temmie/userweb: deny access to documentRoot

This shortens down the path needed to build both overlayed packages and
all the other machine derivations. Here are some examples:

```
nix build .#machine.etc
nix build '.#machine.units."nginx.service".unit'
nix build .#machine.pkgs.overlayed-package
nix build .#machine.config.services.nginx.package
```

flake.nix

@@ -369,7 +369,12 @@
         //
         # Machines
         lib.genAttrs allMachines
-        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
+        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel.overrideAttrs (prev: {
+          passthru =
+            (prev.passthru or { })
+            // self.nixosConfigurations.${machine}.config.system.build
+            // { inherit (self.nixosConfigurations.${machine}) pkgs config; };
+        }))
         //
         # Nix-topology
         (let

hosts/temmie/services/userweb/httpd.nix

@@ -63,6 +63,10 @@ in
       ];
 
       extraConfig = ''
+        <Directory "${pkgs.emptyDirectory}">
+          Require all denied
+        </Directory>
+
         CustomLog "${cfg.logDir}/access.log" combined
         CustomLog "/run/httpd-log-processor-access.fifo" combined
         ErrorLog "/run/httpd-log-processor-error.fifo"
@@ -107,25 +111,25 @@ in
         </Directory>
 
         ${lib.concatMapStringsSep "\n" (d: ''
-          <Directory "${d}">
+          <DirectoryMatch "/${d}(/|$)">
             Require all denied
-          </Directory>
+          </DirectoryMatch>
         '') [
-          ".git"
+          "\\.git"
-          ".hg"
+          "\\.hg"
-          ".svn"
+          "\\.svn"
-          ".ssh"
+          "\\.ssh"
-          ".bzr"
+          "\\.bzr"
-          ".venv"
+          "\\.venv"
           "CVS"
           "RCS"
 
-          "*.bak"
+          ".*\\.bak"
-          "*.bak*"
+          ".*\\.bak.*"
-          "*.bkp"
+          ".*\\.bkp"
-          "*.bkp*"
+          ".*\\.bkp.*"
-          "*.backup"
+          ".*\\.backup"
-          "*.backup*"
+          ".*\\.backup.*"
         ]}
 
         ${lib.concatMapStringsSep "\n" (d: ''