diff --git a/lib/test-driver/Machine.pm b/lib/test-driver/Machine.pm
index 9f5971d70a1c..daa40f78f9f2 100644
--- a/lib/test-driver/Machine.pm
+++ b/lib/test-driver/Machine.pm
@@ -330,6 +330,12 @@ sub waitForFile {
     }
 }
 
+sub startJob {
+    my ($self, $jobName) = @_;
+    $self->execute("initctl start $jobName");
+    my ($status, $out) = $self->execute("initctl status $jobName");
+    die "failed to start $jobName" unless $out =~ /start\/running/;
+}
 
 sub stopJob {
     my ($self, $jobName) = @_;
diff --git a/modules/hardware/network/intel-2100bg.nix b/modules/hardware/network/intel-2100bg.nix
new file mode 100644
index 000000000000..aec4f9748dc2
--- /dev/null
+++ b/modules/hardware/network/intel-2100bg.nix
@@ -0,0 +1,34 @@
+{pkgs, config, ...}:
+
+{
+
+  ###### interface
+
+  options = {
+  
+    networking.enableIntel2100BGFirmware = pkgs.lib.mkOption {
+      default = false;
+      type = pkgs.lib.types.bool;
+      description = ''
+        Turn on this option if you want firmware for the Intel
+        PRO/Wireless 2100BG to be loaded automatically.  This is
+        required if you want to use this device.  Intel requires you to
+        accept the license for this firmware, see
+        <link xlink:href='http://ipw2100.sourceforge.net/firmware.php?fid=2'/>.
+      '';
+    };
+
+  };
+
+
+  ###### implementation
+  
+  config = pkgs.lib.mkIf config.networking.enableIntel2100BGFirmware {
+  
+    # Warning: setting this option requires acceptance of the firmware
+    # license, see http://ipw2100.sourceforge.net/firmware.php?fid=2.
+    hardware.firmware = [ pkgs.ipw2100fw ];
+
+  };
+  
+}
diff --git a/modules/installer/tools/nixos-deploy-network/deploy.nix b/modules/installer/tools/nixos-deploy-network/deploy.nix
index 8d426780b100..10210fb0bea6 100644
--- a/modules/installer/tools/nixos-deploy-network/deploy.nix
+++ b/modules/installer/tools/nixos-deploy-network/deploy.nix
@@ -2,33 +2,71 @@
 , nixpkgs ? /etc/nixos/nixpkgs
 , networkExpr
 , infrastructureExpr
+, targetProperty ? "hostname"
 }:
 
 let
   pkgs = import nixpkgs {};
   
-  inherit (builtins) attrNames getAttr listToAttrs concatMapStrings;
+  inherit (builtins) attrNames getAttr listToAttrs;
+  inherit (pkgs.lib) concatMapStrings;
   
