make documents available only to logged in users

We want to make this blog accessible only through login, the Private buddypress plugin works, for the pages and posts, although for documents it doesn't redirect to the login page, if the user is logged out, he can still have access to the file:

This is on an Nginx server, and we believe we need some redirect rules to apply, do you have any idea of how to fix this issue?

On Apache we managed to figure it out, by using these rules on the .htaccess file:
RewriteCond %{REQUEST_FILENAME} ^.*(mp3|m4a|pdf)$
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in.*$ [NC]
RewriteRule . / [R,L]

but Nginx doesnt allow the usage of this file. So we must find a way to insert these rules in the vhosts file under the /location.

Thank you,