HAProxy – Enable HTTP Strict Transport Header Globally

Firstly this adds unneccesary complexity to your webservers.

Secondly terminating the SSL connection at the LB means you can use keepalive on the client side for the connection reducing the complex part of establishing the connection. Also the most efficient use of resources is to group like workloads. Many people seperate static and dynamic content, SSL at the LB means that both can come from different servers through the same connection.

Thirdly SSL generally scales at a different rate than required by your web app. I think the lack of examples is due to the fact that a single LB pair or Round robin dns is enough for most people. It seems to me that you may be overestimating the SSL workload.

Also I am not sure about your reasoning regarding security. In addition to the fact that the webserver is already running far more services with possible exploits, if there are any vulnerabilities in the LB then you have just introduced them onto your webservers too!

If you would be okay with any of the following response codes: 200, 400, 403, 405, 408, 429, 500, 502, 503, or 504.

Then you could do something like this:

frontend www
  ...
  default_backend no-match

backend no-match
  mode http
  http-request deny deny_status 400

• http-request: http://cbonte.github.io/haproxy-dconv/1.7/configuration.html#4-http-request
• Accepted response codes described in errorfile: http://cbonte.github.io/haproxy-dconv/1.7/configuration.html#errorfile