tree ba9b14350f6b133807b3a38950588694fa89e8fa
parent 41271816b81fd7af6f1820097a743dec1ab16cc9
author Antonio Barone <syntonyze@gmail.com> 1635775862 +0100
committer Antonio Barone <syntonyze@gmail.com> 1636130783 +0000

Single-primary: separate HTTP from SSH traffic

Using a Network Load Balancer forces all the traffic to be handled at
the transport level (Level 4). Whilst this is fine for SSH traffic, it
is not ideal for HTTP traffic, which should be handled at application
level (Level 7).

Split HTTP and SSH traffic and handle HTTP traffic via an Application
Load Balancer.

This unlocks many benefits, among which:
- Advanced routing: based on path, host, headers, request method,
  source IP, etc
- Application-based sticky sessions
- Seamless integration with X-Ray
- Detailed access logs

Separating HTTP and SSH traffic requires to make two endpoints
available at DNS level, respectively:

- <HttpSubDomain>.<HostedZoneName>:443
- <SshSubDomain>.<HostedZoneName>:29418

Bug: Issue 15087
Change-Id: I30b55c3718d2b52d1651a8e541411dc29946cc40