eworkerinc/language-services repository overview

⁠E-Worker Language Services (.NET 10)

Language Services lets E-Worker run spelling and grammar checks locally using LanguageTool, without exposing LanguageTool directly to the browser.

• E-Worker talks to Language Services (not to LanguageTool).
• LanguageTool runs embedded in the same container by default.
• Authentication is required for all non-public routes.
• HTTPS is supported (recommended when E-Worker is running over HTTPS).
• Java and fastText are installed via apt; LanguageTool server files come from the official LanguageTool archive.

⁠Docker image

• Language Services (.NET + embedded LanguageTool): eworkerinc/language-services:0.7.2

Versioning policy for the rewrite:

• Keep the same image repository (eworkerinc/language-services).
• Bump the tag for the .NET runtime line (recommended next major/minor tag: 0.7.2).
• Continue publishing latest from the current stable tag.

⁠Quick start (Docker Compose)

The default compose snippet publishes Language Services on 127.0.0.1 only. Use this when the browser that runs E-Worker is on the same machine as Docker.

services:
  language-services:
    image: eworkerinc/language-services:0.7.2
    restart: unless-stopped
    environment:
      HTTP_HOST: 0.0.0.0
      HTTP_PORT: "8687"
      HTTPS_HOST: 0.0.0.0
      HTTPS_PORT: "8688"
      TLS_CERT_PATH: /certs/service.crt
      TLS_KEY_PATH: /certs/service.key
      LANGUAGE_SERVICE_TOKEN: change-me
      LANGUAGETOOL_URL: http://127.0.0.1:8010
      LANGUAGETOOL_TIMEOUT_MS: "15000"
      LANGUAGETOOL_JAVA_XMS: "1g"
      LANGUAGETOOL_JAVA_XMX: "8g"
      LANGUAGETOOL_MAX_CHECK_THREADS: "12"
      LANGUAGETOOL_MAX_WORK_QUEUE_SIZE: "256"
      LANGUAGETOOL_MAX_CHECK_TIME_MILLIS: "25000"
      LANGUAGETOOL_CACHE_SIZE: "20000"
      LANGUAGETOOL_CACHE_TTL_SECONDS: "600"
      LANGUAGETOOL_PIPELINE_CACHING: "true"
      LANGUAGETOOL_MAX_PIPELINE_POOL_SIZE: "128"
      LANGUAGETOOL_PIPELINE_EXPIRE_SECONDS: "600"
    ports:
      # Local-only: use when the browser runs on this same machine.
      - "127.0.0.1:8687:8687"
      - "127.0.0.1:8688:8688"
      # LAN access: replace the two local-only lines above with these
      # when browsers call https://<host-or-ip>:8688 from another machine.
      # - "0.0.0.0:8687:8687"
      # - "0.0.0.0:8688:8688"
    volumes:
      - ./certs:/certs:ro

For machine-IP/LAN access, Docker must publish the ports on host interfaces. A firewall rule alone will not make https://<host-or-ip>:8688 reachable if Docker is still bound to 127.0.0.1.

Keep LANGUAGETOOL_URL=http://127.0.0.1:8010 when using the embedded LanguageTool server. That URL is internal to the container; browsers should call Language Services on port 8688, not LanguageTool on port 8010.

For LAN HTTPS, generate or install a certificate whose SAN includes the exact host name or IP address users will enter in E-Worker, for example language-service.local, workstation.lan, or 192.168.0.10.

If you want external LanguageTool instead of embedded LT:

• set LANGUAGETOOL_EMBEDDED_ENABLED=false
• set LANGUAGETOOL_URL=http://<external-host>:8010

⁠Verify

docker ps --format "table {{.Names}}\t{{.Ports}}"

# Local-only publish:
# 127.0.0.1:8688->8688/tcp

# LAN publish:
# 0.0.0.0:8688->8688/tcp

curl -k https://127.0.0.1:8688/healthz -H "Authorization: Bearer change-me"
curl -k https://127.0.0.1:8688/v2/languages -H "x-api-key: change-me"
curl -k https://127.0.0.1:8688/v2/check -H "Authorization: Bearer change-me" -H "Content-Type: application/json" --data '{"text":"Ths is tesst","language":"en-US"}'

For LAN installs, also verify from another machine:

curl -k https://<host-or-ip>:8688/healthz -H "Authorization: Bearer change-me"

If the host responds to ping but port 8688 times out, Docker is still bound to 127.0.0.1 or the host firewall/network profile is still blocking inbound TCP 8688.