The Ngris Blog
Tunneling & Edge Gateway Blog
Engineering articles, tutorials, and product deep-dives on API gateways, secure tunneling, and edge computing.
RSS feedDeploy Any Framework in One Click, Free — With a WAF One Rule Away
Deploy a React, Vue, Astro, Next.js static, SvelteKit, Nuxt, or Hugo app to Ngris in one click — free — and serve it behind a real security edge the way Vercel, Netlify, and ngrok don't bundle: a Coraza WAF, OAuth/basic-auth login, and rate limits, attached per endpoint as one traffic-policy rule at no extra vendor cost.
How I Manage My Entire Edge From Claude (MCP)
A first-person tour of running the Ngris edge from Claude over the MCP server: connect over OAuth 2.1, then create endpoints, deploy apps, set firewall and rate-limit rules, inspect and replay traffic, manage domains/DNS/TLS, and check billing in plain language — about 150 user-facing tools, reads free, writes visible, no admin and no credential minting.
Preview Deploys on Every Pull Request
The official ngris-edge/deploy-action GitHub Action builds your app and deploys a preview to the Ngris edge on every pull request, then comments the live URL on the PR. Unlike a plain static host, every preview is served behind the same per-endpoint policy edge — a WAF, OAuth, and rate limits — as your production endpoints.
Manage Your Entire Edge From Your AI Assistant
The Ngris MCP server is live at mcp.ngris.com. Connect Claude Code, Claude Desktop, or any MCP client and drive your whole edge in natural language — expose a local service, deploy a site, inspect and replay traffic, tighten a firewall rule — with about 150 tools over the public API and OAuth or an API key.
Deploy a React or Vite App: Ngris vs Vercel
Deploy a React or Vite app on Ngris, a Vercel alternative that builds and hosts your front-end from git behind a real security edge — a WAF, per-route login, and rate limits, plus tunneling and Iris in one platform. A full-stack app can also add a per-app managed MariaDB (MySQL) database with the connection injected as env vars.
Expose or Deploy: One Edge for Tunnels and Static Hosting
Ngris is the one tool that lets you expose a localhost or K8s service (tunnel) OR build & host a front-end framework app (React, Vite, Next.js static export, and more) plus a full-stack backend with an optional per-app managed MariaDB (MySQL) database — behind one policy edge, with an AI (Iris) that writes your rules.
Deploy Your AI-Coded App to the Edge
Ship a static site or web app to the Ngris edge with no server and no agent: push a repo or drop a folder, Ngris builds it, and every deploy gets a shareable preview URL.
Ngris vs Netlify and Vercel for Deploying Your App
How Ngris app hosting compares to Netlify and Vercel — builds, preview URLs, env vars, and the edge security layer — for shipping AI-coded apps. Ngris also runs full-stack backends and can add a per-app managed MariaDB (MySQL) database, where Netlify and Vercel send you to a third-party database.
What Iris Can (and Can't) Do: an Honest Look at the Gateway AI
An honest account of the Ngris gateway AI: Iris drafts edge rules from plain English, answers questions about your account by reading the live API, searches your traffic logs from a plain-English query, and explains a request — every write gated behind a confirmation card.
Let Iris Take Action, Safely — Behind a Confirm Gate
Iris can create, update, and delete real resources — but every AI action needs your confirmation: a before-and-after diff and a blast-radius preview first.
Generate Traffic-Policy Rules With AI
Describe the behavior in plain English and Iris drafts a traffic-policy rule — WAF, JA3 bot management, CORS, JWT validation, caching — for you to review.
Analyze Traffic Logs With AI
Analyze traffic logs with AI: get a per-request explanation of why a request was blocked or allowed, and compile a plain-English description into a real traffic filter.
Generate Metric Alerts With AI
Say the threshold in plain English — p95 latency over 300ms, error rate above 1% — and Iris drafts the metric-alert rule, scoped to the right endpoint and window, for you to review and enable.
Hands-Off Firewall Autonomy That Auto-Reverts
Opt-in AI autonomous security: for firewall rules only, Iris can apply a safe, reversible change after a passing dry-run — and auto-revert if it hurts real traffic.
Generate Firewall Rules With AI
Describe what to block in plain English and Iris drafts the firewall rule — the right traffic-policy phase and match — for you to review before it enforces.
