diff --git a/.travis.yml b/.travis.yml
index e4fba7ec..f435280e 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,7 +11,9 @@ jobs:
   fast_finish: true
   include:
   # JOB: MiaB-LDAP connected to a remote Nextcloud
-  - env: PRIMARY_HOSTNAME=box1.abc.com
+  - env:
+      - PRIMARY_HOSTNAME=box1.abc.com
+      - FEATURE_MUNIN=false
     name: remote-nextcloud-docker
     before_install:
       - echo "==== ENVIRONMENT ===="
@@ -35,7 +37,11 @@ jobs:
       - sudo tests/runner.sh -dumpoutput -no-smtp-remote default remote-nextcloud
 
   # JOB: Upgrade from upstream install
-  - env: PRIMARY_HOSTNAME=box2.abc.com
+  - env:
+      - PRIMARY_HOSTNAME=box2.abc.com
+      - UPSTREAM_TAG=master
+      - FEATURE_NEXTCLOUD=false
+      - FEATURE_MUNIN=false
     name: upgrade-from-upstream
     install:
       - sudo tests/system-setup/upgrade-from-upstream.sh
diff --git a/setup/munin.sh b/setup/munin.sh
index 6799cad6..79974dc6 100755
--- a/setup/munin.sh
+++ b/setup/munin.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 # Munin: resource monitoring tool
 #################################################
+[ "${FEATURE_MUNIN:-true}" == "false" ] && return 0
 
 source setup/functions.sh # load our functions
 source /etc/mailinabox.conf # load global vars
diff --git a/setup/nextcloud.sh b/setup/nextcloud.sh
index 6bf7899c..88a967f5 100755
--- a/setup/nextcloud.sh
+++ b/setup/nextcloud.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 # Nextcloud
 ##########################
+[ "${FEATURE_NEXTCLOUD:-true}" == "false" ] && return 0
 
 source setup/functions.sh # load our functions
 source /etc/mailinabox.conf # load global vars
diff --git a/tests/lib/rest.sh b/tests/lib/rest.sh
index 86951dc1..dfbccb1b 100644
--- a/tests/lib/rest.sh
+++ b/tests/lib/rest.sh
@@ -3,7 +3,7 @@
 #
 # requirements:
 #   system packages: [ curl ]
-#   lib scripts: [ color-output.sh ]
+#   lib scripts: [ system.sh, color-output.sh ]
 #
 
 rest_urlencoded() {
@@ -26,8 +26,7 @@ rest_urlencoded() {
     #   1 curl returned with non-zero code that indicates and error
     #   2 the response status was <200 or >= 300
     #
-    # Messages, errors, and output are all sent to stderr, there is no
-    # stdout output
+    # Messages and errors are sent to stderr
     #   
 	local verb="$1" # eg "POST"
 	local uri="$2"  # eg "/mail/users/add"
@@ -36,12 +35,14 @@ rest_urlencoded() {
 	shift; shift; shift; shift  # remaining arguments are data or curl args
 
 	local url
+    local is_local="false"
     case "$uri" in
         http:* | https:* )
             url="$uri"
             ;;
         * )
             url="https://$PRIMARY_HOSTNAME${uri}"
+            is_local="true"
             ;;
     esac
     
@@ -98,6 +99,9 @@ rest_urlencoded() {
 	if [ $REST_HTTP_CODE -lt 200 -o $REST_HTTP_CODE -ge 300 ]; then
 		REST_ERROR="REST status $REST_HTTP_CODE: $REST_OUTPUT"
 		echo "${F_DANGER}$REST_ERROR${F_RESET}" 1>&2
+        if $is_local && [ $REST_HTTP_CODE -ge 500 ]; then
+            tail -100 /var/log/syslog
+        fi
 		return 2
 	fi
 	echo "CURL succeded, HTTP status $REST_HTTP_CODE" 1>&2
diff --git a/tests/suites/_mgmt-functions.sh b/tests/suites/_mgmt-functions.sh
index 5ac50701..422e447e 100644
--- a/tests/suites/_mgmt-functions.sh
+++ b/tests/suites/_mgmt-functions.sh
@@ -45,7 +45,7 @@ mgmt_rest() {
 	shift; shift;   # remaining arguments are data
 
