Connection pool proxy

Design a connection-pool / proxy layer for a Postgres primary that can only handle ~500 concurrent backends, but sits behind 2,000 stateless app instances each wanting its own pool, spiking under load. Symptoms: connection exhaustion, memory pressure on the DB, and a thundering herd of reconnects after a failover. How do you pool connections, multiplex many clients onto few DB connections, and survive failover?