Merge remote-tracking branch 'origin/master' into systemd-219

Conflicts:
	pkgs/development/libraries/libseccomp/default.nix

30 files changed, 549 insertions, 163 deletions

diff --git a/nixos/doc/manual/development/sources.xml b/nixos/doc/manual/development/sources.xml
index 3ac07da19f12..879a31e32c59 100644
--- a/nixos/doc/manual/development/sources.xml
+++ b/nixos/doc/manual/development/sources.xml
@@ -24,6 +24,9 @@ $ mkdir -p <replaceable>/my/sources</replaceable>
 $ cd <replaceable>/my/sources</replaceable>
 $ nix-env -i git
 $ git clone git://github.com/NixOS/nixpkgs.git
+$ cd nixpkgs
+$ git remote add channels git://github.com/NixOS/nixpkgs-channels.git
+$ git remote update channels
 </screen>
 
 This will check out the latest NixOS sources to
@@ -31,7 +34,12 @@ This will check out the latest NixOS sources to
 and the Nixpkgs sources to
 <filename><replaceable>/my/sources</replaceable>/nixpkgs</filename>.
 (The NixOS source tree lives in a subdirectory of the Nixpkgs
-repository.)</para>
+repository.) The remote <literal>channels</literal> refers to a
+read-only repository that tracks the Nixpkgs/NixOS channels (see <xref
+linkend="sec-upgrading"/> for more information about channels). Thus,
+the Git branch <literal>channels/nixos-14.12</literal> will contain
+the latest built and tested version available in the
+<literal>nixos-14.12</literal> channel.</para>
 
 <para>It’s often inconvenient to develop directly on the master
 branch, since if somebody has just committed (say) a change to GCC,
@@ -40,28 +48,32 @@ rebuild everything from source. So you may want to create a local
 branch based on your current NixOS version:
 
 <screen>
-$ <replaceable>/my/sources</replaceable>/nixpkgs/maintainers/scripts/update-channel-branches.sh
-Fetching channels from https://nixos.org/channels:
- * [new branch]      cbe467e           -> channels/remotes/nixos-unstable
-Fetching channels from nixos-version:
- * [new branch]      9ff4738           -> channels/current-system
-Fetching channels from ~/.nix-defexpr:
- * [new branch]      0d4acad           -> channels/root/nixos
-$ git checkout -b local channels/current-system
+$ nixos-version
+14.04.273.ea1952b (Baboon)
+
+$ git checkout -b local ea1952b
 </screen>
 
-Or, to base your local branch on the latest version available in the
+Or, to base your local branch on the latest version available in a
 NixOS channel:
 
 <screen>
-$ <replaceable>/my/sources</replaceable>/nixpkgs/maintainers/scripts/update-channel-branches.sh
-$ git checkout -b local channels/remotes/nixos-unstable
+$ git remote update channels
+$ git checkout -b local channels/nixos-14.12
+</screen>
+
+(Replace <literal>nixos-14.12</literal> with the name of the channel
+you want to use.) You can use <command>git merge</command> or
+<command>git rebase</command> to keep your local branch in sync with
+the channel, e.g.
+
+<screen>
+$ git remote update channels
+$ git merge channels/nixos-14.12
 </screen>
 
-You can then use <command>git rebase</command> to sync your local
-branch with the upstream branch, and use <command>git
-cherry-pick</command> to copy commits from your local branch to the
-upstream branch.</para>
+You can use <command>git cherry-pick</command> to copy commits from
+your local branch to the upstream branch.</para>
 
 <para>If you want to rebuild your system using your (modified)
 sources, you need to tell <command>nixos-rebuild</command> about them
diff --git a/nixos/doc/manual/development/writing-nixos-tests.xml b/nixos/doc/manual/development/writing-nixos-tests.xml
index bbb655eed2a6..b9da712b86f0 100644
--- a/nixos/doc/manual/development/writing-nixos-tests.xml
+++ b/nixos/doc/manual/development/writing-nixos-tests.xml
@@ -155,6 +155,15 @@ startAll;
   </varlistentry>
 
   <varlistentry>
+    <term><methodname>getScreenText</methodname></term>
+    <listitem><para>Return a textual representation of what is currently
+    visible on the machine's screen using optical character
+    recognition.</para>
+    <note><para>This requires passing <option>enableOCR</option> to the test
+    attribute set.</para></note></listitem>
+  </varlistentry>
+
+  <varlistentry>
     <term><methodname>sendMonitorCommand</methodname></term>
     <listitem><para>Send a command to the QEMU monitor. This is rarely
     used, but allows doing stuff such as attaching virtual USB disks
@@ -238,6 +247,15 @@ startAll;
   </varlistentry>
 
   <varlistentry>
+    <term><methodname>waitForText</methodname></term>
+    <listitem><para>Wait until the supplied regular expressions matches
+    the textual contents of the screen by using optical character recognition
+    (see <methodname>getScreenText</methodname>).</para>
+    <note><para>This requires passing <option>enableOCR</option> to the test
+    attribute set.</para></note></listitem>
+  </varlistentry>
+
+  <varlistentry>
     <term><methodname>waitForWindow</methodname></term>
     <listitem><para>Wait until an X11 window has appeared whose name
     matches the given regular expression, e.g.,
diff --git a/nixos/doc/manual/release-notes/rl-unstable.xml b/nixos/doc/manual/release-notes/rl-unstable.xml
index c4691aa663f4..755b4bf41541 100644
--- a/nixos/doc/manual/release-notes/rl-unstable.xml
+++ b/nixos/doc/manual/release-notes/rl-unstable.xml
@@ -17,6 +17,7 @@
 
 <itemizedlist>
 <listitem><para><literal>brltty</literal></para></listitem>
+<listitem><para><literal>marathon</literal></para></listitem>
 </itemizedlist>
 </para>
 
@@ -61,6 +62,15 @@ was accordingly renamed to <literal>bomi</literal>
   </para>
 </listitem>
 
+<listitem>
+  <para>
+    HPLIP (printer, scanner, and fax drivers for HP devices) has
+    been updated to version <literal>3.15.4</literal>. This release
+    adds support for the <literal>arm6l-linux</literal> and
+    <literal>arm7l-linux</literal> platforms.
+  </para>
+</listitem>
+
 
