For path-specific rate limits I prefer a dedicated limit_req_zone keyed on $binary_remote_addr and apply it only on the login or write locations, not the whole server. That keeps health checks and static assets free while credential stuffing hits the burst/nodelay ceiling. After deploy I curl the limited path twice quickly to confirm 503/429 behavior, then once slowly to confirm legit traffic still passes.