I'm running a fediverse instance in a Cloud VM. I would like to migrate the instance into my homelab, but there's another admin involved who needs to be able to create and restore from backups/snapshots. I would keep a cloud VM to tunnel to my local VM so I don't need to use my resident IP for the instance and some other reasons. That would also allow to give the other admin ssh from the cloud vm into the local vm without being able to touch my other stuff.

My initial thougt was to create some wrapper tool that can be triggered from inside the VM, just create a snapshot and restore from the latest, but I'd have to develop and run that one somewhere. Maybe there's a better solution like creating an actual Proxmox user for the other admin with permissions just for that vm? I don't want to expose Proxmox publicly of course, but there could be a solution via the cloud vm.

Looking for ideas here, keeping the hassle for the other admin low, while minimizing security risks.