   network = import networkExpr;
   infrastructure = import infrastructureExpr;
- 
-  generateScript = network: infrastructure: configs:
+  
+  generateRollbackSucceededPhase = network: infrastructure: configs:
     concatMapStrings (configurationName: 
       let
         infrastructureElement = getAttr configurationName infrastructure;
 	config = getAttr configurationName configs;
       in
       ''
-        echo "=== upgrading ${infrastructureElement.hostName} ==="
-        nix-copy-closure --to ${infrastructureElement.hostName} ${config.system.build.toplevel} \
-        && ssh $NIX_SSHOPTS ${infrastructureElement.hostName} nix-env -p /nix/var/nix/profiles/system --set ${config.system.build.toplevel} \
-        && ssh $NIX_SSHOPTS ${infrastructureElement.hostName} ${config.system.build.toplevel}/bin/switch-to-configuration switch \
-        && { succeeded=$((succeeded + 1)); } \
-        || { failed=$((failed + 1)); echo 'WARNING: upgrade of ${infrastructureElement.hostName} failed!'; }
+        if [ "$rollback" != "$succeeded" ]
+	then
+	    ssh $NIX_SSHOPTS ${getAttr targetProperty infrastructureElement} nix-env -p /nix/var/nix/profiles/system --rollback
+	    ssh $NIX_SSHOPTS ${getAttr targetProperty infrastructureElement} /nix/var/nix/profiles/bin/switch-to-configuration switch
+	    
+	    rollback=$((rollback + 1))
+	fi
+      ''
+    ) (attrNames network)  
+  ;
+  
+  generateDistributionPhase = network: infrastructure: configs:
+    concatMapStrings (configurationName: 
+      let
+        infrastructureElement = getAttr configurationName infrastructure;
+	config = getAttr configurationName configs;
+      in
+      ''
+        echo "=== copy system closure to ${getAttr targetProperty infrastructureElement} ==="
+        nix-copy-closure --to ${getAttr targetProperty infrastructureElement} ${config.system.build.toplevel}
       ''
     ) (attrNames network)
   ;
-
+  
+  generateActivationPhase = network: infrastructure: configs:
+    concatMapStrings (configurationName: 
+      let
+        infrastructureElement = getAttr configurationName infrastructure;
+	config = getAttr configurationName configs;
+      in
+      ''
+        echo "=== activating system configuration on ${getAttr targetProperty infrastructureElement} ==="
+	ssh $NIX_SSHOPTS ${getAttr targetProperty infrastructureElement} nix-env -p /nix/var/nix/profiles/system --set ${config.system.build.toplevel} || 
+	  (ssh $NIX_SSHOPTS ${getAttr targetProperty infrastructureElement} nix-env -p /nix/var/nix/profiles/system --rollback; rollbackSucceeded)
+	
+        ssh $NIX_SSHOPTS ${getAttr targetProperty infrastructureElement} /nix/var/nix/profiles/bin/switch-to-configuration switch ||
+	  ( ssh $NIX_SSHOPTS ${getAttr targetProperty infrastructureElement} nix-env -p /nix/var/nix/profiles/system --rollback
+	    ssh $NIX_SSHOPTS ${getAttr targetProperty infrastructureElement} /nix/var/nix/profiles/bin/switch-to-configuration switch
+	    rollbackSucceeded
+	  )
+	
+	succeeded=$((succeeded + 1))
+      ''
+    ) (attrNames network)
+  ;
+  
   evaluateMachines = network: infrastructure:
     listToAttrs (map (configurationName:
       let
@@ -48,13 +86,27 @@ let
 in
 pkgs.stdenv.mkDerivation {
   name = "deploy-script";
-  buildCommand = ''
+  buildCommand = 
+  ''
     ensureDir $out/bin
     cat > $out/bin/deploy-systems << "EOF"
     #! ${pkgs.stdenv.shell} -e
-    failed=0; succeeded=0
-    ${generateScript network infrastructure configs}
-    echo "Upgrade of $failed machines failed, $succeeded machines succeeded.";
+    
+    rollbackSucceeded()
+    {
+        rollback=0
+        ${generateRollbackSucceededPhase network infrastructure configs}
+    }
+    
+    # Distribution phase
+    
+    ${generateDistributionPhase network infrastructure configs}
+    
+    # Activation phase
+    
+    succeeded=0
+    
+    ${generateActivationPhase network infrastructure configs}
     EOF
     chmod +x $out/bin/deploy-systems
   '';
diff --git a/modules/installer/tools/nixos-deploy-network/nixos-deploy-network.sh b/modules/installer/tools/nixos-deploy-network/nixos-deploy-network.sh
index 62463285f0fd..9b6d716f3433 100644
--- a/modules/installer/tools/nixos-deploy-network/nixos-deploy-network.sh
+++ b/modules/installer/tools/nixos-deploy-network/nixos-deploy-network.sh
@@ -68,6 +68,6 @@ fi
 
