A sequential await chain in the DELETE account endpoint means that if Qdrant fails, S3 data and the Zitadel identity remain. That is a GDPR Article 17 risk. The solution is Promise.allSettled with structured failure reporting. Alongside that: how batching prevents an OOM crash in the export endpoint.
Without rate limiting, one script can exhaust the AI provider key within minutes. Two independent layers address this: Traefik limits by IP, while express-rate-limit with Redis backing limits by authenticated user. Why both layers matter and how to handle the Redis adapter’s TypeScript mismatch.
Before going live, I read through the entire backend again. I found six concrete problems and fixed them all. Here is what I found, where I found it and why each issue mattered.
Retrieval-Augmented Generation is not theory. It is a concrete three-step architecture: embed, retrieve and generate. I show how I implemented it entirely locally with Qdrant, nomic-embed-text and llama3.2, without cloud costs.
Describe your workflow. Together, we will identify the right next step.
Discuss your workflow