PRETORIA · GAUTENG

Sharif Sule Ndlovu

Software Developer · Cloud / DevOps Engineer

Sole infrastructure engineer on two live government platforms. Builds, releases and operates production Django systems on AWS.

Scroll to follow the request ↓

Rotate for a better experience

□ 01 · SYSTEMS

Systems

4 shipped · 2 live

e-PGLUM

Live · CoGHSTA · Django · Municipal Planning

Electronic Planning & Land-Use Management: land development and building-plan applications across jurisdictions. Live for CoGHSTA, Mpumalanga. Sole infrastructure engineer and, since go-live, sole maintainer.

DjangoPostgreSQLCeleryRedisAWS S3HTMXDocker

Infrastructure, deployment and monitoring: wrote and run the AWS environments across QA, UAT and Production
Configurable workflow engine: DB-modelled stage transitions via Django signals
Layered permissions: middleware-enforced, jurisdiction-scoped data isolation
Async document pipeline: Celery-queued S3 uploads, presigned retrieval
Migrated live infrastructure from AWS Copilot to standalone CloudFormation ahead of Copilot's June 2026 end of life

Build notes · 6 key challenges

96 government submission forms: Python mixins became a survival strategy. A new form type assembled from existing mixins in minutes rather than hours; same pattern applied to CBVs and models.
WAF production blocking: SizeRestrictions_BODY and XSS managed rules blocked legitimate requests that had passed in lower environments. Root cause: dev had no WAF. Fix: byte match exclusions per URI path + code tightening.
Large file uploads (20MB+): Tuned timeouts across the full stack: CloudFront origin timeout → ALB idle timeout → Gunicorn request timeout. Files failed silently until each layer was understood.
Sole-owner AWS environment: VPCs, security groups, RDS in a private subnet, ElastiCache, ECS Fargate, ALB, S3, Route 53, ACM. Every misconfiguration visible as a hard runtime failure.
Nightly stats pipeline: Post-deployment Celery Beat task aggregating submission counts, user activity, and stalled applications into a structured RabbitMQ payload for the middleman server.
Copilot CLI → CloudFormation: Started on AWS Copilot, then moved the live environments to standalone CloudFormation with reusable bash scripts when AWS announced Copilot end of life (June 2026).

Livi-Lemphakhatsi

Live · Django · Citizen Services

A multi-tenant citizen-services platform for the Office of the Premier, Mpumalanga. Ten departments on branded subdomains, routing cases to SLA-enforced resolution. Live in production. Sole infrastructure engineer.

DjangoPostGISCeleryAmazon MQCloudFormationTrivyRekognitionDocker

Infrastructure, deployment and monitoring: CloudFormation and GitHub Actions across dev, stage and production
Security-gated releases: pip-audit and a Trivy image scan must pass before an image can be pushed
Subdomain multi-tenancy: 10 departments, isolated auth, per-department theming
SLA engine: Celery Beat on Amazon MQ, auto-escalation on breach
Upload screening: every image, video and PDF checked with Rekognition before it is processed

Build notes · 8 key challenges

Architecture evaluation: Camunda, django-viewflow, n8n, and django-tenants formally evaluated and scrapped. Settled on a status-driven case model (NEW → IN_PROGRESS → RESOLVED) layered with Celery Beat SLA enforcement.
10 departments, 30 subdomains: One application, 10 distinct branded identities via DepartmentThemeMiddleware. Each of the 30 subdomains required precise database and DNS alignment.
SQS → RabbitMQ migration: Started with AWS SQS; migrated mid-project to AMQP (pika) when the mobile middleman owned a RabbitMQ broker. Payload schemas, idempotency keys and message audit logging rebuilt.
WAF parity from day one: QA configured at production WAF level from project start. Blocking issues caught during team testing, not post-deployment. Turnaround dropped from days to hours.
Security-gated releases: One release script builds the image, runs pip-audit and a Trivy scan for HIGH and CRITICAL findings, and refuses to push any image that has not passed.
Upload screening: Every image, video and PDF is screened with AWS Rekognition before processing; flagged files are rejected and deleted.
SSE realtime chat: Async Daphne views, Redis pub/sub, Last-Event-ID reconnect recovery, and a feature flag for zero-downtime rollout.
Health checks — 5 per group: DB, Redis, S3, migrations, Celery ping. One failing check = one unreachable dependency, identified immediately.

