tutorial

Monitoring Safeline WAF with Vigilmon

Safeline is a self-hosted community WAF and reverse proxy, but a silent ModSecurity crash leaves all your sites unprotected. Here's how to monitor the management UI, WAF proxy health, PostgreSQL, Redis, and SSL certificates with Vigilmon.

Safeline is an open-source web application firewall and reverse proxy built on NGINX and ModSecurity, with a Go + Python backend and a React management UI. It sits in front of all your web traffic — when it works, every HTTP request gets inspected and filtered; when it silently fails, your sites either go offline or run unprotected. The management UI runs on port 9443, and the WAF proxy handles ports 80 and 443. Vigilmon monitors the management UI, WAF proxy health, PostgreSQL, Redis, and SSL certificates so a silent WAF failure never catches you off guard.

What You'll Set Up

  • Management UI availability monitor (port 9443)
  • WAF proxy health check (ports 80/443)
  • PostgreSQL database connectivity heartbeat
  • Redis connectivity heartbeat
  • SSL certificate expiry alerts for proxied domains
  • Rule set synchronization job heartbeat
  • Alert notification delivery check

Prerequisites

  • Safeline installed and running (Docker Compose recommended)
  • At least one site proxied through Safeline
  • A free Vigilmon account

Step 1: Monitor the Management UI

The Safeline management UI at port 9443 is the control plane for all WAF rules and site configurations. If it goes down, you lose visibility into attack traffic and the ability to update rules.

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to HTTP / HTTPS.
  3. URL: https://your-server-ip:9443/
  4. Set Check interval to 1 minute.
  5. Set Expected HTTP status to 200.
  6. Click Save.

If you've configured a domain for the management UI, use that instead of the IP:

https://waf-admin.yourdomain.com/

Step 2: Monitor the WAF Proxy

The WAF proxy is the critical path for all incoming traffic. Add monitors for both HTTP and HTTPS:

HTTPS Proxy Check

  1. Click Add Monitor → HTTP / HTTPS.
  2. URL: https://yourdomain.com/ (one of your proxied sites).
  3. Set Check interval to 1 minute.
  4. Set Expected HTTP status to 200.
  5. Click Save.

HTTP → HTTPS Redirect Check

  1. Click Add Monitor → HTTP / HTTPS.
  2. URL: http://yourdomain.com/.
  3. Set Expected HTTP status to 301 or 302 (redirect to HTTPS).
  4. Click Save.

A 502 Bad Gateway from NGINX means the upstream application is unreachable. A connection refused on port 80 or 443 means the WAF proxy process itself is down.

Step 3: Monitor TCP Ports for WAF Proxy Health

Use TCP monitors to detect the WAF proxy process being down even before NGINX returns an error page:

  1. Click Add Monitor → TCP Port.
  2. Host: your-server-ip, Port: 443.
  3. Set Check interval to 1 minute.
  4. Click Save.

Repeat for port 80. A TCP connection failure at this layer means neither NGINX nor the WAF proxy is accepting connections.

Step 4: Monitor PostgreSQL Connectivity

Safeline stores WAF logs, site configurations, and rule state in PostgreSQL. A database failure prevents rule loading and audit logging.

Create a health check script that probes PostgreSQL and pings Vigilmon:

#!/bin/bash
# /usr/local/bin/safeline-pg-check.sh
HEARTBEAT_URL="https://vigilmon.online/heartbeat/YOUR_PG_HEARTBEAT_ID"
PG_CONTAINER="safeline-pg"

if docker exec "$PG_CONTAINER" pg_isready -U safeline > /dev/null 2>&1; then
    curl -s "$HEARTBEAT_URL"
fi

chmod +x /usr/local/bin/safeline-pg-check.sh

Create the Vigilmon heartbeat:

  1. Click Add Monitor → Cron Heartbeat.
  2. Set the expected interval to 2 minutes.
  3. Copy the heartbeat URL into the script.

Schedule the check:

# /etc/cron.d/safeline-pg-check
*/2 * * * * root /usr/local/bin/safeline-pg-check.sh

Step 5: Monitor Redis Connectivity

Safeline uses Redis for rate limiting and session state. A Redis failure disables rate limiting across all proxied sites, leaving them exposed to brute-force attacks.

