diff --git a/CHANGELOG b/CHANGELOG
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,14 @@
+propellor (0.9.2) unstable; urgency=medium
+
+  * Added nginx module, contributed by Félix Sipma.
+  * Added firewall module, contributed by Arnaud Bailly.
+  * Apache: Fix daemon reload when enabling a new module or site.
+  * Docker: Stop using docker.io; that was a compat symlink in
+    the Debian package which has been removed in docker.io 1.3.1~dfsg1-2.
+  * Orphaned the Debian package, as I am retiring from Debian.
+
+ -- Joey Hess <joeyh@debian.org>  Sat, 08 Nov 2014 15:57:36 -0400
+
 propellor (0.9.1) unstable; urgency=medium
 
   * Docker: Add ability to control when containers restart.
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -62,7 +62,7 @@
    Now they'll automatically update every 30 minutes, and you can
    `git commit -S` and `git push` changes that affect any number of
    hosts.
-10. Write some neat new properties and send patches to <propellor@joeyh.name>!
+10. Write some neat new properties and send patches!
 
 ## debugging
 
diff --git a/config-joey.hs b/config-joey.hs
--- a/config-joey.hs
+++ b/config-joey.hs
@@ -160,6 +160,9 @@
 		-- Some users have zsh as their login shell.
 		, "zsh"
 		]
+	
+	& Docker.configured
+	& Docker.garbageCollected `period` Daily
 
 diatom :: Host
 diatom = standardSystem "diatom.kitenet.net" (Stable "wheezy") "amd64"
diff --git a/debian/changelog b/debian/changelog
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,14 @@
+propellor (0.9.2) unstable; urgency=medium
+
+  * Added nginx module, contributed by Félix Sipma.
+  * Added firewall module, contributed by Arnaud Bailly.
+  * Apache: Fix daemon reload when enabling a new module or site.
+  * Docker: Stop using docker.io; that was a compat symlink in
+    the Debian package which has been removed in docker.io 1.3.1~dfsg1-2.
+  * Orphaned the Debian package, as I am retiring from Debian.
+
+ -- Joey Hess <joeyh@debian.org>  Sat, 08 Nov 2014 15:57:36 -0400
+
 propellor (0.9.1) unstable; urgency=medium
 
   * Docker: Add ability to control when containers restart.
diff --git a/debian/control b/debian/control
--- a/debian/control
+++ b/debian/control
@@ -16,7 +16,7 @@
 	libghc-quickcheck2-dev,
 	libghc-mtl-dev,
 	libghc-monadcatchio-transformers-dev,
-Maintainer: Joey Hess <joeyh@debian.org>
+Maintainer: Debian QA Group <packages@qa.debian.org>
 Standards-Version: 3.9.5
 Vcs-Git: git://git.kitenet.net/propellor
 Homepage: http://propellor.branchable.com/
diff --git a/doc/README.mdwn b/doc/README.mdwn
--- a/doc/README.mdwn
+++ b/doc/README.mdwn
@@ -62,7 +62,7 @@
    Now they'll automatically update every 30 minutes, and you can
    `git commit -S` and `git push` changes that affect any number of
    hosts.
-10. Write some neat new properties and send patches to <propellor@joeyh.name>!
+10. Write some neat new properties and send patches!
 
 ## debugging
 
diff --git a/propellor.cabal b/propellor.cabal
--- a/propellor.cabal
+++ b/propellor.cabal
@@ -1,5 +1,5 @@
 Name: propellor
-Version: 0.9.1
+Version: 0.9.2
 Cabal-Version: >= 1.6
 License: BSD3
 Maintainer: Joey Hess <joey@kitenet.net>
@@ -78,10 +78,12 @@
     Propellor.Property.Dns
     Propellor.Property.Docker
     Propellor.Property.File
+    Propellor.Property.Firewall
     Propellor.Property.Git
     Propellor.Property.Gpg
     Propellor.Property.Grub
     Propellor.Property.Network
+    Propellor.Property.Nginx
     Propellor.Property.Obnam
     Propellor.Property.OpenId
     Propellor.Property.Postfix
diff --git a/src/Propellor/Property/Apache.hs b/src/Propellor/Property/Apache.hs
--- a/src/Propellor/Property/Apache.hs
+++ b/src/Propellor/Property/Apache.hs
@@ -4,23 +4,26 @@
 import qualified Propellor.Property.File as File
 import qualified Propellor.Property.Apt as Apt
 import qualified Propellor.Property.Service as Service
+import Utility.SafeCommand
 
