Coder Legion - Recent posts tagged install

How to Install a WAF with the Official Linux Manager Script on a Checked Host

Thu, 29 Oct 2026 04:37:18 +0000

A self-hosted web application firewall only helps after it is actually running in front of the origin. SafeLine is a self-hosted WAF that filters and monitors HTTP traffic between a web application and the Internet, and the install guide treats one published command as the recommended automatic path. This article follows that path only: check the Linux host against the documented dependencies, run the official manager script as root, open the web console, and then place an application behind the reverse proxy. It does not invent extra flags, custom ports, or a separate uninstall switch for that script.

The product introduction describes SafeLine as a reverse-proxy shield. Clients pass through the WAF before they reach the server. It filters, monitors, and blocks malicious HTTP and HTTPS traffic, and it is described as preventing unauthorized data from leaving the application by applying policy. The same page lists typical coverage for SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoor, brute force, HTTP flood, and bot abuse. Named core capabilities are web-attack defense, proactive bot-abuse defense, HTML and JavaScript code encryption, IP-based rate limiting, and a web access control list. The feature list also describes rate limiting against denial of service, brute force, traffic surges, and other abuse; CAPTCHA challenge; authentication challenge; and dynamic protection that encrypts HTML and JavaScript on each visit. Those controls are configured after installation. They are not arguments to the manager script. See the SafeLine introduction for that capability list.

The install guide states the host requirements before either install method. The operating system must be Linux. The instruction architecture must be x86_64 or arm64. Docker must be version 20.10.14 or above, and Docker Compose must be version 2.0.0 or above. The minimum environment is 1 CPU core, 1 GB of memory, and 5 GB of disk. The CPU must support the ssse3 instruction. The same page publishes these confirmation commands:

uname -m
docker version
docker compose version
cat /proc/cpuinfo | grep "processor"
free -h
df -h
lscpu | grep ssse3

A missing dependency is a reason to stop. The automatic section does not document switches for architecture, a custom data directory, a custom console port, or an LTS release. Those choices appear in the manual compose section, where you create a SafeLine directory, download compose.yaml, and write .env. If the server is ARM, that manual section states that SafeLine installed on ARM requires a Pro license to work properly and that the Personal Edition is not supported on ARM. Nothing in the automatic command says the manager script waives that constraint, so an ARM host should be treated as a licensing decision before you install.

When the checks match the guide, the recommended automatic command is the official manager script. It requires root privileges:

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

The deploy page says that after this command is executed, installation has succeeded, and you should go directly to the web UI. Open https://<safeline-ip>:9443/ in a browser. The initial administrator account is obtained with a separate documented command:

docker exec safeline-mgt resetadmin

On success, the guide shows an initial username of admin, an initial password, and a reminder to keep that output. Log in with that password. Do not assume the script printed a durable account record anywhere else.

A running console is not the same as a protected site. The application guide says SafeLine is a web application firewall developed based on nginx and that it works as an HTTP and HTTPS reverse proxy. It receives traffic for the original website, cleans malicious traffic, and forwards the remaining traffic to the original application. In the web admin console, open Applications and choose Add Application. Enter the domain, hostname, or IP address of the original app; the port SafeLine will listen on, such as 80 or 443; and the upstream address used to forward traffic. For an HTTPS app, check the SSL option. Then resolve the domain you entered to the IP address of the server where SafeLine is located. Until that resolution exists, the path described in the guide is not in place.

Verification belongs on an application you control. The application guide names SQL injection, XSS, path traversal, code injection, and XXE as sample attack classes, and it says a blocking page means the attack was defended. The web console attack list, including the detail view, is where that guide says to inspect what was recorded. One blocked request does not configure rate limiting, CAPTCHA challenge, authentication challenge, or dynamic protection. Those remain separate features described in the introduction.

Keep the manual route in reserve rather than mixing it into the script. The install guide documents a directory such as /data/safeline, a requirement of at least 5 GB of disk for that directory, a downloaded compose file, environment variables, secret generation, permission steps, and docker compose up -d. It also documents uninstall as entering the SafeLine directory, running docker compose down, and then removing that directory, only when you are sure you no longer want to use SafeLine. Those are manual steps. They are not published as manager-script options. If you set RELEASE to the LTS value in the manual file, the same page says the LTS version will no longer be maintained starting from 9.1.0-LTS on 14 August 2025, and it strongly recommends that LTS users upgrade to the latest version.

