--- etc/nginx/sites-enabled/sharelatex.conf
+++ etc/nginx/sites-enabled/sharelatex.conf
@@ -4,6 +4,11 @@ server {

 	root /overleaf/services/web/public/;

+	# block external access to prometheus /metrics
+	location /metrics {
+		internal;
+	}
+
 	location / {
 		proxy_pass http://127.0.0.1:3000;
 		proxy_http_version 1.1;