For anyone who is self hosting ghost blog behind nginx, this is the configuration that worked for me:

location ^~ /.ghost/activitypub/ {
    proxy_pass https://ap.ghost.org;
    proxy_http_version 1.1;
    proxy_ssl_server_name on;

    proxy_set_header Host $host;
    proxy_set_header Authorization $http_authorization;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    proxy_no_cache 1;
    proxy_cache_bypass 1;
}

location = /.well-known/webfinger {
    proxy_pass https://ap.ghost.org;
    proxy_set_header Host $host;
}

location = /.well-known/nodeinfo {
    proxy_pass https://ap.ghost.org;
    proxy_set_header Host $host;
}

# catch all other .ghost hidden files (optional)
location ~ ^/\.ghost/ {
    proxy_pass https://ap.ghost.org;
    proxy_set_header Host $host;
}

Restart nginx. It won't work until you disable and enable "Network" option in Grow settings of your Ghost blog. Thanks for this tip to antsu blog.