ECryptfs

eCryptfs is a cryptographic filesystem encrypting each file individually. To install ecryptfs add the following to environment.systemPackages:

{ pkgs, ... }: {
  environment.systemPackages = with pkgs; [
    ecryptfs
    ecryptfs-helper
  ];
}

ecryptfs-helper contains utilities to facilitate e.g. encrypting your home folder, mounting it as user, and data recovery.

man ecryptfs-setup-private describes how to encrypt your home folder.

To automatically mount your private folder on login with PAM, add this to your config:

{
  security.pam.enableEcryptfs = true;
}