I Put SafeLine in Front of My Home Assistant

SafeLine in a Home Lab

The video documents BeardedTinker’s deployment of SafeLine, a web application firewall (WAF), in a home lab. The goal is to go beyond Wazuh’s security monitoring and block suspicious web requests before they reach exposed applications.

How the systems differ

• A network firewall controls which networks, IP addresses, and ports can communicate.
• A reverse proxy routes incoming web requests to the appropriate application.
• A WAF inspects HTTP requests for potentially malicious patterns, such as SQL injection, cross-site scripting (XSS), and attempts to access restricted files or paths.
• Wazuh collects and analyzes security events across the infrastructure; it does not replace either type of firewall.

In the video’s traffic path, SafeLine serves as both a reverse proxy and a WAF:

Internet → UniFi gateway → SafeLine → protected application

Deployment and security design

SafeLine runs in Docker on a dedicated ZimaBoard with Debian 13. The board is placed in a dedicated UniFi DMZ/VLAN, and firewall rules restrict its ability to initiate connections into the local network.

The creator also describes host-hardening measures, including disabling root SSH, using key-based administrative access, limiting access to SafeLine’s management interface, enabling MFA, and pinning Docker image versions.

The creator discusses SafeLine’s data-sharing options. Software-improvement and threat-data sharing were disabled, while sharing information about malicious IP addresses remained enabled. SafeLine’s country of origin is treated as one factor in risk assessment, not as a verdict by itself.

Editions and features

All demonstrations and integrations shown use SafeLine’s free Personal edition. According to the plan information consulted for the project:

• Personal supports up to 10 protected applications.
• Light raises the limit to 20 and adds features such as geo-blocking, notifications, and attack-log export.
• Pro removes the application limit and adds advanced capabilities, including analytics, custom interception pages, load balancing, and node synchronization.

The creator used a seven-day Pro trial to evaluate paid features, but not to produce the demonstrations. Built-in attack-log export and geo-blocking were of particular interest. However, the creator chose to stay on Personal and use SafeLine’s open API to build a custom log collector instead of paying for log export.

Protected services and testing

SafeLine protects Home Assistant, a Minecraft server’s web management interface, and two temporary test applications. Home Assistant traffic enters over HTTPS on port 443 and is forwarded internally to port 8123. The creator configured Home Assistant to trust the reverse proxy, then tested its interface and live status updates.

Testing from a phone on mobile data produced these results:

• Normal requests to the test application were allowed.
• SQL injection and XSS test requests were blocked and recorded with their classifications.
• A directory-crawl test was blocked but classified as file inclusion, rather than path traversal.
• A legitimate search request was allowed.
• A deliberately low rate limit on OWASP Juice Shop triggered an anti-bot check and recorded blocked requests.

The creator cautions that an old direct route to an application can bypass the WAF. The setup also uses Cloudflare for authoritative DNS and a Let’s Encrypt wildcard certificate obtained through DNS-01 validation, with a script to update the certificate in SafeLine.

Wazuh and Home Assistant integration

Because SafeLine’s built-in attack-log export is a paid feature, the creator wrote a Python collector that uses SafeLine’s open API. It tracks processed records to avoid duplicates and writes structured JSON events for a Wazuh agent. Custom Wazuh rules identify individual attack types and patterns involving repeated or combined events.

The tested SQL injection, XSS, and file-inclusion events appeared in Wazuh with fields such as source IP, hostname, classification, risk level, and action. Security summaries are also displayed in a Home Assistant dashboard alongside data from other sources. The creator notes that refresh intervals mean the pipeline is not necessarily instantaneous.

Limitations and conclusions

SafeLine protects HTTP traffic, not every protocol. For example, it can protect the Minecraft server’s web administration interface, but not the game connection, which uses a separate TCP protocol. SafeLine also cannot protect services reached through routes that bypass it, or fix vulnerable, outdated, or misconfigured applications.

The creator encountered a SafeLine management-interface failure caused by a container that could not connect to PostgreSQL over Docker’s internal network. Recreating the container from the Compose configuration restored access. The experience reinforced the importance of understanding the deployment, keeping and verifying backups of configurations and data, and maintaining an off-device recovery option.

The creator plans to keep using SafeLine, while emphasizing that it adds another system to maintain and can become a single point of failure for services routed through it. A WAF may be unnecessary when no web applications are exposed publicly, and a VPN may be preferable for some remote-access needs. For a home lab with multiple internet-accessible web apps, the creator sees value in combining a WAF’s request inspection with Wazuh’s broader analysis and Home Assistant’s at-a-glance dashboard.

Reviews, guides, and resources

• Product evaluation: SafeLine Personal, Light, and Pro are compared, with the creator’s hands-on assessment favoring Personal for this setup.
• Demonstration: SafeLine is tested against normal traffic, SQL injection, XSS, directory crawling, and rate-limit conditions.
• Integration guide: The creator’s GitHub repository includes the SafeLine collector, Wazuh detection rules, examples, and documentation. The creator advises testing the example configurations because formats may vary by version.
• Related guide: The creator refers viewers to an earlier video about setting up Wazuh.

Main speaker and sources

• Main speaker: BeardedTinker, presenting his own home-lab deployment, tests, and conclusions.
• Product: SafeLine. Its sponsorship and technical review of the project plan are disclosed; the creator says the architecture, deployment choices, testing, and conclusions are his own.
• Other systems discussed: UniFi, Wazuh, Home Assistant, Docker, OWASP Juice Shop, Nginx, and Let’s Encrypt.