Muhammad Salehi

DevOps and infrastructure engineer who designs, builds and operates production systems on bare metal, virtualized and containerized platforms. Led infrastructure transformations from manual SSH deployments and single-VPS setups to automated GitLab CI/CD, Docker and Kubernetes delivery on privately managed, highly available infrastructure. Deep experience with high-availability MySQL (Percona XtraDB Cluster, ProxySQL, Keepalived), VMware vSphere, Linux, networking and security for fintech, cryptocurrency exchange and high-traffic platforms serving millions of requests per hour. Also a backend engineer and technical lead (Python, Django, Go) who has led full platform rewrites and live, zero-loss migrations of terabyte-scale data.

1. Full-timeApr 2020 – Sep 2026

   Lead DevOps Engineer

   Lendo, formerly Iran Renter (Fintech: Crowdfunding & Digital Lending)

   • Joined the fintech startup Iran Renter as a crowdfunding platform. After it was acquired by a bank, the company became the bank's digital lending contractor, delivering loans to consumers.
   • Grew the infrastructure from two VPS instances into privately owned, highly available production infrastructure with zero-downtime requirements and up to 100,000 concurrent users, through both the startup and post-acquisition phases.
   • Cut infrastructure costs by 70% in three ways: moving CDN delivery onto self-hosted infrastructure, replacing paid object storage with self-hosted MinIO S3, and right-sizing over-provisioned VMs based on measured average CPU and RAM usage per workload.
   • Migrated source control from GitHub to self-hosted GitLab and built GitLab CI/CD pipelines that automated build, test and deployment for every service. Put the platform behind a CDN to reduce its attack surface.
   • Procured, provisioned and colocated eight dedicated bare-metal servers. Built an OpenNebula private cloud running 60–70 VMs for databases, analytics, Metabase and internal department workloads.
   • Migrated the private cloud from OpenNebula to VMware vSphere and vCenter, using vMotion to live-migrate every workload with no downtime. Introduced Veeam Backup & Replication.
   • Ran offensive security testing against the company's own systems:
     • An authorized phishing simulation with RedProxy, a self-built man-in-the-middle red-team tool (github.com/salehi/RedProxy). It exposed staff credentials and led to company-wide security improvements.
     • An SMS-bombing test that used up the SMS budget in one hour and bypassed IP-based rate limits through public proxies.
   • Designed and built a request-signing security layer. The frontend and backend share a secret that is never transmitted, and every request carries a time-limited HMAC-style signature of its body. A middleware between HAProxy and the backend drops unsigned or expired requests before they reach the application. This stops bots and replay attacks without the CAPTCHAs or IP rate limits that block legitimate mobile users behind carrier CG-NAT.
   • Secured the perimeter and web applications with a FortiGate 100D firewall, a ModSecurity web application firewall (WAF) on Nginx, and MikroTik routing. Redesigned upstream connectivity to cut internet hops to end users.
   • Deployed a three-node Percona XtraDB Cluster (multi-writer MySQL) for high availability of financial data, with layered backups: VM-level Veeam backups plus encrypted, off-site, file-level replication of MinIO S3 object storage.
   • Built observability with Prometheus and Grafana metrics, Graylog centralized logging and Netdata host monitoring. Set up HAProxy and Nginx for load balancing and reverse proxying.
   • Advised the data team on analytics architecture, including ClickHouse, Kafka and Splunk data pipelines, and introduced Metabase for self-service BI.
   • Mentored two engineers to take over full operational ownership of the infrastructure, then handed it over to them.
2. ContractJul 2024 – Apr 2025

   Principal Engineer

   Pingi (Cryptocurrency Exchange)

