Limit user access via proxy

[faust 1111]

I run Couch
and nginx as proxy
users can download files directly from couch

But how i can limit access only read from my db (limit to remote ip)?

Маy be it's better catch requests to files in my ruby app?
but directly to couch is faster.