Custom Domains

Bring your own domain so endpoints publish at app.yourcompany.com instead of a shared system domain. Manage domains in the dashboard under Domains (/account/domains). Custom domains are plan-gated — your plan must include the custom-domains entitlement, which also caps how many you can add (0 = unlimited).

Wildcard model. Each custom domain is served via a wildcard — *.yourcompany.com — so every endpoint subdomain you create on it resolves without per-record DNS edits.

Two provisioning modes

When you add a domain you choose how its DNS and TLS are handled. The mode is fixed at creation time.

Mode	You provide	Ngris does
Auto (`auto`, default)	DNS provider credentials for the zone.	Provisions and manages DNS records for you, and issues the wildcard TLS certificate automatically via ACME DNS-01.
Manual (`manual`)	A CNAME record you add yourself at your own DNS provider, plus (in v1) your own TLS certificate.	Validates that the CNAME resolves, then accepts your uploaded certificate. No credentials are stored.

Manual mode carries no DNS credentials, so Ngris never edits records on your behalf and DNS-01 auto-issuance does not run — that's why a manual domain expects an uploaded certificate.

Adding a domain (auto mode)

Choose Auto, enter the domain name, pick your DNS provider, and supply its credentials. Supported providers:

Cloudflare — API Token + Zone ID
AWS Route 53 — Access Key + Secret + Region
DigitalOcean — API Token
Namecheap — API User + Key + Client IP
cPanel — URL + Username + API Token + Zone
Webmin — URL + Username + Password + Domain

Your credentials are validated against the provider before anything is saved — bad or insufficient credentials are flagged on the DNS-credentials field. Stored credentials are encrypted at rest. Once saved, the domain enters pending_issuance and an ACME issue job is queued to mint the wildcard certificate.

Apex domains. A CNAME is illegal at a bare apex, so when an apex fallback IP is configured the apex is pointed at it with an A record while subdomains use the wildcard CNAME.

Adding a domain (manual mode) & CNAME validation

Choose Manual and enter the domain name — no credentials needed. The domain is created in the pending_cname state and the dashboard shows you the exact record to add. The DNS-records view for a manual domain is read-only and returns the required records:

Type	Name	Value
CNAME	*	`cname.ngris.io` (the exact target is shown in your dashboard)
A	@	apex fallback IP (only shown when one is configured)

Validate the CNAME

After you add the *.yourdomain CNAME → cname.ngris.io record at your provider, click Validate CNAME. Ngris probes a concrete subdomain that your wildcard must cover and confirms it resolves to the target (it accepts a matching CNAME chain or, for flattened / ALIAS setups, a matching A-record IP).

Not yet resolving — you get a message telling you exactly which record to add; DNS changes can take a few minutes to propagate, so retry.
Resolved — the domain advances from pending_cname to awaiting_cert. The next step is uploading your TLS certificate.

Trying to edit DNS records on a manual domain through the dashboard is refused — those records live at your own provider.

Domain status

The dashboard surfaces the domain's lifecycle state as a status pill:

Status	Meaning
pending_cname	Manual domain awaiting the CNAME you must add + validation.
awaiting_cert	Manual domain validated; awaiting your uploaded certificate.
pending_issuance	Auto domain queued for ACME certificate issuance.
issuing	ACME issuance in progress.
active	Domain is live with a valid certificate; endpoints can use it.
issuance_failed	Certificate issuance failed.
renewal_failed	Renewal of an existing certificate failed.
revoked	Certificate revoked.

Certificates & DNS records

Auto mode — ACME wildcard

Auto domains get a wildcard certificate issued by ACME over DNS-01 and renewed automatically before expiry. You can trigger a manual Re-issue SSL from the domain's actions if needed, and watch live status via the ACME-status poll.

Manual mode — uploaded certificate

After CNAME validation, upload your own certificate (PEM, with private key) for the domain from its certificates view. The domain becomes active once a valid *.yourdomain certificate is in place. Manual certs don't auto-renew via DNS-01 — Ngris emails the account owner before a manual certificate expires so you can upload a fresh one.

DNS records (auto mode)

For auto domains, the dashboard offers full DNS record management against your provider — A, AAAA, CNAME, TXT, MX, NS, SRV, CAA — each with name, content, TTL and optional priority. Manual domains show read-only instructions instead.

Using a domain on an endpoint. An endpoint can only be created on a custom domain once that domain is active (its certificate is live). Until then the domain shows its pending status in the endpoint create form.