   • Assembled and led a cross-functional team (backend, frontend and Android) to rewrite a cryptocurrency exchange that was split across two tangled, coexisting Django codebases (v2 and v3). Delivered a unified Django 4 platform (v4) covering the user, admin and system sides in four months.
   • Designed a modular architecture of independent domain services: authentication, trading, wallet and balance services, plus a blockchain wrapper service that monitors multiple cryptocurrency nodes over RPC. Followed Twelve-Factor App and Single Responsibility principles.
   • Cut the production database from 2 TB to 800 GB (60% smaller) and live-migrated all transaction data to the new v4 schema through Kafka, with no service interruption.
   • Brought every API endpoint under 400 ms (as fast as 10 ms) by finding bottlenecks with Sentry performance monitoring (APM) and fixing their root causes: Django ORM query optimization and annotations, and simplified business flows.
   • Turned a codebase nobody dared to change into clean, maintainable backend, frontend and Android code that junior developers and AI-assisted workflows can safely extend.
   • Built CI/CD pipelines and hardened production security, including firewall configuration and access controls.
3. ContractJan 2020 – Mar 2024

   Technical Consultant

   GAMA EdTech

   • Designed and deployed a five-node Percona XtraDB Cluster (Galera) in multi-writer mode for a write-heavy monolithic PHP platform serving millions of requests per hour.
   • Built a highly available database access layer with two ProxySQL instances and Keepalived, providing load balancing and automatic failover across all writable nodes.
   • Planned the placement of application, database and supporting services across bare-metal servers to minimize network round trips and end-to-end latency.
   • Led MySQL performance tuning and capacity planning for peak-period traffic, using Prometheus, Grafana and Netdata monitoring.
4. ContractOct 2021 – Dec 2022

   Backend Developer

   Bookapo

   • Co-led (team of two) a full rewrite of a legacy Joomla/PHP platform, which PHP developers had been unable to extend, into Django REST Framework (backend), Next.js (web frontend) and a new React Native mobile app for Android and iOS. Delivered in three months.
   • Designed a new relational schema and migrated 3 GB of production data with no data loss, validated through a dedicated month of end-to-end testing.
   • Kept the v1 API working during the transition through MySQL stored functions that rebuilt the legacy Joomla responses as JSON and were served through Django.
   • Added a time-series database to track user activity and reading time.
   • Built Persian full-text book search on Elasticsearch with the ParsiAnalyzer plugin.
   • Built the CI/CD pipelines. Deployed on Docker Compose, then migrated to Kubernetes.
5. ContractJan 2020 – Dec 2022

   DevOps Engineer

   AzPezeshk

   • Built the company's DevOps foundation from scratch: self-hosted GitLab, Sonatype Nexus artifact repository and GitLab CI/CD pipelines.
   • Containerized the microservices and automated deployments with Docker Compose across separate staging and production environments, behind Nginx and HAProxy with Prometheus, Grafana and Graylog monitoring.
   • Deployed WebRTC infrastructure with STUN/TURN servers for real-time audio and video.
6. Full-timeJan 2018 – Dec 2019

   DevOps Engineer

   Snappfood

   • Replaced manual SSH/git-pull and legacy Capistrano deployments with GitLab, GitLab CI/CD and Docker, and containerized the entire Snappfood application stack.
   • Automated Docker image builds and Docker Compose deployments across bare-metal production infrastructure.
   • Designed a per-branch preview environment system that deployed each team's feature branch to its own subdomain. This enabled the release flow: feature review to shared staging to CTO-approved production release, fully automated by pipelines.
   • Cut the developer test database from about 30 GB to about 1.5 GB (95% smaller) by removing obsolete tables and truncating unneeded data, which sped up onboarding and test environment setup.
   • Operated a five-node Percona XtraDB Cluster supporting production database workloads.
   • Tuned and operated Elasticsearch for Persian-language search using the ParsiAnalyzer plugin. Later took over the plugin, extended it and republished it as open source (see Projects).
   • Reduced single points of failure with HAProxy and Nginx load balancing, managed the CDN configuration, and built infrastructure and application monitoring with Prometheus, Grafana, Graylog and Netdata.