can you provide more background on this? I assume that  foreman can reach the vnc server directly (as does the tunnel) so why do we need it?