diff --git a/nixos/modules/services/logging/awstats.nix b/nixos/modules/services/logging/awstats.nix
index 612ae06d0a7..54799d699a7 100644
--- a/nixos/modules/services/logging/awstats.nix
+++ b/nixos/modules/services/logging/awstats.nix
@@ -4,6 +4,7 @@ with lib;
 
 let
   cfg = config.services.awstats;
+  httpd = config.services.httpd;
   package = pkgs.awstats;
 in
 
@@ -67,50 +68,43 @@ in
     environment.etc."awstats/awstats.conf".source = pkgs.runCommand "awstats.conf"
       { preferLocalBuild = true; }
       ( let
-          cfg-httpd = config.services.httpd;
           logFormat =
-            if cfg-httpd.logFormat == "combined" then "1" else
-            if cfg-httpd.logFormat == "common" then "4" else
-            throw "awstats service doesn't support Apache log format `${cfg-httpd.logFormat}`";
+            if httpd.logFormat == "combined" then "1" else
+            if httpd.logFormat == "common" then "4" else
+            throw "awstats service doesn't support Apache log format `${httpd.logFormat}`";
         in
         ''
           sed \
             -e 's|^\(DirData\)=.*$|\1="${cfg.vardir}"|' \
             -e 's|^\(DirIcons\)=.*$|\1="icons"|' \
             -e 's|^\(CreateDirDataIfNotExists\)=.*$|\1=1|' \
-            -e 's|^\(SiteDomain\)=.*$|\1="${cfg-httpd.hostName}"|' \
-            -e 's|^\(LogFile\)=.*$|\1="${cfg-httpd.logDir}/access_log"|' \
+            -e 's|^\(SiteDomain\)=.*$|\1="${httpd.hostName}"|' \
+            -e 's|^\(LogFile\)=.*$|\1="${httpd.logDir}/access_log"|' \
             -e 's|^\(LogFormat\)=.*$|\1=${logFormat}|' \
             < '${package.out}/wwwroot/cgi-bin/awstats.model.conf' > "$out"
           echo '${cfg.extraConfig}' >> "$out"
         '');
 
-    # The httpd sub-service showing awstats.
-    services.httpd.enable = mkIf cfg.service.enable true;
-    services.httpd.extraSubservices = mkIf cfg.service.enable [ { function = { serverInfo, ... }: {
-      extraConfig =
-        ''
-          Alias ${cfg.service.urlPrefix}/classes "${package.out}/wwwroot/classes/"
-          Alias ${cfg.service.urlPrefix}/css "${package.out}/wwwroot/css/"
-          Alias ${cfg.service.urlPrefix}/icons "${package.out}/wwwroot/icon/"
-          ScriptAlias ${cfg.service.urlPrefix}/ "${package.out}/wwwroot/cgi-bin/"
+    systemd.tmpfiles.rules = optionals cfg.service.enable [
+      "d '${cfg.vardir}' - ${httpd.user} ${httpd.group} - -"
+      "Z '${cfg.vardir}' - ${httpd.user} ${httpd.group} - -"
+    ];
 
-          <Directory "${package.out}/wwwroot">
-            Options None
-            AllowOverride None
-            Order allow,deny
-            Allow from all
-          </Directory>
-        '';
-      startupScript =
-        let
-          inherit (serverInfo.serverConfig) user group;
-        in pkgs.writeScript "awstats_startup.sh"
-          ''
-            mkdir -p '${cfg.vardir}'
-            chown '${user}:${group}' '${cfg.vardir}'
-          '';
-    };}];
+    # The httpd sub-service showing awstats.
+    services.httpd = optionalAttrs cfg.service.enable {
+      enable = true;
+      extraConfig = ''
+        Alias ${cfg.service.urlPrefix}/classes "${package.out}/wwwroot/classes/"
+        Alias ${cfg.service.urlPrefix}/css "${package.out}/wwwroot/css/"
+        Alias ${cfg.service.urlPrefix}/icons "${package.out}/wwwroot/icon/"
+        ScriptAlias ${cfg.service.urlPrefix}/ "${package.out}/wwwroot/cgi-bin/"
+
+        <Directory "${package.out}/wwwroot">
+          Options None
+          Require all granted
+        </Directory>
+      '';
+    };
 
     systemd.services.awstats-update = mkIf (cfg.updateAt != null) {
       description = "awstats log collector";