The only DevOps friendly WAF in the market is from Wallarm (wallarm.com ), it meets the requirement from DevOps best practices
It has a real hybrid architecture and has integrated DAST scanner and active treath verification.
I learned that if you encrypt first you will only have random data, which will limit any potential benefit from compression.
So I would say that compress before encrypt
