If the MySQL database is running on a different machine (whether real or virtual) from the application, a connection through a network is needed. Assuming the network cannot be assumed to be secure, some kind of encryption is needed.
Various alternatives exist, the main ones being and SSH tunnel, TLS connection, VPN. Of these, the SSH tunnel is the easiest to configure, and also the most efficient.
I used to set up SSH tunnels with autossh which provides a means of restarting SSH if it should fail. More recently, I found that it is possible in systems that support systemd to run the tunnel as a service. The service mechanism will handle the restarting without the need for extra software. The creation of tunnels can also be made quite elegant.
The solution I have now used is well described at this Github article