roast my simple security scheme

I want an application on my server (Ubuntu VPS on DigitalOcean) to know a secret key for various purposes. I am confused about the infinite regress of schemes that involve putting the secret key anywhere in particular (in an environment variable, in a config/env file, in the database, in a cloud secret manager). With all of those, if someone gains access to my server, it seems like they can get at the key in the same way my application gets at the key. I have only a tenuous understanding or users and roles, and perhaps those are the answer, but still it seems like for any process by which my application starts at boot time and gains access to the keys, and an intruder can follow that same path. It also makes sense to me that the host provider could make certain environment variables magically available to a certain process only (so then someone would need to log in to my DO account, but if they could do that they could wreak all sorts of havoc). But I wasn't able to understand if DO offers that.

In any case, please let me know your feelings about the following (surely unoriginal) scheme: My understanding is that the working memory (both code and data) of my server process is fairly hard to hack without sudo. And let's assume my source code in gitlab is secure. Suppose I have a .env file on my server that contains several key value pairs. My scheme is to read two or more of these values, with innocuous sounding key names like "deployment-date", "version-number" things like that. In the code, it would, say, munge a few of these values (say xor'ing them together), and then get a hash of that value, which would be my secret key. Assuming my code is compiled/obfuscated, it seems like without seeing my source code it would be hard to discover that the key was computed in that way, especially if, say, I read the values in one initialization function and computed the hash in another initialization function.

If I used this scheme, for example, to encode/data that I sent to the database and retrieved from the database, it seems like I could rest easier that if someone did find a way to get into my server, they would have a hard time decoding the data.