Ingress

Inbound network (ingress) requirements for CARTO Self-Hosted

Overview

CARTO Self-Hosted needs to be reachable over HTTPS from your users' browsers and optionally from external systems. This page covers inbound traffic requirements.

Required ingress

Port	Protocol	Purpose
443	HTTPS	CARTO web application and API access
80	HTTP	Optional — used to redirect users to HTTPS

Port 80 should only be used for HTTPS redirects, not for serving CARTO content. All meaningful traffic must use port 443 with a valid TLS certificate.

Load balancer and TLS

CARTO must be accessed over HTTPS. Before deploying, ensure you have:

• A dedicated domain name (e.g., carto.yourcompany.com) pointing to your load balancer or VM IP — subdirectory paths (e.g., yourcompany.com/carto) are not supported

• A valid SSL/TLS certificate for that domain. If no TLS certificate is provided, a self-signed certificate will be generated. The TLS certificate private key can't be protected with a passphrase.

If you would like to use some advanced features of Analytics Toolbox like LDS, or some Workflows features like import/export, your domain should be publicly accessible from the internet.

For load balancer configuration best practices, see Load Balancing best practices.

For TLS certificate options, see Custom Domains & TLS.

Kubernetes ingress

An ingress controller is a common way to route external traffic to the CARTO services, and CARTO is compatible with any standard ingress controller. However, an ingress controller is not required. You can also publish CARTO through a LoadBalancer-type Service or your cloud provider's load balancer directly. Choose whichever approach fits your environment; see Load Balancing best practices.

Checklist

• DNS record points to your load balancer or VM public IP

• SSL/TLS certificate is obtained and ready to configure

• Port 443 is open to your users

• Inbound routing is configured (Kubernetes: ingress controller or LoadBalancer Service)