Secrets: OpenBao

Each site runs one OpenBao (Vault OSS fork) instance on its edge E200. A small Go binary in a roughly 2 GB VM fits the E200 workload boundary. This placement was decided on 2026-07-02. The sites do not share a stretched Raft cluster: OpenBao has no cross-site replication, and a two-node Raft cluster over WireGuard cannot maintain quorum.

Topology

Cross-site disaster recovery uses scheduled bao operator raft snapshot save, shipped to the other site over the backup path (VLAN 90, PBS pattern): each site's secrets are restorable at the other.

Seal / Unseal

Each instance auto-unseals via the other site's transit engine over the WireGuard tunnel: sa-bao-01 points at sb-bao-01 and vice versa. Because the tunnel is the unseal path, Pulumi declares OPNsense order=1,up=90,down=180 before bao order=2,up=60,down=180; Site A UOS follows at order=3,up=0,down=180. Proxmox applies up after the current VM starts, so the firewall's 90-second value is the delay before bao.

Secret Tiers

Tier 0 can never migrate into bao: bao cannot hold the secrets that build bao.

Consumers (bao-first, Executed 2026-07-01)

The KV v2 mount is homelab, with paths opnsense/site-a, unifi/site-a, and pulumi/proxmox; Site B mirrors under */site-b on sb-bao-01 later. Access is per-consumer read-only via AppRole (opnsense-config, unifi-config, pulumi-provision), with role_id/secret_id in root .env.local.

• Ansible secret variables in opnsense/config and unifi/config use KV v2 lookups. When bao is unreachable or sealed, they fall back to the encrypted vault-credentials.yml files. Those files remain as the documented break-glass path and are resynchronized with make openbao-config-seed.
• Pulumi make targets overlay PROXMOX_VE_* from homelab/pulumi/proxmox and fall back to .env.local on failure. Stack encryption stays on the local passphrase provider because a bao-backed provider cannot work while bao is sealed, and aorxi-openbao cannot depend on the service it builds.
• Unsetting BAO_ADDR forces pure fallback mode everywhere.

Still Deferred

Transit engines and seal migration (needs Site B), TLS via Let's Encrypt DNS-01 (sa-bao-01.core.aorxi.io; never expose port 8200 beyond the local segment while TLS is off), the Raft snapshot timer with cross-site shipping, and the api_addr correction at the VLAN 30 cutover. Init and recovery-key handling stay a manual runbook.

Related Pages

• Initial Site Bootstrap: where bao provisioning and the bao-first migration sit in the build order
• DNS VMs: the internal zone that will name the bao endpoints
• Decisions Log: dated entries for the 2026-07-01/02 secrets decisions