Docker Compose WAF: Add SafeLine to Any Existing Stack in 3 Steps

You possess an existing Docker Compose stack consisting of Nginx, your application, PostgreSQL, and Redis. This stack operates correctly, yet you desire WAF protection positioned at the front. Follow these steps to integrate SafeLine into your existing Docker Compose project without causing any disruptions.

Begin by creating a shared network within your Docker Compose configuration file. Define a network named 'webnet' and associate it with the bridge driver. Next, link your services, such as 'app' and 'nginx', to this network to enable communication between them.

Next, install SafeLine independently using its dedicated Compose file. The installer generates this file automatically and places it at a specified location. Leave this file untouched, as SafeLine manages it effectively.

Proceed to connect SafeLine to your existing network. Modify SafeLine's Compose file (located at /opt/safeline/docker-compose.yml) by adding an 'external' section under the 'networks' key. In this section, specify your existing network ('webnet') as external, thus enabling communication between SafeLine and your existing services.

Now, it's time to direct traffic through SafeLine. Update your Nginx configuration to route traffic through SafeLine instead of directly to your application. Ensure that proxy_pass directives are set appropriately, pointing traffic to SafeLine's proxy server. Additionally, include necessary proxy_set_header directives to maintain proper header information.

Finally, restart all your services using `docker compose up -d`. This command will bring up all services, including SafeLine, ensuring that traffic flow is now routed through SafeLine for enhanced security.

When evaluating the benefits of this setup, note that your application remains unaltered. SafeLine acts as middleware between Nginx and your application, providing an added layer of protection without requiring any code changes or modifications to your app containers. With just three lines added to your Nginx configuration and a network connection, the process is straightforward and efficient.

The beauty of this setup lies in its independence. SafeLine can be updated separately from your application stack. When updating your app stack, SafeLine containers remain unaffected. Conversely, when SafeLine releases a new version, your application stack remains untouched. This allows for seamless testing before switching to block mode, starting with SafeLine in detection-only mode to monitor for any false positives.

If you're currently utilizing a different reverse proxy such as Nginx Proxy Manager, Traefik, or Caddy, the integration process remains similar. Adjust your labeling and middleware configurations accordingly, ensuring that traffic flows through SafeLine before reaching your application.

In the event of SafeLine experiencing downtime, your application continues to operate, albeit with access being denied as SafeLine is positioned as the critical path. To mitigate this risk, consider running SafeLine on a separate node with a load balancer in front, ensuring high availability and reliable performance.

While it's technically possible to run SafeLine as a container within your existing Compose file, the installer-generated Compose file offers advantages such as SSL certificate management, PostgreSQL integration, and service management. By maintaining SafeLine as a separate project connected via shared networks, you benefit from enhanced stability and reliability.

As you contemplate implementing SafeLine into your existing Docker Compose stack, consider your current configuration and how these steps align with your security objectives. By following these guidelines, you can seamlessly integrate SafeLine into your stack, bolstering your application's defense against potential threats without disrupting existing functionality.