Generate Rate Limit Rules With AI
Say the limit in plain English — 10 login attempts per minute per IP — and Iris drafts the rate-limit rule, scoped to the right endpoint, for you to review.
Proactive Alerts: Catch Cert Expiry Before It Causes Downtime
Iris surfaces proactive alerts before problems bite: a certificate near expiry, usage burning toward a plan limit, or an endpoint exposed without a WAF.
Iris: an AI Assistant Built Into Your Gateway
Iris is the AI built into Ngris: ask how-to questions, generate firewall and rate-limit rules from plain English, and get proactive alerts before things break.
Custom Domain for Localhost: Point Your Own Domain (with HTTPS)
Use a custom domain for localhost: map your own domain or subdomain to a local server with one CNAME and automatic HTTPS. Custom domains are on the paid Team plan.
Expose a Local API to the Internet
Expose a local API to the internet with a public HTTPS URL, then lock it down with auth, rate limits, and a WAF — and inspect every call. Not just a tunnel.
Your Tunnel Is Now a Full API Gateway
A traffic-policy engine runs 23 rule types across four ordered phases at the edge — WAF, JWT, mTLS, rate limits, and CEL-guarded transforms — attached per endpoint, where the first non-continue result wins.
Ship a Web Application Firewall in One Rule
A Coraza-powered WAF you attach as a single traffic-policy rule — detect by default, block when you're ready, with a curated in-binary baseline and room for your own SecLang.
Catch Bots at the TLS Handshake with JA3
JA3 fingerprints the TLS ClientHello before a single HTTP byte is parsed — computed only when you've enabled a bot-management rule, matched against a denylist or allowlist you build from your own detect logs.
Turn Your OpenAPI Spec Into Edge Request Validation
Upload or paste an OpenAPI 3 spec and Ngris generates one body-validation rule per JSON operation — SSRF-safe parsing, a full preview, and rules staged disabled so an import can't break production.
Deploy Edge Security Rules Without Breaking Prod
Detect-first defaults, staged spec imports, and a blast-radius preview that replays your own real traffic through a rule before you save it — so a typo doesn't take prod down.
Edge Computing Security: Best Practices for 2026
Secure tunnel connections, WAF, identity-aware access, and live traffic inspection — a practical guide to edge computing security with zero-trust architecture.
Tunneling vs API Gateway vs Edge Computing: What's the Difference?
Tunneling, API gateways, and edge computing solve different problems. Learn when to use each — and how Ngris combines all three in one platform from dev to production.
Identity-Aware Access: SSO for Internal Services Without a VPN
Put an internal dashboard behind your identity provider in minutes. Users sign in with Google, GitHub, or Okta; Ngris enforces who can reach what at the edge — no VPN, no shared password.
Debug Production Traffic: Live Inspection and Request Replay
“It only happens in prod” is usually a request you can't reproduce. Capture the exact one, filter to it, and replay it against a fixed build until it's green.
Test Webhooks Locally with a Public URL
Stripe, GitHub, and Shopify all want to POST to a public HTTPS URL. Point them at your laptop, watch every delivery in real time, and replay the ones that failed.
How to Expose Localhost to the Internet (Public URL)
How to expose localhost to the internet: turn a local server or website on localhost:3000 into a public HTTPS URL — make localhost public, no port forwarding, no DNS.
Static Egress IPs Explained
A partner says “send us your IP and we'll allowlist it.” Behind a shared edge, that IP isn't stable. A static egress IP makes your outbound traffic come from one address you can hand over with confidence.
Ngris on Kubernetes, Without the YAML Spaghetti
A native operator with ten CRDs, an Ingress shim, and Gateway API support — so you can declare endpoints, traffic policies, and mTLS the same way you declare everything else in your cluster.
Shipping Mutual TLS at the Edge
Certificate-based client authentication on every Ngris endpoint — across HTTPS, HTTP/2, and HTTP/3.
Building an Edge Gateway: From Zero to Production
A practical guide to setting up a production-grade edge gateway with WAF, per-endpoint auth, load balancing, and multi-region deployment in under an hour.
Ngris vs Traditional Tunneling: A Feature-by-Feature Comparison
An honest, detailed comparison of Ngris and traditional tunneling tools across protocols, security, pricing, and developer experience. See where each platform excels.
Why We Built Ngris
The story behind Ngris — why existing tunneling tools weren't enough, and how we designed a platform that grows with you from development to production.