Merge lp:~thumper/juju-core/agent-conf-interface into lp:~go-bot/juju-core/trunk

[Tim Penhey]

Replace agent.Conf with an interface

This was supposed to be smallish, but turned epic.
I also unexported the Conf structure so construction
now has to be through one of the two New* methods or
the Read method.

A lot of the changes are making the call sites work
with the interface instead of directly poking at the
structure.

Quite a few of the tests in agent were testing for
situations that can no longer occur. Those have
been removed.

https://codereview.appspot.com/13164043/

Replace agent.Conf with an interface

This was supposed to be smallish, but turned epic.
I also unexported the Conf structure so construction
now has to be through one of the two New* methods or
the Read method.

A lot of the changes are making the call sites work
with the interface instead of directly poking at the
structure.

Quite a few of the tests in agent were testing for
situations that can no longer occur. Those have
been removed.

https://codereview.appspot.com/13164043/

[Tim Penhey (thumper)]

Reviewers: mp+181450_code.launchpad.net,

Message:
Please take a look.

Description:
Replace agent.Conf with an interface

This was supposed to be smallish, but turned epic.
I also unexported the Conf structure so construction
now has to be through one of the two New* methods or
the Read method.

A lot of the changes are making the call sites work
with the interface instead of directly poking at the
structure.

Quite a few of the tests in agent were testing for
situations that can no longer occur. Those have
been removed.

https://code.launchpad.net/~thumper/juju-core/agent-conf-interface/+merge/181450

(do not edit description out of merge proposal)

Please review this at https://codereview.appspot.com/13164043/

Affected files:
   A [revision details]
   M agent/agent.go
   M agent/agent_test.go
   M cmd/jujud/agent.go
   M cmd/jujud/agent_test.go
   M cmd/jujud/bootstrap.go
   M cmd/jujud/bootstrap_test.go
   M cmd/jujud/deploy_test.go
   M cmd/jujud/machine.go
   M cmd/jujud/machine_test.go
   M cmd/jujud/unit.go
   M cmd/jujud/unit_test.go
   M environs/bootstrap.go
   M environs/cloudinit/cloudinit.go
   M environs/cloudinit/cloudinit_test.go
   M provider/azure/config_test.go
   M provider/azure/customdata_test.go
   M provider/ec2/local_test.go
   M provider/local/environ.go
   M provider/maas/config_test.go
   M provider/maas/environ_test.go
   M provider/openstack/config_test.go
   M provider/openstack/local_test.go
   M testing/mgo.go
   M worker/deployer/simple.go
   M worker/deployer/simple_test.go

[William Reade (fwereade)]

LGTM, this is awesome. Just a few trivial notes:

https://codereview.appspot.com/13164043/diff/1/agent/agent_test.go
File agent/agent_test.go (left):

https://codereview.appspot.com/13164043/diff/1/agent/agent_test.go#oldcode25
agent/agent_test.go:25: var _ = gc.Suite(suite{})
Please always register suites as pointers -- if/when someone adds test
methods that expect a pointer receiver they'll silently not get run.
Wouldn't matter if everyone was perfect and always ran a failing test
first, but... ;)

https://codereview.appspot.com/13164043/diff/1/agent/agent_test.go
File agent/agent_test.go (right):

https://codereview.appspot.com/13164043/diff/1/agent/agent_test.go#newcode198
agent/agent_test.go:198: // method.
Nice.

https://codereview.appspot.com/13164043/diff/1/cmd/jujud/machine_test.go
File cmd/jujud/machine_test.go (right):

https://codereview.appspot.com/13164043/diff/1/cmd/jujud/machine_test.go#newcode75
cmd/jujud/machine_test.go:75: err =
m.SetPassword(initialMachinePassword)
Doesn't SetPassword also SetMongoPassword? (might well not, just thought
it did)

https://codereview.appspot.com/13164043/diff/1/cmd/jujud/unit_test.go
File cmd/jujud/unit_test.go (right):

https://codereview.appspot.com/13164043/diff/1/cmd/jujud/unit_test.go#newcode47
cmd/jujud/unit_test.go:47: err = unit.SetPassword(initialUnitPassword)
Ditto.

https://codereview.appspot.com/13164043/diff/1/environs/cloudinit/cloudinit.go
File environs/cloudinit/cloudinit.go (right):

https://codereview.appspot.com/13164043/diff/1/environs/cloudinit/cloudinit.go#newcode249
environs/cloudinit/cloudinit.go:249: Password: password,
FWIW this is, I think, a bootstrap compatibility break (until we have
ian's pick-matching-bootstrap-tools fix in). Please confer with him and
dave; I guess it doesn't matter if we release a dev version with this
in, but once this lands we *cannot* do a new stable release without his
change in too.

https://codereview.appspot.com/13164043/diff/1/environs/cloudinit/cloudinit.go#newcode254
environs/cloudinit/cloudinit.go:254: },
This looks identical to...

https://codereview.appspot.com/13164043/diff/1/environs/cloudinit/cloudinit.go#newcode270
environs/cloudinit/cloudinit.go:270: })
...this. Would be nice to pull out into a var.

https://codereview.appspot.com/13164043/diff/1/provider/local/environ.go
File provider/local/environ.go (right):

https://codereview.appspot.com/13164043/diff/1/provider/local/environ.go#newcode513
provider/local/environ.go:513: CACert: info.CACert,
I guess it's not practical to consolidate this with the bits in
cloudinit at this stage, but there's a little bit of a smell here I
think.

https://codereview.appspot.com/13164043/diff/1/worker/deployer/simple.go
File worker/deployer/simple.go (right):

https://codereview.appspot.com/13164043/diff/1/worker/deployer/simple.go#newcode106
worker/deployer/simple.go:106: Nonce: "unused",
slight raised eyebrow... I expect we'll be passing this field up in the
shared agent connection code sooner or later, and we'll need the api
server to expect "unused"?

https://codereview.appspot.com/13164043/

[John A Meinel (jameinel)]

Some thoughts I wanted to make sure to get out since William did the
review.

https://codereview.appspot.com/13164043/diff/1/agent/agent.go
File agent/agent.go (left):

https://codereview.appspot.com/13164043/diff/1/agent/agent.go#oldcode59
agent/agent.go:59: }
Is the goal that 'conf' "is a" Config? In which case, we probably want
the:

var _ Config = (*Conf)(nil)

Statement to solidify that (as a declaration to people reading the code,
rather than a constraint that the compiler will find as soon as you
return one of them from a function).

https://codereview.appspot.com/13164043/diff/1/agent/agent.go
File agent/agent.go (right):

https://codereview.appspot.com/13164043/diff/1/agent/agent.go#newcode42
agent/agent.go:42:
A bunch of the following functions feel like they should be either
free-form functions that accept the interface, or on a different
interface that helps the Config object do stuff.

It may not be something we want to change right now, but it does
highlight that *Config* was doing a bit more than seems correct.

A different breakdown would be:
an object that handles reading and writing itself to disk.
a function that takes the abstract in-memory content and uses it to open
an API connection
a function that takes the in-memory content and opens a DB connection
etc.

https://codereview.appspot.com/13164043/diff/1/agent/agent.go#newcode171
agent/agent.go:171:
I think we eventually will have API server machines that *don't* host
the Mongo DB (State). So we might want to split this a bit further. We
can argue that we should delay until we actually need it, though I'd
like us to be sure we can get there from here.

https://codereview.appspot.com/13164043/

[Tim Penhey (thumper)]

https://codereview.appspot.com/13164043/diff/1/agent/agent.go
File agent/agent.go (left):

https://codereview.appspot.com/13164043/diff/1/agent/agent.go#oldcode59
agent/agent.go:59: }
On 2013/08/22 11:17:05, jameinel wrote:
> Is the goal that 'conf' "is a" Config? In which case, we probably want
the:

> var _ Config = (*Conf)(nil)

> Statement to solidify that (as a declaration to people reading the
code, rather
> than a constraint that the compiler will find as soon as you return
one of them
> from a function).

Done.

https://codereview.appspot.com/13164043/diff/1/agent/agent.go
File agent/agent.go (right):

https://codereview.appspot.com/13164043/diff/1/agent/agent.go#newcode42
agent/agent.go:42:
On 2013/08/22 11:17:05, jameinel wrote:
> A bunch of the following functions feel like they should be either
free-form
> functions that accept the interface, or on a different interface that
helps the
> Config object do stuff.

> It may not be something we want to change right now, but it does
highlight that
> *Config* was doing a bit more than seems correct.

> A different breakdown would be:
> an object that handles reading and writing itself to disk.
> a function that takes the abstract in-memory content and uses it to
open an API
> connection
> a function that takes the in-memory content and opens a DB connection
> etc.

I agree here. I would like to defer that to a later branch.

https://codereview.appspot.com/13164043/diff/1/agent/agent.go#newcode171
agent/agent.go:171:
On 2013/08/22 11:17:05, jameinel wrote:
> I think we eventually will have API server machines that *don't* host
the Mongo
> DB (State). So we might want to split this a bit further. We can argue
that we
> should delay until we actually need it, though I'd like us to be sure
we can get
> there from here.

I don't see any reason why we can't get here from there. It is just
more work :-) A first thing to do would be to add a machine job type
for being an api server. We'd probably then want to have extra configs.
  I'm being a bit vague here as until we need it, it is hard to break
apart. I do have a feeling that the StatePort isn't actually used.

https://codereview.appspot.com/13164043/diff/1/agent/agent_test.go
File agent/agent_test.go (left):

https://codereview.appspot.com/13164043/diff/1/agent/agent_test.go#oldcode25
agent/agent_test.go:25: var _ = gc.Suite(suite{})
On 2013/08/22 10:35:44, fwereade wrote:
> Please always register suites as pointers -- if/when someone adds test
methods
> that expect a pointer receiver they'll silently not get run. Wouldn't
matter if
> everyone was perfect and always ran a failing test first, but... ;)

Done.

https://codereview.appspot.com/13164043/diff/1/cmd/jujud/machine_test.go
File cmd/jujud/machine_test.go (right):

https://codereview.appspot.com/13164043/diff/1/cmd/jujud/machine_test.go#newcode75
cmd/jujud/machine_test.go:75: err =
m.SetPassword(initialMachinePassword)
On 2013/08/22 10:35:44, fwereade wrote:
> Doesn't SetPassword also SetMongoPassword? (might well not, just
thought it did)

No. Although these two methods are almost always done in pairs.

I felt it was outside the scope of this change to fix that.

https://coder...

[Tim Penhey (thumper)]

Please take a look.

https://codereview.appspot.com/13164043/

[Roger Peppe (rogpeppe)]

I very much like it that this branch
hides some of the grungy details of the agent
configuration behind appropriate methods.
Thanks a lot for working on this.

I have some thoughts about some other
aspects of this though, outlined
below.

https://codereview.appspot.com/13164043/diff/12001/agent/agent.go
File agent/agent.go (right):

https://codereview.appspot.com/13164043/diff/12001/agent/agent.go#newcode27
agent/agent.go:27: type Config interface {
Doc comment, please.

And I'm a little puzzled as to what we gain by
making this an interface rather than simply
unexporting the component fields and defining
methods on the type. It doesn't reduce
coupling AFAICS, and it's not like the concrete
type is difficult or expensive to mock.

https://codereview.appspot.com/13164043/diff/12001/agent/agent.go#newcode29
agent/agent.go:29: // containing the configuration files.
s/the/its/ ?

And I think this is wrong - the data dir is shared between all
agents, otherwise we wouldn't need a distincton between DataDir
and Dir below.

https://codereview.appspot.com/13164043/diff/12001/agent/agent.go#newcode50
agent/agent.go:50: // the given Conf.
What given Conf?

https://codereview.appspot.com/13164043/diff/12001/agent/agent.go#newcode53
agent/agent.go:53: // Write writes the agent configuration.
... to the agent's directory. ?

https://codereview.appspot.com/13164043/diff/12001/agent/agent.go#newcode61
agent/agent.go:61: // GenerateNewPassword creates a new random password
and saves this. The
This doesn't make it very clear what's going on.
Perhaps:

// GenerateNewPassword changes the Config's password
// to be a new random password and saves the
// new configuration by calling Config.Write.
// It returns the new password.

?

https://codereview.appspot.com/13164043/diff/12001/agent/agent.go#newcode69
agent/agent.go:69: // APIServerDetails returns the details needed to run
an API server.
This could do with a little more documentation. It does
not say what port, cert or key are. The original documentation
for StateServerCert and StateServerKey was more clear.

Perhaps consider splitting this into two methods, one
to return the port and one to return the cert and key.

https://codereview.appspot.com/13164043/diff/12001/agent/agent.go#newcode74
agent/agent.go:74: type conf struct {
"config" might be a better name here.

https://codereview.appspot.com/13164043/diff/12001/agent/agent.go#newcode114
agent/agent.go:114: type AgentConfigParams struct {
Doc comment please. And on the fields too. The data
that is passed in here is the principal reason
for the existence of this type.

https://codereview.appspot.com/13164043/diff/12001/agent/agent.go#newcode138
agent/agent.go:138: // blank. This is by design.
The conflation of credentials and location is the underlying
problem here, I think (and the central problem with state.Info
as a concept). I'd love to see a branch that fixes that.

https://codereview.appspot.com/13164043/diff/12001/agent/agent.go#newcode175
agent/agent.go:175: type StateMachineConfigParams struct {
Doc comment please.

https://codereview.appspot.com/13164043/diff/12001/agent/agent.go#newcode434
agent/agent.go:434: func InitialStateConfiguration(...

