diff --git a/java/google/registry/BUILD b/java/google/registry/BUILD
index 1a5ed762e..cd2f11ae1 100644
--- a/java/google/registry/BUILD
+++ b/java/google/registry/BUILD
@@ -2,6 +2,8 @@ package(default_visibility = ["//java/google/registry:registry_project"])
 
 licenses(["notice"])  # Apache 2.0
 
+load("//java/google/registry/builddefs:zip_file.bzl", "zip_file")
+load("//java/google/registry/builddefs:registry_ear_file.bzl", "registry_ear_file")
 
 package_group(
     name = "registry_project",
@@ -12,3 +14,278 @@ package_group(
     ],
 )
 
+
+
+
+zip_file(
+    name = "common_war",
+    srcs = ["//third_party/java/appengine:appengine-api"],
+    out = "mandatory_stuff.war",
+    mappings = {"third_party/java/appengine": "WEB-INF/lib"},
+    visibility = ["//visibility:private"],
+)
+
+################################################################################
+# DOMAIN REGISTRY :: PRODUCTION ENVIRONMENT
+
+registry_ear_file(
+    name = "registry_ear",
+    out = "registry.ear",
+    configs = {
+        "env/common/META-INF/appengine-application.xml": "META-INF/appengine-application.xml",
+        "env/common/META-INF/application.xml": "META-INF/application.xml",
+    },
+    wars = {
+        "registry_default.war": "default",
+        "registry_backend.war": "backend",
+        "registry_tools.war": "tools",
+    },
+)
+
+zip_file(
+    name = "registry_default_war",
+    srcs = [
+        "env/common/default/WEB-INF/datastore-indexes.xml",
+        "env/common/default/WEB-INF/dos.xml",
+        "env/common/default/WEB-INF/logging.properties",
+        "env/common/default/WEB-INF/queue.xml",
+        "env/common/default/WEB-INF/web.xml",
+        "env/production/default/WEB-INF/appengine-web.xml",
+        "env/production/default/WEB-INF/cron.xml",
+        "//java/google/registry/module/frontend:frontend_jar_deploy.jar",
+    ],
+    out = "registry_default.war",
+    mappings = {
+        "java/google/registry/env/common/default": "",
+        "java/google/registry/env/production/default": "",
+        "java/google/registry/module/frontend": "WEB-INF/lib",
+    },
+    deps = [
+        ":common_war",
+        "//java/google/registry/ui:war_debug",
+    ],
+)
+
+zip_file(
+    name = "registry_backend_war",
+    srcs = [
+        "env/common/backend/WEB-INF/logging.properties",
+        "env/common/backend/WEB-INF/web.xml",
+        "env/production/backend/WEB-INF/appengine-web.xml",
+        "//java/google/registry/module/backend:backend_jar_deploy.jar",
+    ],
+    out = "registry_backend.war",
+    mappings = {
+        "java/google/registry/env/common/backend": "",
+        "java/google/registry/env/production/backend": "",
+        "java/google/registry/module/backend": "WEB-INF/lib",
+    },
+    deps = [
+        ":common_war",
+        "//java/google/registry/ui:war",
+    ],
+)
+
+zip_file(
+    name = "registry_tools_war",
+    srcs = [
+        "env/common/tools/WEB-INF/logging.properties",
+        "env/common/tools/WEB-INF/web.xml",
+        "env/production/tools/WEB-INF/appengine-web.xml",
+        "//java/google/registry/module/tools:tools_jar_deploy.jar",
+    ],
+    out = "registry_tools.war",
+    mappings = {
+        "java/google/registry/env/common/tools": "",
+        "java/google/registry/env/production/tools": "",
+        "java/google/registry/module/tools": "WEB-INF/lib",
+    },
+    deps = [
+        ":common_war",
+        "//java/google/registry/ui:war",
+    ],
+)
+
+
+################################################################################
+# DOMAIN REGISTRY :: SANDBOX ENVIRONMENT
+#
+# Sandbox is a production environment that registrar customers use to conduct
+# integration tests against the registry service.
+
+registry_ear_file(
+    name = "registry_sandbox_ear",
+    out = "registry_sandbox.ear",
+    configs = {
+        "env/common/META-INF/appengine-application.xml": "META-INF/appengine-application.xml",
+        "env/common/META-INF/application.xml": "META-INF/application.xml",
+    },
+    wars = {
+        "registry_default_sandbox.war": "default",
+        "registry_backend_sandbox.war": "backend",
+        "registry_tools_sandbox.war": "tools",
+    },
+)
+
+zip_file(
+    name = "registry_default_sandbox_war",
+    srcs = [
+        "env/sandbox/default/WEB-INF/appengine-web.xml",
+        "env/sandbox/default/WEB-INF/cron.xml",
+    ],
+    out = "registry_default_sandbox.war",
+    mappings = {"java/google/registry/env/sandbox/default": ""},
+    deps = [":registry_default_war"],
+)
+
+zip_file(
+    name = "registry_backend_sandbox_war",
+    srcs = ["env/sandbox/backend/WEB-INF/appengine-web.xml"],
+    out = "registry_backend_sandbox.war",
+    mappings = {"java/google/registry/env/sandbox/backend": ""},
+    deps = [":registry_backend_war"],
+)
+
+zip_file(
+    name = "registry_tools_sandbox_war",
+    srcs = ["env/sandbox/tools/WEB-INF/appengine-web.xml"],
+    out = "registry_tools_sandbox.war",
+    mappings = {"java/google/registry/env/sandbox/tools": ""},
+    deps = [":registry_tools_war"],
+)
+
+################################################################################
+# DOMAIN REGISTRY :: ALPHA ENVIRONMENT
+#
+# The alpha environment is used by developers to test new features.
