For settings that go to the "App Settings" part of the config file, you can use x Web Config Key Value from x Web Administration to do this.
I feel like something that manipulates the file directly (without appcmd's involvement) that is made generic enough for the entire config file would be more at home in x Web Administration than in x Share Point.
@ykuijs Looping back on this one - in regards to your options, the first one actually does make sense because we should already have a config for all servers that have the web app role anyway for things like SSL bindings through x Web Site, for service instances that run on them through x SPService Instance and other things that are specific to an individual server - so I don't think we are introducing something new here in terms of a new config for that role specifically.
Can you think of a specific scenario here that would warrant taking a different approach or doing something different with it?
The way the Web Config Modifications class works is it only pushes changes to the web.config file once.
For example, with the blob cache, the resource would need to only test that the changes required for blob cache are present, and not fail if another part of the web.config has been modified since the last update.
Currently IIS users get a web.config in the root of Drupal that tries to make Drupal behave well on IIS, but the files directory doesn't get the same treatment.So if you are going to be changing web.config files, I would look in to what x Web Administration can do and whether or not that needs extending.I'm closing this one off, thanks @tonyhxh The issue with the x Web Administration module is that it uses the IIS to change the web.config.The only "risk" I see is that the config isn't targeted to all WFE servers in the farm, which can cause inconsistent settings between different servers.So we have document this really well in our documentation, so our users are aware.It would be great for Drupal to create a Web.config that attempts to disable execution of files in the public files directory.