OK new question. When running CF Server in an enterprise, why not use the built-in web server? Our ops connect CF to Apache. What is the benefit of doing it this way? Doesn’t it just complicate the setup?

Primarily to enable a potential DMZ between the web server and the CFML server. In a production environment, one wants to keep as little as possible on the public-exposed servers.

Duh. that makes perfect sense.

There used to be a (perceived) concern about the throughput that the web server that shipped with JRun could handler. I don't believe this to be the case with Coyote (Tomcat's webserver component); I think it is production-quality.

What would Adobe consider ‘best practice’?

Ha haha

For a Tomcat-based CF install, I would recommend having an other web server in front, but not related to performance, just for configurability. Doing stuff like SSL, client certs, virtual directories, logs, isn't going to be quite as easy via Catalina. The other benifit of an external web server is if you have a lot of static files, it can serve those up directly and not proxy any of that traffic though Tomcat.

FWIW, my preferred setup is Nginx doing a plain HTTP proxy to the built-in web server. Back in the JRun days, the custom connector was terrible and full of bugs, and my experiences with the mod_jk stuff for Tomcat (in general, not just for CF) have also been poor (HTTP verb support was an issue which meant no proper REST usage, but the whole mess of configuration is just not worth dealing with). But, yeah, put a dedicated web server in front of the servlet container, no matter how you run CF/Lucee, and proxy requests.

You can, but unless its running internally, or you are running a mass farm of them behind load balancing firewalls, you are setting yourself up for a bad time. The default http engine doesnt handle all kinds of bad requests, stateless quests for objects like static html, it doesn't handle url rewrites overly well. Added to all of this, if you decide to "hack it" and change the underlying defaults to be more main stream, adobe is apt to ship a patch that will break your configuration. Its why, even Adobe suggests using another HTTPD server such as IIS, Apache HTTPD or even Nginx.