caddy_antibot_gzip_bomb.md

caddyfile:

example.com:443 {
    tls /home/cer /home/key
    log {
        output stdout
        format console
    }
    @http11 protocol http/1.1
    respond @http11 "leave me" 404

    @gzipUnSupported {
        not header Accept-Encoding *gzip*
    }
    @withoutStrings {
        not path */secret_path* */favicon.ico*
    }

    reverse_proxy 127.0.0.1:8080 {
        handle_response {
            handle @withoutStrings {
                handle @gzipUnSupported {
                    respond "leave me" 404
                }

                header content-encoding gzip
                header Content-Type text/html
                root * /home/
                rewrite *  /bomb.gzip
                file_server
            }
            copy_response
        }
    }
}

make bomb file

dd if=/dev/zero bs=1M count=20K | gzip -9  > bomb.gzip

test with curl

curl --http1.1 --compressed  -v https://example.com/secret_or_not -o - | pv > /dev/null