From 7cc7dc4af22e390350707590f12dbef5b3b806ff Mon Sep 17 00:00:00 2001
From: Justine Tunney <jart@google.com>
Date: Tue, 2 Aug 2016 17:29:15 -0700
Subject: [PATCH] Use zip_rule() for EAR/WAR deploy archives

These build rules allow Bazel to generate the .ear and .war files which
appcfg.sh (a tool that comes with the App Engine SDK) can then use to
perform a deployment.

Included in this CL are configurations for five separate production
environments: production, sandbox, alpha, crash, and local.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=129163010
---
 java/google/registry/BUILD                    | 277 ++++++++++++++++++
 .../registry/builddefs/registry_ear_file.bzl  |  54 ++++
 java/google/registry/env/BUILD                |   6 -
 .../alpha/backend/WEB-INF/appengine-web.xml   |  28 ++
 .../alpha/default/WEB-INF/appengine-web.xml   |  32 ++
 .../env/alpha/default/WEB-INF/cron.xml        | 148 ++++++++++
 .../env/alpha/tools/WEB-INF/appengine-web.xml |  28 ++
 java/google/registry/env/common/BUILD         |   7 -
 java/google/registry/env/common/backend/BUILD |   9 -
 java/google/registry/env/common/default/BUILD |   9 -
 java/google/registry/env/common/tools/BUILD   |   9 -
 .../crash/backend/WEB-INF/appengine-web.xml   |  28 ++
 .../crash/default/WEB-INF/appengine-web.xml   |  32 ++
 .../env/crash/default/WEB-INF/cron.xml        | 128 ++++++++
 .../env/crash/tools/WEB-INF/appengine-web.xml |  28 ++
 .../local/backend/WEB-INF/appengine-web.xml   |  38 +++
 .../local/default/WEB-INF/appengine-web.xml   |  45 +++
 .../env/local/tools/WEB-INF/appengine-web.xml |  38 +++
 java/google/registry/env/production/BUILD     |   6 -
 .../registry/env/production/backend/BUILD     |   7 -
 .../registry/env/production/default/BUILD     |   7 -
 .../registry/env/production/tools/BUILD       |   7 -
 .../sandbox/backend/WEB-INF/appengine-web.xml |  33 +++
 .../sandbox/default/WEB-INF/appengine-web.xml |  34 +++
 .../env/sandbox/default/WEB-INF/cron.xml      | 125 ++++++++
 .../sandbox/tools/WEB-INF/appengine-web.xml   |  33 +++
 java/google/registry/ui/BUILD                 |  57 ++--
 javatests/google/registry/server/BUILD        |   5 +-
 javatests/google/registry/testing/BUILD       |   4 +-
 29 files changed, 1170 insertions(+), 92 deletions(-)
 create mode 100644 java/google/registry/builddefs/registry_ear_file.bzl
 delete mode 100644 java/google/registry/env/BUILD
 create mode 100644 java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml
 create mode 100644 java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml
 create mode 100644 java/google/registry/env/alpha/default/WEB-INF/cron.xml
 create mode 100644 java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml
 delete mode 100644 java/google/registry/env/common/BUILD
 delete mode 100644 java/google/registry/env/common/backend/BUILD
 delete mode 100644 java/google/registry/env/common/default/BUILD
 delete mode 100644 java/google/registry/env/common/tools/BUILD
 create mode 100644 java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml
 create mode 100644 java/google/registry/env/crash/default/WEB-INF/appengine-web.xml
 create mode 100644 java/google/registry/env/crash/default/WEB-INF/cron.xml
 create mode 100644 java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml
 create mode 100644 java/google/registry/env/local/backend/WEB-INF/appengine-web.xml
 create mode 100644 java/google/registry/env/local/default/WEB-INF/appengine-web.xml
 create mode 100644 java/google/registry/env/local/tools/WEB-INF/appengine-web.xml
 delete mode 100644 java/google/registry/env/production/BUILD
 delete mode 100644 java/google/registry/env/production/backend/BUILD
 delete mode 100644 java/google/registry/env/production/default/BUILD
 delete mode 100644 java/google/registry/env/production/tools/BUILD
 create mode 100644 java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml
 create mode 100644 java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml
 create mode 100644 java/google/registry/env/sandbox/default/WEB-INF/cron.xml
 create mode 100644 java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml

diff --git a/java/google/registry/BUILD b/java/google/registry/BUILD
index 1a5ed762e..cd2f11ae1 100644
--- a/java/google/registry/BUILD
+++ b/java/google/registry/BUILD
@@ -2,6 +2,8 @@ package(default_visibility = ["//java/google/registry:registry_project"])
 
 licenses(["notice"])  # Apache 2.0
 
+load("//java/google/registry/builddefs:zip_file.bzl", "zip_file")
+load("//java/google/registry/builddefs:registry_ear_file.bzl", "registry_ear_file")
 
 package_group(
     name = "registry_project",
@@ -12,3 +14,278 @@ package_group(
     ],
 )
 
+
+
+
+zip_file(
