ansible-playbooks/roles/webserver/templates/nginx/vhost_protect-files.j2

{% if ansible_prolog -%}
{% from 'templates/ansible/prolog.j2' import prolog with context %}
{{ prolog() }}
{% endif -%}
#
# Protect hidden files and directories
#

location ~* (?:^|/)\.(?!well-known) {
    deny all;
}

location ~* (?:\.(?:bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist)|~)$ {
    deny all;
}