Ifeanyi David Ndueze

Technical Architect

Ifeanyi David Ndueze

Technical Architect

Technical architect with two decades in infrastructure and a decade of designing systems that have to survive their environment. I work across AWS, Azure and Oracle Cloud, and most of my design decisions are shaped by real constraints rather than a blank sheet — choosing a pure-Python database driver because the target host has no compiler, a database outbox instead of a task queue because the runtime will not hold workers, building a learning platform’s quiz and grading engine rather than adopting a library that would not survive the deployment. I also translate those trade-offs for people who do not want the detail, which is most of the job.

  • Wellington, New Zealand
  • NZ residence visa, full working rights
  • Open to NZ-remote
  • Twenty-plus years in IT infrastructure

A decade designing systems that survive their environment

Every figure on this page comes from a repository or a migration I ran.

  • 10 Django applications Learning platform
  • 9 Alembic migrations Savings platform
  • 300 GB mail migrated Cloud hosting stack
  • 9 services in the stack Trading SaaS platform
  • SSM Parameter Store
  • AWS KMS
  • Oracle Cloud (Ampere ARM64)
  • Azure Machine Learning
  • Azure AI Foundry
  • HestiaCP
  • GitHub Actions
  • Docker
  • Docker Compose
  • Alembic
  • Django migrations
  • pytest
  • restic
  • Backblaze B2
  • imapsync
  • Linux (Ubuntu, ARM64 and x86)
  • nginx
  • Passenger / WSGI
  • PostgreSQL
  • TimescaleDB
  • MySQL
  • MariaDB
  • SQLite
  • Redis
  • SQLAlchemy
  • ADLS Gen2
  • Microsoft Fabric
  • FastAPI
  • Django
  • Flask
  • Celery
  • Next.js
  • WordPress theme development
  • Cloudflare (DNS, strict TLS, Email Routing)
  • SPF / DKIM / DMARC
  • RBAC
  • Python
  • TypeScript
  • PHP
  • Bash
  • SQL

What I built, and why

Projects

Learning platform

for a mission and training resources centre
  • 10 Django applications
  • ≈20,800 lines

The constraint

Shared cPanel under Passenger and WSGI: no root, no containers, no systemd, no persistent workers — and a live WordPress site whose users had to come across without anyone being asked to reset a password.

The decision

No LMS, CMS or e-commerce library. The quiz engine, grading, progress tracking and certificate generation are all first-party code, because the libraries that would have done that work could not survive the deployment target.

The evidence

  • A deliberate policy of no LMS, CMS or e-commerce library: the quiz engine, grading, progress tracking and certificate generation are first-party code.
  • The WordPress migration brings users across intact: it verifies WordPress 6.8 $wp$2y$ hashes — a SHA-384 pre-hash plus bcrypt — and implements the legacy phpass $P$ scheme in pure Python, so nobody has to reset a password.
  • Django
  • Python
  • MariaDB
  • MySQL
  • Passenger / WSGI
  • Django migrations
  • GitHub Actions
  • pytest

Cloud hosting stack

for a commercial hosting client Infrastructure — no repository
  • 300 GB mail migrated
  • 1 TB block volume
  • 0 mailboxes lost

The constraint

Outbound port 25 is blocked on the cloud provider, and 300 GB of live mail had to move off managed hosting without an outage.

The decision

Migrate incrementally with repeated imapsync passes so the cutover was a short final delta, and route outbound mail through an authenticated relay on 587 with SPF, DKIM and DMARC left intact.