 type ConfigFile = [String]
 
 siteEnabled :: HostName -> ConfigFile -> RevertableProperty
 siteEnabled hn cf = RevertableProperty enable disable
   where
-	enable = trivial (cmdProperty "a2ensite" ["--quiet", hn])
-		`describe` ("apache site enabled " ++ hn)
-		`requires` siteAvailable hn cf
-		`requires` installed
-		`onChange` reloaded
-	disable = trivial $ combineProperties
+	enable = check (not <$> isenabled) $
+		cmdProperty "a2ensite" ["--quiet", hn]
+			`describe` ("apache site enabled " ++ hn)
+			`requires` siteAvailable hn cf
+			`requires` installed
+			`onChange` reloaded
+	disable = combineProperties
 		("apache site disabled " ++ hn) 
 		(map File.notPresent (siteCfg hn))
 		`onChange` cmdProperty "a2dissite" ["--quiet", hn]
 		`requires` installed
 		`onChange` reloaded
+	isenabled = boolSystem "a2query" [Param "-q", Param "-s", Param hn]
 
 siteAvailable :: HostName -> ConfigFile -> Property
 siteAvailable hn cf = combineProperties ("apache site available " ++ hn) $
@@ -31,17 +34,20 @@
 modEnabled :: String -> RevertableProperty
 modEnabled modname = RevertableProperty enable disable
   where
-	enable = trivial $ cmdProperty "a2enmod" ["--quiet", modname]
-		`describe` ("apache module enabled " ++ modname)
-		`requires` installed
-		`onChange` reloaded
-	disable = trivial $ cmdProperty "a2dismod" ["--quiet", modname]
-		`describe` ("apache module disabled " ++ modname)
-		`requires` installed
-		`onChange` reloaded
+	enable = check (not <$> isenabled) $
+		cmdProperty "a2enmod" ["--quiet", modname]
+			`describe` ("apache module enabled " ++ modname)
+			`requires` installed
+			`onChange` reloaded
+	disable = check isenabled $ 
+		cmdProperty "a2dismod" ["--quiet", modname]
+			`describe` ("apache module disabled " ++ modname)
+			`requires` installed
+			`onChange` reloaded
+	isenabled = boolSystem "a2query" [Param "-q", Param "-m", Param modname]
 
 -- This is a list of config files because different versions of apache
--- use different filenames. Propellor simply writen them all.
+-- use different filenames. Propellor simply writes them all.
 siteCfg :: HostName -> [FilePath]
 siteCfg hn =
 	-- Debian pre-2.4
diff --git a/src/Propellor/Property/Docker.hs b/src/Propellor/Property/Docker.hs
--- a/src/Propellor/Property/Docker.hs
+++ b/src/Propellor/Property/Docker.hs
@@ -567,7 +567,7 @@
 	. readish <$> readFile (identFile cid)
 
 dockercmd :: String
-dockercmd = "docker.io"
+dockercmd = "docker"
 