+    name = "common_war",
+    srcs = ["//third_party/java/appengine:appengine-api"],
+    out = "mandatory_stuff.war",
+    mappings = {"third_party/java/appengine": "WEB-INF/lib"},
+    visibility = ["//visibility:private"],
+)
+
+################################################################################
+# DOMAIN REGISTRY :: PRODUCTION ENVIRONMENT
+
+registry_ear_file(
+    name = "registry_ear",
+    out = "registry.ear",
+    configs = {
+        "env/common/META-INF/appengine-application.xml": "META-INF/appengine-application.xml",
+        "env/common/META-INF/application.xml": "META-INF/application.xml",
+    },
+    wars = {
+        "registry_default.war": "default",
+        "registry_backend.war": "backend",
+        "registry_tools.war": "tools",
+    },
+)
+
+zip_file(
+    name = "registry_default_war",
+    srcs = [
+        "env/common/default/WEB-INF/datastore-indexes.xml",
+        "env/common/default/WEB-INF/dos.xml",
+        "env/common/default/WEB-INF/logging.properties",
+        "env/common/default/WEB-INF/queue.xml",
+        "env/common/default/WEB-INF/web.xml",
+        "env/production/default/WEB-INF/appengine-web.xml",
+        "env/production/default/WEB-INF/cron.xml",
+        "//java/google/registry/module/frontend:frontend_jar_deploy.jar",
+    ],
+    out = "registry_default.war",
+    mappings = {
+        "java/google/registry/env/common/default": "",
+        "java/google/registry/env/production/default": "",
+        "java/google/registry/module/frontend": "WEB-INF/lib",
+    },
+    deps = [
+        ":common_war",
+        "//java/google/registry/ui:war_debug",
+    ],
+)
+
+zip_file(
+    name = "registry_backend_war",
+    srcs = [
+        "env/common/backend/WEB-INF/logging.properties",
+        "env/common/backend/WEB-INF/web.xml",
+        "env/production/backend/WEB-INF/appengine-web.xml",
+        "//java/google/registry/module/backend:backend_jar_deploy.jar",
+    ],
+    out = "registry_backend.war",
+    mappings = {
+        "java/google/registry/env/common/backend": "",
+        "java/google/registry/env/production/backend": "",
+        "java/google/registry/module/backend": "WEB-INF/lib",
+    },
+    deps = [
+        ":common_war",
+        "//java/google/registry/ui:war",
+    ],
+)
+
+zip_file(
+    name = "registry_tools_war",
+    srcs = [
+        "env/common/tools/WEB-INF/logging.properties",
+        "env/common/tools/WEB-INF/web.xml",
+        "env/production/tools/WEB-INF/appengine-web.xml",
+        "//java/google/registry/module/tools:tools_jar_deploy.jar",
+    ],
+    out = "registry_tools.war",
+    mappings = {
+        "java/google/registry/env/common/tools": "",
+        "java/google/registry/env/production/tools": "",
+        "java/google/registry/module/tools": "WEB-INF/lib",
+    },
+    deps = [
+        ":common_war",
+        "//java/google/registry/ui:war",
+    ],
+)
+
+
+################################################################################
+# DOMAIN REGISTRY :: SANDBOX ENVIRONMENT
+#
+# Sandbox is a production environment that registrar customers use to conduct
+# integration tests against the registry service.
+
+registry_ear_file(
+    name = "registry_sandbox_ear",
+    out = "registry_sandbox.ear",
+    configs = {
+        "env/common/META-INF/appengine-application.xml": "META-INF/appengine-application.xml",
+        "env/common/META-INF/application.xml": "META-INF/application.xml",
+    },
+    wars = {
+        "registry_default_sandbox.war": "default",
+        "registry_backend_sandbox.war": "backend",
+        "registry_tools_sandbox.war": "tools",
+    },
+)
+
+zip_file(
+    name = "registry_default_sandbox_war",
+    srcs = [
+        "env/sandbox/default/WEB-INF/appengine-web.xml",
+        "env/sandbox/default/WEB-INF/cron.xml",
+    ],
+    out = "registry_default_sandbox.war",
+    mappings = {"java/google/registry/env/sandbox/default": ""},
+    deps = [":registry_default_war"],
+)
+
+zip_file(
+    name = "registry_backend_sandbox_war",
+    srcs = ["env/sandbox/backend/WEB-INF/appengine-web.xml"],
+    out = "registry_backend_sandbox.war",
+    mappings = {"java/google/registry/env/sandbox/backend": ""},
+    deps = [":registry_backend_war"],
+)
+
+zip_file(
+    name = "registry_tools_sandbox_war",
+    srcs = ["env/sandbox/tools/WEB-INF/appengine-web.xml"],
+    out = "registry_tools_sandbox.war",
+    mappings = {"java/google/registry/env/sandbox/tools": ""},
+    deps = [":registry_tools_war"],
+)
+
+################################################################################
+# DOMAIN REGISTRY :: ALPHA ENVIRONMENT
+#
+# The alpha environment is used by developers to test new features.
