SECURITY: prevent direct download of backups

config/nginx.sample.conf

@@ -59,6 +59,11 @@ server {
   # use dates, it solves the problem fine even cross server
   etag off;
   
+  # prevent direct download of backups
+  location ^~ /backups/ {
+    internal;
+  }
+
   location / {
     root $public;
     add_header ETag "";