+
+registry_ear_file(
+    name = "registry_alpha_ear",
+    out = "registry_alpha.ear",
+    configs = {
+        "env/common/META-INF/appengine-application.xml": "META-INF/appengine-application.xml",
+        "env/common/META-INF/application.xml": "META-INF/application.xml",
+    },
+    wars = {
+        "registry_default_alpha.war": "default",
+        "registry_backend_alpha.war": "backend",
+        "registry_tools_alpha.war": "tools",
+    },
+)
+
+zip_file(
+    name = "registry_default_alpha_war",
+    srcs = [
+        "env/alpha/default/WEB-INF/appengine-web.xml",
+        "env/alpha/default/WEB-INF/cron.xml",
+    ],
+    out = "registry_default_alpha.war",
+    mappings = {"java/google/registry/env/alpha/default": ""},
+    deps = [":registry_default_war"],
+)
+
+zip_file(
+    name = "registry_backend_alpha_war",
+    srcs = ["env/alpha/backend/WEB-INF/appengine-web.xml"],
+    out = "registry_backend_alpha.war",
+    mappings = {"java/google/registry/env/alpha/backend": ""},
+    deps = [":registry_backend_war"],
+)
+
+zip_file(
+    name = "registry_tools_alpha_war",
+    srcs = ["env/alpha/tools/WEB-INF/appengine-web.xml"],
+    out = "registry_tools_alpha.war",
+    mappings = {"java/google/registry/env/alpha/tools": ""},
+    deps = [":registry_tools_war"],
+)
+
+################################################################################
+# DOMAIN REGISTRY :: CRASH ENVIRONMENT
+#
+# The crash environment is used for testing loads, backups, and restores.
+
+registry_ear_file(
+    name = "registry_crash_ear",
+    out = "registry_crash.ear",
+    configs = {
+        "env/common/META-INF/appengine-application.xml": "META-INF/appengine-application.xml",
+        "env/common/META-INF/application.xml": "META-INF/application.xml",
+    },
+    wars = {
+        "registry_default_crash.war": "default",
+        "registry_backend_crash.war": "backend",
+        "registry_tools_crash.war": "tools",
+    },
+)
+
+zip_file(
+    name = "registry_default_crash_war",
+    srcs = [
+        "env/crash/default/WEB-INF/appengine-web.xml",
+        "env/crash/default/WEB-INF/cron.xml",
+    ],
+    out = "registry_default_crash.war",
+    mappings = {"java/google/registry/env/crash/default": ""},
+    deps = [":registry_default_war"],
+)
+
+zip_file(
+    name = "registry_backend_crash_war",
+    srcs = ["env/crash/backend/WEB-INF/appengine-web.xml"],
+    out = "registry_backend_crash.war",
+    mappings = {"java/google/registry/env/crash/backend": ""},
+    deps = [":registry_backend_war"],
+)
+
+zip_file(
+    name = "registry_tools_crash_war",
+    srcs = ["env/crash/tools/WEB-INF/appengine-web.xml"],
+    out = "registry_tools_crash.war",
+    mappings = {"java/google/registry/env/crash/tools": ""},
+    deps = [":registry_tools_war"],
+)
+
+################################################################################
+# DOMAIN REGISTRY :: LOCAL ENVIRONMENT
+#
+# The local environment only runs locally for testing and is never deployed.
+
+registry_ear_file(
+    name = "registry_local_ear",
+    out = "registry_local.ear",
+    configs = {
+        "env/common/META-INF/appengine-application.xml": "META-INF/appengine-application.xml",
+        "env/common/META-INF/application.xml": "META-INF/application.xml",
+    },
+    wars = {
+        "registry_default_local.war": "default",
+        "registry_backend_local.war": "backend",
+        "registry_tools_local.war": "tools",
+    },
+)
+
+zip_file(
+    name = "registry_default_local_war",
+    srcs = ["env/local/default/WEB-INF/appengine-web.xml"],
+    out = "registry_default_local.war",
+    mappings = {"java/google/registry/env/local/default": ""},
+    deps = [":registry_default_war"],
+)
+
+zip_file(
+    name = "registry_backend_local_war",
+    srcs = ["env/local/backend/WEB-INF/appengine-web.xml"],
+    out = "registry_backend_local.war",
+    mappings = {"java/google/registry/env/local/backend": ""},
+    deps = [":registry_backend_war"],
+)
+
+zip_file(
+    name = "registry_tools_local_war",
+    srcs = ["env/local/tools/WEB-INF/appengine-web.xml"],
+    out = "registry_tools_local.war",
+    mappings = {"java/google/registry/env/local/tools": ""},
+    deps = [":registry_tools_war"],
+)
+
diff --git a/java/google/registry/builddefs/registry_ear_file.bzl b/java/google/registry/builddefs/registry_ear_file.bzl
new file mode 100644
index 000000000..9d26bfe92
--- /dev/null
+++ b/java/google/registry/builddefs/registry_ear_file.bzl
@@ -0,0 +1,54 @@
+# Copyright 2016 The Domain Registry Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Build macro for creating App Engine EAR archives for Domain Registry."""
