Forked and extended from SafeLine CE by Chaitin Tech
Quick Start • Add a Website • How It Works • Project Structure
ShieldWAF is a customized, production-ready deployment of SafeLine WAF — the open-source web application firewall built by Chaitin Tech.
This project extends the original with:
| Addition | Description |
|---|---|
🚀 setup.sh |
One-command automated installer with OS checks, port validation, and auto-generated secure passwords |
🌐 scripts/add-website.sh |
Interactive script to add any website behind the WAF using the SafeLine API |
🐳 compose.yaml |
Customized Docker Compose with better container naming, logging, and health checks |
📖 docs/ |
Step-by-step guides with screenshots |
Why this fork? The original SafeLine repo is config-only. This project makes it immediately deployable with custom automation scripts, clear documentation, and a branded setup flow — useful for teams managing multiple web applications.
SafeLine acts as a reverse proxy between the internet and your web applications. All HTTP/HTTPS traffic passes through it and gets analyzed for attacks in real time.
Internet traffic
│
▼
┌─────────────┐ Blocks: SQL Injection, XSS, ┌─────────────────┐
│ ShieldWAF │ ── SSRF, Brute Force, Path Traversal ─► Your Web App │
│ (Port 80) │ Bot attacks, 0-day exploits │ (localhost:3000) │
└─────────────┘ └─────────────────┘
│
▼
Dashboard at :9443
(Live attack logs, site management, IP blocking)
- Linux (x86_64 or ARM)
- Docker 20.10.6+
- Min 1 CPU, 1GB RAM, 5GB disk
# Clone this repo
git clone https://github.com/mrcyb4r/shieldwaf.git
cd shieldwaf
# Run the setup script
sudo bash setup.shThe script will automatically:
- ✅ Check OS & Docker compatibility
- ✅ Validate required ports (80, 443, 9443)
- ✅ Create all directories at
/data/shieldwaf - ✅ Generate a secure
.envwith random DB password - ✅ Pull Docker images and start all services
- ✅ Print your dashboard URL and admin credentials
https://YOUR_SERVER_IP:9443
After setup, use the interactive script to put any website behind ShieldWAF:
bash scripts/add-website.shExample session:
┌─────────────────────────────────────────┐
│ ShieldWAF — Add Website to Protect │
└─────────────────────────────────────────┘
Step 1: Get your API Token
→ Open https://localhost:9443
→ Go to Settings → API Token → Create Token
Paste your API Token here: slce_xxxxxxxxxxxxxxxxxx
Step 2: Enter your website domain
Domain or IP: mywebsite.com
Step 3: Enter your backend server address
Backend URL: http://localhost:3000
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ Website added successfully!
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Next steps:
1. Point your domain DNS → this server's IP
2. All traffic will now flow through ShieldWAF first
3. View attack logs → https://localhost:9443
bash scripts/add-website.sh \
--domain mywebsite.com \
--backend http://localhost:3000 \
--token slce_your_token_hereYou can protect as many sites as needed:
# Site 1: Main website
bash scripts/add-website.sh --domain mysite.com --backend http://localhost:3000 --token TOKEN
# Site 2: Admin panel
bash scripts/add-website.sh --domain admin.mysite.com --backend http://localhost:4000 --token TOKEN
# Site 3: API server
bash scripts/add-website.sh --domain api.mysite.com --backend http://localhost:5000 --token TOKEN┌─────────────────────────────────────────────────────────┐
│ Docker Compose Services │
│ │
│ shieldwaf-pg PostgreSQL database │
│ (172.22.222.2) Stores config, attack logs, rules │
│ │
│ shieldwaf-fvm Feature Version Manager │
│ (172.22.222.6) Manages detection rules/models │
│ │
│ shieldwaf-detector AI Attack Detection Engine │
│ (172.22.222.5) Semantic analysis, 0-day detection │
│ │
│ shieldwaf-mario Nginx Reverse Proxy │
│ (172.22.222.3) Handles :80 and :443 traffic │
│ │
│ shieldwaf-mgt Management API + Dashboard │
│ (172.22.222.4) REST API at :9443 │
└─────────────────────────────────────────────────────────┘
shieldwaf/
├── 📄 compose.yaml # Docker Compose (customized)
├── 📄 .env.example # Environment template
├── 📄 setup.sh # Automated installer
├── 📁 scripts/
│ ├── add-website.sh # Add a site to protect
│ └── remove-website.sh # Remove a site (coming soon)
├── 📁 docs/
│ ├── add-website-guide.md # Step-by-step with screenshots
│ ├── api-reference.md # SafeLine API docs
│ └── troubleshooting.md # Common issues & fixes
└── 📄 README.md
ShieldWAF exposes SafeLine's full REST API. Create an API token in the dashboard → Settings → API Token.
export TOKEN="slce_your_token"
export WAF="https://localhost:9443"
# List all protected websites
curl -sk -H "X-SLCE-API-TOKEN: $TOKEN" $WAF/api/open/v1/website | jq
# View recent attacks
curl -sk -H "X-SLCE-API-TOKEN: $TOKEN" "$WAF/api/open/v1/attack-log?page=1&page_size=10" | jq
# Block an IP address
curl -sk -X POST -H "X-SLCE-API-TOKEN: $TOKEN" \
-H "Content-Type: application/json" \
-d '{"ip":"1.2.3.4"}' \
$WAF/api/open/v1/ip-group/block
# Check WAF health
curl -sk $WAF/api/open/health# View all running containers
docker compose ps
# View live logs
docker compose logs -f
# View WAF (Nginx proxy) logs only
docker compose logs -f mario
# Restart all services
docker compose restart
# Stop everything
docker compose down
# Update to latest version
docker compose pull && docker compose up -d
# Get admin credentials
docker exec shieldwaf-mgt /app/mgt-cli reset-admin --once- Never expose port
9443(dashboard) to the public internet — use a VPN or SSH tunnel - The
.envfile contains your DB password — never commit it to Git (it's in.gitignore) - Change
POSTGRES_PASSWORDbefore first run in production - Enable HTTPS on your domains by uploading SSL certificates in the dashboard
This project is licensed under GPL-3.0 (same as SafeLine CE).
The original SafeLine WAF is developed by Chaitin Tech and licensed under GPL-3.0.
- SafeLine — The WAF engine this project is built on
- All WAF detection and blocking logic belongs to Chaitin Tech
Made by mrcyb4r · GitHub · ⭐ Star if useful!