+
+registry_ear_file(
+    name = "registry_alpha_ear",
+    out = "registry_alpha.ear",
+    configs = {
+        "env/common/META-INF/appengine-application.xml": "META-INF/appengine-application.xml",
+        "env/common/META-INF/application.xml": "META-INF/application.xml",
+    },
+    wars = {
+        "registry_default_alpha.war": "default",
+        "registry_backend_alpha.war": "backend",
+        "registry_tools_alpha.war": "tools",
+    },
+)
+
+zip_file(
+    name = "registry_default_alpha_war",
+    srcs = [
+        "env/alpha/default/WEB-INF/appengine-web.xml",
+        "env/alpha/default/WEB-INF/cron.xml",
+    ],
+    out = "registry_default_alpha.war",
+    mappings = {"java/google/registry/env/alpha/default": ""},
+    deps = [":registry_default_war"],
+)
+
+zip_file(
+    name = "registry_backend_alpha_war",
+    srcs = ["env/alpha/backend/WEB-INF/appengine-web.xml"],
+    out = "registry_backend_alpha.war",
+    mappings = {"java/google/registry/env/alpha/backend": ""},
+    deps = [":registry_backend_war"],
+)
+
+zip_file(
+    name = "registry_tools_alpha_war",
+    srcs = ["env/alpha/tools/WEB-INF/appengine-web.xml"],
+    out = "registry_tools_alpha.war",
+    mappings = {"java/google/registry/env/alpha/tools": ""},
+    deps = [":registry_tools_war"],
+)
+
+################################################################################
+# DOMAIN REGISTRY :: CRASH ENVIRONMENT
+#
+# The crash environment is used for testing loads, backups, and restores.
+
+registry_ear_file(
+    name = "registry_crash_ear",
+    out = "registry_crash.ear",
+    configs = {
+        "env/common/META-INF/appengine-application.xml": "META-INF/appengine-application.xml",
+        "env/common/META-INF/application.xml": "META-INF/application.xml",
+    },
+    wars = {
+        "registry_default_crash.war": "default",
+        "registry_backend_crash.war": "backend",
+        "registry_tools_crash.war": "tools",
+    },
+)
+
+zip_file(
+    name = "registry_default_crash_war",
+    srcs = [
+        "env/crash/default/WEB-INF/appengine-web.xml",
+        "env/crash/default/WEB-INF/cron.xml",
+    ],
+    out = "registry_default_crash.war",
+    mappings = {"java/google/registry/env/crash/default": ""},
+    deps = [":registry_default_war"],
+)
+
+zip_file(
+    name = "registry_backend_crash_war",
+    srcs = ["env/crash/backend/WEB-INF/appengine-web.xml"],
+    out = "registry_backend_crash.war",
+    mappings = {"java/google/registry/env/crash/backend": ""},
+    deps = [":registry_backend_war"],
+)
+
+zip_file(
+    name = "registry_tools_crash_war",
+    srcs = ["env/crash/tools/WEB-INF/appengine-web.xml"],
+    out = "registry_tools_crash.war",
+    mappings = {"java/google/registry/env/crash/tools": ""},
+    deps = [":registry_tools_war"],
+)
+
+################################################################################
+# DOMAIN REGISTRY :: LOCAL ENVIRONMENT
+#
+# The local environment only runs locally for testing and is never deployed.
+
+registry_ear_file(
+    name = "registry_local_ear",
+    out = "registry_local.ear",
+    configs = {
+        "env/common/META-INF/appengine-application.xml": "META-INF/appengine-application.xml",
+        "env/common/META-INF/application.xml": "META-INF/application.xml",
+    },
+    wars = {
+        "registry_default_local.war": "default",
+        "registry_backend_local.war": "backend",
+        "registry_tools_local.war": "tools",
+    },
+)
+
+zip_file(
+    name = "registry_default_local_war",
+    srcs = ["env/local/default/WEB-INF/appengine-web.xml"],
+    out = "registry_default_local.war",
+    mappings = {"java/google/registry/env/local/default": ""},
+    deps = [":registry_default_war"],
+)
+
+zip_file(
+    name = "registry_backend_local_war",
+    srcs = ["env/local/backend/WEB-INF/appengine-web.xml"],
+    out = "registry_backend_local.war",
+    mappings = {"java/google/registry/env/local/backend": ""},
+    deps = [":registry_backend_war"],
+)
+
+zip_file(
+    name = "registry_tools_local_war",
+    srcs = ["env/local/tools/WEB-INF/appengine-web.xml"],
+    out = "registry_tools_local.war",
+    mappings = {"java/google/registry/env/local/tools": ""},
+    deps = [":registry_tools_war"],
+)
+
diff --git a/java/google/registry/builddefs/registry_ear_file.bzl b/java/google/registry/builddefs/registry_ear_file.bzl
new file mode 100644
index 000000000..9d26bfe92
--- /dev/null
+++ b/java/google/registry/builddefs/registry_ear_file.bzl
@@ -0,0 +1,54 @@
+# Copyright 2016 The Domain Registry Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Build macro for creating App Engine EAR archives for Domain Registry."""
+
+load("//java/google/registry/builddefs:defs.bzl", "ZIPPER")
+
+def registry_ear_file(name, out, configs, wars, **kwargs):
+  """Creates an EAR archive by combining WAR archives."""
