diff --git a/config/paludis/local-repo/metadata/categories.conf b/config/paludis/local-repo/metadata/categories.conf
new file mode 100644
index 0000000..8035cdf
--- /dev/null
+++ b/config/paludis/local-repo/metadata/categories.conf
@@ -0,0 +1,44 @@
+app-admin
+app-arch
+app-crypt
+app-ergonomics
+app-office
+dev-db
+dev-games
+dev-lang
+dev-libs
+dev-perl
+dev-python
+dev-tcl
+dev-util
+games-action
+games-arcade
+games-board
+games-emulation
+games-engines
+games-fps
+games-roguelike
+games-rpg
+games-server
+games-simulation
+games-strategy
+games-util
+mail-mta
+media-gfx
+media-libs
+media-sound
+media-video
+net-firewall
+net-im
+net-misc
+net-p2p
+net-www
+sci-mathematics
+sys-apps
+sys-process
+voip
+www-apps
+www-servers
+x11-misc
+x11-themes
+xfce-extra
diff --git a/config/paludis/local-repo/metadata/layout.conf b/config/paludis/local-repo/metadata/layout.conf
new file mode 100644
index 0000000..d8a553c
--- /dev/null
+++ b/config/paludis/local-repo/metadata/layout.conf
@@ -0,0 +1,5 @@
+layout = exheres
+eapi_when_unknown = exheres-0
+eapi_when_unspecified = exheres-0
+profile_eapi_when_unspecified = exheres-0
+masters = arbor
diff --git a/config/paludis/local-repo/packages/dev-perl/Mail-SPF/Mail-SPF-2.9.0.exheres-0 b/config/paludis/local-repo/packages/dev-perl/Mail-SPF/Mail-SPF-2.9.0.exheres-0
new file mode 100644
index 0000000..a971d81
--- /dev/null
+++ b/config/paludis/local-repo/packages/dev-perl/Mail-SPF/Mail-SPF-2.9.0.exheres-0
@@ -0,0 +1,41 @@
+# Copyright 2011 Dan Callaghan <djc@djc.id.au>
+# Distributed under the terms of the GNU General Public License v2
+
+MY_PNV=${PN}-v${PV}
+require perl-module [ module_author=JMEHNLE subdir=${PN,,} ]
+
+SUMMARY="A Perl implementation of Sender Policy Framework"
+DESCRIPTION="
+Mail::SPF is an object-oriented implementation of Sender Policy Framework (SPF). See
+http://www.openspf.org for more information about SPF.
+
+This class collection aims to fully conform to the SPF specification (RFC 4408) so as to serve both
+as a production quality SPF implementation and as a reference for other developers of SPF
+implementations.
+"
+
+LICENCES="BSD-3"
+SLOT="0"
+PLATFORMS="~amd64 ~x86"
+
+WORK="${WORKBASE}/${MY_PNV}"
+
+DEPENDENCIES="
+    build+run:
+        dev-perl/Error
+        dev-perl/Net-DNS[>=0.58]
+        dev-perl/NetAddr-IP[>=4]
+        dev-perl/URI[>=1.13]
+    test:
+        dev-perl/Net-DNS-Resolver-Programmable
+        dev-perl/Test-Pod
+"
+
+src_prepare() {
+    edo sed -i \
+            -e "s#/usr/sbin#/usr/$(exhost --target)/bin#" \
+            Build.PL
+
+    default
+}
+
diff --git a/config/paludis/local-repo/packages/mail-mta/postfix/files/postfix-3.1.3-libressl.patch b/config/paludis/local-repo/packages/mail-mta/postfix/files/postfix-3.1.3-libressl.patch
new file mode 100644
index 0000000..f5388b1
--- /dev/null
+++ b/config/paludis/local-repo/packages/mail-mta/postfix/files/postfix-3.1.3-libressl.patch
@@ -0,0 +1,117 @@
+Source: http://cvsweb.openbsd.org/cgi-bin/cvsweb/ports/mail/postfix/snapshot/patches/?hideattic=1#dirlist
