WireGuard tunnel
If a Miniserver is only reachable through VPN, store the customer's WireGuard .conf on the site. LoxWatch then brings the tunnel up automatically when needed (for example before a backup) and shuts it down afterwards. You can also start, stop or restart the tunnel manually on the site; the config is stored encrypted and only revealed on request.
For Miniservers that are directly reachable, WireGuard is not needed.