 </itemizedlist>
 </para>
diff --git a/nixos/lib/test-driver/Machine.pm b/nixos/lib/test-driver/Machine.pm
index e0791692d3ef..db2c1a68692a 100644
--- a/nixos/lib/test-driver/Machine.pm
+++ b/nixos/lib/test-driver/Machine.pm
@@ -9,6 +9,7 @@ use FileHandle;
 use Cwd;
 use File::Basename;
 use File::Path qw(make_path);
+use File::Slurp;
 
 
 my $showGraphics = defined $ENV{'DISPLAY'};
@@ -493,6 +494,44 @@ sub screenshot {
 }
 
 
+# Take a screenshot and return the result as text using optical character
+# recognition.
+sub getScreenText {
+    my ($self) = @_;
+
+    system("command -v tesseract &> /dev/null") == 0
+        or die "getScreenText used but enableOCR is false";
+
+    my $text;
+    $self->nest("performing optical character recognition", sub {
+        my $tmpbase = Cwd::abs_path(".")."/ocr";
+        my $tmpin = $tmpbase."in.ppm";
+        my $tmpout = "$tmpbase.ppm";
+
+        $self->sendMonitorCommand("screendump $tmpin");
+        system("ppmtopgm $tmpin | pamscale 4 -filter=lanczos > $tmpout") == 0
+            or die "cannot scale screenshot";
+        unlink $tmpin;
+        system("tesseract $tmpout $tmpbase") == 0 or die "OCR failed";
+        unlink $tmpout;
+        $text = read_file("$tmpbase.txt");
+        unlink "$tmpbase.txt";
+    });
+    return $text;
+}
+
+
+# Wait until a specific regexp matches the textual contents of the screen.
+sub waitForText {
+    my ($self, $regexp) = @_;
+    $self->nest("waiting for $regexp to appear on the screen", sub {
+        retry sub {
+            return 1 if $self->getScreenText =~ /$regexp/;
+        }
+    });
+}
+
+
 # Wait until it is possible to connect to the X server.  Note that
 # testing the existence of /tmp/.X11-unix/X0 is insufficient.
 sub waitForX {
diff --git a/nixos/lib/testing.nix b/nixos/lib/testing.nix
index c14f15a1ad5d..ee254ae187fd 100644
--- a/nixos/lib/testing.nix
+++ b/nixos/lib/testing.nix
@@ -28,7 +28,7 @@ rec {
 
         wrapProgram $out/bin/nixos-test-driver \
           --prefix PATH : "${qemu_kvm}/bin:${vde2}/bin:${netpbm}/bin:${coreutils}/bin" \
-          --prefix PERL5LIB : "${lib.makePerlPath [ perlPackages.TermReadLineGnu perlPackages.XMLWriter perlPackages.IOTty ]}:$out/lib/perl5/site_perl"
+          --prefix PERL5LIB : "${with perlPackages; lib.makePerlPath [ TermReadLineGnu XMLWriter IOTty FileSlurp ]}:$out/lib/perl5/site_perl"
       '';
   };
 
@@ -68,7 +68,12 @@ rec {
 
 
   makeTest =
-    { testScript, makeCoverageReport ? false, name ? "unnamed", ... } @ t:
+    { testScript
+    , makeCoverageReport ? false
+    , enableOCR ? false
+    , name ? "unnamed"
+    , ...
+    } @ t:
 
     let
       testDriverName = "nixos-test-driver-${name}";
@@ -86,6 +91,8 @@ rec {
 
       vms = map (m: m.config.system.build.vm) (lib.attrValues nodes);
 
+      ocrProg = tesseract.override { enableLanguages = [ "eng" ]; };
+
       # Generate onvenience wrappers for running the test driver
       # interactively with the specified network, and for starting the
       # VMs from the command line.
@@ -102,12 +109,14 @@ rec {
           vms="$(for i in ${toString vms}; do echo $i/bin/run-*-vm; done)"
           wrapProgram $out/bin/nixos-test-driver \
             --add-flags "$vms" \
+            ${lib.optionalString enableOCR "--prefix PATH : '${ocrProg}/bin'"} \
             --run "testScript=\"\$(cat $out/test-script)\"" \
             --set testScript '"$testScript"' \
             --set VLANS '"${toString vlans}"'
           ln -s ${testDriver}/bin/nixos-test-driver $out/bin/nixos-run-vms
           wrapProgram $out/bin/nixos-run-vms \
             --add-flags "$vms" \
+            ${lib.optionalString enableOCR "--prefix PATH : '${ocrProg}/bin'"} \
             --set tests '"startAll; joinAll;"' \
             --set VLANS '"${toString vlans}"' \
             ${lib.optionalString (builtins.length vms == 1) "--set USE_SERIAL 1"}
diff --git a/nixos/modules/installer/tools/nixos-checkout.nix b/nixos/modules/installer/tools/nixos-checkout.nix
index 3338e5119acb..9cdd8a74a188 100644
--- a/nixos/modules/installer/tools/nixos-checkout.nix
+++ b/nixos/modules/installer/tools/nixos-checkout.nix
@@ -1,5 +1,5 @@
-# This module generates the nixos-checkout script, which replaces the
-# Nixpkgs source trees in /etc/nixos/nixpkgs with a Git checkout.
+# This module generates the nixos-checkout script, which performs a
+# checkout of the Nixpkgs Git repository.
 
 { config, lib, pkgs, ... }:
 
@@ -37,8 +37,19 @@ let
             mv nixpkgs nixpkgs-$backupTimestamp
         fi
 
-        # Check out the NixOS and Nixpkgs sources.
-        git clone git://github.com/NixOS/nixpkgs.git nixpkgs
+        # Check out the Nixpkgs sources.
+        if ! [ -e nixpkgs/.git ]; then
+            echo "Creating repository in $prefix/nixpkgs..."
+            git init --quiet nixpkgs
+        else
+            echo "Updating repository in $prefix/nixpkgs..."
+        fi
+        cd nixpkgs
+        git remote add origin git://github.com/NixOS/nixpkgs.git || true
+        git remote add channels git://github.com/NixOS/nixpkgs-channels.git || true
+        git remote set-url origin --push git@github.com:NixOS/nixpkgs.git
+        git remote update
+        git checkout master
       '';
    };
 