+
+load("//java/google/registry/builddefs:defs.bzl", "ZIPPER")
+
+def registry_ear_file(name, out, configs, wars, **kwargs):
+  """Creates an EAR archive by combining WAR archives."""
+  cmd = [
+      "set -e",
+      "repo=$$(pwd)",
+      "zipper=$$repo/$(location %s)" % ZIPPER,
+      "tmp=$$(mktemp -d $${TMPDIR:-/tmp}/registry_ear_file.XXXXXXXXXX)",
+      "cd $${tmp}",
+  ]
+  for target, dest in configs.items():
+    cmd += [
+        "mkdir -p $${tmp}/$$(dirname %s)" % dest,
+        "ln -s $${repo}/$(location %s) $${tmp}/%s" % (target, dest),
+    ]
+  for target, dest in wars.items():
+    cmd += [
+        "mkdir " + dest,
+        "cd " + dest,
+        "$${zipper} x $${repo}/$(location %s)" % target,
+        "cd ..",
+    ]
+  cmd += [
+      ("find . | sed 1d | cut -c 3- | LC_ALL=C sort" +
+       " | xargs $${zipper} cC $${repo}/$@"),
+      "cd $${repo}",
+      "rm -rf $${tmp}",
+  ]
+  native.genrule(
+      name = name,
+      srcs = configs.keys() + wars.keys(),
+      outs = [out],
+      cmd = "\n".join(cmd),
+      tools = [ZIPPER],
+      message = "Generating EAR archive",
+      **kwargs
+  )
diff --git a/java/google/registry/env/BUILD b/java/google/registry/env/BUILD
deleted file mode 100644
index 17ccbda7c..000000000
--- a/java/google/registry/env/BUILD
+++ /dev/null
@@ -1,6 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
diff --git a/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml b/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..774b7de5a
--- /dev/null
+++ b/java/google/registry/env/alpha/backend/WEB-INF/appengine-web.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>backend</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4</instance-class>
+  <basic-scaling>
+    <max-instances>10</max-instances>
+    <idle-timeout>10m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="alpha"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1m"/>
+    <include path="/assets/js/**" expiration="1m"/>
+    <include path="/assets/css/**" expiration="1m"/>
+    <include path="/assets/images/**" expiration="1m"/>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml b/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..625375fa2
--- /dev/null
+++ b/java/google/registry/env/alpha/default/WEB-INF/appengine-web.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>default</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>F4_1G</instance-class>
+  <automatic-scaling>
+    <min-idle-instances>0</min-idle-instances>
+    <max-idle-instances>automatic</max-idle-instances>
+    <min-pending-latency>automatic</min-pending-latency>
+    <max-pending-latency>100ms</max-pending-latency>
+    <max-concurrent-requests>10</max-concurrent-requests>
+  </automatic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="alpha"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1m"/>
+    <include path="/assets/js/**" expiration="1m"/>
+    <include path="/assets/css/**" expiration="1m"/>
+    <include path="/assets/images/**" expiration="1m"/>
+    <include path="/assets/sources/**" expiration="1m"/>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/alpha/default/WEB-INF/cron.xml b/java/google/registry/env/alpha/default/WEB-INF/cron.xml
new file mode 100644
index 000000000..fe273077f
--- /dev/null
+++ b/java/google/registry/env/alpha/default/WEB-INF/cron.xml
@@ -0,0 +1,148 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<cronentries>
+
+  <cron>
+    <url>/_dr/task/rdeStaging</url>
+    <description>
+      This job generates a full RDE escrow deposit as a single gigantic XML document
+      and streams it to cloud storage. When this job has finished successfully, it'll
+      launch a separate task that uploads the deposit file to Iron Mountain via SFTP.
+    </description>
+    <!--
+      This only needs to run once per day, but we launch additional jobs in case the
+      cursor is lagging behind, so it'll catch up to the current date as quickly as
+      possible. The only job that'll run under normal circumstances is the one that's
+      close to midnight, since if the cursor is up-to-date, the task is a no-op.
