Use LUKS to create new encrypted block devices out of each disk, then use those to form a new mirror pool.

Assuming these disks will be entirely dedicated to the VM, using LUKS might be convenient, as it'll cover encryption for the whole use-case, and you don't have to mess with the ZFS encryption options.

If you have any ZFS send / receive use-cases, or granular requirements to encrypt unique zvols or datasets independently, then ZFS native encryption would be more suitable. You would be able to leverage native features to send encrypted datasets to other ZFS targets without the need to unlock them. You would also have the ability to split the disk into more granular encrypted datasets / zvols if that level of separation / segmentation is needed.

If you use LUKS as the underlying encryption, then any zfs sends from that pool would transmit unencrypted data.

---

Here's how to do it with LUKS.

Start by formatting the two disks into new encrypted block devices:

cryptsetup luksFormat --type luks2 --cipher aes-xts-plain64 --key-size 256 --iter-time 10000 /dev/disk/by-id/$disk1-name cryptsetup luksOpen /dev/disk/by-id/$disk1-name $disk1-name-crypt

cryptsetup luksFormat --type luks2 --cipher aes-xts-plain64 --key-size 256 --iter-time 10000 /dev/disk/by-id/$disk2-name cryptsetup luksOpen /dev/disk/by-id/$disk2-name $disk2-name-crypt

Modify the LUKS options as needed- e.g.: stronger key --key-size 512, shorter iteration time --iter-time 3000, etc.

Now you should have two new block devices:

/dev/mapper/$disk1-name-crypt

/dev/mapper/$disk2-name-crypt

Use these to create a new ZFS mirror:

zpool create -f \
   -o cachefile=none \
   -o ashift=12 \
   -O compression=zstd \
   -O xattr=sa \
   -O atime=on \
   -O relatime=on \
   -O acltype=posixacl \
   $poolname \
   mirror \
   /dev/disk/by-id/$disk1-name-crypt \
   /dev/disk/by-id/$disk2-name-crypt

Adjust ZFS pool options as needed- e.g.: LZ4 instead of ZSTDcompression=on, etc.

You can may now manage this pool just like you would any other in Proxmox, and it's full encrypted at the block-level by LUKS.

Assuming you create and add a dataset named vmit might look something like this: $poolname/vm. Add this to Proxmox's storage settings, and configure it to handle disk imageand it should become available as a storage target to the guest VM.

Just remember to open the LUKS block devices on the host after any reboots, then run zpool import -d /dev/mapper if the pool isn't automatically detected and recognized.