+Upstream: no, upstream does not define a contribution workflow/platform
+Reason: fix compatibility with LibreSSL
+
+--- src/posttls-finger/posttls-finger.c.orig	Thu Sep  1 21:51:53 2016
++++ src/posttls-finger/posttls-finger.c	Thu Sep  1 21:54:23 2016
+@@ -1511,7 +1511,8 @@ static int finger(STATE *state)
+     return (0);
+ }
+ 
+-#if defined(USE_TLS) && OPENSSL_VERSION_NUMBER < 0x10100000L
++#if defined(USE_TLS) && \
++    ( OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) )
+ 
+ /* ssl_cleanup - free memory allocated in the OpenSSL library */
+ 
+@@ -1958,7 +1959,8 @@ int     main(int argc, char *argv[])
+     cleanup(&state);
+ 
+     /* OpenSSL 1.1.0 and later (de)initialization is implicit */
+-#if defined(USE_TLS) && OPENSSL_VERSION_NUMBER < 0x10100000L
++#if defined(USE_TLS) && \
++    ( OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) )
+     ssl_cleanup();
+ #endif
+ 
+--- src/tls/tls_client.c.orig	Thu Sep  1 21:53:17 2016
++++ src/tls/tls_client.c	Thu Sep  1 21:55:50 2016
+@@ -299,7 +299,7 @@ TLS_APPL_STATE *tls_client_init(const TLS_CLIENT_INIT_
+      */
+     tls_check_version();
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ 
+     /*
+      * Initialize the OpenSSL library by the book! To start with, we must
+@@ -441,7 +441,7 @@ TLS_APPL_STATE *tls_client_init(const TLS_CLIENT_INIT_
+     /*
+      * 2015-12-05: Ephemeral RSA removed from OpenSSL 1.1.0-dev
+      */
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ 
+     /*
+      * According to the OpenSSL documentation, temporary RSA key is needed
+--- src/tls/tls_dane.c.orig	Thu Sep  1 21:56:25 2016
++++ src/tls/tls_dane.c	Thu Sep  1 21:56:58 2016
+@@ -2163,7 +2163,7 @@ static SSL_CTX *ctx_init(const char *CAfile)
+     tls_param_init();
+     tls_check_version();
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+     SSL_load_error_strings();
+     SSL_library_init();
+ #endif
+--- src/tls/tls.h.orig	Sat Feb  6 15:09:41 2016
++++ src/tls/tls.h	Sun Feb 14 19:54:38 2016
+@@ -89,7 +89,7 @@ extern const char *str_tls_level(int);
+ #endif
+ 
+  /* Backwards compatibility with OpenSSL < 1.1.0 */
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ #define OpenSSL_version_num SSLeay
+ #define OpenSSL_version SSLeay_version
+ #define OPENSSL_VERSION SSLEAY_VERSION
+--- src/tls/tls_rsa.c.orig	Thu Sep  1 21:57:15 2016
++++ src/tls/tls_rsa.c	Thu Sep  1 21:58:11 2016
+@@ -57,7 +57,7 @@
+  /*
+   * 2015-12-05: Ephemeral RSA removed from OpenSSL 1.1.0-dev
+   */
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ 
+ /* tls_tmp_rsa_cb - call-back to generate ephemeral RSA key */
+ 
+@@ -109,7 +109,7 @@ int     main(int unused_argc, char *const argv[])
+     /*
+      * 2015-12-05: Ephemeral RSA removed from OpenSSL 1.1.0-dev
+      */
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+     RSA    *rsa;
+ 
+     msg_vstream_init(argv[0], VSTREAM_ERR);
+--- src/tls/tls_server.c.orig	Thu Sep  1 21:58:44 2016
++++ src/tls/tls_server.c	Thu Sep  1 21:59:40 2016
