All of our requests to apache are routed from nginx on port 80 to apache at  127.0.0.1:8080, so this is going to allow anyone to see /server-status.

You would have to block /server-status in the webserver's nginx conf for this to work, or you can just deny all like we do on microsites.