I was lucky enough to get a Kimsufi transfered to me last BFCM-weekend.

Their system doesn't, howewer, allow for encrypted OS installations out of the box. Resources on getting that done seem sparse, I found a single blog entry from 10+ years ago, and a 5+ years old script automating said blog entry.

If it works, it works, but I can't imagine so few people have encryption requirements that there are not a few more hints in that direction.

Any experiences here on the forum?

Found this article on LET but it's from 2016 and commenters did not have a high opinion of author's skill.

So just want to check what if that's still roughly state-of-the-art?

Not looking to defend against sophisticated attackers (RAM dump etc) and I'm fine with OS partition being unencrypted. Database / docker / home should be though.

A solution compatible with ansible deployment would be a bonus since that's the next thing I'm tackling.