diff --git a/etc/default.nix b/etc/default.nix
index 6456e52f9d9..599ee33944f 100644
--- a/etc/default.nix
+++ b/etc/default.nix
@@ -162,7 +162,7 @@ import ../helpers/make-etc.nix {
     
   # Configuration file for fontconfig used to locate
   # (X11) client-rendered fonts.
-  ++ optional config.fonts.enableFontConfig { 
+  ++ optional config.fonts.enableFontConfig {
     source = pkgs.runCommand "fonts.conf"
       { 
         fontDirectories = import ../system/fonts.nix {inherit pkgs config;};
diff --git a/system/options.nix b/system/options.nix
index eed01824bf5..723bf475900 100644
--- a/system/options.nix
+++ b/system/options.nix
@@ -1277,7 +1277,7 @@
 	  description = "List of Java webapplications that should be mapped to the servlet container (Tomcat/JBoss)";
 	};
       };
-      
+
       subservices = {
 
         subversion = {
@@ -1354,22 +1354,11 @@
 
       };
 
-      extraSubservices = {
-
-        enable = mkOption {
-          default = false;
-          description = "
-            Whether to enable the extra subservices in the webserver.
-          ";
-        };
-
-        services = mkOption {
-          default = [];
-          description = "
-            Extra subservices to enable in the webserver.
-          ";
-        };
-
+      extraSubservices = mkOption {
+        default = [];
+        description = "
+          Extra subservices to enable in the webserver.
+        ";
       };
 
     };
diff --git a/upstart-jobs/apache-httpd/default.nix b/upstart-jobs/apache-httpd/default.nix
index 320f8cdb65c..9d72896c772 100644
--- a/upstart-jobs/apache-httpd/default.nix
+++ b/upstart-jobs/apache-httpd/default.nix
@@ -18,11 +18,10 @@ let
   };
 
 
-  subservices = [
-    (import ./subversion.nix {inherit config pkgs serverInfo;})
-  ];
+  subservices = map (svc: svc {inherit config pkgs serverInfo;}) cfg.extraSubservices;
 
 
+  # !!! should be in lib
   writeTextInDir = name: text:
     pkgs.runCommand name {inherit text;} "ensureDir $out; echo -n \"$text\" > $out/$name";
   
@@ -134,17 +133,12 @@ let
   '';
 
 
-  robotsTxt = writeTextInDir "robots.txt" ''
+  robotsTxt = pkgs.writeText "robots.txt" ''
     ${pkgs.lib.concatStrings (map (svc: svc.robotsEntries) subservices)}
   '';
   
   robotsConf = ''
-    Alias /robots.txt ${robotsTxt}/robots.txt
-
-    <Directory ${robotsTxt}>
-        Order allow,deny
-        Allow from all
-    </Directory>
+    Alias /robots.txt ${robotsTxt}
   '';
 
   
@@ -215,12 +209,19 @@ let
     ${if cfg.enableSSL then sslConf else ""}
 
     # Fascist default - deny access to everything.
-    # !!!
     <Directory />
         Options FollowSymLinks
         AllowOverride None
-#        Order deny,allow
-#        Deny from all
+        Order deny,allow
+        Deny from all
+    </Directory>
+
+    # But do allow access to files in the store so that we don't have
+    # to generate <Directory> clauses for every generated file that we
+    # want to serve.
+    <Directory /nix/store>
+        Order allow,deny
+        Allow from all
     </Directory>
 
     ${documentRootConf}
diff --git a/upstart-jobs/apache-httpd/subversion.nix b/upstart-jobs/apache-httpd/subversion.nix
index 4589256f0ca..bcc95e00941 100644
--- a/upstart-jobs/apache-httpd/subversion.nix
+++ b/upstart-jobs/apache-httpd/subversion.nix
@@ -64,7 +64,9 @@ let
     ];
 
     # Do a syntax check on the generated file.
-    postInstall = "$perl -c -T $out/cgi-bin/repoman.pl; $perl -c $out/bin/svn-server-create-user.pl";
+    postInstall = ''
+      $perl -c -T $out/cgi-bin/repoman.pl; $perl -c $out/bin/svn-server-create-user.pl
+    '';
   };
 
   
@@ -246,9 +248,8 @@ let
   writeTextInDir = name: text:
     pkgs.runCommand name {inherit text;} ''ensureDir $out; echo -n "$text" > $out/$name'';
 
-  substituteInSome = args: pkgs.stdenv.mkDerivation ({
+  substituteInSome = args: pkgs.stdenvUsingSetupNew2.mkDerivation ({
     buildCommand = ''
-      buildCommand= # ugh, hack to prevent sed errors
       ensureDir $out
       cp -prd $src/* $out
       chmod -R u+w $out
@@ -258,9 +259,8 @@ let
     '';
   } // args); # */
     
-  substituteInAll = args: pkgs.stdenv.mkDerivation ({
+  substituteInAll = args: pkgs.stdenvUsingSetupNew2.mkDerivation ({
     buildCommand = ''
-      buildCommand= # ugh, hack to prevent sed errors
       ensureDir $out
       cp -prd $src/* $out
       chmod -R u+w $out
diff --git a/upstart-jobs/xserver.conf b/upstart-jobs/xserver.conf
index 2535f194a5d..d3fc22278c5 100644
--- a/upstart-jobs/xserver.conf
+++ b/upstart-jobs/xserver.conf
@@ -78,7 +78,6 @@ Section "Device"
   Identifier   "Device[0]"
   Driver       "@videoDriver@"
   Option       "Clone" "@isClone@"
-  #Option       "MonitorLayout" "CRT,LFP"
   @device@
   @internalAGPGART@
   @extraDeviceConfig@
@@ -90,7 +89,7 @@ Section "ServerLayout"
   InputDevice  "Keyboard[0]" "CoreKeyboard"
   InputDevice  "@corePointer@" "CorePointer"
   Screen       "Screen[0]"
-	@serverLayoutOptions@
+  @serverLayoutOptions@
 EndSection