Varnish 4.1 expert needed

I am looking for someone who already knows Varnish 4.1 so I don't have to dig out every functionality by my own.... We want to setup this (but we only need the Varnish part from you): Internet <-> nginx (for TLS, HTTP/2 and trivial stuff (like redirects)) <-> Varnish <-> Apache <-> Web-Application (Apache runs 1000 webservers.) These are our questions/goals: 1. We have too many slow clients and too many big files: Varnish has to tranfer the content from the origin server to itself in full speed and handles (together with nginx) the slow client connection without blocking the origin server. This also has to de done for normally non-cachable content (e.g. requests containing Authorization-header and/or query strings). 'Normal' content should be cached, but the non-cachable content NOT! So a second request to a non-cachable content should go to the origin server, but it should be transfered in full speed from the origin server... To make it clear: Non-cacheable content requests will go everytime to the origin server.... (Or can this behaviour be changed?) While the content is being received from the origin server it has to go in parallel to the 'outside' (= nginx). So Varnish is NOT allowed to wait for the complete content from the origin server! Is all that possible? If not, talk to me!! How do I define what is cacheable and what isn't by my own? (From the incoming side (Authorization-header and/or query strings, cookies) or from the origin server side (403, 404, Redirects etc)) 2. Sometimes we have a Thundering Herd problem. That has to be solved by the reverse proxy by sending just ONE request to the origin server. The other requests have to wait until some content is arriving which is then shown to them. (What is the behavior for non-cachable content in this situation?) Is that possible? If not, talk to me!! The above and the rest of my questions are in the attached document! Yes, it is really one-to-one. No load-balancing is involved. Most of the above should be easily be answered by a Varnish expert.... I need detailed answers! A 'yes, Varnish can do it' is not enough! I need it this way: Where is that written in the docs? How do I configure that, how do I verify that, and how do I see it in the logs? You won't get access to my machines! If that is a problem for you, don't bid! Have fun!