> For the complete documentation index, see [llms.txt](https://docs.carto.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.carto.com/carto-self-hosted/planning/prerequisites/network/ingress.md).

# Ingress

## Overview

CARTO Self-Hosted needs to be reachable over HTTPS from your users' browsers and optionally from external systems. This page covers inbound traffic requirements.

## Required ingress

| Port | Protocol | Purpose                                    |
| ---- | -------- | ------------------------------------------ |
| 443  | HTTPS    | CARTO web application and API access       |
| 80   | HTTP     | Optional — used to redirect users to HTTPS |

{% hint style="warning" %}
Port 80 should only be used for HTTPS redirects, not for serving CARTO content. All meaningful traffic must use port 443 with a valid TLS certificate.
{% endhint %}

## Load balancer and TLS

CARTO must be accessed over HTTPS. Before deploying, ensure you have:

* A **dedicated domain name** (e.g., `carto.yourcompany.com`) pointing to your load balancer or VM IP — subdirectory paths (e.g., `yourcompany.com/carto`) are not supported
* A valid **SSL/TLS certificate** for that domain. If no TLS certificate is provided, a self-signed certificate will be generated. The TLS certificate private key can't be protected with a passphrase.

{% hint style="info" %}
If you would like to use some advanced features of Analytics Toolbox like LDS, or some Workflows features like import/export, your domain should be publicly accessible from the internet.
{% endhint %}

For load balancer configuration best practices, see [Load Balancing best practices](/carto-self-hosted/best-practices/deployment/load-balancing-best-practices.md).

For TLS certificate options, see [Custom Domains & TLS](/carto-self-hosted/configuration/networking/custom-domains-and-tls.md).

## Kubernetes ingress

An **ingress controller** is a common way to route external traffic to the CARTO services, and CARTO is compatible with any standard ingress controller. However, an ingress controller is **not required**. You can also publish CARTO through a `LoadBalancer`-type Service or your cloud provider's load balancer directly. Choose whichever approach fits your environment; see [Load Balancing best practices](/carto-self-hosted/best-practices/deployment/load-balancing-best-practices.md).

## Checklist

* [ ] DNS record points to your load balancer or VM public IP
* [ ] SSL/TLS certificate is obtained and ready to configure
* [ ] Port 443 is open to your users
* [ ] Inbound routing is configured (Kubernetes: ingress controller or `LoadBalancer` Service)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.carto.com/carto-self-hosted/planning/prerequisites/network/ingress.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.