Ifeanyi David Ndueze

Cloud & Platform Engineer

Ifeanyi David Ndueze

Cloud & Platform Engineer

Cloud and platform engineer with two decades of infrastructure experience, now designing and deploying production cloud systems end to end. I build and run a multi-tenant SaaS platform on Linux cloud infrastructure — a nine-service containerised stack with PostgreSQL/TimescaleDB, Redis and Celery, secrets held in AWS SSM Parameter Store, KMS-backed encryption, nginx and Cloudflare strict TLS — under a disciplined infrastructure-as-code and git-based deployment protocol where nothing is changed by hand on a production server. Hands-on across AWS (CDK, ECS, Aurora/RDS, S3, IAM, CloudFront, SSM, SES, KMS), GitHub Actions CI/CD pipelines, observability with Prometheus and Grafana, and multi-cloud delivery on AWS, Azure and Oracle Cloud. Completing a Level 7 Diploma in Cloud Engineering and preparing for AWS Solutions Architect – Associate, on a foundation of Windows Server, Active Directory, networking and security administration.

  • Wellington, New Zealand
  • NZ residence visa, full working rights
  • Open to NZ-remote
  • Twenty-plus years in IT infrastructure

Two decades in infrastructure

Every figure on this page comes from a repository or a migration I ran.

  • 9 services in the stack Trading SaaS platform
  • 210,107 rows of market data backfilled Trading SaaS platform
  • 150 commits Field-services platform
  • 300 GB mail migrated Cloud hosting stack
  • SSM Parameter Store
  • AWS KMS
  • Oracle Cloud (Ampere ARM64)
  • Azure Machine Learning
  • Azure AI Foundry
  • HestiaCP
  • GitHub Actions
  • Docker
  • Docker Compose
  • Alembic
  • Django migrations
  • pytest
  • restic
  • Backblaze B2
  • imapsync
  • Linux (Ubuntu, ARM64 and x86)
  • nginx
  • Passenger / WSGI
  • PostgreSQL
  • TimescaleDB
  • MySQL
  • MariaDB
  • SQLite
  • Redis
  • SQLAlchemy
  • ADLS Gen2
  • Microsoft Fabric
  • FastAPI
  • Django
  • Flask
  • Celery
  • Next.js
  • WordPress theme development
  • Cloudflare (DNS, strict TLS, Email Routing)
  • SPF / DKIM / DMARC
  • RBAC
  • Python
  • TypeScript
  • PHP
  • Bash
  • SQL

What I built, and why

Projects

Trading SaaS platform

Live in paper mode
  • 9 services in the stack
  • 32,926 lines · execution engine
  • 115 commits · web platform
  • 210,107 rows of market data backfilled

The constraint

One ARM64 host in a single region has to run the whole platform, and it holds other people’s exchange API keys.

The decision

Nothing on that server is changed by hand. Every change goes local → commit → push → server pull, and the production schema is committed to git as the single source of truth.

The evidence

  • Deployed as a nine-service Docker Compose stack: postgres, redis, backend, worker, events, beat scheduler, flower, frontend, and the bot itself.
  • CI runs on every push and pull request: uv on Python 3.11 with ruff, mypy and pytest, and separately pnpm on Node 20 for lint, typecheck and a production build.
  • Secrets live in AWS SSM Parameter Store, and user exchange keys are sealed with AES-256-GCM under AWS KMS.
  • Carried out a SOC 2 and ISO 27001 gap assessment, with a public security page describing the result.
  • Python
  • FastAPI
  • Next.js
  • TypeScript
  • Celery
  • PostgreSQL
  • TimescaleDB
  • Redis
  • Docker Compose
  • Oracle Cloud (Ampere ARM64)
  • SSM Parameter Store
  • AWS KMS
  • nginx
  • Cloudflare (DNS, strict TLS, Email Routing)
  • GitHub Actions

Cloud hosting stack

for a commercial hosting client Infrastructure — no repository
  • 300 GB mail migrated
  • 1 TB block volume
  • 0 mailboxes lost

The constraint

Outbound port 25 is blocked on the cloud provider, and 300 GB of live mail had to move off managed hosting without an outage.

The decision

Migrate incrementally with repeated imapsync passes so the cutover was a short final delta, and route outbound mail through an authenticated relay on 587 with SPF, DKIM and DMARC left intact.

