Senior Backend & Platform Engineer
Client engineering alongside building and operating a production Kubernetes platform end to end: the deploy path, the observability, the incidents and the pager. Coming out of three years in an on-premise shop, this is the operational half most backend roles never hand over, and it is what I bring into a team.
- Client engagement, Dance Fusion Aachen: built and shipped the event platforms for Bachata Sensual Congress Germany, 2025 and 2026 editions.
- Built the internal developer platform every service I run ships through: one shared Helm chart and an ArgoCD GitOps flow that takes a new service from repository to production with no hand-written infrastructure, across 8 Linux hosts on Hetzner provisioned with Terraform, a private registry and DNS-01 certificates.
- CI/CD on GitHub Actions gates every push on type checks, linting and a Gradle test suite (JUnit 5 and Testcontainers against real Postgres, Konsist architecture tests holding the hexagonal boundaries, Vitest and Playwright on the front) before a Docker image is built. Ships several times a week, rollback by reverting the commit.
- Built the observability under it (Prometheus, Grafana, Loki, Alertmanager) and tuned it against real false positives, including replication lag that had to move from timestamps to WAL byte distance because the timestamp version climbed forever on an idle cluster.
- Caught a 13-day silent TLS renewal failure with 17 days left on the certificate, then diagnosed why nothing had alerted: CDN-terminated TLS made the probes structurally blind, reporting 75 days while the origin had 17. Moved certificate truth to an origin-side collector.
- Built and run DanceClub (danceclub.app), a live events platform across 15 localized markets: Kotlin and Spring Boot over 10 isolated PostgreSQL schemas each with its own migration lane, PostGIS geo-search for viewport and radius queries, Kafka for event-driven communication, and four Next.js frontends.
- Built elvix (elvix.is), the OIDC identity service every application on that platform authenticates through: passwordless sign-in with email OTP, Google, GitHub and WebAuthn passkeys, RS256 JWTs with a JWKS endpoint so resource servers verify locally, OAuth 2.0 Device Grant for CLI logins, per-application roles and scopes, rate limiting and HMAC-signed webhooks. TypeScript on Prisma and PostgreSQL, SDK on public npm.
- Built PulseAI (pulseai.run), a self-hosted workflow automation engine in the n8n mould: multi-step pipelines with conditional branching, retries and traceable failure, driving that platform's own automation.
- Tuned the data layer for the patterns that actually run: PostGIS GIST indexes for viewport and radius search, partial and sort indexes across 70+ Flyway migrations, and connection-pool sizing worked out against the server's own limit rather than copied per service, which is what stops a service fleet opening 110 connections into a database that accepts 100.
