nginx: block all /metrics endpoints

shared/applications/server/nginx.nix

@@ -10,6 +10,16 @@ let
       -out "$out/ca.pem" -keyout "$out/ca.key"
   '';
 in {
+  # block all /metrics endpoints
+  options.services.nginx.virtualHosts = lib.mkOption {
+    type = lib.types.attrsOf (lib.types.submodule {
+      config.locations."/metrics" = lib.mkDefault {
+        extraConfig = "deny all;";
+      };
+    });
+  };
+
+  config = {
     services.nginx = {
       enable = true;
 
@@ -52,5 +62,6 @@ in {
       allowedTCPPorts = [80 443];
       allowedUDPPorts = [443];
     };
+  };
 }