http://blog.frelleto.com.br/ruby/rails/nginx/2014/09/01/como-proteger-os-downloads-com-nginx/

document_uploader.rb

class DocumentUploader < CarrierWave::Uploader::Base
  storage :file

  def store_dir
    "uploads/#{model.class.to_s.underscore}/#{mounted_as}/#{model.id}"
  end

  def extension_white_list
    %w(pdf)
  end
end

nginx

# /etc/nginx/sites-enabled/seu_site

upstream unicorn_server_seu_site {
   # This is the socket we configured in unicorn.rb
   server unix:/home/seu_site/shared/unicorn.sock
   fail_timeout=0;
}

server {
    listen 80;
    client_max_body_size 4G;

    # ser the Server output header
    more_set_headers 'Server: seu_site';

    server_name seu_site.com.br www.seu_site.com.br;

    keepalive_timeout 5;

    # Location of our static files
    root /home/seu_site/node/public;

    location ~ /uploads/(.*) {
      internal;
      alias /home/seu_site/node/public/uploads/$1;
    }

    location / {
      proxy_redirect off;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;

      proxy_set_header X-Sendfile-Type X-Accel-Redirect;
      proxy_set_header X-Accel-Mapping /uploads/=/home/seu_site/node/public/uploads/;
    }

    error_page 500 502 503 504 /500.html;
    location = /500.html {
      root /home/seu_site/node/public;
    }

    error_page 404 /404.html;
    location = /404.html {
      root /home/seu_site/node/public;
    }
}

post.rb

class Post
  mount_uploader :document, DocumentUploader
end

posts_controller.rb

class PostsController < ApplicationController
  before_action :authenticate_user!

  # ...

  def download
    @post = Post.find params[:id]
    send_file @post.document.file.file, disposition: 'inline', filename: @post.document.file.filename
  end
end

production.rb

SeuSite::Application.configure do

  # ...
  
  config.action_dispatch.x_sendfile_header = 'X-Accel-Redirect'

  # ...
end

routes.rb

SeuSite::Application.routes.draw do
  devise_for :users
  
  # ...

  get 'posts/:id/download' => 'posts#download', as: 'download_posts'

  # ...
end