Files could be decrypted by the end user. The OS itself could remain unencrypted.

Nginx is pretty easy to set up. Look up “nginx virtual hosts”. You might want to use certbot/acme if you don’t have SSL certificates for your domain names. You need either a wildcard certificate (*.example.com), a certificate with SAN (Subject Alternative Name) containing the second subdomain, or two certificates (one for each subdomain). Note that subdomains can be found more easily than path based websites, if you allow connections from the whole WAN.

Currently namecheap, but I was pretty mad to see that API access (for ACME DNS record auth, which I need to prevent downtime) was not available due to my yearly plan being too cheap (?!). You need to spend at least 50$ per months or have at least 20 domains for no good reason.

The best solution seems to acquire the domain using namecheap and then transfer name servers to a better service.