Deploy SafeLine WAF on a VPS

SafeLine (by Chaitin Tech) is a self-hosted Web Application Firewall that sits in front of your web apps as a reverse proxy. It ships as a set of Docker containers with its own installer script.

Target: Ubuntu 24.04 LTS, sudo/root SSH access.

1. Prerequisites

• A RamNode VPS with at least 2 vCPU / 2GB RAM (SafeLine runs several containers: detector, tengine, management, database)
• Docker & Docker Compose installed (the installer script will do this for you if missing, but you can pre-install if preferred)
• Ports available: 9443 (management UI), plus whatever ports your protected sites use (typically 80/443)
• DNS for the sites you want to protect pointed at this VPS (once SafeLine is live, traffic flows: internet → SafeLine → your actual backend)

2. Install Docker (if not already present)

curl -fsSL https://get.docker.com | sudo sh
sudo systemctl enable --now docker

3. Run the SafeLine installer

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

This script:

• Pulls the required SafeLine Docker images
• Creates a safeline install directory (default /data/safeline)
• Generates an initial admin password, printed at the end of the script output — copy it immediately, it's not shown again by default

If you need to retrieve/reset the admin password later:

cd /data/safeline
sudo docker compose exec management resetadmin

4. Open the firewall

sudo ufw allow 9443/tcp     # management dashboard
sudo ufw allow 80/tcp       # HTTP traffic to protected sites (if used)
sudo ufw allow 443/tcp      # HTTPS traffic to protected sites
sudo ufw status

Also open these ports in RamNode's control-panel firewall/security group if one is configured separately.

5. Log in to the dashboard

Visit:

https://YOUR_VPS_IP:9443

You'll get a self-signed cert warning on first visit (browser security page) — this is expected since it's the management UI's own cert. Accept and proceed, then log in with:

• Username: admin
• Password: the one printed during install (or reset via the command above)

You'll be prompted to change the password and, optionally, enable 2FA on first login.

6. Add a protected website

Inside the dashboard:

1. Go to Website > Add Website
2. Enter the domain name (e.g. app.example.com)
3. Enter the upstream server — this is where your actual application lives, e.g. 127.0.0.1:8080 if it's on the same box, or another internal IP if it's a separate backend server
4. Choose HTTP or HTTPS for the listener, and upload/select a TLS certificate if using HTTPS (SafeLine supports uploading your own cert or requesting one via ACME/Let's Encrypt directly in the UI)
5. Save — SafeLine will now terminate/inspect traffic on port 80/443 for that domain and forward clean requests to your upstream

7. Point DNS at SafeLine

Make sure the domain's A record points to the VPS's IP so traffic actually reaches SafeLine's listener rather than going straight to your backend.

8. Tune WAF policy

Under Website > [your site] > Policy, you can set:

• Detection mode: observe-only vs. block
• Sensitivity/rule groups (SQLi, XSS, RCE, scanner detection, etc.)
• Rate limiting / bot protections
• IP allow/deny lists

It's worth running in "observe" mode for a day or two on a new site to check for false positives in the logs before switching to blocking mode.

9. Review logs

Logs > Attack Logs in the dashboard shows blocked/flagged requests in real time. Use this to fine-tune rules for your specific application.

10. Updating SafeLine

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

Re-running the installer script pulls the latest release and upgrades in place; it will not overwrite your existing site configs.

11. Backup

Config and data live under /data/safeline by default — include this directory in your regular VPS backup routine.