Sharif Sule Ndlovu

The Workplace Basics

A Django e-commerce and compliance training platform commissioned by a private client. The project was cancelled before launch — the client pivoted to a publishing model — but the work went deliberately beyond the requirements and became the technical foundation for every system that followed.

Key Challenges

• Paystack webhook integration — built the full payment lifecycle from first principles: charge.success, invoice.payment_failed, subscription.disable, expiring card notifications. First deep encounter with event-driven payment flows.
• Docker container networking — diagnosed the localhost trap inside Compose; learned bridge vs. host mode and service-name DNS resolution. Pattern carried into every project after.
• UUID primary key migration — raw SQL migration surgery on a live schema: add column, backfill rows, drop old PK constraint, promote UUID, update all foreign keys. First time writing PostgreSQL constraint syntax.
• Django Channels + Redis async — understood the sync/async boundary, the two-role Redis model (Channels layer vs. cache), and WebSocket consumer patterns through systematic study of Django by Example (editions 4 and 5).
• WSGI vs. ASGI + first AWS — S3 for media (IAM, presigned URLs, storage backends), Gunicorn as the production server, and why Django's runserver is not one.

e-PGLUM

Nationwide electronic land use management platform serving South African municipalities. I am the sole infrastructure engineer across three environments (QA, UAT, Production) — writing the infrastructure, running deployments and monitoring production — and contributed to a 96-form Django codebase in a team of 7. Since go-live I am the only person handling bug fixes and new features. Confirmed live by Thembisile Hani Local Municipality public notice, March 2026.

Key Challenges

• 96 government submission forms — Python mixins became a survival strategy. A new form type assembled from existing mixins in minutes rather than hours; same pattern applied to CBVs and models.
• WAF production blocking — SizeRestrictions_BODY and XSS managed rules blocked legitimate requests that had passed in lower environments. Root cause: dev had no WAF. Fix: byte match exclusions per URI path + code tightening.
• Large file uploads (20MB+) — tuned timeouts across the full stack: CloudFront origin timeout → ALB idle timeout → Gunicorn request timeout. Files failed silently until each layer was understood.
• Sole-owner AWS environment — VPCs, security groups, RDS in a private subnet, ElastiCache, ECS Fargate, ALB, S3, Route 53, ACM. Every misconfiguration visible as a hard runtime failure.
• Nightly stats pipeline — post-deployment Celery Beat task aggregating submission counts, user activity, and stalled applications into a structured RabbitMQ payload for the middleman server.
• Copilot CLI → CloudFormation — started on AWS Copilot, then moved the live environments to standalone CloudFormation with reusable bash scripts when AWS announced Copilot end of life (June 2026). OTP was rebuilt on CloudFormation scripts from the same pattern.

OTP — Livi Lemphakatsi

Multi-tier government case management system for the Office of the Premier, Mpumalanga. Citizens submit cases via mobile; 10 provincial departments handle them through a branded backoffice portal. Queue-driven architecture: OTP ↔ RabbitMQ middleman ↔ mobile app. I am the sole infrastructure engineer, owning the infrastructure, deployments and monitoring.

Key Challenges

• Architecture evaluation — Camunda, django-viewflow, n8n, and django-tenants formally evaluated and scrapped. Settled on a status-driven case model (NEW → IN_PROGRESS → RESOLVED) layered with Celery Beat SLA enforcement.
• 10 departments, 30 subdomains — one application, 10 distinct branded identities via DepartmentThemeMiddleware. Subdomains could not be wildcarded everywhere; each of the 30 required precise database and DNS alignment.
• SQS → RabbitMQ migration — started with AWS SQS; migrated mid-project to AMQP (pika) when it became clear the mobile middleman ran RabbitMQ and owned the broker. Queue payload schemas, idempotency keys, and message audit logging rebuilt for the new transport.
• WAF parity from day one — QA environment configured at production WAF level from project start. Blocking issues caught during team testing, not post-deployment. Turnaround dropped from days to hours.
• Security-gated releases — one release script builds the image, runs pip-audit on production dependencies and a Trivy scan for HIGH and CRITICAL findings, and refuses to push any image that has not passed. GitHub Actions calls the same script for dev, stage and production.
• Upload screening — every image, video and PDF is screened with AWS Rekognition before processing; flagged files are rejected and deleted. Videos are staged only briefly in an auto-expiring bucket and removed after analysis.
• SSE realtime chat — async Daphne views, Redis pub/sub, Last-Event-ID reconnect recovery, CASE_CHAT_REALTIME_ENABLED feature flag for zero-downtime rollout.
• Health checks — 5 per group — DB, Redis, S3, migrations, Celery ping. A cycling ECS task became a useful diagnostic: one failing check = one unreachable dependency, identified immediately.

Community Web Modernization

A DevBridge social programme providing modern, secure static websites to South African community organisations — estates, schools, churches, NGOs, sports clubs — at low or no cost. Production standards applied to community-scale problems: Cloudflare CDN, automatic HTTPS, DDoS protection, git-based deploy pipeline, full source ownership on handover.