+  cmd = [
+      "set -e",
+      "repo=$$(pwd)",
+      "zipper=$$repo/$(location %s)" % ZIPPER,
+      "tmp=$$(mktemp -d $${TMPDIR:-/tmp}/registry_ear_file.XXXXXXXXXX)",
+      "cd $${tmp}",
+  ]
+  for target, dest in configs.items():
+    cmd += [
+        "mkdir -p $${tmp}/$$(dirname %s)" % dest,
+        "ln -s $${repo}/$(location %s) $${tmp}/%s" % (target, dest),
+    ]
+  for target, dest in wars.items():
+    cmd += [
+        "mkdir " + dest,
+        "cd " + dest,
+        "$${zipper} x $${repo}/$(location %s)" % target,
+        "cd ..",
+    ]
+  cmd += [
+      ("find . | sed 1d | cut -c 3- | LC_ALL=C sort" +
+       " | xargs $${zipper} cC $${repo}/$@"),
+      "cd $${repo}",
+      "rm -rf $${tmp}",
+  ]
+  native.genrule(
+      name = name,
+      srcs = configs.keys() + wars.keys(),
+      outs = [out],
+      cmd = "\n".join(cmd),
+      tools = [ZIPPER],
+      message = "Generating EAR archive",
+      **kwargs
+  )
diff --git a/java/google/registry/env/BUILD b/java/google/registry/env/BUILD
deleted file mode 100644
index 17ccbda7c..000000000
--- a/java/google/registry/env/BUILD
+++ /dev/null
@@ -1,6 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
diff --git a/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml b/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..774b7de5a
--- /dev/null
+++ b/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>backend</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4</instance-class>
+  <basic-scaling>
+    <max-instances>10</max-instances>
+    <idle-timeout>10m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="alpha"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1m"/>
+    <include path="/assets/js/**" expiration="1m"/>
+    <include path="/assets/css/**" expiration="1m"/>
+    <include path="/assets/images/**" expiration="1m"/>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml b/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..625375fa2
--- /dev/null
+++ b/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>default</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>F4_1G</instance-class>
+  <automatic-scaling>
+    <min-idle-instances>0</min-idle-instances>
+    <max-idle-instances>automatic</max-idle-instances>
+    <min-pending-latency>automatic</min-pending-latency>
+    <max-pending-latency>100ms</max-pending-latency>
+    <max-concurrent-requests>10</max-concurrent-requests>
+  </automatic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="alpha"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1m"/>
+    <include path="/assets/js/**" expiration="1m"/>
+    <include path="/assets/css/**" expiration="1m"/>
+    <include path="/assets/images/**" expiration="1m"/>
+    <include path="/assets/sources/**" expiration="1m"/>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/alpha/default/WEB-INF/cron.xml b/java/google/registry/env/alpha/default/WEB-INF/cron.xml
new file mode 100644
index 000000000..fe273077f
--- /dev/null
+++ b/java/google/registry/env/alpha/default/WEB-INF/cron.xml
@@ -0,0 +1,148 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<cronentries>
+
+  <cron>
+    <url>/_dr/task/rdeStaging</url>
+    <description>
+      This job generates a full RDE escrow deposit as a single gigantic XML document
+      and streams it to cloud storage. When this job has finished successfully, it'll
+      launch a separate task that uploads the deposit file to Iron Mountain via SFTP.
+    </description>
+    <!--
+      This only needs to run once per day, but we launch additional jobs in case the
+      cursor is lagging behind, so it'll catch up to the current date as quickly as
+      possible. The only job that'll run under normal circumstances is the one that's
+      close to midnight, since if the cursor is up-to-date, the task is a no-op.
+
+      We want it to be close to midnight because that reduces the chance that the
+      point-in-time code won't have to go to the extra trouble of fetching old
+      versions of objects from the datastore. However, we don't want it to run too
+      close to midnight, because there's always a chance that a change which was
+      timestamped before midnight hasn't fully been committed to the datastore. So
+      we add a 4+ minute grace period to ensure the transactions cool down, since
+      our queries are not transactional.
+    -->
+    <schedule>every 4 hours from 00:07 to 20:00</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=rde-upload&endpoint=/_dr/task/rdeUpload&forEachRealTld]]></url>
+    <description>
+      This job is a no-op unless RdeUploadCursor falls behind for some reason.
+    </description>
+    <schedule>every 4 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=rde-report&endpoint=/_dr/task/rdeReport&forEachRealTld]]></url>
+    <description>
+      This job is a no-op unless RdeReportCursor falls behind for some reason.
+    </description>
+    <schedule>every 4 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchDnl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest DNL from MarksDB and inserts it into the database.
+      (See: TmchDnlServlet, ClaimsList)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchSmdrl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest SMDRL from MarksDB and inserts it into the database.
+      (See: TmchSmdrlServlet, SignedMarkRevocationList)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchCrl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest CRL from MarksDB and inserts it into the database.
+      (See: TmchCrlServlet)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=sheet&endpoint=/_dr/task/syncRegistrarsSheet&runInEmpty]]></url>
+    <description>
+      Synchronize Registrar entities to Google Spreadsheets.
+    </description>
+    <schedule>every 1 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <!-- TODO(b/23319222): Re-enable when fixed.
+  <cron>
+    <url><![CDATA[/_dr/cron/commitLogFanout?queue=delete-commits&endpoint=/_dr/task/deleteOldCommitLogs&jitterSeconds=600]]></url>
+    <description>
+      This job deletes commit logs from datastore that are old, e.g. thirty days.
