location = /logout {
    {{ lookup('proxy_pass', 'web-svc-logout', 'logout', 'http', tail='/logout') }}
    proxy_set_header   Host              $host;
    proxy_set_header   X-Real-IP         $remote_addr;
    proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header   X-Forwarded-Proto $scheme;
    proxy_http_version 1.1;

    {% include 'roles/sys-svc-proxy/templates/headers/upstream_strips.conf.j2' %}

    {%- set aca_origin = (lookup('tls', 'web-svc-logout', 'url.base') | regex_replace('/$', '')) ~ " always" -%}
    {%- set aca_credentials = "'true' always" -%}
    {%- set aca_methods = "'GET, OPTIONS' always" -%}
    {%- set aca_headers = "'Accept, Authorization' always" -%}
    {%- include 'roles/sys-svc-proxy/templates/headers/access_control_allow.conf.j2' -%}

    add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
    add_header Pragma "no-cache" always;
    add_header Expires "0" always;

    if ($request_method = OPTIONS) {
      return 204;
    }
}