 # Deploy the network
 
-nix-build $NIXOS/deploy.nix --argstr networkExpr $networkExpr --argstr infrastructureExpr $infrastructureExpr $showTraceArg
+nix-build $NIXOS/modules/installer/tools/nixos-deploy-network/deploy.nix --argstr networkExpr $networkExpr --argstr infrastructureExpr $infrastructureExpr $showTraceArg
 ./result/bin/deploy-systems
 rm -f result
diff --git a/modules/module-list.nix b/modules/module-list.nix
index f70473f1b9b8..5e6ed0095f2e 100644
--- a/modules/module-list.nix
+++ b/modules/module-list.nix
@@ -12,6 +12,7 @@
   ./config/timezone.nix
   ./config/unix-odbc-drivers.nix
   ./config/users-groups.nix
+  ./hardware/network/intel-2100bg.nix
   ./hardware/network/intel-2200bg.nix
   ./hardware/network/intel-3945abg.nix
   ./hardware/network/rt73.nix 
diff --git a/modules/rename.nix b/modules/rename.nix
index 19cf11b4fca2..ebad3821270a 100644
--- a/modules/rename.nix
+++ b/modules/rename.nix
@@ -1,8 +1,6 @@
 {pkgs, options, config, ...}:
 
-
 let
-  to = throw "This is just a dummy keyword";
 
   alias = from: to: {
     name = "Alias";
@@ -29,10 +27,16 @@ let
 
   zipModules = list: with pkgs.lib;
     zip (n: v:
-      if tail v != [] then zipModules v else head v
+      if tail v != [] then
+        if n == "_type" then builtins.trace "Merge _type" (head v)
+        else if n == "extraConfigs" then builtins.trace "Merge extraConfigs" (concatLists v)
+        else if n == "description" || n == "apply" then
+          abort "Cannot rename an option to multiple options."
+        else zipModules v
+      else head v
     ) list;
 
-  rename = statusTemplate: from: keyword: to: with pkgs.lib;
+  rename = statusTemplate: from: to: with pkgs.lib;
     let
       status = statusTemplate from to;
       setTo = setAttrByPath (splitString "." to);
@@ -60,30 +64,30 @@ let
 in zipModules ([]
 
 # usage example:
-# ++ rename alias "services.xserver.slim.theme" to "services.xserver.displayManager.slim.theme"
-++ rename obsolete "environment.extraPackages" to "environment.systemPackages"
+# ++ rename alias "services.xserver.slim.theme" "services.xserver.displayManager.slim.theme"
+++ rename obsolete "environment.extraPackages" "environment.systemPackages"
 
 # Old Grub-related options.
-++ rename obsolete "boot.copyKernels" to "boot.loader.grub.copyKernels"
-++ rename obsolete "boot.extraGrubEntries" to "boot.loader.grub.extraEntries"
-++ rename obsolete "boot.extraGrubEntriesBeforeNixos" to "boot.loader.grub.extraEntriesBeforeNixOS"
-++ rename obsolete "boot.grubDevice" to "boot.loader.grub.device"
-++ rename obsolete "boot.bootMount" to "boot.loader.grub.bootDevice"
-++ rename obsolete "boot.grubSplashImage" to "boot.loader.grub.splashImage"
+++ rename obsolete "boot.copyKernels" "boot.loader.grub.copyKernels"
+++ rename obsolete "boot.extraGrubEntries" "boot.loader.grub.extraEntries"
+++ rename obsolete "boot.extraGrubEntriesBeforeNixos" "boot.loader.grub.extraEntriesBeforeNixOS"
+++ rename obsolete "boot.grubDevice" "boot.loader.grub.device"
+++ rename obsolete "boot.bootMount" "boot.loader.grub.bootDevice"
+++ rename obsolete "boot.grubSplashImage" "boot.loader.grub.splashImage"
 
-++ rename obsolete "boot.initrd.extraKernelModules" to "boot.initrd.kernelModules"
+++ rename obsolete "boot.initrd.extraKernelModules" "boot.initrd.kernelModules"
 
 # OpenSSH
-++ rename obsolete "services.sshd.ports" to "services.openssh.ports"
-++ rename obsolete "services.sshd.enable" to "services.openssh.enable"
-++ rename obsolete "services.sshd.allowSFTP" to "services.openssh.allowSFTP"
-++ rename obsolete "services.sshd.forwardX11" to "services.openssh.forwardX11"
-++ rename obsolete "services.sshd.gatewayPorts" to "services.openssh.gatewayPorts"
-++ rename obsolete "services.sshd.permitRootLogin" to "services.openssh.permitRootLogin"
-++ rename obsolete "services.xserver.startSSHAgent" to "services.xserver.startOpenSSHAgent"
+++ rename obsolete "services.sshd.ports" "services.openssh.ports"
+++ rename obsolete "services.sshd.enable" "services.openssh.enable"
+++ rename obsolete "services.sshd.allowSFTP" "services.openssh.allowSFTP"
+++ rename obsolete "services.sshd.forwardX11" "services.openssh.forwardX11"
+++ rename obsolete "services.sshd.gatewayPorts" "services.openssh.gatewayPorts"
+++ rename obsolete "services.sshd.permitRootLogin" "services.openssh.permitRootLogin"
+++ rename obsolete "services.xserver.startSSHAgent" "services.xserver.startOpenSSHAgent"
 
