DEV Community

Lia
Lia

Posted on

How to Plan a SafeLine WAF Upstream Health Check Interval

#websecurity #reverseproxy #uptime #deployment

SafeLine is a self-hosted WAF that filters and monitors HTTP traffic between a web application and the internet, blocking attacks such as SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, and backdoor (https://docs.waf.chaitin.com/en/home). It works as a reverse proxy: clients pass through SafeLine before reaching the origin server, and SafeLine forwards cleaned traffic to the real application (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

Before tuning an upstream health check interval, you need a working SafeLine deployment and a correctly registered upstream address. The official documentation does not expose a dedicated health check interval field, so this article separates the documented setup from the decision checklist you should apply to your upstream monitoring configuration.

Setup steps

  1. Verify the host dependencies. SafeLine requires Linux with x86_64 or arm64 architecture, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, and at least 1 core CPU, 1 GB memory, and 5 GB disk with ssse3 support (https://docs.waf.chaitin.com/en/GetStarted/Deploy). Run uname -m, docker version, docker compose version, free -h, and df -h to confirm the environment.

  2. Run the automated installer with root privileges: bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en. After the command completes, SafeLine is installed and ready for the web console (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

  3. For a manual install, create the data directory with mkdir -p "/data/safeline", download the compose file with wget "https://waf.chaitin.com/release/latest/compose.yaml", write the required values into .env including SAFELINE_DIR, IMAGE_TAG, MGT_PORT, POSTGRES_PASSWORD, and the detector management tokens, then start the service with docker compose up -d (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

  4. Open the web console at https://:9443/ and create the administrator account by running docker exec safeline-mgt resetadmin, which returns the initial username admin and a generated password (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

  5. Register the application. In the Applications page, click Add Application and enter the Domain, the Port that SafeLine will listen on such as 80 or 443, and the Upstream value containing the real address of the original app where SafeLine forwards traffic (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). For HTTPS applications, enable the SSL option.

  6. Resolve the domain name to the IP address of the server where SafeLine is located, then access the application through that domain to confirm the proxy path is live (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

Health check decision checklist

SafeLine is developed based on nginx (https://docs.waf.chaitin.com/en/GetStarted/AddApplication), and the Add Application flow treats the Upstream value as the forwarding target. Because the supplied documents do not define a separate health check interval control, do not assume a hidden default. Instead, verify the following before changing any monitoring behavior:

  • Confirm the upstream endpoint actually accepts the probe method SafeLine will use, whether a TCP connection check or an HTTP request.
  • Set the check timeout lower than the interval so a slow upstream fails cleanly rather than overlapping the next probe.
  • Choose an interval that matches how quickly your origin should be marked down; a shorter interval detects failure faster but increases probe traffic.
  • Define how many consecutive failures should mark the upstream unhealthy, and how many successes should restore it.
  • Monitor the upstream status after deployment so the configured interval is validated against real failure behavior rather than a guessed value.

Does the official guide expose a health check interval field?

No. The supplied Add Application guide lists only Domain, Port, Upstream, and an SSL option for HTTPS applications (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). A dedicated health check interval is not documented there.

Where is the upstream address configured?

In the Add Application dialog on the Applications page. The Upstream field holds the real address of the original app, and SafeLine forwards cleaned traffic to it (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

Which ports should I listen on?

Enter the port SafeLine will listen on, such as 80 or 443, and check the SSL option for HTTPS applications (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). This port is separate from the upstream port on your origin.

How do I know the proxy path is working?

Resolve your domain to the SafeLine server IP, then access the application through the domain. Attack test requests should return a blocking page, and the web console should list the blocked attempts (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

What should I check before changing a health check interval?

Verify the probe method, timeout, failure threshold, recovery threshold, and whether your origin can tolerate the extra probe load. Since the supplied documents do not specify an interval value, treat these as checks rather than assumed SafeLine defaults.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)