I understand a complete server reset would be inconvenient.

I’m quite fond of veracrypt: It offers good encryption and is transparent when mounted.

You can create and mount a container file with veracrypt, copy your existing data in there and replace the original folders with appropriate symlinks. I think thats the best tradeoff for good protection and convenience

Was actually confronted with the same problem - thank you for the solution!