Yes, bulletproof hosting using reverse proxies or chaining multiple tunnels with a ddos solution (like cloudflare)

i.e.

Backend hosts (multiples) -> NGINX in upstream mode that only serves on localhost -> (Proxy, SSH tunnel, or Multiple SSH tunnels chained together) w/ NGINX/APACHE reverse proxy to prev connection -> Anti DDoS service (cloudflare)

It would prevent anyone from being able to discover the backend servers ip addresses and the upstream mode will distribute the load so 1 server does not get bogged down.

It would also prevent the DDOS service (or anyone) from knowing the ip addresses of the backend servers to get them shutdown.

Worst they can do is get one of the proxies taken down which can be had to pennies on the dollar.

It would look like this is someone were to visit the site

website.win -> cloudflare -> proxy1/reverse proxy (stunnel1 -> stunnel2 -> stunnel3) -> upstream/HA server -> (backend1, backend2, backend3, etc)

Normal traffic will only be able to see to cloudflare, cloudflare/gov will only be able to see to proxy1 (which will look like the main site but will not be accessible unless coming through CF). They would need a warrant for proxy1 as well as one for each one in the chain.

Yes, bulletproof hosting using reverse proxies or chaining multiple tunnels with a ddos solution (like cloudflare)

i.e.

Backend hosts (multiples) -> NGINX in upstream mode that only serves on localhost -> (Proxy, SSH tunnel, or Multiple SSH tunnels chained together) w/ NGINX/APACHE reverse proxy to prev connection -> Anti DDoS service (cloudflare)

It would prevent anyone from being able to discover the backend servers ip addresses and the upstream mode will distribute the load so 1 server does not get bogged down.

It would also prevent the DDOS service (or anyone) from knowing the ip addresses of the backend servers to get them shutdown.

Worst they can do is get one of the proxies taken down which can be had to pennies on the dollar.