=== modified file 'agent/agent.go'
--- agent/agent.go	2013-08-20 14:02:31 +0000
+++ agent/agent.go	2013-08-22 23:04:24 +0000
@@ -11,8 +11,10 @@
 	"regexp"
 
 	"launchpad.net/goyaml"
+	"launchpad.net/loggo"
 
 	"launchpad.net/juju-core/agent/tools"
+	"launchpad.net/juju-core/environs/config"
 	"launchpad.net/juju-core/errors"
 	"launchpad.net/juju-core/state"
 	"launchpad.net/juju-core/state/api"
@@ -20,11 +22,59 @@
 	"launchpad.net/juju-core/utils"
 )
 
-// Conf holds information for a given agent.
-type Conf struct {
+var logger = loggo.GetLogger("juju.agent")
+
+type Config interface {
+	// DataDir returns the data directory. Each agent has a subdirectory
+	// containing the configuration files.
+	DataDir() string
+
+	// Tag returns the tag of the entity on whose behalf the state connection
+	// will be made.
+	Tag() string
+
+	// Dir returns the agent's directory.
+	Dir() string
+
+	// Nonce returns the nonce saved when the machine was provisioned
+	// TODO: make this one of the key/value pairs.
+	Nonce() string
+
+	// OpenAPI tries to connect to an API end-point.  If a non-empty
+	// newPassword is returned, the password used to connect to the state
+	// should be changed accordingly - the caller should set the entity's
+	// password accordingly.
+	OpenAPI(dialOpts api.DialOpts) (st *api.State, newPassword string, err error)
+
+	// OpenState tries to open a direct connection to the state database using
+	// the given Conf.
+	OpenState() (*state.State, error)
+
+	// Write writes the agent configuration.
+	Write() error
+
+	// WriteCommands returns shell commands to write the agent configuration.
+	// It returns an error if the configuration does not have all the right
+	// elements.
+	WriteCommands() ([]string, error)
+
+	// GenerateNewPassword creates a new random password and saves this.  The
+	// new password string is returned.
+	GenerateNewPassword() (string, error)
+
+	// PasswordHash returns a hash of the password that is stored for state and
+	// api connections.
+	PasswordHash() string
+
+	// APIServerDetails returns the details needed to run an API server.
+	APIServerDetails() (port int, cert, key []byte)
+}
+
+// conf holds information for a given agent.
+type conf struct {
 	// DataDir specifies the path of the data directory used by all
 	// agents
-	DataDir string
+	dataDir string
 
 	// StateServerCert and StateServerKey hold the state server
 	// certificate and private key in PEM format.
@@ -58,20 +108,110 @@
 	APIInfo *api.Info `yaml:",omitempty"`
 }
 
+// Ensure that conf implements Config.
+var _ Config = (*conf)(nil)
+
+type AgentConfigParams struct {
+	DataDir        string
+	Tag            string
+	Password       string
+	Nonce          string
+	StateAddresses []string
+	APIAddresses   []string
+	CACert         []byte
+}
+
+func newConfig(params AgentConfigParams) (*conf, error) {
+	if params.DataDir == "" {
+		return nil, requiredError("data directory")
+	}
+	if params.Tag == "" {
+		return nil, requiredError("entity tag")
+	}
+	if params.Password == "" {
+		return nil, requiredError("password")
+	}
+	if params.CACert == nil {
+		return nil, requiredError("CA certificate")
+	}
+	// Note that the password parts of the state and api information are
+	// blank.  This is by design.
+	var stateInfo *state.Info
+	if len(params.StateAddresses) > 0 {
+		stateInfo = &state.Info{
+			Addrs:  params.StateAddresses,
+			Tag:    params.Tag,
+			CACert: params.CACert,
+		}
+	}
+	var apiInfo *api.Info
+	if len(params.APIAddresses) > 0 {
+		apiInfo = &api.Info{
+			Addrs:  params.APIAddresses,
+			Tag:    params.Tag,
+			CACert: params.CACert,
+		}
+	}
+	conf := &conf{
+		dataDir:      params.DataDir,
+		OldPassword:  params.Password,
+		StateInfo:    stateInfo,
+		APIInfo:      apiInfo,
+		MachineNonce: params.Nonce,
+	}
+	if err := conf.check(); err != nil {
+		return nil, err
+	}
+	return conf, nil
+}
+
+// NewAgentConfig returns a new config object suitable for use for a unit
+// agent. As the unit agent becomes entirely APIified, we should remove the
+// state addresses from here.
+func NewAgentConfig(params AgentConfigParams) (Config, error) {
+	return newConfig(params)
+}
+
+type StateMachineConfigParams struct {
+	AgentConfigParams
+	StateServerCert []byte
+	StateServerKey  []byte
+	StatePort       int
+	APIPort         int
+}
+
+func NewStateMachineConfig(params StateMachineConfigParams) (Config, error) {
+	if params.StateServerCert == nil {
+		return nil, requiredError("state server cert")
+	}
+	if params.StateServerKey == nil {
+		return nil, requiredError("state server key")
+	}
+	conf, err := newConfig(params.AgentConfigParams)
+	if err != nil {
+		return nil, err
+	}
+	conf.StateServerCert = params.StateServerCert
+	conf.StateServerKey = params.StateServerKey
+	conf.StatePort = params.StatePort
+	conf.APIPort = params.APIPort
+	return conf, nil
+}
+
 // ReadConf reads configuration data for the given
 // entity from the given data directory.
-func ReadConf(dataDir, tag string) (*Conf, error) {
+func ReadConf(dataDir, tag string) (Config, error) {
 	dir := tools.Dir(dataDir, tag)
 	data, err := ioutil.ReadFile(path.Join(dir, "agent.conf"))
 	if err != nil {
 		return nil, err
 	}
-	var c Conf
+	var c conf
 	if err := goyaml.Unmarshal(data, &c); err != nil {
 		return nil, err
 	}
-	c.DataDir = dataDir
-	if err := c.Check(); err != nil {
+	c.dataDir = dataDir
+	if err := c.check(); err != nil {
 		return nil, err
 	}
 	if c.StateInfo != nil {
@@ -88,17 +228,29 @@
 }
 
 // File returns the path of the given file in the agent's directory.
-func (c *Conf) File(name string) string {
+func (c *conf) File(name string) string {
 	return path.Join(c.Dir(), name)
 }
 
-func (c *Conf) confFile() string {
+func (c *conf) confFile() string {
 	return c.File("agent.conf")
 }
 
+func (c *conf) DataDir() string {
+	return c.dataDir
+}
+
+func (c *conf) Nonce() string {
+	return c.MachineNonce
+}
+
+func (c *conf) APIServerDetails() (port int, cert, key []byte) {
+	return c.APIPort, c.StateServerCert, c.StateServerKey
+}
+
 // Tag returns the tag of the entity on whose behalf the state connection will
 // be made.
-func (c *Conf) Tag() string {
+func (c *conf) Tag() string {
 	if c.StateInfo != nil {
 		return c.StateInfo.Tag
 	}
@@ -106,43 +258,25 @@
 }
 
 // Dir returns the agent's directory.
-func (c *Conf) Dir() string {
-	return tools.Dir(c.DataDir, c.Tag())
+func (c *conf) Dir() string {
+	return tools.Dir(c.dataDir, c.Tag())
 }
 
 // Check checks that the configuration has all the required elements.
-func (c *Conf) Check() error {
-	if c.DataDir == "" {
-		return requiredError("data directory")
-	}
+func (c *conf) check() error {
 	if c.StateInfo == nil && c.APIInfo == nil {
-		return requiredError("state info or API info")
+		return requiredError("state or API addresses")
 	}
 	if c.StateInfo != nil {
-		if c.StateInfo.Tag == "" {
-			return requiredError("state entity tag")
-		}
 		if err := checkAddrs(c.StateInfo.Addrs, "state server address"); err != nil {
 			return err
 		}
-		if len(c.StateInfo.CACert) == 0 {
-			return requiredError("state CA certificate")
-		}
 	}
 	// TODO(rog) make APIInfo mandatory
 	if c.APIInfo != nil {
-		if c.APIInfo.Tag == "" {
-			return requiredError("API entity tag")
-		}
 		if err := checkAddrs(c.APIInfo.Addrs, "API server address"); err != nil {
 			return err
 		}
-		if len(c.APIInfo.CACert) == 0 {
-			return requiredError("API CA certficate")
-		}
-	}
-	if c.StateInfo != nil && c.APIInfo != nil && c.StateInfo.Tag != c.APIInfo.Tag {
-		return fmt.Errorf("mismatched entity tags")
 	}
 	return nil
 }
@@ -161,9 +295,46 @@
 	return nil
 }
 
+func (c *conf) PasswordHash() string {
+	var password string
+	if c.StateInfo == nil {
+		password = c.APIInfo.Password
+	} else {
+		password = c.StateInfo.Password
+	}
+	return utils.PasswordHash(password)
+}
+
+func (c *conf) GenerateNewPassword() (string, error) {
+	newPassword, err := utils.RandomPassword()
+	if err != nil {
+		return "", err
+	}
+	// Make a copy of the configuration so that if we fail
+	// to write the configuration file, the configuration will
+	// still be valid.
+	other := *c
+	if c.StateInfo != nil {
+		stateInfo := *c.StateInfo
+		stateInfo.Password = newPassword
+		other.StateInfo = &stateInfo
+	}
+	if c.APIInfo != nil {
+		apiInfo := *c.APIInfo
+		apiInfo.Password = newPassword
+		other.APIInfo = &apiInfo
+	}
+
+	if err := other.Write(); err != nil {
+		return "", err
+	}
+	*c = other
+	return newPassword, nil
+}
+
 // Write writes the agent configuration.
-func (c *Conf) Write() error {
-	if err := c.Check(); err != nil {
+func (c *conf) Write() error {
+	if err := c.check(); err != nil {
 		return err
 	}
 	data, err := goyaml.Marshal(c)
@@ -186,8 +357,8 @@
 // WriteCommands returns shell commands to write the agent
 // configuration.  It returns an error if the configuration does not
 // have all the right elements.
-func (c *Conf) WriteCommands() ([]string, error) {
-	if err := c.Check(); err != nil {
+func (c *conf) WriteCommands() ([]string, error) {
+	if err := c.check(); err != nil {
 		return nil, err
 	}
 	data, err := goyaml.Marshal(c)
@@ -210,7 +381,7 @@
 // to the state should be changed accordingly - the caller should write the
 // configuration with StateInfo.Password set to newPassword, then
 // set the entity's password accordingly.
-func (c *Conf) OpenAPI(dialOpts api.DialOpts) (st *api.State, newPassword string, err error) {
+func (c *conf) OpenAPI(dialOpts api.DialOpts) (st *api.State, newPassword string, err error) {
 	info := *c.APIInfo
 	info.Nonce = c.MachineNonce
 	if info.Password != "" {
@@ -231,9 +402,10 @@
 	if err != nil {
 		return nil, "", err
 	}
+
 	// We've succeeded in connecting with the old password, so
 	// we can now change it to something more private.
-	password, err := utils.RandomPassword()
+	password, err := c.GenerateNewPassword()
 	if err != nil {
 		st.Close()
 		return nil, "", err
@@ -242,7 +414,7 @@
 }
 
 // OpenState tries to open the state using the given Conf.
-func (c *Conf) OpenState() (*state.State, error) {
+func (c *conf) OpenState() (*state.State, error) {
 	info := *c.StateInfo
 	if info.Password != "" {
 		st, err := state.Open(&info, state.DefaultDialOpts())
@@ -258,3 +430,50 @@
 	info.Password = c.OldPassword
 	return state.Open(&info, state.DefaultDialOpts())
 }
+
+func InitialStateConfiguration(agentConfig Config, cfg *config.Config, timeout state.DialOpts) (*state.State, error) {
+	c := agentConfig.(*conf)
+	info := *c.StateInfo
+	info.Tag = ""
+	logger.Debugf("initializing address %v", info.Addrs)
+	st, err := state.Initialize(&info, cfg, timeout)
+	if err != nil {
+		if errors.IsUnauthorizedError(err) {
+			logger.Errorf("unauthorized: %v", err)
+		} else {
+			logger.Errorf("failed to initialize state: %v", err)
+		}
+		return nil, err
+	}
+	logger.Debugf("state initialized")
+
+	if err := bootstrapUsers(st, cfg, c.OldPassword); err != nil {
+		st.Close()
+		return nil, err
+	}
+	return st, nil
+}
+
+// bootstrapUsers creates the initial admin user for the database, and sets
+// the initial password.
+func bootstrapUsers(st *state.State, cfg *config.Config, passwordHash string) error {
+	logger.Debugf("adding admin user")
+	// Set up initial authentication.
+	u, err := st.AddUser("admin", "")
+	if err != nil {
+		return err
+	}
+
+	// Note that at bootstrap time, the password is set to
+	// the hash of its actual value. The first time a client
+	// connects to mongo, it changes the mongo password
+	// to the original password.
+	logger.Debugf("setting password hash for admin user")
+	if err := u.SetPasswordHash(passwordHash); err != nil {
+		return err
+	}
+	if err := st.SetAdminMongoPassword(passwordHash); err != nil {
+		return err
+	}
+	return nil
+}

=== modified file 'agent/agent_test.go'
--- agent/agent_test.go	2013-07-24 03:30:48 +0000
+++ agent/agent_test.go	2013-08-22 23:04:24 +0000
@@ -4,410 +4,251 @@
 package agent_test
 
 import (
-	"os"
-	"os/exec"
-	"path/filepath"
-
 	gc "launchpad.net/gocheck"
 
 	"launchpad.net/juju-core/agent"
-	"launchpad.net/juju-core/juju/testing"
-	"launchpad.net/juju-core/state"
-	"launchpad.net/juju-core/state/api"
 	coretesting "launchpad.net/juju-core/testing"
-	"launchpad.net/juju-core/utils"
 )
 
 type suite struct {
 	coretesting.LoggingSuite
 }
 
-var _ = gc.Suite(suite{})
+var _ = gc.Suite(&suite{})
 
