I understand a complete server reset would be inconvenient.
I’m quite fond of veracrypt: It offers good encryption and is transparent when mounted.
You can create and mount a container file with veracrypt, copy your existing data in there and replace the original folders with appropriate symlinks. I think thats the best tradeoff for good protection and convenience
Was actually confronted with the same problem - thank you for the solution!
I’ve been contributing to it via Street complete (can get it on fdroid) and it has become quite a hobby of mine.
I’ve done some more research and I think I found it. It’s already out of Print and I think never that big to begin with, but still I present:
On Her Majesty’s Arcane Service