+    </description>
+    <schedule>every 20 minutes synchronized</schedule>
+    <target>backend</target>
+  </cron>
+  -->
+
+  <!-- TODO: Add borgmon job to check that these files are created and updated successfully. -->
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=export-reserved-terms&endpoint=/_dr/task/exportReservedTerms&forEachRealTld]]></url>
+    <description>
+      Reserved terms export to Google Drive job for creating once-daily exports.
+    </description>
+    <schedule>every day 05:30</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=group-members-sync&endpoint=/_dr/task/syncGroupMembers&runInEmpty]]></url>
+    <description>
+      Syncs RegistrarContact changes in the past hour to Google Groups.
+    </description>
+    <schedule>every 1 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/commitLogCheckpoint]]></url>
+    <description>
+      This job checkpoints the commit log buckets and exports the diff since last checkpoint to GCS.
+    </description>
+    <schedule>every 1 minutes synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=export-snapshot&endpoint=/_dr/task/exportSnapshot&runInEmpty]]></url>
+    <description>
+      This job fires off a datastore backup-as-a-service job that generates snapshot files in GCS.
+      It also enqueues a new task to wait on the completion of that job and then load the resulting
+      snapshot into bigquery.
+    </description>
+    <!-- Keep the task-age-limit for this job's task queue less than this cron interval. -->
+    <schedule>every day 06:00</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/readDnsQueue?jitterSeconds=45]]></url>
+    <description>
+      Lease all tasks from the dns-pull queue, group by TLD, and invoke PublishDnsUpdates for each
+      group.
+    </description>
+    <schedule>every 1 minutes synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+
+</cronentries>
diff --git a/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml b/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..0a82b840c
--- /dev/null
+++ b/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>tools</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4_1G</instance-class>
+  <basic-scaling>
+    <max-instances>100</max-instances>
+    <idle-timeout>5m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="alpha"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1m"/>
+    <include path="/assets/js/**" expiration="1m"/>
+    <include path="/assets/css/**" expiration="1m"/>
+    <include path="/assets/images/**" expiration="1m"/>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/common/BUILD b/java/google/registry/env/common/BUILD
deleted file mode 100644
index 737f8ac34..000000000
--- a/java/google/registry/env/common/BUILD
+++ /dev/null
@@ -1,7 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
-
diff --git a/java/google/registry/env/common/backend/BUILD b/java/google/registry/env/common/backend/BUILD
deleted file mode 100644
index 80135411c..000000000
--- a/java/google/registry/env/common/backend/BUILD
+++ /dev/null
@@ -1,9 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
-exports_files(glob(["WEB-INF/*"]))
-
-
diff --git a/java/google/registry/env/common/default/BUILD b/java/google/registry/env/common/default/BUILD
deleted file mode 100644
index 80135411c..000000000
--- a/java/google/registry/env/common/default/BUILD
+++ /dev/null
@@ -1,9 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
-exports_files(glob(["WEB-INF/*"]))
-
-
diff --git a/java/google/registry/env/common/tools/BUILD b/java/google/registry/env/common/tools/BUILD
deleted file mode 100644
index 80135411c..000000000
--- a/java/google/registry/env/common/tools/BUILD
+++ /dev/null
@@ -1,9 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
-exports_files(glob(["WEB-INF/*"]))
-
-
diff --git a/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml b/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..9b9cc5403
--- /dev/null
+++ b/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>backend</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4</instance-class>
+  <basic-scaling>
+    <max-instances>10</max-instances>
+    <idle-timeout>10m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="crash"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1m"/>
+    <include path="/assets/js/**" expiration="1m"/>
+    <include path="/assets/css/**" expiration="1m"/>
+    <include path="/assets/images/**" expiration="1m"/>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml b/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..4dd7927b1
--- /dev/null
+++ b/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>default</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>F4_1G</instance-class>
+  <automatic-scaling>
+    <min-idle-instances>0</min-idle-instances>
+    <max-idle-instances>automatic</max-idle-instances>
+    <min-pending-latency>automatic</min-pending-latency>
+    <max-pending-latency>100ms</max-pending-latency>
+    <max-concurrent-requests>10</max-concurrent-requests>
+  </automatic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="crash"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1m"/>
+    <include path="/assets/js/**" expiration="1m"/>
+    <include path="/assets/css/**" expiration="1m"/>
+    <include path="/assets/images/**" expiration="1m"/>
+    <include path="/assets/sources/**" expiration="1m"/>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/crash/default/WEB-INF/cron.xml b/java/google/registry/env/crash/default/WEB-INF/cron.xml
new file mode 100644
index 000000000..dc41d9d5a
--- /dev/null
+++ b/java/google/registry/env/crash/default/WEB-INF/cron.xml
@@ -0,0 +1,128 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<cronentries>
+
+  <cron>
+    <url>/_dr/task/rdeStaging</url>
+    <description>
+      This job generates a full RDE escrow deposit as a single gigantic XML document
+      and streams it to cloud storage. When this job has finished successfully, it'll
+      launch a separate task that uploads the deposit file to Iron Mountain via SFTP.
+    </description>
+    <!--
+      This only needs to run once per day, but we launch additional jobs in case the
+      cursor is lagging behind, so it'll catch up to the current date as quickly as
+      possible. The only job that'll run under normal circumstances is the one that's
+      close to midnight, since if the cursor is up-to-date, the task is a no-op.