+
+      We want it to be close to midnight because that reduces the chance that the
+      point-in-time code won't have to go to the extra trouble of fetching old
+      versions of objects from the datastore. However, we don't want it to run too
+      close to midnight, because there's always a chance that a change which was
+      timestamped before midnight hasn't fully been committed to the datastore. So
+      we add a 4+ minute grace period to ensure the transactions cool down, since
+      our queries are not transactional.
+    -->
+    <schedule>every 4 hours from 00:07 to 20:00</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=rde-upload&endpoint=/_dr/task/rdeUpload&forEachRealTld]]></url>
+    <description>
+      This job is a no-op unless RdeUploadCursor falls behind for some reason.
+    </description>
+    <schedule>every 4 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=rde-report&endpoint=/_dr/task/rdeReport&forEachRealTld]]></url>
+    <description>
+      This job is a no-op unless RdeReportCursor falls behind for some reason.
+    </description>
+    <schedule>every 4 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchDnl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest DNL from MarksDB and inserts it into the database.
+      (See: TmchDnlServlet, ClaimsList)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchSmdrl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest SMDRL from MarksDB and inserts it into the database.
+      (See: TmchSmdrlServlet, SignedMarkRevocationList)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchCrl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest CRL from MarksDB and inserts it into the database.
+      (See: TmchCrlServlet)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=sheet&endpoint=/_dr/task/syncRegistrarsSheet&runInEmpty]]></url>
+    <description>
+      Synchronize Registrar entities to Google Spreadsheets.
+    </description>
+    <schedule>every 1 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <!-- TODO(b/23319222): Re-enable when fixed.
+  <cron>
+    <url><![CDATA[/_dr/cron/commitLogFanout?queue=delete-commits&endpoint=/_dr/task/deleteOldCommitLogs&jitterSeconds=600]]></url>
+    <description>
+      This job deletes commit logs from datastore that are old, e.g. thirty days.
+    </description>
+    <schedule>every 20 minutes synchronized</schedule>
+    <target>backend</target>
+  </cron>
+  -->
+
+  <!-- TODO: Add borgmon job to check that these files are created and updated successfully. -->
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=export-reserved-terms&endpoint=/_dr/task/exportReservedTerms&forEachRealTld]]></url>
+    <description>
+      Reserved terms export to Google Drive job for creating once-daily exports.
+    </description>
+    <schedule>every day 05:30</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=group-members-sync&endpoint=/_dr/task/syncGroupMembers&runInEmpty]]></url>
+    <description>
+      Syncs RegistrarContact changes in the past hour to Google Groups.
+    </description>
+    <schedule>every 1 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/commitLogCheckpoint]]></url>
+    <description>
+      This job checkpoints the commit log buckets and exports the diff since last checkpoint to GCS.
+    </description>
+    <schedule>every 1 minutes synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=export-snapshot&endpoint=/_dr/task/exportSnapshot&runInEmpty]]></url>
+    <description>
+      This job fires off a datastore backup-as-a-service job that generates snapshot files in GCS.
+      It also enqueues a new task to wait on the completion of that job and then load the resulting
+      snapshot into bigquery.
+    </description>
+    <!-- Keep the task-age-limit for this job's task queue less than this cron interval. -->
+    <schedule>every day 06:00</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/readDnsQueue?jitterSeconds=45]]></url>
+    <description>
+      Lease all tasks from the dns-pull queue, group by TLD, and invoke PublishDnsUpdates for each
+      group.
+    </description>
+    <schedule>every 1 minutes synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+
+</cronentries>
diff --git a/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml b/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..0a82b840c
--- /dev/null
+++ b/java/google/registry/env/alpha/tools/WEB-INF/appengine-web.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>tools</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4_1G</instance-class>
+  <basic-scaling>
+    <max-instances>100</max-instances>
+    <idle-timeout>5m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="alpha"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1m"/>
+    <include path="/assets/js/**" expiration="1m"/>
+    <include path="/assets/css/**" expiration="1m"/>
+    <include path="/assets/images/**" expiration="1m"/>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/common/BUILD b/java/google/registry/env/common/BUILD
deleted file mode 100644
index 737f8ac34..000000000
--- a/java/google/registry/env/common/BUILD
+++ /dev/null
@@ -1,7 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
-
diff --git a/java/google/registry/env/common/backend/BUILD b/java/google/registry/env/common/backend/BUILD
deleted file mode 100644
index 80135411c..000000000
--- a/java/google/registry/env/common/backend/BUILD
+++ /dev/null
@@ -1,9 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
-exports_files(glob(["WEB-INF/*"]))
-
-
diff --git a/java/google/registry/env/common/default/BUILD b/java/google/registry/env/common/default/BUILD
deleted file mode 100644
index 80135411c..000000000
--- a/java/google/registry/env/common/default/BUILD
+++ /dev/null
@@ -1,9 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
-exports_files(glob(["WEB-INF/*"]))
-
-
diff --git a/java/google/registry/env/common/tools/BUILD b/java/google/registry/env/common/tools/BUILD
deleted file mode 100644
index 80135411c..000000000
--- a/java/google/registry/env/common/tools/BUILD
+++ /dev/null
@@ -1,9 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
-exports_files(glob(["WEB-INF/*"]))
