Coder Legion - Recent posts tagged license

How to Fix an ARM64 WAF Deploy When Personal Edition Is Not Supported

Sun, 01 Nov 2026 03:46:59 +0000

An ARM64 host can meet every published dependency and still be configured as an unsupported SafeLine deployment. The concrete misconfiguration is a manual .env left on the sample values: ARCH_SUFFIX is empty, POSTGRES_IMAGE is chaitin/safeline-postgres:15.18, and the operator plans to run Personal Edition. The Deploy guide says an ARM server must set ARCH_SUFFIX=-arm and POSTGRES_IMAGE=chaitin/safeline-postgres-arm:15.18. It also states that SafeLine installed on ARM requires a Pro license to work properly, and that the Personal Edition is not supported on ARM (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

Confirm the host before editing .env

SafeLine lists Linux, instruction architectures x86_64 and arm64, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, and a minimum environment of 1 core CPU, 1 GB memory, and 5 GB disk (https://docs.waf.chaitin.com/en/GetStarted/Deploy). The same page gives the checks: uname -m for instruction architecture, docker version, docker compose version, free -h, and df -h. It also lists a CPU ssse3 check with lscpu | grep ssse3. Run uname -m first. If it reports an ARM architecture, do not keep the blank ARCH_SUFFIX from the sample .env. A blank suffix is the sample default, not the ARM setting.

The Deploy guide also offers an automatic install command that requires root. This fix follows the manual path, because that is where ARCH_SUFFIX and POSTGRES_IMAGE are written by hand. Create the data directory with mkdir -p "/data/safeline", download https://waf.chaitin.com/release/latest/compose.yaml into that directory, and write .env there. The sample sets SAFELINE_DIR=/data/safeline, IMAGE_TAG=latest, MGT_PORT=9443, a Postgres password, SUBNET_PREFIX=172.22.222, IMAGE_PREFIX=chaitin, an empty ARCH_SUFFIX, an empty RELEASE, REGION=-g, and MGT_PROXY=0. On ARM, replace the architecture lines before the first launch. Set ARCH_SUFFIX=-arm and POSTGRES_IMAGE=chaitin/safeline-postgres-arm:15.18. Leave RELEASE empty unless you intentionally want the LTS build. The Deploy guide says the LTS version will no longer be maintained starting from 9.1.0-LTS (14 August 2025) and strongly recommends an upgrade to the latest version.

Generate the documented secrets in the SafeLine directory, write DETECTOR_MGMT_TOKEN, MGT_INTERNAL_TOKEN, and DETECTOR_AES_KEY into .env, and chmod 600 .env. Those steps are separate from the architecture mistake, but a correct ARM file still needs them before docker compose up -d. Also create the documented resource directories and apply the documented permissions before launch, including chmod 700 on the run, mgt, sock, and postgres data paths named in the guide, plus the documented socket link.

The edition limit is not an image-tag typo

Changing the suffix does not remove the edition limit. The Deploy guide is explicit: SafeLine installed on ARM requires a Pro license to work properly, and the Personal Edition is not supported on ARM. If the only edition you can activate is Personal Edition, correcting ARCH_SUFFIX is not enough to make that edition supported. Treat a Personal Edition plan on this host as part of the same misconfiguration, not as a tuning choice. The supported path in that document is a Pro license together with the ARM image settings.

The Deploy guide does not publish a sample denial log for a Personal Edition install on ARM. Do not treat a guessed error string as proof. Use the written requirement as the decision, then use the console screen below as proof that the corrected deploy is actually up.

The screen that confirms the fix

After ARCH_SUFFIX=-arm, the ARM Postgres image line, and a Pro license are in place, start the stack with docker compose up -d from /data/safeline. The Deploy guide says this can take several minutes. The confirmation is the web console the guide tells you to open. Browse to https://<safeline-ip>:9443/ and you should see the web console page. Then run docker exec safeline-mgt resetadmin. A successful run prints the initial username, the initial password, and a Done line. Keep that password and log in. That console page, together with those resetadmin lines, is the screen that confirms the architecture settings were applied and the service reached the documented ready state.

If the console URL does not load, re-read .env before changing anything else. The two lines that define this misconfiguration are still the ones to check: ARCH_SUFFIX must be -arm, and POSTGRES_IMAGE must be chaitin/safeline-postgres-arm:15.18. Also confirm MGT_PORT is still 9443 unless you chose another console port, because the documented URL uses that port. MGT_PROXY should stay 0 unless you are configuring a proxy for the console. Re-check uname -m if you are no longer sure the host is ARM. The architecture check and the .env lines have to agree before the console can be treated as a fixed ARM deploy.