The Workplace Basics

2024–25 · Not launched · Django · Publishing & Commerce

A multi-module Django platform combining a public-sector blog, tiered subscriptions, a digital marketplace, and a newsletter system. Sole developer. The client cancelled before go-live; it became the groundwork for the government systems that followed.

DjangoPostgreSQLCeleryRedisAWS S3PaystackDocker

Paystack: recurring billing, one-time orders, signature-verified webhooks
Tiered access: free/premium gates with JWT-backed session tokens
AWS S3 media: presigned URLs, lifecycle policies, Pillow thumbnails
Celery + Redis async dispatch with Papertrail log aggregation

Build notes · 5 key challenges

Paystack webhook integration: Built the full payment lifecycle from first principles: charge.success, invoice.payment_failed, subscription.disable, expiring card notifications. First deep encounter with event-driven payment flows.
Docker container networking: Diagnosed the localhost trap inside Compose; learned bridge vs. host mode and service-name DNS resolution. Pattern carried into every project after.
UUID primary key migration: Raw SQL migration surgery on a live schema: add column, backfill rows, drop old PK constraint, promote UUID, update all foreign keys.
Django Channels + Redis async: Understood the sync/async boundary, the two-role Redis model (Channels layer vs. cache), and WebSocket consumer patterns.
WSGI vs. ASGI + first AWS: S3 for media (IAM, presigned URLs, storage backends), Gunicorn as the production server, and why Django's runserver is not one.

Community Web Modernization

Pro-bono · Static Web · Community

An annual pro-bono DevBridge programme replacing outdated, insecure sites for South African community organisations with fast static sites, with full source ownership handed over.

HTML / CSS / JSCloudflare PagesGitHub PagesCDN

Static architecture: no server runtime or database attack surface
Cloudflare edge: global CDN, automatic HTTPS, DDoS protection
Git-based push-to-live deployment workflow
Full institutional handover: no vendor lock-in

||| 02 · TOOLKIT

Toolkit

How many of the 9 builds use it

Most used

In most of my builds

Python8 / 9
Django / DRF7 / 9
Docker7 / 9
SQL (PostgreSQL / MySQL)6 / 9
Celery + RabbitMQ6 / 9
AWS4 / 9 · 22 SERVICES
CloudFormation3 / 9

Also in the toolkit

7 groups · in production, in the Lab and in study

Programming
JavaJavaScriptC# (.NET MVC)KotlinBash / Shell Scripting
Web & Backend
ASGI / WSGIPaystack APIBootstrap / HTML / CSSREST API design
Cloud & Infra
AzureGit / GitHub ActionsCI/CD PipelinesMulti-environment releases
Infrastructure as Code
TerraformBash automation
DevSecOps
Trivypip-auditAWS WAF
Monitoring & Ops
CloudWatchLog analysisProduction troubleshooting
Linux & Systems
Linux administrationServer hardeningSystem troubleshooting