The evidence

  • This replaced managed hosting end to end — provisioning, storage, TLS, DNS, mail and backup are all now run rather than bought.
  • Outbound port 25 is blocked on the provider, so mail routes through an authenticated relay on 587, with SPF, DKIM and DMARC kept intact.
  • 300 GB of mail migrated off cPanel using incremental imapsync passes, so the cutover was a short final delta rather than an outage. No mailboxes were lost.
  • HestiaCP
  • Oracle Cloud (Ampere ARM64)
  • Linux (Ubuntu, ARM64 and x86)
  • imapsync
  • restic
  • Backblaze B2
  • Cloudflare (DNS, strict TLS, Email Routing)
  • SPF / DKIM / DMARC
  • Bash

Trading SaaS platform

Live in paper mode
  • 9 services in the stack
  • 32,926 lines · execution engine
  • 115 commits · web platform
  • 210,107 rows of market data backfilled

The constraint

One ARM64 host in a single region has to run the whole platform, and it holds other people’s exchange API keys.

The decision

Nothing on that server is changed by hand. Every change goes local → commit → push → server pull, and the production schema is committed to git as the single source of truth.

The evidence

  • Deployed as a nine-service Docker Compose stack: postgres, redis, backend, worker, events, beat scheduler, flower, frontend, and the bot itself.
  • Secrets live in AWS SSM Parameter Store, and user exchange keys are sealed with AES-256-GCM under AWS KMS.
  • The production DDL — 71,148 lines — is committed to git as the schema’s single source of truth.
  • Python
  • FastAPI
  • Next.js
  • TypeScript
  • Celery
  • PostgreSQL
  • TimescaleDB
  • Redis
  • Docker Compose
  • Oracle Cloud (Ampere ARM64)
  • SSM Parameter Store
  • AWS KMS
  • nginx
  • Cloudflare (DNS, strict TLS, Email Routing)
  • GitHub Actions

Savings platform

a rotating savings and credit association (ROSCA)
  • 27,736 lines
  • 9 Alembic migrations

The constraint

Shared cPanel with no Celery and no Redis available — the runtime will not hold a background worker.

The decision

Asynchronous work goes through a database outbox drained by cron, rather than a task queue the host cannot run.

The evidence

  • Flask 3 and SQLAlchemy 2, 27,736 lines, with 9 Alembic migrations.
  • Multi-currency throughout, with a documented security model covering how financial records are kept.
  • Flask
  • Python
  • SQLAlchemy
  • SQLite
  • Alembic
  • Passenger / WSGI

Azure data platform

Coursework
  • 2 Azure tenants

The constraint

The Fabric workspace sat in a tenant provisioned by the lecturer while the storage account was in my own — so identity and access had to be made to work across two tenants.

The decision

Configure the cross-tenant RBAC properly rather than collapsing everything into one tenant, which made the access model real work instead of a diagram.

The evidence

  • Built across two tenants: the Fabric workspace in a lecturer-provisioned tenant, the ADLS Gen2 storage in my own Azure account, so the cross-tenant identity and access configuration was real work rather than a diagram.
  • Microsoft Fabric
  • ADLS Gen2
  • Azure Machine Learning
  • Azure AI Foundry
  • RBAC
  • SQL

Field-services platform

for a cleaning and field-services company in Australia
  • 150 commits
  • 49,760 lines
  • 3 CI workflows

The constraint

The client might not have payment keys configured on the day it went live, and a booking flow that breaks without them is worse than one that never offers cards.

The decision

The platform degrades deliberately: with no Stripe keys configured, card payment is not offered at all and bookings fall back to bank transfer.

The evidence

  • With no payment keys configured, card payment is not offered and bookings fall back to bank transfer rather than failing.
  • Django
  • Python
  • Django migrations
  • GitHub Actions
  • PostgreSQL

Marketing site and blog

for a study-abroad and immigration consultancy
  • 3,173 lines · theme
  • 442 lines · SEO module
  • 0 plugins required

The constraint

WordPress on shared cPanel, a client who has to be able to edit every page themselves, and no build step available on the server.

The decision

No page builder, and no plugin for anything that matters. The SEO module, the Study Destinations post type and its fields are all first-party code, so the theme is the entire deliverable and there is nothing to keep in step with someone else’s release cycle.

