You can basically do it like luks does, but encrypting the files separately with gocryptfs, but like with all file encryption, you’re leaking directory structure.