+@@ -174,7 +174,7 @@ static const char server_session_id_context[] = "Postf
+ #endif					/* OPENSSL_VERSION_NUMBER */
+ 
+  /* OpenSSL 1.1.0 bitrot */
+-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+ typedef const unsigned char *session_id_t;
+ 
+ #else
+@@ -377,7 +377,7 @@ TLS_APPL_STATE *tls_server_init(const TLS_SERVER_INIT_
+      */
+     tls_check_version();
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ 
+     /*
+      * Initialize the OpenSSL library by the book! To start with, we must
+@@ -588,7 +588,7 @@ TLS_APPL_STATE *tls_server_init(const TLS_SERVER_INIT_
+     /*
+      * 2015-12-05: Ephemeral RSA removed from OpenSSL 1.1.0-dev
+      */
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ 
+     /*
+      * According to OpenSSL documentation, a temporary RSA key is needed when
diff --git a/config/paludis/local-repo/packages/mail-mta/postfix/files/systemd/postfix.service b/config/paludis/local-repo/packages/mail-mta/postfix/files/systemd/postfix.service
new file mode 100644
index 0000000..012ad2a
--- /dev/null
+++ b/config/paludis/local-repo/packages/mail-mta/postfix/files/systemd/postfix.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=postfix
+After=network.target
+
+[Service]
+Type=forking
+ExecStart=/usr/host/bin/postfix start
+ExecStop=/usr/host/bin/postfix stop
+ExecReload=/usr/host/bin/postfix reload
+
+[Install]
+WantedBy=multi-user.target
diff --git a/config/paludis/local-repo/packages/mail-mta/postfix/postfix-2.11.7.exheres-0 b/config/paludis/local-repo/packages/mail-mta/postfix/postfix-2.11.7.exheres-0
new file mode 100644
index 0000000..6eb489e
--- /dev/null
+++ b/config/paludis/local-repo/packages/mail-mta/postfix/postfix-2.11.7.exheres-0
@@ -0,0 +1,7 @@
+# Copyright 2013 Johannes Nixdorf <mixi@exherbo.org>
+# Distributed under the terms of the GNU General Public License v2
+
+require postfix
+
+PLATFORMS="~amd64 ~x86"
+
diff --git a/config/paludis/local-repo/packages/mail-mta/postfix/postfix-3.1.3.exheres-0 b/config/paludis/local-repo/packages/mail-mta/postfix/postfix-3.1.3.exheres-0
new file mode 100644
index 0000000..d71424d
--- /dev/null
+++ b/config/paludis/local-repo/packages/mail-mta/postfix/postfix-3.1.3.exheres-0
@@ -0,0 +1,11 @@
+# Copyright 2015 Johannes Nixdorf <mixi@exherbo.org>
+# Distributed under the terms of the GNU General Public License v2
+
+require postfix
+
+PLATFORMS="~amd64 ~x86"
+
+DEFAULT_SRC_PREPARE_PATCHES=(
+    -p0 "${FILES}"/${PNV}-libressl.patch
+)
+
diff --git a/config/paludis/local-repo/packages/mail-mta/postfix/postfix.exlib b/config/paludis/local-repo/packages/mail-mta/postfix/postfix.exlib
new file mode 100644
index 0000000..12c764f
--- /dev/null
+++ b/config/paludis/local-repo/packages/mail-mta/postfix/postfix.exlib
@@ -0,0 +1,199 @@
+# Copyright 2008 Fernando J. Pereda
+# Copyright 2013-2015 Johannes Nixdorf <mixi@exherbo.org>
+# Distributed under the terms of the GNU General Public License v2
+# Based in part upon 'postfix-2.5.1.ebuild' from Gentoo, which is:
+#     Copyright 1999-2008 Gentoo Foundation
+
