The location resolution order, the arbitrary rule inheritance, the complete lack of useful errors, the abundance of footguns, the asinine defaults. Oh and automatic certificate renewal is still a pain. Purging the cache selectively took me a few days to set up.

Blame the user all you want, but after a decade of using nginx, I'm ready to claim that it's a pain to work with.