Written by Alex Bezek, Senior Infrastructure Engineer at ngrok
When you develop software, there comes a time when you must expose services to other networks so they can provide value. At ngrok, we aim to make this as simple as possible, and we apply that principle internally as well. Initially, we deployed an nginx proxy and configured routes by hostnames to host our Python website, Go API, and other tools. After configuring Kubernetes, TLS certificates, and DNS, we were online, but it wasn't as simple as a single command line.
Over time, more applications and services emerged that needed public entry points, such as dashboards, APIs for webhooks, and internal tools. We considered whether we could create ingress to these services using ngrok, and after a proof of concept, we confirmed that we could, and with relative ease. That's how the idea of dogfooding at ngrok was born, which involves using the product internally to close feedback loops and improve empathy with the user.
The biggest challenge was replacing an nginx that had accumulated complexity: static copies of documentation in S3, pages and blogs managed with a CMS, a multitude of redirects and rewrites by routes, various subdomains, and special rules. Changing the DNS of the entire domain required ngrok to be able to reproduce all those functionalities, and a couple of years ago, key features like URL rewrites and complex redirects were still missing.
With the arrival of Endpoints and Traffic Policy, ngrok evolved from a simple tunnel to a complete API gateway. Traffic Policy is an expressive format that allows you to manipulate traffic with fine-grained control, similar to nginx configuration but executed in the ngrok cloud and with built-in features like authentication, allowlists, webhook validations, and more.
When evaluating the requirements of our nginx, we identified several critical points we needed to cover: TLS termination and certificate management, logs and observability, custom headers in non-production environments, expression-based redirects and rewrites, and forwarding traffic to external services like S3 and a CMS. We reviewed each element to confirm whether we could now do it with ngrok.
TLS termination ceased to be an operational burden: registering a domain in our test account, adding DNS to prove ownership, and ngrok provisions and renews certificates automatically. TLS termination occurs at the ngrok edge without having to manage secrets in Kubernetes.
As for logs, previously nginx would dump to stdout and a Datadog agent would collect them from the pods. With ngrok, the plane that receives traffic operates on its global network, and each request generates a Traffic Event with structured data such as source IP, method, headers, latency, and response status. We configured an event destination that forwards those entries to Datadog without deploying sidecars or additional agents. Additionally, Traffic Inspector offers real-time streaming to debug and validate changes.
For non-production environments, we needed to add headers like X-Robots-Tag noindex to prevent indexing. In nginx, we managed this globally with ConfigMap, but in ngrok, each endpoint declares the headers to apply, which is clearer and more portable.
Redirects were a key point. Previously, we used ingress annotations to perform complex rewrites and redirects. With Traffic Policy, redirects are native and manageable through CEL-based expressions, which allowed us to translate existing rules into readable and precise policies.
Forwarding to external services, for example static documentation in S3, was also simplified. Where previously multiple annotations, upstream host adjustments, and TLS configuration snippets were needed, we now use Traffic Policy actions like url-rewrite to remove prefixes and forward-external to proxy the request to the external origin. The result is cleaner and less error-prone configuration.
To deploy everything, we use the ngrok operator for Kubernetes and define Cloud Endpoints as resources in git. These definitions as code are reviewed, versioned, and deployed through the same pipelines as the rest of the infrastructure. After changing the DNS from nginx to the endpoints managed by ngrok, the site went live without depending on local pods.
The benefits were evident: we eliminated a single point of failure in our cluster, reduced latency by serving responses from the nearest ngrok PoP thanks to the global load balancer, and decreased unnecessary traffic to our control region. Product teams were able to self-manage traffic rules without requesting changes in nginx because policies are simpler to understand and modify.
The practice of dogfooding also allowed us to provide feedback during the design of new features, catch bugs before customers saw them, and improve the user experience of Traffic Policy. The process continues, and we are already testing new functionalities such as custom responses to serve security.txt or robots.txt files, adding security headers, rate limiting policies, IP intelligence by geolocation and threat score, and OWASP CRS protections in tests.
At Q2BSTUDIO, we are a software development and custom applications company specialized in enterprise solutions. We offer custom software services, custom applications, and business-oriented artificial intelligence integration. We also provide cybersecurity services to protect infrastructures, consulting and deployment on aws and azure cloud services, and business intelligence solutions such as power bi for visualization and advanced analytics. We develop AI agents and AI solutions for companies that automate processes and improve decision-making. Our approach combines expertise in artificial intelligence, cybersecurity, and cloud services to deliver scalable and secure projects.
If your company needs to migrate infrastructure, modernize traffic routing, implement an API gateway, or explore artificial intelligence solutions and AI agents, at Q2BSTUDIO we can help with auditing, design, and implementation. We work with aws and azure cloud technologies, develop custom software and custom applications, and deploy business intelligence solutions with power bi to improve the strategic and operational positioning of your organization.
The final lesson is that dogfooding drives real improvements. By using ngrok for our own services, we discovered gaps, validated solutions, and accelerated product maturity. At Q2BSTUDIO, we apply the same philosophy: we use the tools we develop in production to guarantee quality, security, and tangible value for our clients in custom software, artificial intelligence, cybersecurity, and cloud services projects.
The migration may be over, but the process of continuous improvement and internal use never stops. If you want to improve your platform with custom software solutions or explore how artificial intelligence and power bi can transform your data into decisions, contact Q2BSTUDIO for specialized consulting.
