I’ve always used Veracrypt since I discovered its existence.
Nice inconspicuous encrypted loop-files you can mount manually when needed (or automount at boot, but that already makes them a lot less safe) and backup to any cloud safely, as without the password they are useless.
I just use *.loc.al as a local dns entry in my own server with local addresses using devicename.loc.al and loc.al itself going to my gateway/routerpage. 😅