Coder Legion - Recent posts tagged upgrade

How to Move an LTS Install to the Latest Release

Mon, 02 Nov 2026 02:42:22 +0000

Moving an LTS SafeLine install to the latest release starts with one file, not with a migration wizard. The install guide does not publish a separate upgrade command, a schema converter, or a rollback button. It does publish a hard maintenance fact: the LTS version will no longer be maintained starting from 9.1.0-LTS on 14 August 2025, LTS users are strongly recommended to upgrade to the latest version, and anyone with concerns should wait until one month after a new version is released (https://docs.waf.chaitin.com/en/GetStarted/Deploy). SafeLine itself is a self-hosted web application firewall. Deployed in front of an application, it is a reverse proxy that filters and monitors HTTP and HTTPS, and it is documented to defend against SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoors, brute force, HTTP flood, and bot abuse, with rate limiting, CAPTCHA challenge, authentication challenge, and dynamic HTML and JS protection among its listed capabilities (https://docs.waf.chaitin.com/en/home). None of those protections matter if the host is still selecting an unmaintained release track by accident.

The misconfiguration is a leftover LTS selector. Manual install writes an environment file whose sample sets IMAGE_TAG=latest and RELEASE= with an empty value. The same page defines RELEASE in one line: set it to -lts to use the LTS version (https://docs.waf.chaitin.com/en/GetStarted/Deploy). IMAGE_TAG is defined separately as the SafeLine version to be used. Those are not the same key. A common failed move looks like this on screen: the operator downloads https://waf.chaitin.com/release/latest/compose.yaml into the SafeLine directory, sees latest in that URL, sees IMAGE_TAG=latest, and stops reading. The next line, or a line left over from the original LTS install, still says RELEASE=-lts. That is the documented LTS switch. Until that value is empty, the environment file has not been brought in line with the latest sample, no matter how many times the latest compose file is fetched. The automated installer, bash -c with the latest manager.sh and an --en argument, is documented as the way to start an automated installation. It is not documented as an in-place rewrite of an existing LTS environment file, so a successful-looking curl is not evidence that RELEASE was cleared.

Confirm the fix on two screens the guide already names. First, open the environment file in the SafeLine directory. The corrected screen shows RELEASE= and nothing after the equals sign, IMAGE_TAG=latest, SAFELINE_DIR pointing at the directory you intend to keep, MGT_PORT set to the console port you will actually open, and MGT_PROXY left at 0 unless you are configuring console proxy layers. The sample default port is 9443. ARCH_SUFFIX is empty on x86_64 and -arm on ARM, with POSTGRES_IMAGE switched to the documented ARM image name only in the ARM case. The file should still contain the postgres password, subnet prefix, image prefix, and the generated detector and management secrets, and it should remain readable only by the owner because the guide sets chmod 600 on .env. If RELEASE=-lts is still visible, you have not fixed the selector. Do not invent a second flag to override it. The documented latest sample uses an empty RELEASE, not a new token such as a made-up stable or current label.

Second, start from that directory with the documented launch command, docker compose up -d. The install guide says this can take several minutes. The confirming screen is not an imagined upgrade banner. It is the web console at https://<safeline-ip>:9443/. If you cannot log in and you need the administrator account, docker exec safeline-mgt resetadmin prints the initial username and the initial password. Read that output in the terminal and store it outside the chat log. A console login page after an environment file that shows an empty RELEASE is the pair that confirms the selector change and a started UI. It does not, by itself, prove that old LTS data was converted. The install guide never documents data migration, database conversion, or rollback, so do not describe the login page as a completed data upgrade. Describe it as the documented sign that the stack you just started presented its console.

Run the dependency checks before you change the release line, because a bad host will hide a good .env. The guide requires Linux, x86_64 or arm64, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, at least 1 CPU core, 1 GB of memory, 5 GB of disk, and the ssse3 instruction (https://docs.waf.chaitin.com/en/GetStarted/Deploy). The listed commands are uname -m, docker version, docker compose version, a processor listing from /proc/cpuinfo, free -h, df -h, and lscpu filtered for ssse3. On ARM, an empty ARCH_SUFFIX is its own misconfiguration, separate from RELEASE. SafeLine installed on ARM requires a Pro license to work properly, and the Personal Edition is not supported on ARM. Clearing the LTS flag does not remove that license boundary. If ssse3 is missing, or disk is under 5 GB, fix the host first. Fetching compose.yaml again will not add a CPU instruction.

