This seems like the classic "OSS is free if you value your time at zero" answer, but I don't think it is wrong. I think this is the type of tool which I model

This seems like the classic "OSS is free if you value your time at zero" answer, but I don't think it is wrong. I think this is the type of tool which I model you as having relatively little need or use for (since you care very strongly about the details and are willing to burn N days on getting e.g. HashiCorp Vault working) and which I would adopt ~instantly rather than trying to again stitch together all of the Ansible scripts required to get Vault working properly. "So I can give an external Rails contractor all the API keys they need to run the application without also giving them e.g. my payment processor secret key? And I don't have to configure their Macbook to make this happen or explain to them how to use a toolchain to get e.g. passwords out of an encrypted Ansible vault? Done." would be my approximate reaction here. I'm looking at their integration guide and Vault's side-by-side and trying to model out installing them in a typical boring Rails app. My mental math is "~25 minutes and one deploy, maybe an hour if you want to monkeypatch Rails.secrets" versus "2~3 days, assuming you've already got a well-maintained Ansible All The Things setup running; a capital-P project otherwise." It's my ambient impression that this would improve secret management at, hmm, 98% of Microconf attendees' shops. My estimate for e.g. software companies which have raised an A round is not lower than 50%. I would probably be much closer to (my model of) your POV on this matter if I were making the decision on behalf of a company with elevated security requirements or which already had a staffed-up DevOps or security team.