Infrastructure & Operations / Built / deployed
Central Secret Lifecycle / OpenBao
Two-tier OpenBao secret authority with Raft state, Transit auto-unseal, TLS, AppRole and a migration path away from filesystem secrets.
OVERVIEW
What I built.
Two-tier OpenBao secret authority with Raft state, Transit auto-unseal, TLS, AppRole and a migration path away from filesystem secrets.
Built a two-tier OpenBao secret-control plane using Raft and Transit auto-unseal.
Configured TLS, AppRole/ACL boundaries, certificate-based operator access and a migration path away from flat filesystem secrets.
Kept the temporary same-host seal trust anchor explicit rather than presenting it as the final security boundary.
SYSTEM ARCHITECTURE
How the system is divided.
Main OpenBao -> Transit seal service for auto-unseal.
Raft provides durable service state; application identities consume scoped secret paths via reviewed auth methods.
A future independent seal host/KMS can replace the temporary local trust anchor without changing consumer paths.
NETWORK / DATA FLOW
What talks to what.
TECHNOLOGY STACK
The technical surface.
IMPLEMENTATION
How it works in practice.
- 01
Main OpenBao -> Transit seal service for auto-unseal.
- 02
Raft provides durable service state; application identities consume scoped secret paths via reviewed auth methods.
- 03
A future independent seal host/KMS can replace the temporary local trust anchor without changing consumer paths.
TESTING & VALIDATION
How I know it works.
TLS-only access
Self-initialization path
Transit auto-unseal behavior
AppRole / ACL scope
Certificate operator access
No-root-token bootstrap behavior
EXTERNAL SERVICES & DEPENDENCIES
What sits outside the core.
ENGINEERING EVIDENCE
Artifacts behind the claims.
BOUNDARIES / CONSTRAINTS
What the project does not pretend to solve.
—Current same-host static seal key is a temporary trust anchor
—Seal service publishes no host port
—Filesystem-secret migration remains staged until consumers are accepted
RESULT / CURRENT STATE
What this produced.
A production-style secrets lifecycle with explicit trust boundaries and a clear path to stronger physical separation.