SafeLine is a self-hosted web application firewall that works as an nginx-based reverse proxy, filtering, monitoring, and blocking malicious HTTP/S traffic before it reaches a web application (https://docs.waf.chaitin.com/en/home). The deployment guide documents its protection scope, including attacks such as SQL injection, XSS, code injection, OS command injection, path traversal, and SSRF. If your deployment still points at the long-term-support channel, the documentation is explicit: the LTS version will no longer be maintained starting from 9.1.0-LTS (14 August 2025), and LTS users are strongly recommended to upgrade to the latest version (https://docs.waf.chaitin.com/en/GetStarted/Deploy).
I treat this migration as a release-management decision rather than a simple version bump. Turning protection back on is the final step, so I work through the checklist below before enabling the new install.
Decision checklist before turning protection on
Confirm the current configuration. Inspect the install directory and .env file to see whether RELEASE is set to -lts. The deployment guide notes that RELEASE is the switch that selects the LTS version, and leaving it unset targets the latest channel.
Verify the host still meets the minimum requirements. The deployment guide lists Linux on x86_64 or arm64, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, and at least 1 CPU, 1 GB memory, and 5 GB disk, with ssse3 CPU support.
Check ARM licensing before committing. The documentation states that SafeLine installed on ARM requires a Pro license to work properly and that the Personal Edition is not supported on ARM.
Protect the data and secrets first. The install directory contains SafeLine configuration and data, including the .env file with the PostgreSQL password and generated detector and management tokens. The guide sets .env permissions to 600, so preserve that file and the SAFELINE_DIR contents before pulling new images.
Choose the timing deliberately. The guide recommends that if you have concerns, you should upgrade one month after the release of a new version. This lets a fresh release age before it becomes your enforcement point.
Plan the actual cutover. The manual path downloads the latest compose.yaml into the SafeLine directory, updates .env, and starts the stack with docker compose up -d. The automatic path runs the manager script from the release/latest URL. Whichever route you take, retrieve the administrator credentials with docker exec safeline-mgt resetadmin and log in at https://<safeline-ip>:9443/.
Re-confirm the application proxy before flipping traffic. The application setup flow requires a domain, a listening port, and an upstream address, and DNS must resolve the domain to the SafeLine server (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). Only after that mapping is correct do I consider protection turned on.
Is the LTS channel still receiving updates?
No. According to the deployment guide, the LTS version is no longer maintained starting from 9.1.0-LTS (14 August 2025). Staying on LTS means you stop receiving that maintenance stream, which is why the guide strongly recommends moving to the latest version.
Do I need to upgrade the moment a new release appears?
Not necessarily. The guide advises users who have concerns to wait about one month after a new version is released before upgrading. That window lets you observe the release while you still plan your own migration.
What exactly should I back up before switching?
Keep the SafeLine directory, especially the .env file and the PostgreSQL data under the install path. The .env file holds the POSTGRES_PASSWORD plus the detector and management tokens, and the guide keeps this file readable only by the owner with chmod 600. Copy these outside the working directory before you replace the compose stack.
How do I actually move from LTS to latest?
Set the release selector to the latest channel in .env by removing or emptying the RELEASE=-lts line and using IMAGE_TAG=latest, download the current compose.yaml from the release/latest URL, then run docker compose up -d in the SafeLine directory. After startup, run docker exec safeline-mgt resetadmin to get a fresh admin password and sign in at the console port.
What should I verify before turning protection back on?
Confirm the console is reachable at https://<safeline-ip>:9443/ and that you can log in. Re-check each application entry for its domain, port, and upstream address, and confirm DNS points at the SafeLine host. Finally, send a harmless request and a known attack pattern to make sure normal traffic passes while malicious traffic is blocked and visible in the attack list.
SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.