Use a location rule in Nginx for wp-admin denying access to all and then allowing access only to a specified IP address (the machine hosting the proxy).
Alternatively, you can deny access to all on the public site (www.example.com/wp-admin -> 405) and create a separate sites which allows access to the admin (admin.example.com/wp-admin -> 200) with that separate site only listening on a private interface (and/or behind a firewall, etc). That's modestly more secure because IPs can be spoofed, but I was just worried about the "Script kiddie hits every /wp-admin in the world at once with a zero-day" than worried about someone trying to compromise my blog in particular.
Alternatively, you can deny access to all on the public site (www.example.com/wp-admin -> 405) and create a separate sites which allows access to the admin (admin.example.com/wp-admin -> 200) with that separate site only listening on a private interface (and/or behind a firewall, etc). That's modestly more secure because IPs can be spoofed, but I was just worried about the "Script kiddie hits every /wp-admin in the world at once with a zero-day" than worried about someone trying to compromise my blog in particular.