How do you selectively block access to all static files under a folder (e.g. /wp-admin/) but make sure that the .php files are executed properly when access is allowed, and without creating a heap of location blocks and tearing your hair out due to nginx selecting the wrong block?

    location = /xmlrpc.php {
        deny all;
    }

    # apparently things break if admin-ajax.php isn't allowed
    location = /wp-admin/admin-ajax.php {
        allow all;
        include php-config.conf;
    }

    location = /wp-login.php {
        include only-allow-from.conf;
        include php-config.conf;
    }

    location ^~ /wp-admin/ {
        include only-allow-from.conf;
        location ~ \.php$ {
            include php-config.conf;
        }
    }

php-config.conf

include fastcgi_params;
fastcgi_intercept_errors on;
fastcgi_pass unix:/var/run/php/php8.5fpm.sock;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

only-allow-from.conf

# single IPv6 host
allow 2603:1061:14:14::1;
# subnet
allow 2603:1061:14:14::/64;
allow 150.171.109.27;
allow 192.168.0.0/24;
deny all;