Explanation of the setup:

- a frontend server runs Nginx
- a backend server runs the PHP application

In the original setup, both are virtual machines on the same host, and we can mount parts of the piwik to the frontend. YMMV (the security.limit_extensions would include also .js and .css without that possibility)