What’s wrong with Whonix configured out of the box?
See also: Duress Passwords and Deniable Qubes Installation