Firezone

Firezone: Zero-trust access platform built on WireGuard. Provide secure, identity-aware access to internal applications without exposing ports.

Deploy from this page: TryDirect provisions the server, starts the services, generates the deployment credentials and wires the 2 containers together. Nothing is shared between deployments and no secrets ship with the stack.

What's included

Service	Port	Description
app	8080 (public), 51820/udp (public on 51820)	firezone/firezone:latest
postgres	5432 (local only)	Database

What you configure

• Domain (commonDomain): the hostname the stack is served on
• Defaults provided: EXTERNAL_URL, LOG_LEVEL, POSTGRES_DB, POSTGRES_USER ship prefilled and can be adjusted in the deploy form

All 5 credentials (passwords and keys) are generated per deployment and stored in your project's secret store.

Requirements

• A cloud account connected to TryDirect (the deploy form provisions

the server) or one of your own servers

• A server that fits 2 containers (2 GB RAM or more recommended)
• A DNS record for the domain you set in the deploy form

Alternative: deploy with the Stacker CLI

Everything above also works from the command line:

git clone https://github.com/trydirect/awesome-selfhosted-stacker.git
cd awesome-selfhosted-stacker/stacker-projects/firezone

# Generate secrets
cp .env.example .env
./scripts/generate-secrets.sh

# Deploy
stacker deploy