Before You Start
# Make sure Docker is installed
docker --version # Should be 20.10.6+
docker compose version # Should be 2.0.0+
# Make sure you have room
df -h / # Need at least 5 GB free
free -h # Need at least 1 GB available RAM
Install SafeLine
bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
This single command pulls the Docker images, creates the Compose file, starts all containers, and runs the initial setup in 2-3 minutes.
First Login
Open https://<your-server-ip>:9443 in your browser. Scan the TOTP QR code with Google Authenticator or Authy, verify with the 6-digit code, then set your admin password.
Add a Site
- In the dashboard sidebar, click Sites
- Click Add Site
- Fill in your domain, backend address (e.g.
localhost:3000), and port
- Click save. Your site is now protected
Point Your Domain
If SafeLine is your primary reverse proxy on ports 80/443, update your DNS A record. If behind Nginx or Caddy, forward traffic to SafeLine port.
Verify it works with a simple SQL injection test. Open Attack Logs and you will see the blocked attempt.
Quick Config After Install
Rate limit your login page. Set 5 req/min on login endpoints to stop brute force instantly.
Block noisy countries. Geo-block regions you do not serve. Most scanner traffic comes from countries you have no business with.
Enable bot protection on forms. Toggle on for login, signup, checkout pages. Suspicious patterns get JS or Captcha challenges.
Check the dashboard tomorrow. In 24 hours you will see automated scanners, SQL injection probes, and path traversal attempts, all blocked without a single rule written.
Keeping It Updated
docker compose -f /path/to/safeline/docker-compose.yml pull
docker compose -f /path/to/safeline/docker-compose.yml up -d
Troubleshooting
If SafeLine goes down, traffic stops reaching your app. Quick fix:
docker compose -f /path/to/safeline/docker-compose.yml ps
docker compose -f /path/to/safeline/docker-compose.yml restart
To bypass temporarily, point DNS directly at your app.
FAQ
Can I install this on an existing server without breaking anything?
Yes. Run on a custom port and keep your current web server on 80/443. SafeLine only intercepts what you route through it.
Does SafeLine need a dedicated server?
No. Community Edition uses about 1 GB RAM. A ten dollar VPS with 2 GB RAM runs SafeLine alongside Node.js, Python, or PHP apps comfortably.
What happens to my existing SSL certificates?
Nothing changes if you terminate TLS at your current proxy. SafeLine sits behind it. If you want SafeLine to handle TLS, upload your cert or enable Let's Encrypt in the dashboard.
Is this production-ready for client projects?
Absolutely. Same detection engine as the paid Pro version. Community Edition protects over a million websites worldwide. The limits are on apps, throughput, and support type. Most client sites never hit those limits.
What is running on your Ubuntu server right now that could use a WAF in front of it?