-var confTests = []struct {
+var agentConfigTests = []struct {
 	about    string
-	conf     agent.Conf
+	params   agent.AgentConfigParams
 	checkErr string
 }{{
-	about: "state info only",
-	conf: agent.Conf{
-		OldPassword:  "old password",
-		MachineNonce: "dummy",
-		StateInfo: &state.Info{
-			Addrs:    []string{"foo.com:355", "bar:545"},
-			CACert:   []byte("ca cert"),
-			Tag:      "entity",
-			Password: "current password",
-		},
-	},
-}, {
-	about: "state info and api info",
-	conf: agent.Conf{
-		StateServerCert: []byte("server cert"),
-		StateServerKey:  []byte("server key"),
-		StatePort:       1234,
-		APIPort:         4321,
-		OldPassword:     "old password",
-		StateInfo: &state.Info{
-			Addrs:    []string{"foo.com:355", "bar:545"},
-			CACert:   []byte("ca cert"),
-			Tag:      "entity",
-			Password: "current password",
-		},
-		APIInfo: &api.Info{
-			Tag:      "entity",
-			Password: "other password",
-			Addrs:    []string{"foo.com:555", "bar:555"},
-			CACert:   []byte("api ca cert"),
-		},
-	},
-}, {
-	about: "API info and state info sharing CA cert",
-	conf: agent.Conf{
-		OldPassword: "old password",
-		StateInfo: &state.Info{
-			Addrs:    []string{"foo.com:355", "bar:545"},
-			CACert:   []byte("ca cert"),
-			Tag:      "entity",
-			Password: "current password",
-		},
-		APIInfo: &api.Info{
-			Tag:    "entity",
-			Addrs:  []string{"foo.com:555"},
-			CACert: []byte("ca cert"),
-		},
-	},
-}, {
-	about: "no api entity tag",
-	conf: agent.Conf{
-		StateServerCert: []byte("server cert"),
-		StateServerKey:  []byte("server key"),
-		OldPassword:     "old password",
-		StateInfo: &state.Info{
-			Addrs:    []string{"foo.com:355", "bar:545"},
-			CACert:   []byte("ca cert"),
-			Tag:      "entity",
-			Password: "current password",
-		},
-		APIInfo: &api.Info{
-			Addrs:  []string{"foo.com:555"},
-			CACert: []byte("api ca cert"),
-		},
-	},
-	checkErr: "API entity tag not found in configuration",
-}, {
-	about: "mismatched entity tags",
-	conf: agent.Conf{
-		StateServerCert: []byte("server cert"),
-		StateServerKey:  []byte("server key"),
-		OldPassword:     "old password",
-		StateInfo: &state.Info{
-			Addrs:    []string{"foo.com:355", "bar:545"},
-			CACert:   []byte("ca cert"),
-			Tag:      "entity",
-			Password: "current password",
-		},
-		APIInfo: &api.Info{
-			Tag:    "other",
-			Addrs:  []string{"foo.com:555"},
-			CACert: []byte("api ca cert"),
-		},
-	},
-	checkErr: "mismatched entity tags",
-}, {
-	about: "no state entity tag",
-	conf: agent.Conf{
-		OldPassword: "old password",
-		StateInfo: &state.Info{
-			Addrs:    []string{"foo.com:355", "bar:545"},
-			CACert:   []byte("ca cert"),
-			Password: "current password",
-		},
-	},
-	checkErr: "state entity tag not found in configuration",
-}, {
-	about: "no state server address",
-	conf: agent.Conf{
-		OldPassword: "old password",
-		StateInfo: &state.Info{
-			CACert:   []byte("ca cert"),
-			Password: "current password",
-			Tag:      "entity",
-		},
-	},
-	checkErr: "state server address not found in configuration",
-}, {
-	about: "state server address with no port",
-	conf: agent.Conf{
-		OldPassword: "old password",
-		StateInfo: &state.Info{
-			Addrs:    []string{"foo"},
-			CACert:   []byte("ca cert"),
-			Tag:      "entity",
-			Password: "current password",
-		},
-	},
-	checkErr: "invalid state server address \"foo\"",
-}, {
-	about: "state server address with non-numeric port",
-	conf: agent.Conf{
-		OldPassword: "old password",
-		StateInfo: &state.Info{
-			Addrs:    []string{"foo:bar"},
-			CACert:   []byte("ca cert"),
-			Tag:      "entity",
-			Password: "current password",
-		},
-	},
-	checkErr: "invalid state server address \"foo:bar\"",
-}, {
-	about: "state server address with bad port",
-	conf: agent.Conf{
-		OldPassword: "old password",
-		StateInfo: &state.Info{
-			Addrs:    []string{"foo:345d"},
-			CACert:   []byte("ca cert"),
-			Tag:      "entity",
-			Password: "current password",
-		},
-	},
-	checkErr: "invalid state server address \"foo:345d\"",
-}, {
-	about: "invalid api server address",
-	conf: agent.Conf{
-		OldPassword: "old password",
-		StateInfo: &state.Info{
-			Addrs:    []string{"foo:345"},
-			CACert:   []byte("ca cert"),
-			Tag:      "entity",
-			Password: "current password",
-		},
-		APIInfo: &api.Info{
-			Tag:    "entity",
-			Addrs:  []string{"bar.com:455", "foo"},
-			CACert: []byte("ca cert"),
-		},
-	},
-	checkErr: "invalid API server address \"foo\"",
-}, {
-	about: "no api CA cert",
-	conf: agent.Conf{
-		OldPassword: "old password",
-		StateInfo: &state.Info{
-			Addrs:    []string{"foo:345"},
-			CACert:   []byte("ca cert"),
-			Tag:      "entity",
-			Password: "current password",
-		},
-		APIInfo: &api.Info{
-			Tag:    "entity",
-			Addrs:  []string{"foo:3"},
-			CACert: []byte{},
-		},
-	},
-	checkErr: "API CA certficate not found in configuration",
-}, {
-	about: "no state or API info",
-	conf: agent.Conf{
-		OldPassword: "old password",
-	},
-	checkErr: "state info or API info not found in configuration",
+	about:    "missing data directory",
+	checkErr: "data directory not found in configuration",
+}, {
+	about: "missing tag directory",
+	params: agent.AgentConfigParams{
+		DataDir: "/data/dir",
+	},
+	checkErr: "entity tag not found in configuration",
+}, {
+	about: "missing password",
+	params: agent.AgentConfigParams{
+		DataDir: "/data/dir",
+		Tag:     "omg",
+	},
+	checkErr: "password not found in configuration",
+}, {
+	about: "missing CA cert",
+	params: agent.AgentConfigParams{
+		DataDir:  "/data/dir",
+		Tag:      "omg",
+		Password: "sekrit",
+	},
+	checkErr: "CA certificate not found in configuration",
+}, {
+	about: "need either state or api addresses",
+	params: agent.AgentConfigParams{
+		DataDir:  "/data/dir",
+		Tag:      "omg",
+		Password: "sekrit",
+		CACert:   []byte("ca cert"),
+	},
+	checkErr: "state or API addresses not found in configuration",
+}, {
+	about: "invalid state address",
+	params: agent.AgentConfigParams{
+		DataDir:        "/data/dir",
+		Tag:            "omg",
+		Password:       "sekrit",
+		CACert:         []byte("ca cert"),
+		StateAddresses: []string{"localhost:8080", "bad-address"},
+	},
+	checkErr: `invalid state server address "bad-address"`,
+}, {
+	about: "invalid api address",
+	params: agent.AgentConfigParams{
+		DataDir:      "/data/dir",
+		Tag:          "omg",
+		Password:     "sekrit",
+		CACert:       []byte("ca cert"),
+		APIAddresses: []string{"localhost:8080", "bad-address"},
+	},
+	checkErr: `invalid API server address "bad-address"`,
+}, {
+	about: "good state addresses",
+	params: agent.AgentConfigParams{
+		DataDir:        "/data/dir",
+		Tag:            "omg",
+		Password:       "sekrit",
+		CACert:         []byte("ca cert"),
+		StateAddresses: []string{"localhost:1234"},
+	},
+}, {
+	about: "good api addresses",
+	params: agent.AgentConfigParams{
+		DataDir:      "/data/dir",
+		Tag:          "omg",
+		Password:     "sekrit",
+		CACert:       []byte("ca cert"),
+		APIAddresses: []string{"localhost:1234"},
+	},
+}, {
+	about: "both state and api addresses",
+	params: agent.AgentConfigParams{
+		DataDir:        "/data/dir",
+		Tag:            "omg",
+		Password:       "sekrit",
+		CACert:         []byte("ca cert"),
+		StateAddresses: []string{"localhost:1234"},
+		APIAddresses:   []string{"localhost:1235"},
+	},
+}, {
+	about: "everything...",
+	params: agent.AgentConfigParams{
+		DataDir:        "/data/dir",
+		Tag:            "omg",
+		Password:       "sekrit",
+		CACert:         []byte("ca cert"),
+		StateAddresses: []string{"localhost:1234"},
+		APIAddresses:   []string{"localhost:1235"},
+		Nonce:          "a nonce",
+	},
 }}
 
-func (suite) TestConfReadWriteCheck(c *gc.C) {
-	d := c.MkDir()
-	dataDir := filepath.Join(d, "data")
-	for i, test := range confTests {
-		c.Logf("test %d; %s", i, test.about)
-		conf := test.conf
-		conf.DataDir = dataDir
-		err := conf.Check()
-		if test.checkErr != "" {
-			c.Assert(err, gc.ErrorMatches, test.checkErr)
-			c.Assert(conf.Write(), gc.ErrorMatches, test.checkErr)
-			cmds, err := conf.WriteCommands()
-			c.Assert(cmds, gc.IsNil)
-			c.Assert(err, gc.ErrorMatches, test.checkErr)
-			continue
-		}
-		c.Assert(err, gc.IsNil)
-		err = os.Mkdir(dataDir, 0777)
-		c.Assert(err, gc.IsNil)
-		err = conf.Write()
-		c.Assert(err, gc.IsNil)
-		info, err := os.Stat(conf.File("agent.conf"))
-		c.Assert(err, gc.IsNil)
-		c.Assert(info.Mode()&os.ModePerm, gc.Equals, os.FileMode(0600))
-
-		// Move the configuration file to a different directory
-		// to check that the entity name gets set correctly when
-		// reading.
-		newDir := filepath.Join(dataDir, "agents", "another")
-		err = os.Mkdir(newDir, 0777)
-		c.Assert(err, gc.IsNil)
-		err = os.Rename(conf.File("agent.conf"), filepath.Join(newDir, "agent.conf"))
-		c.Assert(err, gc.IsNil)
-
-		rconf, err := agent.ReadConf(dataDir, "another")
-		c.Assert(err, gc.IsNil)
-		c.Assert(rconf.StateInfo.Tag, gc.Equals, "another")
-		if rconf.StateInfo != nil {
-			rconf.StateInfo.Tag = conf.Tag()
-		}
-		if rconf.APIInfo != nil {
-			rconf.APIInfo.Tag = conf.Tag()
-		}
-		c.Assert(rconf, gc.DeepEquals, &conf)
-
-		err = os.RemoveAll(dataDir)
-		c.Assert(err, gc.IsNil)
-
-		// Try the equivalent shell commands.
-		cmds, err := conf.WriteCommands()
-		c.Assert(err, gc.IsNil)
-		for _, cmd := range cmds {
-			out, err := exec.Command("sh", "-c", cmd).CombinedOutput()
-			c.Assert(err, gc.IsNil, gc.Commentf("command %q; output %q", cmd, out))
-		}
-		info, err = os.Stat(conf.File("agent.conf"))
-		c.Assert(err, gc.IsNil)
-		c.Assert(info.Mode()&os.ModePerm, gc.Equals, os.FileMode(0600))
-
-		rconf, err = agent.ReadConf(dataDir, conf.StateInfo.Tag)
-		c.Assert(err, gc.IsNil)
-
-		c.Assert(rconf, gc.DeepEquals, &conf)
-
-		err = os.RemoveAll(dataDir)
-		c.Assert(err, gc.IsNil)
-	}
-}
-
-func (suite) TestCheckNoDataDir(c *gc.C) {
-	conf := agent.Conf{
-		StateInfo: &state.Info{
-			Addrs:    []string{"x:4"},
-			CACert:   []byte("xxx"),
-			Tag:      "bar",
-			Password: "pass",
-		},
-	}
-	c.Assert(conf.Check(), gc.ErrorMatches, "data directory not found in configuration")
-}
-
-func (suite) TestConfDir(c *gc.C) {
-	conf := agent.Conf{
-		DataDir: "/foo",
-		StateInfo: &state.Info{
-			Addrs:    []string{"x:4"},
-			CACert:   []byte("xxx"),
-			Tag:      "bar",
-			Password: "pass",
-		},
-	}
-	c.Assert(conf.Dir(), gc.Equals, "/foo/agents/bar")
-}
-
-func (suite) TestConfFile(c *gc.C) {
-	conf := agent.Conf{
-		DataDir: "/foo",
-		StateInfo: &state.Info{
-			Addrs:    []string{"x:4"},
-			CACert:   []byte("xxx"),
-			Tag:      "bar",
-			Password: "pass",
-		},
-	}
-	c.Assert(conf.File("x/y"), gc.Equals, "/foo/agents/bar/x/y")
-}
-
-type openSuite struct {
-	testing.JujuConnSuite
-}
-
-var _ = gc.Suite(&openSuite{})
-
-func (s *openSuite) TestOpenStateNormal(c *gc.C) {
-	conf := agent.Conf{
-		StateInfo: s.StateInfo(c),
-	}
-	conf.OldPassword = "irrelevant"
-	st, err := conf.OpenState()
-	c.Assert(err, gc.IsNil)
-	st.Close()
-}
-
-func (s *openSuite) TestOpenStateFallbackPassword(c *gc.C) {
-	conf := agent.Conf{
-		StateInfo: s.StateInfo(c),
-	}
-	conf.OldPassword = conf.StateInfo.Password
-	conf.StateInfo.Password = "not the right password"
-
-	st, err := conf.OpenState()
-	c.Assert(err, gc.IsNil)
-	c.Assert(st, gc.NotNil)
-	st.Close()
-}
-
-func (s *openSuite) TestOpenStateNoPassword(c *gc.C) {
-	conf := agent.Conf{
-		StateInfo: s.StateInfo(c),
-	}
-	conf.OldPassword = conf.StateInfo.Password
-	conf.StateInfo.Password = ""
-
-	st, err := conf.OpenState()
-	c.Assert(err, gc.IsNil)
-	c.Assert(st, gc.NotNil)
-	st.Close()
-}
-
-func (s *openSuite) TestOpenAPINormal(c *gc.C) {
-	conf := agent.Conf{
-		APIInfo: s.APIInfo(c),
-	}
-	conf.OldPassword = "irrelevant"
-
-	st, newPassword, err := conf.OpenAPI(api.DialOpts{})
-	c.Assert(err, gc.IsNil)
-	defer st.Close()
-	c.Assert(newPassword, gc.Equals, "")
-	c.Assert(st, gc.NotNil)
-}
-
-func (s *openSuite) TestOpenAPIFallbackPassword(c *gc.C) {
-	conf := agent.Conf{
-		APIInfo: s.APIInfo(c),
-	}
-	conf.OldPassword = conf.APIInfo.Password
-	conf.APIInfo.Password = "not the right password"
-
-	st, newPassword, err := conf.OpenAPI(api.DialOpts{})
-	c.Assert(err, gc.IsNil)
-	defer st.Close()
-	c.Assert(newPassword, gc.Matches, ".+")
-	c.Assert(st, gc.NotNil)
-	p, err := utils.RandomPassword()
-	c.Assert(err, gc.IsNil)
-	c.Assert(newPassword, gc.HasLen, len(p))
-	c.Assert(conf.OldPassword, gc.Equals, s.APIInfo(c).Password)
-}
-
-func (s *openSuite) TestOpenAPINoPassword(c *gc.C) {
-	conf := agent.Conf{
-		APIInfo: s.APIInfo(c),
-	}
-	conf.OldPassword = conf.APIInfo.Password
-	conf.APIInfo.Password = ""
-
-	st, newPassword, err := conf.OpenAPI(api.DialOpts{})
-	c.Assert(err, gc.IsNil)
-	defer st.Close()
-	c.Assert(newPassword, gc.Matches, ".+")
-	c.Assert(st, gc.NotNil)
-	p, err := utils.RandomPassword()
-	c.Assert(err, gc.IsNil)
-	c.Assert(newPassword, gc.HasLen, len(p))
-	c.Assert(conf.OldPassword, gc.Equals, s.APIInfo(c).Password)
-}
+func (*suite) TestNewAgentConfig(c *gc.C) {
+
+	for i, test := range agentConfigTests {
+		c.Logf("%v: %s", i, test.about)
+		_, err := agent.NewAgentConfig(test.params)
+		if test.checkErr == "" {
+			c.Assert(err, gc.IsNil)
+		} else {
+			c.Assert(err, gc.ErrorMatches, test.checkErr)
+		}
+	}
+}
+
+func (*suite) TestNewStateMachineConfig(c *gc.C) {
+	type testStruct struct {
+		about    string
+		params   agent.StateMachineConfigParams
+		checkErr string
+	}
+	var tests = []testStruct{{
+		about:    "missing state server cert",
+		checkErr: "state server cert not found in configuration",
+	}, {
+		about: "missing state server key",
+		params: agent.StateMachineConfigParams{
+			StateServerCert: []byte("server cert"),
+		},
+		checkErr: "state server key not found in configuration",
+	}}
+
+	for _, test := range agentConfigTests {
+		tests = append(tests, testStruct{
+			about: test.about,
+			params: agent.StateMachineConfigParams{
+				StateServerCert:   []byte("server cert"),
+				StateServerKey:    []byte("server key"),
+				AgentConfigParams: test.params,
+			},
+			checkErr: test.checkErr,
+		})
+	}
+
+	for i, test := range tests {
+		c.Logf("%v: %s", i, test.about)
+		_, err := agent.NewStateMachineConfig(test.params)
+		if test.checkErr == "" {
+			c.Assert(err, gc.IsNil)
+		} else {
+			c.Assert(err, gc.ErrorMatches, test.checkErr)
+		}
+	}
+}
+
+var attributeParams = agent.AgentConfigParams{
+	DataDir:        "/data/dir",
+	Tag:            "omg",
+	Password:       "sekrit",
+	CACert:         []byte("ca cert"),
+	StateAddresses: []string{"localhost:1234"},
+	Nonce:          "a nonce",
+}
+
+func (*suite) TestAttributes(c *gc.C) {
+	conf, err := agent.NewAgentConfig(attributeParams)
+	c.Assert(err, gc.IsNil)
+	c.Assert(conf.DataDir(), gc.Equals, "/data/dir")
+	c.Assert(conf.Tag(), gc.Equals, "omg")
+	c.Assert(conf.Dir(), gc.Equals, "/data/dir/agents/omg")
+	c.Assert(conf.Nonce(), gc.Equals, "a nonce")
+}
+
+func (*suite) TestWriteAndRead(c *gc.C) {
+	testParams := attributeParams
+	testParams.DataDir = c.MkDir()
+	conf, err := agent.NewAgentConfig(testParams)
+	c.Assert(err, gc.IsNil)
+
+	c.Assert(conf.Write(), gc.IsNil)
+	reread, err := agent.ReadConf(conf.DataDir(), conf.Tag())
+	c.Assert(err, gc.IsNil)
+	// Since we can't directly poke the internals, we'll use the WriteCommands
+	// method.
+	confCommands, err := conf.WriteCommands()
+	c.Assert(err, gc.IsNil)
+	rereadCommands, err := reread.WriteCommands()
+	c.Assert(err, gc.IsNil)
+	c.Assert(confCommands, gc.DeepEquals, rereadCommands)
+}
+
+func (*suite) TestGenerateNewPassword(c *gc.C) {
+
+	for i, test := range []struct {
+		about  string
+		params agent.AgentConfigParams
+	}{{
+		about: "good state addresses",
+		params: agent.AgentConfigParams{
+			DataDir:        c.MkDir(),
+			Tag:            "omg",
+			Password:       "sekrit",
+			CACert:         []byte("ca cert"),
+			StateAddresses: []string{"localhost:1234"},
+		},
+	}, {
+		about: "good api addresses",
+		params: agent.AgentConfigParams{
+			DataDir:      c.MkDir(),
+			Tag:          "omg",
+			Password:     "sekrit",
+			CACert:       []byte("ca cert"),
+			APIAddresses: []string{"localhost:1234"},
+		},
+	}, {
+		about: "both state and api addresses",
+		params: agent.AgentConfigParams{
+			DataDir:        c.MkDir(),
+			Tag:            "omg",
+			Password:       "sekrit",
+			CACert:         []byte("ca cert"),
+			StateAddresses: []string{"localhost:1234"},
+			APIAddresses:   []string{"localhost:1235"},
+		},
+	}} {
+		c.Logf("%v: %s", i, test.about)
+
+		conf, err := agent.NewAgentConfig(test.params)
+		c.Assert(err, gc.IsNil)
+		_, err = conf.GenerateNewPassword()
+		c.Assert(err, gc.IsNil)
+		// Show that the password is saved.
+		reread, err := agent.ReadConf(conf.DataDir(), conf.Tag())
+		c.Assert(conf.PasswordHash(), gc.Equals, reread.PasswordHash())
+	}
+}
+
+// Actual opening of state and api requires a lot more boiler plate to make
+// sure they are valid connections.  This is done in the cmd/jujud tests for
+// bootstrap, machine and unit tests.

