> For the complete documentation index, see [llms.txt](https://docs.carto.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.carto.com/carto-self-hosted/planning/prerequisites/network/ingress.md).

# Ingress

Inbound network (ingress) requirements for CARTO Self-Hosted

## Overview

CARTO Self-Hosted needs to be reachable over HTTPS from your users' browsers and optionally from external systems. This page covers inbound traffic requirements.

## Required ingress

| Port | Protocol | Purpose                                    |
| ---- | -------- | ------------------------------------------ |
| 443  | HTTPS    | CARTO web application and API access       |
| 80   | HTTP     | Optional — used to redirect users to HTTPS |

{% hint style="warning" %}
Port 80 should only be used for HTTPS redirects, not for serving CARTO content. All meaningful traffic must use port 443 with a valid TLS certificate.
{% endhint %}

## Load balancer and TLS

CARTO must be accessed over HTTPS. Before deploying, ensure you have:

* A **dedicated domain name** (e.g., `carto.yourcompany.com`) pointing to your load balancer or VM IP — subdirectory paths (e.g., `yourcompany.com/carto`) are not supported
* A valid **SSL/TLS certificate** for that domain. If no TLS certificate is provided, a self-signed certificate will be generated. The TLS certificate private key can't be protected with a passphrase.

{% hint style="info" %}
If you would like to use some advanced features of Analytics Toolbox like LDS, or some Workflows features like import/export, your domain should be publicly accessible from the internet.
{% endhint %}

For load balancer configuration best practices, see [Load Balancing best practices](/carto-self-hosted/best-practices/deployment/load-balancing-best-practices.md).

For TLS certificate options, see [Custom Domains & TLS](/carto-self-hosted/configuration/networking/custom-domains-and-tls.md).

## Kubernetes ingress

An **ingress controller** is a common way to route external traffic to the CARTO services, and CARTO is compatible with any standard ingress controller. However, an ingress controller is **not required**. You can also publish CARTO through a `LoadBalancer`-type Service or your cloud provider's load balancer directly. Choose whichever approach fits your environment; see [Load Balancing best practices](/carto-self-hosted/best-practices/deployment/load-balancing-best-practices.md).

## Checklist

* [ ] DNS record points to your load balancer or VM public IP
* [ ] SSL/TLS certificate is obtained and ready to configure
* [ ] Port 443 is open to your users
* [ ] Inbound routing is configured (Kubernetes: ingress controller or `LoadBalancer` Service)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.carto.com/carto-self-hosted/planning/prerequisites/network/ingress.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.