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 0039ca74ba85..cc1976e236bd 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -196,7 +196,6 @@
       nylon = 168;
       apache-kafka = 169;
       panamax = 170;
-      marathon = 171;
       exim = 172;
       #fleet = 173; # unused
       #input = 174; # unused
@@ -217,6 +216,7 @@
       lambdabot = 191;
       asterisk = 192;
       plex = 193;
+      bird = 195;
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
@@ -390,7 +390,6 @@
       gitlab = 165;
       nylon = 168;
       panamax = 170;
-      #marathon = 171; # unused
       exim = 172;
       fleet = 173;
       input = 174;
@@ -412,6 +411,7 @@
       #asterisk = 192; # unused
       plex = 193;
       sabnzbd = 194;
+      bird = 195;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index e869b350e716..bef3f7f2fe73 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -62,6 +62,7 @@
   ./programs/environment.nix
   ./programs/info.nix
   ./programs/ibus.nix
+  ./programs/kbdlight.nix
   ./programs/light.nix
   ./programs/nano.nix
   ./programs/screen.nix
@@ -251,6 +252,7 @@
   ./services/networking/atftpd.nix
   ./services/networking/avahi-daemon.nix
   ./services/networking/bind.nix
+  ./services/networking/bird.nix
   ./services/networking/bitlbee.nix
   ./services/networking/btsync.nix
   ./services/networking/charybdis.nix
@@ -289,6 +291,7 @@
   ./services/networking/nat.nix
   ./services/networking/networkmanager.nix
   ./services/networking/ngircd.nix
+  ./services/networking/nix-serve.nix
   ./services/networking/notbit.nix
   ./services/networking/nsd.nix
   ./services/networking/ntopng.nix
@@ -461,5 +464,6 @@
   ./virtualisation/openvswitch.nix
   ./virtualisation/parallels-guest.nix
   ./virtualisation/virtualbox-guest.nix
+  ./virtualisation/vmware-guest.nix
   ./virtualisation/xen-dom0.nix
 ]
diff --git a/nixos/modules/programs/kbdlight.nix b/nixos/modules/programs/kbdlight.nix
new file mode 100644
index 000000000000..0172368e968f
--- /dev/null
+++ b/nixos/modules/programs/kbdlight.nix
@@ -0,0 +1,16 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.kbdlight;
+
+in
+{
+  options.programs.kbdlight.enable = mkEnableOption "kbdlight";
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.kbdlight ];
+    security.setuidPrograms = [ "kbdlight" ];
+  };
+}
diff --git a/nixos/modules/services/backup/postgresql-backup.nix b/nixos/modules/services/backup/postgresql-backup.nix
index 1f7b123eca37..4a5ebebc682e 100644
--- a/nixos/modules/services/backup/postgresql-backup.nix
+++ b/nixos/modules/services/backup/postgresql-backup.nix
@@ -3,13 +3,13 @@
 with lib;
 
 let
-  inherit (pkgs) postgresql gzip;
+  inherit (pkgs) gzip;
 
-  location = config.services.postgresqlBackup.location ;
+  location = config.services.postgresqlBackup.location;
 
   postgresqlBackupCron = db:
     ''
-      ${config.services.postgresqlBackup.period} root ${postgresql}/bin/pg_dump ${db} | ${gzip}/bin/gzip -c > ${location}/${db}.gz
+      ${config.services.postgresqlBackup.period} root ${config.services.postgresql.package}/bin/pg_dump ${db} | ${gzip}/bin/gzip -c > ${location}/${db}.gz
     '';
 
 in
diff --git a/nixos/modules/services/networking/bird.nix b/nixos/modules/services/networking/bird.nix
new file mode 100644
index 000000000000..e7e1db191529
--- /dev/null
+++ b/nixos/modules/services/networking/bird.nix
@@ -0,0 +1,76 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib) mkEnableOption mkIf mkOption singleton types;
+  inherit (pkgs) bird;
+  cfg = config.services.bird;
+
+  configFile = pkgs.writeText "bird.conf" ''
+    ${cfg.config}
+  '';
+in
+
+{
+
+  ###### interface
+
+  options = {
+
+    services.bird = {
+
+      enable = mkEnableOption "BIRD Internet Routing Daemon";
+
+      config = mkOption {
+        type = types.string;
+        description = ''
+          BIRD Internet Routing Daemon configuration file.
+          <link xlink:href='http://bird.network.cz/'/>
+        '';
+      };
+
+      user = mkOption {
+        type = types.string;
+        default = "ircd";
+        description = ''
+          BIRD Internet Routing Daemon user.
+        '';
+      };
+
+      group = mkOption {
+        type = types.string;
+        default = "ircd";
+        description = ''
+          BIRD Internet Routing Daemon group.
+        '';
+      };
+
+    };
+
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+
+    users.extraUsers = singleton {
+      name = cfg.user;
+      description = "BIRD Internet Routing Daemon user";
+      uid = config.ids.uids.bird;
+      group = cfg.group;
+    };
+
+    users.extraGroups = singleton {
+      name = cfg.group;
+      gid = config.ids.gids.bird;
+    };
+
+    systemd.services.bird = {
+      description = "BIRD Internet Routing Daemon";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart   = "${bird}/bin/bird -d -c ${configFile} -s /var/run/bird.ctl -u ${cfg.user} -g ${cfg.group}";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/consul.nix b/nixos/modules/services/networking/consul.nix
index 5308fd995085..53a9f4626254 100644
--- a/nixos/modules/services/networking/consul.nix
+++ b/nixos/modules/services/networking/consul.nix
@@ -6,11 +6,9 @@ let
   dataDir = "/var/lib/consul";
   cfg = config.services.consul;
 
-  configOptions = {
-    data_dir = dataDir;
-  }
-  // (if cfg.webUi then { ui_dir = "${pkgs.consul.ui}"; } else { })
-  // cfg.extraConfig;
+  configOptions = { data_dir = dataDir; } //
+    (if cfg.webUi then { ui_dir = "${pkgs.consul.ui}"; } else { }) //
+    cfg.extraConfig;
 
   configFiles = [ "/etc/consul.json" "/etc/consul-addrs.json" ]
     ++ cfg.extraConfigFiles;
@@ -52,23 +50,6 @@ in
         '';
       };
 