AWS register

22 services in production

01EC2
Elastic compute for full-control server workloads.
02ECS Fargate
Serverless container orchestration, no servers to manage.
03Lambda
Event-driven serverless compute and scheduled jobs.
04ECR
Private container registry with image scanning.
05S3
Object storage for media, assets, versioned files.
06EFS
Elastic shared file storage across instances.
07RDS
Managed PostgreSQL — backups, patching, replicas.
08ElastiCache · Redis
In-memory caching, sessions, rate limiting.
09SQS
Managed queues for async task processing.
10SNS
Pub/sub fan-out across services, email, SMS.
11EventBridge
Serverless event bus for service routing.
12SES
Transactional email and system alerts.
13CloudFront
Global CDN delivering from edge locations.
14Route 53
Scalable DNS with health checks and routing.
15ACM
Managed TLS/SSL with auto-renewal.
16IAM
Least-privilege users, roles, and policies.
17KMS
Managed encryption keys, envelope encryption.
18Secrets Manager
Secure credential storage and rotation.
19SSM Parameter Store
Hierarchical config and environment params.
20Rekognition
Computer vision — moderation and label detection.
21CloudWatch
Metrics, logs, dashboards, and alarms.
22CloudFormation
Declarative infrastructure as code.

⌭ 03 · RECORD

Record

Education · certifications

Education

3 institutions

University of PretoriaJAN – JUN 2025
Short Course: Programming Languages, Artificial Intelligence
Varsity College (now Emeris)2021 – 2023
BSc Computer & Application Development
Abbotts CollegeCOMPLETED
High School: IT & Computer Science

Certifications

7 held

AWS Solutions Architect — AssociateAWS
AWS Developer — AssociateAWS
AWS Cloud PractitionerAWS
Azure Fundamentals (AZ-900)MICROSOFT
CompTIA Network+COMPTIA
CompTIA Project+COMPTIA
AI Skills Fest: Building AI AgentsMICROSOFT

› 04 · ROADMAP

Roadmap

◐ in progress · ○ planned

Staying current is part of the job. Each wire carries a certification I hold into the one that renews it; new credentials start fresh.

Terraform Associate◐ NOV – DEC 2026
New credential
Azure Administrator (AZ-104)◐ NOV – DEC 2026
New credential
AWS DevOps Engineer — Professional○ JAN – FEB 2027
Renews AWS Developer — Associate
AWS Solutions Architect — Professional○ MAR – APR 2027
Renews SA Associate + Cloud Practitioner
CompTIA Security+○ OCT – NOV 2027
Renews CompTIA Network+
AWS Security — Specialty○ 2028
New credential

Skill areas

Beyond the certs

Azure Fundamentals (AZ-900)✓ ACHIEVED
Core cloud concepts, Azure services, security, pricing, compliance.
Bash & Shell Scripting✓ ACHIEVED
Automating system tasks, build steps, and CI/CD pipelines.
Kubernetes & Helm○ 2027
Container orchestration and Kubernetes package management.
Prometheus, Grafana, Loki & OpenTelemetry○ 2027
Metrics, dashboards, log aggregation and distributed tracing.
Advanced DevSecOps○ 2027
Trivy IaC scanning, SAST, DAST and secret scanning.
Jenkins & advanced GitHub Actions○ 2027
Declarative CI/CD pipelines, build agents, deployment automation.
Reliability engineering○ 2027
SLIs, SLOs, error budgets and incident management.

△ 05 · LAB

Lab

5 builds in progress

EO Risk Platform

In development · Pilot build

Satellite-derived property-risk scoring, served as a REST API.

DjangoDRFPostGISSTAC

View project ↗

Heavy Fleet Platform

In development · In build

Live tracking and payload/fuel monitoring for mining fleets.

DjangoNext.jsPostGISTimescaleDB

View project ↗

NetPulse

In daily use · Self-hosted

My home network at a glance, self-hosted on a Raspberry Pi.

DjangoCeleryPostgreSQLRedis

Source on GitHub ↗

Siteward

In development · Open source

A self-hostable, passive web security scanner.

PythonDjangoDockerCloudflare

Source on GitHub ↗

Speedward

In development · Open source

How fast a site loads from around the world, on a map.

PythonDockerGlobalping CLI

Source on GitHub ↗

✉ 06 · CONTACT

Contact

Email sharifndlovu@gmail.com
GitHub sharifndlovu123
LinkedIn sharif-ndlovu
Knowledge Base knowledgebase.devbridge.co.za
DevBridge devbridge.co.za
Download CV · PDF
Technical portfolio · PDF, 10 pages