On my Wheezy system, I used cryptsetup to set up a LUKs encrypted file system on a dedicated partition (actually, two filesystems).
It was a PITA learning how to do it, and it was 6 years ago, and it looks like I have to relearn it to do it again on Jessie and / or Buster (and on a backup device). (I have my "stream of consciousness" notes from when I did it back then, but there were so many false starts / blind paths that the notes are very confusing.) I'm wondering if cryptsetup is still something like "state of the art" or if there is anything more secure and simpler to learn to setup?