 report :: [Bool] -> Result
 report rmed
diff --git a/src/Propellor/Property/Firewall.hs b/src/Propellor/Property/Firewall.hs
new file mode 100644
--- /dev/null
+++ b/src/Propellor/Property/Firewall.hs
@@ -0,0 +1,91 @@
+-- |Properties for configuring firewall (iptables) rules
+--
+-- Copyright 2014 Arnaud Bailly <arnaud.oqube@gmail.com>
+-- License: BSD-2-Clause
+module Propellor.Property.Firewall (
+	rule,
+	installed,
+	Chain(..),
+	Target(..),
+	Proto(..),
+	Rules(..),
+	ConnectionState(..)
+) where
+
+import Data.Monoid
+import Data.Char
+import Data.List
+
+import Propellor
+import Utility.SafeCommand
+import qualified Propellor.Property.Apt as Apt
+import qualified Propellor.Property.Network as Network
+
+installed :: Property
+installed = Apt.installed ["iptables"]
+
+rule :: Chain -> Target -> Rules -> Property
+rule c t rs = property ("firewall rule: " <> show r) addIpTable
+  where
+	r = Rule c t rs
+	addIpTable = liftIO $ do
+		let args = toIpTable r
+		exist <- boolSystem "iptables" (chk args)
+		if exist
+			then return NoChange
+			else ifM (boolSystem "iptables" (add args))
+				( return MadeChange , return FailedChange)
+	add params = (Param "-A") : params
+	chk params = (Param "-C") : params
+
+toIpTable :: Rule -> [CommandParam]
+toIpTable r =  map Param $
+	(show $ ruleChain r) :
+	(toIpTableArg (ruleRules r)) ++ [ "-j" , show $ ruleTarget r ]
+
+toIpTableArg :: Rules -> [String]
+toIpTableArg Everything        = []
+toIpTableArg (Proto proto)     = ["-p", map toLower $ show proto]
+toIpTableArg (Port port)       = ["--dport", show port]
+toIpTableArg (PortRange (f,t)) = ["--dport", show f ++ ":" ++ show t]
+toIpTableArg (IFace iface)     = ["-i", iface]
+toIpTableArg (Ctstate states)  = ["-m", "conntrack","--ctstate", concat $ intersperse "," (map show states)]
+toIpTableArg (r :- r')         = toIpTableArg r <> toIpTableArg r'
+
+data Rule = Rule
+	{ ruleChain :: Chain
+	, ruleTarget :: Target
+	, ruleRules :: Rules
+	} deriving (Eq, Show, Read)
+
+data Chain = INPUT | OUTPUT | FORWARD
+	deriving (Eq,Show,Read)
+
+data Target = ACCEPT | REJECT | DROP | LOG
+	deriving (Eq,Show,Read)
+
+data Proto = TCP | UDP | ICMP
+	deriving (Eq,Show,Read)
+
+type Port = Int
+
+data ConnectionState = ESTABLISHED | RELATED | NEW | INVALID
+	deriving (Eq,Show,Read)
+
+data Rules
+	= Everything
+	| Proto Proto
+	-- ^There is actually some order dependency between proto and port so this should be a specific
+	-- data type with proto + ports
+	| Port Port
+	| PortRange (Port,Port)
+	| IFace Network.Interface
+	| Ctstate [ ConnectionState ]
+	| Rules :- Rules   -- ^Combine two rules
+	deriving (Eq,Show,Read)
+
+infixl 0 :-
+
+instance Monoid Rules where
+	mempty  = Everything
+	mappend = (:-)
diff --git a/src/Propellor/Property/Nginx.hs b/src/Propellor/Property/Nginx.hs
new file mode 100644
--- /dev/null
+++ b/src/Propellor/Property/Nginx.hs
@@ -0,0 +1,52 @@
+module Propellor.Property.Nginx where
+
+import Propellor
+import qualified Propellor.Property.File as File
+import qualified Propellor.Property.Apt as Apt
+import qualified Propellor.Property.Service as Service
+import System.Posix.Files
+
+type ConfigFile = [String]
+
+siteEnabled :: HostName -> ConfigFile -> RevertableProperty
+siteEnabled hn cf = RevertableProperty enable disable
+  where
+	enable = check test prop
+		`describe` ("nginx site enabled " ++ hn)
+		`requires` siteAvailable hn cf
+		`requires` installed
+		`onChange` reloaded
+	  where
+		test = not <$> doesFileExist (siteVal hn)
+		prop = property "nginx site in place" $ makeChange $
+			createSymbolicLink target dir
+		target = siteValRelativeCfg hn
+		dir = siteVal hn
+	disable = trivial $ File.notPresent (siteVal hn)
+		`describe` ("nginx site disable" ++ hn)
+		`requires` installed
+		`onChange` reloaded
+
+siteAvailable :: HostName -> ConfigFile -> Property
+siteAvailable hn cf = ("nginx site available " ++ hn) ==>
+	siteCfg hn `File.hasContent` (comment : cf)
+  where
+	comment = "# deployed with propellor, do not modify"
+
+siteCfg :: HostName -> FilePath
+siteCfg hn = "/etc/nginx/sites-available/" ++ hn
+
+siteVal :: HostName -> FilePath
+siteVal hn = "/etc/nginx/sites-enabled/" ++ hn
+
+siteValRelativeCfg :: HostName -> FilePath
+siteValRelativeCfg hn = "../sites-available/" ++ hn
+
+installed :: Property
+installed = Apt.installed ["nginx"]
+
+restarted :: Property
+restarted = Service.restarted "nginx"
+
+reloaded :: Property
+reloaded = Service.reloaded "nginx"