Open /setup, create the first admin, store the generated secrets.
This is the multi-page printable view of this section. .
Quick start
Initialize CheeseWAF, add the first site, and connect a model for ALAP.
Do these three steps after the process is running.
The data plane works without a model.
ALAP review stays empty until you configure ai.
1 - Initialize
Create the first administrator at /setup and lock down the management listener.
Open the wizard
On a local install open http://127.0.0.1:9443/setup.
On Docker open https://<host>:9443/setup and accept the self-signed certificate.
If the process prints a setup token, paste it when the wizard asks.
Create the admin
Set a username and a password that meets the console password policy. Save every generated secret the wizard shows. CheeseWAF will not print them again in clear text.
Confirm the listener
Leave server.admin_listen on loopback for a single-host install.
Set server.admin_public to true only with TLS and a network policy in front.
After setup, the same URL becomes the login page.
CLI users can also run waf-cli (TUI) or cheesewaf user.
2 - Add the first site
Point CheeseWAF at a domain and an upstream, then pick paranoia level 3.
In the console open Sites → New site.
Domain
Enter the hostname clients already use, for example app.example.com.
CheeseWAF matches sites[].domains.
Upstream
Enter the origin address, for example 10.0.0.10:8000.
More than one upstream uses the site loadbalance policy (round_robin by default).
Paranoia
Use level 3 for a first production site. Level 3 blocks isolated attack values and allows embedded hits for later ALAP review.
Save
Save the site. The process reloads the site list without a full restart.
Point DNS or the local hosts file at the CheeseWAF data-plane address. Confirm the origin still answers through CheeseWAF before you raise the level.
Details: Sites and reverse proxy.
3 - Connect a model
Point ALAP at an OpenAI-compatible or Anthropic-compatible endpoint.
ALAP is optional for a first day. Turn it on when you want asynchronous review and lasting rules.
In the console open AI.
| Field | Meaning |
|---|---|
| Enabled | Master switch (ai.enabled) |
| Provider | openai or anthropic |
| Endpoint | Chat Completions / Messages base URL, for example https://api.openai.com/v1 |
| API key | Secret for that endpoint |
| Model | Model name, for example gpt-4o-mini |
| Auto-agree | When on, high / critical findings can become lasting rules |
The sample config starts with ai.enabled: false.
ai.async stays true so the data plane never waits on the model.
Use Test connection in the console before you trust auto-agree.