New — Iris AI drafts your firewall, routing & rate-limit rules. Explore AI features →

Host the whole app, behind the same edge as your tunnels

Static sites, full-stack apps, Docker and Node, Python or Go backends, one-click WordPress and Node.js serverless functions. Deploy from GitHub, GitLab or the ngris CLI, preview it, promote it, roll it back. Every app sits behind the same WAF, bot protection, rate limits and edge login as every agent tunnel.

Start free Hosting docs

Five app types
Push to deploy
Preview, promote, roll back

Terminal ngris apps

# front end on the edge, /api on a managed backend
$ ngris apps create shop --type fullstack \
--repo https://github.com/acme/shop
Created fullstack app "shop" (uuid 6f1c…).
Git source: the first deploy is building.
$ ngris apps link --app 6f1c…
$ ngris apps env set STRIPE_KEY=sk_live_… --secret
Set secret STRIPE_KEY.
$ ngris apps cron add --schedule "@daily" --path /api/digest
Created cron job 2b9e…: GET /api/digest on "@daily" (UTC).
# bad push? back to the last good build
$ ngris apps rollback 91ad…
Rollback: deploy 91ad… is rolling out.

Five ways to run your code

Pick the type that fits the app. Each one deploys the same way, can take your own domain, and is served through the same edge.

--type static

Static site

HTML, JS and CSS served straight from the edge, with no server to run. We build Angular, Next.js (static export), Nuxt, Gatsby, Astro, SvelteKit, Vite, Create React App, Hugo and Jekyll, or serve your folder as-is. Docs

--type fullstack

Full-stack

A static front end on the edge with a managed backend behind it. The path prefixes you choose (/api by default) go to the backend; everything else is served as static files. Docs

--type managed

Backend container

Bring a Dockerfile, or a Go, Node or Python project and we build it, including server-side rendering for Next.js, Nuxt, SvelteKit, Remix and Astro. Images are scanned and signed before they run. Docs

one click

WordPress

Pick a name; we provision the database, install WordPress and give you the admin login. Add your own SMTP server for mail, and retry from the dashboard if an install fails. Docs

--type function

Serverless function

Export a standard (request) => Response handler on Node.js 20. It scales to zero when idle, and the edge starts it again on the next request. Docs

beta

Plus: edge functions

Small JavaScript handlers compiled to WebAssembly and run on the edge itself, on the request or the response, for any endpoint: an app or an agent tunnel. How they work

FULL-STACK APPS

One URL, two origins

The edge looks at the path. Your backend prefixes, /api by default, go to the backend container; every other path is a static file served from the edge. No CORS, no second domain.

Up to 20 backend prefixes, or / to send everything to the backend
The backend runs in a gVisor sandbox; its image is scanned and signed before it runs
A managed MariaDB database arrives as DATABASE_URL and DB_* env vars

Deploy from Git. Preview, promote, roll back.

Three ways a deploy can flow, and every build is kept, so going back is one command.

Push to deploy

Connect GitHub through the ngris GitHub App or a token, or GitLab with a token. We register the webhook; we detect the framework, and you can override the build or set a monorepo root directory.

Or skip Git

ngris deploy zips a folder and uploads it, from your laptop or CI. Or deploy through the REST API, the MCP server, Iris or a one-click template.

Manual promotion

Switch an app to manual promotion and pushes to the production branch wait as candidates until you run ngris apps promote. A preview URL can be turned on for any deploy.

Edge functions (beta)

Run your own JavaScript on the ngris edge: before a request reaches your origin, or on the response on its way back. Write one in the dashboard and attach it to any endpoint, whether it serves an app or an agent tunnel.

edge function · on_http_request

// readRequest / writeResponse come with the starter
const req = readRequest(); // method, url, path, headers

if (req.path.startsWith("/admin") &&
    !req.headers["Authorization"]) {
  writeResponse({ status: 401 }); // answer at the edge
} else {
  writeResponse({ status: 0 });   // continue to origin
}

Compiled to WebAssembly and run in a sandbox on the edge, with no network access
A timeout and a memory limit on every run
Mark an auth check as enforced and a failure answers 502 instead of skipping it
Attach it to any endpoint: a hosted app or an agent tunnel

Edge functions are in beta.

Built in, not bolted on

The pieces a real app needs sit next to the deploy button, in the dashboard and in the ngris apps CLI.

Managed databaseMariaDB, handed over as DATABASE_URL. Docs

BackupsDatabase and volume, on demand or scheduled; restore or download.

Cron jobsScheduled HTTP calls in UTC: ngris apps cron add

AutoscalingOn CPU, between a minimum and a maximum replica count.

Env vars & secretsStored encrypted; env pull never prints a secret.

Build & runtime logsngris apps logs --runtime, crashed instance included.

Web analyticsCounted at the edge. No cookie, no script tag.

Speed InsightsCore Web Vitals from real visitors.

Image optimizationResize and convert to WebP, AVIF, JPEG or PNG at the edge.

Skew protectionOld pages keep getting their own assets after a deploy.

Edge cachingISR-style, honouring s-maxage from your backend.

Custom domainsAutomatic certificates. Domains

SECURITY

The same security edge as your tunnels

A hosted app is an endpoint like any other, so every rule you can put in front of an agent tunnel works in front of an app, configured the same way.

Coraza WAF with a built-in baseline plus your own rules, firewall policies and rate limits
Bot protection: a bot score on every request and an Under attack check. How it works
Edge login with OAuth/OIDC, user accounts and roles, in front of the app with no code changes. Edge login
Private apps: production, previews or both, only for members of your account
Every request in the inspector; replay one, edited if you like
Managed apps run in gVisor sandboxes in our EU region and are served from every edge region over HTTP/1.1, 2 and 3

Already running the service yourself? Expose it with the ngris agent instead, from your machine, a server or Kubernetes. Same edge, same rules. Tunneling docs

Frequently asked questions

Is Ngris hosting only for static sites?

No. Ngris hosts static sites, full-stack apps, container backends built from a Dockerfile or a Go, Node or Python project, one-click WordPress, and Node.js 20 serverless functions. Static files are served straight from the edge; everything else runs as a managed container behind the same edge.

How do I deploy an app?

Connect a GitHub or GitLab repository and every push to your branch builds and deploys, or run ngris deploy to upload a folder from your machine or CI. You can also deploy through the REST API, the MCP server, or by asking Iris in the dashboard.

Can I preview a deploy and roll back?

Yes. Any deploy can get its own preview URL, and for static and full-stack apps, branch previews build one for every push to another branch, kept for 7 days. Build a candidate with ngris deploy --preview and make it live with ngris apps promote, or go back to an earlier build with ngris apps rollback.

Do hosted apps get the same security as tunnels?

Yes. Apps are served through the same edge as agent tunnels, so the WAF, firewall policies, bot protection, rate limits, edge login and the traffic inspector apply in the same way. You can also make an app private, so only members of your account can open it.

Where do hosted apps run?

Managed apps run in gVisor sandboxes in our EU region and are served through every Ngris edge region, in the EU and the US. Static sites are served directly by the edge.

Ship the whole app, not just the front end.

Start free, deploy a site or a function in minutes, and put the same edge in front of it as your tunnels.

Start free Read the docs

Ask an AI to summarise this page