I assume the proxy will filter out all private information, but if it doesn't (thinking about UA), we can stick the banner from https://wikitech.wikimedia.org/wiki/Wikitech:Cloud_Services_Terms_of_use#If_my_tools_collect_Private_Information... in the wiki's sitenotice.

IIRC it doesn't provide backends with the remote IP, but probably does UA. You might find you are able to prevent the UA being made available to MediaWiki on your end, not sure.
This sounds okay as long as you use all the relevant banners from the TOU, and don't need to recreate a beta-cluster/prod style infrastructure (it sounds like a single vagrant VM is all so this should be fine)

If you use the web proxy layer the visitor's IP address will be stripped from the requests as seen by MediaWiki (or whatever) running on the Cloud VPS backend instance. The User-Agent header is currently passed through unchanged; that may change in the future, but we will make announcements on cloud-announce if we decide to add this additional privacy protection. A sitenotice warning sounds like a reasonable thing to do to ensure compliance with the Cloud Services TOU.

+1 approved

Thanks a lot !