You can use a similar method like VeraCrypt. Also, you can use a better Key derivation alternative like Argon2id. Argon2id is the combined version of Argon2d, data-dependent, and Argon2i data-independent modes.
For the encryption
Get/force a good password from user and use it with Argonid with application/usage dependent domain separation
$$k = \...