I'm not an expert, but it's also better to use something like /blog rather than a subdomain, for SEO reasons.
There are some proxying shenanigans you can do with mod_rewrite but I'd certainly not want a PHP-based blog anywhere near my main site/app if I could get away with it due to the security risks.
In fact, on one domain nginx sends part of the traffice /static/ directly to that actual directory, and anything else gets picked up by node.js.
Or is what I'm doing really stupid? I'm not currently running anything significant on my servers, and this is not my primary domain of interest, so I've never checked how risky my setup is. Maybe you could tell me if that's the case?