After the console is up

SafeLine is a self-hosted WAF placed in front of a web application. The product introduction says it filters and monitors HTTP traffic and can defend against SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoor, brute force, HTTP flood, and bot abuse (https://docs.waf.chaitin.com/en/home). Core capabilities listed there include defenses for web attacks, proactive bot abused defense, HTML and JS code encryption, IP-based rate limiting, and a web access control list. The docs also state that SafeLine is production-ready. It works as a reverse proxy: clients pass through SafeLine before they reach the server, and SafeLine forwards traffic that passes policy (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

Once login works, open the Applications page and click Add Application. Enter the domain, hostname, or IP, the listen port such as 80 or 443, check SSL for an HTTPS app, and set the upstream to the real address of the original app. Resolve that domain to the IP of the server where SafeLine runs. The configuration guide shows sample requests for SQL injection, XSS, path traversal, code injection, and XXE, and says a blocking page means the attack was defended. Open the console attack list and click detail for the event. That check proves protection on a live site. It does not replace the resetadmin screen that confirmed the ARM deploy itself.

Does Personal Edition run on an ARM64 SafeLine host?

No. The Deploy guide says SafeLine installed on ARM requires a Pro license to work properly, and the Personal Edition is not supported on ARM (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

Which environment lines are wrong on ARM if I keep the sample file?

ARCH_SUFFIX is empty in the sample, and the sample Postgres image is chaitin/safeline-postgres:15.18. On an ARM server those must become ARCH_SUFFIX=-arm and POSTGRES_IMAGE=chaitin/safeline-postgres-arm:15.18.

What output confirms the corrected deploy?

The web console at https://<safeline-ip>:9443/ should load, and docker exec safeline-mgt resetadmin should print the initial username, the initial password, and Done.

Is arm64 outside the published architecture list?

No. The dependency table lists instruction architectures x86_64 and arm64. The command uname -m is the documented way to view the instruction architecture before you choose ARCH_SUFFIX.

What should I verify before the first docker compose up?

Confirm Docker is 20.10.14 or above, Docker Compose is 2.0.0 or above, and the host has at least 1 core, 1 GB memory, and 5 GB disk. On ARM, also confirm the two image lines and that you are not relying on Personal Edition.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

SafeLine website: https://ly.cyberserval.tech/MqhYdmI
Demo: https://demo.waf.chaitin.com:9443/statistics
Official docs: https://docs.waf.chaitin.com/en/home
GitHub: https://github.com/chaitin/SafeLine
Pro offer: https://cyberserval.tech/landing/lto

Why I Check ARM64 Edition Limits Before Turning SafeLine On

Sun, 01 Nov 2026 03:46:28 +0000

I do not turn protection on until an ARM64 host has passed an edition check. Architecture support and edition support are different facts. The deploy guide lists both x86_64 and arm64, then states that SafeLine installed on ARM requires a Pro license to work properly and that the Personal Edition is not supported on ARM (https://docs.waf.chaitin.com/en/GetStarted/Deploy). If I treat arm64 as permission to use Personal Edition, I can finish Docker setup and still have an instance that is not allowed to do the job.

This is the checklist I run before any public cutover.

Confirm the edition before touching images

I run uname -m first, because that is the documented way to view instruction architecture. If the host is not x86_64, I treat it as an ARM deployment and stop unless a Pro license is already available. I do not infer a price, a trial, or an activation command. The deploy page states the requirement and does not document those extras, so they stay outside the decision.

Image settings come next, and only after the license gate. On an ARM server the same guide says to set ARCH_SUFFIX=-arm and POSTGRES_IMAGE=chaitin/safeline-postgres-arm:15.18. Those values select ARM builds. They do not waive the Personal Edition limit. My written rule is simple: ARM images without a confirmed Pro license means do not install, or uninstall if a test install already happened. The documented removal path is docker compose down in the SafeLine directory, then removal of that directory only when I am sure the data can go.

Prove the host meets the published minimum

Support for arm64 does not mean every small board is a safe place to put a reverse proxy. The deploy guide requires Linux, Docker 20.10.14 or above, and Docker Compose 2.0.0 or above. The minimum environment is 1 CPU core, 1 GB of memory, and 5 GB of disk. The CPU must provide ssse3. I use the listed checks: docker version, docker compose version, free -h, df -h, processor lines from /proc/cpuinfo, and lscpu | grep ssse3.

I also reserve the data directory before install. SafeLine writes configuration and data there, and the guide expects at least 5 GB. The manual layout uses /data/safeline. If memory, disk, Docker, or ssse3 fails, I fix the host first. Putting a filter in front of a healthy origin on an unfit host creates an outage that looks like an attack.

