For a long time I’ve been a quiet advocate of HashiCorp Vault, since the IBM buyout I went a bit quieter, and now that Boundary has lost its Community Edition I can only feel that Vault will be next.
Luckily, since IBM changed Vaults licence in 2023, it was forked into OpenBao under the Linux Foundation.
Most of my home infrastructure is setup with Ansible, and this is one of those “I need to do it, I don’t have time to do it” type scenarios, so we can get Claude to do it. Generating the Ansible was easy. It quite quickly put together a few scripts to backup the old data and restore it to OpenBao. I added some Gitea CI/CD and was soon on the way.
The more exciting thing really was the chance to scratch a couple of itches while I was at it.
Enter EnvBao a little application that you can call from your zshrc/bashrc to load some secrets as environment variables. There are two nice little features here:
- You can choose which variables or groups of variables to load from OpenBao
- Your OpenBao token will be limiting your access. This means you could have one token for your development machine and other tokens for your servers or deployment targets. This helps limit credentials spreading where they’re not needed.
As well as that, it can be used as a tool by an AI Agent, such as Claude Code, to reach credentials, again limited by the token. Docs here
Have a look at the docs and have a go.
Itches scratched. Though now I need to sort out the interface for creating users/tokens and linking secrets too them. Always more to do.