Onboarding¶

Before you start, list every hostname, every machine client (monitoring, webhooks, payment callbacks: they cannot solve a challenge) and how many connections your origin survives. $API and $ZP_KEY: API access.

1. Create the service¶

Shared: order it with your primary FQDN in the customer portal; it appears in the portal and in GET /services once provisioned.
Dedicated edges: create it yourself (main account, address from your pool, live at once). See Shared and Dedicated.

curl -s -X POST -H "Authorization: Bearer $ZP_KEY" -H 'Content-Type: application/json' \
  $API/services -d '{"account_id": "ACCOUNT_ID", "fqdn": "www.example.com", "origins": [{"address": "203.0.113.10"}]}'

2. Origin¶

On a shared service, add the origin:

curl -s -X POST -H "Authorization: Bearer $ZP_KEY" -H 'Content-Type: application/json' \
  $API/services/www.example.com/origins \
  -d '{"name": "origin1", "address": "203.0.113.10", "port": 443, "sni": "www.example.com", "maxconn": 100}'

Set maxconn to what your application survives; the edge queues the rest. Aliases and health checks: Origins, Services.

3. DNS¶

The edge hostname (network.edge_hostname, for example www-example-com.edge.protect.zeroservices.eu) serves the primary FQDN and all aliases.

Name	Record
subdomain	`CNAME` to the edge hostname
apex (`example.com`)	`A` and `AAAA` with the service's anycast addresses
`CAA`, if set	must allow your ACME provider

Lower the TTL a day in advance, then check:

curl -s -H "Authorization: Bearer $ZP_KEY" "$API/services/www.example.com/dns?refresh=1"

Per hostname: ok_cname, ok_a, wrong_target, apex_cname, or not set up yet.

4. Certificate¶

curl -s -X POST -H "Authorization: Bearer $ZP_KEY" $API/services/www.example.com/ssl/issue

ACME HTTP-01 through the edge, issued within minutes once DNS passes. Own certificates: ECDSA only. Aliases have their own, see TLS.

5. Shield the origin¶

Allow only the ZERO-PROTECT edge addresses in the origin firewall (IPv4 and IPv6; support provides the list), or connect over IPsec, MPLS or a CrossConnect. Then request the application directly on the origin address from elsewhere: it must fail.

6. Protect and test¶

Set service type and posture together with PATCH /services/{fqdn}, for example {"service_profile": "web_dynamic", "defense_posture": "standard"}. For api and hls use posture off and set the limits directly, see Rate limits.
Machine clients into protection_allowlist, see Protection rules.
WAF is off by default: start at paranoia level 1, see WAF.
After a day of normal traffic, size req_per_10s and path_aggregate_per_10s from the logs.
Test from several networks, every alias, the 80 to 443 redirect and the machine clients from their real addresses; X-ZP-Cache shows what the edge caches.

Guided onboarding with our engineers is billed by effort, see the terms of service.