-      joinNodes = mkOption {
-        type = types.listOf types.str;
-        default = [ ];
-        description = ''
-          A list of addresses of nodes which should be joined at startup if the
-          current node is in a left state.
-        '';
-      };
-
-      joinRetries = mkOption {
-        type = types.int;
-        default = 10;
-        description = ''
-          The number of times to retry connecting to the join nodes.
-        '';
-      };
-
       interface = {
 
         advertise = mkOption {
@@ -159,10 +140,14 @@ in
     users.extraUsers."consul" = {
       description = "Consul agent daemon user";
       uid = config.ids.uids.consul;
+      # The shell is needed for health checks
+      shell = "/run/current-system/sw/bin/bash";
     };
 
     environment = {
       etc."consul.json".text = builtins.toJSON configOptions;
+      # We need consul.d to exist for consul to start
+      etc."consul.d/dummy.json".text = "{ }";
       systemPackages = with pkgs; [ consul ];
     };
 
@@ -170,10 +155,12 @@ in
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ] ++ systemdDevices;
       bindsTo = systemdDevices;
-      restartTriggers = [ config.environment.etc."consul.json".source ];
+      restartTriggers = [ config.environment.etc."consul.json".source ]
+        ++ mapAttrsToList (_: d: d.source)
+          (filterAttrs (n: _: hasPrefix "consul.d/" n) config.environment.etc);
 
       serviceConfig = {
-        ExecStart = "@${pkgs.consul}/bin/consul consul agent"
+        ExecStart = "@${pkgs.consul}/bin/consul consul agent -config-dir /etc/consul.d"
           + concatMapStrings (n: " -config-file ${n}") configFiles;
         ExecReload = "${pkgs.consul}/bin/consul reload";
         PermissionsStartOnly = true;
@@ -219,18 +206,6 @@ in
       + ''
         echo "}" >> /etc/consul-addrs.json
       '';
-      postStart = ''
-        # Issues joins to nodes which we statically connect to
-        ${flip concatMapStrings cfg.joinNodes (addr: ''
-          for i in {0..${toString cfg.joinRetries}}; do
-            # Try to join the other nodes ${toString cfg.joinRetries} times before failing
-            consul join "${addr}" && break
-            sleep 1
-          done &
-        '')}
-        wait
-        exit 0
-      '';
     };
 
     systemd.services.consul-alerts = mkIf (cfg.alerts.enable) {
diff --git a/nixos/modules/services/networking/nix-serve.nix b/nixos/modules/services/networking/nix-serve.nix
new file mode 100644
index 000000000000..c2c579c3177e
--- /dev/null
+++ b/nixos/modules/services/networking/nix-serve.nix
@@ -0,0 +1,56 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.nix-serve;
+in
+{
+  options = {
+    services.nix-serve = {
+      enable = mkEnableOption "nix-serve, the standalone Nix binary cache server";
+
+      port = mkOption {
+        type = types.int;
+        default = 5000;
+        description = ''
+          Port number where nix-serve will listen on.
+        '';
+      };
+
+      bindAddress = mkOption {
+        type = types.string;
+        default = "0.0.0.0";
+        description = ''
+          IP address where nix-serve will bind its listening socket.
+        '';
+      };
+
+      extraParams = mkOption {
+        type = types.string;
+        default = "";
+        description = ''
+          Extra command line parameters for nix-serve.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.nix-serve = {
+      description = "nix-serve binary cache server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      path = [ config.nix.package pkgs.bzip2 ];
+      environment.NIX_REMOTE = "daemon";
+
+      serviceConfig = {
+        ExecStart = "${pkgs.nix-serve}/bin/nix-serve " +
+          "--port ${cfg.bindAddress}:${toString cfg.port} ${cfg.extraParams}";
+        User = "nobody";
+        Group = "nogroup";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index c25532511a07..6cc86b4e4b5a 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -282,8 +282,8 @@ in
   config = mkIf cfg.enable {
 
     users.extraUsers.sshd =
-      { description = "SSH privilege separation user";
-        home = "/var/empty";
+      { isSystemUser = true;
+        description = "SSH privilege separation user";
       };
 
     environment.etc = authKeysFiles ++ [
diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix
index f9ca796ea652..2d43c3d962dd 100644
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@@ -154,6 +154,7 @@ in
     users.extraUsers = flip mapAttrs' cfg.networks (network: _:
       nameValuePair ("tinc.${network}") ({
         description = "Tinc daemon user for ${network}";
+        isSystemUser = true;
       })
     );
 
diff --git a/nixos/modules/services/scheduling/marathon.nix b/nixos/modules/services/scheduling/marathon.nix
index 8513d1174c38..ab93334f5fc9 100644
--- a/nixos/modules/services/scheduling/marathon.nix
+++ b/nixos/modules/services/scheduling/marathon.nix
@@ -12,27 +12,56 @@ in {
 
   options.services.marathon = {
     enable = mkOption {
-      description = "Whether to enable the marathon mesos framework.";
-      default = false;
       type = types.uniq types.bool;
+      default = false;
+      description = ''
+	Whether to enable the marathon mesos framework.
+      '';
     };
 
     httpPort = mkOption {
-      description = "Marathon listening port";
-      default = 8080;
       type = types.int;
+      default = 8080;
+      description = ''
+	Marathon listening port for HTTP connections.
+      '';
     };
 
     master = mkOption {
-      description = "Marathon mesos master zookeeper address";
-      default = "zk://${head cfg.zookeeperHosts}/mesos";
       type = types.str;
+      default = "zk://${concatStringsSep "," cfg.zookeeperHosts}/mesos";
+      example = "zk://1.2.3.4:2181,2.3.4.5:2181,3.4.5.6:2181/mesos";
+      description = ''
+	Mesos master address. See <link xlink:href="https://mesosphere.github.io/marathon/docs/"/> for details.
+      '';
     };
 
     zookeeperHosts = mkOption {
-      description = "Marathon mesos zookepper addresses";
+      type = types.listOf types.str;
       default = [ "localhost:2181" ];
+      example = [ "1.2.3.4:2181" "2.3.4.5:2181" "3.4.5.6:2181" ];
+      description = ''
+	ZooKeeper hosts' addresses.
+      '';
+    };
+
+    extraCmdLineOptions = mkOption {
       type = types.listOf types.str;
+      default = [ ];
+      example = [ "--https_port=8443" "--zk_timeout=10000" "--marathon_store_timeout=2000" ];
+      description = ''
+	Extra command line options to pass to Marathon.
+	See <link xlink:href="https://mesosphere.github.io/marathon/docs/command-line-flags.html"/> for all possible flags.
+      '';
+    };
+
+    environment = mkOption {
+      default = { };
+      type = types.attrs;
+      example = { JAVA_OPTS = "-Xmx512m"; MESOSPHERE_HTTP_CREDENTIALS = "username:password"; };
+      description = ''
+	Environment variables passed to Marathon.
+      '';
     };
   };
 
