we use nginx in front for various reasons:
- is easier and much cleaner to do the rewrites and configure some stuff (like add/modify
Expires
headers) in nginx - we can easily block some requests like access to non-existent PHP scripts in nginx
- we can apply rate limiting to some areas of the site like the search form
- we can cache some HTTP response codes like 301, 302 and 404
- according to some old performance measures nginx is a little bit faster for static content than Varnish
- if you need to enable HTTPS you will have to deal with nginx in front anyway
so what pass nginx is cached in Varnish 30%-95% of the time, and only a few request pass to the Plone instances.