Automation
Automate the work. Prove it works first.
A rule is one sentence: when this happens, if that is true, do these things — and from then on it runs hands-free, every time it applies. Before you switch it on, replay it against your own event history to see how often it would have fired and on what, and dry-run every step to see exactly what it would do. Nothing changes until you save.
Free plan · No credit card · Start from one of 26 recipes
- When this happens, if that is true, do this
- Dry-run it and replay it against real history
- 74 events, 79 actions, your own tools included
- It names the failure instead of grinding on
When this happens
Domain expiring
A domain is approaching its expiry date.
Runs at 09:00 · Europe/Amsterdam · it’s 15:49 there now
Next runs:Sat 19 Sept, 09:00Sun 20 Sept, 09:00Mon 21 Sept, 09:00
This automation only runs when you click “Run now”.
Only if — optional filters
MatchAllAnyNoneof these conditions
Tip: a value can reference another field or the time using a placeholder.
Do this — actions run in order, stop at the first failure
In plain English
When Domain expiring if Days left less or equal 15, then Require approval, Set auto-renew and Send notification.
Works with the tools you already run
Know what a rule will do before you trust it with anything
This is the part most rule engines skip. A trigger and a list of steps takes a minute to write and is impossible to check: you find out whether you meant it the first time it fires, on something real, usually at three in the morning. InfraNest answers the question four ways before that happens. The builder writes the rule back to you as a sentence while you build it. A dry run executes every step against a real object from your own account and changes nothing. A saved rule can be tested on demand. And a backtest replays the trigger and the filters over your own recorded history, and tells you how often the rule would have fired, and on what.
- A plain-English sentence of the whole rule, rewritten as you build it — the cheapest way to catch a rule that says something you did not mean
- Backtest against your own history: how many times it would have fired in the last 30 days, and which of your things it would have fired on
- Dry-run every step against a real object from your account — each one reports what it would do, including the ones that would be skipped and why
- Test a saved rule on demand, or run it now, instead of waiting for the real event to come round
- An unknown placeholder or a destination that does not exist is flagged where you typed it, not at 3am in a run log
Would have run
5×in the last 30 days
- northwind.shop4d
- northwind-labs.com6d
- nwcloud.app8d
▸ Test with a custom payload
Conditions pass — this would run
1 of 1 matchedRuns each step in dry-run against a real example from your account — nothing is changed.
1. Require approval
Would pause for approval
2. Set auto-renew
domain has no registrar connection
3. Send notification
Would notify 1 destination(s)
dry run
Actions are a tree, not a checklist — and one branch can be a person
Almost everything worth automating is conditional. Route by tag. Notify, wait fifteen minutes, and escalate only if it is still down. Repeat a step for each thing the event carried. And before anything you cannot undo, stop and ask somebody. So the actions are a tree rather than a list: branches and loops nest, a wait parks the run and resumes it at the exact step it left — inside a branch inside a loop, re-running nothing — and an approval holds the run in front of the risky part until a named person says yes.
- If/else branches and for-each loops, nested as deep as the job needs
- Wait for minutes or hours; the run parks and picks up exactly where it was, and a run that is merely waiting is never killed for sitting still
- Require approval stops the run before the destructive step — and rejecting ends the run rather than skipping one step and carrying on
- Restrict who may approve, and the one-click approve links are left out of the notification, so a forwarded email cannot get round it
- Placeholders drop live detail into any message, title or webhook body, with filters for dates, case and fallbacks — and secrets are never offered and never resolve
Monitor alert · Status equals down
Do this — actions run in order, stop at the first failure
Then
Otherwise
Add action
Search actions…
Flow
If / branch
Run steps only when conditions match — otherwise the Else steps.
For each
Repeat steps for each item in a list.
Wait
Pause the flow, then continue — e.g. notify, wait, then re-check.
Set a value
Define a named value that later actions in this automation can reuse.
Require approval
Pause for a human to approve before the steps below run.
Every event you run on — and a good many you do not
Seventy-four events, and they are not confined to one corner of the product: a domain registered, a zone that has drifted from what your provider is publishing, a server created, a monitor down, an incident opened, a certificate gone weak, a watched domain about to drop. Seventy-nine actions, on any of them. And because plenty of what you want to react to happens somewhere else, GitHub, Jira, Linear and PagerDuty start rules directly — a workflow that failed, a pull request merged, an incident escalated — which is what stops this being an infrastructure-only engine. A rule can also run on a schedule in your own timezone, or on an inbound webhook that anything at all can post to.
- 74 events across ten categories; 47 actions built in and 32 more through a connected account
- GitHub, Jira, Linear and PagerDuty in both directions — they trigger rules, and rules open issues, merge pull requests, re-run workflows and move tickets
- A schedule in your timezone — hourly to monthly, every N minutes, or a raw cron expression — with the next run times shown before you save
- An inbound webhook endpoint, so a tool with no integration of its own can still start a rule
- Conditions on the event, on any field of the thing it is about, on tags or on the clock — nested all/any/none groups and twelve comparisons, deliberately not an expression language
When this happens
Search events…
Domains6
Domain added
A domain was added or imported into InfraNest.