=== modified file 'cmd/jujud/agent.go'
--- cmd/jujud/agent.go	2013-08-02 12:49:26 +0000
+++ cmd/jujud/agent.go	2013-08-22 23:04:24 +0000
@@ -32,8 +32,8 @@
 
 // AgentConf handles command-line flags shared by all agents.
 type AgentConf struct {
-	*agent.Conf
 	dataDir string
+	config  agent.Config
 }
 
 // addFlags injects common agent flags into f.
@@ -48,10 +48,9 @@
 	return cmd.CheckEmpty(args)
 }
 
-func (c *AgentConf) read(tag string) error {
-	var err error
-	c.Conf, err = agent.ReadConf(c.dataDir, tag)
-	return err
+func (c *AgentConf) read(tag string) (err error) {
+	c.config, err = agent.ReadConf(c.dataDir, tag)
+	return
 }
 
 func importance(err error) int {
@@ -124,8 +123,8 @@
 	return true
 }
 
-func openState(c *agent.Conf, a Agent) (*state.State, AgentState, error) {
-	st, err := c.OpenState()
+func openState(agentConfig agent.Config, a Agent) (*state.State, AgentState, error) {
+	st, err := agentConfig.OpenState()
 	if err != nil {
 		return nil, nil, err
 	}
@@ -140,13 +139,13 @@
 	return st, entity, nil
 }
 
-func openAPIState(c *agent.Conf, a Agent) (*api.State, *apiagent.Entity, error) {
+func openAPIState(agentConfig agent.Config, a Agent) (*api.State, *apiagent.Entity, error) {
 	// We let the API dial fail immediately because the
 	// runner's loop outside the caller of openAPIState will
 	// keep on retrying. If we block for ages here,
 	// then the worker that's calling this cannot
 	// be interrupted.
-	st, newPassword, err := c.OpenAPI(api.DialOpts{})
+	st, newPassword, err := agentConfig.OpenAPI(api.DialOpts{})
 	if err != nil {
 		return nil, nil, err
 	}
@@ -158,26 +157,10 @@
 		st.Close()
 		return nil, nil, err
 	}
-	if newPassword == "" {
-		return st, entity, nil
-	}
-	// Make a copy of the configuration so that if we fail
-	// to write the configuration file, the configuration will
-	// still be valid.
-	c1 := *c
-	stateInfo := *c.StateInfo
-	c1.StateInfo = &stateInfo
-	apiInfo := *c.APIInfo
-	c1.APIInfo = &apiInfo
-
-	c1.StateInfo.Password = newPassword
-	c1.APIInfo.Password = newPassword
-	if err := c1.Write(); err != nil {
-		return nil, nil, err
-	}
-	*c = c1
-	if err := entity.SetPassword(newPassword); err != nil {
-		return nil, nil, err
+	if newPassword != "" {
+		if err := entity.SetPassword(newPassword); err != nil {
+			return nil, nil, err
+		}
 	}
 	return st, entity, nil
 

=== modified file 'cmd/jujud/agent_test.go'
--- cmd/jujud/agent_test.go	2013-08-19 11:17:19 +0000
+++ cmd/jujud/agent_test.go	2013-08-22 23:04:24 +0000
@@ -108,26 +108,60 @@
 	testing.JujuConnSuite
 }
 
-// primeAgent writes the configuration file and tools
-// for an agent with the given entity name.
-// It returns the agent's configuration and the current tools.
-func (s *agentSuite) primeAgent(c *gc.C, tag, password string) (*agent.Conf, *tools.Tools) {
-	agentTools := s.primeTools(c, version.Current)
-	tools1, err := tools.ChangeAgentTools(s.DataDir(), tag, version.Current)
-	c.Assert(err, gc.IsNil)
-	c.Assert(tools1, gc.DeepEquals, agentTools)
-
-	conf := &agent.Conf{
-		DataDir:   s.DataDir(),
-		StateInfo: s.StateInfo(c),
-		APIInfo:   s.APIInfo(c),
-	}
-	conf.StateInfo.Tag = tag
-	conf.StateInfo.Password = password
-	conf.APIInfo.Tag = tag
-	conf.APIInfo.Password = password
-	err = conf.Write()
-	c.Assert(err, gc.IsNil)
+// primeAgent writes the configuration file and tools for an agent with the
+// given entity name.  It returns the agent's configuration and the current
+// tools.
+func (s *agentSuite) primeAgent(c *gc.C, tag, password string) (agent.Config, *tools.Tools) {
+	agentTools := s.primeTools(c, version.Current)
+	tools1, err := tools.ChangeAgentTools(s.DataDir(), tag, version.Current)
+	c.Assert(err, gc.IsNil)
+	c.Assert(tools1, gc.DeepEquals, agentTools)
+
+	stateInfo := s.StateInfo(c)
+	apiInfo := s.APIInfo(c)
+	conf, err := agent.NewAgentConfig(
+		agent.AgentConfigParams{
+			DataDir:        s.DataDir(),
+			Tag:            tag,
+			Password:       password,
+			Nonce:          state.BootstrapNonce,
+			StateAddresses: stateInfo.Addrs,
+			APIAddresses:   apiInfo.Addrs,
+			CACert:         stateInfo.CACert,
+		})
+	c.Assert(conf.Write(), gc.IsNil)
+	return conf, agentTools
+}
+
+// primeStateAgent writes the configuration file and tools for an agent with the
+// given entity name.  It returns the agent's configuration and the current
+// tools.
+func (s *agentSuite) primeStateAgent(c *gc.C, tag, password string) (agent.Config, *tools.Tools) {
+	agentTools := s.primeTools(c, version.Current)
+	tools1, err := tools.ChangeAgentTools(s.DataDir(), tag, version.Current)
+	c.Assert(err, gc.IsNil)
+	c.Assert(tools1, gc.DeepEquals, agentTools)
+
+	stateInfo := s.StateInfo(c)
+	port := coretesting.FindTCPPort()
+	apiAddr := []string{fmt.Sprintf("localhost:%d", port)}
+	conf, err := agent.NewStateMachineConfig(
+		agent.StateMachineConfigParams{
+			AgentConfigParams: agent.AgentConfigParams{
+				DataDir:        s.DataDir(),
+				Tag:            tag,
+				Password:       password,
+				Nonce:          state.BootstrapNonce,
+				StateAddresses: stateInfo.Addrs,
+				APIAddresses:   apiAddr,
+				CACert:         stateInfo.CACert,
+			},
+			StateServerCert: []byte(coretesting.ServerCert),
+			StateServerKey:  []byte(coretesting.ServerKey),
+			StatePort:       coretesting.MgoPort,
+			APIPort:         port,
+		})
+	c.Assert(conf.Write(), gc.IsNil)
 	return conf, agentTools
 }
 
@@ -177,21 +211,12 @@
 	return agentTools
 }
 
-func (s *agentSuite) testOpenAPIState(c *gc.C, ent state.AgentEntity, agentCmd Agent) {
+func (s *agentSuite) testOpenAPIState(c *gc.C, ent state.AgentEntity, agentCmd Agent, initialPassword string) {
 	conf, err := agent.ReadConf(s.DataDir(), ent.Tag())
 	c.Assert(err, gc.IsNil)
 
 	// Check that it starts initially and changes the password
-	err = ent.SetPassword("initial")
-	c.Assert(err, gc.IsNil)
-
-	conf.OldPassword = "initial"
-	conf.APIInfo.Password = ""
-	conf.StateInfo.Password = ""
-	err = conf.Write()
-	c.Assert(err, gc.IsNil)
-
-	assertOpen := func(conf *agent.Conf) {
+	assertOpen := func(conf agent.Config) {
 		st, gotEnt, err := openAPIState(conf, agentCmd)
 		c.Assert(err, gc.IsNil)
 		c.Assert(st, gc.NotNil)
@@ -203,41 +228,12 @@
 	// Check that the initial password is no longer valid.
 	err = ent.Refresh()
 	c.Assert(err, gc.IsNil)
-	c.Assert(ent.PasswordValid("initial"), gc.Equals, false)
-
-	// Check that the passwords in the configuration are correct.
-	c.Assert(ent.PasswordValid(conf.APIInfo.Password), gc.Equals, true)
-	c.Assert(conf.StateInfo.Password, gc.Equals, conf.APIInfo.Password)
-	c.Assert(conf.OldPassword, gc.Equals, "initial")
-
-	// Read the configuration and check the same
-	c.Assert(refreshConfig(conf), gc.IsNil)
-	c.Assert(ent.PasswordValid(conf.APIInfo.Password), gc.Equals, true)
-	c.Assert(conf.StateInfo.Password, gc.Equals, conf.APIInfo.Password)
-	c.Assert(conf.OldPassword, gc.Equals, "initial")
+	c.Assert(ent.PasswordValid(initialPassword), gc.Equals, false)
 
 	// Read the configuration and check that we can connect with it.
-	c.Assert(refreshConfig(conf), gc.IsNil)
-
+	conf = refreshConfig(c, conf)
 	// Check we can open the API with the new configuration.
 	assertOpen(conf)
-
-	newPassword := conf.StateInfo.Password
-
-	// Change the password in the configuration and check
-	// that it falls back to using the initial password
-	c.Assert(refreshConfig(conf), gc.IsNil)
-	conf.APIInfo.Password = "spurious"
-	conf.OldPassword = newPassword
-	c.Assert(conf.Write(), gc.IsNil)
-	assertOpen(conf)
-
-	// Check that it's changed the password again...
-	c.Assert(conf.APIInfo.Password, gc.Not(gc.Equals), "spurious")
-	c.Assert(conf.APIInfo.Password, gc.Not(gc.Equals), newPassword)
-
-	// ... and that we can still open the state with the new configuration.
-	assertOpen(conf)
 }
 
 func (s *agentSuite) testUpgrade(c *gc.C, agent runner, currentTools *tools.Tools) {
@@ -252,11 +248,8 @@
 	c.Assert(ug.OldTools, gc.DeepEquals, currentTools)
 }
 
-func refreshConfig(c *agent.Conf) error {
-	nc, err := agent.ReadConf(c.DataDir, c.StateInfo.Tag)
-	if err != nil {
-		return err
-	}
-	*c = *nc
-	return nil
+func refreshConfig(c *gc.C, config agent.Config) agent.Config {
+	config, err := agent.ReadConf(config.DataDir(), config.Tag())
+	c.Assert(err, gc.IsNil)
+	return config
 }

=== modified file 'cmd/jujud/bootstrap.go'
--- cmd/jujud/bootstrap.go	2013-07-19 02:21:57 +0000
+++ cmd/jujud/bootstrap.go	2013-08-22 23:04:24 +0000
@@ -7,8 +7,12 @@
 	"encoding/base64"
 	"fmt"
 	"io/ioutil"
+	"strings"
+
 	"launchpad.net/gnuflag"
 	"launchpad.net/goyaml"
+
+	"launchpad.net/juju-core/agent"
 	"launchpad.net/juju-core/cmd"
 	"launchpad.net/juju-core/constraints"
 	"launchpad.net/juju-core/environs"
@@ -16,7 +20,6 @@
 	"launchpad.net/juju-core/environs/config"
 	"launchpad.net/juju-core/instance"
 	"launchpad.net/juju-core/state"
-	"strings"
 )
 
 // Cloud-init write the URL to be used to load the bootstrap state into this file.
@@ -54,7 +57,8 @@
 
 // Run initializes state for an environment.
 func (c *BootstrapCommand) Run(_ *cmd.Context) error {
-	if err := c.Conf.read("bootstrap"); err != nil {
+	err := c.Conf.read("bootstrap")
+	if err != nil {
 		return err
 	}
 	cfg, err := config.New(c.EnvConfig)
@@ -62,18 +66,13 @@
 		return err
 	}
 
-	// There is no entity that's created at init time.
-	c.Conf.StateInfo.Tag = ""
-	st, err := state.Initialize(c.Conf.StateInfo, cfg, state.DefaultDialOpts())
+	// There is no entity that's created at init time
+	st, err := agent.InitialStateConfiguration(c.Conf.config, cfg, state.DefaultDialOpts())
 	if err != nil {
 		return err
 	}
 	defer st.Close()
 
-	if err := environs.BootstrapUsers(st, cfg, c.Conf.OldPassword); err != nil {
-		return err
-	}
-
 	// TODO(fwereade): we need to be able to customize machine jobs,
 	// not just hardcode these values; in particular, JobHostUnits
 	// on a machine, like this one, that is running JobManageEnviron
@@ -106,7 +105,7 @@
 		characteristics = bsState.Characteristics[0]
 	}
 
-	return environs.ConfigureBootstrapMachine(st, c.Constraints, c.Conf.DataDir, jobs, instance.Id(instId), characteristics)
+	return environs.ConfigureBootstrapMachine(st, c.Constraints, c.Conf.dataDir, jobs, instance.Id(instId), characteristics)
 }
 
 // yamlBase64Value implements gnuflag.Value on a map[string]interface{}.