+
+      We want it to be close to midnight because that reduces the chance that the
+      point-in-time code won't have to go to the extra trouble of fetching old
+      versions of objects from the datastore. However, we don't want it to run too
+      close to midnight, because there's always a chance that a change which was
+      timestamped before midnight hasn't fully been committed to the datastore. So
+      we add a 4+ minute grace period to ensure the transactions cool down, since
+      our queries are not transactional.
+    -->
+    <schedule>every 4 hours from 00:07 to 20:00</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=rde-upload&endpoint=/_dr/task/rdeUpload&forEachRealTld]]></url>
+    <description>
+      This job is a no-op unless RdeUploadCursor falls behind for some reason.
+    </description>
+    <schedule>every 4 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=rde-report&endpoint=/_dr/task/rdeReport&forEachRealTld]]></url>
+    <description>
+      This job is a no-op unless RdeReportCursor falls behind for some reason.
+    </description>
+    <schedule>every 4 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchDnl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest DNL from MarksDB and inserts it into the database.
+      (See: TmchDnlServlet, ClaimsList)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchSmdrl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest SMDRL from MarksDB and inserts it into the database.
+      (See: TmchSmdrlServlet, SignedMarkRevocationList)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchCrl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest CRL from MarksDB and inserts it into the database.
+      (See: TmchCrlServlet)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=sheet&endpoint=/_dr/task/syncRegistrarsSheet&runInEmpty]]></url>
+    <description>
+      Synchronize Registrar entities to Google Spreadsheets.
+    </description>
+    <schedule>every 1 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <!-- TODO: Add borgmon job to check that these files are created and updated successfully. -->
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=export-reserved-terms&endpoint=/_dr/task/exportReservedTerms&forEachRealTld]]></url>
+    <description>
+      Reserved terms export to Google Drive job for creating once-daily exports.
+    </description>
+    <schedule>every day 05:30</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=group-members-sync&endpoint=/_dr/task/syncGroupMembers&runInEmpty]]></url>
+    <description>
+      Syncs RegistrarContact changes in the past hour to Google Groups.
+    </description>
+    <schedule>every 1 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=export-snapshot&endpoint=/_dr/task/exportSnapshot&runInEmpty]]></url>
+    <description>
+      This job fires off a datastore backup-as-a-service job that generates snapshot files in GCS.
+      It also enqueues a new task to wait on the completion of that job and then load the resulting
+      snapshot into bigquery.
+    </description>
+    <!-- Keep the task-age-limit for this job's task queue less than this cron interval. -->
+    <schedule>every day 06:00</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/readDnsQueue?jitterSeconds=45]]></url>
+    <description>
+      Lease all tasks from the dns-pull queue, group by TLD, and invoke PublishDnsUpdates for each
+      group.
+    </description>
+    <schedule>every 1 minutes synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+
+</cronentries>
diff --git a/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml b/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..72aac3b85
--- /dev/null
+++ b/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>tools</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4</instance-class>
+  <basic-scaling>
+    <max-instances>10</max-instances>
+    <idle-timeout>10m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="crash"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1m"/>
+    <include path="/assets/js/**" expiration="1m"/>
+    <include path="/assets/css/**" expiration="1m"/>
+    <include path="/assets/images/**" expiration="1m"/>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml b/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..afe90f338
--- /dev/null
+++ b/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>backend</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4</instance-class>
+  <basic-scaling>
+    <max-instances>10</max-instances>
+    <idle-timeout>10m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="local"/>
+    <property name="appengine.generated.dir"
+              value="/tmp/domain-registry-appengine-generated/local/"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/js/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/css/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/images/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/local/default/WEB-INF/appengine-web.xml b/java/google/registry/env/local/default/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..183b45cb4
--- /dev/null
+++ b/java/google/registry/env/local/default/WEB-INF/appengine-web.xml
@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>default</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>F4_1G</instance-class>
+  <automatic-scaling>
+    <min-idle-instances>1</min-idle-instances>
+    <max-idle-instances>automatic</max-idle-instances>
+    <min-pending-latency>automatic</min-pending-latency>
+    <max-pending-latency>100ms</max-pending-latency>
+    <max-concurrent-requests>10</max-concurrent-requests>
+  </automatic-scaling>
+
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="local"/>
+    <property name="appengine.generated.dir"
+              value="/tmp/domain-registry-appengine-generated/local/"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/js/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/css/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/images/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/sources/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml b/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..5d1a17d65
--- /dev/null
+++ b/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>tools</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4</instance-class>
+  <basic-scaling>
+    <max-instances>10</max-instances>
+    <idle-timeout>10m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="local"/>
+    <property name="appengine.generated.dir"
