disallow access to dotfiles besides .well-known by default

README.md

@@ -102,6 +102,9 @@ key: ~
 
 # SSL certificat, mutally exclusive with letsencrypt option
 crt: ~
+
+# Disallow access to dotfiles besides .well-known by default
+disallow_dotfiles: True
 ```
 
 **locationconfig**:

defaults/main.yml

@@ -45,6 +45,7 @@ nginx_vhosts_defaults:
   add_proxy_headers: {}
   hide_proxy_headers: {}
   backend: ~
+  disallow_dotfiles: True
 
 nginx_streams_defaults:
   listen:

templates/vhost.conf.j2

@@ -86,6 +86,15 @@ server {
 	}
 	{% endfor %}
 
+
+	{% if vhost.disallow_dotfiles %}
+	# disallow every path starting with a dot except .well-known/
+	location ~ /\.(?!well-known\/).* {
+		deny all;
+	}
+	{% endif %}
+
+
 	{% if vhost.auth.enable %}
 	auth_basic           "restricted area";
 	auth_basic_user_file {{ vhost.auth.path }};