SECURITY: prevent direct download of backups

config/nginx.sample.conf

@@ -58,6 +58,11 @@ server {
   # further more etags are based on the file in nginx not sha of data
   # use dates, it solves the problem fine even cross server
   etag off;
+  
+  # prevent direct download of backups
+  location ^~ /backups/ {
+    internal;
+  }
 
   location / {
     root $public;