rsyslog can send logs to a remote server, encrypted with TLS (to avoid tampering and MIM attacks);
but generating certificates can be difficult; enters letsencrypt to save the day.
Currently the module imtcp seems to have a bug [1] so we use relp
We assume Ubuntu or Debian below. All commands are to be done as root, or using sudo