DEV Community

Lia
Lia

Posted on

How to Add a Site Domain, Port, and Upstream in a Reverse Proxy WAF

#reverseproxy #upstream #deployment #websecurity

SafeLine is placed in front of a web application so it can filter and monitor HTTP traffic before a request reaches the origin. The product introduction describes it as a self-hosted web application firewall. It is documented to defend against SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoor activity, brute force, HTTP flood, and bot abused traffic. That page lists core capabilities as web-attack defense, proactive bot abused defense, HTML and JavaScript code encryption, IP-based rate limiting, and a web access control list (https://docs.waf.chaitin.com/en/home).

The practical task is how to add a site domain, port, and upstream in a reverse proxy WAF without leaving the origin exposed. The add-application guide says SafeLine is developed on nginx. It receives traffic for the original website, cleans malicious attack traffic, and forwards safe traffic to the original application (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). Domain tells SafeLine which name to accept. Port tells it where to listen. Upstream tells it where the real application lives. This checklist follows only the official deploy guide and the official add-application guide. It does not add console fields, certificate steps, or policy toggles that those pages do not describe.

Check the server before you install

The deploy guide publishes minimum requirements and the commands used to confirm them (https://docs.waf.chaitin.com/en/GetStarted/Deploy). Finish this check before you create an application.

  1. Use Linux. The documented instruction architectures are x86_64 and arm64.
  2. Confirm Docker is version 20.10.14 or above, and Docker Compose is version 2.0.0 or above.
  3. Provide at least 1 CPU core, 1 GB of memory, and 5 GB of disk. The CPU must support ssse3.
  4. Run the documented checks: uname -m, docker version, docker compose version, cat /proc/cpuinfo | grep "processor", free -h, df -h, and lscpu | grep ssse3.
  5. If the machine is ARM, plan for the ARM image settings in the manual path. The deploy guide states that SafeLine installed on ARM requires a Pro license to work properly and that the Personal Edition is not supported on ARM.

Do not continue if Docker or Compose is older than the stated versions, if free disk is below 5 GB, or if ssse3 is absent. Those limits come from the install document, not from local preference.

Install and sign in

Automatic deployment is the recommended path, and the guide says it requires root privileges (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

  1. Run the documented installer: bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en.
  2. When the command finishes, the guide says installation succeeded. Open https://<safeline-ip>:9443/ and continue at the administrator login step below.

Use the manual path when you need to choose the directory, console port, architecture, or release channel yourself.

  1. If Docker is missing, install it with the documented command curl -sSL "https://get.docker.com/" | bash. Skip this step when Docker is already installed.
  2. Create the data directory with mkdir -p "/data/safeline". SafeLine writes configuration and data there, and the directory needs at least 5 GB.
  3. Enter that directory and download the compose file from https://waf.chaitin.com/release/latest/compose.yaml.
  4. Create .env in /data/safeline and write the variables shown in the deploy guide. The published example sets SAFELINE_DIR=/data/safeline, IMAGE_TAG=latest, MGT_PORT=9443, a POSTGRES_PASSWORD placeholder you must replace, SUBNET_PREFIX=172.22.222, IMAGE_PREFIX=chaitin, an empty ARCH_SUFFIX, an empty RELEASE, REGION=-g, and MGT_PROXY=0. It also sets POSTGRES_IMAGE to chaitin/safeline-postgres:15.18, leaves the detector tokens and AES key as placeholders, sets DETECTOR_MGMT_AUTH=on and DETECTOR_UPDATE_VERIFY=on, and leaves DETECTOR_UPDATE_PUBLIC_KEY empty as shown.
  5. Replace the placeholder secrets with the guide's generators. Use od -An -N32 -tx1 to produce the 64-character hex value for DETECTOR_MGMT_TOKEN, use the same method for MGT_INTERNAL_TOKEN, and take 16 alphanumeric characters for DETECTOR_AES_KEY. Write them with the documented set_env helper, then run chmod 600 .env.
  6. On ARM only, set ARCH_SUFFIX=-arm and POSTGRES_IMAGE=chaitin/safeline-postgres-arm:15.18. Keep the Pro license requirement from the deploy guide in mind before you rely on that host.
  7. Set RELEASE=-lts only if you intentionally select the LTS channel. The deploy guide says the LTS version will no longer be maintained starting from 9.1.0-LTS (14 August 2025) and strongly recommends an upgrade to the latest version.
  8. Run mkdir -p /data/safeline/resources/run, then the documented chmod 700 on resources/run, resources/mgt, resources/sock, and resources/postgres/data. Run chmod 600 /data/safeline/.env if it is not already restricted, and link the socket with ln -sfn /data/safeline/resources/run/safeline.sock /var/run/safeline.sock.
  9. Start the stack with docker compose up -d. The guide says this may take several minutes.
  10. Create the first console account with docker exec safeline-mgt resetadmin. Save the printed username and password. The documented initial username is admin.
  11. Log in at https://<safeline-ip>:9443/ with that password.

