Safeline – Self‑Hosted Web Application Firewall (WAF) App

[IniBudi]

• Main Page: https://github.com/chaitin/safeline

• Git: https://github.com/chaitin/safeline

• Licence: GPL-3.0 license

• Dockerfile: ?

• Demo: https://ly.safepoint.cloud/hSMd4SH

• Summary

Safeline is a self‑hosted Web Application Firewall (WAF) designed to sit in front of your web applications and shield them from a wide range of web attacks and exploits. Acting as a reverse proxy, Safeline inspects, filters, and monitors HTTP(S) traffic before it ever reaches your apps.

• Alternative to / Similar tools

Safeline can be seen as an alternative or complement to:

• Cloudflare WAF / other SaaS WAFs

• ModSecurity / OWASP Core Rule Set

• NAXSI

• Imperva, F5 WAF, etc. (commercial solutions)

• Screenshots

[timconsidine]

@IniBudi cool !

[RoundHouse1924]

https://alternativeto.net/software/safeline/about/
Safeline originates from China, which is an issue IMO.

[robi]

@RoundHouse1924 a lot of good software comes from China from
Chinese people who don't necessarily agree with their state sponsored pals.

Depends who wrote it and why.

[jdaviescoates]

There are some very intriguing/ interesting Chinese hackers etc living in Chiang Mai in northern Thailand see e.g. https://4thgenerationcivilization.substack.com/p/towards-civilizational-ai-our-central

[timconsidine]

@RoundHouse1924 I often gravitate to this thought, but then remember that what @robi says is true.
Consider Seafile as an example of an app which seems trusted.

The problem is knowing the reliability.
I guess we have to rely on peer review, no. of GitHub stars, and the valiant efforts of code reviewers.

It might be academic, as I asked for an AI review of feasibility of packaging for Cloudron, and it was essentially negative, too complex and not enough info about building (they assume a docker-compose deployment based on their image which is not officially published).

Someone more technical than me needs also to consider the issue of running a reverse proxy (SafeLine) in front of Cloudron's reverse proxy, especially when Safeline if packaged for Cloudron would be on same VPS as Cloudron's reverse proxy. Confused ? I sure am.

[robi]

@timconsidine nesting reverse proxies is OK.

It happens already with Cloudron's Nginx and webservers that front multiple app servers in our Apps.

[IniBudi]

I came across Safeline through a Meta Ads. The ad was run by a web dev based in Indonesia who offers a course on how to secure WordPress websites against hacking.

After reviewing the course modules listed on the landing page, I noticed that Safeline was mentioned and that it can be integrated with Cloudflare.

This caught my interest, so I decided to do some research.

I then looked into third-party benchmarks and evaluations of Safeline’s protection capabilities and found the following articles:

• https://dev.to/carrie_luo1/the-6-best-web-application-firewalls-compared-2024-1d9l
• https://medium.com/@tvvzvpb186/which-open-source-waf-really-delivers-a-head-to-head-benchmark-37631e08fb7f

Based on the benchmark data presented in those articles, Safeline appears to perform well in blocking common web application attacks.

That said, this is purely based on third-party analysis. I have not personally used Safeline in a production environment yet.

I should also mention that I am not an IT developer or sysadmin by profession. My background is primarily in digital marketing, so I fully understand that many people in this forum have far deeper technical expertise than I do.

That said, I find Safeline interesting due to its feature set and open-source offering, which prompted me to explore it further and request the app here.