Installing a WAF involves two separate milestones: getting the service running and routing an application through it. This guide uses that distinction to organize a Debian deployment, with checkpoints before installation, console access, and traffic cutover.
One qualification comes first: the supplied SafeLine installation guide lists Linux as the operating-system requirement, but it does not name Debian releases or provide Debian-specific package instructions. Treat this as a checklist for applying the documented Linux installation process to a Debian host, rather than a claim that every Debian version is certified. Source: installation guide
1. Check the host before changing anything
SafeLine documents these minimum requirements: Linux, x86_64 or arm64 architecture, Docker 20.10.14 or later, Docker Compose 2.0.0 or later, one CPU core, 1 GB of memory, and 5 GB of disk space. The dependency table also lists the SSSE3 CPU instruction requirement. ARM installations require a Pro license; the Personal Edition does not support ARM. Resolve that architecture and edition choice before deployment. Source: dependencies and ARM configuration
Use the relevant checks provided by the installation guide:
uname -m
docker version
docker compose version
free -h
df -h
lscpu | grep ssse3
These commands establish what the server actually has. If Docker or Compose is absent or below the documented minimum, address that prerequisite before continuing. An architecture result alone does not establish that all requirements are satisfied. Source: server configuration checks
For your own deployment record, note the Debian release, architecture, available resources, and current application address. This makes later troubleshooting more concrete than relying on memory.
2. Run the documented installation
The official guide recommends automatic deployment and states that the process requires root privileges. Its published command is:
bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
Review the command and its downloaded script before running it with administrative privileges. The command above follows the supplied documentation; it does not add an unverified Debian package repository or substitute an unofficial installer. Source: automatic deployment
If your operating procedures require explicit configuration review, the same guide provides a manual Docker Compose deployment path, including a data directory, Compose file, environment variables, and launch command. Follow that procedure as a complete alternative rather than combining isolated steps from both methods. Source: manual deployment
3. Establish console access
After installation, the documented console address is https://<safeline-ip>:9443/. Retrieve the administrator credentials using:
docker exec safeline-mgt resetadmin
The guide instructs you to use the resulting credentials to log in. Keep the generated password out of shared terminal transcripts and deployment notes. Source: web UI and administrator account
Treat successful login as an installation checkpoint. Application routing is a separate configuration step: SafeLine operates as an HTTP/HTTPS reverse proxy, receiving application traffic and forwarding it to the original application after inspection. Source: application protection
4. Prepare the application route before changing DNS
Write down three values before opening the application dialog: the public domain, the port clients will connect to, and the real upstream application address. Keeping those values distinct helps prevent accidental routing back to the WAF itself.
In the console, open Applications, select Add Application, and enter the domain, listening port, and upstream. The documentation instructs you to select SSL for HTTPS applications. After configuring the application, resolve its domain to the IP address of the SafeLine server. Source: proxy an application
Before that DNS change, record the existing DNS value and decide how you would restore it if application checks fail. After the change, exercise ordinary user journeys such as navigation, sign-in, and form submission. These are operational checks for your application, not evidence that every possible attack is blocked.
Does the official guide specifically support my Debian release?
The supplied guide specifies Linux without listing Debian versions. Check the documented dependencies against your host and validate the deployment before committing production traffic. Source: dependencies
Can I use an ARM-based Debian server?
The guide lists arm64, but explicitly states that ARM requires a Pro license and that the Personal Edition is unsupported on ARM. Source: ARM configuration
Does opening the console mean my website is protected?
You still need to add the application and direct its domain to the SafeLine server. Those steps place SafeLine in the documented request path. Source: application configuration
How can I check attack handling after configuration?
For an application you own or are authorized to test, the application guide supplies example attack requests. It describes checking the blocking page and inspecting the attack list and request details in the console. Pair those checks with normal application testing. Source: documented validation examples
Try this checklist on a test application, and share which deployment checkpoint needed the most attention. Explore the official project at SafeLine GitHub and continue with the official docs.
