DEV Community

Carrie
Carrie

Posted on

Migrating from Cloud WAF to Self-Hosted SafeLine: A Practical Guide

#safelinewaf #cloudflaremigration #selfhosted #cybersecurity

Switching from a cloud-based WAF like Cloudflare to a self-hosted solution such as SafeLine WAF can feel daunting, but it’s a strategic move for teams looking for full control, better data privacy, and flexible rule customization.

In this article, I’ll walk you through the migration process, highlight potential pitfalls, and share actionable tips to make your transition smooth.

Why Consider Migrating?

Cloud WAFs are convenient, but they have limitations:

  • Data residency concerns: Traffic passes through third-party servers.
  • Limited rule customization: Cloud WAFs provide templates, but fine-grained control is restricted.
  • Latency & dependency: External proxies can introduce delays and single points of failure.

SafeLine WAF, being self-hosted, addresses these issues by running entirely in your infrastructure, giving you:

  • End-to-end traffic control
  • Granular bot protection and rate-limiting
  • Customizable rules per endpoint
  • Full visibility into logs and analytics

Step 1: Assess Your Current Setup

Before migration, inventory your existing Cloudflare or cloud WAF configuration:

  • DNS setup: Make a note of proxied subdomains and CNAMEs.
  • Rules & policies: Export IP blocklists, rate-limits, and bot protection settings.
  • SSL/TLS: Identify certificates used by your domains.
  • Logging & analytics: Check what logs you want to preserve or replicate.

This step ensures nothing critical is missed during migration.

Step 2: Prepare SafeLine Environment

SafeLine runs self-hosted, typically on a Linux server. Recommended specs:

  • CPU: 4+ cores
  • RAM: 8+ GB
  • Storage: SSD recommended for logs

Install SafeLine:

# Pull SafeLine Docker image
docker pull safeline/waf:latest

# Start SafeLine container
docker-compose up -d
Enter fullscreen mode Exit fullscreen mode

Check that your server is reachable and ports 80/443 are open.

Step 3: Configure SSL/TLS

If you’re migrating from Cloudflare, your domain likely has SSL termination at the edge. SafeLine supports Let’s Encrypt and custom certificates:

Once configured, SafeLine can serve traffic securely without relying on Cloudflare’s proxy.

Step 4: Recreate Rules & Policies

  1. IP allow/block lists: Import previous lists into SafeLine.
  2. Rate limiting: Apply endpoint-specific limits.
  3. Bot protection: Enable JS/CAPTCHA challenges as needed.
  4. Custom rules: SafeLine allows regex-based request matching for fine-grained control.

Example:

# Limit /api/login to 5 req/sec per IP
docker exec -it safeline-cli set-rule /api/login rate-limit 5
Enter fullscreen mode Exit fullscreen mode

Step 5: DNS Cutover

  1. Point your domain’s A/AAAA record to your SafeLine server.
  2. Disable Cloudflare proxy (orange cloud → grey cloud) temporarily to test traffic.
  3. Monitor SafeLine logs for errors or blocked requests.

Tip: Use a staging subdomain first to validate rules before cutting over production traffic.

Step 6: Monitoring & Fine-Tuning

Once live:

  • Tail access logs to check bot detection: 
tail -f /data/safeline/logs/nginx/safeline/access.log | grep "bot"
Enter fullscreen mode Exit fullscreen mode
  • Monitor CPU and memory usage
  • Adjust custom rules based on real traffic patterns

Key Considerations

  • SafeLine is self-hosted: You’re responsible for server maintenance, backups, and uptime.
  • Granular control: Offers flexibility, but requires careful tuning.
  • Migration period: Run both Cloudflare and SafeLine in parallel to avoid downtime.

Developer Takeaways

  • Migration gives full control and eliminates third-party dependency
  • Logs provide detailed visibility for security audits
  • Endpoint-specific policies allow smarter bot protection
  • SafeLine integrates easily into CI/CD pipelines

Conclusion

Migrating from a cloud WAF to SafeLine may require planning, but the benefits of ownership, privacy, and flexibility are well worth the effort. By following the steps above, developers can safely move traffic, maintain security, and fine-tune WAF behavior to match their application’s needs.

Top comments (0)