Bring your own domain. We handle DNS and HTTPS.
Add your domain, connect Cloudflare, AWS Route 53, DigitalOcean, Namecheap, cPanel or Virtualmin, and ngris creates the DNS records and issues a free Let's Encrypt certificate for the domain and its wildcard, then keeps it renewed. Any other DNS host works too: prove ownership with a TXT record and bring your own certificate. It works the same for agent tunnels and for apps hosted on ngris.
- Free wildcard certificates
- Renewed automatically
- Expiry reminders
Automatic DNS, or one TXT record
You choose the mode when you add the domain. Automatic lets ngris manage the records at your DNS provider. Manual works with any DNS host and leaves every record in your hands.
Automatic
- Connect Cloudflare, AWS Route 53, DigitalOcean, Namecheap, cPanel or Virtualmin/Webmin with an API token or login, scoped as tightly as you like (on Cloudflare,
Zone:DNS:Editon one zone) - Credentials are checked against the provider before they're saved, and stored encrypted
- Each endpoint's record is added when you create it (a CNAME to
cname.ngris.io, or an A record at the apex) and removed when you delete it - A free Let's Encrypt certificate for the domain and its wildcard, renewed for you
Manual
- Prove ownership with a TXT record at
_ngris-verify.example.com, read straight from your nameservers - Add one CNAME,
*.example.com→cname.ngris.io, and click Check DNS - Upload your own certificate; ngris emails you before it expires
- No DNS credentials are stored, and ngris never edits your records
Certificates: free wildcard, auto-renewed, or your own
HTTPS ends at the ngris edge, so the service behind it can keep speaking plain HTTP. You pick where the certificate comes from.
Free wildcard certificates
Let's Encrypt over DNS-01 for example.com and *.example.com, so every endpoint you put on the domain is covered from its first request. The dashboard follows issuance live.
Renewed before they expire
No certbot and no renewal cron on your side. Need a fresh certificate now? Click Re-issue SSL. If a renewal keeps failing, you get an email with the reason.
Bring your own
Upload a PEM certificate with its key and chain, make it the domain's certificate or assign it to a single endpoint, and download it again whenever you need it.
Your DNS records, in the dashboard
For a domain in automatic mode, ngris reads and writes the zone through your provider's API. Edit records next to the endpoints that use them, without opening another console.
Every common record type
Create, edit and delete A, AAAA, CNAME, TXT, MX, NS, SRV and CAA records, each with its TTL and, where it applies, a priority.
Cloudflare proxy toggle
On a Cloudflare zone, switch Cloudflare's proxy on or off for each record from the same form.
One view for all six providers
The same record table for Cloudflare, Route 53, DigitalOcean, Namecheap, cPanel and Virtualmin/Webmin.
From the API or your AI assistant
Domains, certificates and records are in the REST API and the ngris MCP server: domain_add, domain_reissue_cert, dns_record_create.
A manual-mode domain shows the records to add at your own provider instead. Ngris doesn't edit them.
Reminders before anything expires
Two dates can take a domain offline: its certificate and its registration. Ngris watches both.
Registration dates come from Cloudflare Registrar, RDAP or WHOIS, refreshed about once a day; a registry's unpaid auto-renew grace period isn't mistaken for a renewal. Iris, the dashboard assistant, also shows a nudge when a certificate or registration is close, and walks you through the fix.
Ngris doesn't sell or register domains. Renew at your registrar as usual; ngris watches the date.
One domain setup for tunnels and apps
A domain you add is used the same way by a service on your own machine and by an app hosted on ngris.
Agent tunnels
- Create an endpoint on your domain, then run
ngris http 3000 --url app.example.com - The agent connects out to the edge, so there's no port to open and no reverse proxy to configure
- The edge serves your certificate; the local service can stay on plain HTTP
Hosted apps
- Open the app's Domains pane and add your domain; the same certificate covers it
- For WordPress, the site URL switches to the new domain automatically
- Until then the app answers on a free hostname such as
*.ngris.dev. See hosting
Every endpoint also starts on an ngris hostname with HTTPS already on, so it works before your own domain is connected.
Frequently asked questions
Which DNS providers work in automatic mode?
Cloudflare, AWS Route 53, DigitalOcean, Namecheap, cPanel and Virtualmin/Webmin. Ngris checks the credentials against the provider before saving them and stores them encrypted. Any other DNS host works in manual mode, with a TXT record to prove ownership and one CNAME.
Are the certificates free, and do they cover subdomains?
Yes. In automatic mode Ngris issues a Let's Encrypt certificate for your domain and its wildcard (example.com and *.example.com) over DNS-01, so every endpoint on the domain is covered, and renews it before it expires. You can also re-issue it at any time.
Can I use my own certificate?
Yes. Upload a PEM certificate with its private key and chain, then make it the domain's certificate or assign it to a single endpoint. A manual-mode domain always uses an uploaded certificate, and Ngris emails you before it expires because it can't renew it for you.
Does Ngris sell or register domains?
No. Your domain stays at your registrar. Ngris looks up its registration expiry about once a day (Cloudflare Registrar, RDAP or WHOIS) and emails you 30, 14, 7, 3 and 1 days before it runs out.
What happens if my domain registration lapses?
When a fresh lookup shows the registration has really lapsed, Ngris takes the domain and its endpoints offline and emails you. It re-checks every 4 hours and brings everything back as it was once you renew. A domain still not renewed 30 days later is deleted.
Do I have to move my nameservers to Ngris?
No. Your domain stays with your DNS provider. In automatic mode Ngris creates the records through your provider's API; in manual mode you add one TXT record to prove ownership and one CNAME yourself.
Put your own domain on ngris.
Start free, connect your DNS provider, and get a certificate for your domain and its wildcard.