-
-
diff --git a/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml b/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..9b9cc5403
--- /dev/null
+++ b/java/google/registry/env/crash/backend/WEB-INF/appengine-web.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>backend</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4</instance-class>
+  <basic-scaling>
+    <max-instances>10</max-instances>
+    <idle-timeout>10m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="crash"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1m"/>
+    <include path="/assets/js/**" expiration="1m"/>
+    <include path="/assets/css/**" expiration="1m"/>
+    <include path="/assets/images/**" expiration="1m"/>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml b/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..4dd7927b1
--- /dev/null
+++ b/java/google/registry/env/crash/default/WEB-INF/appengine-web.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>default</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>F4_1G</instance-class>
+  <automatic-scaling>
+    <min-idle-instances>0</min-idle-instances>
+    <max-idle-instances>automatic</max-idle-instances>
+    <min-pending-latency>automatic</min-pending-latency>
+    <max-pending-latency>100ms</max-pending-latency>
+    <max-concurrent-requests>10</max-concurrent-requests>
+  </automatic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="crash"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1m"/>
+    <include path="/assets/js/**" expiration="1m"/>
+    <include path="/assets/css/**" expiration="1m"/>
+    <include path="/assets/images/**" expiration="1m"/>
+    <include path="/assets/sources/**" expiration="1m"/>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/crash/default/WEB-INF/cron.xml b/java/google/registry/env/crash/default/WEB-INF/cron.xml
new file mode 100644
index 000000000..dc41d9d5a
--- /dev/null
+++ b/java/google/registry/env/crash/default/WEB-INF/cron.xml
@@ -0,0 +1,128 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<cronentries>
+
+  <cron>
+    <url>/_dr/task/rdeStaging</url>
+    <description>
+      This job generates a full RDE escrow deposit as a single gigantic XML document
+      and streams it to cloud storage. When this job has finished successfully, it'll
+      launch a separate task that uploads the deposit file to Iron Mountain via SFTP.
+    </description>
+    <!--
+      This only needs to run once per day, but we launch additional jobs in case the
+      cursor is lagging behind, so it'll catch up to the current date as quickly as
+      possible. The only job that'll run under normal circumstances is the one that's
+      close to midnight, since if the cursor is up-to-date, the task is a no-op.
+
+      We want it to be close to midnight because that reduces the chance that the
+      point-in-time code won't have to go to the extra trouble of fetching old
+      versions of objects from the datastore. However, we don't want it to run too
+      close to midnight, because there's always a chance that a change which was
+      timestamped before midnight hasn't fully been committed to the datastore. So
+      we add a 4+ minute grace period to ensure the transactions cool down, since
+      our queries are not transactional.
+    -->
+    <schedule>every 4 hours from 00:07 to 20:00</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=rde-upload&endpoint=/_dr/task/rdeUpload&forEachRealTld]]></url>
+    <description>
+      This job is a no-op unless RdeUploadCursor falls behind for some reason.
+    </description>
+    <schedule>every 4 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=rde-report&endpoint=/_dr/task/rdeReport&forEachRealTld]]></url>
+    <description>
+      This job is a no-op unless RdeReportCursor falls behind for some reason.
+    </description>
+    <schedule>every 4 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchDnl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest DNL from MarksDB and inserts it into the database.
+      (See: TmchDnlServlet, ClaimsList)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchSmdrl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest SMDRL from MarksDB and inserts it into the database.
+      (See: TmchSmdrlServlet, SignedMarkRevocationList)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchCrl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest CRL from MarksDB and inserts it into the database.
+      (See: TmchCrlServlet)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=sheet&endpoint=/_dr/task/syncRegistrarsSheet&runInEmpty]]></url>
+    <description>
+      Synchronize Registrar entities to Google Spreadsheets.
+    </description>
+    <schedule>every 1 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <!-- TODO: Add borgmon job to check that these files are created and updated successfully. -->
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=export-reserved-terms&endpoint=/_dr/task/exportReservedTerms&forEachRealTld]]></url>
+    <description>
+      Reserved terms export to Google Drive job for creating once-daily exports.
+    </description>
+    <schedule>every day 05:30</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=group-members-sync&endpoint=/_dr/task/syncGroupMembers&runInEmpty]]></url>
+    <description>
+      Syncs RegistrarContact changes in the past hour to Google Groups.
+    </description>
+    <schedule>every 1 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=export-snapshot&endpoint=/_dr/task/exportSnapshot&runInEmpty]]></url>
+    <description>
+      This job fires off a datastore backup-as-a-service job that generates snapshot files in GCS.
+      It also enqueues a new task to wait on the completion of that job and then load the resulting
+      snapshot into bigquery.
+    </description>
+    <!-- Keep the task-age-limit for this job's task queue less than this cron interval. -->
+    <schedule>every day 06:00</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/readDnsQueue?jitterSeconds=45]]></url>
+    <description>
+      Lease all tasks from the dns-pull queue, group by TLD, and invoke PublishDnsUpdates for each
+      group.