=== modified file 'cmd/jujud/bootstrap_test.go'
--- cmd/jujud/bootstrap_test.go	2013-08-19 11:17:19 +0000
+++ cmd/jujud/bootstrap_test.go	2013-08-22 23:04:24 +0000
@@ -18,7 +18,6 @@
 	"launchpad.net/juju-core/errors"
 	"launchpad.net/juju-core/instance"
 	"launchpad.net/juju-core/state"
-	"launchpad.net/juju-core/state/api"
 	"launchpad.net/juju-core/testing"
 	"launchpad.net/juju-core/utils"
 )
@@ -77,39 +76,27 @@
 	return utils.PasswordHash(testPassword)
 }
 
-func (s *BootstrapSuite) initBootstrapCommand(c *gc.C, args ...string) (machineConf *agent.Conf, cmd *BootstrapCommand, err error) {
+func (s *BootstrapSuite) initBootstrapCommand(c *gc.C, args ...string) (machineConf agent.Config, cmd *BootstrapCommand, err error) {
 	ioutil.WriteFile(s.providerStateURLFile, []byte("test://localhost/provider-state\n"), 0600)
-	bootConf := &agent.Conf{
-		DataDir:     s.dataDir,
-		OldPassword: testPasswordHash(),
-		StateInfo: &state.Info{
-			Tag:    "bootstrap",
-			Addrs:  []string{testing.MgoAddr},
-			CACert: []byte(testing.CACert),
-		},
-		APIInfo: &api.Info{
-			Tag:    "bootstrap",
-			Addrs:  []string{"0.1.2.3:1234"},
-			CACert: []byte(testing.CACert),
-		},
+	// NOTE: the old test used an equivalent of the NewAgentConfig, but it
+	// really should be using NewStateMachineConfig.
+	params := agent.AgentConfigParams{
+		DataDir:        s.dataDir,
+		Tag:            "bootstrap",
+		Password:       testPasswordHash(),
+		Nonce:          state.BootstrapNonce,
+		StateAddresses: []string{testing.MgoAddr},
+		APIAddresses:   []string{"0.1.2.3:1234"},
+		CACert:         []byte(testing.CACert),
 	}
+	bootConf, err := agent.NewAgentConfig(params)
+	c.Assert(err, gc.IsNil)
 	err = bootConf.Write()
 	c.Assert(err, gc.IsNil)
 
-	machineConf = &agent.Conf{
-		DataDir:     s.dataDir,
-		OldPassword: testPasswordHash(),
-		StateInfo: &state.Info{
-			Tag:    "machine-0",
-			Addrs:  []string{testing.MgoAddr},
-			CACert: []byte(testing.CACert),
-		},
-		APIInfo: &api.Info{
-			Tag:    "machine-0",
-			Addrs:  []string{"0.1.2.3:1234"},
-			CACert: []byte(testing.CACert),
-		},
-	}
+	params.Tag = "machine-0"
+	machineConf, err = agent.NewAgentConfig(params)
+	c.Assert(err, gc.IsNil)
 	err = machineConf.Write()
 	c.Assert(err, gc.IsNil)
 
@@ -238,28 +225,13 @@
 	// Check that the machine configuration has been given a new
 	// password and that we can connect to mongo as that machine
 	// and that the in-mongo password also verifies correctly.
-
-	machineConf1, err := agent.ReadConf(machineConf.DataDir, "machine-0")
+	machineConf1, err := agent.ReadConf(machineConf.DataDir(), "machine-0")
 	c.Assert(err, gc.IsNil)
-
-	c.Assert(machineConf1.OldPassword, gc.Equals, "")
-	c.Assert(machineConf1.APIInfo.Password, gc.Not(gc.Equals), "")
-	c.Assert(machineConf1.StateInfo.Password, gc.Equals, machineConf1.APIInfo.Password)
-
-	// Check that no other information has been lost.
-	machineConf.OldPassword = ""
-	machineConf.APIInfo.Password = machineConf1.APIInfo.Password
-	machineConf.StateInfo.Password = machineConf1.StateInfo.Password
-	c.Assert(machineConf1, gc.DeepEquals, machineConf)
-
-	info.Tag, info.Password = "machine-0", machineConf1.StateInfo.Password
-	st, err = state.Open(info, state.DefaultDialOpts())
+	c.Assert(machineConf1.PasswordHash(), gc.Not(gc.Equals), testPasswordHash())
+
+	st, err = machineConf1.OpenState()
 	c.Assert(err, gc.IsNil)
 	defer st.Close()
-
-	m, err := st.Machine("0")
-	c.Assert(err, gc.IsNil)
-	c.Assert(m.PasswordValid(machineConf1.StateInfo.Password), gc.Equals, true)
 }
 
 var base64ConfigTests = []struct {

=== modified file 'cmd/jujud/deploy_test.go'
--- cmd/jujud/deploy_test.go	2013-08-19 11:17:19 +0000
+++ cmd/jujud/deploy_test.go	2013-08-22 23:04:24 +0000
@@ -12,10 +12,8 @@
 	gc "launchpad.net/gocheck"
 
 	"launchpad.net/juju-core/state"
-	apideployer "launchpad.net/juju-core/state/api/deployer"
 	"launchpad.net/juju-core/testing"
 	"launchpad.net/juju-core/utils/set"
-	"launchpad.net/juju-core/worker/deployer"
 )
 
 // fakeManager allows us to test deployments without actually deploying units
@@ -78,29 +76,3 @@
 		}
 	}
 }
-
-func patchDeployContext(c *gc.C, st *state.State, expectInfo *state.Info, expectDataDir string) (*fakeContext, func()) {
-	ctx := &fakeContext{
-		inited: make(chan struct{}),
-	}
-	e0 := *expectInfo
-	expectInfo = &e0
-	orig := newDeployContext
-	newDeployContext = func(dst *apideployer.State, dataDir string) (deployer.Context, error) {
-		caCert, err := dst.CACert()
-		if err != nil {
-			return nil, err
-		}
-		stateAddrs, err := dst.StateAddresses()
-		if err != nil {
-			return nil, err
-		}
-		c.Check(stateAddrs, gc.DeepEquals, expectInfo.Addrs)
-		c.Check(caCert, gc.DeepEquals, expectInfo.CACert)
-		c.Check(dataDir, gc.Equals, expectDataDir)
-		ctx.st = st
-		close(ctx.inited)
-		return ctx, nil
-	}
-	return ctx, func() { newDeployContext = orig }
-}

=== modified file 'cmd/jujud/machine.go'
--- cmd/jujud/machine.go	2013-08-19 13:29:56 +0000
+++ cmd/jujud/machine.go	2013-08-22 23:04:24 +0000
@@ -89,7 +89,7 @@
 	if err := a.Conf.read(a.Tag()); err != nil {
 		return err
 	}
-	charm.CacheDir = filepath.Join(a.Conf.DataDir, "charmcache")
+	charm.CacheDir = filepath.Join(a.Conf.dataDir, "charmcache")
 
 	// ensureStateWorker ensures that there is a worker that
 	// connects to the state that runs within itself all the workers
@@ -137,7 +137,7 @@
 //
 // If a state worker is necessary, APIWorker calls ensureStateWorker.
 func (a *MachineAgent) APIWorker(ensureStateWorker func()) (worker.Worker, error) {
-	st, entity, err := openAPIState(a.Conf.Conf, a)
+	st, entity, err := openAPIState(a.Conf.config, a)
 	if err != nil {
 		// There was an error connecting to the API,
 		// https://launchpad.net/bugs/1199915 means that we may just
@@ -167,12 +167,12 @@
 	})
 	runner.StartWorker("upgrader", func() (worker.Worker, error) {
 		// TODO(rog) use id instead of *Machine (or introduce Clone method)
-		return upgrader.New(st.Upgrader(), a.Tag(), a.Conf.DataDir), nil
+		return upgrader.New(st.Upgrader(), a.Tag(), a.Conf.dataDir), nil
 	})
 	for _, job := range entity.Jobs() {
 		switch job {
 		case params.JobHostUnits:
-			deployerTask, err := newDeployer(st.Deployer(), a.Tag(), a.Conf.DataDir)
+			deployerTask, err := newDeployer(st.Deployer(), a.Tag(), a.Conf.dataDir)
 			if err != nil {
 				return nil, err
 			}
@@ -192,9 +192,9 @@
 }
 
 // StateJobs returns a worker running all the workers that require
-// a *state.State connection.
+// a *state.State cofnnection.
 func (a *MachineAgent) StateWorker() (worker.Worker, error) {
-	st, entity, err := openState(a.Conf.Conf, a)
+	st, entity, err := openState(a.Conf.config, a)
 	if err != nil {
 		return nil, err
 	}
@@ -202,7 +202,7 @@
 	m := entity.(*state.Machine)
 	// TODO(rog) use more discriminating test for errors
 	// rather than taking everything down indiscriminately.
-	dataDir := a.Conf.DataDir
+	dataDir := a.Conf.dataDir
 	runner := worker.NewRunner(allFatal, moreImportant)
 	// At this stage, since we don't embed lxc containers, just start an lxc
 	// provisioner task for non-lxc containers.  Since we have only LXC
@@ -245,10 +245,11 @@
 				// the agent's configuration file. In the future, we may retrieve
 				// the state server certificate and key from the state, and
 				// this should then change.
-				if len(a.Conf.StateServerCert) == 0 || len(a.Conf.StateServerKey) == 0 {
+				port, cert, key := a.Conf.config.APIServerDetails()
+				if len(cert) == 0 || len(key) == 0 {
 					return nil, &fatalError{"configuration does not have state server cert/key"}
 				}
-				return apiserver.NewServer(st, fmt.Sprintf(":%d", a.Conf.APIPort), a.Conf.StateServerCert, a.Conf.StateServerKey)
+				return apiserver.NewServer(st, fmt.Sprintf(":%d", port), cert, key)
 			})
 			runner.StartWorker("cleaner", func() (worker.Worker, error) {
 				return cleaner.NewCleaner(st), nil
@@ -275,7 +276,7 @@
 		return nil, err
 	}
 	// Check the machine nonce as provisioned matches the agent.Conf value.
-	if !m.CheckProvisioned(a.Conf.MachineNonce) {
+	if !m.CheckProvisioned(a.Conf.config.Nonce()) {
 		// The agent is running on a different machine to the one it
 		// should be according to state. It must stop immediately.
 		log.Errorf("running machine %v agent on inappropriate instance", m)

=== modified file 'cmd/jujud/machine_test.go'
--- cmd/jujud/machine_test.go	2013-08-20 15:01:49 +0000
+++ cmd/jujud/machine_test.go	2013-08-22 23:04:24 +0000
@@ -4,7 +4,6 @@
 package main
 
 import (
-	"fmt"
 	"path/filepath"
 	"reflect"
 	"time"
@@ -24,11 +23,13 @@
 	"launchpad.net/juju-core/provider/dummy"
 	"launchpad.net/juju-core/state"
 	"launchpad.net/juju-core/state/api"
+	apideployer "launchpad.net/juju-core/state/api/deployer"
 	"launchpad.net/juju-core/state/api/params"
 	"launchpad.net/juju-core/state/watcher"
 	"launchpad.net/juju-core/testing"
 	"launchpad.net/juju-core/testing/checkers"
 	"launchpad.net/juju-core/version"
+	"launchpad.net/juju-core/worker/deployer"
 )
 
 type MachineSuite struct {
@@ -61,22 +62,27 @@
 	s.agentSuite.TearDownTest(c)
 }
 
+const initialMachinePassword = "machine-password"
+
 // primeAgent adds a new Machine to run the given jobs, and sets up the
 // machine agent's directory.  It returns the new machine, the
 // agent's configuration and the tools currently running.
-func (s *MachineSuite) primeAgent(c *gc.C, jobs ...state.MachineJob) (*state.Machine, *agent.Conf, *tools.Tools) {
+func (s *MachineSuite) primeAgent(c *gc.C, jobs ...state.MachineJob) (m *state.Machine, config agent.Config, tools *tools.Tools) {
 	m, err := s.State.InjectMachine("series", constraints.Value{}, "ardbeg-0", instance.HardwareCharacteristics{}, jobs...)
 	c.Assert(err, gc.IsNil)
-	err = m.SetMongoPassword("machine-password")
-	c.Assert(err, gc.IsNil)
-	err = m.SetPassword("machine-password")
-	c.Assert(err, gc.IsNil)
-	conf, tools := s.agentSuite.primeAgent(c, names.MachineTag(m.Id()), "machine-password")
-	conf.MachineNonce = state.BootstrapNonce
-	conf.APIInfo.Nonce = conf.MachineNonce
-	err = conf.Write()
-	c.Assert(err, gc.IsNil)
-	return m, conf, tools
+	err = m.SetMongoPassword(initialMachinePassword)
+	c.Assert(err, gc.IsNil)
+	err = m.SetPassword(initialMachinePassword)
+	c.Assert(err, gc.IsNil)
+	tag := names.MachineTag(m.Id())
+	if m.IsStateServer() {
+		config, tools = s.agentSuite.primeStateAgent(c, tag, initialMachinePassword)
+	} else {
+		config, tools = s.agentSuite.primeAgent(c, tag, initialMachinePassword)
+	}
+	err = config.Write()
+	c.Assert(err, gc.IsNil)
+	return m, config, tools
 }
 
 // newAgent returns a new MachineAgent instance
@@ -128,7 +134,7 @@
 	err := a.Stop()
 	c.Assert(err, gc.IsNil)
 	c.Assert(<-done, gc.IsNil)
-	c.Assert(charm.CacheDir, gc.Equals, filepath.Join(ac.DataDir, "charmcache"))
+	c.Assert(charm.CacheDir, gc.Equals, filepath.Join(ac.DataDir(), "charmcache"))
 }
 
 func (s *MachineSuite) TestWithDeadMachine(c *gc.C) {
@@ -174,9 +180,9 @@
 }
 
 func (s *MachineSuite) TestHostUnits(c *gc.C) {
-	m, conf, _ := s.primeAgent(c, state.JobHostUnits)
+	m, _, _ := s.primeAgent(c, state.JobHostUnits)
 	a := s.newAgent(c, m)
-	ctx, reset := patchDeployContext(c, s.BackingState, conf.StateInfo, conf.DataDir)
+	ctx, reset := patchDeployContext(c, s.BackingState)
 	defer reset()
 	go func() { c.Check(a.Run(nil), gc.IsNil) }()
 	defer func() { c.Check(a.Stop(), gc.IsNil) }()
@@ -234,6 +240,19 @@
 	ctx.waitDeployed(c)
 }
 
+func patchDeployContext(c *gc.C, st *state.State) (*fakeContext, func()) {
+	ctx := &fakeContext{
+		inited: make(chan struct{}),
+	}
+	orig := newDeployContext
+	newDeployContext = func(dst *apideployer.State, dataDir string) (deployer.Context, error) {
+		ctx.st = st
+		close(ctx.inited)
+		return ctx, nil
+	}
+	return ctx, func() { newDeployContext = orig }
+}
+
 func (s *MachineSuite) TestManageEnviron(c *gc.C) {
 	usefulVersion := version.Current
 	usefulVersion.Series = "series" // to match the charm created below
@@ -297,35 +316,18 @@
 }
 
 func (s *MachineSuite) TestUpgrade(c *gc.C) {
-	m, conf, currentTools := s.primeAgent(c, state.JobManageState, state.JobManageEnviron, state.JobHostUnits)
-	addAPIInfo(conf, m)
-	err := conf.Write()
-	c.Assert(err, gc.IsNil)
+	m, _, currentTools := s.primeAgent(c, state.JobManageState, state.JobManageEnviron, state.JobHostUnits)
 	a := s.newAgent(c, m)
 	s.testUpgrade(c, a, currentTools)
 }
 
-// addAPIInfo adds information to the agent's configuration
-// for serving the API.
-func addAPIInfo(conf *agent.Conf, m *state.Machine) {
-	port := testing.FindTCPPort()
-	conf.APIInfo.Addrs = []string{fmt.Sprintf("localhost:%d", port)}
-	conf.APIInfo.CACert = []byte(testing.CACert)
-	conf.StateServerCert = []byte(testing.ServerCert)
-	conf.StateServerKey = []byte(testing.ServerKey)
-	conf.APIPort = port
-}
-
 var fastDialOpts = api.DialOpts{
 	Timeout:    1 * time.Second,
 	RetryDelay: 10 * time.Millisecond,
 }
 
-func (s *MachineSuite) assertJobWithState(c *gc.C, job state.MachineJob, test func(*agent.Conf, *state.State)) {
+func (s *MachineSuite) assertJobWithState(c *gc.C, job state.MachineJob, test func(agent.Config, *state.State)) {
 	stm, conf, _ := s.primeAgent(c, job)
-	addAPIInfo(conf, stm)
-	err := conf.Write()
-	c.Assert(err, gc.IsNil)
 	a := s.newAgent(c, stm)
 	defer a.Stop()
 