 # KDE
-++ rename deprecated "kde.extraPackages" to "environment.kdePackages"
-
+++ rename deprecated "kde.extraPackages" "environment.kdePackages"
+# ++ rename obsolete "environment.kdePackages" "environment.systemPackages" # !!! doesn't work!
 
 ) # do not add renaming after this.
diff --git a/modules/services/networking/openvpn.nix b/modules/services/networking/openvpn.nix
index 0d2025d9ce3d..772a95090645 100644
--- a/modules/services/networking/openvpn.nix
+++ b/modules/services/networking/openvpn.nix
@@ -155,7 +155,11 @@ in
   ###### implementation
 
   config = mkIf cfg.enable {
+
     jobs = listToAttrs (mapAttrsFlatten (name: value: nameValuePair "openvpn-${name}" (makeOpenVPNJob value name)) cfg.servers);
+
+    environment.systemPackages = [ openvpn ];
+
   };
   
 }
diff --git a/modules/services/networking/ssh/sshd.nix b/modules/services/networking/ssh/sshd.nix
index e02b755a516c..0533201e0215 100644
--- a/modules/services/networking/ssh/sshd.nix
+++ b/modules/services/networking/ssh/sshd.nix
@@ -8,31 +8,6 @@ let
 
   nssModulesPath = config.system.nssModules.path;
 
-  sshdConfig = pkgs.writeText "sshd_config"
-    ''
-      Protocol 2
-
-      UsePAM yes
-
-      ${ concatMapStrings (port : ''Port ${toString port}
-                                           '') cfg.ports}
-
-      ${if cfg.forwardX11 then "
-        X11Forwarding yes
-        XAuthLocation ${pkgs.xlibs.xauth}/bin/xauth
-      " else "
-        X11Forwarding no
-      "}
-
-      ${if cfg.allowSFTP then "
-        Subsystem sftp ${pkgs.openssh}/libexec/sftp-server
-      " else "
-      "}
-
-      PermitRootLogin ${cfg.permitRootLogin}
-      GatewayPorts ${cfg.gatewayPorts}
-    '';
-
   permitRootLoginCheck = v:
     v == "yes" ||
     v == "without-password" ||
@@ -102,6 +77,11 @@ in
         '';
       };
       
+      extraConfig = mkOption {
+        default = "";
+        description = "Verbatim contents of <filename>sshd_config</filename>.";
+      };
+      
     };
 
   };
@@ -146,10 +126,40 @@ in
 
         daemonType = "fork";
 
-        exec = "${pkgs.openssh}/sbin/sshd -h /etc/ssh/ssh_host_dsa_key -f ${sshdConfig}";
+        exec = 
+          ''
+            ${pkgs.openssh}/sbin/sshd -h /etc/ssh/ssh_host_dsa_key \
+              -f ${pkgs.writeText "sshd_config" cfg.extraConfig}
+          '';
       };
 
     networking.firewall.allowedTCPPorts = cfg.ports;
+
+    services.openssh.extraConfig =
+      ''
+        Protocol 2
+
+        UsePAM yes
+
+        ${concatMapStrings (port: ''
+          Port ${toString port}
+        '') cfg.ports}
+
+        ${if cfg.forwardX11 then ''
+          X11Forwarding yes
+          XAuthLocation ${pkgs.xlibs.xauth}/bin/xauth
+        '' else ''
+          X11Forwarding no
+        ''}
+
+        ${optionalString cfg.allowSFTP ''
+          Subsystem sftp ${pkgs.openssh}/libexec/sftp-server
+        ''}
+
+        PermitRootLogin ${cfg.permitRootLogin}
+        GatewayPorts ${cfg.gatewayPorts}
+      '';
+
   };
 
