SilverStripe improved Nginx configuration built upon http://doc.silverstripe.org/framework/en/installation/nginx.

nginx.conf

location / {
	try_files $uri /framework/main.php?url=$uri&$query_string;
}

error_page 404 /assets/error-404.html;
error_page 500 /assets/error-500.html;

location ^~ /assets/ {
	sendfile on;
	try_files $uri =404;
}

location ~ "^/framework/.*(?:main|rpc|tiny_mce_gzip)\.php$" {
	fastcgi_index index.php;
	if (!-f $document_root$fastcgi_script_name) {
		return 404;
	}

	fastcgi_keep_conn on;
	fastcgi_pass 127.0.0.1:9000;
	fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	include fastcgi_params;

	# note: might need the next two, since SilverStripe admin system login often sends really fat HTTP headers
	#fastcgi_buffers 48 4k;
	#fastcgi_buffer_size 32k;
}

location ~ "^/(?:mysite|framework|cms)/.*\.(?:php|php3|php4|php5|phtml|inc)$" {
	deny all;
}

location ~ "/\.." {
	deny all;
}

location ~ "\.ss$" {
	satisfy any;
	allow 127.0.0.1;
	deny all;
}

location ~ "web\.config$" {
	deny all;
}

location ~ "\.ya?ml$" {
	deny all;
}

location ^~ "^/vendor/" {
	deny all;
}

location ~* "^/silverstripe-cache/" {
	deny all;
}

location ~* "composer\.(?:json|lock)$" {
	deny all;
}

location ~* "^/(?:cms|framework)/silverstripe_version$" {
	deny all;
}

location ~ "\.php$" {
	fastcgi_index index.php;
	if (!-f $document_root$fastcgi_script_name) {
		return 404;
	}

	fastcgi_keep_conn on;
	fastcgi_pass 127.0.0.1:9000;
	fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	include fastcgi_params;
}