Firezone is a zero-trust network access platform providing secure remote access through VPN-like tunnels. The production system consists of a cloud-based management portal (Elixir/Phoenix), data-plane components (Rust gateways and relays), and native clients for macOS/iOS, Android, Windows, and Linux. The portal manages multi-tenant accounts, identity (OIDC, SAML, email OTP, X.509), access policies, device posture, and logs. It exposes a REST API (PortalAPI) for CRUD operations and WebSocket channels for real-time client/gateway connectivity. The Rust core (connlib) handles ICE/STUN/TURN connectivity, WireGuard tunnels, and eBPF-accelerated packet routing. PostgreSQL is used for persistence with logical replication for change data capture, Oban for background job processing, and Redis for caching/presence. External dependencies include identity providers (Entra, Okta, Google Workspace), device management systems (Intune, Defender, SentinelOne, etc.), log sinks (Splunk, Datadog, Elastic, S3), and billing (Stripe). The architecture separates the web admin interface (PortalWeb), REST API (PortalAPI), and internal ops (PortalOps) into distinct endpoints. Data-plane components (gateway, relay) communicate via WebSockets with the API to receive policy updates. Clients connect to relays using ICE/STUN/TURN. The system uses Phoenix PubSub for real-time updates and Postgres logical replication to propagate changes to connected clients and gateways. Key entry points: PortalWeb.Endpoint (admin UI), PortalAPI.Endpoint (REST/WebSocket for clients and gateways), PortalOps.Endpoint (ops dashboard). Rust binaries: firezone-gateway, firezone-relay, firezone-headless-client, firezone-gui-client. Mobile apps: Firezone iOS/macOS (Swift), Firezone Android (Kotlin).