The worst class of infrastructure problem is the one you only find out about after it has already broken something. A TLS certificate on a custom domain silently reaches its renewal window and then lapses, and the first signal you get is a browser throwing NET::ERR_CERT_DATE_INVALID at real users. This is exactly the gap that Iris — the AI built into Ngris — is meant to close with proactive certificate expiry alerts and a handful of other nudges that show up in your dashboard before the failure does, not after. Iris knows your account: your endpoints, your policies, your plan, and the state of every cert it manages. That context is what lets it warn you ahead of time instead of narrating the outage.
The class of problem you only notice too late
There is a whole category of operational failure that never announces itself. It accumulates quietly and then presents as a page at an inconvenient hour. A cert lapses. You blow past a plan limit mid-deploy and requests start getting rejected. An endpoint that was only ever meant for a quick demo has been sitting exposed on the public internet for three weeks with no WAF in front of it and no access control on it.
None of these are hard problems to fix once you know about them. The renewal is a config change, the plan bump is a click, attaching a policy is one rule. The difficulty is entirely in the noticing. You are not sitting there watching cert expiry dates or your usage counter — you are shipping features. Iris watches those signals for you and surfaces them as nudges in the dashboard, so the information reaches you while there is still time to act on it cheaply.
Certificate expiry
When you run a custom domain, the cert behind it has a renewal window, and missing that window means downtime. Iris tracks the cert state on your endpoints and nudges you before a custom-domain certificate hits its renewal window — while the fix is still a routine renewal and not an incident. You bring your own domain the usual way:
# serve a local app on your own hostname
ngris http 3000 --url app.ngris.comFrom there, the cert lifecycle is something Iris keeps an eye on in the background. The nudge lands in the dashboard with enough lead time that renewing is a calm task rather than a scramble, and because Iris already knows which endpoint the cert belongs to, the alert points you straight at the thing that needs attention.
Usage burn
Plan limits are fine right up until you hit one without warning, at which point they feel like a wall that appeared out of nowhere. The free plan gives you 5 endpoints and no credit card, and the paid tiers raise the ceilings — but either way, the useful moment to hear about your consumption is before you reach the top of it, not when traffic starts getting turned away.
Iris watches your usage burn and gives you a heads-up as you approach a plan limit. That turns a surprise into a decision you get to make on your own schedule: trim what you are running, or move up a tier deliberately. Getting started is the same one command whether you are near a limit or nowhere close to it:
# install and expose a local service
brew install ngris
ngris http 3000Weak posture
The last category is security posture, and it is the one that is easiest to leave in a bad state without realizing it. An endpoint that is publicly reachable but has no WAF attached is a standing exposure — the Coraza-powered WAF attaches as a single traffic-policy rule, so there is no good reason to run without it once you know it is missing. Iris flags endpoints in that shape.
It also flags open access that really should be gated. If an endpoint is wide open to the internet but is clearly something internal or sensitive, the right posture is usually identity-aware access with SSO/OIDC in front of it rather than a raw public URL. Iris will point that out. Both of these are cases where the config is straightforward — describe what you want and Iris drafts the exact traffic-policy rule, correctly ordered across the WAF, JWT, mTLS, rate-limit, and transform phases — but the awareness that you needed to act was the missing piece.
A nudge, not an auto-fix
Every one of these is a nudge, and that word is doing real work. Iris surfaces the problem; you decide what to do about it. It does not renew the cert for you, it does not bump your plan, and it does not attach a policy on your behalf. When it does help you write the fix — a WAF rule, a rate-limit rule, an SSO gate — that generation is create-only: it drafts a new rule for you to review, never silently mutates an existing one, and nothing ships until you save it.
That boundary is deliberate. Proactive alerting is valuable precisely because it hands you information at the right moment; it stops being trustworthy the instant it starts taking actions you did not review. So Iris stays on the surfacing side of the line. You keep the judgment, and you keep the save button.
If you want to see the nudges in your own dashboard, spin up an endpoint on the free plan — 5 endpoints, no card — and let Iris start watching your certs, your usage, and your posture. Read more about what it can do on the Iris hub.