ansible-playbooks/roles/webserver/templates/nginx/vhost_protect-files.j2

{% if ansible_controlled is defined and ansible_controlled != "" %}
#
# {{ ansible_controlled }}
#
{% endif %}
#
# Protect hidden files and directories
#

location ~* (?:^|/)\.(?!well-known) {
    deny all;
}

location ~* (?:\.(?:bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist)|~)$ {
    deny all;
}