Power Pages in detail.

I learned that a Docker named volume does not automatically end up on a Hetzner volume in production. Only when I deliberately control the path do I really know where Qdrant, Redis and certificates are written.

I do not treat the choice of embedding model as an interchangeable environment variable. In Qdrant, it becomes part of every collection. Using different vector spaces locally and in production creates an expensive future migration.

A sequential await chain in the DELETE account endpoint means that if Qdrant fails, S3 data and the Zitadel identity remain. That is a GDPR Article 17 risk. The solution is Promise.allSettled with structured failure reporting. Alongside that: how batching prevents an OOM crash in the export endpoint.

Without rate limiting, one script can exhaust the AI provider key within minutes. Two independent layers address this: Traefik limits by IP, while express-rate-limit with Redis backing limits by authenticated user. Why both layers matter and how to handle the Redis adapter’s TypeScript mismatch.

With eight services in a Docker Compose stack, nginx.conf becomes a maintenance burden. Traefik reads service configuration directly from Docker labels, terminates TLS automatically through ACME and needs no separate configuration file. Why I switched and what the configuration looks like.

Before going live, I read through the entire backend again. I found six concrete problems and fixed them all. Here is what I found, where I found it and why each issue mattered.