Comment 2 for bug 1918439

I think we should try go down the HAProxy route first and perhaps have it per-site with the default disabled. The main reason being that we already generate the HAProxy config file used so should be more straight forward to implement vs. iptables where we'll then have to manage.

Also, I'm not sure what metrics the haproxy telegraf plugin exposes but it would be nice to extend it to support feeding the limits and existing connections metrics so we could alert when close to reaching said threshold.