After discussion, we've decided to go with a match against the private hostname as passed in as an environment variable, mostly as stripping headers isn't built into nginx by default.