# Secrets without a human in the loop

**URL:** <https://community.monospacementor.com/t/secrets-without-a-human-in-the-loop/379>\
**Category:** DevOps\
**Tags:** deployment, learning, linux\
**Created:** [8 April 2026 12:01 UTC](https://community.monospacementor.com/t/secrets-without-a-human-in-the-loop/379 "2026-04-08T12:01:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![shortofcode](https://community.monospacementor.com/letter_avatar_proxy/v4/letter/s/9dc877/32.png) [@shortofcode](https://community.monospacementor.com/u/shortofcode)\
**Post date:** [8 April 2026 12:01 UTC](https://community.monospacementor.com/t/secrets-without-a-human-in-the-loop/379/1 "2026-04-08T12:01:04Z")

</div>

I’ve spent a bunch of time working on secrets management. On the homelab, I’ve managed to bury the secrets in a `pass` password store. I added my Traefik/Forgejo/stage docker stack to my old school init system (soon to be replaced I hope). This init system is just shell scripts, so I pull the secrets out of `pass` into environment variables which docker consumes, passing them on the the apps within. It works like this:

```auto
SECRET1="$(pass app1/secret)"
SECRET2="$(pass app2/secret)"
docker compose up -d

```

This is all fine because I, the human, is here when I start the stack and can supply the passphrase to unlock the keys that allow access to the secrets. And I would appreciate any feedback on this arrangement.

But I also have this question… My app will have users (ideally) and I’d want to make sure that their data is stored encypted.

How do I unlock their data?

I suppose one option is to use the user’s password as a passphrase for the keys. But then what happens when the user forgets the password?

The other option it to generate a set of keys for encrypting all user data. But then I won’t be there to enter the passphrase for my thousands of active users 😁 🤞. Is it ok not to use a passphrase?

I have read of solutions that use some program in some prime number puzzle solution into the app’s code and that solutino becomes the passphrase.

What do folks out there do?

---

<div class="post-metadata">

**Author:** ![shortofcode](https://community.monospacementor.com/letter_avatar_proxy/v4/letter/s/9dc877/32.png) [@shortofcode](https://community.monospacementor.com/u/shortofcode)\
**Post date:** [9 April 2026 19:16 UTC](https://community.monospacementor.com/t/secrets-without-a-human-in-the-loop/379/2 "2026-04-09T19:16:48Z")

</div>

So doing more homework o the subject I see how the `pass` trick above is a terrible idea. No audit logging, manual key rotation and other issues. I’m starting to appreciate more the niceties of automated solutions. Slowly I depart from my educational scripting tricks to more grown up things.