Bfvtmrc

You can't, plain and simple. If you don't trust the hosting company, you don't host with them. This is law #3 from 10 immutable law of security:

Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.

The hypervisor always have privileged position over your virtualised machine, you can't protect yourself from rogue hypervisor.

One way you can do to benefit from their network location but still keeping your code secure is to do a colocation hosting. In a colocation hosting, you bring your own machine that you put in someone else's datacenter.

Basic colocation itself should discourage most opportunistic attackers, but a targeted/determined attacker might connect into your machine anyway. If this is a concern for you, you should put your machine in a tamper-evident/tamper-proof server casing, so that the only unlocked port to the outside world is the power cable and network cable, and you encrypt all network traffic going into/out of the machine. This way you can put your machine in their network and benefit from the network's low latency, and they won't be able to steal data from your server unless they break the server's chassis.

If protecting your data is very important, you would also want to do a regular audit that the case hasn't been tampered with. If you have infinite budget, it may also be possible to design tamper proof chassis that have various sensors that can raise an alarm and initiate shutdown (discarding all sensitive/encryption keys) if they detect that the chassis had been tampered with, but of course these gets expensive really quickly.

In theory, you should be able to use the trusted hardware features of modern CPUs to run your disk encryption, or even your entire VM, inside a tamper-resistant part of the CPU, having all the data on disk and in memory encrypted with keys that are only accessible inside that tamper-resistant trusted enclave.

While exposing Intel's SGX trusted computing system to VMs doesn't appear to be possible on stock hypervisors, AMD has a feature called Secure Encrypted Virtualization, or SEV, which sounds like exactly what you are looking for: you can set up your VM in such a way that it is protected from the hypervisor with keys known only to AMD or someone who is willing and able to disassemble the host CPU.

Unfortunately, it's unlikely that the particular hosting company that you need to use provides AMD SEV-supporting hosts or makes the feature available to their clients.

I don't fully trust for some reason

Trust them in what way? Do you believe they may be incompetent or do you think they may be malicious?

If merely incompetent, you'll probably get reasonable protection from the encryption you've described. It is of course possible that their host machine gets compromised and the attacker finds a way to grab the current encryption keys from RAM, but in typical web host compromises the attackers won't go that far. They'll just find an easy place to dump their malware or easy to grab passwords.

But if they are actively malicious, you cannot protect the data on the VM. At best, you could configure it as a proxy server, which could give you the latency benefits without exposing your database and source code.

Microsoft has a possible solution for this called Shielded VMs, these are specifically intended for the attack vector that some malicious actor has administrative access to the hypervisor. An example of this would be machines deployed either in the cloud or in a colo.

The downside is that you will need to maintain a Guardian Server under your physical control. That may be overkill for your needs.