 	# call function from lib/rest.sh
-	rest_urlencoded "$verb" "$uri" "${MGMT_ADMIN_EMAIL}" "${MGMT_ADMIN_PW}" "$@" 2>>$TEST_OF
+	rest_urlencoded "$verb" "$uri" "${MGMT_ADMIN_EMAIL}" "${MGMT_ADMIN_PW}" "$@" >>$TEST_OF 2>&1
 	return $?
 }
 
diff --git a/tests/system-setup/remote-nextcloud-docker.sh b/tests/system-setup/remote-nextcloud-docker.sh
index 1332c64f..e24900e4 100755
--- a/tests/system-setup/remote-nextcloud-docker.sh
+++ b/tests/system-setup/remote-nextcloud-docker.sh
@@ -142,13 +142,17 @@ after_miab_install() {
     
     # install and enable Nextcloud apps
     H2 "docker: install Nextcloud calendar app"
-    docker exec -u www-data NC ./occ app:install calendar \
-        || $container_started \
-            && die "docker: installing calendar app failed ($?)"
+    if ! docker exec -u www-data NC ./occ app:install calendar
+    then
+        $container_started || die "docker: installing calendar app failed"
+    fi
+    
     H2 "docker: install Nextcloud contacts app"
-    docker exec -u www-data NC ./occ app:install contacts \
-        || $container_started \
-            && die "docker: installing contacts app failed ($?)"
+    if ! docker exec -u www-data NC ./occ app:install contacts
+    then
+        $container_started || die "docker: installing contacts app failed"
+    fi
+    
     H2 "docker: enable user_ldap"
     docker exec -u www-data NC ./occ app:enable user_ldap \
         || die "docker: enabling user_ldap failed ($?)"
diff --git a/tests/system-setup/upgrade-from-upstream.sh b/tests/system-setup/upgrade-from-upstream.sh
index 45f40fcb..0e321e49 100755
--- a/tests/system-setup/upgrade-from-upstream.sh
+++ b/tests/system-setup/upgrade-from-upstream.sh
@@ -51,7 +51,7 @@ upstream_install() {
             rm -rf "$upstream_dir"
             die "git clone upstream failed!"
         fi
-        if [ -z "$TAG" ]; then
+        if [ -z "$UPSTREAM_TAG" ]; then
             tag_from_readme "$upstream_dir/README.md"
             if [ $? -ne 0 ]; then
                 rm -rf "$upstream_dir"
@@ -61,9 +61,9 @@ upstream_install() {
     fi
 
     pushd "$upstream_dir" >/dev/null
-    if [ ! -z "$TAG" ]; then
-        H2 "Checkout $TAG"
-        git checkout "$TAG" || die "git checkout $TAG failed"
+    if [ ! -z "$UPSTREAM_TAG" ]; then
+        H2 "Checkout $UPSTREAM_TAG"
+        git checkout "$UPSTREAM_TAG" || die "git checkout $UPSTREAM_TAG failed"
     fi
     
     H2 "Run upstream setup"
@@ -93,7 +93,7 @@ add_data() {
     #
     local current_users=() current_aliases=()
     local user alias
-    if ! rest_urlencoded GET /admin/mail/users "$EMAIL_ADDR" "$EMAIL_PW" --insecure 2>/dev/null; then
+    if ! rest_urlencoded GET /admin/mail/users "$EMAIL_ADDR" "$EMAIL_PW" --insecure >/dev/null 2>&1; then
         die "Unable to enumerate users: rc=$? err=$REST_ERROR"
     fi
     for user in $REST_OUTPUT; do
@@ -132,7 +132,7 @@ add_data() {
             echo "Not adding alias $alias: already exists"
             
         elif ! rest_urlencoded POST /admin/mail/aliases/add "$EMAIL_ADDR" "$EMAIL_PW" --insecure -- "address=$alias" "forwards_to=$forwards_to" 2>/dev/null
-        then 
+        then
             die "Unable to add alias $alias: rc=$? err=$REST_ERROR"
         fi
     done
@@ -144,7 +144,7 @@ capture_state() {
     # tls certificates: expected CN's
 
     local state_dir="$1"
-    local infojson="$state_dir/info.json"
+    local info="$state_dir/info.txt"
 
