Caching, bot defense and a CDN

I've been wary of and interested in putting a CDN in front of my site. I had tools in place to block bots (and several countries), but they were fragmented and it was an ongoing rock fight. I had a Go job that banned IPs after too many 404s, a crawler denylist that mirrored my robots.txt, and an SQL-injection probe filter (regex). I also wanted the improved load times and other niceties that come with a CDN. The catch (and cause for my concern) is that I wanted my existing Redis caching, live routes (like the now playing block on the home and music pages), and other bot-related mitigations to keep working. Setup I've been using bunny.net to serve images here (and on my Mastodon instance) for ages, so it was a natural shift to put their CDN in front of the site itself. I pointed the domain you're reading this on to a new pull zone, while leaving the apex and my admin pointing at the origin server. The "public" origin is accessible only via requests from the edge through bunny. Each…