@@ -41,17 +70,19 @@ in {
   config = mkIf cfg.enable {
     systemd.services.marathon = {
       description = "Marathon Service";
+      environment = cfg.environment;
       wantedBy = [ "multi-user.target" ];
       after = [ "network-interfaces.target" "zookeeper.service" "mesos-master.service" "mesos-slave.service" ];
 
       serviceConfig = {
-        ExecStart = "${pkgs.marathon}/bin/marathon --master ${cfg.master} --zk zk://${head cfg.zookeeperHosts}/marathon";
+        ExecStart = "${pkgs.marathon}/bin/marathon --master ${cfg.master} --zk zk://${concatStringsSep "," cfg.zookeeperHosts}/marathon --http_port ${toString cfg.httpPort} ${concatStringsSep " " cfg.extraCmdLineOptions}";
         User = "marathon";
+        Restart = "always";
+        RestartSec = "2";
       };
     };
 
     users.extraUsers.marathon = {
-      uid = config.ids.uids.marathon;
       description = "Marathon mesos framework user";
     };
   };
diff --git a/nixos/modules/services/system/nscd.nix b/nixos/modules/services/system/nscd.nix
index caedc2e42173..3c0d2043ed5d 100644
--- a/nixos/modules/services/system/nscd.nix
+++ b/nixos/modules/services/system/nscd.nix
@@ -42,7 +42,10 @@ in
 
   config = mkIf cfg.enable {
 
-    users.extraUsers.nscd.description = "Name service cache daemon user";
+    users.extraUsers.nscd =
+      { isSystemUser = true;
+        description = "Name service cache daemon user";
+      };
 
     systemd.services.nscd =
       { description = "Name Service Cache Daemon";
diff --git a/nixos/modules/services/x11/desktop-managers/gnome3.nix b/nixos/modules/services/x11/desktop-managers/gnome3.nix
index d53f119c9558..cf6d2cab3492 100644
--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@@ -45,7 +45,7 @@ in {
 
     environment.gnome3.packageSet = mkOption {
       default = null;
-      example = literalExample "pkgs.gnome3_12";
+      example = literalExample "pkgs.gnome3_16";
       description = "Which GNOME 3 package set to use.";
       apply = p: if p == null then pkgs.gnome3 else p;
     };
@@ -109,9 +109,6 @@ in {
           # Override default mimeapps
           export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${mimeAppsList}/share
 
-          # Let gnome-control-center find gnome-shell search providers. GNOME 3.12 compatibility.
-          export GNOME_SEARCH_PROVIDERS_DIR=${config.system.path}/share/gnome-shell/search-providers/
-
           # Let nautilus find extensions
           export NAUTILUS_EXTENSION_DIR=${config.system.path}/lib/nautilus/extensions-3.0/
 
diff --git a/nixos/modules/services/x11/display-managers/lightdm.nix b/nixos/modules/services/x11/display-managers/lightdm.nix
index 4aeaed8cd324..f6de8c02b186 100644
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@@ -65,7 +65,7 @@ let
       greeters-directory = ${cfg.greeter.package}
       sessions-directory = ${dmcfg.session.desktops}
 
-      [SeatDefaults]
+      [Seat:*]
       xserver-command = ${xserverWrapper}
       session-wrapper = ${dmcfg.session.script}
       greeter-session = ${cfg.greeter.name}
@@ -143,8 +143,26 @@ in
     services.dbus.enable = true;
     services.dbus.packages = [ lightdm ];
 
-    security.pam.services.lightdm = { allowNullPassword = true; startSession = true; };
-    security.pam.services.lightdm-greeter = { allowNullPassword = true; startSession = true; };
+    security.pam.services.lightdm = {
+      allowNullPassword = true;
+      startSession = true;
+    };
+    security.pam.services.lightdm-greeter = {
+      allowNullPassword = true;
+      startSession = true;
+      text = ''
+        auth     required pam_env.so
+        auth     required pam_permit.so
+
+        account  required pam_permit.so
+
+        password required pam_deny.so
+
+        session  required pam_env.so envfile=${config.system.build.pamEnvironment}
+        session  required pam_unix.so
+        session  optional ${pkgs.systemd}/lib/security/pam_systemd.so
+      '';
+    };
 
