I guess I don’t understand the issues you think you’re facing with straightforward approaches. You probably don’t want it on an internet server, right? Maybe just scrounge an old laptop with no internet connection and set it up with an encrypted disk. Then use it as your journalling box. So you’re fairly safe from network attacks. You might have to worry about someone snagging the laptop itself and recovering the key somehow. Yes there are approaches you can take to mitigate that. I don’t know of any super simple ready made methods though.