Which directive order ensures a default-deny posture in ngx_http_access_module?

Implementing a security posture that prevents accidental public access to internal resources requires a precise configuration of the ngx_http_access_module. In Nginx, the allow and deny directives are used to restrict access based on client IP addresses or CIDR blocks.

Because these directives are processed sequentially, the order of operations determines whether a request is permitted or rejected. There is a need to establish a configuration pattern that guarantees all traffic is blocked unless specifically whitelisted, avoiding scenarios where a missing rule results in open public access.

Does placing deny all; at the end of a configuration block effectively create a default-deny environment? Which specific levels—http, server, or location—take precedence when conflicting access rules are defined across multiple blocks?