CCD SuiteDocs

CCD-Suite — self-host

Run the whole stack on your own infrastructure. Bring your own LLM key or use the bundled local model. Your data never leaves your network.

CCD-Suite is one codebase, three editions: cloud (managed), self-host community (free, this site), and self-host Enterprise (paid, on-prem SSO/audit/DSAR). This page covers self-host — both community and enterprise share the same install path; the enterprise tier is a runtime entitlement unlock via a LICENSE_KEY of tier: 'enterprise'.

Three editions at a glance

Cloud (managed)Self-host communitySelf-host Enterprise
Where it runsccdsuite.comYour hardwareYour hardware
LLMManaged brain (no key)Bundled Ollama or BYO keyBundled Ollama or BYO key
CostSubscriptionFreeAnnual paid license
UpdatesAutomatic./ccd upgrade./ccd upgrade
LICENSE_KEY neededn/a — Stripe-gated✅ free community-tier JWT✅ paid enterprise-tier JWT
Cross-org benchmarks✅❌ impossible solo❌ impossible solo
SSO/SAML, ABAC, audit-deep, system-admin DSAR✅❌✅ license-gated
9 modules, knowledge graph, agent✅✅✅

Full row-by-row comparison: Cloud vs self-host. Enterprise issuance + install: Self-host Enterprise.

If you're not sure — start with self-host community. Upgrade to enterprise (same binary, swap the key) or migrate to cloud later; your tenant data is portable in both directions.

Install (community)

There are two steps: request a free community LICENSE_KEY (a signed JWT we mint on ccdsuite.com so we can offer support + push security patches), then run the installer.

# 1. Request your free community key at:
#    https://ccdsuite.com/self-host
#    You'll get a JWT by email — paste it into ccd/.env as
#    LICENSE_KEY=eyJhbGciOiJFZERTQSJ9....

# 2. Run the installer
curl -fsSL https://get.ccdsuite.com/install.sh | sh

The installer (see Quickstart for the walk-through):

  1. Preflights — Docker, daemon, disk, RAM, port conflicts.
  2. Drops the compose + init scripts + Kong config into ./ccd.
  3. Generates fresh Supabase keys + internal service secrets.
  4. Asks: bundled Ollama (default) or BYO key.
  5. docker compose up -d.
  6. Polls /api/health and reports.

Boot will fail in production if LICENSE_KEY is missing or invalid — the entitlement layer hard-blocks on a bad key (process.exit(1)). In dev (NODE_ENV != production), it logs the failure and continues so local work isn't blocked.

After ~15 minutes (most of it pulling images + Ollama models on first boot):

cd ccd
docker compose ps

You should see the full stack running — ccd-supabase-db, ccd-supabase-auth, ccd-supabase-rest, ccd-supabase-realtime, ccd-supabase-storage, ccd-supabase-kong, ccd-ollama, plus the four CCD app services (ccd-web, ccd-api-gateway, ccd-ai-services, ccd-worker). Open http://localhost:3000 — that's the app.

What's in the box

  • 9 product modules — CRM, projects, finance, HR, content, social, SEO, portal, analytics.
  • Knowledge graph — every entity from every module, queryable semantically.
  • Agent — chat, insights, actions. Runs against the bundled local LLM or your own API key.
  • Supabase OSS data plane — Postgres + auth + REST + realtime + storage + Kong gateway, bundled in compose. No managed dependency.
  • The four-namespace projection — memory.md, skills/*.md, tasks.md, user.md written to the configured projection root so you can grep/edit/git-track your agent's state.
  • Operator CLI (./ccd) — backup create / list / restore, upgrade [version]. See Backup + restore and Upgrades.
  • Observability profile (opt-in) — Prometheus + Loki + Grafana
    • cAdvisor under docker compose --profile observability up. See Observability.

What's NOT in the community edition

Two categories. Cloud-only features can't exist on a lone self-host instance by definition; license-gated features ship in the same binary but require an enterprise-tier LICENSE_KEY.

Cloud-only (network/managed-service value):

  • Cross-org anonymized benchmarks
  • The managed brain proxy
  • Billing / subscription dashboards
  • Centralized cross-tenant analytics
  • Marketplace templates + referral program

License-gated (unlock with self-host Enterprise):

  • SSO / SAML (Google Workspace, Entra, Okta, OneLogin, custom)
  • ABAC (attribute-based access-control policies)
  • Audit deep — tenant-wide search + signed exports
  • System-admin DSAR queue — operator-side bulk fulfillment + cross-user export
  • User self-serve DSAR — Settings → Privacy page

Self-serve DSAR being license-gated is a deliberate community-scope choice: community is intentionally minimal, and DSAR workflows are something an enterprise compliance team needs, not a small-team evaluator. Operators on community handle data-rights requests off-platform (Postgres-level export + delete).

Everything else (9 modules, KG, agent, file projection) ships in all three editions, identical.

Next reads