The fundamental problem in any system like this is where do you store the key? There are plenty of decent symmetric ciphers out there, many of which would be acceptable for this use case, but every single one of them is trivially broken if the attacker can get the key. You obviously can't store it in the same database as the secrets. You probably shouldn't store it in a file either; those are sometimes exposed either through SQLi or through other attacks that allow reading local files, or are exposed if the entire machine or one if its backups are captured. You can try passing it in from another key store but that just moves the problem by one step. You can try storing it on removable media (a flashdrive or similar) that you only plug in while using it, but then you risk losing the drive or the file being read off of it while the drive is plugged in.
The usual solution here is some kind of Hardware Security Module (HSM), which supports write-only key storage (you give it a key once, and it remembers but never divulges it) and various cryptographic operations using that key (such as using it to decrypt a database key which is never stored in decrypted form, or to decrypt any individual secret extracted from the database). Ideally you also want to require some authentication to the HSM so that an attacker can't use it themselves if they somehow get code execution on your machine or steal the HSM, but you've already raised the bar by a lot just by requiring those levels of access.
If a full HSM is too expensive, there are various other options. Some operating systems (Windows definitely, MacOS or Linux maybe) provide a write-only key storage solution in software; these aren't quite as secure as an HSM because the key is written to disk in some form but at least the file containing it isn't readable by the process that uses the secret (instead, some inter-process communication is done to a security service that is the only one able to read the key file and never divulges the key, and which can also require authentication of the caller). There are also cloud-based key storage options; they're backed by HSMs but are only as secure as the authentication to your cloud account.
You can also just do something similar to the password storage systems out there today (or just use one directly), such as KeePass (mentioned in a comment). You then do still need to store the password to unlock the password storage somewhere - that somewhere can potentially be "your brain, and also written on paper in a fireproof safe" though - and input that password at need, but this might work for your situation and doesn't require you making any direct decisions about how to implement the cryptosystem (which is generally best left to experts).