     users.extraUsers.lightdm = {
       createHome = true;
diff --git a/nixos/modules/virtualisation/azure-common.nix b/nixos/modules/virtualisation/azure-common.nix
new file mode 100644
index 000000000000..47022c6887c3
--- /dev/null
+++ b/nixos/modules/virtualisation/azure-common.nix
@@ -0,0 +1,61 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+{
+  imports = [ ../profiles/headless.nix ];
+
+  boot.kernelParams = [ "console=ttyS0" "earlyprintk=ttyS0" "rootdelay=300" "panic=1" "boot.panic_on_fail" ];
+  boot.initrd.kernelModules = [ "hv_vmbus" "hv_netvsc" "hv_utils" "hv_storvsc" ];
+
+  # Generate a GRUB menu. 
+  boot.loader.grub.device = "/dev/sda";
+  boot.loader.grub.version = 2;
+  boot.loader.grub.timeout = 0;
+
+  # Don't put old configurations in the GRUB menu.  The user has no
+  # way to select them anyway.
+  boot.loader.grub.configurationLimit = 0;
+
+  fileSystems."/".device = "/dev/disk/by-label/nixos";
+
+  # Allow root logins only using the SSH key that the user specified
+  # at instance creation time, ping client connections to avoid timeouts
+  services.openssh.enable = true;
+  services.openssh.permitRootLogin = "without-password";
+  services.openssh.extraConfig = ''
+    ClientAliveInterval 180
+  '';
+
+  # Force getting the hostname from Azure
+  networking.hostName = mkDefault "";
+
+  # Always include cryptsetup so that NixOps can use it.
+  # sg_scan is needed to finalize disk removal on older kernels
+  environment.systemPackages = [ pkgs.cryptsetup pkgs.sg3_utils ];
+
+  networking.usePredictableInterfaceNames = false;
+
+  services.udev.extraRules = ''
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:0", ATTR{removable}=="0", SYMLINK+="disk/by-lun/0",
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:1", ATTR{removable}=="0", SYMLINK+="disk/by-lun/1",
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:2", ATTR{removable}=="0", SYMLINK+="disk/by-lun/2"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:3", ATTR{removable}=="0", SYMLINK+="disk/by-lun/3"
+
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:4", ATTR{removable}=="0", SYMLINK+="disk/by-lun/4"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:5", ATTR{removable}=="0", SYMLINK+="disk/by-lun/5"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:6", ATTR{removable}=="0", SYMLINK+="disk/by-lun/6"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:7", ATTR{removable}=="0", SYMLINK+="disk/by-lun/7"
+
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:8", ATTR{removable}=="0", SYMLINK+="disk/by-lun/8"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:9", ATTR{removable}=="0", SYMLINK+="disk/by-lun/9"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:10", ATTR{removable}=="0", SYMLINK+="disk/by-lun/10"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:11", ATTR{removable}=="0", SYMLINK+="disk/by-lun/11"
+
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:12", ATTR{removable}=="0", SYMLINK+="disk/by-lun/12"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:13", ATTR{removable}=="0", SYMLINK+="disk/by-lun/13"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:14", ATTR{removable}=="0", SYMLINK+="disk/by-lun/14"
+    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:15", ATTR{removable}=="0", SYMLINK+="disk/by-lun/15"
+
+  '';
+
+}
diff --git a/nixos/modules/virtualisation/azure-image.nix b/nixos/modules/virtualisation/azure-image.nix
index ab5a9c51fa5b..3f554d127c35 100644
--- a/nixos/modules/virtualisation/azure-image.nix
+++ b/nixos/modules/virtualisation/azure-image.nix
@@ -5,8 +5,6 @@ let
   diskSize = "4096";
 in
 {
-  imports = [ ../profiles/headless.nix ];
-
   system.build.azureImage =
     pkgs.vmTools.runInLinuxVM (
       pkgs.runCommand "azure-image"
@@ -24,7 +22,6 @@ in
 
           postVM =
             ''
-              echo Converting
               mkdir -p $out
               ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -O vpc $diskImage $out/disk.vhd
               rm $diskImage
@@ -93,34 +90,11 @@ in
         ''
     );
 
-  fileSystems."/".device = "/dev/disk/by-label/nixos";
+  imports = [ ./azure-common.nix ];
 
   # Azure metadata is available as a CD-ROM drive.
   fileSystems."/metadata".device = "/dev/sr0";
 
-  boot.kernelParams = [ "console=ttyS0" "earlyprintk=ttyS0" "rootdelay=300" "panic=1" "boot.panic_on_fail" ];
-  boot.initrd.kernelModules = [ "hv_vmbus" "hv_netvsc" "hv_utils" "hv_storvsc" ];
-
-  # Generate a GRUB menu. 
-  boot.loader.grub.device = "/dev/sda";
-  boot.loader.grub.version = 2;
-  boot.loader.grub.timeout = 0;
-
-  # Don't put old configurations in the GRUB menu.  The user has no
-  # way to select them anyway.
-  boot.loader.grub.configurationLimit = 0;
-
-  # Allow root logins only using the SSH key that the user specified
-  # at instance creation time.
-  services.openssh.enable = true;
-  services.openssh.permitRootLogin = "without-password";
-
-  # Force getting the hostname from Azure
-  networking.hostName = mkDefault "";
-
-  # Always include cryptsetup so that NixOps can use it.
-  environment.systemPackages = [ pkgs.cryptsetup ];
-
   systemd.services.fetch-ssh-keys =
     { description = "Fetch host keys and authorized_keys for root user";
 
@@ -157,8 +131,4 @@ in
       serviceConfig.StandardOutput = "journal+console";
      };
 
-  networking.usePredictableInterfaceNames = false;
-
-  #users.extraUsers.root.openssh.authorizedKeys.keys = [ (builtins.readFile <ssh-pub-key>) ];
-
 }
diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix
index 7410609e0642..16aedbbb185d 100644
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@@ -57,6 +57,17 @@ in
           '';
       };
 
+    virtualisation.libvirtd.extraOptions =
+      mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        example = [ "--verbose" ];
+        description =
+          ''
+            Extra command line arguments passed to libvirtd on startup.
+          '';
+      };
+
     virtualisation.libvirtd.onShutdown =
       mkOption {
         type = types.enum ["shutdown" "suspend" ];
@@ -140,7 +151,7 @@ in
             done
           ''; # */
 
-        serviceConfig.ExecStart = ''@${pkgs.libvirt}/sbin/libvirtd libvirtd --config "${configFile}" --daemon --verbose'';
+        serviceConfig.ExecStart = ''@${pkgs.libvirt}/sbin/libvirtd libvirtd --config "${configFile}" --daemon ${concatStringsSep " " cfg.extraOptions}'';
         serviceConfig.Type = "forking";
         serviceConfig.KillMode = "process"; # when stopping, leave the VMs alone
 
