I've been using a .rsync-filter file for something like what you mean for ages for my homedirs backups. It's a bit tricky probably to make it right the first time but once it's there it just works.
That's why I'm still using munin, even for kubernetes clusters, even after 20 years in the business, if I should need a plugin that I wrote back then it would still work!
And I can monitor a whole k8s cluster (around 70 nodes) using 100MB of mem and 3G for storage (up to 1 year).
It's just one click and hopefully a password away. I use "personal CAs" everywhere, if you share the p12 file via a webserver it's installed by the browser when you click on the link, and share the password over phone or another medium.