That's what I'm doing

Nixos with natively encrypted zfs mirror.

Next step is impermanence