 }
diff --git a/modules/services/x11/desktop-managers/kde4.nix b/modules/services/x11/desktop-managers/kde4.nix
index 5ed501e4b020..2841c9426ff0 100644
--- a/modules/services/x11/desktop-managers/kde4.nix
+++ b/modules/services/x11/desktop-managers/kde4.nix
@@ -23,7 +23,7 @@ in
       default = [];
       example = [ pkgs.kde4.kdesdk ];
       type = types.list types.package;
-      description = "Additional KDE 4 programs. Only a minimal set is installed by default.";
+      description = "This option is obsolete.  Please use <option>environment.systemPackages</option> instead.";
     };
 
   };
@@ -56,7 +56,7 @@ in
     } ];
 
     environment = {
-      kdePackages = [
+      systemPackages = [
         pkgs.kde4.kdelibs
         pkgs.kde4.kdebase
         pkgs.kde4.kdebase_runtime
@@ -69,9 +69,7 @@ in
         pkgs.gst_all.gstPluginsGood
         xorg.xmessage # so that startkde can show error messages
         xorg.xset # used by startkde, non-essential
-      ];
-
-      x11Packages = config.environment.kdePackages;
+      ] ++ config.environment.kdePackages;
 
       pathsToLink = [ "/share" ];
 
diff --git a/modules/services/x11/desktop-managers/xfce.nix b/modules/services/x11/desktop-managers/xfce.nix
index 46b054989e02..4e8689f7ca71 100644
--- a/modules/services/x11/desktop-managers/xfce.nix
+++ b/modules/services/x11/desktop-managers/xfce.nix
@@ -33,7 +33,11 @@ in
             
             # Set GTK_DATA_PREFIX so that GTK+ can find the Xfce themes.
             export GTK_DATA_PREFIX=${config.system.path}
-            
+
+            # Necessary to get xfce4-mixer to find GST's ALSA plugin.
+            # Ugly.
+            export GST_PLUGIN_PATH=${config.system.path}/lib
+
             exec ${pkgs.stdenv.shell} ${pkgs.xfce.xfceutils}/etc/xdg/xfce4/xinitrc
           '';
       };
@@ -55,6 +59,7 @@ in
         pkgs.xfce.xfce4panel
         pkgs.xfce.xfce4session
         pkgs.xfce.xfce4settings
+        pkgs.xfce.xfce4mixer
         pkgs.xfce.xfceutils
         pkgs.xfce.xfconf
         pkgs.xfce.xfdesktop
diff --git a/modules/services/x11/display-managers/kdm.nix b/modules/services/x11/display-managers/kdm.nix
index 7dd979376d64..1fa5b4f210ff 100644
--- a/modules/services/x11/display-managers/kdm.nix
+++ b/modules/services/x11/display-managers/kdm.nix
@@ -100,7 +100,7 @@ in
     services.xserver.displayManager.job =
       { execCmd =
           (optionalString (config.system.boot.loader.id == "grub") "PATH=${config.system.build.grub}/sbin:$PATH ") +
-          "exec ${kdebase_workspace}/bin/kdm -config ${kdmrc} -nodaemon";
+          "KDEDIRS=${kdebase_workspace} exec ${kdebase_workspace}/bin/kdm -config ${kdmrc} -nodaemon";
         logsXsession = true;
       };
 
diff --git a/modules/virtualisation/xen-dom0.nix b/modules/virtualisation/xen-dom0.nix
index e10713466f7a..18fbf7bc62b2 100644
--- a/modules/virtualisation/xen-dom0.nix
+++ b/modules/virtualisation/xen-dom0.nix
@@ -72,7 +72,7 @@ in
 
     boot.kernelModules = 
       [ "xen_evtchn" "xen_gntdev" "xen_blkback" "xen_netback" "xen_pciback" 
-        "blktap" "tap"
+        "blktap" "tun"
       ];
 
