---
id: platform/recovery-openbao
title: "Recovery drill: OpenBao"
description: Restore an OpenBao Raft snapshot into a new restore-* namespace and verify a path after unseal.
keywords: [bex, recovery, openbao, vault]
last_updated: 2026-09-23
---

# Recovery drill: OpenBao

Use `scripts/restore-openbao.sh` (see [Platform recovery rehearsals](./recovery.md)).
There is **no** same-instance mode: the script always creates a one-node
throwaway in a `restore-*` namespace and uses the fresh-node snapshot-force API.

## Prepare

Export (never print) the original unseal material and root token:

- `BAO_UNSEAL_KEY_1`, `BAO_UNSEAL_KEY_2`, `BAO_UNSEAL_KEY_3`
- `BAO_ROOT_TOKEN`

Also retain the `age` key that decrypts the transport-wrapped snapshot.
Choose `--verify-path` for a known tenants path, e.g. `tenants/data/…`.

## DRY_RUN

```bash
cd /path/to/bex
DRY_RUN=1 scripts/restore-openbao.sh \
  --target-namespace restore-bao-drill \
  --verify-path tenants/data/example \
  --snapshot latest
```

## Restore

```bash
scripts/restore-openbao.sh \
  --target-namespace restore-bao-drill \
  --verify-path tenants/data/example \
  --snapshot latest \
  --confirm restore-bao-drill \
  --teardown-on-success
```

## Verify and clean up

The script unseals the throwaway with the provided keys and checks
`--verify-path`. If you omitted teardown-on-success:

```bash
scripts/restore-openbao.sh --teardown restore-bao-drill --confirm restore-bao-drill
```