Encrypt whole hard drive?
Yes.

Log in automatically?
Yes.

With luks?
That would be the easiest solution, since it’s offered during install with many distros.
TPM or put a keyfile on the boot partition or into the initrd.

this is the way

(blank kwallet password + autologin)

I used to run as root until they made it pretty much impossible.
This is what I do. As far as I’m concerned, there’s my password and then there’s the one that’s a last “are you sure?” step before I sudo fuck shit up.
Yep. I have an overkill password for the drive on boot and a secure but easier to type one as my user password to unlock from sleep or sudo.