Random thought--what about storing SQLite replicas on a OCI image store (docker registry) as an option? Then your service code (as container images) and data (as SQLite replicas from litestream) all live in one central store, under the same auth strategy, the same versioning, the same auditing, etc. You can tightly lock down your servers to only talk to the image registry and that's it.