I understand a complete server reset would be inconvenient.

I’m quite fond of veracrypt: It offers good encryption and is transparent when mounted.

You can create and mount a container file with veracrypt, copy your existing data in there and replace the original folders with appropriate symlinks. I think thats the best tradeoff for good protection and convenience

Aegis authenticator. Beats all proprietary apps I’ve tried so far

I’ve been contributing to it via Street complete (can get it on fdroid) and it has become quite a hobby of mine.

Depends ok the cloud solution you use, but it definitely could be an issue. Probably not because of locking, but because the files probably aren’t locked with the clientson there could be issues while merging the changes.

It seems to be file based, so wouldn’t it be able to use other self-hosted sync-tools like the next cloud client (given you’re hosting your own instance)?