The supported order is therefore short. Match Linux, architecture, Docker, Docker Compose, ssse3, memory, and disk to the install guide. Run the official manager script with root. Open the console on port 9443 and reset the admin account with the documented container command. Add the application, point the domain at the SafeLine server, and confirm blocks in the console. That is how to install this WAF with the official Linux manager script without adding steps the deploy page does not publish.

What does the official manager script require?

The install guide marks automatic deployment as recommended and says the command requires root privileges. It also requires Linux, x86_64 or arm64, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, a CPU with ssse3, and at least 1 CPU core, 1 GB of memory, and 5 GB of disk. Run the published check commands before the installer.

Does a finished script mean the site is already protected?

No. The deploy page says a completed command means installation succeeded and that you should use the web UI. The application guide says protection is the reverse-proxy setup: add the application, set domain, listen port, and upstream, check SSL for HTTPS, and resolve the domain to the SafeLine server IP.

Where is the first console password documented?

Open https://<safeline-ip>:9443/ and run docker exec safeline-mgt resetadmin. The install guide says a successful run shows the initial username admin and an initial password, and it tells you to remember that content before you log in.

When is the manual compose path the documented alternative?

Use the manager script for the recommended automatic install. Use the manual section when you need the published compose workflow, including the SafeLine directory, compose.yaml, .env values, generated secrets, and docker compose up -d. On ARM, that section states that a Pro license is required and that the Personal Edition is not supported.

Which settings are outside the automatic command?

The automatic section does not publish a custom console port, an LTS switch, token generation, console proxy layers, or an uninstall flag. ARCH_SUFFIX, RELEASE, MGT_PORT, and related variables are documented in the manual .env instructions. Uninstall is docker compose down in the SafeLine directory, followed by removal of that directory.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

SafeLine website: https://ly.cyberserval.tech/MqhYdmI
Demo: https://demo.waf.chaitin.com:9443/statistics
Official docs: https://docs.waf.chaitin.com/en/home
GitHub: https://github.com/chaitin/SafeLine
Pro offer: https://cyberserval.tech/landing/lto

Why I Check the Host Before the Official Linux WAF Manager Script

Thu, 29 Oct 2026 04:36:46 +0000

A one-line installer is useful only when the host underneath it already matches the product's documented requirements. SafeLine's English deploy guide marks automatic installation as the recommended path, and that path is the official Linux manager script. I still refuse to paste the script into a shell as my first action. The same page lists operating system, architecture, container runtime, memory, disk, and CPU checks before the install command. Those checks are the install, in practice. The script is the commit step.

SafeLine is a self-hosted web application firewall. Placed in front of a web application, it filters and monitors HTTP traffic between the application and the Internet. The introduction describes it as a reverse proxy: clients pass through the WAF before they reach the server, which limits direct exposure of the origin. Documented attack coverage includes SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoor, brute force, HTTP flood, and bot abuse. Listed core capabilities are defenses for web attacks, proactive bot-abuse defense, HTML and JS code encryption, IP-based rate limiting, and a web access control list. The feature list also includes CAPTCHA challenge, authentication challenge, and dynamic protection that encrypts HTML and JS on each visit. I cite those capabilities from the product introduction at https://docs.waf.chaitin.com/en/home so the install decision stays tied to what the WAF is actually documented to do. Installation does not turn those controls on for a site by itself.

Before the manager script, I confirm the dependency table in the deploy guide at https://docs.waf.chaitin.com/en/GetStarted/Deploy. The operating system must be Linux. The instruction architecture must be x86_64 or arm64. Docker must be version 20.10.14 or above. Docker Compose must be version 2.0.0 or above. The minimum environment is 1 core of CPU, 1 GB of memory, and 5 GB of disk. The CPU must provide the ssse3 instruction. The guide publishes the confirmation commands, and I run them rather than trusting a panel screenshot: uname -m, docker version, docker compose version, cat /proc/cpuinfo | grep "processor", free -h, df -h, and lscpu | grep ssse3. A host that fails any line is not ready. I do not lower the documented floor to make the script fit a smaller VM.

The recommended automatic command, which requires root privileges, is bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en. I copy that command from the deploy guide and I do not append undocumented options. The guide's success criterion is narrow and useful: after the command is executed, the installation is successful, and the next instruction is to use the web UI directly. I treat a clean exit as proof that the instance was installed, not as proof that the origin is protected. If the command fails, I return to the dependency checks and the installation FAQ linked from that page instead of retrying with guessed flags.

The documented console address is https://<safeline-ip>:9443/. In the manual environment file the management port variable MGT_PORT is set to 9443, which matches that URL. To obtain the administrator account, the guide says to run docker exec safeline-mgt resetadmin. A successful execution prints the initial username admin, an initial password, and a done line. The password belongs to that instance. I record it before closing the session, then log in with that password.

