Has something changed on the server, i.e different PHP version? Check with phpinfo() if gd is still enabled on the server. Might make sense to also check the php and server error logs.
Only one location is matched at any given time, so if that last block is found to be matching, the location / block is never run; just because ~* blocks have a higher priority.
Kirby needs to be invoked when the image does not exist, so it can generate it, respond with it and save it into the media folder. The next time a user requests the image, it’s already there and kirby can be skipped.
I think you should be able to do this by adding a try_files directive to the assets block.
So if the requested image doesn’t exist, the request is internally redirected to the ~* \.php$ location, if it is found the headers are added and the file is returned as is.
you also want to block access to the content, site and kirby folders. Which, judging by the config I’m able to see is not happening. Otherwise people would be able to access, for example “/content/site.txt” and possibly get access to private data.
You also want to block access to hidden files (filename starting with a .), because you could, for example have a .git folder in your root, or you could have an .env file which you definitely don’t want to expose.
The only folder starting with a . you might want to expose is the .well-known folder (let’s encrypt might rely on that).