@@ -346,7 +348,7 @@
 		c.Fatalf("state not opened")
 	}
 
-	err = a.Stop()
+	err := a.Stop()
 	if job == state.JobManageState {
 		// When shutting down, the API server can be shut down before
 		// the other workers that connect to it, so they get an error so
@@ -370,18 +372,18 @@
 }
 
 func (s *MachineSuite) TestManageStateServesAPI(c *gc.C) {
-	s.assertJobWithState(c, state.JobManageState, func(conf *agent.Conf, agentState *state.State) {
-		st, err := api.Open(conf.APIInfo, fastDialOpts)
+	s.assertJobWithState(c, state.JobManageState, func(conf agent.Config, agentState *state.State) {
+		st, _, err := conf.OpenAPI(fastDialOpts)
 		c.Assert(err, gc.IsNil)
 		defer st.Close()
-		m, err := st.Machiner().Machine(conf.APIInfo.Tag)
+		m, err := st.Machiner().Machine(conf.Tag())
 		c.Assert(err, gc.IsNil)
 		c.Assert(m.Life(), gc.Equals, params.Alive)
 	})
 }
 
 func (s *MachineSuite) TestManageStateRunsCleaner(c *gc.C) {
-	s.assertJobWithState(c, state.JobManageState, func(conf *agent.Conf, agentState *state.State) {
+	s.assertJobWithState(c, state.JobManageState, func(conf agent.Config, agentState *state.State) {
 		// Create a service and unit, and destroy the service.
 		service, err := s.State.AddService("wordpress", s.AddTestingCharm(c, "wordpress"))
 		c.Assert(err, gc.IsNil)
@@ -419,7 +421,7 @@
 }
 
 func (s *MachineSuite) TestManageStateRunsMinUnitsWorker(c *gc.C) {
-	s.assertJobWithState(c, state.JobManageState, func(conf *agent.Conf, agentState *state.State) {
+	s.assertJobWithState(c, state.JobManageState, func(conf agent.Config, agentState *state.State) {
 		// Ensure that the MinUnits worker is alive by doing a simple check
 		// that it responds to state changes: add a service, set its minimum
 		// number of units to one, wait for the worker to add the missing unit.
@@ -451,38 +453,6 @@
 	})
 }
 
-var serveAPIWithBadConfTests = []struct {
-	change func(c *agent.Conf)
-	err    string
-}{{
-	func(c *agent.Conf) {
-		c.StateServerCert = nil
-	},
-	"configuration does not have state server cert/key",
-}, {
-	func(c *agent.Conf) {
-		c.StateServerKey = nil
-	},
-	"configuration does not have state server cert/key",
-}}
-
-func (s *MachineSuite) TestServeAPIWithBadConf(c *gc.C) {
-	m, conf, _ := s.primeAgent(c, state.JobManageState)
-	addAPIInfo(conf, m)
-	for i, t := range serveAPIWithBadConfTests {
-		c.Logf("test %d: %q", i, t.err)
-		conf1 := *conf
-		t.change(&conf1)
-		err := conf1.Write()
-		c.Assert(err, gc.IsNil)
-		a := s.newAgent(c, m)
-		err = runWithTimeout(a)
-		c.Assert(err, gc.ErrorMatches, t.err)
-		err = refreshConfig(conf)
-		c.Assert(err, gc.IsNil)
-	}
-}
-
 // opRecvTimeout waits for any of the given kinds of operation to
 // be received from ops, and times out if not.
 func opRecvTimeout(c *gc.C, st *state.State, opc <-chan dummy.Operation, kinds ...dummy.Operation) dummy.Operation {
@@ -504,5 +474,5 @@
 
 func (s *MachineSuite) TestOpenAPIState(c *gc.C) {
 	m, _, _ := s.primeAgent(c, state.JobHostUnits)
-	s.testOpenAPIState(c, m, s.newAgent(c, m))
+	s.testOpenAPIState(c, m, s.newAgent(c, m), initialMachinePassword)
 }

=== modified file 'cmd/jujud/unit.go'
--- cmd/jujud/unit.go	2013-08-02 14:04:05 +0000
+++ cmd/jujud/unit.go	2013-08-22 23:04:24 +0000
@@ -79,12 +79,12 @@
 
 // StateWorkers returns a worker that runs the unit agent workers.
 func (a *UnitAgent) StateWorkers() (worker.Worker, error) {
-	st, entity, err := openState(a.Conf.Conf, a)
+	st, entity, err := openState(a.Conf.config, a)
 	if err != nil {
 		return nil, err
 	}
 	unit := entity.(*state.Unit)
-	dataDir := a.Conf.DataDir
+	dataDir := a.Conf.dataDir
 	runner := worker.NewRunner(allFatal, moreImportant)
 	runner.StartWorker("uniter", func() (worker.Worker, error) {
 		return uniter.NewUniter(st, unit.Name(), dataDir), nil
@@ -93,11 +93,11 @@
 }
 
 func (a *UnitAgent) APIWorkers() (worker.Worker, error) {
-	st, entity, err := openAPIState(a.Conf.Conf, a)
+	st, entity, err := openAPIState(a.Conf.config, a)
 	if err != nil {
 		return nil, err
 	}
-	dataDir := a.Conf.DataDir
+	dataDir := a.Conf.dataDir
 	runner := worker.NewRunner(allFatal, moreImportant)
 	runner.StartWorker("upgrader", func() (worker.Worker, error) {
 		return upgrader.New(st.Upgrader(), entity.Tag(), dataDir), nil

=== modified file 'cmd/jujud/unit_test.go'
--- cmd/jujud/unit_test.go	2013-08-19 11:17:19 +0000
+++ cmd/jujud/unit_test.go	2013-08-22 23:04:24 +0000
@@ -33,18 +33,20 @@
 	s.GitSuite.TearDownTest(c)
 }
 
+const initialUnitPassword = "unit-password"
+
 // primeAgent creates a unit, and sets up the unit agent's directory.
 // It returns the new unit and the agent's configuration.
-func (s *UnitSuite) primeAgent(c *gc.C) (*state.Unit, *agent.Conf, *tools.Tools) {
+func (s *UnitSuite) primeAgent(c *gc.C) (*state.Unit, agent.Config, *tools.Tools) {
 	svc, err := s.State.AddService("wordpress", s.AddTestingCharm(c, "wordpress"))
 	c.Assert(err, gc.IsNil)
 	unit, err := svc.AddUnit()
 	c.Assert(err, gc.IsNil)
-	err = unit.SetMongoPassword("unit-password")
-	c.Assert(err, gc.IsNil)
-	err = unit.SetPassword("unit-password")
-	c.Assert(err, gc.IsNil)
-	conf, tools := s.agentSuite.primeAgent(c, unit.Tag(), "unit-password")
+	err = unit.SetMongoPassword(initialUnitPassword)
+	c.Assert(err, gc.IsNil)
+	err = unit.SetPassword(initialUnitPassword)
+	c.Assert(err, gc.IsNil)
+	conf, tools := s.agentSuite.primeAgent(c, unit.Tag(), initialUnitPassword)
 	return unit, conf, tools
 }
 
@@ -150,5 +152,5 @@
 func (s *UnitSuite) TestOpenAPIState(c *gc.C) {
 	c.Skip("unit agent API connection not implemented yet")
 	unit, _, _ := s.primeAgent(c)
-	s.testOpenAPIState(c, unit, s.newAgent(c, unit))
+	s.testOpenAPIState(c, unit, s.newAgent(c, unit), initialUnitPassword)
 }

=== modified file 'environs/bootstrap.go'
--- environs/bootstrap.go	2013-08-06 21:02:51 +0000
+++ environs/bootstrap.go	2013-08-22 23:04:24 +0000
@@ -9,7 +9,6 @@
 
 	"launchpad.net/juju-core/agent"
 	"launchpad.net/juju-core/constraints"
-	"launchpad.net/juju-core/environs/config"
 	"launchpad.net/juju-core/errors"
 	"launchpad.net/juju-core/instance"
 	"launchpad.net/juju-core/state"
@@ -82,31 +81,6 @@
 	return VerifyStorage(storage)
 }
 
-// BootstrapUsers creates the initial admin user for the database, and sets
-// the initial password.
-func BootstrapUsers(st *state.State, cfg *config.Config, passwordHash string) error {
-	logger.Debugf("adding admin user")
-	// Set up initial authentication.
-	u, err := st.AddUser("admin", "")
-	if err != nil {
-		return err
-	}
-
-	// Note that at bootstrap time, the password is set to
-	// the hash of its actual value. The first time a client
-	// connects to mongo, it changes the mongo password
-	// to the original password.
-	logger.Debugf("setting password hash for admin user")
-	if err := u.SetPasswordHash(passwordHash); err != nil {
-		return err
-	}
-	if err := st.SetAdminMongoPassword(passwordHash); err != nil {
-		return err
-	}
-	return nil
-
-}
-
 // ConfigureBootstrapMachine adds the initial machine into state.  As a part
 // of this process the environmental constraints are saved as constraints used
 // when bootstrapping are considered constraints for the entire environment.
@@ -136,17 +110,10 @@
 	if err != nil {
 		return err
 	}
-	newPassword, err := utils.RandomPassword()
+	newPassword, err := mconf.GenerateNewPassword()
 	if err != nil {
 		return err
 	}
-	mconf.StateInfo.Password = newPassword
-	mconf.APIInfo.Password = newPassword
-	mconf.OldPassword = ""
-
-	if err := mconf.Write(); err != nil {
-		return err
-	}
 	if err := m.SetMongoPassword(newPassword); err != nil {
 		return err
 	}

=== modified file 'environs/cloudinit/cloudinit.go'
--- environs/cloudinit/cloudinit.go	2013-08-09 06:56:44 +0000
+++ environs/cloudinit/cloudinit.go	2013-08-22 23:04:24 +0000
@@ -230,36 +230,45 @@
 	return filepath.Join(cfg.DataDir, name)
 }
 
-func (cfg *MachineConfig) agentConfig(tag string) *agent.Conf {
-	info := *cfg.StateInfo
-	apiInfo := *cfg.APIInfo
-	c := &agent.Conf{
-		DataDir:         cfg.DataDir,
-		StateInfo:       &info,
-		APIInfo:         &apiInfo,
-		StateServerCert: cfg.StateServerCert,
-		StateServerKey:  cfg.StateServerKey,
-		StatePort:       cfg.StatePort,
-		APIPort:         cfg.APIPort,
-		MachineNonce:    cfg.MachineNonce,
-	}
-	c.OldPassword = cfg.StateInfo.Password
-
-	c.StateInfo.Addrs = cfg.stateHostAddrs()
-	c.StateInfo.Tag = tag
-	c.StateInfo.Password = ""
-
-	c.APIInfo.Addrs = cfg.apiHostAddrs()
-	c.APIInfo.Tag = tag
-	c.APIInfo.Password = ""
-
-	return c
+func (cfg *MachineConfig) agentConfig(tag string) (agent.Config, error) {
+	// TODO for HAState: the stateHostAddrs and apiHostAddrs here assume that
+	// if the machine is a stateServer then to use localhost.  This may be
+	// sufficient, but needs thought in the new world order.
+	var password string
+	if cfg.StateInfo == nil {
+		password = cfg.APIInfo.Password
+	} else {
+		password = cfg.StateInfo.Password
+	}
+	var configParams = agent.AgentConfigParams{
+		DataDir:        cfg.DataDir,
+		Tag:            tag,
+		Password:       password,
+		Nonce:          cfg.MachineNonce,
+		StateAddresses: cfg.stateHostAddrs(),
+		APIAddresses:   cfg.apiHostAddrs(),
+		CACert:         cfg.StateInfo.CACert,
+	}
+	if cfg.StateServer {
+		return agent.NewStateMachineConfig(
+			agent.StateMachineConfigParams{
+				AgentConfigParams: configParams,
+				StateServerCert:   cfg.StateServerCert,
+				StateServerKey:    cfg.StateServerKey,
+				StatePort:         cfg.StatePort,
+				APIPort:           cfg.APIPort,
+			})
+	}
+	return agent.NewAgentConfig(configParams)
 }
 
 // addAgentInfo adds agent-required information to the agent's directory
 // and returns the agent directory name.
-func (cfg *MachineConfig) addAgentInfo(c *cloudinit.Config, tag string) (*agent.Conf, error) {
-	acfg := cfg.agentConfig(tag)
+func (cfg *MachineConfig) addAgentInfo(c *cloudinit.Config, tag string) (agent.Config, error) {
+	acfg, err := cfg.agentConfig(tag)
+	if err != nil {
+		return nil, err
+	}
 	cmds, err := acfg.WriteCommands()
 	if err != nil {
 		return nil, err

