The alternative would be to create an VM with full-disk encryption now.
That's because...
I found out that limits from limits.conf don’t apply to systemd services at all
With systemd services, this is done via the LimitNOFILE config.
See https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Process%20Properties
Why not? It's commented, so you can uncomment it to easily run the recipe locally. Same as all the other commented recipes.
I also don’t see the ulimit change anywhere, did you forget to push it?
Which ulimit change are you referring to?
Turns out that this is an unknown issue with encfs (and/or leveldb).
I pushed a change to only store the wallet data in encfs, but use the default directory (still configurable) for the rest.
As I nuked all data, it is currently re-syncing the whole chain. So I'm going to revisit this when sync is done.