Posts by Muzilla
Posts by Muzilla
Operators who search for how to set WAF SSL compliance to TLS 1.2 and TLS 1.3 usually expect a protocol dropdown. The supplied SafeLine documents do not describe that control. They describe a reverse proxy, an SSL option on each application, and scre...
Searching for how to upload an SSL certificate for an HTTPS site in a WAF usually assumes a file picker, a certificate bundle, and a reload button. The SafeLine documents used here do not describe that workflow. They describe a reverse-proxy applicat...
Visitors reach a reverse-proxy WAF only when the public name lands on the host that is actually proxying. Adding an application in the console does not, by itself, move traffic. SafeLine is a self-hosted web application firewall placed in front of a ...
Adding a site to a reverse proxy WAF is not one address typed three times. Domain, Port, and Upstream describe three different hops, and a single wrong hop leaves the origin exposed while the console still looks complete. SafeLine is a self-hosted we...
A manual SafeLine deploy is not finished when .env merely contains every key from the sample. The install guide shows a template, then a separate secret-generation section. Stopping after the paste leaves instructions where passwords and tokens must ...
Moving an LTS SafeLine install to the latest release starts with one file, not with a migration wizard. The install guide does not publish a separate upgrade command, a schema converter, or a rollback button. It does publish a hard maintenance fact: ...
An ARM64 host can meet every published dependency and still be configured as an unsupported SafeLine deployment. The concrete misconfiguration is a manual .env left on the sample values: ARCHSUFFIX is empty, POSTGRESIMAGE is chaitin/safeline-postgres...
SafeLine is described in its official documentation as a self-hosted WAF that protects web applications by filtering and monitoring HTTP traffic between the app and the Internet https://docs.waf.chaitin.com/en/home. When you deploy it manually, the g...
Changing the WAF web console listening port looks like a one-line edit, but the SafeLine deploy guide only treats one environment key as that port. This troubleshooting note covers one concrete misconfiguration: the operator stored a new port in MGTP...
Losing the SafeLine console password usually starts with a reasonable but wrong edit. After installation, the web UI is opened at https://:9443/, and the deploy guide does not store that login in the Compose environment file. Resetting the administra...
A self-hosted web application firewall only helps after it is actually running in front of the origin. SafeLine is a self-hosted WAF that filters and monitors HTTP traffic between a web application and the Internet, and the install guide treats one p...
Before I install a web application firewall, I verify the host against the published dependency table. For SafeLine, that table is not a suggestion buried under a feature list. The deploy guide states Linux, instruction architectures x8664 and arm64,...
Python teams usually start web security inside the framework. Django has auth, CSRF middleware, and an ORM. Flask has signed sessions, request hooks, and whatever validators you added. Those controls still matter. They are not the same thing as a web...
A review keyword that joins features, pricing, and a verdict only works when each claim has a source. I am using the home page at https://docs.waf.chaitin.com/en/home, the deploy guide at https://docs.waf.chaitin.com/en/GetStarted/Deploy, and the app...
Checking an SSL option is not the same job as renewing a certificate. If the goal is to use a web application firewall together with Let's Encrypt automatic HTTPS, I separate those jobs before I change DNS. The SafeLine pages available for this guide...
A CDN and a self-hosted web application firewall answer different placement questions. Cloudflare, or any other content delivery network, usually becomes the public name that visitors resolve. SafeLine, as documented, is a reverse proxy that is suppo...
A SafeLine hit on the PHP Core rule is a starting point, not a closed case. CVE-2026-109618 and CVE-2026-109619 are serious because a crafted request can disturb the runtime or leave worker state behind. If the rule fires, or if the server looks wron...
The failure mode in this PHP advisory is not "we upgraded PHP." It is "we upgraded one PHP and left three others running." CVE-2026-109618 and CVE-2026-109619 are in PHP Core, so every branch on the host is its own decision.
Build a table before you...
When someone asks how to whitelist an IP in SafeLine, separate the policy question from the missing procedure. The introduction describes SafeLine as a self-hosted web application firewall that filters and monitors HTTP traffic between an application...
chevron_left