disallow access to dotfiles besides .well-known by default

questions i stumbled upon:

• use prefix match instead of regex?
  • takes higher precedence
  • only overwritable by more specific match

closes https://git.cccv.de/infra/documentation/-/issues/115

templates/vhost.conf.j2

@@ -89,7 +89,7 @@ server {
 
 	{% if vhost.disallow_dotfiles %}
 	# disallow every path starting with a dot except .well-known/
-	location ~ ^/\.(?!well-known\/).* {
+	location ~ /\.(?!well-known\/).* {
 		deny all;
 	}
 	{% endif %}