nginx - serve only images - nginx

Question

I'm trying to setup nginx so "static.domain.com" can only serve images. This is what I have come up with, but I know it can be done more efficiently. I want to serve 403.html if someone tries to access any .htm, .php, directory (anything else I'm missing?) files. Of course, with the exception of 403.htm and static.htm files.
Any ideas how I can secure this properly?
server {
listen xx.xx.xx.xx:80;
server_name static.domain.com;
root /www/domain.com/httpdocs;
index static.htm;
access_log off;
error_log /dev/null crit;
error_page 403 /403.html;
# Disable access to .htaccess or any other hidden file
location ~ /\.ht {
deny all;
}
location ~* \.php {
deny all;
}
# Serve static files directly from nginx
location ~* \.(jpg|jpeg|gif|png|bmp|ico|pdf|flv|swf|exe|html|htm|txt|css|js) {
add_header Cache-Control public;
add_header Cache-Control must-revalidate;
expires 7d;
}
}

Answer 1

Why not move the images up and then deny all?
location ~* \.(jpg|jpeg|gif|png|bmp|ico|pdf|flv|swf|exe|html|htm|txt|css|js) {
add_header Cache-Control public;
add_header Cache-Control must-revalidate;
expires 7d;
}
location / {
deny all;
}
there is no syntax for NOT matching a regular expression. Instead, match the target regular expression and assign an empty block, then use location / to match anything else. -From http://wiki.nginx.org/HttpCoreModule#location
Edit: Removed "=" from "location /"
To quote the docs:
location = / {
# matches the query / *only.*
}
location / {
# matches *any query*, since all queries begin with /, but regular
# expressions and any longer conventional blocks will be
# matched first.
}
My bad.