# netbox-openbao

NetBox plugin that keeps secret material in OpenBao while NetBox owns credential inventory, assignments, and audit.

| Field |Value |
| --- | --- |
| Canonical URL | https://emersonfelipesp.com/netbox-openbao |
| GitHub | https://github.com/emersonfelipesp/netbox-openbao |
| Developer guide | https://emersonfelipesp.com/netbox-openbao/developer |
| Roadmap | https://emersonfelipesp.com/netbox-openbao/roadmap |
| Releases | https://emersonfelipesp.com/netbox-openbao/releases |
| Stars | 0 |
| Forks | 0 |
| Latest release | n/a |

## Overview

netbox-openbao splits secret material from credential metadata. Private keys, passwords, and API tokens live only in OpenBao KV v2. Usernames, fingerprints, expiry dates, and device assignments stay in NetBox — searchable, filterable, and safe to export without a reveal permission.

Unlike browser-side vault plugins, every resolve path is server-side over the NetBox REST API, so automation and operators share one authorization model. Reveal is a separate permission, POST-only in the UI, JSON-only on the wire, and fully audited.

## Features

- No model field can hold secret material — changelog, exports, and REST GET responses are safe by construction
- Inventory queries (expiry, fingerprint, assignment) need zero OpenBao reads
- Dedicated reveal permission with object-level constraints in standard NetBox RBAC
- Staged rotation: write candidate alongside live version, promote on decision
- Per-tier AppRoles bound blast radius; optional broker mode keeps vault credentials off the NetBox host
- HashiCorp Vault supported as an alternative backend on the same wire contract
- Quick-add SSH password flow; broker mode and netbox-rpc integrate without a proprietary credential mirror

## Stack

- NetBox plugin (Django / Python 3.12+)
- OpenBao 2.6.x KV v2 (HashiCorp Vault optional)
- PostgreSQL 15+ with ltree
- Redis 6+ and NetBox RQ for background jobs

## Install

Primary command:

```shell
pip install netbox-openbao
```

Requires OpenBao (or Vault) with KV v2, AppRole auth, and per-engine SecretID in the NetBox process environment.

## Links

| Label |URL |
| --- | --- |
| repo | https://github.com/emersonfelipesp/netbox-openbao |
| docs | https://emersonfelipesp.com/netbox-openbao/docs/ |
| broker | https://github.com/emersonfelipesp/netbox-openbao-broker |
| OpenBao | https://openbao.org/ |