+              value="/tmp/domain-registry-appengine-generated/local/"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/js/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/css/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/images/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/production/BUILD b/java/google/registry/env/production/BUILD
deleted file mode 100644
index 17ccbda7c..000000000
--- a/java/google/registry/env/production/BUILD
+++ /dev/null
@@ -1,6 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
diff --git a/java/google/registry/env/production/backend/BUILD b/java/google/registry/env/production/backend/BUILD
deleted file mode 100644
index 737f8ac34..000000000
--- a/java/google/registry/env/production/backend/BUILD
+++ /dev/null
@@ -1,7 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
-
diff --git a/java/google/registry/env/production/default/BUILD b/java/google/registry/env/production/default/BUILD
deleted file mode 100644
index 737f8ac34..000000000
--- a/java/google/registry/env/production/default/BUILD
+++ /dev/null
@@ -1,7 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
-
diff --git a/java/google/registry/env/production/tools/BUILD b/java/google/registry/env/production/tools/BUILD
deleted file mode 100644
index 737f8ac34..000000000
--- a/java/google/registry/env/production/tools/BUILD
+++ /dev/null
@@ -1,7 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
-
diff --git a/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml b/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..ece64f711
--- /dev/null
+++ b/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>backend</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4</instance-class>
+  <basic-scaling>
+    <max-instances>50</max-instances>
+    <idle-timeout>10m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="sandbox"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1d"/>
+    <include path="/assets/js/**" expiration="1d"/>
+    <include path="/assets/css/**" expiration="1d"/>
+    <include path="/assets/images/**" expiration="1d"/>
+  </static-files>
+
+  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
+  <static-error-handlers>
+    <handler file="error.html"/>
+  </static-error-handlers>
+</appengine-web-app>
diff --git a/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml b/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..c962d22d8
--- /dev/null
+++ b/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>default</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4_1G</instance-class>
+  <basic-scaling>
+    <max-instances>20</max-instances>
+    <idle-timeout>10m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="sandbox"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1d"/>
+    <include path="/assets/js/**" expiration="1d"/>
+    <include path="/assets/css/**" expiration="1d"/>
+    <include path="/assets/images/**" expiration="1d"/>
+    <include path="/assets/sources/**" expiration="1d"/>
+  </static-files>
+
+  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
+  <static-error-handlers>
+    <handler file="error.html"/>
+  </static-error-handlers>
+</appengine-web-app>
diff --git a/java/google/registry/env/sandbox/default/WEB-INF/cron.xml b/java/google/registry/env/sandbox/default/WEB-INF/cron.xml
new file mode 100644
index 000000000..e14467149
--- /dev/null
+++ b/java/google/registry/env/sandbox/default/WEB-INF/cron.xml
@@ -0,0 +1,125 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<cronentries>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchDnl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest DNL from MarksDB and inserts it into the database.
+      (See: TmchDnlServlet, ClaimsList)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchSmdrl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest SMDRL from MarksDB and inserts it into the database.
+      (See: TmchSmdrlServlet, SignedMarkRevocationList)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchCrl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest CRL from MarksDB and inserts it into the database.
+      (See: TmchCrlServlet)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=group-members-sync&endpoint=/_dr/task/syncGroupMembers&runInEmpty]]></url>
+    <description>
+      Syncs RegistrarContact changes in the past hour to Google Groups.
+    </description>
+    <schedule>every 1 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=export-snapshot&endpoint=/_dr/task/exportSnapshot&runInEmpty]]></url>
+    <description>
+      This job fires off a datastore backup-as-a-service job that generates snapshot files in GCS.
+      It also enqueues a new task to wait on the completion of that job and then load the resulting
+      snapshot into bigquery.
+    </description>
+    <!-- Keep the task-age-limit for this job's task queue less than this cron interval. -->
+    <schedule>every day 06:00</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=export-reserved-terms&endpoint=/_dr/task/exportReservedTerms&forEachRealTld]]></url>
+    <description>
+      Reserved terms export to Google Drive job for creating once-daily exports.
+    </description>
+    <schedule>every day 05:30</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/task/exportDomainLists]]></url>
+    <description>
+      This job exports lists of all active domain names to Google Cloud Storage.
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/readDnsQueue?jitterSeconds=45]]></url>
+    <description>
+      Lease all tasks from the dns-pull queue, group by TLD, and invoke PublishDnsUpdates for each
+      group.
+    </description>
+    <schedule>every 1 minutes synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/task/deleteProberData]]></url>
+    <description>
+      This job clears out data from probers and runs once a week.
+    </description>
+    <schedule>every monday 14:00</schedule>
+    <timezone>UTC</timezone>
+    <!-- TODO(b/27309488): maybe move this to the backend module. -->
+    <target>tools</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/task/verifyEntityIntegrity]]></url>
+    <description>
+      This job verifies entity integrity and runs once daily.
+    </description>
+    <schedule>every day 06:30</schedule>
+    <timezone>UTC</timezone>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=sheet&endpoint=/_dr/task/syncRegistrarsSheet&runInEmpty]]></url>
+    <description>
+      Synchronize Registrar entities to Google Spreadsheets.
+    </description>
+    <schedule>every 1 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <!-- TODO(b/23319222): Re-enable when fixed.
+  <cron>
+    <url><![CDATA[/_dr/cron/commitLogFanout?queue=delete-commits&endpoint=/_dr/task/deleteOldCommitLogs&jitterSeconds=600]]></url>
+    <description>
+      This job deletes commit logs from datastore that are old, e.g. thirty days.