Login is still only console access. Application protection is a separate procedure, documented at https://docs.waf.chaitin.com/en/GetStarted/AddApplication. SafeLine is described there as a web application firewall developed based on nginx. It receives traffic for the original website, cleans malicious traffic, and forwards safe traffic upstream. In the web admin console I open Applications and choose Add Application. Domain accepts a domain name, a hostname, or an IP address. Port is the port SafeLine will listen on, such as 80 or 443, and HTTPS applications need the SSL option checked. Upstream is the real address of the original application. After saving, I resolve the entered domain to the IP of the server where SafeLine runs. The same page publishes sample requests for SQL injection, XSS, path traversal, code injection, and XXE. A blocking page means the attack was defended. Details are in the console attack list.

I keep manual compose as the documented alternative, not as a second opinion from an unrelated guide. Manual deploy installs Docker if needed with the published Docker install command, creates /data/safeline, requires at least 5 GB there, downloads compose.yaml, writes .env, generates a 64-character hex detector management token, a 64-character hex management internal token, and a 16-character alphanumeric detector AES key, restricts .env to mode 600, prepares runtime directories, and starts the stack with docker compose up -d. That is the path I use when I must set SAFELINE_DIR, IMAGE_TAG, MGT_PORT, POSTGRES_PASSWORD, SUBNET_PREFIX, IMAGE_PREFIX, ARCH_SUFFIX, RELEASE, REGION, or MGT_PROXY myself. MGT_PROXY is documented as the number of console proxy layers and should only be used when configuring a proxy for the console. The default is 0, meaning no proxy is configured.

Two manual settings change the decision even if the manager script is otherwise attractive. On an ARM server the guide says to set ARCH_SUFFIX to -arm and to use the ARM Postgres image. It also states that SafeLine installed on ARM requires a Pro license to work properly, and that the Personal Edition is not supported on ARM. I confirm edition and architecture before I install, because a successful container start is not the same statement as a supported edition. For the LTS line, RELEASE is set to -lts. The guide states that the LTS version will no longer be maintained starting from 9.1.0-LTS (14 August 2025), and that LTS users are strongly recommended to upgrade to the latest version. If there are concerns about a new release, the same note recommends upgrading one month after that release. For a first host I stay on the latest recommended automatic install unless I have a specific reason to select LTS and accept that maintenance status.

Uninstall is also explicit, and it is destructive. Enter the SafeLine directory, run docker compose down, then remove the directory with rm -rf only when you are sure you no longer want to use SafeLine. I do not use that sequence to reset a host that failed the ssse3 or disk check. Those failures should be fixed, or the install should be abandoned, before any data directory exists.

The manager script is the right Linux install path when the dependency table already passes, root is available, and I do not need to override the environment variables that only the manual page documents. It is the wrong moment to experiment when architecture, license edition, disk, or Docker version is still unknown.

What does the official manager script require on Linux?

The automatic command requires root. The host must already meet the published minimums: Linux, x86_64 or arm64, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, 1 CPU core, 1 GB of memory, 5 GB of disk, and ssse3. I verify those with the commands in the deploy guide before I run the script.

Is the web console available as soon as the script finishes?

The deploy guide says a completed command means the installation succeeded and that you should open the web UI. The documented console URL is https://<safeline-ip>:9443/. You still need the administrator password from docker exec safeline-mgt resetadmin before login will succeed.

Does installation alone proxy my existing site?

No. You must add an application in the console, set domain, listen port, and upstream, and resolve that domain to the SafeLine server. Until that forwarding path exists, the origin is not behind the WAF described in the configuration guide.

Should an ARM host use the same one-line install without extra review?

Review the ARM notes first. The deploy guide says an ARM install must use the ARM architecture suffix and ARM Postgres image in the manual environment, and that SafeLine on ARM requires a Pro license. The Personal Edition is not supported on ARM.

How do I remove a test install without leaving the stack running?

From the SafeLine directory, run docker compose down. If you are certain you no longer want the product or its data, remove that directory with rm -rf. Do this only after you have exported anything you still need, because the documented removal deletes the directory.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

SafeLine website: https://ly.cyberserval.tech/MqhYdmI
Demo: https://demo.waf.chaitin.com:9443/statistics
Official docs: https://docs.waf.chaitin.com/en/home
GitHub: https://github.com/chaitin/SafeLine
Pro offer: https://cyberserval.tech/landing/lto