Domain expiring
A domain is approaching its expiry date.
Domain status changed
A domain's nameservers or status changed.
DNSSEC broke
A domain's DNSSEC stopped validating — resolvers that check it may refuse to answer for the domain.
Domain renewed
A domain's registrar pushed its expiry date out (renewed).
Domain deleted
A domain was removed from InfraNest.
DNS3
Certificates6
Servers11
Monitoring11
75 events across 10 categories
All events in a category
All domain events
6 event types
Everything that happens
75 event types
When a run goes wrong, it tells you which kind of wrong
“It failed” is not an answer. Every run is kept as its ordered steps with what each one returned, and the states are distinct on purpose: succeeded, skipped because the conditions did not match, waiting on a person, retrying, failed with the error the provider gave, and gave up. The distinction that matters most is between a bad minute upstream and a permission you never granted. A transient failure is retried with backoff. A refused permission stops the rule on the first failure, names the permission the way your provider spells it, and tells you — because four more attempts would only be four identical refusals.
- Every run kept as ordered steps with the output or the exact error, and retries, waits and approval decisions on the same timeline
- A skipped run names the condition that did not match, which is the answer to “why did my automation not fire?”
- Five failures in a row switch the rule off with the reason recorded, rather than failing forever in silence
- A run executes a frozen copy of the rule, so editing one mid-flight cannot derail a run already going
- Cooldown is keyed to the thing the event is about, not to the rule — a burst about one domain cannot silence the other forty-nine
Open a maintenance window on new server
Start from a recipe, not a blank page
A first automation is far easier to pick than to invent. Twenty-six ready-made recipes cover the ordinary jobs and the awkward ones — onboard a new domain, escalate a monitor after fifteen minutes, ask for approval before committing to another year of a domain, open a GitHub issue when a workflow fails. Each one pre-fills the builder rather than running as a black box, so you can read it, change it and check it before you save. When your own organisation settles on a shape it likes, save that as a template too.
- Twenty-six recipes across eight categories, filtered by category or trigger, or searched
- One click pre-fills the builder — you tailor it before saving, and nothing runs until you do
- Save any rule of your own as a template for the rest of your organisation
- Every input in the builder is searchable and pick-or-type, so you are never guessing at a field name
- Rules are org-wide, taggable and searchable, and every change lands in the audit log
Start from a ready-made recipe — filter by category or trigger, or search. One click pre-fills the builder; tailor it before saving.
Expiring domain → approve, then auto-renew
v2Domain expiring → Require approval → Set auto-renew → Send notification
Monitor down → wait, then escalate
v2Monitor alert → Send notification → Wait → Send notification
Ask another system, then act on the answer
v2Domain expiring → Call webhook → If / branch → Send notification → Send notification
Certificate expiring → run a GitHub workflow
v2Certificate expiring → Run GitHub workflow
Monitor down → route by tag
v2Monitor alert → If / branch → Send notification → Send notification
New domain onboarding
Domain added → Create DNS zone → Apply DNS template → Start monitoring
Auto-renew expiring domains
Domain expiring → Set auto-renew → Send notification
GitHub workflow failed → open an issue & alert
GitHub workflow run → Create GitHub issue → Send notification
Incident opened → announce on status page
Incident opened → Post status-page announcement → Send notification
Monitor down → reboot the server
Monitor alert → Reboot server → Send notification
New server → enable backups & protection
Server added → Enable backups → Enable delete protection
Weak certificate → webhook
Weak certificate → Call webhook → Send notification
Certificate expiry heads-up
Certificate expiring → Send notification
Deployment succeeded → purge Cloudflare cache
GitHub deployment status → Purge Cloudflare cache
DNS record changed → alert
DNS record changed (in-app) → Send notification
Send domain events to my system
Domain added → Call webhook
Send everything to my system
Domain added → Call webhook
Deployment succeeded → announce on status page
GitHub deployment status → Post status-page announcement
Incident opened → Cloudflare Under Attack
Incident opened → Set Cloudflare security level
Incident opened → log to a webhook / Sheet
Incident opened → Call webhook
Let another tool trigger an automation
Incoming webhook → Send notification
Maintenance started → status announcement
Maintenance started → Post status-page announcement
Tell my own system when a monitor fails
Monitor alert → Call webhook
Production monitor down → page on-call
Monitor alert → Send notification
Watched domain available → notify
Watched domain available → Send notification
Weekly expiry review reminder
Scheduled → Send notification
Showing 26 of 26 recipes
Everything else it handles
The parts that are only interesting when you need them.
It runs as a person, not a robot
A rule acts with the permissions of your organisation’s owner or of whoever created it — your choice, per rule — and the run is attributed to them in the audit log. There is no unbounded service account behind it that can do more than the person who set it up.
Guardrails you never have to think about
A run is capped at 100 actions and 500 steps, a loop at 100 iterations, and a transient failure is retried on a backoff of 30 seconds to 15 minutes before it gives up. Nothing hangs, and a run that is only waiting is left alone.
