Something like :

This method uses the rsync utility for snapshots. rsync should be available by default on all modern linux distributions. This is the fastest and recommended method, especially for large datasets since it copies binary data. It requires a READ LOCK during the whole process, as for mysqldump.

As of MariaDB 10.1.36, stunnel can now be used to encrypt data over the wire. Be sure to have it installed, and to set tkey and tcert options referring to the Galera Cluster documentation (certificate directory will have to be hashed : openssl rehash /path/to/certs/).

Basic documentation has been added, as well as on release notes. Will add example at a later stage.