I've configured something similar. The /boot partition is the only unencrypted. In the initramfs there is a script that downloads half of the decryption key from http, while the other half is stored in the script itself.
The script implements automated retry until it can fetch the key and decrypt the root partition.

My attack model here is that, as soon as I realize someone stole my NAS I can shutdown the server hosting half of the decryption key making my data safe. There is a window where the attacker could connect it to a network and decrypt the data, but it is made more difficult by the static network configuration: they should have a default gateway with the same IP address of mine.

On my TODO list I also have to implement some sort of notification to get an alert when the decryption key is fetched from internet.

On my TODO list I also have to implement some sort of notification to get an alert when the decryption key is fetched from internet.

Why is it fetchable by arbitrary IPs from the internet? I'd think you'd lock it down to an IP/only make it available locally.

I use a headless server connected to nothing but an ethernet cable in my basement, and I'd prefer to allow the thing to boot by itself and start up without me needing to unlock the disk encryption every single time I do an update or power back on. Its a Dell 9500t NUC that I'm using it as a server and am wondering whether its possible to encrypt everything still.

I do generally use docker containers, so could I potentially encrypt just the containers themselves, assuming I'm worried about a smash and grab rather than someone keeping the machine powered up and reading my ram?

assuming I’m worried about a smash and grab

For your specific use case, how about this:

Get a cheap USB thumb drive and a long USB cable. Put your disk unlock password on that thumb drive, and semi-permanently affix the USB drive to your building. You said you're in a basement. Put it on top of a rafter with a metal fitting that would keep the drive from being taken without removing the screws. Run the long USB cable from the thumb driving in your rafter to the USB port on the machine. Alter your startup script to mount the thumb drive read the password from the thumb drive to unlock your main disk. Don't forget to immediately unmount the thumbdrive in the OS after the disk is unlocked for extra safety.

If someone is doing a smash and grab, they'll unplug all the cables (including this USB cable going to the thumb drive) and take your machine leaving the disk encryption password behind on the USB thumb drive.

The decryption key is more than 20 random character, so if you get only half of it is not a biggie and it doesn't look like anything interesting.

It is on the internet mostly because I don't have anything else to host it locally. But I see some benefit: I wanted for the server to be available immediately after a power failure. If it fetches the key from internet I just need for the router to be online, if it fetches it from the local network I need another server running unencrypted disk.

Most cloud providers have some kind of firewall that allows to configure a resource being accessible only from certain IP addresses. Worth it to set to your home IP address, as long as it's static.