SafeLine WAF in a Homelab: Hardening Traefik Ingress Without Breaking mTLS Chains

Описание и применение

SafeLine WAF успешно защищает внутренний админ‑панель Traefik, блокируя 94 % SQL‑инъекций, сохраняя цепочку клиентских сертификатов и добавляя лишь ~8 мс задержки.

Задача

An exposed internal LiteLLM admin dashboard leaked to a public IP, attracting automated SQLi and path traversal attacks, while Traefik lacked native Layer‑7 filtering and adding a WAF must not break existing mTLS client‑certificate chains or add noticeable latency.

Результат

SafeLine successfully protected the internal admin panel, blocking 94 % of SQLi attempts while preserving mTLS client‑certificate authentication and adding minimal latency.

Рабочий процесс

• Deploy SafeLine as a Docker Compose stack with safeline‑mgt, safeline‑tengine, and safeline‑detector services.
• Configure SafeLine in transparent proxy mode with proxy_ssl_verify off and forward SSL_CLIENT_CERT via the SSL-Client-Cert header.
• Set up Traefik to read the SSL-Client-Cert header via middleware and validate against the CA bundle.
• Route internal traffic from SafeLine to Traefik over a dedicated Docker bridge network (traefik_internal).
• Tune SafeLine’s false‑positive rules through its web UI, adding whitelist entries for base64‑encoded JSON POST bodies.
• Run sqlmap against a test endpoint to verify that SafeLine blocks 94 % of SQLi payloads.
• Measure latency and resource usage to confirm acceptable overhead (≈8 ms P50, 12 % CPU peak).
• Add exception paths for high‑throughput streaming endpoints by bypassing body inspection with X‑SafeLine‑Skip header.

Доказательства

Last month I accidentally left an internal LiteLLM admin dashboard exposed on a Tailscale exit node that briefly leaked to a public IP during a DNS migration.

Источник

Traefik handles TLS termination and routing beautifully, but it has no native WAF logic.

Источник

SafeLine (chaitin/SafeLine): Purpose‑built WAF with a detection engine derived from Chaitin's commercial product, packaged as a Docker Compose stack.

Источник

Initial problem: My Open‑WebUI instance required client certificates for API authentication. When SafeLine terminated TLS, it stripped the client cert before forwarding to Traefik, breaking the entire auth chain.

Источник

Solution: Configure SafeLine in transparent proxy mode with proxy_ssl_verify off and forward the original SSL_CLIENT_CERT header.

Источник

With SafeLine: 94% blocked at the WAF layer, logged with semantic match details.

Источник

Added ~8ms P50 and ~15ms P99 per request on a 4-core NUC homelab (Intel N100, 16GB RAM).

Источник