MGT_PORT is the web console port. MGT_PROXY is the number of console proxy layers and should stay at 0 unless you are configuring a proxy for the console. Neither value is the public site port you will enter on the application form.

Enter domain, port, and upstream

The add-application guide starts from a working install (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). Enter the three site fields in one dialog so the reverse proxy has a complete route.

  1. Log in to the SafeLine Web Admin Console.
  2. Open the Applications page.
  3. Click Add Application in the upper right corner.
  4. In Domain, enter the domain name, hostname, or IP address of the original app. The documented example is www.chaitin.com. Use the name clients should request. Do not add a second name that you will not publish in DNS.
  5. In Port, enter the port SafeLine will listen on. The guide gives 80 and 443 as examples. If the application is HTTPS, check the SSL option. This page does not document a separate certificate upload flow, so this setup stops at that documented checkbox.
  6. In Upstream, enter the real address of the original app. The guide says SafeLine forwards traffic to the application through this address. As an operator check, keep that address pointed at the origin rather than at the SafeLine listen port you just chose, or the proxy path is no longer a path to the application. The page does not publish a required URL scheme, so use the address format the dialog accepts instead of assuming an undocumented pattern.
  7. Submit the dialog only after domain, port, and upstream are all set. A saved name without a listen port does not receive client traffic. A listen port without an upstream has nowhere to send clean requests.

Point DNS at the proxy and verify

  1. Resolve the domain you entered to the IP address of the server where SafeLine is located. The add-application guide states this step directly. Until that record points at SafeLine, visitors can still reach the origin and bypass the filter.
  2. Browse the application through that domain. The guide says this is how you access the application protected by SafeLine.
  3. On a site you operate, and only on that site, try the documented probes after replacing the example host. The guide lists SQL injection as /?id=1+and+1=2+union+select+1, XSS as /?id=<img+src=x+onerror=alert()>, path traversal as /?id=../../../../etc/passwd, code injection as /?id=phpinfo();system('id'), and XXE as /?id=<?xml+version="1.0"?><!DOCTYPE+foo+SYSTEM+"">.
  4. A blocking page means SafeLine defended the request. Open the web console, find the attack list, and click detail to read the event. Do not send these probes to any application you do not control.

Rate limiting, CAPTCHA challenge, authentication challenge, and dynamic HTML and JavaScript protection are listed in the product introduction (https://docs.waf.chaitin.com/en/home). The CAPTCHA challenge is documented as allowing human users through while blocking crawlers and bots. The authentication challenge is documented as requiring a password, with other visitors blocked. Dynamic protection is documented as encrypting HTML and JavaScript on each visit when it is turned on. The add-application page does not include the toggle steps for those controls, so leave them out of this domain, port, and upstream change. Confirm the proxy path first, then configure those controls only from documentation that actually describes them.

FAQ

What do domain, port, and upstream mean in the add-application dialog?

Domain is the original app's domain name, hostname, or IP address. Port is the port SafeLine listens on, such as 80 or 443. Upstream is the real address of the original app, and SafeLine forwards safe traffic there (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

Which install method should I finish before adding a site?

The deploy guide recommends the automatic installer and says a completed command means you can use the web UI. The manual compose path is the documented alternative when you must set the directory, environment file, ARM suffix, or release channel yourself (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

How do I mark an HTTPS application?

Use the same Port field and check the SSL option. The guide cites 443 as a typical listen port for HTTPS. It does not describe extra certificate fields on this page, so do not add an undocumented upload step to this procedure.

Why does the origin still receive traffic after I save the application?

Saving the dialog does not move public DNS. You still have to resolve the entered domain to the SafeLine server IP. Clients that follow an old record never enter the reverse proxy, so SafeLine cannot inspect those requests.

How do I confirm that a test request was blocked?

Replace the example host in the official test cases with your own protected domain. If the blocking page appears, the defense fired. Then open the console attack list and click detail for the event (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)