disable_symlinks if_not_owner from=$document_root;

# Do not serve dotfiles.
location ~ /\. {
    deny all;
    access_log off;
    log_not_found off;
}