The evidence

  • HestiaCP on an Oracle Cloud Ampere A1 ARM64 instance in Sydney, with a 1 TB block volume.
  • Backups run restic to Backblaze B2, and are verified by restoring from them rather than by checking a green tick.
  • This replaced managed hosting end to end — provisioning, storage, TLS, DNS, mail and backup are all now run rather than bought.
  • HestiaCP
  • Oracle Cloud (Ampere ARM64)
  • Linux (Ubuntu, ARM64 and x86)
  • imapsync
  • restic
  • Backblaze B2
  • Cloudflare (DNS, strict TLS, Email Routing)
  • SPF / DKIM / DMARC
  • Bash

Field-services platform

for a cleaning and field-services company in Australia
  • 150 commits
  • 49,760 lines
  • 3 CI workflows

The constraint

The client might not have payment keys configured on the day it went live, and a booking flow that breaks without them is worse than one that never offers cards.

The decision

The platform degrades deliberately: with no Stripe keys configured, card payment is not offered at all and bookings fall back to bank transfer.

The evidence

  • Django 5.2.8 with WhiteNoise, CKEditor 5 and Stripe, covering bookings, jobs, pricing, payments, an office and admin area, and a content system.
  • CI asserts models and migrations are in step with makemigrations --check, so schema drift cannot reach production.
  • CI proves the WhiteNoise manifest pipeline can hash every referenced static file before anything is deployed.
  • Django
  • Python
  • Django migrations
  • GitHub Actions
  • PostgreSQL

Learning platform

for a mission and training resources centre
  • 10 Django applications
  • ≈20,800 lines

The constraint

Shared cPanel under Passenger and WSGI: no root, no containers, no systemd, no persistent workers — and a live WordPress site whose users had to come across without anyone being asked to reset a password.

The decision

No LMS, CMS or e-commerce library. The quiz engine, grading, progress tracking and certificate generation are all first-party code, because the libraries that would have done that work could not survive the deployment target.

The evidence

  • Django 5.2 on Python 3.11 with MariaDB, deployed to shared cPanel under Passenger and WSGI — no root, no containers, no systemd, no persistent workers.
  • The WordPress migration brings users across intact: it verifies WordPress 6.8 $wp$2y$ hashes — a SHA-384 pre-hash plus bcrypt — and implements the legacy phpass $P$ scheme in pure Python, so nobody has to reset a password.
  • Deployment is test-gated rsync over SSH, with a MariaDB 10.11 service container in CI matching production and a concurrency guard preventing overlapping deploys.
  • Django
  • Python
  • MariaDB
  • MySQL
  • Passenger / WSGI
  • Django migrations
  • GitHub Actions
  • pytest

Savings platform

a rotating savings and credit association (ROSCA)
  • 27,736 lines
  • 9 Alembic migrations

The constraint

Shared cPanel with no Celery and no Redis available — the runtime will not hold a background worker.

The decision

Asynchronous work goes through a database outbox drained by cron, rather than a task queue the host cannot run.

The evidence

  • Flask 3 and SQLAlchemy 2, 27,736 lines, with 9 Alembic migrations.
  • Multi-currency throughout, with a documented security model covering how financial records are kept.
  • Flask
  • Python
  • SQLAlchemy
  • SQLite
  • Alembic
  • Passenger / WSGI

Azure data platform

Coursework
  • 2 Azure tenants

The constraint

The Fabric workspace sat in a tenant provisioned by the lecturer while the storage account was in my own — so identity and access had to be made to work across two tenants.

The decision

Configure the cross-tenant RBAC properly rather than collapsing everything into one tenant, which made the access model real work instead of a diagram.

The evidence

  • A Microsoft Fabric medallion architecture — Bronze, Silver and Gold Delta tables — over an ADLS Gen2 landing zone with RBAC, an orchestration pipeline, an event-driven trigger and Power BI reporting, built on New York high-volume for-hire vehicle trip data.
  • An end-to-end Azure Machine Learning pipeline for a regression model on vehicle price data: cleaning, a 70/30 train-test split, evaluation metrics and reporting.
  • Also covered Azure AI Foundry capabilities — generative text, text analytics, speech and image analysis — alongside classification and clustering scenarios.
  • Microsoft Fabric
  • ADLS Gen2
  • Azure Machine Learning
  • Azure AI Foundry
  • RBAC
  • SQL

Marketing site and blog

for a study-abroad and immigration consultancy
  • 3,173 lines · theme
  • 442 lines · SEO module
  • 0 plugins required

The constraint

WordPress on shared cPanel, a client who has to be able to edit every page themselves, and no build step available on the server.

