[vitormattos]

Context

Compared .docker/web/nextcloud.conf against Nextcloud 35 official webroot reference nextcloud/documentation/admin_manual/installation/nginx-root.conf.sample (2026-06-09), and audited production cloud.somossementes.org.br without deploying.

Findings

• Confirmed exposure in ICLT production: unauthenticated GET requests to /composer.json, /composer.lock, /package.json, /package-lock.json, and /core/shipped.json return HTTP 200. The official sample denies these metadata paths. This is the security-relevant correction in this PR.
• Duplicate Strict-Transport-Security headers because TLS-terminating nginx-proxy and the internal web Nginx both set HSTS.
• The current nginx:alpine image already provides WASM MIME mapping; nginx -t reports a duplicate extension warning.

Minimal changes

• Pin the upstream sample revision in a header for future comparisons; preserve Docker-specific config, 20G upload limit, ONLYOFFICE includes, and dynamic PHP-FPM DNS upstream from merged fix(web): dynamically resolve PHP-FPM after container recreation #90.
• Add the exact official metadata deny rule.
• Leave the HSTS directive commented (matching official sample), since the TLS proxy already sets it.
• Comment only the redundant WASM type mapping; keep Nextcloud Nginx example otherwise intact.
• Add a Bats integration regression covering those five paths, valid status.php, and clean nginx -t output.

Validation and deployment

• Production baseline before fix: all five metadata paths yielded HTTP 200; TLS, /status.php, /index.php/204 healthy.
• No production Nginx configuration changed. After CI passes and review, deploy the published image using the inventory/Ansible path, respecting existing local overrides and approval. Check all five paths return 404, HSTS appears once, /status.php 200, /index.php/204 204, and ONLYOFFICE/DAV routes.

Scope limits

This PR does not change Nextcloud desktop URL parsing, Docker Engine API/docker-gen, or inventory-level configuration. These are tracked separately.

Source: https://docs.nextcloud.com/server/stable/admin_manual/installation/nginx.html

Signed commit with DCO.