DEV Community

Lia
Lia

Posted on • Edited on

SafeLine WAF Behind Cloudflare and Nginx Proxy Manager

#webdev #security #devops #tutorial

A production stack that combines Cloudflare's edge with SafeLine's detection:

User → Cloudflare (DNS/CDN) → Nginx Proxy Manager (SSL) → SafeLine WAF → Your App
Enter fullscreen mode Exit fullscreen mode

Why This Stack

  • Cloudflare: Free DNS, CDN, basic DDoS protection
  • Nginx Proxy Manager: Easy SSL via Let's Encrypt GUI
  • SafeLine: 71.65% attack detection, semantic engine, bot protection
  • Your App: Protected three layers deep, $0/month in WAF licensing

Prerequisites

A VPS with Docker and at least 2 GB RAM. All services run in containers.

Step 1: Deploy Your App

Ensure your app is containerized and listening on an internal port (e.g., localhost:3000).

Step 2: Install SafeLine 

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
Enter fullscreen mode Exit fullscreen mode

SafeLine tries to bind ports 80/443. Since NPM will handle those, set SafeLine to an internal port like 5080 in the dashboard settings.

Step 3: Configure SafeLine

  1. Open https://your-ip:9443 and log in
  2. Add a new site, point to app-container:3000
  3. Verify: curl -H "Host: yourdomain.com" http://localhost:5080

Step 4: Install Nginx Proxy Manager 

docker run -d \
  --name nginx-proxy-manager \
  -p 80:80 \
  -p 443:443 \
  -p 81:81 \
  -v npm_data:/data \
  -v npm_letsencrypt:/etc/letsencrypt \
  jc21/nginx-proxy-manager:latest
Enter fullscreen mode Exit fullscreen mode

Step 5: Configure NPM

  1. Open http://your-ip:81 (default: admin@example.com / changeme)
  2. Add SSL via Let's Encrypt
  3. Create Proxy Host -> forward to http://safeline-container:5080
  4. Enable SSL, force HTTPS

Step 6: Configure Cloudflare

  1. Set DNS A record to your VPS IP
  2. SSL/TLS -> "Full (strict)"

Step 7: Test 

# Should be blocked
curl -H "Host: yourdomain.com" "http://your-ip/?id=1' OR '1'='1"
# Should pass
curl -H "Host: yourdomain.com" "http://your-ip/"
Enter fullscreen mode Exit fullscreen mode

Read the full comparison: SafeLine vs Cloudflare WAF: An Honest, Detailed Comparison — why self-hosted beats cloud-only for detection rate.

FAQ

Does this add latency?

NPM + SafeLine add ~1-2ms. Cloudflare's CDN compensates.

Why three layers instead of just Cloudflare?

Cloudflare Free WAF catches ~11%. SafeLine catches ~71%.

Can I skip NPM?

Yes. SafeLine can terminate SSL directly.

Try SafeLine yourself: Live Demo | Website | Deploy Guide | Discord Community | More from CyberServal | LinkedIn

Top comments (0)