The decision

No page builder, and no plugin for anything that matters. The SEO module, the Study Destinations post type and its fields are all first-party code, so the theme is the entire deliverable and there is nothing to keep in step with someone else’s release cycle.

The evidence

  • A custom theme of 3,173 lines across 24 PHP files, with five page templates and a Study Destinations custom post type.
  • A self-contained SEO module of 442 lines: per-view titles and descriptions, canonical URLs, Open Graph and Twitter cards, JSON-LD for Organization, WebSite with SearchAction, BreadcrumbList and BlogPosting, sitemap and robots wiring, and an editable SEO box on every page. No SEO plugin.
  • Consultation booking runs on Cal.com, which creates the Zoom or Microsoft Teams meeting and emails the link the moment a slot is taken.
  • WordPress theme development
  • PHP
  • Docker

Corporate site rebuild

for a marine services company
  • 5,243 lines · theme and plugin
  • 1,834 lines · crew portal
  • 0 third-party API keys

The constraint

Shared cPanel with FTPS and nothing else — no SSH, no git on the host — and a members area where seafarers upload certificates that exist nowhere else.

The decision

Deployment adds and updates only. The script never touches the database or wp-content/uploads, so no deploy can destroy a document somebody uploaded, and the contact map is self-hosted so the site needs no third-party API key at all.

The evidence

  • The crew portal is a plugin of 1,834 lines — seafarer accounts, document upload and storage, an admin view and transactional mail — written as first-party code rather than assembled out of membership plugins.
  • A 74-line Node script uploads the theme and plugin over FTPS from a machine whose IP the host firewall allows. It adds and updates only, and never touches the database or wp-content/uploads.
  • The contact page map is self-hosted Leaflet with dark tiles, so the site needs no mapping API key and makes no third-party request for it.
  • WordPress theme development
  • PHP
  • Docker

2001 — present

Experience

  • 2022–present

    Independent Cloud & Systems Engineering Consultant

    Wellington, New Zealand

    • Design, build and operate cloud platforms end to end: infrastructure, application, delivery pipeline and deployment are all mine.
    • Replaced a client’s managed hosting with a self-run stack on ARM64 cloud infrastructure, including a 300 GB mail migration completed with no mailboxes lost.
    • Deliver under real platform constraints — shared hosting with no root or containers, blocked outbound SMTP, no persistent workers — and choose the architecture that survives them.
    • Own the CI that gates every deployment, so no change reaches a production server except by commit, push and pull.

  • 2022–present

    Able Seafarer (Deck)

    Coastal passenger ferry operations, New Zealand

    • Concurrent with consulting work, in a safety-critical regulated environment operating 24/7.
    • Procedure is followed without deviation, and operational and defect records are kept accurately to regulatory standard — the same discipline good change management asks for.

  • 2019–2022

    Systems Support Engineer

    Port Harcourt, Nigeria

    • Diagnosed, resolved and escalated hardware, software and network faults across a multi-site estate.
    • Administered Windows systems, user accounts and access controls across sites.
    • Owned proactive monitoring, scheduled maintenance, patching and backups.

  • 2005–2018

    Systems Support Specialist

    Port Harcourt, Nigeria

    • A thirteen-year engagement supporting a diverse client base, including a media and entertainment group and a radio station.
    • Acted as trusted point of contact and technical advisor, translating business requirements into technical solutions.
    • Explained the impact and severity of issues to non-technical stakeholders, and recommended network improvements.

  • 2003–2005

    Systems Support Technician

    Abuja, Nigeria

    • Led a team of seven technicians across concurrent client projects — assigning work, providing technical guidance and ensuring delivery to schedule.
    • Ran Windows Server and Active Directory environments: user accounts, group policy and network access controls.
    • Supported mixed Windows and macOS local area networks.

  • 2001–2002

    Systems Technician

    Lagos, Nigeria

    LAN support and application training.

Each one links to where it was used

Capabilities

Cloud Platforms

IaC & CI/CD

Observability & Operations

Data & Storage

Application & Web

Networking & Security

Languages

Formal training

Education & certifications

  • Level 7 Diploma in Cloud Engineering 2026
  • AWS Solutions Architect – Associate (SAA-C03)
  • Simplilearn training certificates AWS Solutions Architect – Associate track, completed 2025
  • CCNA 2010
  • Diploma in Computer Engineering 2000

The same record, a different emphasis

Other versions of this profile

By email or phone

Contact

Open to cloud and platform engineering roles.

david@ndueze.com +64 22 423 3173 github.com/DavidIfeanyichukwu