diff --git a/system/options.nix b/system/options.nix
index 78128a03f222..d525136b5a8c 100644
--- a/system/options.nix
+++ b/system/options.nix
@@ -874,6 +874,7 @@
         ";
       };
 
+      # !!! this is a mis-nomer, should be "extraConfig" or something.
       extraDirectories = mkOption {
         default = "";
         example = "
@@ -1216,6 +1217,23 @@
         ";
       };
 
+      enableWebInterface = mkOption {
+        default = false;
+        description = "
+          Whether to enable the Nagios web interface.  You should also
+          enable Apache (<option>services.httpd.enable</option>).
+        ";
+      };
+
+      urlPath = mkOption {
+        default = "/nagios";
+        description = "
+          The URL path under which the Nagios web interface appears.
+          That is, you can access the Nagios web interface through
+          <literal>http://<replaceable>server</replaceable>/<replaceable>urlPath</replaceable></literal>.
+        ";
+      };
+
     };
 
 
diff --git a/upstart-jobs/default.nix b/upstart-jobs/default.nix
index 42fc4c0b7d45..a4ab27e001fa 100644
--- a/upstart-jobs/default.nix
+++ b/upstart-jobs/default.nix
@@ -12,11 +12,7 @@ let
     (config.services.mingetty.ttys)
     ++ [10] /* !!! sync with syslog.conf */ ;
 
-in
-
-import ../upstart-jobs/gather.nix {
-  inherit (pkgs) runCommand;
-
+    
   jobs = map makeJob [
     # Syslogd.
     (import ../upstart-jobs/syslogd.nix {
@@ -171,6 +167,8 @@ import ../upstart-jobs/gather.nix {
     (import ../upstart-jobs/httpd.nix {
       inherit config pkgs;
       inherit (pkgs) glibc;
+      extraConfig = pkgs.lib.concatStringsSep "\n"
+        (map (job: job.extraHttpdConfig) jobs);
     })
 
   # Samba service.
@@ -203,7 +201,6 @@ import ../upstart-jobs/gather.nix {
       inherit config pkgs;
     })
 
-
   # ALSA sound support.
   ++ optional config.sound.enable
     (import ../upstart-jobs/alsa.nix {
@@ -285,5 +282,9 @@ import ../upstart-jobs/gather.nix {
 
   # For the built-in logd job.
   ++ [(makeJob { jobDrv = pkgs.upstart; })];
+
   
+in import ../upstart-jobs/gather.nix {
+  inherit (pkgs) runCommand;
+  inherit jobs;
 }
diff --git a/upstart-jobs/httpd.nix b/upstart-jobs/httpd.nix
index fcc89740b5a3..a8f00552fc8b 100644
--- a/upstart-jobs/httpd.nix
+++ b/upstart-jobs/httpd.nix
@@ -1,4 +1,4 @@
-{config, pkgs, glibc}:
+{config, pkgs, glibc, extraConfig}:
 
 let
 
@@ -18,7 +18,7 @@ let
   stateDir = cfg.stateDir;
   enableSSL = false;
   noUserDir = cfg.noUserDir;
-  extraDirectories = cfg.extraDirectories;
+  extraDirectories = cfg.extraDirectories + extraConfig;
 
   startingDependency = if config.services.gw6c.enable then "gw6c" else "network-interfaces";
   
diff --git a/upstart-jobs/make-job.nix b/upstart-jobs/make-job.nix
index 14f48ae04d65..5523ad5af93c 100644
--- a/upstart-jobs/make-job.nix
+++ b/upstart-jobs/make-job.nix
@@ -24,6 +24,10 @@
   # Allow jobs to declare extra files that should be added to /etc.
   extraEtc = if job ? extraEtc then job.extraEtc else [];
 
+  # Allow jobs to declare extra configuration for Apache (e.g. Nagios
+  # declaring its web interface).
+  extraHttpdConfig = if job ? extraHttpdConfig then job.extraHttpdConfig else "";
+
   # Allow jobs to declare user accounts that should be created.
   users = if job ? users then job.users else [];
   
diff --git a/upstart-jobs/nagios/default.nix b/upstart-jobs/nagios/default.nix
index a9ad05055f54..256693ba072c 100644
--- a/upstart-jobs/nagios/default.nix
+++ b/upstart-jobs/nagios/default.nix
@@ -45,6 +45,37 @@ let
     
   ";
 
+  # Plain configuration for the Nagios web-interface with no
+  # authentication.
+  nagiosCGICfgFile = pkgs.writeText "nagios.cgi.conf" "
+    main_config_file=${nagiosCfgFile}
+    use_authentication=0
+    url_html_path=/nagios
+  ";
+
+  urlPath = config.services.nagios.urlPath;
+
+  extraHttpdConfig = "
+    ScriptAlias ${urlPath}/cgi-bin ${pkgs.nagios}/sbin
+
+    <Directory \"${pkgs.nagios}/sbin\">
+      Options ExecCGI
+      AllowOverride None
+      Order allow,deny
+      Allow from all
+      SetEnv NAGIOS_CGI_CONFIG ${nagiosCGICfgFile}
+    </Directory>
+
+    Alias ${urlPath} ${pkgs.nagios}/share
+
+    <Directory \"${pkgs.nagios}/share\">
+      Options None
+      AllowOverride None
+      Order allow,deny
+      Allow from all
+    </Directory>
+  ";
+    
 in
 
 {
@@ -68,6 +99,9 @@ in
     }
   ];
 
+  extraHttpdConfig =
+    if config.services.nagios.enableWebInterface then extraHttpdConfig else "";
+  
   # Run `nagios -v' to check the validity of the configuration file so
   # that a nixos-rebuild fails *before* we kill the running Nagios
   # daemon.