     # The radeonfb kernel module causes the screen to go black as soon
diff --git a/release.nix b/release.nix
index c50cfa03095e..62fc2387aad7 100644
--- a/release.nix
+++ b/release.nix
@@ -159,12 +159,14 @@ let
           system = "i686-linux";
         };
       in {
+        avahi = t.avahi.test;
         bittorrent = t.bittorrent.test;
         firefox = t.firefox.test;
         installer.lvm = t.installer.lvm.test;
         installer.separateBoot = t.installer.separateBoot.test;
         installer.simple = t.installer.simple.test;
         installer.swraid = t.installer.swraid.test;
+        installer.rebuildCD = t.installer.rebuildCD.test;
         kde4 = t.kde4.test;
         login = t.login.test;
         nat = t.nat.test;
diff --git a/tests/installer.nix b/tests/installer.nix
index e8337ebe2bb6..4dcb08f70766 100644
--- a/tests/installer.nix
+++ b/tests/installer.nix
@@ -302,37 +302,31 @@ in {
     { inherit iso;
       nodes = { };
       testScript =
-    ''
-      # damn, it's costly to evaluate nixos-rebuild (1G of ram)
-      my $machine = Machine->new({ cdrom => glob("${iso}/iso/*.iso"), qemuFlags => '${qemuNICFlags 1 1} -m 1024' });
-      $machine->start;
-      
-      # Make sure that we get a login prompt etc.
-      $machine->mustSucceed("echo hello");
-      $machine->waitForJob("tty1");
-      $machine->waitForJob("rogue");
-      $machine->waitForJob("nixos-manual");
+        ''
+          # damn, it's costly to evaluate nixos-rebuild (1G of ram)
+          my $machine = Machine->new({ cdrom => glob("${iso}/iso/*.iso"), qemuFlags => '${qemuNICFlags 1 1} -m 1024' });
+          $machine->start;
 
-      # Make sure that we don't try to download anything.
-      $machine->stopJob("dhclient");
-      $machine->mustSucceed("rm /etc/resolv.conf");
+          # Make sure that we don't try to download anything.
+          $machine->stopJob("dhclient");
+          $machine->mustSucceed("rm /etc/resolv.conf");
 
-      # Enable sshd service.
-      $machine->mustSucceed(
-        "sed -i 's,^}\$,jobs.sshd.startOn = pkgs.lib.mkOverride 0 \"startup\"; },' /etc/nixos/configuration.nix"
-      );
+          # Enable sshd service.
+          $machine->mustSucceed(
+            "sed -i 's,^}\$,jobs.sshd.startOn = pkgs.lib.mkOverride 0 \"startup\"; },' /etc/nixos/configuration.nix"
+          );
 
-      my $cfg = $machine->mustSucceed("cat /etc/nixos/configuration.nix");
-      print STDERR "New CD config:\n$cfg\n";
+          my $cfg = $machine->mustSucceed("cat /etc/nixos/configuration.nix");
+          print STDERR "New CD config:\n$cfg\n";
 
-      # Apply the new CD configuration.
-      $machine->mustSucceed("nixos-rebuild test --no-pull");
+          # Apply the new CD configuration.
+          $machine->mustSucceed("nixos-rebuild test --no-pull");
 
-      # Connect to it-self.
-      #$machine->waitForJob("sshd");
-      #$machine->mustSucceed("ssh root@127.0.0.1 echo hello");
+          # Connect to it-self.
+          #$machine->waitForJob("sshd");
+          #$machine->mustSucceed("ssh root@127.0.0.1 echo hello");
 
-      $machine->shutdown;
-    '';
+          $machine->shutdown;
+        '';
     };
 }
diff --git a/tests/quake3.nix b/tests/quake3.nix
index 6bc7b8f91199..1a9f53d1a56a 100644
--- a/tests/quake3.nix
+++ b/tests/quake3.nix
@@ -7,8 +7,8 @@ rec {
 
     { require = [ ./common/x11.nix ];
       services.xserver.driSupport = true;
-      services.xserver.defaultDepth = pkgs.lib.mkOverrideTemplate 0 {} 16;
-      environment.systemPackages = [ pkgs.icewm pkgs.quake3demo ];
+      services.xserver.defaultDepth = pkgs.lib.mkOverride 0 16;
+      environment.systemPackages = [ pkgs.quake3demo ];
     };
 
   nodes =