How to do full disk encryption.

https://trisquel.info/en/wiki/full-disk-encryption-install explains how to install Trisquel with a full disk encryption.

However, as far as I understand, you have successfully encrypted /home. The second most sensitive part of the disk is the swap (assuming you have a swap partition or a swap file). To encrypt it, you only need to execute this command while the swap is on (it is, by default):
$ sudo ecryptfs-setup-swap

Before doing anything else, backup! Make a LUKS container and a volume group in it. This way you only have to enter one passphrase to decrypt the whole thing.
When creating the LUKS container, if you had unencrypted data in that part of the disk, you should choose to wipe it so that it can't be accessed again. This may take some time. Afterwards, you can create the volume group and partition your system however you want (I usually make 3 logical volumes: /, /home, and swap). It is unnecessary to create a separate unencrypted /boot partition as used to be the case.
Once you reach the step of installing GRUB, you will get an error. You need to enable GRUB's cryptodisk module so that it can decrypt the partition. Switch to a tty and go to the place where the installation is mounted. Edit the etc/grub/default file and add the following line:
GRUB_ENABLE_CRYPTODISK=y
The GRUB installation should then succeed, as well as the rest of the installation.

You will have to type your passphrase twice when booting up. To avoid this, see http://www.pavelkogan.com/2015/01/25/linux-mint-encryption/.

oh wow this stuff is so over my head. :(

Backups I know how to do, partitions and swap, no, but I know I won't learn it by not trying. I will need to have instructions, including what to do it I screw it up, how to get out of it, start over, whatever, commands for fixing it, if my machine will be functional at all. My crapware Mac still works, in case I totally wreck this one.

Today is not the day for me to try this, so I'll be gathering info and deciding if I even wanna risk killing another computer. Many years ago on a different OS I tried encrypting files, that worked fine, but I couldn't decrypt them- lucky I had backups.

hmm...
with full disk encryption there is small partition of around
200MB-hmm300MB(?) of size. which is where the boot loader/kernel is
stored. other wise whats left to load the OS? some software has to be
loaded else how to decrypt and load the system ;)

what can be done is to have the boot partition -as its called- on
another drive, like a usb flash drive. that way only encrypted data is
on the drive in the computer and you can keep the all important
non-encrypted boot partition on a usb drive/sick which you can keep on
your person at all times but for when your using/have the laptop booted.
so its harder for an attacker to physical get hold of it and add a backdoor.

i think this is helpful, when getting though air port "security".

so it depends on your threat level or convenience level