Automations that trigger automations
Bounded rather than banned, because chaining rules is genuinely useful. A chain is capped at five deep and a rule cannot re-trigger itself within one, so a loop between two rules stops instead of compounding.
Replay a past run
Once whatever broke has been fixed, re-run any run from the history with the payload it originally had — rather than waiting for the event to happen again, or faking one.
Carry a value between steps
Save something an early step produced — including the body a webhook answered with — and use it in a later condition, message or request. That is what turns a list of steps into something that can ask another system and act on the answer.
One rule, several events
A rule can listen to a whole category, or to everything that happens, not just one event. That is what you want when the destination is your own system and you would rather forward the lot than maintain twenty rules.
A deleted rule is restorable
For fourteen days, from Recently deleted, and it fires nothing at all while it waits there. Deleting a rule you turn out to need next quarter is not a decision you have to make carefully.
Alerts wherever you already read them
Notification actions reach Slack, Teams, Discord, Telegram, email or a webhook, chosen per action, with the message you write and live detail dropped into it.
Build your first rule in about two minutes
Start from a recipe, replay it against your own history, then switch it on. Nothing runs until you save.
Scripts and reminders vs InfraNest
The difference between something that fired and knowing what it did.
Scripts and reminders
- You find out whether the rule was right the first time it fires, on something real
- A cron job that stopped last month looks exactly like one that is working
- “It failed” — with no way to tell a bad minute from a permission you never granted
- The irreversible step runs at 3am with nobody awake to say no
- Steps that live in someone’s head, done a little differently each time
With InfraNest
- Replay it against real history and dry-run every step before you switch it on
- Five failures in a row switch the rule off and record why
- The refusal names the permission, spelled the way your provider spells it
- Require approval holds the run until a named person says yes
- One rule, one audit trail, the same every time
One login, ten modules
Every module is in every plan, Free included — what changes is how much of each you get.
The cost of doing it separately
Buy each piece from a different tool and it adds up fast:
- Domain & DNS
- ~€30
- Uptime monitoring
- ~€29
- SSL tracking
- ~€15
- Status page
- ~€29
- Server panel
- ~€15
- Across 4–5 separate tools
- €100–150/mo
Frequently asked
Do I need to write any code?
No. You pick a trigger, add filters from dropdowns, and choose actions — and twenty-six ready-made recipes mean you usually start from something that already works. Conditions are nested all/any/none groups with twelve comparisons, deliberately not a formula language: a formula would make “what will this rule actually do?” unanswerable without running it. Webhooks and placeholders are there for the rare job that needs to reach further, and they are optional.
How do I know a rule will do what I meant?
Four ways, before it ever runs for real. The builder writes the whole rule back to you as a plain-English sentence as you build it. A dry run executes every step against a real object from your account and changes nothing, reporting what each step would do. A saved rule can be tested on demand. And a backtest replays your trigger and filters against your own recorded event history and tells you how often the rule would have fired in the last thirty days, and on what. Most rule engines in this category offer none of these.
Can a rule act on GitHub, Jira or PagerDuty?
In both directions. GitHub, Jira, Linear and PagerDuty events start rules — a workflow run that failed, a pull request merged, a release published, an incident escalated — and rules act back on them: open, label, assign, comment on or close an issue, merge a pull request, request a review, trigger or re-run a workflow, create a release or a deployment, set a commit status, transition a ticket, or create and comment on a Notion page. That is 32 actions through connected accounts, on top of the 47 built in.
What happens if an action fails?
It depends on how it failed, which is the point. A transient failure is retried with backoff — 30 seconds, then two, five, ten and fifteen minutes — and if it never comes good the run gives up, with the reason recorded, rather than hanging. A permission your credential does not have stops the rule immediately instead, names the permission the way the provider spells it, and notifies you, because four more attempts would be four identical refusals. Five failed runs in a row switch a rule off with the reason recorded. You can also tell any single step to carry on rather than stop the run.
Could an automation do something destructive by accident?
Several things make that hard. Nothing runs until you save and enable a rule, and you can dry-run it first. Anything irreversible can sit behind Require approval, which holds the run until a named person says yes — and rejecting ends the run rather than skipping the step. A rule acts with a real person’s permissions rather than an unbounded service account. A run executes a frozen copy of the rule, so an edit mid-flight cannot change what is already going. And every run is in the audit log, with a deleted rule restorable for fourteen days.
Can a rule run on a schedule instead of an event?
Yes. Hourly, daily, weekly, monthly, every N minutes, or a raw cron expression if you prefer — in your organisation’s timezone, with the next few run times shown before you save so you can see you have not written 09:00 in the wrong zone. Rules can also be run by hand, or started by an inbound webhook that any tool can post to.
How many automations do I get?
Three rules on the free plan, twenty-five on Pro and unlimited on Business — each with as many conditions and actions as you need. Every action is available on the free plan except the eleven that power servers up and down or change Cloudflare’s settings, which are Pro. Run history, dry runs and the backtest are not gated at all.
Write the rule once, and stop remembering it
Start from a recipe, prove it against your own history, then let it run.
Free plan · No credit card required · Set up in minutes