Setting up the private file directory (nginx) Problem

I'm trying to set-up a private file directory for Drupal on an LEMP stack (Ubuntu 12.04, nginx, MySQL, PHP), I wasn't 100% sure about the permissions or set-up so I thought I'd ask, how should you do it?

So Far

It needs to be a folder which is writable by the webserver but not accessible from the web.

Example:

Location: drupal_root/privatefiles

Permission: chgrp 775 www-data privatefiles

Nginx config: (goes into /etc/nginx/sites-available/mysite): 

server {
         listen 8080;
           root /srv/www/mysite/public;


           location ^~ /privatefiles {
             internal;
           }

        ...
        }


Would that be enough? It recommends on the official page to have the folder outside the Drupal root. What difference would this make?
Have a look at Perusio's config, it has all the information and explanation you need. Here is a quote from it:


  This config assumes that private files are stored under a directory
  named private. I suggest sites/default/files/private or
  sites/&lt;sitename&gt;/files/private but can be anywhere inside the site
  root as long as you keep the top level directory name private. (...)
  Example: Calling the top level private files directory protected
  instead of private.

location ^~ /sites/default/files/protected {          
  internal;        
}

  
  Now any attempt to access the files under this directory directly will
  return a 404.


... 


  The usual practice involves setting up a directory outside of
  files directory and giving write permissions to the web server user.
  (...)  I think it to be less advisable, in the sense that now there's another directory that is writable by the server.
  
  I prefer to use a directory under files, which is the only one that is
  writable by the web server, and use the above location (protected or
  private) to block access by the client to it.


In short, marking it as internal is enough.