+    </description>
+    <schedule>every 1 minutes synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+
+</cronentries>
diff --git a/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml b/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..72aac3b85
--- /dev/null
+++ b/java/google/registry/env/crash/tools/WEB-INF/appengine-web.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>tools</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4</instance-class>
+  <basic-scaling>
+    <max-instances>10</max-instances>
+    <idle-timeout>10m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="crash"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1m"/>
+    <include path="/assets/js/**" expiration="1m"/>
+    <include path="/assets/css/**" expiration="1m"/>
+    <include path="/assets/images/**" expiration="1m"/>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml b/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..afe90f338
--- /dev/null
+++ b/java/google/registry/env/local/backend/WEB-INF/appengine-web.xml
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>backend</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4</instance-class>
+  <basic-scaling>
+    <max-instances>10</max-instances>
+    <idle-timeout>10m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="local"/>
+    <property name="appengine.generated.dir"
+              value="/tmp/domain-registry-appengine-generated/local/"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/js/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/css/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/images/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/local/default/WEB-INF/appengine-web.xml b/java/google/registry/env/local/default/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..183b45cb4
--- /dev/null
+++ b/java/google/registry/env/local/default/WEB-INF/appengine-web.xml
@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>default</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>F4_1G</instance-class>
+  <automatic-scaling>
+    <min-idle-instances>1</min-idle-instances>
+    <max-idle-instances>automatic</max-idle-instances>
+    <min-pending-latency>automatic</min-pending-latency>
+    <max-pending-latency>100ms</max-pending-latency>
+    <max-concurrent-requests>10</max-concurrent-requests>
+  </automatic-scaling>
+
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="local"/>
+    <property name="appengine.generated.dir"
+              value="/tmp/domain-registry-appengine-generated/local/"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/js/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/css/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/images/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/sources/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml b/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..5d1a17d65
--- /dev/null
+++ b/java/google/registry/env/local/tools/WEB-INF/appengine-web.xml
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>tools</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4</instance-class>
+  <basic-scaling>
+    <max-instances>10</max-instances>
+    <idle-timeout>10m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="local"/>
+    <property name="appengine.generated.dir"
+              value="/tmp/domain-registry-appengine-generated/local/"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/js/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/css/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+    <include path="/assets/images/**">
+      <http-header name="Cache-Control" value="max-age=0,must-revalidate" />
+    </include>
+  </static-files>
+</appengine-web-app>
diff --git a/java/google/registry/env/production/BUILD b/java/google/registry/env/production/BUILD
deleted file mode 100644
index 17ccbda7c..000000000
--- a/java/google/registry/env/production/BUILD
+++ /dev/null
@@ -1,6 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
diff --git a/java/google/registry/env/production/backend/BUILD b/java/google/registry/env/production/backend/BUILD
deleted file mode 100644
index 737f8ac34..000000000
--- a/java/google/registry/env/production/backend/BUILD
+++ /dev/null
@@ -1,7 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
-
diff --git a/java/google/registry/env/production/default/BUILD b/java/google/registry/env/production/default/BUILD
deleted file mode 100644
index 737f8ac34..000000000
--- a/java/google/registry/env/production/default/BUILD
+++ /dev/null
@@ -1,7 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
-
diff --git a/java/google/registry/env/production/tools/BUILD b/java/google/registry/env/production/tools/BUILD
deleted file mode 100644
index 737f8ac34..000000000
--- a/java/google/registry/env/production/tools/BUILD
+++ /dev/null
@@ -1,7 +0,0 @@
-package(
-    default_visibility = ["//java/google/registry:registry_project"],
-)
-
-licenses(["notice"])  # Apache 2.0
-
-
diff --git a/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml b/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..ece64f711
--- /dev/null
+++ b/java/google/registry/env/sandbox/backend/WEB-INF/appengine-web.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>backend</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4</instance-class>
+  <basic-scaling>
+    <max-instances>50</max-instances>
+    <idle-timeout>10m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="sandbox"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1d"/>
+    <include path="/assets/js/**" expiration="1d"/>
+    <include path="/assets/css/**" expiration="1d"/>
+    <include path="/assets/images/**" expiration="1d"/>
+  </static-files>
+
+  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
+  <static-error-handlers>
+    <handler file="error.html"/>
+  </static-error-handlers>
+</appengine-web-app>
diff --git a/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml b/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..c962d22d8
--- /dev/null
+++ b/java/google/registry/env/sandbox/default/WEB-INF/appengine-web.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>default</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4_1G</instance-class>
+  <basic-scaling>
+    <max-instances>20</max-instances>
+    <idle-timeout>10m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="sandbox"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1d"/>
+    <include path="/assets/js/**" expiration="1d"/>
+    <include path="/assets/css/**" expiration="1d"/>
+    <include path="/assets/images/**" expiration="1d"/>
+    <include path="/assets/sources/**" expiration="1d"/>
+  </static-files>
+
+  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
+  <static-error-handlers>
+    <handler file="error.html"/>
+  </static-error-handlers>
+</appengine-web-app>
diff --git a/java/google/registry/env/sandbox/default/WEB-INF/cron.xml b/java/google/registry/env/sandbox/default/WEB-INF/cron.xml
new file mode 100644
index 000000000..e14467149
--- /dev/null
+++ b/java/google/registry/env/sandbox/default/WEB-INF/cron.xml
@@ -0,0 +1,125 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<cronentries>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchDnl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest DNL from MarksDB and inserts it into the database.
