DEV Community

Lia
Lia

Posted on

How to Put the WAF Management Console Behind a Proxy

#waf #proxy #console #deploy

The management console is not the same door as the site you want to protect. SafeLine is a self-hosted web application firewall that filters and monitors HTTP traffic and sits as a reverse proxy in front of a web application, so clients pass through it before they reach the origin server. Its documented capabilities include defenses for web attacks, proactive bot-abuse defense, HTML and JavaScript code encryption, IP-based rate limiting, and a web access control list, as described in the product introduction at https://docs.waf.chaitin.com/en/home.

Publishing that console through an extra proxy is a narrower setup. The deploy guide at https://docs.waf.chaitin.com/en/GetStarted/Deploy says the Web UI is opened at https://:9443/. In the manual environment file, MGT_PORT is the web console port, shown as 9443, and MGT_PROXY is the number of console proxy layers. The guide says to use MGT_PROXY only when configuring the proxy for the console. The default is 0, and 0 means no proxy is configured.

Those pages do not ship a configuration for a separate proxy product. This setup follows the documented install, records the layer count, and leaves unsupported proxy syntax out.

Numbered setup

  1. Match the host to the published dependencies. The deploy guide requires Linux, x86_64 or arm64, Docker 20.10.14 or above, and Docker Compose 2.0.0 or above. The minimum environment is 1 CPU core, 1 GB of memory, and 5 GB of disk. The CPU must support ssse3. Check with uname -m, docker version, docker compose version, cat /proc/cpuinfo, free -h, df -h, and lscpu filtered for ssse3. If the machine is ARM, the same page says SafeLine requires a Pro license to work properly and that the Personal Edition is not supported on ARM.

  2. Choose an install path that can store the console setting. The recommended automatic command is bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en. When that command finishes, the guide says installation succeeded and you can go to the Web UI. The command shown there does not set MGT_PROXY. For a first install that must record console proxy layers, use the manual steps, where the value is an explicit .env key.

  3. Create the SafeLine directory and fetch the compose file. Run mkdir -p "/data/safeline". The guide says SafeLine writes configuration and data to this directory and that you need at least 5 GB of disk. Then run wget "https://waf.chaitin.com/release/latest/compose.yaml" from /data/safeline.

  4. Write .env before launch. Create /data/safeline/.env with the documented keys: SAFELINE_DIR=/data/safeline, IMAGE_TAG=latest, MGT_PORT=9443, a POSTGRES_PASSWORD you choose, SUBNET_PREFIX=172.22.222, IMAGE_PREFIX=chaitin, ARCH_SUFFIX left empty on the non-ARM example, RELEASE left empty unless you select LTS, REGION=-g, and MGT_PROXY=0. Also set the documented Postgres image name and the detector token fields. Generate DETECTOR_MGMT_TOKEN and MGT_INTERNAL_TOKEN with od from /dev/urandom as 32-byte hex values, generate a 16-character alphanumeric DETECTOR_AES_KEY, write them with the set_env function shown in the guide, and run chmod 600 .env. On ARM, set ARCH_SUFFIX=-arm and POSTGRES_IMAGE to the ARM image named in the guide. If you set RELEASE=-lts, note the guide's warning that LTS is no longer maintained starting from 9.1.0-LTS (14 August 2025) and that LTS users are strongly recommended to upgrade to the latest version.

  5. Set the console proxy-layer count only for a real console proxy. Keep MGT_PROXY at 0 if you are not configuring a proxy for the console. If you are, set it to the number of those layers. Do not repurpose the key for attack detection, bot challenges, or site rate limits. The deploy guide defines it only as the console proxy-layer count, used only in that case.

  6. Finish the documented directory prep and start the stack. Create /data/safeline/resources/run, then apply chmod 700 to the run, mgt, sock, and postgres data directories and chmod 600 to .env. Link /data/safeline/resources/run/safeline.sock to /var/run/safeline.sock. From the SafeLine directory, run docker compose up -d. The guide says this can take several minutes.

  7. Open the direct console and create the administrator. Browse to https://:9443/, using the server address and the MGT_PORT you set. On the host, run docker exec safeline-mgt resetadmin. The guide says a successful run prints an initial username of admin and an initial password, and that you must remember both. Log in with that password. This direct URL is the readiness check the install page actually documents.

  8. Protect websites on the application path, not by recycling the console variable. The application guide at https://docs.waf.chaitin.com/en/GetStarted/AddApplication says to log in to the Web Admin Console, open Applications, and click Add Application. Enter the original domain, hostname, or IP, the listen port such as 80 or 443, and the upstream address of the real application. Check SSL for HTTPS apps. Resolve the domain to the SafeLine server IP. SafeLine then receives the site traffic, cleans malicious requests, and forwards the remaining traffic. That is a different proxy role from MGT_PROXY.

  9. Walk this checklist before you rely on a front proxy. Count only layers placed in front of the management console. A proxy that sends public site traffic to a protected application does not belong in that count. Use an integer equal to the number of console layers, because the field is a count and the supplied pages do not define vendor-specific modes. Point any later proxy at the host and MGT_PORT only after the direct login works. The pages do not publish forwarded-header names, a console health path, or a sample upstream block, so do not treat those details as product behavior. Authentication challenge, CAPTCHA, rate limiting, and dynamic HTML or JavaScript encryption are described for web apps in the introduction and feature list. The supplied pages do not say that editing MGT_PROXY enables them on the console. If you uninstall, enter the SafeLine directory, run docker compose down, and remove that directory. Retire the external console proxy in whatever system owns it. The uninstall section does not remove that outer layer for you.

Should MGT_PROXY stay at zero?

Yes, unless you are configuring a proxy for the console. The manual template sets MGT_PROXY=0, and the field note says the default means no proxy is configured. Set a different number only when it equals the console proxy layers you actually use.

Does the variable install or configure the outer proxy?

No. It stores the number of console proxy layers. The deploy guide does not install a separate proxy, and it does not include a server configuration for one. Building that outer proxy remains your own step, using software and syntax those pages do not specify.

Can I add the console as an application instead?

The supplied application guide does not tell you to do that. Add Application is for the original web app: domain, listen port, upstream, optional SSL, and DNS pointing at the SafeLine server. Console proxy layers are the MGT_PROXY setting in the deploy guide. Keep the two procedures apart.

Which URL should succeed before the proxy matters?

The documented Web UI URL is https://:9443/, or the same pattern with the MGT_PORT you configured. Run docker exec safeline-mgt resetadmin on the SafeLine host if you need the initial admin username and password again. A front proxy is not a substitute for that direct check.

What does this setup refuse to promise?

It does not promise a particular certificate layout, client-IP header, timeout, or proxy vendor for the console, because the supplied official pages do not define them. It also does not change how SafeLine filters site traffic. Site protection still depends on the reverse-proxy application settings in the application guide, while console publishing depends on the Web UI, MGT_PORT, and MGT_PROXY.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)