I do not turn protection on in the same hour I install a web application firewall. SafeLine sits in front of the origin as a reverse proxy, so a rushed cutover can lock operators out of the console or send visitors to the wrong upstream. The product documentation describes SafeLine as a self-hosted WAF that filters and monitors HTTP traffic between a web application and the Internet, blocking malicious requests and stopping unauthorized data from leaving the app by applying policies that separate malicious traffic from safe traffic (https://docs.waf.chaitin.com/en/home). That architecture is why I keep a decision checklist, and why the first operational question is how to reset the WAF admin account inside Docker before any site depends on the proxy.
Confirm the host before you trust the console
The deploy guide sets a floor I will not negotiate: Linux, x86_64 or arm64, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, and at least 1 CPU core, 1 GB of memory, and 5 GB of disk. The CPU must support ssse3. The same page lists the checks I actually run: uname -m, docker version, docker compose version, processor and memory inspection, df -h, and an lscpu filter for ssse3 (https://docs.waf.chaitin.com/en/GetStarted/Deploy). If any line fails, protection stays off. On ARM, that guide states that SafeLine requires a Pro license to work properly and that the Personal Edition is not supported on ARM. I treat that as a stop, not a footnote. I also decide the release track before launch. The guide says the LTS line will no longer be maintained starting from 9.1.0-LTS (14 August 2025) and strongly recommends an upgrade to the latest version. I do not put a new site behind an unmaintained image tag just because the compose file still accepts RELEASE=-lts.
Recover the admin account while the shell still works
After the stack is up, the deploy guide says to open the web console at https://<safeline-ip>:9443/ and to get the administrator account with this command:
docker exec safeline-mgt resetadmin
A successful run tells you to remember the printed content. It shows an initial username of admin, an initial password, and a done line. I run that command from the Docker host, store the password outside the server, and log in once before I add an application. This is the documented way to obtain the administrator account inside Docker. I do not invent a database edit, a second container name, or a custom reset flag. If the command fails, the container is unhealthy, or I cannot read the password, I am not ready to proxy production traffic. The management UI is how I will later add sites and read the attack list, so a console I cannot enter is a failed checklist, not a minor inconvenience.
Secrets sit next to that login drill. A manual install keeps configuration in a directory such as /data/safeline, including POSTGRES_PASSWORD and the generated detector and management tokens, and the guide sets .env to mode 600. MGT_PORT is the console port, 9443 in the sample. MGT_PROXY is the number of console proxy layers and should stay at 0 unless a console proxy is actually being configured (https://docs.waf.chaitin.com/en/GetStarted/Deploy). Before protection is on, I decide who can reach port 9443 and who can read .env. I do not change MGT_PROXY to paper over a login problem.
Decide the proxy path, then decide which controls to enable
SafeLine is an nginx-based reverse proxy. It receives traffic for the original site, cleans malicious traffic, and forwards the remainder to the original application (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). In the Web Admin Console, Add Application asks for Domain, Port, and Upstream. Domain may be a domain name, a hostname, or an IP. Port is what SafeLine will listen on, such as 80 or 443, and HTTPS apps need the SSL option checked. Upstream is the real address used for forwarding. After those values are saved, the domain must resolve to the SafeLine server. If DNS still points at the origin, the site is not protected. If Upstream is wrong, the site is down. I write the three values down and test resolution before I call the change complete.
The feature choice is a separate decision. Documented capabilities include defenses against SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoor, brute force, HTTP flood, and bot abuse, plus IP-based rate limiting and a web access control list (https://docs.waf.chaitin.com/en/home). The feature list also describes CAPTCHA so human visitors can pass while crawlers and bots are blocked, an authentication challenge that requires a password or else blocks the visitor, and dynamic protection that encrypts HTML and JS on each visit. I do not turn every one of those on during the first cutover. Challenges, dynamic encryption, and tight rate limits change what a legitimate user receives. My default is to prove the proxy and basic attack handling first, and to enable a challenge or dynamic encryption only after I can name the user impact.
I prove the path with the samples in the application guide, not with live customers. That page shows test requests for SQL injection, XSS, path traversal, code injection, and XXE, and says a blocking page means the attack was defended. I then open the console attack list and a detail view (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). A normal request should reach the upstream. A documented attack-style request should block or at least show up in that list. If neither happens, I do not declare protection on. I correct the proxy path and repeat the test.
My go or no-go order is fixed. The host meets the documented CPU, memory, disk, Docker, Compose, and ssse3 requirements, and the ARM license rule is already satisfied if the server is ARM. docker exec safeline-mgt resetadmin has printed an admin password I have stored, and I have logged in on port 9443. Domain, listen port, and upstream are recorded, and DNS points at the SafeLine host. I know which extra controls stay off on day one. One safe request is forwarded and one documented attack-style request is visible as a block or in the attack list. Any failed line means protection stays off.
How do I reset the WAF admin account inside Docker?
On the Docker host, run the command from the deploy guide: docker exec safeline-mgt resetadmin. Success output shows an initial username of admin and an initial password. Store that password and log in at https://<safeline-ip>:9443/ before you add an application. These pages do not describe another reset method, so I do not improvise one inside the database container.
Should I turn protection on before console login works?
No. Adding an application and reading the attack list both happen in the Web Admin Console. If resetadmin fails or port 9443 is unreachable from your admin network, leave visitor traffic on the origin until the operator path works.
What has to be true before an application is actually protected?
SafeLine must already be installed, the application entry needs Domain, Port, and Upstream, and the domain must resolve to the SafeLine server IP. Protection is that reverse-proxy path plus inspection. A saved form with DNS still aimed at the origin is not protection.
Which controls do I leave off on the first cutover?
I leave CAPTCHA, the authentication challenge, dynamic HTML and JS encryption, and aggressive rate limits off until I have seen normal traffic through the proxy. Those controls are documented, and they change the visitor experience. I validate attack handling with the published test payloads first.
Does this checklist replace the install guide?
No. Automatic install, the compose file, environment variables, permissions, and uninstall steps belong to the official deploy guide. This list is only the set of decisions I finish after install and before real users pass through the proxy. If a recovery or tuning step is not in the supplied install or application docs, I stop rather than invent it.
SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.