HAProxy looks good, but I would also consider a unique unguessable subdomain per established customer. This won't thwart the IP-level attacks, but it will thwa

HAProxy looks good, but I would also consider a unique unguessable subdomain per established customer. This won't thwart the IP-level attacks, but it will thwart most subdomain attacks for those customers.