CF ASN and bot block
│
▼
Caddy/Iocaine
│
├── response other than 421 ──► return Iocaine response
│
└── 421 ──────────────────────► continue to normal Caddy routing
                                  │
                                  ▼
                               Caddy - CN block
                                  │
                                  ▼
                                Lemmy

Caddyfile:

{$LEMMY_HOSTNAME} {
    import caddy-common

    ######################################
    ########## log files        ##########
    log cn_blocked {
            output file /data/cn-blocked.log
            format json
            no_hostname
    }

    ########## iocaine  code ##########
    @read method GET HEAD
            reverse_proxy @read host.docker.internal:42069 {
            @fallback status 421
            handle_response @fallback
    }

    ########## cn blocking code ##########
    @blocked {
            remote_ip 1.0.1.0/24 ...
    }

    route @blocked {
            log_name cn_blocked
            respond "<h1>Access Denied</h1>" 403
    }
    ##########   cn block ends  ##########
    ######################################  

Iocaine metrics with CF still on:

$ curl -s http://127.0.0.1:42042/metrics | grep '^qmk_'
qmk_garbage_generated{host="127.0.0.1:42069"} 3888
qmk_garbage_generated{host="no.lastname.nz"} 251440
qmk_requests{host="127.0.0.1:42069"} 2
qmk_requests{host="172.18.0.1:42069"} 2
qmk_requests{host="no.lastname.nz"} 404
qmk_ruleset_hits{outcome="default",ruleset="default"} 223
qmk_ruleset_hits{outcome="default",ruleset="trusted-path"} 1
qmk_ruleset_hits{outcome="garbage",ruleset="ai.robots.txt"} 11
qmk_ruleset_hits{outcome="garbage",ruleset="major-browsers"} 172
qmk_ruleset_hits{outcome="garbage",ruleset="unwanted-visitors"} 1