DEV Community

Lia
Lia

Posted on

How to Set Up SafeLine and Judge Balance vs Strict

#setup #detection #proxy #policy

Operators often search for a switch that moves WAF semantic analysis among audit, balance, and strict. The SafeLine pages used here do not document that switch. They never define semantic analysis as a configurable module, and they never describe an audit mode, a console control, a command, or an API that selects those three labels. Balance and Strict appear only as named rows in a published effect evaluation. Product facts in this guide come from the home page at https://docs.waf.chaitin.com/en/home, the deploy guide at https://docs.waf.chaitin.com/en/GetStarted/Deploy, and the application guide at https://docs.waf.chaitin.com/en/GetStarted/AddApplication. The workable path is to prepare the host, install the reverse proxy, protect one application, verify blocking, and use the published figures as a decision checklist.

Start with the numbers so the labels are not mistaken for buttons. The home page reports one evaluation table with 33669 samples in every row. SafeLine Balance is listed at 71.65 percent detection, 0.07 percent false positives, and 99.45 percent accuracy. SafeLine Strict is listed at 76.17 percent detection, 0.22 percent false positives, and 99.38 percent accuracy. The same table includes ModSecurity Level 1 and CloudFlare Free as comparison rows. Those rows are not integration steps, and neither the deploy guide nor the application guide says to copy another product's settings into SafeLine. The only defensible reading is comparative. In that table, Strict detects more of the sample set and records more false positives. Balance records slightly higher accuracy and a lower false-positive rate. Nothing on the page says these names are live policy modes, and nothing says an audit row was left out of a console. If a later build shows extra labels, wait for a document that maps them before you treat the table as a toggle.

Run the setup in the order below. Each step is taken from the deploy guide or the application guide.

  1. Match the host to the documented dependencies. SafeLine requires Linux, x86_64 or arm64, Docker 20.10.14 or above, and Docker Compose 2.0.0 or above. The minimum environment is 1 CPU core, 1 GB of memory, and 5 GB of disk. The CPU must provide the ssse3 instruction.
  2. Confirm the machine before you install. The deploy guide lists uname -m, docker version, docker compose version, cat /proc/cpuinfo | grep "processor", free -h, df -h, and lscpu | grep ssse3. Stop if architecture, Docker versions, disk space, or ssse3 do not match.
  3. Use the automatic installer when you want the recommended path. The command is bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en. It requires root privileges. After it finishes, continue at the web console rather than repeating the manual file steps.
  4. For a manual install, install Docker with the documented curl command if it is missing, create /data/safeline, change into that directory, and download https://waf.chaitin.com/release/latest/compose.yaml. The directory must have at least 5 GB free because SafeLine writes configuration and data there.
  5. Create .env in that directory and set the documented keys: SAFELINE_DIR, IMAGE_TAG, MGT_PORT, POSTGRES_PASSWORD, SUBNET_PREFIX, IMAGE_PREFIX, ARCH_SUFFIX, RELEASE, REGION, MGT_PROXY, the Postgres image, and the detector token fields. The sample management port is 9443. Leave MGT_PROXY at 0 unless you are configuring a console proxy. The guide says that value should be used only for console proxy layers.
  6. Generate secrets in the SafeLine directory. The deploy guide uses od for DETECTOR_MGMT_TOKEN and MGT_INTERNAL_TOKEN, and a 16-character alphanumeric DETECTOR_AES_KEY. Write them with the documented set_env function and run chmod 600 .env. Then create the resources directories, apply the listed chmod modes, and create the safeline.sock symlink.
  7. Adjust architecture and release only when the guide says to. On ARM, set ARCH_SUFFIX=-arm and POSTGRES_IMAGE=chaitin/safeline-postgres-arm:15.18. The same page states that SafeLine on ARM requires a Pro license and that the Personal Edition is not supported on ARM. Set RELEASE=-lts only for the LTS channel. That channel is no longer maintained starting from 9.1.0-LTS, dated 14 August 2025, and the guide recommends the latest version.
  8. Launch with docker compose up -d. The guide warns that startup can take several minutes. Open https://:9443/ and run docker exec safeline-mgt resetadmin. Save the printed initial username and password. The sample output uses admin as the initial username.
  9. Protect the origin only after login. On the Applications page, click Add Application. Enter the original domain, hostname, or IP, the listen port, and the upstream address. Check SSL for HTTPS applications. Resolve that domain to the SafeLine server address. SafeLine is an nginx-based HTTP and HTTPS reverse proxy: clients reach it first, it filters malicious traffic, and it forwards the remaining traffic to the upstream.
  10. Prove the path with the published attack samples, not with an undocumented mode change. Replace the example domain in the application guide and request the SQL injection, XSS, path traversal, code injection, and XXE cases. A blocking page means the attack was defended. Open the console attack list and click detail for the event. Repeat the same five requests after any later console change so you have a before-and-after record.

Keep a separate decision note for Balance versus Strict. It is a checklist, not another install command. Favor the Strict row in that note when the higher listed detection, 76.17 percent versus 71.65 percent, matters more than the rise in false positives from 0.07 percent to 0.22 percent. Favor the Balance row when the higher listed accuracy, 99.45 percent versus 99.38 percent, and the lower false-positive figure are the priority. Do not write those names into .env. The documented environment keys do not include a semantic-analysis mode. Do not describe the evaluation as a promise about your own traffic. The table is a fixed sample comparison of 33669 requests, not a measurement of your site.

Other documented controls are adjacent, not equivalent. The home page lists defenses for web attacks, proactive bot abuse defense, HTML and JS code encryption, IP-based rate limiting, and a web access control list. Feature descriptions also cover rate limiting for abuse and traffic surges, CAPTCHA challenges, an authentication challenge that requires a password, and dynamic encryption of HTML and JS. Use those only when the matching guide text fits the problem. None of them is documented as the missing audit, balance, or strict selector.

What does Balance vs Strict mean in the official table?

They are evaluation rows on the product home page, not a documented switch. Balance is listed at 71.65 percent detection, 0.07 percent false positives, and 99.45 percent accuracy. Strict is listed at 76.17 percent detection, 0.22 percent false positives, and 99.38 percent accuracy. Both rows use 33669 samples.

Can I switch semantic analysis to audit from these docs?

No. The home page, deploy guide, and application guide do not mention semantic analysis or an audit mode. There is no command, environment key, or console path here for moving among audit, balance, and strict. Do not add an unsupported flag and call the install complete.

Which setup path is the recommended one?

The deploy guide marks automatic deployment as recommended and gives one root command that ends with --en. Use the manual Docker Compose procedure when you must set the data directory, management port, ARM suffix, or release channel yourself. Both end at the same web console on port 9443 unless you change MGT_PORT.

How do I know traffic is being filtered?

After DNS points at the SafeLine host, send a documented test such as the SQL injection or path traversal sample. Expect the blocking page, then open the attack detail in the console. That confirms the reverse-proxy path. It does not tell you which evaluation row your running policy matches.

What should stay out of the tuning checklist?

Do not invent a mode-switch command, do not treat ModSecurity or CloudFlare rows as SafeLine settings, and do not delete /data/safeline unless you mean to uninstall. The documented uninstall is to enter the SafeLine directory, run docker compose down, and then remove that directory.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)