     H1 "Capture server state to $state_dir"
     
@@ -153,9 +153,9 @@ capture_state() {
     mkdir -p "$state_dir"
 
     # create info.json
-    H2 "create info.json"
-    echo "VERSION='$(git describe --abbrev=0)'" >"$infojson"
-    echo "MIGRATION_VERSION=$(cat "$STORAGE_ROOT/mailinabox.version")" >>"$infojson"
+    H2 "create info.txt"
+    echo "VERSION='$(git describe --abbrev=0)'" >"$info"
+    echo "MIGRATION_VERSION=$(cat "$STORAGE_ROOT/mailinabox.version")" >>"$info"
 
     # record users
     H2 "record users"
@@ -173,10 +173,9 @@ capture_state() {
     H2 "record dns details"
     local file
     mkdir -p "$state_dir/zones"
-    for file in ls /etc/nsd/zones/*.signed; do
+    for file in /etc/nsd/zones/*.signed; do
         cp "$file" "$state_dir/zones"
-    done
-    
+    done    
 }
 
 miab_ldap_install() {
@@ -217,33 +216,46 @@ compare_state() {
     fi
 
     H2 "DNS - zones missing"
-    local zone
+    local zone count=0
     for zone in $(cd "$s1/zones"; ls *.signed); do
         if [ ! -e "$s2/zones/$zone" ]; then
             echo "MISSING zone: $zone"
             changed="true"
+            let count+=1
         fi
     done
+    echo "$count missing"
 
     H2 "DNS - zones added"
+    count=0
     for zone in $(cd "$s2/zones"; ls *.signed); do
         if [ ! -e "$s2/zones/$zone" ]; then
             echo "ADDED zone: $zone"
             changed="true"
+            let count+=1
         fi
     done
+    echo "$count added"
 
     H2 "DNS - zones changed"
+    count=0
     for zone in $(cd "$s1/zones"; ls *.signed); do
         if [ -e "$s2/zones/$zone" ]; then
-            output="$(diff "$s1/zones/$zone" "$s2/zones/$zone" 2>&1)"
+            # all the signatures change if we're using self-signed certs
+            local t1="/tmp/s1.$$.txt"
+            local t2="/tmp/s2.$$.txt"
+            awk '$4 == "RRSIG" || $4 == "NSEC3" { next; } $4 == "SOA" { print $1" "$2" "$3" "$4" "$5" "$6" "$8" "$9" "$10" "$11" "$12; next } { print $0 }' "$s1/zones/$zone" > "$t1" 
+            awk '$4 == "RRSIG" || $4 == "NSEC3" { next; } $4 == "SOA" { print $1" "$2" "$3" "$4" "$5" "$6" "$8" "$9" "$10" "$11" "$12; next } { print $0 }' "$s2/zones/$zone" > "$t2" 
+            output="$(diff "$t1" "$t2" 2>&1)"
             if [ $? -ne 0 ]; then
                 echo "CHANGED zone: $zone"
                 echo "$output"
                 changed="true"
+                let count+=1
             fi
         fi
     done
+    echo "$count zone files had differences"
 
     if $changed; then
         return 1
@@ -253,12 +265,17 @@ compare_state() {
 }
 
 
-if [ "$1" == "c" ]; then
+
+if [ "$1" == "cap" ]; then
     capture_state "tests/system-setup/state/miab-ldap"
     exit $?
+elif [ "$1" == "compare" ]; then
+    compare_state "tests/system-setup/state/upstream" "tests/system-setup/state/miab-ldap"
+    exit $?
 fi
 
 
+
 # install basic stuff, set the hostname, time, etc
 before_install