SafeLine

Connect as azureuser, the default login user. Replace <vm-ip> with the public IP of your VM.

ssh azureuser@<vm-ip>

sudo systemctl is-active docker safeline docker --version docker compose version

The output shows active twice, then the Docker Engine version and the Docker Compose v2 plugin version.

cd /data/safeline && sudo docker compose -f compose.yaml --env-file .env ps

All seven SafeLine containers should be in the Up / running state: safeline-mgt, safeline-tengine, safeline-detector, safeline-pg, safeline-luigi, safeline-fvm and safeline-chaos.

The management console is served over HTTPS on port 9443. It exposes an unauthenticated health endpoint that returns HTTP 200 when SafeLine is ready. The console uses a self-signed certificate on first launch, so the command below passes -k to curl.

curl -ks -o /dev/null -w "%{http_code}\n" https://localhost:9443/api/open/health

A response of 200 confirms the console is up.

SafeLine has no default password. On first boot, your instance creates a unique admin credential and writes it to a root-only file. Read it with sudo:

sudo cat /root/safeline-credentials.txt

The file lists safeline.url (where to sign in), safeline.admin.user (admin) and safeline.admin.pass. Store the password somewhere safe.

Browse to https://<vm-ip>:9443/. The console uses a self-signed certificate on first launch, so your browser warns once. Accept the warning to continue.

On the first visit, SafeLine shows a one-time software licence agreement. Read it and choose Agree, start using. On the sign-in page, log in with the username admin and the safeline.admin.pass from Step 5.

After you sign in, the Statistics dashboard summarises request volume, blocked attacks, the geographic origin of traffic and the current security posture. SafeLine recommends binding an authenticator app for two-factor authentication on first sign-in. You can do this from Auth at any time.

To put SafeLine in front of a web application, open Applications in the console and choose Add Application.

Enter the domain (or Match All Host), the port SafeLine should listen on (for example 80 or 443), and the upstream address of your origin server (for example http://127.0.0.1:8080 or http://10.0.0.4:3000).

SafeLine's tengine proxy then binds that port. The detection engine inspects every request before it reaches your origin.

Once a site is protected, SafeLine passes clean traffic straight through to your origin and intercepts attacks. A benign request returns your application's normal response. An obvious SQL injection or cross-site scripting probe is answered with an HTTP 403 interception page and never reaches your origin.

The visitor who sends the malicious request sees SafeLine's branded interception page. It carries a unique event id, which also appears in the console under Attacks.

The safeline.service systemd unit manages the whole stack. It wraps docker compose under /data/safeline.

sudo systemctl restart safeline.service
sudo systemctl status safeline.service --no-pager

To inspect the logs of a specific service, run:

cd /data/safeline && sudo docker compose -f compose.yaml --env-file .env logs --tail 50 mgt

To create a fresh admin credential, run sudo docker exec safeline-mgt resetadmin. It prints a new username and password.