I’ve spent a bunch of time working on secrets management. On the homelab, I’ve managed to bury the secrets in a pass password store. I added my Traefik/Forgejo/stage docker stack to my old school init system (soon to be replaced I hope). This init system is just shell scripts, so I pull the secrets out of pass into environment variables which docker consumes, passing them on the the apps within. It works like this:
SECRET1="$(pass app1/secret)"
SECRET2="$(pass app2/secret)"
docker compose up -d
This is all fine because I, the human, is here when I start the stack and can supply the passphrase to unlock the keys that allow access to the secrets. And I would appreciate any feedback on this arrangement.
But I also have this question… My app will have users (ideally) and I’d want to make sure that their data is stored encypted.
How do I unlock their data?
I suppose one option is to use the user’s password as a passphrase for the keys. But then what happens when the user forgets the password?
The other option it to generate a set of keys for encrypting all user data. But then I won’t be there to enter the passphrase for my thousands of active users 
. Is it ok not to use a passphrase?
I have read of solutions that use some program in some prime number puzzle solution into the app’s code and that solutino becomes the passphrase.
What do folks out there do?