In my setup I use the below rules:
# IPS REWRITE RULES
location / {
try_files $uri $uri/ /index.php?$args;
}
# IPS API
location /api/ {
try_files $uri $uri/ /api/index.php?$args;
}
# IPS PHP/CGI PROTECTION
location ~ ^/uploads/.*\.(?:php\d*|phtml)$ {
deny all;
}
location ~ ^/datastore/.*\.(?:php\d*|phtml)$ {
deny all;
}