I use the below config to let nginx listen 127.0.0.1:444, so only local server can access:
127.0.0.1:444
server { listen 127.0.0.1:444 ssl ht