+      (See: TmchDnlServlet, ClaimsList)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchSmdrl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest SMDRL from MarksDB and inserts it into the database.
+      (See: TmchSmdrlServlet, SignedMarkRevocationList)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=marksdb&endpoint=/_dr/task/tmchCrl&runInEmpty]]></url>
+    <description>
+      This job downloads the latest CRL from MarksDB and inserts it into the database.
+      (See: TmchCrlServlet)
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=group-members-sync&endpoint=/_dr/task/syncGroupMembers&runInEmpty]]></url>
+    <description>
+      Syncs RegistrarContact changes in the past hour to Google Groups.
+    </description>
+    <schedule>every 1 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=export-snapshot&endpoint=/_dr/task/exportSnapshot&runInEmpty]]></url>
+    <description>
+      This job fires off a datastore backup-as-a-service job that generates snapshot files in GCS.
+      It also enqueues a new task to wait on the completion of that job and then load the resulting
+      snapshot into bigquery.
+    </description>
+    <!-- Keep the task-age-limit for this job's task queue less than this cron interval. -->
+    <schedule>every day 06:00</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=export-reserved-terms&endpoint=/_dr/task/exportReservedTerms&forEachRealTld]]></url>
+    <description>
+      Reserved terms export to Google Drive job for creating once-daily exports.
+    </description>
+    <schedule>every day 05:30</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/task/exportDomainLists]]></url>
+    <description>
+      This job exports lists of all active domain names to Google Cloud Storage.
+    </description>
+    <schedule>every 12 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/readDnsQueue?jitterSeconds=45]]></url>
+    <description>
+      Lease all tasks from the dns-pull queue, group by TLD, and invoke PublishDnsUpdates for each
+      group.
+    </description>
+    <schedule>every 1 minutes synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/task/deleteProberData]]></url>
+    <description>
+      This job clears out data from probers and runs once a week.
+    </description>
+    <schedule>every monday 14:00</schedule>
+    <timezone>UTC</timezone>
+    <!-- TODO(b/27309488): maybe move this to the backend module. -->
+    <target>tools</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/task/verifyEntityIntegrity]]></url>
+    <description>
+      This job verifies entity integrity and runs once daily.
+    </description>
+    <schedule>every day 06:30</schedule>
+    <timezone>UTC</timezone>
+    <target>backend</target>
+  </cron>
+
+  <cron>
+    <url><![CDATA[/_dr/cron/fanout?queue=sheet&endpoint=/_dr/task/syncRegistrarsSheet&runInEmpty]]></url>
+    <description>
+      Synchronize Registrar entities to Google Spreadsheets.
+    </description>
+    <schedule>every 1 hours synchronized</schedule>
+    <target>backend</target>
+  </cron>
+
+  <!-- TODO(b/23319222): Re-enable when fixed.
+  <cron>
+    <url><![CDATA[/_dr/cron/commitLogFanout?queue=delete-commits&endpoint=/_dr/task/deleteOldCommitLogs&jitterSeconds=600]]></url>
+    <description>
+      This job deletes commit logs from datastore that are old, e.g. thirty days.
