All in all that looks pretty good to me. As AgentM said, I'd make a second pass thru the Apache config and maybe ask around for help on that in the appropriate places if you aren't sure.

Also, don't get too uptight about the security thru obscurity thing. Given that you are doing your best to secure it properly, throwing obscurity at it _too_ can't ever hurt much. The point is not to _depend_ on it!

Oh, and tilly's point about CVS is well considered to... It is fair to ask why have non-code/html in the code/html trees. The data you may wish to move down out of the apache tree completely, or at least lower.

--
$you = new YOU;
honk() if $you->love(perl)