Decide what on will change for clients

SafeLine is a self-hosted web application firewall. It sits in front of an application as a reverse proxy, filters and monitors HTTP and HTTPS, and blocks malicious traffic while forwarding the rest (https://docs.waf.chaitin.com/en/home). The application guide adds that it is developed based on nginx: it receives traffic for the original site, cleans malicious traffic, and forwards safe traffic upstream (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

Before I add an application, I write down the three required fields. Domain can be a domain name, a hostname, or an IP address. Port is what SafeLine will listen on, such as 80 or 443, with SSL checked for HTTPS applications. Upstream is the real address SafeLine will use to reach the origin. After those settings, the domain has to resolve to the SafeLine server. That DNS change is the moment protection is actually on for visitors. I do not make it until the upstream answers through the proxy.

I also pick controls deliberately instead of enabling every feature on the first day. Documented capabilities include defenses against SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoor, brute force, HTTP flood, and bot abuse. Separate controls cover IP-based rate limiting, a web access control list, CAPTCHA challenge, an authentication challenge that blocks visitors who do not enter the password, and dynamic protection that encrypts HTML and JavaScript on each visit. Rate limiting is described as throttling traffic that exceeds defined limits, including DoS attempts, brute-force attempts, and traffic surges. I enable the extra challenges only after a normal page load works. A password wall or a CAPTCHA on a broken upstream hides the real fault.

Choose the install path and the release channel

Automatic install is the recommended path. The English command in the deploy guide is bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en, and it requires root. I still run the edition and host gates before I paste it, because a successful script is not the same as a supported Personal Edition on ARM.

Manual install is the path I use when I want the ARM suffix visible before docker compose up -d. That path installs Docker if needed, creates /data/safeline, downloads compose.yaml, writes .env, generates the documented secrets, and fixes permissions. The console port is MGT_PORT, 9443 unless I change it. After startup I open https://<safeline-ip>:9443/ and create the first administrator with docker exec safeline-mgt resetadmin. I store that initial password before anyone else logs in.

RELEASE=-lts is a separate decision. The deploy guide says the LTS version will no longer be maintained starting from 9.1.0-LTS on 14 August 2025, and it strongly recommends upgrading to the latest version. If I am uneasy about a new release, the same page recommends upgrading about one month later. I never choose LTS as a way around the ARM Pro requirement.

Turn the proxy on, then test, then cut over

When the checks above are true, I add the application and only then move a test name to the SafeLine address. I replay the documented probes against my own domain: a SQL injection union-select, an XSS onerror payload, a path traversal toward /etc/passwd, a code-injection probe, and an XXE-style payload. A blocking page means that request was stopped. I open the console attack list and read the detail view so the block is recorded, not just displayed. I also load a known-good URL. Protection is on only when bad requests are blocked, good requests still reach the origin, and I can move DNS back if the proxy path fails.

Does Personal Edition work on ARM64?

No. The deploy guide says SafeLine on ARM requires a Pro license to work properly, and that the Personal Edition is not supported on ARM. ARCH_SUFFIX=-arm only selects ARM images.

What host checks should pass before installation?

Linux on x86_64 or arm64, Docker 20.10.14 or newer, Docker Compose 2.0.0 or newer, at least 1 core, 1 GB of memory, 5 GB of disk, and ssse3. The deploy guide names uname -m, the Docker version commands, free -h, df -h, CPU info, and lscpu | grep ssse3.

What changes when protection is turned on?

Visitors reach SafeLine instead of the origin. SafeLine listens on the configured port, filters HTTP or HTTPS, and forwards safe traffic to the upstream. The application domain must resolve to the SafeLine server, so the cutover is a DNS and proxy change.

How can I test blocking without inventing new attacks?

Use the probes in the application guide, pointed at your own domain: SQL injection, XSS, path traversal, code injection, and XXE. Expect a blocking page, then confirm the event in the console attack list detail view. Also request a normal page so you know the upstream still works.

Does the LTS channel remove the ARM edition limit?

No. LTS is a release choice, set with RELEASE=-lts. Maintenance for that line stops at 9.1.0-LTS, dated 14 August 2025, and the deploy guide recommends the latest version. The Pro license requirement for ARM remains either way.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

SafeLine website: https://ly.cyberserval.tech/MqhYdmI
Demo: https://demo.waf.chaitin.com:9443/statistics
Official docs: https://docs.waf.chaitin.com/en/home
GitHub: https://github.com/chaitin/SafeLine
Pro offer: https://cyberserval.tech/landing/lto