diff --git a/nixos/modules/virtualisation/vmware-guest.nix b/nixos/modules/virtualisation/vmware-guest.nix
new file mode 100644
index 000000000000..3f19f6a28b2b
--- /dev/null
+++ b/nixos/modules/virtualisation/vmware-guest.nix
@@ -0,0 +1,47 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.vmwareGuest;
+  open-vm-tools = pkgs.open-vm-tools;
+in
+{
+  options = {
+    services.vmwareGuest.enable = mkEnableOption "Enable VMWare Guest Support";
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [ {
+      assertion = pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64;
+      message = "VMWare guest is not currently supported on ${pkgs.stdenv.system}";
+    } ];
+
+    environment.systemPackages = [ open-vm-tools ];
+
+    systemd.services.vmware =
+      { description = "VMWare Guest Service";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig.ExecStart = "${open-vm-tools}/bin/vmtoolsd";
+      };
+
+    services.xserver = {
+      videoDrivers = mkOverride 50 [ "vmware" ];
+
+      config = ''
+          Section "InputDevice"
+            Identifier "VMMouse"
+            Driver "vmmouse"
+          EndSection
+        '';
+
+      serverLayoutSection = ''
+          InputDevice "VMMouse"
+        '';
+
+      displayManager.sessionCommands = ''
+          ${open-vm-tools}/bin/vmware-user-suid-wrapper
+        '';
+    };
+  };
+}
diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index cb1c200ab475..a79f72823fdf 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -53,6 +53,7 @@ in rec {
         (all nixos.tests.firewall)
         (all nixos.tests.gnome3)
         (all nixos.tests.installer.lvm)
+        (all nixos.tests.installer.luksroot)
         (all nixos.tests.installer.separateBoot)
         (all nixos.tests.installer.simple)
         (all nixos.tests.installer.simpleLabels)
diff --git a/nixos/release.nix b/nixos/release.nix
index 375b65d040e6..dfc28173f1a3 100644
--- a/nixos/release.nix
+++ b/nixos/release.nix
@@ -255,6 +255,7 @@ in rec {
   tests.i3wm = callTest tests/i3wm.nix {};
   tests.installer.grub1 = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).grub1.test);
   tests.installer.lvm = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).lvm.test);
+  tests.installer.luksroot = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).luksroot.test);
   tests.installer.rebuildCD = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).rebuildCD.test);
   tests.installer.separateBoot = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).separateBoot.test);
   tests.installer.simple = forAllSystems (system: hydraJob (import tests/installer.nix { inherit system; }).simple.test);
diff --git a/nixos/tests/chromium.nix b/nixos/tests/chromium.nix
index 026433fc7ee9..2241bc9c3bca 100644
--- a/nixos/tests/chromium.nix
+++ b/nixos/tests/chromium.nix
@@ -9,6 +9,8 @@ import ./make-test.nix (
 }: rec {
   name = "chromium";
 
+  enableOCR = true;
+
   machine.imports = [ ./common/x11.nix ];
   machine.virtualisation.memorySize = 1024;
 
@@ -106,15 +108,11 @@ import ./make-test.nix (
         "ulimit -c unlimited; ".
         "$pkg/bin/chromium $args \"$url\" & disown"
       );
+      $machine->waitForText(qr/Type to search or enter a URL to navigate/);
       $machine->waitUntilSucceeds("${xdo "check-startup" ''
         search --sync --onlyvisible --name "startup done"
         # close first start help popup
         key -delay 1000 Escape
-        # XXX: This is to make sure the popup is closed, but we better do
-        # screenshots to detect visual changes.
-        key -delay 2000 Escape
-        key -delay 3000 Escape
-        key -delay 4000 Escape
         windowfocus --sync
         windowactivate --sync
       ''}");
diff --git a/nixos/tests/common/user-account.nix b/nixos/tests/common/user-account.nix
index aa3a0b82bcde..ded8275000af 100644
--- a/nixos/tests/common/user-account.nix
+++ b/nixos/tests/common/user-account.nix
@@ -1,10 +1,9 @@
-{ pkgs, ... }:
+{ lib, ... }:
 
-{ users.extraUsers = pkgs.lib.singleton
+{ users.extraUsers = lib.singleton
     { isNormalUser = true;
       name = "alice";
       description = "Alice Foobar";
       password = "foobar";
-      uid = 1000;
     };
 }
diff --git a/nixos/tests/gnome3_16.nix b/nixos/tests/gnome3_16.nix
deleted file mode 100644
index 23a66aba50c5..000000000000
--- a/nixos/tests/gnome3_16.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-import ./make-test.nix {
-  name = "gnome3";
-
-  machine =
-    { config, pkgs, ... }:
-
-    { imports = [ ./common/user-account.nix ];
-
-      services.xserver.enable = true;
-
-      services.xserver.displayManager.auto.enable = true;
-      services.xserver.displayManager.auto.user = "alice";
-      services.xserver.desktopManager.gnome3.enable = true;
-
-      environment.gnome3.packageSet = pkgs.gnome3_16;
-
-      virtualisation.memorySize = 512;
-    };
-
-  testScript =
-    ''
-      $machine->waitForX;
-      $machine->sleep(15);
-
-      # Check that logging in has given the user ownership of devices.
-      $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
-
-      $machine->succeed("su - alice -c 'DISPLAY=:0.0 gnome-terminal &'");
-      $machine->waitForWindow(qr/Terminal/);
-      $machine->sleep(20);
-      $machine->screenshot("screen");
-    '';
-
-}
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index af87705b9279..64f98141cc0e 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -45,7 +45,8 @@ let
 
   # The configuration to install.
   makeConfig = { testChannel, grubVersion, grubDevice, grubIdentifier
-    , readOnly ? true, forceGrubReinstallCount ? 0 }:
+               , extraConfig, readOnly ? true, forceGrubReinstallCount ? 0
+               }:
     pkgs.writeText "configuration.nix" ''
       { config, lib, pkgs, modulesPath, ... }:
 
@@ -70,6 +71,7 @@ let
         environment.systemPackages = [ ${optionalString testChannel "pkgs.rlwrap"} ];
 
         nix.binaryCaches = [ http://cache.nixos.org/ ];
+        ${replaceChars ["\n"] ["\n  "] extraConfig}
       }
     '';
 
@@ -106,7 +108,9 @@ let
   # disk, and then reboot from the hard disk.  It's parameterized with
   # a test script fragment `createPartitions', which must create
   # partitions and filesystems.
-  testScriptFun = { createPartitions, testChannel, grubVersion, grubDevice, grubIdentifier }:
+  testScriptFun = { createPartitions, testChannel, grubVersion, grubDevice
+                  , grubIdentifier, preBootCommands, extraConfig
+                  }:
     let
       # FIXME: OVMF doesn't boot from virtio http://www.mail-archive.com/edk2-devel@lists.sourceforge.net/msg01501.html
       iface = if grubVersion == 1 then "scsi" else "virtio";
@@ -172,7 +176,7 @@ let
       $machine->succeed("cat /mnt/etc/nixos/hardware-configuration.nix >&2");
 
       $machine->copyFileFromHost(
-          "${ makeConfig { inherit testChannel grubVersion grubDevice grubIdentifier; } }",
+          "${ makeConfig { inherit testChannel grubVersion grubDevice grubIdentifier extraConfig; } }",
           "/mnt/etc/nixos/configuration.nix");
 
