Great writeup. One suggestion on the nginx front I might suggest is you add an entry to drop requests for unknown hosts. e.g. http://104.131.41.220
https://github.com/h5bp/server-configs-nginx/blob/master/sit...
That github repo is a goldmine for understanding nginx configs too.