I've actually done it.
WIll post the procedure when I find some time.
Thank you both again.
[edit]
Ok here it is.
1. Setup a ddns provider and an updater for it (through your router, another device on your LAN, a LibreELEC add-on etc, whatever works for you)
2. Make sure your ISP allows you to use port 443 and forward it to the LibreELEC machine. Let's Encrypt requires port 443 to complete the challenge that generates the ssl certificates.*
3. Download the linuxserver.io Nginx Letsencrypt docker image add-on (as suggested above). (I am not going to go into details about setting this up as it is out of scope for this thread).
4. Once you have verified the the nginx letsencrypt container is running correctly you have to edit the default configuration file for nginx. This file is accessible over LibreELEC samba on the path below:
Userdata\addon_data\docker.linuxserver.letsencrypt\config\nginx\site-confs\default
Edit it to make it look like the following:
server {
listen 443 ssl default_server;
#.... [lines omitted for clarity]
location ~ \.php$ {
#.... [lines omitted for clarity]
}
location /transmission {
proxy_pass http://192.168.1.21:9091; #Use your own IP:port here
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
Display More
Pay extra attention on the line where you define the IP:port for the transmission service. You have to use the LibreELEC LAN IP there. This means LibreELEC should have a static LAN IP, but you have probably set it up like this if you are forwarding ports to it.**
5. Restart the nginx letencrypt container (either through the command line or restart LibreELEC)
6. From inside your LAN, open a browser to https://192.168.1.21/transmission (use your own LibreELEC LAN IP of course). You should receive a bad certificate warning (this is expected as the certificate is signed for your ddns url), ignore it, enter your username/password and you should see the Transmission web interface. Test that everything works as expected (add a .torrent, remove it, etc)
7. Now open a browser to https://myexample.ddns.com/transmission (use your own ddns url of course). There is a case that this URL will fail (if your router does not support NAT loopback, or maybe you haven't enabled it) , in that case you'll have to test it from outside your LAN. The browser should show the certificate is valid (green lock etc). Again make sure that everything works as expected.
8. Setup your favorite transmission remote client to use SSL and verify everything works as expected. For example for Transmission Remote GUI:
Remote host: myexample.ddns.com
Port: 443
Use SSL
Authentication Required
[username]
[password]
RPC path: /transmission/rpc
* If your ISP does not allow you to use port 443, all is not lost. You can opt to use the simple Nginx docker image add-on with another port and self-signed certificates or maybe look about buying an SSL certificate.
** I tried using 127.0.0.1, but it wouldn't work. I was scratching my head as to why, until I realised that, from inside the docker container, 127.0.0.1 refers to the container itself (and not the LibreELEC host). There is probably some docker-ish way to get the host IP that the container interface sees and use that, and you'll probably have to find out how to do that if you want to setup something similar with the dockerized transmission add-on.
