Docker Compose WAF: Add SafeLine to Any Existing Stack in 3 Steps

The Situation

You already have a Docker Compose stack running: Nginx + your app + PostgreSQL + Redis. It works. You don't want to rebuild it. But you want WAF protection in front.

Here's how to add SafeLine to an existing Docker Compose project without disrupting anything.

Step 1: Create a Shared Network

# docker-compose.yml (add to your existing file)
networks:
  webnet:
    driver: bridge

Connect your existing services to this network:

services:
  app:
    networks:
      - webnet
  nginx:
    networks:
      - webnet

Step 2: Install SafeLine Separately

SafeLine uses its own Compose file. The installer creates it automatically:

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

The generated docker-compose.yml (for SafeLine) will be something like /opt/safeline/docker-compose.yml. Leave it alone — SafeLine manages this.

Step 3: Connect SafeLine to Your Network

Edit SafeLine's Compose file (/opt/safeline/docker-compose.yml) and add your existing network as external:

networks:
  safeline:
    driver: bridge
  webnet:
    external: true  # Your existing network

Then connect SafeLine's reverse proxy to both networks:

services:
  safeline-tengine:
    networks:
      - safeline
      - webnet

Step 4: Point Traffic Through SafeLine

Update your Nginx config to route traffic through SafeLine:

# Before (direct to app)
location / {
    proxy_pass http://app:3000;
}

# After (through SafeLine)
location / {
    proxy_pass http://safeline-tengine:80;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

Then in SafeLine's dashboard, point the site backend to your app container: app:3000.

Step 5: Restart

# Start all your services
docker compose up -d

# SafeLine should already be running from the installer
docker compose -f /opt/safeline/docker-compose.yml ps

Traffic flow:

Internet → Nginx:80 → SafeLine (inspection) → app:3000

The Beauty of This Setup

Your app doesn't change. SafeLine sits between Nginx and your app as a middleware proxy. No code changes. No config changes to your app containers. Just 3 lines in your Nginx config and one network connection.

SafeLine updates independently. When you update your app stack, SafeLine containers aren't touched. When SafeLine releases a new version, your app stack isn't touched.

You can test before switching. Set up SafeLine in detection-only mode first. Watch Attack Logs for a few days. Confirm zero false positives. Then switch to block mode.

Migration from Existing Reverse Proxy

If you currently use Nginx Proxy Manager, Traefik, or Caddy:

# Traefik example
labels:
  - "traefik.http.routers.app.middlewares=safeline"
  - "traefik.http.middlewares.safeline.forwardauth.address=http://safeline-tengine:80"

For Nginx Proxy Manager, add a custom location that forwards to SafeLine before reaching your app. The principle is the same: NPM -> SafeLine -> your app.

FAQ

Does this work with Kubernetes?

The pattern is the same but implemented differently. Use a DaemonSet for SafeLine or deploy it as a sidecar. The concept of "insert WAF between ingress and app" applies regardless of orchestrator.

What if SafeLine goes down?

Your app still runs, but traffic won't reach it — SafeLine is in the critical path. Mitigate with:

docker compose -f /opt/safeline/docker-compose.yml restart

Add a health check to your monitoring tool. If you need high availability, run SafeLine on a separate node with a load balancer in front.

Can I run SafeLine as a container in my existing compose file?

You can, but the installer-generated Compose file handles SSL certs, PostgreSQL, and the management service. It's safer to keep SafeLine as a separate compose project connected by shared networks.

---

What's your current Docker Compose stack looking like?

#webdev #devops #docker #security