Sanity check of my config - is it secure?

[benseb]

Thanks for those tips. I'll have a read around those bits

My main concern is that by combining different locations, etc i may have
accidentally exposed a security issue - I need to ensure everything
that's not an image/css file/javascript file etc is either denied or
proxied to apache.

Posted at Nginx Forum: http://forum.nginx.org/read.php?2,199902,199931#msg-199931