diff --git a/files/patches/03_augeas_httpd.patch b/files/patches/03_augeas_httpd.patch
new file mode 100644
index 0000000..f9cd9f2
--- /dev/null
+++ b/files/patches/03_augeas_httpd.patch
@@ -0,0 +1,28 @@
+--- dist/httpd.aug.org	2017-04-28 11:17:04.010737996 +0100
++++ dist/httpd.aug	2017-04-28 11:27:57.115688414 +0100
+@@ -34,6 +34,9 @@
+ 
+ *)
+ 
++(*
++# puppet perfsonar::patches applied patch: 03_augeas_httpd.patch
++*)
+ 
+ module Httpd =
+ 
+@@ -63,13 +66,14 @@
+ let char_arg_sec  = /[^ '"\t\r\n>]|\\\\"|\\\\'/
+ let dquot = /"([^"\\\r\n]|\\\\.)*"/
+ let squot = /'([^'\\\r\n]|\\\\.)*'/
++let comp = /[<>=]?=/
+ 
+ (******************************************************************
+  *                            Attributes
+  *****************************************************************)
+ 
+ let arg_dir = [ label "arg" . store (char_arg_dir+|dquot|squot) ]
+-let arg_sec = [ label "arg" . store (char_arg_sec+|dquot|squot) ]
++let arg_sec = [ label "arg" . store (char_arg_sec+|comp|dquot|squot) ]
+ 
+ let argv (l:lens) = l . (sep_spc . l)*
+ 
diff --git a/manifests/apache.pp b/manifests/apache.pp
index 4447e78..f548fca 100644
--- a/manifests/apache.pp
+++ b/manifests/apache.pp
@@ -83,12 +83,18 @@
   }
   if $have_auth > 0 {
     # additions for new web gui
+    $changes40 = versioncmp($perfsonar_version, '4.0') ? {
+      /^[01]$/ => [
+        "rm Location[arg='\"/toolkit/auth\"']/*/directive[.='AuthUserFile']",
+      ],
+      default  => [],
+    }
     $changes35 = versioncmp($perfsonar_version, '3.5') ? {
       /^[01]$/ => [
-        "rm Location[arg='\"/toolkit/auth\"']/directive[.='AuthShadow']",
-        "rm Location[arg='\"/toolkit/auth\"']/directive[.='AuthType']",
-        "rm Location[arg='\"/toolkit/auth\"']/directive[.='AuthName']",
-        "rm Location[arg='\"/toolkit/auth\"']/directive[.='Require']",
+        "rm Location[arg='\"/toolkit/auth\"']/*/directive[.='AuthShadow']",
+        "rm Location[arg='\"/toolkit/auth\"']/*/directive[.='AuthType']",
+        "rm Location[arg='\"/toolkit/auth\"']/*/directive[.='AuthName']",
+        "rm Location[arg='\"/toolkit/auth\"']/*/directive[.='Require']",
         "setm Location[arg='\"/toolkit/auth\"'] directive[.='Include'] 'Include'",
         "setm Location[arg='\"/toolkit/auth\"'] *[.='Include']/arg '${perfsonar::params::httpd_dir}/ssl_auth.conf'",
       ],
@@ -147,7 +153,7 @@
     notify  => Service[$::perfsonar::params::httpd_service],
     require => Package[$::perfsonar::params::httpd_package],
   }
-  $auges_changes = concat($changes34, $changes35, $remove_redirect)
+  $auges_changes = concat($changes34, $changes35, $changes40, $remove_redirect)
   augeas { 'update perfsonar apache config':
     incl    => "${perfsonar::params::conf_dir}/apache-toolkit_web_gui.conf",
     lens    => 'Httpd.lns',
diff --git a/manifests/esmond.pp b/manifests/esmond.pp
index f5d42a1..a8ae759 100644
--- a/manifests/esmond.pp
+++ b/manifests/esmond.pp
@@ -1,5 +1,5 @@
 class perfsonar::esmond (
-  $use_db_module = $::perfsonar::params::esmond_use_db_module,
+  $use_db_module = $::perfsonar::params::esmond_use_db_module_real,
   $dbname        = $::perfsonar::params::esmond_dbname,
   $dbuser        = $::perfsonar::params::esmond_dbuser,
   $dbpassword    = $::perfsonar::params::esmond_dbpass,
diff --git a/manifests/init.pp b/manifests/init.pp
index 4ac288f..56193a0 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -4,7 +4,9 @@
   include 'perfsonar::service'
   include 'perfsonar::apache'
   include 'perfsonar::esmond'
-  include 'perfsonar::regular_testing'
+  if $::perfsonar_version and versioncmp($::perfsonar_version, '4.0') < 0 {
+    include 'perfsonar::regular_testing'
+  }
   include 'perfsonar::mesh_config'
   include 'perfsonar::owamp'
   include 'perfsonar::bwctl'
