How to Run SafeLine WAF Behind an Nginx Reverse Proxy

Sometimes Nginx is already your public edge — terminating TLS, serving static files, doing virtual hosting. You can keep Nginx exactly where it is and place SafeLine behind it, so Nginx forwards traffic to SafeLine for inspection before it reaches your app.

The topology

Client → Nginx (edge / TLS) → SafeLine (inspects) → upstream app

Nginx stays the entry point. Instead of proxying straight to your app, it proxies to SafeLine; SafeLine then proxies to the real upstream. You get Nginx's edge features plus SafeLine's WAF filtering.

Step 1 — Install SafeLine

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

Step 2 — Tell SafeLine where the app is

In the SafeLine console (https://<safeline-ip>:9443), add a protected site whose upstream is your actual app, e.g. http://127.0.0.1:3000 or http://10.0.0.10:8080. SafeLine will listen on its own port (default :80) and forward clean traffic there.

Step 3 — Point Nginx at SafeLine

Change Nginx's proxy_pass from the app to SafeLine. A minimal upstream looks like:

upstream safeline {
    server 127.0.0.1:80;   # SafeLine's listener
}

server {
    listen 443 ssl;
    server_name app.example.com;

    location / {
        proxy_pass http://safeline;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Reload Nginx. Traffic now flows Client → Nginx → SafeLine → app.

Step 4 — Preserve the real client IP

Because Nginx proxies to SafeLine, SafeLine sees Nginx's address by default. Pass X-Forwarded-For (above) and configure SafeLine's trusted-proxy / client-IP setting so its logs show the real visitor IP rather than Nginx's.

FAQ

Why put SafeLine behind Nginx instead of in front?

If Nginx already handles TLS, redirects, or static assets you don't want to move, keeping it at the edge and forwarding to SafeLine is the least-disruptive way to add a WAF.

Can SafeLine also do TLS?

Yes — you can terminate TLS at SafeLine instead. Behind-Nginx just describes the case where Nginx keeps that job.

Does this affect performance much?

SafeLine adds one lightweight proxy hop; for most sites the latency is negligible.

Free tier?

The Community Edition covers 10 apps at 800 QPS for free.

That's it — Nginx stays your edge, and SafeLine quietly filters everything behind it.

• ⭐ SafeLine WAF on GitHub — give it a star if you find it useful
• 🔗 Official Docs — installation guide, configuration, and API reference
• 🧪 Live Demo — see the dashboard in action (no login required)

Deploy it in minutes:

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en