+export_exlib_phases src_prepare src_configure src_install
+
+require pam alternatives systemd-service
+
+SUMMARY="Fast, easy to administer and secure mail transport agent"
+HOMEPAGE="http://www.postfix.org"
+DOWNLOADS="ftp://ftp.porcupine.org/mirrors/postfix-release/official/${PNV}.tar.gz"
+
+REMOTE_IDS="freecode:${PN}"
+
+UPSTREAM_DOCUMENTATION="${HOMEPAGE}/documentation.html [[ lang = en ]]"
+UPSTREAM_RELEASE_NOTES="${HOMEPAGE}/announcements/${PNV}.html [[ lang = en ]]"
+
+LICENCES="IPL-1.0"
+SLOT="0"
+MYOPTIONS="
+    cyrus      [[ description = [ Support using Cyrus SASL for SASL support (SASL support using dovecot is built unconditionally) ] ]]
+    ldap       [[ description = [ Support using LDAP as source for postfix lookup tables (see ${HOMEPAGE}/DATABASE_README.html) ] ]]
+    mysql      [[ description = [ Support using a MySQL database as source for postfix lookup tables (see ${HOMEPAGE}/DATABASE_README.html) ] ]]
+    postgresql [[ description = [ Support using a PostgreSQL database as source for postfix lookup tables (see ${HOMEPAGE}/DATABASE_README.html) ] ]]
+    ssl        [[ description = [ Support making SSL connections to remote servers and clients ] ]]
+    ssl? ( ( providers: libressl openssl ) [[ number-selected = exactly-one ]] )
+"
+
+DEPENDENCIES="
+    build+run:
+        dev-libs/pcre
+        group/postdrop
+        group/postfix
+        sys-libs/db:=
+        sys-libs/pam
+        user/postfix
+        cyrus? ( net-libs/cyrus-sasl )
+        ldap? ( net-directory/openldap )
+        mysql? (
+            sys-libs/zlib
+            virtual/mysql
+        )
+        postgresql? ( dev-db/postgresql )
+        ssl? (
+            providers:libressl? ( dev-libs/libressl:= )
+            providers:openssl? ( dev-libs/openssl )
+        )
+    suggestion:
+        net-mail/dovecot [[ description = [ Used for SASL support without cyrus-sasl ] ]]
+"
+
+if ever at_least 3 ; then
+    DEPENDENCIES+="
+        build+run:
+            dev-libs/icu:=
+    "
+fi
+
+BUGS_TO="mixi@exherbo.org"
+
+postfix_src_prepare() {
+    # fix makedefs to allow default tool names to be overridden via env
+    edo sed \
+        -e 's/AR=ar/AR=${AR:-ar}/' \
+        -e 's/RANLIB=ranlib/RANLIB=${RANLIB:-ranlib}/' \
+        -i makedefs
+
+    default
+}
+
+postfix_src_configure() {
+    local makeopts=() auxlibs=( -pthread -ldb -lpam -lresolv )
+    # -DUSE_SASL_AUTH: this enables dovecot SASL and adds no additional build dependencies
+    # -DHAS_DB: this is already enabled in sys_defs.h for linux
+    local ccargs=(
+        -DDEF_COMMAND_DIR=\\\"/usr/$(exhost --target)/bin\\\"
+        -DDEF_DAEMON_DIR=\\\"/usr/$(exhost --target)/lib/postfix\\\"
+        -DDEF_SENDMAIL_PATH=\\\"/usr/$(exhost --target)/bin/sendmail\\\"
+        -DDEF_MANPAGE_DIR=\\\"/usr/share/man\\\"
+        -DDEF_README_DIR=\\\"/usr/share/doc/${PNVR}/readme\\\"
+        -DDEF_HTML_DIR=\\\"/usr/share/doc/${PNVR}/html\\\"
+        -DUSE_SASL_AUTH
+    )
+
+    if [[ $(exhost --target) == *-musl* ]]; then
+        # musl does not support NIS.
