diff --git a/machines/nixos/storage01/_configuration.nix b/machines/nixos/storage01/_configuration.nix
index 4c480bcf..1d21f965 100644
--- a/machines/nixos/storage01/_configuration.nix
+++ b/machines/nixos/storage01/_configuration.nix
@@ -20,6 +20,7 @@ lib.extra.mkConfig {
     "garage"
     "influxdb"
     "netbird"
+    "openbao"
     "peertube"
     "prometheus"
     "redirections"
diff --git a/machines/nixos/storage01/openbao.nix b/machines/nixos/storage01/openbao.nix
new file mode 100644
index 00000000..82b99787
--- /dev/null
+++ b/machines/nixos/storage01/openbao.nix
@@ -0,0 +1,34 @@
+# SPDX-FileCopyrightText: 2025 Elias Coppens <elias.coppens@dgnum.eu>
+#
+# SPDX-License-Identifier: EUPL-1.2
+
+let
+  host = "vault.dgnum.eu";
+  port = 3100;
+  clusterPort = 3101;
+in
+
+{
+  services.openbao = {
+    enable = true;
+
+    settings = {
+      listener = {
+        tcp.address = "127.0.0.1:${builtins.toString port}";
+        cluster_address = "0.0.0.0:${toString clusterPort}";
+      };
+
+      storage.raft = {
+        path = "/var/lib/openbao/raft";
+        node_id = "storage01";
+      };
+
+      cluster_addr = "http://${host}:${toString clusterPort}";
+      api_addr = "https://${host}";
+    };
+  };
+
+  dgn-web.simpleProxies.openbao = {
+    inherit host port;
+  };
+}
diff --git a/meta/dns.nix b/meta/dns.nix
index f548c54a..f1c55150 100644
--- a/meta/dns.nix
+++ b/meta/dns.nix
@@ -110,6 +110,7 @@ let
           "victoria-metrics" # Victoria Metrics
           "videos" # Peertube
           "pub"
+          "vault" # OpenBao
 
           # Garage S3
           "*.cdn"