Do not confuse uninstall with the move. Documented uninstall is to enter the SafeLine directory, run docker compose down, then remove that directory with rm -rf (https://docs.waf.chaitin.com/en/GetStarted/Deploy). The removal deletes SafeLine data. An empty directory is the screen for a completed uninstall, not the screen for a move to latest. If the only wrong line is RELEASE=-lts, leave the directory in place, correct that line to the empty latest value, and use the start command. There is no documented backup command in the install guide, so treat deletion as final.

Once the console is up, prove the proxy path with the application guide rather than with another release flag. Log in, open Applications, and add an application with the original domain or host, the listen port, and the upstream address. For HTTPS, check the SSL option. Then resolve that domain to the SafeLine server (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). The guide's attack checks are query-string cases for SQL injection, XSS, path traversal, code injection, and XXE. Replace the example domain with yours. The confirming screen for filtering is the blocking page. The confirming screen for visibility is the attack list in the web console, then the detail view. A login page only means the management UI answered. The blocking page plus detail means this instance filtered a request after you left the LTS selector behind.

If the console does not load, return to the environment file before you download anything else. Check that MGT_PORT matches the port in the browser URL, that MGT_PROXY is still 0 when no console proxy is configured, and that RELEASE is empty rather than -lts. Recheck Docker and Compose versions against the minimums above. The guide's advice on timing still applies: if you are uneasy about a build that has just appeared, wait one month after that release before you move. The maintenance note is a recommendation to leave LTS, not an order to cut over on the announcement day.

Why does IMAGE_TAG=latest not prove the install left LTS?

IMAGE_TAG is the version field in the sample file, and the sample sets it to latest. RELEASE is a different key. The install guide says to set RELEASE to -lts when you want the LTS version, and the latest sample leaves RELEASE empty (https://docs.waf.chaitin.com/en/GetStarted/Deploy). A file that still shows RELEASE=-lts has not left the documented LTS selector, even if the compose file came from the latest URL.

What screen confirms the release setting was corrected?

Read the environment file. The corrected screen is RELEASE= with an empty value beside IMAGE_TAG=latest. Then run docker compose up -d from the SafeLine directory and open https://<safeline-ip>:9443/. That web console is the start screen the install guide documents. If you need credentials, docker exec safeline-mgt resetadmin prints the initial username and password. There is no documented upgrade-complete log line beyond those screens.

Should I uninstall before moving to the latest release?

No. Uninstall stops the stack with docker compose down and then deletes the SafeLine directory, which removes data (https://docs.waf.chaitin.com/en/GetStarted/Deploy). Use that only when you mean to stop using the product. The latest sample does not ask you to delete data in order to clear RELEASE. An empty directory confirms uninstall, not a release move.

How do I confirm the console is actually protecting traffic?

Add the application with domain, port, and upstream, and point DNS at the SafeLine host (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). Try one documented test case, such as a SQL injection or path traversal query string, on your own domain. The blocking page confirms the request was stopped. The attack list and its detail view confirm the console recorded it. A reachable login page does not prove that filtering path.

What should I check on ARM before clearing RELEASE?

Run uname -m first. On ARM the guide sets ARCH_SUFFIX to -arm and names the ARM Postgres image. SafeLine on ARM requires a Pro license, and the Personal Edition is not supported on ARM (https://docs.waf.chaitin.com/en/GetStarted/Deploy). An empty RELEASE value does not change that. Also confirm Docker 20.10.14 or newer, Compose 2.0.0 or newer, memory, disk, and ssse3 before starting the stack again.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

SafeLine website: https://ly.cyberserval.tech/MqhYdmI
Demo: https://demo.waf.chaitin.com:9443/statistics
Official docs: https://docs.waf.chaitin.com/en/home
GitHub: https://github.com/chaitin/SafeLine
Pro offer: https://cyberserval.tech/landing/lto

