[0ren]

Nitpick:

> Temporary files usually start with a dot or a dollar-sign.. to make sure that Nginx never serves any files starting with either of those characters...

> location ~ ~$ { access_log off; log_not_found off; deny all; }

Wouldn't that regex match temporary files ending with ~ (as it should)?