Tutorials
These tutorials walk through common ZCP deployments from account setup to verification. Each guide lists the required commands, explains the key decisions, and shows how to confirm the result.
Looking for a single feature instead of a full walkthrough? The CLI reference and the per-service guides in the sidebar cover those.
Tutorials
Section titled “Tutorials”Publish DKIM and DMARC records on an existing ZCP DNS zone with the CLI or Terraform/OpenTofu. Learn where SPF needs a separate, carefully reviewed change, how to keep a single owner for each record set, and how to verify both DNS and delivered mail.
You learn how to:
- Inventory senders and existing DNS record sets before a change
- Publish a provider-issued DKIM TXT record or CNAME and a monitoring DMARC policy
- Manage dedicated record sets through either the CLI or Terraform/OpenTofu
- Test DNS answers and
Authentication-Resultsfor every sender before enforcement
Deploy a VPS and install Dokploy with the CLI
Section titled “Deploy a VPS and install Dokploy with the CLI”Go from a fresh account to a public virtual machine running Dokploy, a self-hosted app platform. You install and authenticate the CLI, create a VPS with a public IP and SSH access, and install Dokploy, all from the terminal. About 15 minutes.
You learn how to:
- Install and authenticate the
zcpCLI - Import an SSH key and pick a region, plan, and image
- Create an internet-facing VM with a public IP
- Connect over SSH and install Dokploy
Deploy OpenClaw from the Marketplace with the CLI
Section titled “Deploy OpenClaw from the Marketplace with the CLI”Deploy OpenClaw, a self-hosted personal AI assistant, straight from the ZSoftly Marketplace. It comes pre-installed on the image, so you deploy and connect, with no manual install. About 10 minutes.
You learn how to:
- Find a Marketplace app template with the CLI
- Deploy it in one command with your SSH key
- Open SSH and confirm the app is ready to configure
Deploy the Ollama Marketplace image on an Intel VM, pull a model, and use it from the CLI and REST API. The reference path uses an 8B model. Deployment time depends on image startup and model download speed.
You learn how to:
- Pick a YUL Intel plan from the catalog
- Use Ollama from the CLI,
/api/chat, and/api/generate - Compare the 8B and 70B CPU workload profiles
- Record timings, resource usage, and failure signals during a bounded test
Add Open WebUI to an existing Ollama VM. Run the browser client on the same machine, connect it to the host Ollama service, and keep access private with an encrypted SSH tunnel.
You learn how to:
- Install Open WebUI with Docker and connect it to host Ollama
- Access Open WebUI through an encrypted SSH tunnel
- Select models from the browser without changing their compute path
- Remove the container, network rules, VM, and any orphaned source-NAT IP
Create a private VPC and tier, lock it down with a custom network ACL, and deploy a self-hosted Headscale server from the Marketplace to give yourself mesh access into it. About 30 minutes.
You learn how to:
- Create a VPC and a private network tier with no public exposure by default
- Replace the default network ACL with one scoped to exactly what the tier needs
- Deploy a self-hosted Headscale and Headplane server from the Marketplace
- Enroll a subnet router and connect your own device to the mesh
Deploy an NFS file share on a VM inside the private tier from Build a Private Network with Headscale, reachable only from the tier and the mesh, never exposed publicly. About 20 minutes.
You learn how to:
- Deploy a VM with a separate data disk inside an existing private tier
- Format and mount the data disk, then export it over NFS to the tier and mesh
- Verify the share from a mesh client, then confirm its public IP has nothing but SSH reachable on it
Deploy a full Ubuntu KDE remote desktop for one employee on a VM inside the private tier from Build a Private Network with Headscale, reached only through the mesh over RDP, never exposed publicly. About 30 minutes.
You learn how to:
- Deploy a desktop VM with a named cloud-init login, not the template’s default account
- Lock down the marketplace template’s default-open SSH rule and bring up the tier network interface
- Connect over RDP and verify the desktop works end to end, then confirm its public IP has nothing but SSH reachable on it
Connect Your Ubuntu Desktops to Private Storage
Section titled “Connect Your Ubuntu Desktops to Private Storage”Mount the file share from Deploy Private Shared Storage on the desktop from Deploy Ubuntu Employee Desktops, over SSH, before handing the employee their RDP login. About 10 minutes per desktop.
You learn how to:
- Mount the NFS share on a desktop through your existing SSH admin access, before RDP credentials go out
- Confirm the mount in Dolphin and persist it across reboots via
fstab - Understand NFS’s raw-UID permission model, and recover a desktop where an RDP login already happened before an identity fix was applied
Back Up Vaultwarden to Object Storage with restic
Section titled “Back Up Vaultwarden to Object Storage with restic”Deploy a Vaultwarden password manager with Terraform or OpenTofu, then back its database up to ZCP object storage every night with restic. restic encrypts on the VM, so the bucket only ever holds ciphertext. That stays true whether or not server-side encryption ships. About 45 minutes.
You learn how to:
- Provision a VM, a public IP, firewall rules, and an object storage bucket in one configuration
- Snapshot a live SQLite database without stopping the service
- Run restic on a systemd timer with retention, pruning, and integrity checks
- Read an object straight out of the bucket to confirm it is unreadable, then restore the vault
Where to go next
Section titled “Where to go next”- CLI quickstart: the short version, for when you already have an account
- Public Cloud quickstart: the same first deployment from the web portal
- Changelog: what is new across the platform
Provision a network and a virtual machine declaratively with the official zsoftly/zcp provider,
published on the Terraform and OpenTofu registries. You write one configuration file, apply it,
change it, and destroy it, with every resource tracked. About 15 minutes.
You learn how to:
- Install the provider and authenticate with an API token
- Describe a network and a VM in HCL and apply the plan
- Resize in place and import resources you created elsewhere
- Destroy the whole stack with nothing left behind