Why I Run This Checklist Before Switching SafeLine LTS to the Latest Release

Mon, 02 Nov 2026 02:41:51 +0000

SafeLine is a self-hosted web application firewall that works as an nginx-based reverse proxy, filtering, monitoring, and blocking malicious HTTP/S traffic before it reaches a web application (https://docs.waf.chaitin.com/en/home). The deployment guide documents its protection scope, including attacks such as SQL injection, XSS, code injection, OS command injection, path traversal, and SSRF. If your deployment still points at the long-term-support channel, the documentation is explicit: the LTS version will no longer be maintained starting from 9.1.0-LTS (14 August 2025), and LTS users are strongly recommended to upgrade to the latest version (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

I treat this migration as a release-management decision rather than a simple version bump. Turning protection back on is the final step, so I work through the checklist below before enabling the new install.

Decision checklist before turning protection on

Confirm the current configuration. Inspect the install directory and .env file to see whether RELEASE is set to -lts. The deployment guide notes that RELEASE is the switch that selects the LTS version, and leaving it unset targets the latest channel.
Verify the host still meets the minimum requirements. The deployment guide lists Linux on x86_64 or arm64, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, and at least 1 CPU, 1 GB memory, and 5 GB disk, with ssse3 CPU support.
Check ARM licensing before committing. The documentation states that SafeLine installed on ARM requires a Pro license to work properly and that the Personal Edition is not supported on ARM.
Protect the data and secrets first. The install directory contains SafeLine configuration and data, including the .env file with the PostgreSQL password and generated detector and management tokens. The guide sets .env permissions to 600, so preserve that file and the SAFELINE_DIR contents before pulling new images.
Choose the timing deliberately. The guide recommends that if you have concerns, you should upgrade one month after the release of a new version. This lets a fresh release age before it becomes your enforcement point.
Plan the actual cutover. The manual path downloads the latest compose.yaml into the SafeLine directory, updates .env, and starts the stack with docker compose up -d. The automatic path runs the manager script from the release/latest URL. Whichever route you take, retrieve the administrator credentials with docker exec safeline-mgt resetadmin and log in at https://<safeline-ip>:9443/.
Re-confirm the application proxy before flipping traffic. The application setup flow requires a domain, a listening port, and an upstream address, and DNS must resolve the domain to the SafeLine server (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). Only after that mapping is correct do I consider protection turned on.

Is the LTS channel still receiving updates?

No. According to the deployment guide, the LTS version is no longer maintained starting from 9.1.0-LTS (14 August 2025). Staying on LTS means you stop receiving that maintenance stream, which is why the guide strongly recommends moving to the latest version.

Do I need to upgrade the moment a new release appears?

Not necessarily. The guide advises users who have concerns to wait about one month after a new version is released before upgrading. That window lets you observe the release while you still plan your own migration.

What exactly should I back up before switching?

Keep the SafeLine directory, especially the .env file and the PostgreSQL data under the install path. The .env file holds the POSTGRES_PASSWORD plus the detector and management tokens, and the guide keeps this file readable only by the owner with chmod 600. Copy these outside the working directory before you replace the compose stack.

How do I actually move from LTS to latest?

Set the release selector to the latest channel in .env by removing or emptying the RELEASE=-lts line and using IMAGE_TAG=latest, download the current compose.yaml from the release/latest URL, then run docker compose up -d in the SafeLine directory. After startup, run docker exec safeline-mgt resetadmin to get a fresh admin password and sign in at the console port.

What should I verify before turning protection back on?

Confirm the console is reachable at https://<safeline-ip>:9443/ and that you can log in. Re-check each application entry for its domain, port, and upstream address, and confirm DNS points at the SafeLine host. Finally, send a harmless request and a known attack pattern to make sure normal traffic passes while malicious traffic is blocked and visible in the attack list.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

SafeLine website: https://ly.cyberserval.tech/MqhYdmI
Demo: https://demo.waf.chaitin.com:9443/statistics
Official docs: https://docs.waf.chaitin.com/en/home
GitHub: https://github.com/chaitin/SafeLine
Pro offer: https://cyberserval.tech/landing/lto