LanguageTool Self-Hosted Grammar API | cloudimg Support

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

LanguageTool is an open source (LGPL-2.1 core) multilingual grammar, style and spell checker supporting over 25 languages. This image runs the LanguageTool HTTP server as a self-hosted REST API entirely inside your own VPC, so your documents never leave your account. It is delivered fully installed on OpenJDK 17 with a dedicated service account, a hardened systemd unit and an nginx front door, so you can run your first grammar check within minutes of launch rather than working through a manual Java install.

Product and platform teams who need a private grammar and style API to power editors, CMS integrations or content pipelines without sending text to a third-party cloud service; privacy-conscious and regulated organisations who must keep proofreading in-house; and developers who want a real LanguageTool endpoint to develop against.

• LanguageTool, the official standalone distribution, SHA-512 verified against the pinned upstream checksum
• OpenJDK 17 (headless) as the runtime
• nginx as the only public listener, proxying the LanguageTool server behind a per-instance HTTP Basic Auth gate, with an open /healthz endpoint for load-balancer probes
• A dedicated unprivileged languagetool service account and a systemd unit that starts the server on boot
• The base language models bundled inside the LanguageTool jars, so grammar checks return results immediately

This image ships the open source LanguageTool core only. It does not include the LanguageTool premium or paid features, the hosted LanguageTool cloud API, or the optional multi-gigabyte n-gram datasets. The n-gram data can be added later on your own storage; the user guide explains how.

Unlike a raw open source deployment where the check endpoint is exposed without authentication, this image ships fail-closed:

• The LanguageTool server binds to the loopback interface only and is never reachable from the network
• nginx on port 80 is the single public listener and gates the whole API behind HTTP Basic Auth
• A one-shot first-boot service generates a unique Basic Auth password on every instance, applies it as a bcrypt .htpasswd entry, and proves the gate with a real grammar-check round trip before the instance is marked ready
• The shipped .htpasswd is empty, so the API fails closed (every request returns 401) until the per-instance credential is generated
• Credentials are written to a root-only file. No shared secret and no TLS private key are baked into the image

The recommended security group opens port 22 for SSH and port 80 for the authenticated API. Restrict the port-80 source range to your own network, and terminate TLS at an upstream load balancer or by adding a certificate to the nginx server block, before exposing the API to the internet. The user guide covers both approaches.

• POST /v2/check performs a grammar, style and spell check on the supplied text and returns JSON, with each issue and its suggested replacements
• GET /v2/languages lists the supported languages
• GET /healthz is an unauthenticated health endpoint for load-balancer and probe checks

1. Launch the image on an m5.large instance or larger, with port 22 open to your management network and port 80 restricted to the clients that will call the API
2. Connect over SSH as the default login user for your variant (the user guide lists it)
3. Retrieve the generated Basic Auth password with sudo cat /root/languagetool-credentials.txt
4. Send a check request with curl, supplying the admin user and the generated password, and confirm the JSON flags a deliberate error
5. Point your editor, CMS or content pipeline at the API and restrict the security group to those clients

Every deployment is backed by cloudimg engineers available around the clock by email and live chat. Support covers deployment and sizing guidance, tuning the JVM heap and per-request limits, configuring the nginx front door, TLS termination and source restriction, rotating the Basic Auth credential, adding the optional n-gram datasets, and LanguageTool upgrades and troubleshooting. Critical issues receive a one-hour average response time.

This image uses standard AWS pay-as-you-go infrastructure billing. Launch an instance to evaluate the API against your own text and integrations, and terminate at any time.

LanguageTool is a trademark of LanguageTooler GmbH. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.