Choosing OpenBao and Vaultwarden for Secrets Management
Context
Secrets for machine-to-machine communication and personal/shared credentials were scattered across configuration files and informal channels, without a consistent way to rotate or audit access.
Decision
Implement machine-to-machine secrets handling with OpenBao and use Vaultwarden for shared credential storage.
Alternatives Considered
HashiCorp Vault
Pros
- Mature ecosystem and documentation
Cons
- Licensing changes made the open-source fork (OpenBao) more attractive for a self-hosted, community-driven setup
Keep secrets in configuration management variables
Pros
- No new service to run
Cons
- No rotation, weak audit trail, secrets exposed in more places than necessary
Reasoning
OpenBao's open governance model made it a better long-term fit for a self-hosted university environment than a vendor-controlled alternative, while Vaultwarden covered day-to-day shared credential needs without the overhead of a full secrets engine for simple cases.