=== modified file 'environs/cloudinit/cloudinit_test.go'
--- environs/cloudinit/cloudinit_test.go	2013-08-20 14:02:31 +0000
+++ environs/cloudinit/cloudinit_test.go	2013-08-22 23:04:24 +0000
@@ -96,7 +96,7 @@
 restart rsyslog
 mkdir -p '/var/lib/juju/agents/machine-0'
 install -m 600 /dev/null '/var/lib/juju/agents/machine-0/agent\.conf'
-printf '%s\\n' 'datadir: /var/lib/juju\\nstateservercert:\\n[^']+stateserverkey:\\n[^']+stateport: 37017\\napiport: 17070\\noldpassword: arble\\nmachinenonce: FAKE_NONCE\\nstateinfo:\\n  addrs:\\n  - localhost:37017\\n  cacert:\\n[^']+  tag: machine-0\\n  password: ""\\noldapipassword: ""\\napiinfo:\\n  addrs:\\n  - localhost:17070\\n  cacert:\\n[^']+  tag: machine-0\\n  password: ""\\n' > '/var/lib/juju/agents/machine-0/agent\.conf'
+printf '%s\\n' 'stateservercert:\\n[^']+stateserverkey:\\n[^']+stateport: 37017\\napiport: 17070\\noldpassword: arble\\nmachinenonce: FAKE_NONCE\\nstateinfo:\\n  addrs:\\n  - localhost:37017\\n  cacert:\\n[^']+  tag: machine-0\\n  password: ""\\noldapipassword: ""\\napiinfo:\\n  addrs:\\n  - localhost:17070\\n  cacert:\\n[^']+  tag: machine-0\\n  password: ""\\n' > '/var/lib/juju/agents/machine-0/agent\.conf'
 install -m 600 /dev/null '/var/lib/juju/server\.pem'
 printf '%s\\n' 'SERVER CERT\\n[^']*SERVER KEY\\n[^']*' > '/var/lib/juju/server\.pem'
 mkdir -p /var/lib/juju/db/journal
@@ -107,7 +107,7 @@
 start juju-db
 mkdir -p '/var/lib/juju/agents/bootstrap'
 install -m 600 /dev/null '/var/lib/juju/agents/bootstrap/agent\.conf'
-printf '%s\\n' 'datadir: /var/lib/juju\\nstateservercert:\\n[^']+stateserverkey:\\n[^']+stateport: 37017\\napiport: 17070\\noldpassword: arble\\nmachinenonce: FAKE_NONCE\\nstateinfo:\\n  addrs:\\n  - localhost:37017\\n  cacert:\\n[^']+  tag: bootstrap\\n  password: ""\\noldapipassword: ""\\napiinfo:\\n  addrs:\\n  - localhost:17070\\n  cacert:\\n[^']+  tag: bootstrap\\n  password: ""\\n' > '/var/lib/juju/agents/bootstrap/agent\.conf'
+printf '%s\\n' 'stateservercert:\\n[^']+stateserverkey:\\n[^']+stateport: 37017\\napiport: 17070\\noldpassword: arble\\nmachinenonce: FAKE_NONCE\\nstateinfo:\\n  addrs:\\n  - localhost:37017\\n  cacert:\\n[^']+  tag: bootstrap\\n  password: ""\\noldapipassword: ""\\napiinfo:\\n  addrs:\\n  - localhost:17070\\n  cacert:\\n[^']+  tag: bootstrap\\n  password: ""\\n' > '/var/lib/juju/agents/bootstrap/agent\.conf'
 echo 'some-url' > /tmp/provider-state-url
 /var/lib/juju/tools/1\.2\.3-precise-amd64/jujud bootstrap-state --data-dir '/var/lib/juju' --env-config '[^']*' --constraints 'mem=2048M' --debug
 rm -rf '/var/lib/juju/agents/bootstrap'
@@ -155,7 +155,7 @@
 restart rsyslog
 mkdir -p '/var/lib/juju/agents/machine-0'
 install -m 600 /dev/null '/var/lib/juju/agents/machine-0/agent\.conf'
-printf '%s\\n' 'datadir: /var/lib/juju\\nstateservercert:\\n[^']+stateserverkey:\\n[^']+stateport: 37017\\napiport: 17070\\noldpassword: arble\\nmachinenonce: FAKE_NONCE\\nstateinfo:\\n  addrs:\\n  - localhost:37017\\n  cacert:\\n[^']+  tag: machine-0\\n  password: ""\\noldapipassword: ""\\napiinfo:\\n  addrs:\\n  - localhost:17070\\n  cacert:\\n[^']+  tag: machine-0\\n  password: ""\\n' > '/var/lib/juju/agents/machine-0/agent\.conf'
+printf '%s\\n' 'stateservercert:\\n[^']+stateserverkey:\\n[^']+stateport: 37017\\napiport: 17070\\noldpassword: arble\\nmachinenonce: FAKE_NONCE\\nstateinfo:\\n  addrs:\\n  - localhost:37017\\n  cacert:\\n[^']+  tag: machine-0\\n  password: ""\\noldapipassword: ""\\napiinfo:\\n  addrs:\\n  - localhost:17070\\n  cacert:\\n[^']+  tag: machine-0\\n  password: ""\\n' > '/var/lib/juju/agents/machine-0/agent\.conf'
 install -m 600 /dev/null '/var/lib/juju/server\.pem'
 printf '%s\\n' 'SERVER CERT\\n[^']*SERVER KEY\\n[^']*' > '/var/lib/juju/server\.pem'
 mkdir -p /var/lib/juju/db/journal
@@ -166,7 +166,7 @@
 start juju-db
 mkdir -p '/var/lib/juju/agents/bootstrap'
 install -m 600 /dev/null '/var/lib/juju/agents/bootstrap/agent\.conf'
-printf '%s\\n' 'datadir: /var/lib/juju\\nstateservercert:\\n[^']+stateserverkey:\\n[^']+stateport: 37017\\napiport: 17070\\noldpassword: arble\\nmachinenonce: FAKE_NONCE\\nstateinfo:\\n  addrs:\\n  - localhost:37017\\n  cacert:\\n[^']+  tag: bootstrap\\n  password: ""\\noldapipassword: ""\\napiinfo:\\n  addrs:\\n  - localhost:17070\\n  cacert:\\n[^']+  tag: bootstrap\\n  password: ""\\n' > '/var/lib/juju/agents/bootstrap/agent\.conf'
+printf '%s\\n' 'stateservercert:\\n[^']+stateserverkey:\\n[^']+stateport: 37017\\napiport: 17070\\noldpassword: arble\\nmachinenonce: FAKE_NONCE\\nstateinfo:\\n  addrs:\\n  - localhost:37017\\n  cacert:\\n[^']+  tag: bootstrap\\n  password: ""\\noldapipassword: ""\\napiinfo:\\n  addrs:\\n  - localhost:17070\\n  cacert:\\n[^']+  tag: bootstrap\\n  password: ""\\n' > '/var/lib/juju/agents/bootstrap/agent\.conf'
 echo 'some-url' > /tmp/provider-state-url
 /var/lib/juju/tools/1\.2\.3-raring-amd64/jujud bootstrap-state --data-dir '/var/lib/juju' --env-config '[^']*' --constraints 'mem=2048M' --debug
 rm -rf '/var/lib/juju/agents/bootstrap'
@@ -209,7 +209,7 @@
 restart rsyslog
 mkdir -p '/var/lib/juju/agents/machine-99'
 install -m 600 /dev/null '/var/lib/juju/agents/machine-99/agent\.conf'
-printf '%s\\n' 'datadir: /var/lib/juju\\noldpassword: arble\\nmachinenonce: FAKE_NONCE\\nstateinfo:\\n  addrs:\\n  - state-addr\.testing\.invalid:12345\\n  cacert:\\n[^']+  tag: machine-99\\n  password: ""\\noldapipassword: ""\\napiinfo:\\n  addrs:\\n  - state-addr\.testing\.invalid:54321\\n  cacert:\\n[^']+  tag: machine-99\\n  password: ""\\n' > '/var/lib/juju/agents/machine-99/agent\.conf'
+printf '%s\\n' 'oldpassword: arble\\nmachinenonce: FAKE_NONCE\\nstateinfo:\\n  addrs:\\n  - state-addr\.testing\.invalid:12345\\n  cacert:\\n[^']+  tag: machine-99\\n  password: ""\\noldapipassword: ""\\napiinfo:\\n  addrs:\\n  - state-addr\.testing\.invalid:54321\\n  cacert:\\n[^']+  tag: machine-99\\n  password: ""\\n' > '/var/lib/juju/agents/machine-99/agent\.conf'
 ln -s 1\.2\.3-linux-amd64 '/var/lib/juju/tools/machine-99'
 cat >> /etc/init/jujud-machine-99\.conf << 'EOF'\\ndescription "juju machine-99 agent"\\nauthor "Juju Team <juju@lists\.ubuntu\.com>"\\nstart on runlevel \[2345\]\\nstop on runlevel \[!2345\]\\nrespawn\\nnormal exit 0\\nenv JUJU_PROVIDER_TYPE="dummy"\\n\\nlimit nofile 20000 20000\\n\\nexec /var/lib/juju/tools/machine-99/jujud machine --log-file '/var/log/juju/machine-99\.log' --data-dir '/var/lib/juju' --machine-id 99  --debug >> /var/log/juju/machine-99\.log 2>&1\\nEOF\\n
 start jujud-machine-99
@@ -250,7 +250,7 @@
 restart rsyslog
 mkdir -p '/var/lib/juju/agents/machine-2-lxc-1'
 install -m 600 /dev/null '/var/lib/juju/agents/machine-2-lxc-1/agent\.conf'
-printf '%s\\n' 'datadir: /var/lib/juju\\noldpassword: arble\\nmachinenonce: FAKE_NONCE\\nstateinfo:\\n  addrs:\\n  - state-addr\.testing\.invalid:12345\\n  cacert:\\n[^']+  tag: machine-2-lxc-1\\n  password: ""\\noldapipassword: ""\\napiinfo:\\n  addrs:\\n  - state-addr\.testing\.invalid:54321\\n  cacert:\\n[^']+  tag: machine-2-lxc-1\\n  password: ""\\n' > '/var/lib/juju/agents/machine-2-lxc-1/agent\.conf'
+printf '%s\\n' 'oldpassword: arble\\nmachinenonce: FAKE_NONCE\\nstateinfo:\\n  addrs:\\n  - state-addr\.testing\.invalid:12345\\n  cacert:\\n[^']+  tag: machine-2-lxc-1\\n  password: ""\\noldapipassword: ""\\napiinfo:\\n  addrs:\\n  - state-addr\.testing\.invalid:54321\\n  cacert:\\n[^']+  tag: machine-2-lxc-1\\n  password: ""\\n' > '/var/lib/juju/agents/machine-2-lxc-1/agent\.conf'
 ln -s 1\.2\.3-linux-amd64 '/var/lib/juju/tools/machine-2-lxc-1'
 cat >> /etc/init/jujud-machine-2-lxc-1\.conf << 'EOF'\\ndescription "juju machine-2-lxc-1 agent"\\nauthor "Juju Team <juju@lists\.ubuntu\.com>"\\nstart on runlevel \[2345\]\\nstop on runlevel \[!2345\]\\nrespawn\\nnormal exit 0\\nenv JUJU_PROVIDER_TYPE="dummy"\\n\\nlimit nofile 20000 20000\\n\\nexec /var/lib/juju/tools/machine-2-lxc-1/jujud machine --log-file '/var/log/juju/machine-2-lxc-1\.log' --data-dir '/var/lib/juju' --machine-id 2/lxc/1  --debug >> /var/log/juju/machine-2-lxc-1\.log 2>&1\\nEOF\\n
 start jujud-machine-2-lxc-1
@@ -572,8 +572,9 @@
 		AuthorizedKeys:     "sshkey1",
 		MachineEnvironment: map[string]string{osenv.JujuProviderType: "dummy"},
 		StateInfo: &state.Info{
-			Addrs:  []string{"host:98765"},
-			CACert: []byte(testing.CACert),
+			Addrs:    []string{"host:98765"},
+			CACert:   []byte(testing.CACert),
+			Password: "password",
 		},
 		APIInfo: &api.Info{
 			Addrs:  []string{"host:9999"},

=== modified file 'provider/azure/config_test.go'
--- provider/azure/config_test.go	2013-08-09 05:36:08 +0000
+++ provider/azure/config_test.go	2013-08-22 23:04:24 +0000
@@ -13,7 +13,9 @@
 	"launchpad.net/juju-core/testing"
 )
 
-type configSuite struct{}
+type configSuite struct {
+	testing.LoggingSuite
+}
 
 var _ = gc.Suite(&configSuite{})
 

=== modified file 'provider/azure/customdata_test.go'
--- provider/azure/customdata_test.go	2013-08-01 04:34:27 +0000
+++ provider/azure/customdata_test.go	2013-08-22 23:04:24 +0000
@@ -17,7 +17,9 @@
 	"launchpad.net/juju-core/testing"
 )
 
-type customDataSuite struct{}
+type customDataSuite struct {
+	testing.LoggingSuite
+}
 
 var _ = gc.Suite(&customDataSuite{})
 
@@ -31,9 +33,10 @@
 		DataDir:      dir,
 		Tools:        &tools.Tools{URL: "file://" + dir},
 		StateInfo: &state.Info{
-			CACert: []byte(testing.CACert),
-			Addrs:  []string{"127.0.0.1:123"},
-			Tag:    names.MachineTag(machineID),
+			CACert:   []byte(testing.CACert),
+			Addrs:    []string{"127.0.0.1:123"},
+			Tag:      names.MachineTag(machineID),
+			Password: "password",
 		},
 		APIInfo: &api.Info{
 			CACert: []byte(testing.CACert),

=== modified file 'provider/ec2/config_test.go'
--- provider/ec2/config_test.go	2013-08-19 11:19:07 +0000
+++ provider/ec2/config_test.go	2013-08-22 23:04:24 +0000
@@ -7,20 +7,23 @@
 
 import (
 	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+
 	"launchpad.net/goamz/aws"
 	gc "launchpad.net/gocheck"
 	"launchpad.net/goyaml"
+
 	"launchpad.net/juju-core/environs"
 	"launchpad.net/juju-core/environs/config"
 	"launchpad.net/juju-core/testing"
-	"os"
-	"path/filepath"
-	"strings"
 )
 
 // Use local suite since this file lives in the ec2 package
 // for testing internals.
 type ConfigSuite struct {
+	testing.LoggingSuite
 	savedHome, savedAccessKey, savedSecretKey string
 }
 
@@ -301,6 +304,7 @@
 }
 
 func (s *ConfigSuite) SetUpTest(c *gc.C) {
+	s.LoggingSuite.SetUpTest(c)
 	s.savedHome = os.Getenv("HOME")
 	s.savedAccessKey = os.Getenv("AWS_ACCESS_KEY_ID")
 	s.savedSecretKey = os.Getenv("AWS_SECRET_ACCESS_KEY")
@@ -323,6 +327,7 @@
 	os.Setenv("AWS_ACCESS_KEY_ID", s.savedAccessKey)
 	os.Setenv("AWS_SECRET_ACCESS_KEY", s.savedSecretKey)
 	delete(aws.Regions, "configtest")
+	s.LoggingSuite.TearDownTest(c)
 }
 
 func (s *ConfigSuite) TestConfig(c *gc.C) {

=== modified file 'provider/ec2/local_test.go'
--- provider/ec2/local_test.go	2013-08-22 21:27:52 +0000
+++ provider/ec2/local_test.go	2013-08-22 23:04:24 +0000
@@ -280,6 +280,7 @@
 	// provisioning agent.
 	series := t.env.Config().DefaultSeries()
 	info.Tag = "machine-1"
+	info.Password = "password"
 	apiInfo.Tag = "machine-1"
 	inst1, hc, err := t.env.StartInstance("1", "fake_nonce", series, constraints.Value{}, info, apiInfo)
 	c.Assert(err, gc.IsNil)
@@ -314,6 +315,7 @@
 	c.Assert(err, gc.IsNil)
 	c.Assert(info, gc.NotNil)
 	info.Tag = "machine-1"
+	info.Password = "password"
 	apiInfo.Tag = "machine-1"
 	t.srv.ec2srv.SetInitialInstanceState(ec2test.Terminated)
 	inst, _, err := t.env.StartInstance("1", "fake_nonce", series, constraints.Value{}, info, apiInfo)
@@ -329,6 +331,7 @@
 	c.Assert(err, gc.IsNil)
 	c.Assert(info, gc.NotNil)
 	info.Tag = "machine-1"
+	info.Password = "password"
 	apiInfo.Tag = "machine-1"
 	_, hc, err := t.env.StartInstance("1", "fake_nonce", series, constraints.MustParse("mem=1024"), info, apiInfo)
 	c.Assert(err, gc.IsNil)
@@ -346,6 +349,7 @@
 	c.Assert(err, gc.IsNil)
 	c.Assert(info, gc.NotNil)
 	info.Tag = "machine-1"
+	info.Password = "password"
 	apiInfo.Tag = "machine-1"
 	inst, _, err := t.env.StartInstance("1", "fake_nonce", series, constraints.Value{}, info, apiInfo)
 	c.Assert(err, gc.IsNil)

=== modified file 'provider/local/environ.go'
--- provider/local/environ.go	2013-08-13 04:55:12 +0000
+++ provider/local/environ.go	2013-08-22 23:04:24 +0000
@@ -125,13 +125,14 @@
 	// Need to write out the agent file for machine-0 before initializing
 	// state, as as part of that process, it will reset the password in the
 	// agent file.
-	if err := env.writeBootstrapAgentConfFile(cert, key); err != nil {
+	agentConfig, err := env.writeBootstrapAgentConfFile(env.config.AdminSecret(), cert, key)
+	if err != nil {
 		return err
 	}
 
 	// Have to initialize the state configuration with localhost so we get
 	// "special" permissions.
-	stateConnection, err := env.initialStateConfiguration(boostrapInstanceId, cons)
+	stateConnection, err := env.initialStateConfiguration(agentConfig, cons)
 	if err != nil {
 		return err
 	}
@@ -493,59 +494,57 @@
 	return getAddressForInterface(lxcBridgeName)
 }
 