+        ccargs+=( -DNO_NIS )
+    else
+        auxlibs+=( -lnsl )
+    fi
+
+    if option ssl; then
+        ccargs+=( -DUSE_TLS )
+        auxlibs+=( -lssl -lcrypto )
+    fi
+
+    if option cyrus; then
+        ccargs+=( -DUSE_CYRUS_SASL -I/usr/$(exhost --target)/include/sasl )
+        auxlibs+=( -lsasl2 )
+    fi
+
+    if option ldap; then
+        ccargs+=( -DHAS_LDAP )
+
+        if ever at_least 3; then
+            makeopts+=( AUXLIBS_LDAP="-lldap -llber" )
+        else
+            auxlibs+=( -lldap -llber )
+        fi
+    fi
+
+    if option mysql; then
+        ccargs+=( -DHAS_MYSQL -I/usr/$(exhost --target)/include/mysql )
+
+        if ever at_least 3; then
+            makeopts+=( AUXLIBS_MYSQL="-L/usr/$(exhost --target)/lib/mysql/ -lmysqlclient -lz -lm" )
+        else
+            auxlibs+=( -L/usr/$(exhost --target)/lib/mysql/ -lmysqlclient -lz -lm )
+        fi
+    fi
+
+    if option postgresql; then
+        ccargs+=( -DHAS_PGSQL )
+        if ever at_least 3; then
+            makeopts+=( AUXLIBS_PGSQL="-lpq" )
+        else
+            auxlibs+=( -lpq )
+        fi
+    fi
+
+    if ever at_least 3; then
+        makeopts+=(
+            shared=yes
+            SHLIB_DIR=/usr/$(exhost --target)/lib/postfix
+        )
+    fi
+
+    export AR="${AR}" RANLIB="${RANLIB}"
+
+    emake \
+        CC="${CC}" \
+        OPT="${CFLAGS}" \
+        CCARGS="${ccargs[*]}" \
+        AUXLIBS="${auxlibs[*]}" \
+        "${makeopts[@]}" \
+        makefiles
+}
+
+postfix_src_install() {
+    LD_LIBRARY_PATH=${WORK}/lib:${LD_LIBRARY_PATH} \
+    edo /bin/sh postfix-install \
+        -non-interactive \
+        install_root="${IMAGE}" \
+        shlib_directory=/usr/$(exhost --target)/lib/postfix \
+        config_directory="/usr/share/doc/${PNVR}/defaults" \
+        readme_directory="/usr/share/doc/${PNVR}/readme"
+
+    edo mv "${IMAGE}"/usr/$(exhost --target)/bin/{,${PN}.}sendmail
+    edo rm "${IMAGE}"/usr/bin/{mailq,newaliases}
+    edo rmdir "${IMAGE}"/usr/bin
+
+    alternatives_for mta ${PN} 9 /usr/$(exhost --target)/bin/sendmail ${PN}.sendmail
+    alternatives_for mta ${PN} 9 /usr/$(exhost --target)/lib/sendmail ../bin/sendmail
+    alternatives_for mta ${PN} 9 /usr/$(exhost --target)/bin/mailq sendmail
+    alternatives_for mta ${PN} 9 /usr/$(exhost --target)/bin/newaliases sendmail
+
+    local manpage
+    for manpage in man1/{mailq.1,newaliases.1} man5/aliases.5; do
+        edo mv "${IMAGE}"/usr/share/man/${manpage%/*}/{,${PN}.}${manpage##*/}
+        alternatives_for mta ${PN} 9 /usr/share/man/${manpage} ${PN}.${manpage##*/}
+    done
+
+    keepdir /var/lib/postfix
+    edo chown -R postfix:postfix "${IMAGE}"/var/lib/postfix/
+
+    keepdir /var/spool/postfix
+    rmdir "${IMAGE}"/var/spool/postfix/*
+    edo chown root "${IMAGE}"/var/spool/postfix
+
+    edo chown root:postdrop "${IMAGE}"/usr/$(exhost --target)/bin/post{drop,queue}
+    edo chmod 2711 "${IMAGE}"/usr/$(exhost --target)/bin/post{drop,queue}
+
+    pamd_mimic_system smtp auth auth account
+
+    dodir /etc/postfix
+    insinto /etc/postfix
+    doins "${IMAGE}"/usr/share/doc/${PNVR}/defaults/{main,master}.cf
+    keepdir /etc/postfix/postfix-files.d
+
+    insinto /usr/share/doc/${PNVR}
+    doins -r "${WORK}"/examples
+
+    dosym /usr/share/doc/${PNVR} /usr/share/doc/${PN}
+
+    install_systemd_files
+}
+
diff --git a/config/paludis/local-repo/profiles/repo_name b/config/paludis/local-repo/profiles/repo_name
new file mode 100644
index 0000000..4083037
--- /dev/null
+++ b/config/paludis/local-repo/profiles/repo_name
@@ -0,0 +1 @@
+local
diff --git a/config/paludis/repositories/local.conf b/config/paludis/repositories/local.conf
new file mode 100644
index 0000000..132d291
--- /dev/null
+++ b/config/paludis/repositories/local.conf
@@ -0,0 +1,2 @@
+format = e
+location = /etc/paludis/local-repo