VPN tunnel from a Vapor managed server?

I manage a web app for a client on a DigitalOcean droplet. For X reasons, we have to decouple some things in this app. The idea is to have 1 droplet exposed to the internet where customers do the usual and another droplet not exposed to the internet.

Now, that second (private) droplet, needs to communicate with the outside through a VPN or some sort of tunnel. Can I have a server managed by Vapor that can stay hidden from the internet but connected to a machine on the internet using a tunnel?

Basically, this is what I'd like to do in Vapor: