Stephan Lachnit has done great work to package REUSE for Debian .
This is the software we use for license compliance at DebOps. All
dependencies are currently in Debian unstable, but Stephan is still
looking for a sponsor  who can upload his reuse package. If you know
a Debian Developer who could help with this, please let me know.
I've attached a diff file for the debops.postldap role. It contains CipherMail-specific changes to the role defaults that more people might be interested in. What do you think? Should I make a PR for (some of) these changes?
The changes are:
- Use of mailRecipient object class where it makes sense, specifically in the ldap_virtual_alias_maps, ldap_virtual_mailbox_maps and ldap_smtpd_sender_login_maps configuration.
- Support for virtual alias lookups for group members. This allows us to make a distribution list out of an LDAP group. Postfix resolves the distribution list members using special_result_attribute and leaf_result_attribute.
- search_base of ldap_virtual_mailbox_maps.cf set to the base DN instead of ou=People. We did this because we also have mailboxes that are accessed by services whose LDAP accounts are under the ou=Hosts tree. An example is the system that uses IMAP to access messages in our support(a)ciphermail.com mailbox.
- The maildir paths are /var/vmail/<uid>/Maildir instead of /var/vmail/<domain>/<localpart>/Maildir. I like to associate mailboxes with the accounts in LDAP, which are primarily distinguished by uid and not email addresses.
- We are using mailAlternateAddress attributes (mailRecipient objectClass) instead of mailAlias objects. This allows us to add email aliases directly to the existing people and group objects. The filters have been updated for this.
- I have removed the ldap_unauth_sender_access sender restriction. This restriction forces SMTP clients to authenticate before sending mail when the sender address exists in LDAP. This is nice, but the ldap_unauth_domain_access sender restriction already forces authentication when an SMTP client tries to send mail from one of the domains in LDAP, which should be enough. Removing this restriction reduces the complexity of the whole system a little and saves some LDAP lookups.
- We're not using postldap__domain_rev_pattern.
Personal LDAP objects look like this:
cn: Imre Jonk
Group LDAP objects used as distribution lists look like this:
dn: cn=UNIX Administrators,ou=Groups,dc=ciphermail,dc=com
cn: UNIX Administrators
description: People responsible for UNIX-like infrastructure
Hoping this is useful for someone. It took me quite a while to figure out and explain in writing what customizations I've made to this role. It's been a while since I last touched the mail cluster configuration...