       # Perform the installation.
@@ -190,6 +194,9 @@ let
       # Now see if we can boot the installation.
       $machine = createMachine({ ${hdFlags} qemuFlags => "${qemuFlags}" });
 
+      # For example to enter LUKS passphrase
+      ${preBootCommands}
+
       # Did /boot get mounted?
       $machine->waitForUnit("local-fs.target");
 
@@ -210,7 +217,7 @@ let
 
       # We need to a writable nix-store on next boot
       $machine->copyFileFromHost(
-          "${ makeConfig { inherit testChannel grubVersion grubDevice grubIdentifier; readOnly = false; forceGrubReinstallCount = 1; } }",
+          "${ makeConfig { inherit testChannel grubVersion grubDevice grubIdentifier extraConfig; readOnly = false; forceGrubReinstallCount = 1; } }",
           "/etc/nixos/configuration.nix");
 
       # Check whether nixos-rebuild works.
@@ -225,9 +232,10 @@ let
 
       # Check whether a writable store build works
       $machine = createMachine({ ${hdFlags} qemuFlags => "${qemuFlags}" });
+      ${preBootCommands}
       $machine->waitForUnit("multi-user.target");
       $machine->copyFileFromHost(
-          "${ makeConfig { inherit testChannel grubVersion grubDevice grubIdentifier; readOnly = false; forceGrubReinstallCount = 2; } }",
+          "${ makeConfig { inherit testChannel grubVersion grubDevice grubIdentifier extraConfig; readOnly = false; forceGrubReinstallCount = 2; } }",
           "/etc/nixos/configuration.nix");
       $machine->succeed("nixos-rebuild boot >&2");
       $machine->shutdown;
@@ -235,19 +243,25 @@ let
       # And just to be sure, check that the machine still boots after
       # "nixos-rebuild switch".
       $machine = createMachine({ ${hdFlags} qemuFlags => "${qemuFlags}" });
+      ${preBootCommands}
       $machine->waitForUnit("network.target");
       $machine->shutdown;
     '';
 
 
   makeInstallerTest = name:
-    { createPartitions, testChannel ? false, grubVersion ? 2, grubDevice ? "/dev/vda", grubIdentifier ? "uuid" }:
+    { createPartitions, preBootCommands ? "", extraConfig ? ""
+    , testChannel ? false, grubVersion ? 2, grubDevice ? "/dev/vda"
+    , grubIdentifier ? "uuid", enableOCR ? false
+    }:
     makeTest {
       inherit iso;
       name = "installer-" + name;
       nodes = if testChannel then { inherit webserver; } else { };
+      inherit enableOCR;
       testScript = testScriptFun {
-        inherit createPartitions testChannel grubVersion grubDevice grubIdentifier;
+        inherit createPartitions preBootCommands testChannel grubVersion
+                grubDevice grubIdentifier extraConfig;
       };
     };
 
@@ -321,6 +335,44 @@ in {
         '';
     };
 
+  # Boot off an encrypted root partition
+  luksroot = makeInstallerTest "luksroot"
+    { createPartitions = ''
+        $machine->succeed(
+          "parted /dev/vda mklabel msdos",
+          "parted /dev/vda -- mkpart primary ext2 1M 50MB", # /boot
+          "parted /dev/vda -- mkpart primary linux-swap 50M 1024M",
+          "parted /dev/vda -- mkpart primary 1024M -1s", # LUKS
+          "udevadm settle",
+          "mkswap /dev/vda2 -L swap",
+          "swapon -L swap",
+          "modprobe dm_mod dm_crypt",
+          "echo -n supersecret | cryptsetup luksFormat -q /dev/vda3 -",
+          "echo -n supersecret | cryptsetup luksOpen --key-file - /dev/vda3 cryptroot",
+          "mkfs.ext3 -L nixos /dev/mapper/cryptroot",
+          "mount LABEL=nixos /mnt",
+          "mkfs.ext3 -L boot /dev/vda1",
+          "mkdir -p /mnt/boot",
+          "mount LABEL=boot /mnt/boot",
+        );
+      '';
+      # XXX: Currently, generate-config doesn't detect LUKS yet.
+      extraConfig = ''
+        boot.kernelParams = lib.mkAfter [ "console=tty0" ];
+        boot.initrd.luks.devices = lib.singleton {
+          name = "cryptroot";
+          device = "/dev/vda3";
+          preLVM = true;
+        };
+      '';
+      enableOCR = true;
+      preBootCommands = ''
+        $machine->start;
+        $machine->waitForText(qr/Enter passphrase/);
+        $machine->sendChars("supersecret\n");
+      '';
+    };
+
   swraid = makeInstallerTest "swraid"
     { createPartitions =
         ''
diff --git a/nixos/tests/printing.nix b/nixos/tests/printing.nix
index 708ff5391570..1e3a0057c657 100644
--- a/nixos/tests/printing.nix
+++ b/nixos/tests/printing.nix
@@ -34,6 +34,7 @@ import ./make-test.nix ({pkgs, ... }: {
       # Make sure that cups is up on both sides.
       $server->waitForUnit("cups.service");
       $client->waitForUnit("cups.service");
+      $client->sleep(10); # wait until cups is fully initialized
       $client->succeed("lpstat -r") =~ /scheduler is running/ or die;
       $client->succeed("lpstat -H") =~ "/var/run/cups/cups.sock" or die;
       $client->succeed("curl --fail http://localhost:631/");
@@ -67,6 +68,7 @@ import ./make-test.nix ({pkgs, ... }: {
 
               # Print the file on the client.
               $client->succeed("lp $file");
+              $client->sleep(10);
               $client->succeed("lpq") =~ /active.*root.*$fn/ or die;
 
               # Ensure that a raw PCL file appeared in the server's queue
@@ -74,11 +76,13 @@ import ./make-test.nix ({pkgs, ... }: {
               # course, since there is no actual USB printer attached, the
               # file will stay in the queue forever.
               $server->waitForFile("/var/spool/cups/d00001-001");
+              $server->sleep(10);
               $server->succeed("lpq -a") =~ /$fn/ or die;
 
               # Delete the job on the client.  It should disappear on the
               # server as well.
               $client->succeed("lprm");
+              $client->sleep(10);
               $client->succeed("lpq -a") =~ /no entries/;
               Machine::retry sub {
                 return 1 if $server->succeed("lpq -a") =~ /no entries/;