ansible-config/roles/nginx/files/snippets/no-unsafe-files.conf

disable_symlinks if_not_owner from=$document_root;

# Do not serve dotfiles.
location ~ /\. {
    deny all;
    access_log off;
    log_not_found off;
}