#!/bin/bash
# /usr/local/bin/safeline-redis-check.sh
HEARTBEAT_URL="https://vigilmon.online/heartbeat/YOUR_REDIS_HEARTBEAT_ID"
REDIS_CONTAINER="safeline-redis"

if docker exec "$REDIS_CONTAINER" redis-cli ping | grep -q "PONG"; then
    curl -s "$HEARTBEAT_URL"
fi

chmod +x /usr/local/bin/safeline-redis-check.sh

Create a second heartbeat monitor in Vigilmon with a 2 minute interval and schedule:

*/2 * * * * root /usr/local/bin/safeline-redis-check.sh

Step 6: Monitor SSL Certificates for Proxied Domains

Safeline terminates TLS for all proxied sites. If the certificate for any proxied domain expires, visitors see a browser warning and traffic drops immediately.

For each proxied domain, add a certificate monitor:

  1. Open the HTTPS monitor for that domain (from Step 2) or create a new one.
  2. Enable Monitor SSL certificate.
  3. Set Alert when certificate expires in less than 21 days.
  4. Click Save.

Repeat for every domain proxied through Safeline. If you have many domains, you can automate monitor creation using the Vigilmon API:

#!/bin/bash
VIGILMON_API_KEY="your_api_key"
DOMAINS=("site1.com" "site2.com" "site3.com")

for domain in "${DOMAINS[@]}"; do
    curl -s -X POST https://vigilmon.online/api/monitors \
      -H "Authorization: Bearer $VIGILMON_API_KEY" \
      -H "Content-Type: application/json" \
      -d "{
        \"type\": \"https\",
        \"url\": \"https://$domain\",
        \"interval\": 60,
        \"ssl_check\": true,
        \"ssl_alert_days\": 21
      }"
done

Step 7: Monitor the Rule Set Synchronization Job

Safeline's ModSecurity rule sets need to stay current. A failed rule sync leaves you running outdated signatures. Add a heartbeat for the sync job:

#!/bin/bash
# /usr/local/bin/safeline-rule-sync.sh
HEARTBEAT_URL="https://vigilmon.online/heartbeat/YOUR_RULESYNC_HEARTBEAT_ID"

# Trigger rule sync via Safeline API (adjust endpoint to your version)
SYNC_RESULT=$(curl -s -o /dev/null -w "%{http_code}" \
  -X POST https://your-server-ip:9443/api/open/ruleset/update \
  -H "X-SLCE-API-TOKEN: $SAFELINE_API_TOKEN")

if [ "$SYNC_RESULT" = "200" ]; then
    curl -s "$HEARTBEAT_URL"
fi
  1. In Vigilmon, click Add Monitor → Cron Heartbeat.
  2. Set the expected interval to 24 hours.
  3. Schedule to run daily:
0 3 * * * root /usr/local/bin/safeline-rule-sync.sh

Step 8: Configure Alert Channels and Thresholds

  1. Go to Alert Channels in Vigilmon and add Slack, email, or PagerDuty.
  2. For the WAF proxy monitors (ports 80/443), set Consecutive failures before alert to 1 — the WAF is the security perimeter, any downtime is critical.
  3. For the management UI monitor, set Consecutive failures before alert to 2 — a brief restart shouldn't page you immediately.
  4. For certificate monitors, use immediate alerting — expiry has a hard deadline.

Summary

| Monitor | Target | What It Catches | |---|---|---| | Management UI | https://server:9443/ | Control plane down | | WAF HTTPS proxy | https://yourdomain.com/ | Traffic inspection failure | | WAF HTTP redirect | http://yourdomain.com/ | HTTP handling broken | | TCP port 443 | Server port 443 | NGINX process down | | TCP port 80 | Server port 80 | NGINX process down | | PostgreSQL heartbeat | Heartbeat URL | DB down, rules unloadable | | Redis heartbeat | Heartbeat URL | Rate limiting disabled | | SSL certificates | Each proxied domain | Certificate expiry | | Rule sync heartbeat | Heartbeat URL | Outdated WAF signatures |

A WAF that silently fails is worse than no WAF — your sites either go offline or run unprotected without alerting you. Vigilmon's layered monitoring catches proxy process failures, database outages, and certificate expirations before they become security or availability incidents.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles