match .well-known only on top level

templates/vhost.conf.j2

@@ -89,7 +89,7 @@ server {
 
 	{% if vhost.disallow_dotfiles %}
 	# explicitly allow .well-known/
-	location ~ /\.well-known/ {
+	location ~ ^/\.well-known/ {
 		allow all;
 	}
 

[jaan]

maybe add the following line to be on the safe side: default_type "text/plain"; someone might have an interest in executing scripts otherwise ...