The evidence

  • A self-contained SEO module of 442 lines: per-view titles and descriptions, canonical URLs, Open Graph and Twitter cards, JSON-LD for Organization, WebSite with SearchAction, BreadcrumbList and BlogPosting, sitemap and robots wiring, and an editable SEO box on every page. No SEO plugin.
  • The custom post type keeps its fields as native WordPress meta, so the site needs no custom-fields plugin either.
  • WordPress theme development
  • PHP
  • Docker

Corporate site rebuild

for a marine services company
  • 5,243 lines · theme and plugin
  • 1,834 lines · crew portal
  • 0 third-party API keys

The constraint

Shared cPanel with FTPS and nothing else — no SSH, no git on the host — and a members area where seafarers upload certificates that exist nowhere else.

The decision

Deployment adds and updates only. The script never touches the database or wp-content/uploads, so no deploy can destroy a document somebody uploaded, and the contact map is self-hosted so the site needs no third-party API key at all.

The evidence

  • A 74-line Node script uploads the theme and plugin over FTPS from a machine whose IP the host firewall allows. It adds and updates only, and never touches the database or wp-content/uploads.
  • The contact page map is self-hosted Leaflet with dark tiles, so the site needs no mapping API key and makes no third-party request for it.
  • WordPress theme development
  • PHP
  • Docker

2001 — present

Experience

  • 2022–present

    Independent Cloud & Systems Engineering Consultant

    Wellington, New Zealand

    • Design, build and operate cloud platforms end to end: infrastructure, application, delivery pipeline and deployment are all mine.
    • Replaced a client’s managed hosting with a self-run stack on ARM64 cloud infrastructure, including a 300 GB mail migration completed with no mailboxes lost.
    • Deliver under real platform constraints — shared hosting with no root or containers, blocked outbound SMTP, no persistent workers — and choose the architecture that survives them.
    • Own the CI that gates every deployment, so no change reaches a production server except by commit, push and pull.

  • 2022–present

    Able Seafarer (Deck)

    Coastal passenger ferry operations, New Zealand

    • Concurrent with consulting work, in a safety-critical regulated environment operating 24/7.
    • Procedure is followed without deviation, and operational and defect records are kept accurately to regulatory standard — the same discipline good change management asks for.

  • 2019–2022

    Systems Support Engineer

    Port Harcourt, Nigeria

    • Diagnosed, resolved and escalated hardware, software and network faults across a multi-site estate.
    • Administered Windows systems, user accounts and access controls across sites.

  • 2005–2018

    Systems Support Specialist

    Port Harcourt, Nigeria

    • A thirteen-year engagement supporting a diverse client base, including a media and entertainment group and a radio station.
    • Acted as trusted point of contact and technical advisor, translating business requirements into technical solutions.
    • Explained the impact and severity of issues to non-technical stakeholders, and recommended network improvements.
    • Managed shared hosting environments, domain configuration and web deployments.

  • 2003–2005

    Systems Support Technician

    Abuja, Nigeria

    • Led a team of seven technicians across concurrent client projects — assigning work, providing technical guidance and ensuring delivery to schedule.
    • Ran Windows Server and Active Directory environments: user accounts, group policy and network access controls.
    • Supported mixed Windows and macOS local area networks.
    • Delivered end-user training across varying levels of technical literacy.

  • 2001–2002

    Systems Technician

    Lagos, Nigeria

    LAN support and application training.

Each one links to where it was used

Capabilities

Cloud Platforms

Application & Web

Data & Storage

Networking & Security

IaC & CI/CD

Observability & Operations

Languages

Formal training

Education & certifications

  • Level 7 Diploma in Cloud Engineering 2026
  • AWS Solutions Architect – Associate (SAA-C03)
  • Simplilearn training certificates AWS Solutions Architect – Associate track, completed 2025
  • CCNA 2010
  • Diploma in Computer Engineering 2000

The same record, a different emphasis

Other versions of this profile

By email or phone

Contact

Open to technical architect and consulting roles.

david@ndueze.com +64 22 423 3173 github.com/DavidIfeanyichukwu