reminder: for tempest & vCHS, this needs to be configurable from the deployment manifest. https://www.pivotaltracker.com/story/show/48812729