at the moment, our application servers are directly accessable on the internet, like the following picture shows.
With this in mind, it would be aful if a server crashes (hardware-failure) or stops doing it work somehow.
To prevent this, i would like to split my application server and put a load balancer in front of it, like the next picture shows. A separate server for the database shows up here, but this is not part of the question, but a note, that database will be extracted from the APS, too.
Whilst the WAF (modsecurity for apache) run on the application servers at the moment, would you put the WAF on the loadbalancer on the new configuration? I thought about using NGINX as a proxy/loadbalancer for it. Or should i leave it on the APS? I am also not sure if there is any influence if the TLS-termination is done by the APS's or on the load-balancer.
Our concerns are most about security, availability and of course performance.
Thank you :)