-func (env *localEnviron) writeBootstrapAgentConfFile(cert, key []byte) error {
-	info, apiInfo, err := env.StateInfo()
-	if err != nil {
-		logger.Errorf("failed to get state info to write bootstrap agent file: %v", err)
-		return err
-	}
+func (env *localEnviron) writeBootstrapAgentConfFile(secret string, cert, key []byte) (agent.Config, error) {
 	tag := names.MachineTag("0")
-	info.Tag = tag
-	apiInfo.Tag = tag
-	conf := &agent.Conf{
-		DataDir:         env.config.rootDir(),
-		StateInfo:       info,
-		APIInfo:         apiInfo,
-		StateServerCert: cert,
-		StateServerKey:  key,
-		StatePort:       env.config.StatePort(),
-		APIPort:         env.config.APIPort(),
-		MachineNonce:    state.BootstrapNonce,
-	}
-	if err := conf.Write(); err != nil {
-		logger.Errorf("failed to write bootstrap agent file: %v", err)
-		return err
-	}
-	return nil
-}
-
-func (env *localEnviron) initialStateConfiguration(addr string, cons constraints.Value) (*state.State, error) {
+	passwordHash := utils.PasswordHash(secret)
 	// We don't check the existance of the CACert here as if it wasn't set, we
 	// wouldn't get this far.
 	cfg := env.config.Config
 	caCert, _ := cfg.CACert()
-	addr = fmt.Sprintf("%s:%d", addr, cfg.StatePort())
-	info := &state.Info{
-		Addrs:  []string{addr},
-		CACert: caCert,
-	}
+	// NOTE: the state address HAS to be localhost, otherwise the mongo
+	// initialization fails.  There is some magic code somewhere in the mongo
+	// connection code that treats connections from localhost as special, and
+	// will raise unauthorized errors during the initialization if the caller
+	// is not connected from localhost.
+	stateAddress := fmt.Sprintf("localhost:%d", cfg.StatePort())
+	apiAddress := fmt.Sprintf("localhost:%d", cfg.APIPort())
+	config, err := agent.NewStateMachineConfig(
+		agent.StateMachineConfigParams{
+			AgentConfigParams: agent.AgentConfigParams{
+				DataDir:        env.config.rootDir(),
+				Tag:            tag,
+				Password:       passwordHash,
+				Nonce:          state.BootstrapNonce,
+				StateAddresses: []string{stateAddress},
+				APIAddresses:   []string{apiAddress},
+				CACert:         caCert,
+			},
+			StateServerCert: cert,
+			StateServerKey:  key,
+			StatePort:       cfg.StatePort(),
+			APIPort:         cfg.APIPort(),
+		})
+	if err != nil {
+		return nil, err
+	}
+	if err := config.Write(); err != nil {
+		logger.Errorf("failed to write bootstrap agent file: %v", err)
+		return nil, err
+	}
+	return config, nil
+}
+
+func (env *localEnviron) initialStateConfiguration(agentConfig agent.Config, cons constraints.Value) (*state.State, error) {
 	timeout := state.DialOpts{60 * time.Second}
-	bootstrap, err := environs.BootstrapConfig(cfg)
-	if err != nil {
-		return nil, err
-	}
-	st, err := state.Initialize(info, bootstrap, timeout)
-	if err != nil {
-		logger.Errorf("failed to initialize state: %v", err)
-		return nil, err
-	}
-	logger.Debugf("state initialized")
+	bootstrap, err := environs.BootstrapConfig(env.config.Config)
+	if err != nil {
+		return nil, err
+	}
+	st, err := agent.InitialStateConfiguration(agentConfig, bootstrap, timeout)
+	if err != nil {
+		return nil, err
+	}
 
-	passwordHash := utils.PasswordHash(cfg.AdminSecret())
-	if err := environs.BootstrapUsers(st, cfg, passwordHash); err != nil {
-		st.Close()
-		return nil, err
-	}
 	jobs := []state.MachineJob{state.JobManageEnviron, state.JobManageState}
 
 	if err := environs.ConfigureBootstrapMachine(

=== modified file 'provider/maas/config_test.go'
--- provider/maas/config_test.go	2013-08-09 04:58:34 +0000
+++ provider/maas/config_test.go	2013-08-22 23:04:24 +0000
@@ -11,7 +11,9 @@
 	"launchpad.net/juju-core/version"
 )
 
-type configSuite struct{}
+type configSuite struct {
+	testing.LoggingSuite
+}
 
 var _ = gc.Suite(&configSuite{})
 

=== modified file 'provider/maas/environ_test.go'
--- provider/maas/environ_test.go	2013-08-15 17:49:53 +0000
+++ provider/maas/environ_test.go	2013-08-22 23:04:24 +0000
@@ -257,6 +257,7 @@
 	stateInfo, apiInfo, err := env.StateInfo()
 	c.Assert(err, gc.IsNil)
 	stateInfo.Tag = "machine-1"
+	stateInfo.Password = "password"
 	apiInfo.Tag = "machine-1"
 	series := version.Current.Series
 	nonce := "12345"

=== modified file 'provider/openstack/config_test.go'
--- provider/openstack/config_test.go	2013-07-23 05:02:37 +0000
+++ provider/openstack/config_test.go	2013-08-22 23:04:24 +0000
@@ -19,6 +19,7 @@
 )
 
 type ConfigSuite struct {
+	testing.LoggingSuite
 	savedVars   map[string]string
 	oldJujuHome *testing.FakeHome
 }
@@ -178,6 +179,7 @@
 }
 
 func (s *ConfigSuite) SetUpTest(c *gc.C) {
+	s.LoggingSuite.SetUpTest(c)
 	s.oldJujuHome = testing.MakeEmptyFakeHome(c)
 	s.savedVars = make(map[string]string)
 	for v, val := range envVars {
@@ -191,6 +193,7 @@
 		os.Setenv(k, v)
 	}
 	s.oldJujuHome.Restore()
+	s.LoggingSuite.TearDownTest(c)
 }
 
 var configTests = []configTest{
@@ -469,17 +472,13 @@
 func (s *ConfigDeprecationSuite) setupLogger(c *gc.C) {
 	var err error
 	s.writer = &testWriter{}
-	s.oldWriter, s.oldLevel, err = loggo.RemoveWriter("default")
-	c.Assert(err, gc.IsNil)
-	err = loggo.RegisterWriter("test", s.writer, loggo.TRACE)
+	err = loggo.RegisterWriter("test", s.writer, loggo.WARNING)
 	c.Assert(err, gc.IsNil)
 }
 
 func (s *ConfigDeprecationSuite) resetLogger(c *gc.C) {
 	_, _, err := loggo.RemoveWriter("test")
 	c.Assert(err, gc.IsNil)
-	err = loggo.RegisterWriter("default", s.oldWriter, s.oldLevel)
-	c.Assert(err, gc.IsNil)
 }
 
 type testWriter struct {

=== modified file 'provider/openstack/local_test.go'
--- provider/openstack/local_test.go	2013-08-21 01:26:36 +0000
+++ provider/openstack/local_test.go	2013-08-22 23:04:24 +0000
@@ -460,6 +460,7 @@
 	// and without a provisioning agent.
 	series := s.env.Config().DefaultSeries()
 	info.Tag = "machine-1"
+	info.Password = "password"
 	apiInfo.Tag = "machine-1"
 	inst1, _, err := s.env.StartInstance("1", "fake_nonce", series, constraints.Value{}, info, apiInfo)
 	c.Assert(err, gc.IsNil)

=== modified file 'state/open.go'
--- state/open.go	2013-08-06 21:02:51 +0000
+++ state/open.go	2013-08-22 23:04:24 +0000
@@ -19,7 +19,6 @@
 	"launchpad.net/juju-core/constraints"
 	"launchpad.net/juju-core/environs/config"
 	"launchpad.net/juju-core/errors"
-	"launchpad.net/juju-core/log"
 	"launchpad.net/juju-core/state/presence"
 	"launchpad.net/juju-core/state/watcher"
 	"launchpad.net/juju-core/utils"
@@ -66,7 +65,7 @@
 // representing the environment connected to.
 // It returns unauthorizedError if access is unauthorized.
 func Open(info *Info, opts DialOpts) (*State, error) {
-	log.Infof("state: opening state; mongo addresses: %q; entity %q", info.Addrs, info.Tag)
+	logger.Infof("opening state; mongo addresses: %q; entity %q", info.Addrs, info.Tag)
 	if len(info.Addrs) == 0 {
 		return nil, stderrors.New("no mongo addresses")
 	}
@@ -86,12 +85,12 @@
 	dial := func(addr net.Addr) (net.Conn, error) {
 		c, err := net.Dial("tcp", addr.String())
 		if err != nil {
-			log.Errorf("state: connection failed, will retry: %v", err)
+			logger.Debugf("connection failed, will retry: %v", err)
 			return nil, err
 		}
 		cc := tls.Client(c, tlsConfig)
 		if err := cc.Handshake(); err != nil {
-			log.Errorf("state: TLS handshake failed: %v", err)
+			logger.Errorf("TLS handshake failed: %v", err)
 			return nil, err
 		}
 		return cc, nil
@@ -104,7 +103,7 @@
 	if err != nil {
 		return nil, err
 	}
-	log.Infof("state: connection established")
+	logger.Infof("connection established")
 	st, err := newState(session, info)
 	if err != nil {
 		session.Close()
@@ -134,7 +133,7 @@
 	} else if !errors.IsNotFoundError(err) {
 		return nil, err
 	}
-	log.Infof("state: initializing environment")
+	logger.Infof("initializing environment")
 	if err := checkEnvironConfig(cfg); err != nil {
 		return nil, err
 	}

=== modified file 'state/state.go'
--- state/state.go	2013-08-21 09:27:41 +0000
+++ state/state.go	2013-08-22 23:04:24 +0000
@@ -17,13 +17,13 @@
 	"labix.org/v2/mgo"
 	"labix.org/v2/mgo/bson"
 	"labix.org/v2/mgo/txn"
+	"launchpad.net/loggo"
 
 	"launchpad.net/juju-core/charm"
 	"launchpad.net/juju-core/constraints"
 	"launchpad.net/juju-core/environs/config"
 	"launchpad.net/juju-core/errors"
 	"launchpad.net/juju-core/instance"
-	"launchpad.net/juju-core/log"
 	"launchpad.net/juju-core/names"
 	"launchpad.net/juju-core/state/api/params"
 	"launchpad.net/juju-core/state/multiwatcher"
@@ -32,6 +32,8 @@
 	"launchpad.net/juju-core/utils"
 )
 
+var logger = loggo.GetLogger("juju.state")
+
 // TODO(niemeyer): This must not be exported.
 type D []bson.DocElem
 
@@ -1122,7 +1124,7 @@
 			err = fmt.Errorf("unknown cleanup kind %q", doc.Kind)
 		}
 		if err != nil {
-			log.Warningf("cleanup failed: %v", err)
+			logger.Warningf("cleanup failed: %v", err)
 			continue
 		}
 		ops := []txn.Op{{

=== modified file 'testing/mgo.go'
--- testing/mgo.go	2013-07-31 08:17:33 +0000
+++ testing/mgo.go	2013-08-22 23:04:24 +0000
@@ -32,6 +32,9 @@
 	// MgoTestPackage.
 	MgoAddr string
 
+	// MgoPort holds the port used by the shared MongoDB server.
+	MgoPort int
+
 	// mgoServer holds the running MongoDB command.
 	mgoServer *exec.Cmd
 
@@ -65,7 +68,8 @@
 	if err != nil {
 		return fmt.Errorf("cannot write cert/key PEM: %v", err)
 	}
-	mgoport := strconv.Itoa(FindTCPPort())
+	MgoPort = FindTCPPort()
+	mgoport := strconv.Itoa(MgoPort)
 	mgoargs := []string{
 		"--auth",
 		"--dbpath", dbdir,

=== modified file 'worker/deployer/simple.go'
--- worker/deployer/simple.go	2013-07-31 21:44:45 +0000
+++ worker/deployer/simple.go	2013-08-22 23:04:24 +0000
@@ -16,8 +16,6 @@
 	"launchpad.net/juju-core/juju/osenv"
 	"launchpad.net/juju-core/log/syslog"
 	"launchpad.net/juju-core/names"
-	"launchpad.net/juju-core/state" // Only because of state.Info
-	"launchpad.net/juju-core/state/api"
 	"launchpad.net/juju-core/upstart"
 	"launchpad.net/juju-core/version"
 )
@@ -89,33 +87,29 @@
 	defer removeOnErr(&err, toolsDir)
 
 	// Retrieve the state addresses.
+	// TODO: remove the state addresses when unit agent is API only.
 	stateAddrs, err := ctx.addresser.StateAddresses()
 	if err != nil {
 		return err
 	}
+	logger.Debugf("state addresses: %q", stateAddrs)
 	apiAddrs, err := ctx.addresser.APIAddresses()
 	if err != nil {
 		return err
 	}
-
-	stateInfo := state.Info{
-		Addrs:  stateAddrs,
-		Tag:    tag,
-		CACert: ctx.caCert,
-	}
-	logger.Debugf("state addresses: %q", stateAddrs)
-	apiInfo := api.Info{
-		Addrs:  apiAddrs,
-		Tag:    tag,
-		CACert: ctx.caCert,
-	}
 	logger.Debugf("API addresses: %q", apiAddrs)
-	// Prepare the agent's configuration data.
-	conf := &agent.Conf{
-		DataDir:     ctx.dataDir,
-		OldPassword: initialPassword,
-		StateInfo:   &stateInfo,
-		APIInfo:     &apiInfo,
+	conf, err := agent.NewAgentConfig(
+		agent.AgentConfigParams{
+			DataDir:        ctx.dataDir,
+			Tag:            tag,
+			Password:       initialPassword,
+			Nonce:          "unused",
+			StateAddresses: stateAddrs,
+			APIAddresses:   apiAddrs,
+			CACert:         ctx.caCert,
+		})
+	if err != nil {
+		return err
 	}
 	if err := conf.Write(); err != nil {
 		return err
@@ -138,7 +132,7 @@
 
 	cmd := strings.Join([]string{
 		path.Join(toolsDir, "jujud"), "unit",
-		"--data-dir", conf.DataDir,
+		"--data-dir", conf.DataDir(),
 		"--unit-name", unitName,
 		"--debug", // TODO: propagate debug state sensibly
 	}, " ")

=== modified file 'worker/deployer/simple_test.go'
--- worker/deployer/simple_test.go	2013-08-19 11:20:02 +0000
+++ worker/deployer/simple_test.go	2013-08-22 23:04:24 +0000
@@ -17,8 +17,7 @@
 	"launchpad.net/juju-core/agent"
 	"launchpad.net/juju-core/agent/tools"
 	"launchpad.net/juju-core/names"
-	"launchpad.net/juju-core/state"
-	"launchpad.net/juju-core/state/api"
+	"launchpad.net/juju-core/testing"
 	"launchpad.net/juju-core/testing/checkers"
 	"launchpad.net/juju-core/version"
 	"launchpad.net/juju-core/worker/deployer"
@@ -130,6 +129,7 @@
 }
 
 type SimpleToolsFixture struct {
+	testing.LoggingSuite
 	dataDir         string
 	initDir         string
 	logDir          string
@@ -141,6 +141,7 @@
 var fakeJujud = "#!/bin/bash\n# fake-jujud\nexit 0\n"
 
 func (fix *SimpleToolsFixture) SetUp(c *gc.C, dataDir string) {
+	fix.LoggingSuite.SetUpTest(c)
 	fix.dataDir = dataDir
 	fix.initDir = c.MkDir()
 	fix.logDir = c.MkDir()
@@ -166,6 +167,7 @@
 
 func (fix *SimpleToolsFixture) TearDown(c *gc.C) {
 	os.Setenv("PATH", fix.origPath)
+	fix.LoggingSuite.TearDownTest(c)
 }
 
 func (fix *SimpleToolsFixture) makeBin(c *gc.C, name, script string) {
@@ -240,20 +242,8 @@
 
 	conf, err := agent.ReadConf(fix.dataDir, tag)
 	c.Assert(err, gc.IsNil)
-	c.Assert(conf, gc.DeepEquals, &agent.Conf{
-		DataDir:     fix.dataDir,
-		OldPassword: password,
-		StateInfo: &state.Info{
-			Addrs:  []string{"s1:123", "s2:123"},
-			CACert: []byte("test-cert"),
-			Tag:    tag,
-		},
-		APIInfo: &api.Info{
-			Addrs:  []string{"a1:123", "a2:123"},
-			CACert: []byte("test-cert"),
-			Tag:    tag,
-		},
-	})
+	c.Assert(conf.Tag(), gc.Equals, tag)
+	c.Assert(conf.DataDir(), gc.Equals, fix.dataDir)
 
 	jujudData, err := ioutil.ReadFile(jujudPath)
 	c.Assert(err, gc.IsNil)