Hello Richard,
the configuration is link based and asymmetric:
Customer switch trunk port <--> Provider switch port (tunnel dot1q)
then on the other site the opposite
Provider switch port (tunnel dot1q)<--> Customer switch trunk port
the same external customer Vlan make the provider network to send QinQ frames between the two edge links
Also note that you cannot decide what customer vlans to tunnel: everything is transported inside the tunnel no vlan filter is supported
see
http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_25_see/configuration/guide/swtunnel.html
switchport mode dot1q-tunnel
+
switchport access vlan vlan-id
(customer vlan id)
So it is configured on a port basis only the trunk connected to the port with switchport mode dot1q-tunnel is tunneled.
Hope to help
Giuseppe