You hit the nail on the head.

I would not publicly expose ssh. Your home IP will get scanned all the time and external machines will try to connect to your ssh port.

If you wanted to go overboard, don’t even make the server accessible publicly. Distribute keys to a Wireguard network that is accessible publicly. Mandate your players obtain keys from you to play.

Veracrypt. Make a file on your disk.

Don’t want a storage file?

Make 2 partitions, put veracrypt portable exe on the first normal storage partition. (fat32 is likely ideal here) Second partition formatted with veracrypt.

I transcode to ramdisk.