From 48c0a4e504188b6c8131e6e97a5fea0371eac57e Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Wed, 17 Jun 2026 08:23:08 +0900
Subject: [PATCH] temmie/userweb: fix directory denylist enforcement

---
 hosts/temmie/services/userweb/httpd.nix | 28 ++++++++++++-------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/hosts/temmie/services/userweb/httpd.nix b/hosts/temmie/services/userweb/httpd.nix
index 432df34..1c46246 100644
--- a/hosts/temmie/services/userweb/httpd.nix
+++ b/hosts/temmie/services/userweb/httpd.nix
@@ -107,25 +107,25 @@ in
         </Directory>
 
         ${lib.concatMapStringsSep "\n" (d: ''
-          <Directory "${d}">
+          <DirectoryMatch "/${d}(/|$)">
             Require all denied
-          </Directory>
+          </DirectoryMatch>
         '') [
-          ".git"
-          ".hg"
-          ".svn"
-          ".ssh"
-          ".bzr"
-          ".venv"
+          "\\.git"
+          "\\.hg"
+          "\\.svn"
+          "\\.ssh"
+          "\\.bzr"
+          "\\.venv"
           "CVS"
           "RCS"
 
-          "*.bak"
-          "*.bak*"
-          "*.bkp"
-          "*.bkp*"
-          "*.backup"
-          "*.backup*"
+          ".*\\.bak"
+          ".*\\.bak.*"
+          ".*\\.bkp"
+          ".*\\.bkp.*"
+          ".*\\.backup"
+          ".*\\.backup.*"
         ]}
 
         ${lib.concatMapStringsSep "\n" (d: ''