Secret-store boundaries
OpenBao is Enclavr's only supported configuration and secret store. Host reads, namespace edits, pre-Go bootstrap, enrollment, and QA use accepted scoped connections. Operator-owned custody is a separate attended responsibility.
Responsibility matrix
| Responsibility | Accepted source |
|---|---|
| Host configuration and protected reads | Host-scoped, read-only OpenBao connection |
| Namespace writes | Separate writer identity on namespace_writer_host |
| DNS preparation and publication | Persisted service identities declared by openbao_roles and dns_topology.publication |
| Fresh Ubuntu/Kali bootstrap | This host's accepted OpenBao connection; hand off to Go when available |
| OpenBao voter startup | Minimal protected config/seal.json with the existing pinned seal |
| Attended cluster recovery | Operator-owned .env-mwc-openbao JSON custody and matching protected checkpoints |
| External backup | Manual operator action outside Enclavr; never a runtime or recovery login source |
Runtime selection
configr_secret_store_provider=openbao
configr_openbao_config_file=/absolute/path/to/protected/openbao-connection.json
An omitted or blank provider also selects OpenBao. Other provider values are rejected. The absolute connection path is required. Connection files are issued and accepted through the attended workflow, with pinned TLS and cluster identity; do not hand-build one or copy another host's credentials.
See repository environment for file precedence. Missing connections, authentication failures, and unavailable endpoints fail closed without external sign-in, credential guessing, or fallback.
Logical references and writes
op://<namespace>/<item>/<field> is the retained logical namespace-reference
format. OpenBao resolves it directly. It does not request a 1Password lookup;
do not perform a blind prefix replacement in existing documents.
Use ./enclavr namespace status to discover declared ownership. The
protected edit workflow validates the selected writer's
namespace, cluster, scope, and observed item versions before a confirmed write.
Normal deployment keeps its separate read identity.
See OpenBao custody and roles and external backups and retired provider.