That's hard. Only way for the load balancer to see URL paths is to terminate TLS, and that opens a whole can of worms around Puppet's use of mTLS. The Puppet Server process heavily expects to see the client certificate in the TLS handshake.