Just encrypt database tables. It would be the easiest way as for me. But I still see no reason for doing anything that weird

The best way would be to use S3+cloudfront+route53 from AWS because it seems to be the cheapest setup for such approach. It will take approximately $2 per month to serve such site

The only reason for me to selfhost is that I dont like to use some services which are proposed by market. Like I use firefly-iii as there's just no alternatives convenient for me. I use wireguard because there's no vpn to get things done in way I want. The same with ghostfolio, paperless-ngx and drone. There's just no alternatives to match my requirements so I'm forced to selfhost