01 · Commerce + last-mile logistics · Mexico
One platform for the stores, the warehouse, the drivers and the books.
- Role
- Technical Lead (contract)
- Period
- Mar 2024 — present
- Engagement
- Remote contract
- Team
- Led up to 4 developers in 2024–25; a two-person team today
- Location
- Mexico City · from Lahore
- of 2,372 commits on the core backend
- ~2,300
- domain modules · ~535 API routes
- 26
- Terraform modules · AWS Mexico region
- 11
- ECS Fargate services, auto-rollback
- 4
- Celery tasks · 22 scheduled jobs
- 47
- automated backend tests
- 436
counted, not estimated · no client business metrics
JMA Logistika Urbana is a Mexican company that sells and delivers for several brands from one system. Customers buy on the Yoon Lab and Fleksi storefronts or in a physical store, wholesale buyers order through a B2B portal, drivers deliver, store staff sell at a counter, and the directors run the business from an admin dashboard.
All of it runs on one backend that I designed. Each brand is a portal on the same platform, with its own domain, payment merchant and email settings, and the same stock and order tables underneath.
When I joined in March 2024, the business ran on a template ERP: Django with server-rendered HTML pages and MySQL. It was fine for back-office screens, but it had no API that a storefront, native driver apps and a point of sale could all share.
Every new sales channel was turning into its own system, and every gap between systems was a reconciliation job that someone did by hand. The result was stock numbers that nobody trusted.
- 01from Mar 2024
An API-first rewrite on one data model
I started the Django REST backend on 8 March 2024, the day after the company's GitHub organisation was created. Inventory, orders, purchasing, finance, CRM, dispatch, POS, HR, support and analytics are separate modules over one PostgreSQL schema. A sale at a counter and a sale on the web are the same kind of event, and both move the same stock number.
- 26 Django apps, ~183 models, ~535 URL routes, ~113k lines of Python
- Multi-tenant portals: one Portal per brand (domain, merchant, email config), chosen per request
- Channels WebSockets for driver tracking, chat and live data sync
- 47 Celery tasks and 22 scheduled jobs on Redis
- 02
Infrastructure as code, in the AWS Mexico region
The whole production stack is Terraform: 11 modules in mx-central-1, with remote state in S3 and a DynamoDB lock. No production resource is created by hand.
- VPC across two availability zones: private subnets, NAT, VPC endpoints for S3, ECR, CloudWatch Logs and Secrets Manager
- ALB with ACM certificates, HTTP → HTTPS, WAFv2 rate limiting and AWS managed rule sets
- RDS PostgreSQL 16 Multi-AZ: encrypted, 30-day backups, deletion protection, Performance Insights
- ElastiCache Redis 7.1 and a VPC-only OpenSearch domain, both encrypted
- Secrets Manager injected into task definitions, separate execution and task IAM roles, GuardDuty
- 03Mar 2026
From docker-compose on EC2 to ECS Fargate
Until March 2026, production ran as docker-compose on EC2, deployed by a self-hosted runner and monitored with Prometheus, Grafana and Loki. On 11 March 2026 I moved it to ECS Fargate: four services, each with CPU-target autoscaling and a deployment circuit breaker that rolls back automatically.
- Django API (ASGI, 1 vCPU / 2 GB), autoscaling from 2 to 6 tasks at 70% CPU
- Celery worker (1–3 tasks) and Celery beat
- A self-hosted OSRM routing server (Mexico City extract) for distance-based driver assignment
- CloudWatch Container Insights and 7 alarms to SNS: ECS CPU and memory, ALB 5xx, latency over 2 s, RDS CPU, storage and connections
- 04
A deploy pipeline with no static keys
A push to the production branch runs a GitHub Actions pipeline that signs in to AWS with OIDC, so there are no long-lived access keys to leak. The steps are ordered so that a failed release stops before a customer sees it.
- Build once, push to ECR tagged with the commit SHA
- Run database migrations as a one-off Fargate task, and print its CloudWatch logs if it fails
- Recompute inventory and repopulate the OpenSearch index in place, so the catalogue is never empty
- Roll the API, worker and beat services, then wait until they are stable
- Finish with a read-only data check and a TLS-validated health check
- Every third-party Action pinned to a commit SHA; Dependabot and gitleaks on every push
- 052026
A security programme, not a checklist
In 2026 I led a security hardening programme and wrote the company's information security policy. The policy names me as technical lead for infrastructure controls, access grants and revocation, and incident triage.
- gitleaks as a pre-commit hook and as a CI gate
- All application secrets moved to AWS Secrets Manager
- Shipping labels, driver documents, delivery proofs, HR files and invoices moved to a private S3 bucket behind signed URLs
- Account anonymisation for Mexico's data-protection law (LFPDPPP) that keeps the records tax law requires (CFDI), run daily at 03:30
- 06
The integrations a Mexican retailer needs
Much of the real business logic sits at the edges: payments, tax invoices, shipping and marketplaces.
- Stripe with signed webhooks, wallet, refunds and a reconciliation job; Apple Pay and Google Pay
- SAT CFDI electronic invoicing through FacturAPI
- Envia shipping labels with webhook replay
- Twilio masked calls between driver and customer, SMS and OTP; Firebase push
- A marketplace sync framework for TikTok Shop, Amazon SP-API, Meta Catalog and Google Merchant Center: encrypted credentials, webhooks, stock sync every 15 minutes, order polling, token refresh, 201 tests
- Architecture and technical direction, which I set with the founder
- ~2,300 of 2,372 commits on the core backend, and 649 of 653 merged pull requests: I am the release gatekeeper
- Every commit that touches infrastructure, CI/CD, production builds and monitoring (109 of 109)
- Admin of the company's GitHub organisation since the day it was created (19 private repositories)
- Second-largest contributor to the React admin dashboard (405 of 990 commits)
- In 2024–25 I led up to four developers across the mobile apps, the POS and the admin. Today the team is two people: I lead, and one developer works with me. We deliver at this scale with AI coding agents (Claude Code), backed by tests, CI gates and review.
- This is a private client system. The code is not public and is not linked. Every number on this page is counted from the repositories, the Terraform and the git history; none of them are business metrics, which belong to the client.
- Production runs on ECS Fargate, not Kubernetes. My Kubernetes work (EKS, Helm, Argo CD) is in open-source reference builds.
- A reference from the company's founder is available on request.
Platform, DevOps or AI-platform role? Let's talk.
I build and run production systems on AWS, and I deploy and operate models in them. I'm looking for a senior platform, DevOps or AI-platform role, and I'm relocating to Japan in 2027. A résumé and references are available on request.
- Role
- Platform & AI Engineer · Technical Lead
- Location
- Lahore, Pakistan · Relocating to Tokyo · 2027
- Languages
- English (professional) · Urdu (native) · Japanese (beginner, studying daily)
- contact@codewithmuh.com