Architecture

OAuth 2.0 and OIDC return two tokens at login, and almost every implementation reads the email address from the wrong one. Why access_token and id_token serve fundamentally different purposes, and why the Userinfo endpoint is the more reliable source for user profile data.

Azurite ties the project to Azure Blob Storage. MinIO speaks the same S3 API as Hetzner Object Storage. Changing environment variables is enough to move to production. Alongside that: how the Zitadel bootstrap container creates OIDC apps automatically.

POST /ingest blocked the extension until embedding generation and the Qdrant upsert finished. BullMQ and Redis make ingestion asynchronous: an immediate 202, background processing and status queries through GET /captures/:id/status.

I could have built Ollama directly into the backend. I could have built OpenAI directly into it. Instead, I built an abstraction layer that allows both, and understood why this is not overengineering but the only strategically sound decision.

Retrieval-Augmented Generation is not theory. It is a concrete three-step architecture: embed, retrieve and generate. I show how I implemented it entirely locally with Qdrant, nomic-embed-text and llama3.2, without cloud costs.

A Chrome Extension for Instagram metadata was the starting point. It grew into a complete RAG system built on Qdrant, Ollama and TypeScript that runs locally, is cloud-ready and enables semantic search across captured social media data.