[tpfour]

Thank you for the references.

I don't think I can explain it more succinctly than this: I ship fully provisioned VMs which contain all of the application code (web frontend and backend) which accesses internal databases. My provisioning workflow is already automated.

It would be desirable for me to move from managing on-prem VMs to managing cloud instances with on-prem connectivity. I am just interested in reading about how others do it.

[Jugurtha]

This is what I thought I understood from your original post, I just wanted to increase the chances to get it right.

Also, take a look at Wireguard for VPN.

[tpfour]

Clients do not support wireguard, but I wish. I use it for my own uses but there's practically no chance it gets approved by clients!