SafeLine WAF Behind Cloudflare and Nginx Proxy Manager

Question

A production stack that combines Cloudflare's edge with SafeLine's detection:

User -> Cloudflare (DNS/CDN) -> Nginx Proxy Manager (SSL) -> SafeLine WAF -> Your App

Why This Stack

• Cloudflare: Free DNS, CDN, basic DDoS protection
• Nginx Proxy Manager: Easy SSL via Let's Encrypt GUI
• SafeLine: 71.65% attack detection, semantic engine, bot protection
• Your App: Protected three layers deep, $0/month in WAF licensing

Prerequisites

A VPS with Docker and at least 2 GB RAM. All services run in containers.

Step 1: Deploy Your App

Ensure your app is containerized and listening on an internal port (e.g., localhost:3000).

Step 2: Install SafeLine

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

Set SafeLine to an internal port like 5080 in the dashboard settings since NPM will handle 80/443.

Step 3: Configure SafeLine

1. Open https://your-ip:9443 and log in
2. Add a new site, point to app-container:3000
3. Verify: curl -H "Host: yourdomain.com" http://localhost:5080

Step 4: Install Nginx Proxy Manager

docker run -d \
  --name nginx-proxy-manager \
  -p 80:80 \
  -p 443:443 \
  -p 81:81 \
  -v npm_data:/data \
  -v npm_letsencrypt:/etc/letsencrypt \
  jc21/nginx-proxy-manager:latest

Step 5: Configure NPM

1. Open http://your-ip:81 (default: admin@example.com / changeme)
2. Add SSL via Let's Encrypt
3. Create Proxy Host -> forward to http://safeline-container:5080
4. Enable SSL, force HTTPS

Step 6: Configure Cloudflare

1. Set DNS A record to your VPS IP
2. SSL/TLS -> "Full (strict)"

FAQ

Does this add latency?

NPM + SafeLine add ~1-2ms. Cloudflare's CDN compensates.

Why three layers instead of just Cloudflare?

Cloudflare Free WAF catches ~11%. SafeLine catches ~71%.

Can I skip NPM?

Yes. SafeLine can terminate SSL directly.

---

Try SafeLine yourself: Live Demo | Website | Deploy Guide | Discord Community | More from CyberServal | LinkedIn