SecureAnyCloud
Deployment guide

Zope 6

Overview

This guide covers the deployment and configuration of Zope 6 on Ubuntu 24.04 on Azure using SecureAnyCloud Azure Marketplace images. Zope (the Z Object Publishing Environment) is an open source web application server written in Python and organised around the Zope Object Database (ZODB), a transactional object store that persists ordinary Python objects with no separate relational database to manage. Content and code are managed through the browser based Zope Management Interface (ZMI), where administrators create folders, page templates and scripts, control access and inspect the running system.

The image installs the official Zope 6.2 release from the Python Package Index into a dedicated virtualenv, pinned to Zope's version matched dependency set, and serves it through the waitress WSGI server. It runs as a single Python process. Because Zope is a web application server, this image ships a genuinely browsable web UI: the welcome page, the Zope Management Interface for building and managing objects, and the Zope Control Panel for inspecting the running system.

What is included:

  • Zope 6.2 installed with pip into a Python 3.12 virtualenv at /opt/zope/venv, pinned to the upstream version matched constraints
  • The waitress WSGI server, with the application served by runwsgi
  • zope.service systemd unit auto-starting on boot, running as the unprivileged zope:zope system user
  • zope-firstboot.service systemd oneshot that generates a per-VM administrator password, creates the admin manager in a fresh object database, and confirms the login before completing
  • WSGI listener bound to loopback only (127.0.0.1:8080) — nginx fronts it on :80
  • Unauthenticated /healthz endpoint (nginx-native, HTTP 200) for load balancer / probe checks
  • The Zope welcome page, the Zope Management Interface (/manage) and the Zope Control Panel — a real, clickable admin UI
  • The ZODB Data.fs object database on a dedicated 20 GiB Azure data disk mounted at /var/lib/zope, so object data survives independently of the OS disk
  • Ubuntu 24.04 LTS base with latest security patches applied at build time and unattended security updates enabled
  • Azure Linux Agent for seamless cloud integration and SSH key injection
  • 24/7 SecureAnyCloud support with guaranteed 24 hour response SLA

Architecture

Zope listens on 127.0.0.1:8080 only and is never exposed directly to the network. nginx terminates :80 and reverse proxies to the loopback WSGI listener. The Azure Network Security Group opens only ports 22, 80 and 443.

This keeps the Management Interface and the object database off the public interface and behind a single nginx front door.

1

Deploy the image

Launch the Zope 6 on Ubuntu 24.04 LTS by SecureAnyCloud image from the Azure Marketplace on a Standard_B2s or larger VM. In the Network Security Group, open inbound ports 22 (SSH), 80 (HTTP) and 443 (HTTPS). The 20 GiB data disk that holds the object database is provisioned automatically from the image.

When the VM is running, connect over SSH as azureuser with the SSH key you selected at launch:

ssh azureuser@<public-ip>
2

Confirm the services are running

Zope and nginx start automatically on boot. Run this command to confirm both are active:

systemctl is-active zope.service nginx.service

The command prints active once for each service. For the full status view, run:

systemctl --no-pager status zope.service nginx.service
3

Retrieve the per-VM administrator password

There is no default login. The image ships with no object database and no credential. On first boot it creates a fresh Data.fs, generates a unique administrator password and creates the admin manager account with it. The details are written to a root-only file. Read the file with:

sudo cat /var/lib/sac/secrets/sac-credentials.txt

The file lists the Zope URL, the management URL, the admin user name and the generated ZOPE_ADMIN_PASSWORD.

4

Open the Zope welcome page

Open a browser and go to the VM's public address:

http://<public-ip>/

Zope serves its default page, rendered from the index_html page template in the root of the object database.

You can also check the front door from the shell. The nginx health endpoint returns 200:

curl -s -o /dev/null -w '%{http_code}\n' http://localhost/healthz
5

Sign in to the Zope Management Interface

Open the ZMI at /manage and sign in with admin and the password from Step 3. The Contents view lists the objects in the root folder: acl_users (the user folder), index_html (the welcome page template) and virtual_hosting. Use the toolbar to add, rename, copy and delete objects.

You can also confirm the login from the shell. Replace <ZOPE_ADMIN_PASSWORD> with the value from Step 3. The per-VM administrator returns 200, and the upstream default admin/admin returns 401:

curl -s -o /dev/null -w 'per-VM admin: HTTP %{http_code}\n' -u "admin:<ZOPE_ADMIN_PASSWORD>" http://localhost/manage_main
curl -s -o /dev/null -w 'default admin/admin: HTTP %{http_code}\n' -u "admin:admin" http://localhost/manage_main
6

Inspect the running system in the Control Panel

Open the Control Panel from the gear icon in the ZMI toolbar. It reports the Zope and Python versions, the instance home, debug mode, process id and uptime. Additional tabs cover the databases, configuration, DAV locks and ZODB connections.

7

Manage users

Open the root user folder (acl_users) to see the defined users. After first boot, the only user is the admin manager. From here you can add users, change passwords and assign roles. Click a user name to edit it.

8

Where the data lives

The ZODB Data.fs object database lives under /var/lib/zope on the dedicated 20 GiB Azure data disk. It persists independently of the OS disk, and you can resize the volume on its own. Confirm the mount with:

df -h /var/lib/zope

Managing the service

Zope runs as a standard systemd service. Restart it and view its recent logs with:

sudo systemctl restart zope.service
sudo journalctl -u zope.service -n 50 --no-pager

Stop the service with sudo systemctl stop zope.service and start it again with sudo systemctl start zope.service. Zope's own event and access logs are in /var/lib/zope/log/, for example event.log and Z4.log.

Security notes

  • No default credential. The image contains no object database and no user. A unique administrator password is generated on first boot, before nginx exposes port 80.
  • Loopback binding. Zope listens only on 127.0.0.1:8080. nginx is the single network-facing front door on :80.
  • Change the administrator password. After first login, set a password you control: in the ZMI open acl_users, click the admin user, enter a new password and save.
  • Keep the VM patched. Ubuntu unattended security upgrades are enabled by default.
  • Use HTTPS in production. Terminate TLS at nginx or an Azure load balancer before serving production traffic.

Troubleshooting

  • Welcome page not loading: confirm that systemctl is-active zope.service nginx.service reports active for both services, and that the NSG allows inbound port 80.
  • Management login rejected: read the password again with sudo cat /var/lib/sac/secrets/sac-credentials.txt. It is generated per VM and is not admin.
  • Zope slow to answer right after boot: the WSGI server needs a few seconds on first start to import the application and open the database. Run curl -s -o /dev/null -w '%{http_code}\n' http://localhost/ to see when it is ready.

Support

SecureAnyCloud images include 24/7 support with a guaranteed 24 hour response SLA. Contact sales@secureanycloud.com for assistance.

Deploy on Azure

Launch Zope 6 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure