179,"meta":180,"style":180},"providers:\n  local-secrets:\n    driver: vault\n    scope: installation\n    mode: managed\n    installation: local-secrets\n    release: \"1.19\"\n    management-port: 18210\n",[149,385,386,392,399,407,416,425,435,445],{"__ignoreMap":180},[184,387,388,390],{"class":186,"line":187},[184,389,191],{"class":190},[184,391,195],{"class":194},[184,393,394,397],{"class":186,"line":198},[184,395,396],{"class":190},"  local-secrets",[184,398,195],{"class":194},[184,400,401,403,405],{"class":186,"line":206},[184,402,209],{"class":190},[184,404,212],{"class":194},[184,406,216],{"class":215},[184,408,409,411,413],{"class":186,"line":219},[184,410,222],{"class":190},[184,412,212],{"class":194},[184,414,415],{"class":215}," installation\n",[184,417,418,420,422],{"class":186,"line":230},[184,419,233],{"class":190},[184,421,212],{"class":194},[184,423,424],{"class":215}," managed\n",[184,426,427,430,432],{"class":186,"line":241},[184,428,429],{"class":190},"    installation",[184,431,212],{"class":194},[184,433,434],{"class":215}," local-secrets\n",[184,436,437,440,442],{"class":186,"line":252},[184,438,439],{"class":190},"    release",[184,441,212],{"class":194},[184,443,444],{"class":215}," \"1.19\"\n",[184,446,447,450,452],{"class":186,"line":267},[184,448,449],{"class":190},"    management-port",[184,451,212],{"class":194},[184,453,455],{"class":454},"s1Wbj"," 18210\n",[145,457,458,459,463],{},"Set up ",[154,460,462],{"href":461},".\u002Flocal-services","local services"," first. Managed Vault supports local\nDocker Compose and rootless Podman Compose, not Swarm or remote lifecycle\noperations. This is a development setup. Supported releases are 1.18 and 1.19;\nthe supported upgrade path is 1.18 to 1.19.",[175,465,467],{"className":318,"code":466,"language":320,"meta":180,"style":180},"mm secret provider plan local-secrets --operation install\nmm secret provider apply local-secrets --operation install --plan PLAN_HASH --yes\nmm secret provider status local-secrets\n",[149,468,469,489,516],{"__ignoreMap":180},[184,470,471,473,475,477,480,483,486],{"class":186,"line":187},[184,472,328],{"class":327},[184,474,331],{"class":215},[184,476,334],{"class":215},[184,478,479],{"class":215}," plan",[184,481,482],{"class":215}," local-secrets",[184,484,485],{"class":343}," --operation",[184,487,488],{"class":215}," install\n",[184,490,491,493,495,497,500,502,504,507,510,513],{"class":186,"line":198},[184,492,328],{"class":327},[184,494,331],{"class":215},[184,496,334],{"class":215},[184,498,499],{"class":215}," apply",[184,501,482],{"class":215},[184,503,485],{"class":343},[184,505,506],{"class":215}," install",[184,508,509],{"class":343}," --plan",[184,511,512],{"class":215}," PLAN_HASH",[184,514,515],{"class":343}," --yes\n",[184,517,518,520,522,524,527],{"class":186,"line":206},[184,519,328],{"class":327},[184,521,331],{"class":215},[184,523,334],{"class":215},[184,525,526],{"class":215}," status",[184,528,434],{"class":215},[145,530,531],{},"The management API is available only on loopback. Normal removal keeps the\nserver's data volume so the same instance can reuse it later. Purging deletes it.",[145,533,534],{},"mm stores the initial root token and unseal key in its private Age-encrypted\nstore. Keep a separate backup of the Age identity. Production Vault needs its\nown recovery setup and license review.",[536,537,538],"style",{},"html pre.shiki code .sWZmh, html code.shiki .sWZmh{--shiki-default:var(--mm-code-key)}html pre.shiki code .sIbZ0, html code.shiki .sIbZ0{--shiki-default:var(--mm-code-punctuation)}html pre.shiki code .sv8ni, html code.shiki .sv8ni{--shiki-default:var(--mm-code-string)}html pre.shiki code .sP7nD, html code.shiki .sP7nD{--shiki-default:var(--mm-code-comment)}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .svrjQ, html code.shiki .svrjQ{--shiki-default:var(--mm-code-function)}html pre.shiki code .sbRf1, html code.shiki .sbRf1{--shiki-default:var(--mm-code-option)}html pre.shiki code .s1Wbj, html code.shiki .s1Wbj{--shiki-default:var(--mm-code-constant)}",{"title":180,"searchDepth":198,"depth":198,"links":540},[541,542,543],{"id":162,"depth":198,"text":163},{"id":172,"depth":198,"text":173},{"id":379,"depth":198,"text":380},"Connect a Vault server or run one for local development.","md",{},true,{"title":138,"description":544},"docs\u002Fvault","nlcwS0fWuOcRpxF6OeSK9kH6BWpI-TqbNsQDsQK72MA",1794512546198]