diff --git a/manifests/logrotate_all.pp b/manifests/logrotate_all.pp
index 37875da..e0260c3 100644
--- a/manifests/logrotate_all.pp
+++ b/manifests/logrotate_all.pp
@@ -1,6 +1,8 @@
 class perfsonar::logrotate_all {
   include 'perfsonar::logrotate'
-  include 'perfsonar::regular_testing::logrotate'
+  if $::perfsonar_version and versioncmp($::perfsonar_version, '4.0') < 0 {
+    include 'perfsonar::regular_testing::logrotate'
+  }
   include 'perfsonar::ls_registration_daemon::logrotate'
   include 'perfsonar::ls_cache_daemon::logrotate'
 }
diff --git a/manifests/mesh_config/config.pp b/manifests/mesh_config/config.pp
index ff7cf25..0ca1895 100644
--- a/manifests/mesh_config/config.pp
+++ b/manifests/mesh_config/config.pp
@@ -10,23 +10,25 @@
     content => template("${module_name}/agent_configuration.conf.erb"),
     require => Package['perfsonar-meshconfig-agent'],
   }
-  # needs notty in sudoers
-  exec { 'generate mesh configuration':
-    command     => '/usr/bin/sudo -u perfsonar /usr/lib/perfsonar/bin/generate_configuration',
-    logoutput   => 'on_failure',
-    subscribe   => File['/etc/perfsonar/meshconfig-agent.conf'],
-    require     => [
-      Exec['run regular testing configuration script'],
-      File['/etc/sudoers.d/perfsonar_mesh_config'],
-    ],
-    refreshonly => true,
-    notify      => Service['perfsonar-regulartesting'],
-  }
-  file { '/etc/sudoers.d/perfsonar_mesh_config':
-    ensure => 'file',
-    owner  => 'root',
-    group  => 'root',
-    mode   => '0440',
-    content => "Defaults!/usr/lib/perfsonar/bin/generate_configuration !requiretty\n",
+  if $::perfsonar_version and versioncmp($::perfsonar_version, '4.0') < 0 {
+    # needs notty in sudoers
+    exec { 'generate mesh configuration':
+      command     => '/usr/bin/sudo -u perfsonar /usr/lib/perfsonar/bin/generate_configuration',
+      logoutput   => 'on_failure',
+      subscribe   => File['/etc/perfsonar/meshconfig-agent.conf'],
+      require     => [
+        Exec['run regular testing configuration script'],
+        File['/etc/sudoers.d/perfsonar_mesh_config'],
+      ],
+      refreshonly => true,
+      notify      => Service['perfsonar-regulartesting'],
+    }
+    file { '/etc/sudoers.d/perfsonar_mesh_config':
+      ensure => 'file',
+      owner  => 'root',
+      group  => 'root',
+      mode   => '0440',
+      content => "Defaults!/usr/lib/perfsonar/bin/generate_configuration !requiretty\n",
+    }
   }
 }
diff --git a/manifests/params.pp b/manifests/params.pp
index 0c01515..c7771dc 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -168,4 +168,11 @@
     send_error_emails      => 1,
     skip_redundant_tests   => 1,
   }
+
+  # disable db after upgrade to perfsonar 4.0
+  if $::perfsonar_version and versioncmp($::perfsonar_version, '4.0') >= 0 {
+    $esmond_use_db_module_real = false
+  } else {
+    $esmond_use_db_module_real = true
+  }
 }
diff --git a/manifests/patches.pp b/manifests/patches.pp
index d930db7..471e57e 100644
--- a/manifests/patches.pp
+++ b/manifests/patches.pp
@@ -12,7 +12,10 @@
     $patchpackage_require = undef
   }
   case $perfsonar_version {
-    /^3\.5\.1/: {
+    /^(3\.5\.1|4\.0)/: {
+      package { 'augeas-libs':
+        ensure => 'present',
+      }
       $patches = {
         '01_perfsonar_webservice_auth.patch.3.5.0' => {
           path      => '/usr/lib/perfsonar/lib/perfSONAR_PS/NPToolkit/WebService',
@@ -30,7 +33,13 @@
           strip     => 1,
           deps      => Package['perfsonar-toolkit'],
           checkfile => 'index.cgi', # relative to path
-        }
+        },
+        '03_augeas_httpd.patch' => {
+          path      => '/usr/share/augeas/lenses/dist',
+          strip     => 1,
+          deps      => Package['augeas-libs'],
+          checkfile => 'httpd.aug', # relative to path
+        },
       }
     }
     default: {