[YvesCesar]

Summary

The rules that hide dotfiles and dependency manifests are anchored at the web root, so /.git and /composer.json return 404, but the same files inside app directories were served as static files by the location / fallback. For apps cloned into apps-extra, that exposed .git/ (config, logs, index and loose objects), .env, composer.lock and package.json.

This adds a location for apps, apps-extra and apps-writable that returns 404 for paths starting with a dot right below the app directory and for composer.json, composer.lock, package.json and package-lock.json at the app root. Assets of the app and PHP entry points are not affected, and WebDAV access to hidden user files goes through remote.php, which this rule does not match.

Validation

• New policy test in tests/proxy/compose-policy.bats fails on main and passes with this change.
• Ran nginx 1.31.8-alpine with nginx.conf and nextcloud.conf from the repo against a test docroot and a PHP-FPM container:
  • main: apps-extra/<app>/.git/config, .env, composer.lock and apps/<app>/package.json returned 200.
  • This branch: the same paths return 404; apps-extra/<app>/js/app.js, /index.php/apps/files/ and /remote.php/dav/files/<user>/.<hidden file> still reach their handlers with 200.