+    </description>
+    <schedule>every 20 minutes synchronized</schedule>
+    <target>backend</target>
+  </cron>
+  -->
+
+
+</cronentries>
diff --git a/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml b/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml
new file mode 100644
index 000000000..9e8bcb777
--- /dev/null
+++ b/java/google/registry/env/sandbox/tools/WEB-INF/appengine-web.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
+
+  <application>domain-registry</application>
+  <version>1</version>
+  <module>tools</module>
+  <threadsafe>true</threadsafe>
+  <sessions-enabled>true</sessions-enabled>
+  <instance-class>B4</instance-class>
+  <basic-scaling>
+    <max-instances>50</max-instances>
+    <idle-timeout>10m</idle-timeout>
+  </basic-scaling>
+
+  <system-properties>
+    <property name="java.util.logging.config.file"
+              value="WEB-INF/logging.properties"/>
+    <property name="google.registry.environment"
+              value="sandbox"/>
+  </system-properties>
+
+  <static-files>
+    <include path="/*.html" expiration="1d"/>
+    <include path="/assets/js/**" expiration="1d"/>
+    <include path="/assets/css/**" expiration="1d"/>
+    <include path="/assets/images/**" expiration="1d"/>
+  </static-files>
+
+  <!-- Prevent uncaught servlet errors from leaking a stack trace. -->
+  <static-error-handlers>
+    <handler file="error.html"/>
+  </static-error-handlers>
+</appengine-web-app>
diff --git a/java/google/registry/ui/BUILD b/java/google/registry/ui/BUILD
index 03af8eb17..e6f5aff80 100644
--- a/java/google/registry/ui/BUILD
+++ b/java/google/registry/ui/BUILD
@@ -3,36 +3,18 @@ package(default_visibility = ["//java/google/registry:registry_project"])
 licenses(["notice"])  # Apache 2.0
 
 load("@io_bazel_rules_closure//closure:defs.bzl", "closure_js_binary", "closure_js_deps")
+load("//java/google/registry/builddefs:zip_file.bzl", "zip_file")
 
 exports_files(["globals.txt"])
 
 
-filegroup(
-    name = "assets_recursive",
-    srcs = glob(["assets/**"]),
-)
-
-filegroup(
-    name = "js_files_recursive",
-    srcs = [
-        "//java/google/registry/ui/js:js_files",
-        "//java/google/registry/ui/js/registrar:js_files",
-        "//java/google/registry/ui/soy:js_files",
-        "//java/google/registry/ui/soy/registrar:js_files",
-    ],
-)
-
 filegroup(
     name = "runfiles",
-    srcs = [
+    srcs = glob(["assets/**"]) + [
         "brain_bin.js",
         "brain_bin_map.js",
         "registrar_bin.js",
         "registrar_bin_map.js",
-        ":assets_recursive",
-        "//javascript/closure:js_files_recursive",
-        "//javascript/template/soy:soy_usegoog_js_files",
-        "//java/google/registry/ui:deps.js",
         "//java/google/registry/ui/css:registrar_bin.css",
         "//java/google/registry/ui/html:html_files",
     ],
@@ -45,14 +27,45 @@ filegroup(
         "brain_bin.js.map",
         "deps.js",
         "registrar_bin.js.map",
-        ":js_files_recursive",
-        ":runfiles",
+        "registrar_dbg.js",
         "//javascript/closure:js_files_recursive",
         "//javascript/template/soy:soy_usegoog_js_files",
         "//java/google/registry/ui/css:css_files",
+        "//java/google/registry/ui/css:registrar_dbg.css",
+        "//java/google/registry/ui/js:js_files",
+        "//java/google/registry/ui/js/registrar:js_files",
+        "//java/google/registry/ui/soy:js_files",
+        "//java/google/registry/ui/soy/registrar:js_files",
     ],
 )
 
+zip_file(
+    name = "war",
+    srcs = [":runfiles"],
+    out = "ui.war",
+    mappings = {
+        "java/google/registry/ui/assets": "assets",
+        "java/google/registry/ui/css": "assets/css",
+        "java/google/registry/ui/html": "",
+        "java/google/registry/ui": "assets/js",
+    },
+)
+
+zip_file(
+    name = "war_debug",
+    srcs = [":runfiles_debug"],
+    out = "ui_debug.war",
+    mappings = {
+        "java/google/registry/ui/deps.js": "assets/sources/deps.js",
+        "java/google/registry/ui/brain_bin.js.map": "assets/js/brain_bin.js.map",
+        "java/google/registry/ui/registrar_bin.js.map": "assets/js/registrar_bin.js.map",
+        "java/google/registry/ui/registrar_dbg.js": "assets/js/registrar_dbg.js",
+        "java/google/registry/ui/css/registrar_dbg.css": "assets/css/registrar_dbg.css",
+        "": "assets/sources",
+    },
+    deps = [":war"],
+)
+
 java_library(
     name = "ui",
     srcs = glob(["*.java"]),
diff --git a/javatests/google/registry/server/BUILD b/javatests/google/registry/server/BUILD
index 0e391cba3..8f96b546b 100644
--- a/javatests/google/registry/server/BUILD
+++ b/javatests/google/registry/server/BUILD
@@ -47,7 +47,10 @@ java_library(
 java_library(
     name = "RegistryTestServer",
     srcs = ["RegistryTestServer.java"],
-    data = ["//java/google/registry/ui:runfiles_debug"],
+    data = [
+        "//java/google/registry/ui:runfiles",
+        "//java/google/registry/ui:runfiles_debug",
+    ],
     deps = [
         ":TestServer",
         "//java/com/google/common/collect",
diff --git a/javatests/google/registry/testing/BUILD b/javatests/google/registry/testing/BUILD
index 0eee27234..0768d2a7a 100644
--- a/javatests/google/registry/testing/BUILD
+++ b/javatests/google/registry/testing/BUILD
@@ -17,8 +17,8 @@ java_library(
     ),
     resources = [
         "logging.properties",
-        "//java/google/registry/env/common/default:WEB-INF/datastore-indexes.xml",
-        "//java/google/registry/env/common/default:WEB-INF/queue.xml",
+        "//java/google/registry:env/common/default/WEB-INF/datastore-indexes.xml",
+        "//java/google/registry:env/common/default/WEB-INF/queue.xml",
     ] + glob(["*.csv"]),
     visibility = ["//visibility:public"],
     deps = [