Homelab and small-prod threads keep landing on the same question:
“I want a self-hosted WAF. SafeLine/Docker, or something smaller?”
There’s no universal winner. Here’s the decision frame I use after running both styles.
Two honest shapes
A) Docker / appliance WAF
Examples: SafeLine, BunkerWeb-style stacks, ModSecurity-in-compose.
Wins
- Polished dashboards
- Familiar deploy (
docker compose up) - Often opinionated defaults for homelab
Costs
- More containers, volumes, upgrades
- Another network path to reason about
- Host already busy? You feel it
B) Single-binary reverse proxy + WAF
Examples: Caddy + Coraza yourself, or a packaged product like Tiyi.
Wins
- One process, one upgrade artifact
- Fits “I already think in reverse proxies”
- Easy to put on a tiny VPS / metal box
Costs
- UI may be simpler than a full appliance
- You still need to understand CRS false positives
- Not a substitute for L3/L4 scrubbing
Decision checklist
Pick Docker appliance if most of these are true:
- You’re fine operating Compose long-term
- You want a rich security console first
- Multiple teammates will click through the UI daily
Pick single binary if most of these are true:
- You want
scp/ package / one systemd unit - Caddy (or Caddy-like) is already your front door
- You’re optimizing for fewer failure domains on one node
What I run when constraints are “one box, CRS, low glue”
I use Tiyi: Caddy + Coraza + OWASP CRS 4 + admin UI/CLI in one Go binary, SQLite, free on a single node.
- Site: https://www.tiyisec.com/
- 90s demo: https://www.tiyisec.com/assets/video/tiyi-demo.mp4
- Source: https://github.com/zzmzm/tiyi
I’m not arguing it’s “more secure than SafeLine.” It’s a packaging choice: less stack, more “proxy with CRS.”
False friends
- “WAF = anti-DDoS” — no. Different layer.
- “CRS with defaults forever” — you’ll tune. Budget time for false positives.
- “More containers = more secure” — sometimes just more surface.
Practical recommendation
- Write down the threat: scanners/SQLi vs volumetric floods vs credential stuffing.
- Pick the packaging that matches how you already operate.
- Prove a block (SQLi probe + log) before you polish dashboards.
If you comment your stack (Caddy/Nginx/Traefik, Docker yes/no, one node vs cluster), I’ll suggest the boring default for that case.
Top comments (0)