+    </description>
+    <schedule>every 20 minutes synchronized</schedule>
+    <target>backend</target>
+  </cron>
+  -->
+
+
+</cronentries>
diff --git a/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml b/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..9e8bcb777
--- /dev/null
+++ b/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>tools</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4</instance-class>
+  <basic-scaling>
+    <max-instances>50</max-instances>
+    <idle-timeout>10m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="sandbox"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1d"/>
+    <include path="/assets/js/**" expiration="1d"/>
+    <include path="/assets/css/**" expiration="1d"/>
+    <include path="/assets/images/**" expiration="1d"/>
+  </static-files>
+
+  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
+  <static-error-handlers>
+    <handler file="error.html"/>
+  </static-error-handlers>
+</appengine-web-app>
diff --git a/java/google/registry/ui/BUILD b/java/google/registry/ui/BUILD
index 03af8eb17..e6f5aff80 100644
--- a/java/google/registry/ui/BUILD
+++ b/java/google/registry/ui/BUILD
@@ -3,36 +3,18 @@ package(default_visibility = ["//java/google/registry:registry_project"])
 licenses(["notice"])  # Apache 2.0
 
 load("@io_bazel_rules_closure//closure:defs.bzl", "closure_js_binary", "closure_js_deps")
+load("//java/google/registry/builddefs:zip_file.bzl", "zip_file")
 
 exports_files(["globals.txt"])
 
 
-filegroup(
-    name = "assets_recursive",
-    srcs = glob(["assets/**"]),
-)
-
-filegroup(
-    name = "js_files_recursive",
-    srcs = [
-        "//java/google/registry/ui/js:js_files",
-        "//java/google/registry/ui/js/registrar:js_files",
-        "//java/google/registry/ui/soy:js_files",
-        "//java/google/registry/ui/soy/registrar:js_files",
-    ],
-)
-
 filegroup(
     name = "runfiles",
-    srcs = [
+    srcs = glob(["assets/**"]) + [
         "brain_bin.js",
         "brain_bin_map.js",
         "registrar_bin.js",
         "registrar_bin_map.js",
-        ":assets_recursive",
-        "//javascript/closure:js_files_recursive",
-        "//javascript/template/soy:soy_usegoog_js_files",
-        "//java/google/registry/ui:deps.js",
         "//java/google/registry/ui/css:registrar_bin.css",
         "//java/google/registry/ui/html:html_files",
     ],
@@ -45,14 +27,45 @@ filegroup(
         "brain_bin.js.map",
         "deps.js",
         "registrar_bin.js.map",
-        ":js_files_recursive",
-        ":runfiles",
+        "registrar_dbg.js",
         "//javascript/closure:js_files_recursive",
         "//javascript/template/soy:soy_usegoog_js_files",
         "//java/google/registry/ui/css:css_files",
+        "//java/google/registry/ui/css:registrar_dbg.css",
+        "//java/google/registry/ui/js:js_files",
+        "//java/google/registry/ui/js/registrar:js_files",
+        "//java/google/registry/ui/soy:js_files",
+        "//java/google/registry/ui/soy/registrar:js_files",
     ],
 )
 
+zip_file(
+    name = "war",
+    srcs = [":runfiles"],
+    out = "ui.war",
+    mappings = {
+        "java/google/registry/ui/assets": "assets",
+        "java/google/registry/ui/css": "assets/css",
+        "java/google/registry/ui/html": "",
+        "java/google/registry/ui": "assets/js",
+    },
+)
+
+zip_file(
+    name = "war_debug",
+    srcs = [":runfiles_debug"],
+    out = "ui_debug.war",
+    mappings = {
+        "java/google/registry/ui/deps.js": "assets/sources/deps.js",
+        "java/google/registry/ui/brain_bin.js.map": "assets/js/brain_bin.js.map",
+        "java/google/registry/ui/registrar_bin.js.map": "assets/js/registrar_bin.js.map",
+        "java/google/registry/ui/registrar_dbg.js": "assets/js/registrar_dbg.js",
+        "java/google/registry/ui/css/registrar_dbg.css": "assets/css/registrar_dbg.css",
+        "": "assets/sources",
+    },
+    deps = [":war"],
+)
+
 java_library(
     name = "ui",
     srcs = glob(["*.java"]),
diff --git a/javatests/google/registry/server/BUILD b/javatests/google/registry/server/BUILD
index 0e391cba3..8f96b546b 100644
--- a/javatests/google/registry/server/BUILD
+++ b/javatests/google/registry/server/BUILD
@@ -47,7 +47,10 @@ java_library(
 java_library(
     name = "RegistryTestServer",
     srcs = ["RegistryTestServer.java"],
-    data = ["//java/google/registry/ui:runfiles_debug"],
+    data = [
+        "//java/google/registry/ui:runfiles",
+        "//java/google/registry/ui:runfiles_debug",
+    ],
     deps = [
         ":TestServer",
         "//java/com/google/common/collect",
diff --git a/javatests/google/registry/testing/BUILD b/javatests/google/registry/testing/BUILD
index 0eee27234..0768d2a7a 100644
--- a/javatests/google/registry/testing/BUILD
+++ b/javatests/google/registry/testing/BUILD
@@ -17,8 +17,8 @@ java_library(
     ),
     resources = [
         "logging.properties",
-        "//java/google/registry/env/common/default:WEB-INF/datastore-indexes.xml",
-        "//java/google/registry/env/common/default:WEB-INF/queue.xml",
+        "//java/google/registry:env/common/default/WEB-INF/datastore-indexes.xml",
+        "//java/google/registry:env/common/default/WEB-INF/queue.xml",
     ] + glob(["*.csv"]),
     visibility = ["//visibility:public"],
     deps = [