diff --git a/scripts/repository/commit_hook.php b/scripts/repository/commit_hook.php
index 2c7fe4289b..4132df941e 100755
--- a/scripts/repository/commit_hook.php
+++ b/scripts/repository/commit_hook.php
@@ -1,142 +1,161 @@
 #!/usr/bin/env php
 <?php
 
+// Commit hooks execute in an unusual context where the environment may be
+// unavailable, particularly in SVN. The first parameter to this script is
+// either a bare repository identifier ("X"), or a repository identifier
+// followed by an instance identifier ("X:instance"). If we have an instance
+// identifier, unpack it into the environment before we start up. This allows
+// subclasses of PhabricatorConfigSiteSource to read it and build an instance
+// environment.
+
+if ($argc > 1) {
+  $context = $argv[1];
+  $context = explode(':', $context, 2);
+  $argv[1] = $context[0];
+
+  if (count($context) > 1) {
+    $_ENV['PHABRICATOR_INSTANCE'] = $context[1];
+    putenv('PHABRICATOR_INSTANCE='.$context[1]);
+  }
+}
+
 $root = dirname(dirname(dirname(__FILE__)));
 require_once $root.'/scripts/__init_script__.php';
 
 if ($argc < 2) {
   throw new Exception(pht('usage: commit-hook <callsign>'));
 }
 
 $engine = new DiffusionCommitHookEngine();
 
 $repository = id(new PhabricatorRepositoryQuery())
   ->setViewer(PhabricatorUser::getOmnipotentUser())
   ->withCallsigns(array($argv[1]))
   ->needProjectPHIDs(true)
   ->executeOne();
 
 if (!$repository) {
   throw new Exception(pht('No such repository "%s"!', $argv[1]));
 }
 
 if (!$repository->isHosted()) {
   // This should be redundant, but double check just in case.
   throw new Exception(pht('Repository "%s" is not hosted!', $argv[1]));
 }
 
 $engine->setRepository($repository);
 
 
 // Figure out which user is writing the commit.
 
 if ($repository->isGit() || $repository->isHg()) {
   $username = getenv(DiffusionCommitHookEngine::ENV_USER);
   if (!strlen($username)) {
     throw new Exception(
       pht('usage: %s should be defined!', DiffusionCommitHookEngine::ENV_USER));
   }
 
   if ($repository->isHg()) {
     // We respond to several different hooks in Mercurial.
     $engine->setMercurialHook($argv[2]);
   }
 
 } else if ($repository->isSVN()) {
   // NOTE: In Subversion, the entire environment gets wiped so we can't read
   // DiffusionCommitHookEngine::ENV_USER. Instead, we've set "--tunnel-user" to
   // specify the correct user; read this user out of the commit log.
 
   if ($argc < 4) {
     throw new Exception(pht('usage: commit-hook <callsign> <repo> <txn>'));
   }
 
   $svn_repo = $argv[2];
   $svn_txn = $argv[3];
   list($username) = execx('svnlook author -t %s %s', $svn_txn, $svn_repo);
   $username = rtrim($username, "\n");
 
   $engine->setSubversionTransactionInfo($svn_txn, $svn_repo);
 } else {
   throw new Exception(pht('Unknown repository type.'));
 }
 
 $user = id(new PhabricatorPeopleQuery())
   ->setViewer(PhabricatorUser::getOmnipotentUser())
   ->withUsernames(array($username))
   ->executeOne();
 
 if (!$user) {
   throw new Exception(pht('No such user "%s"!', $username));
 }
 
 $engine->setViewer($user);
 
 
 // Read stdin for the hook engine.
 
 if ($repository->isHg()) {
   // Mercurial leaves stdin open, so we can't just read it until EOF.
   $stdin = '';
 } else {
   // Git and Subversion write data into stdin and then close it. Read the
   // data.
   $stdin = @file_get_contents('php://stdin');
   if ($stdin === false) {
     throw new Exception(pht('Failed to read stdin!'));
   }
 }
 
 $engine->setStdin($stdin);
 $engine->setOriginalArgv(array_slice($argv, 2));
 
 $remote_address = getenv(DiffusionCommitHookEngine::ENV_REMOTE_ADDRESS);
 if (strlen($remote_address)) {
   $engine->setRemoteAddress($remote_address);
 }
 
 $remote_protocol = getenv(DiffusionCommitHookEngine::ENV_REMOTE_PROTOCOL);
 if (strlen($remote_protocol)) {
   $engine->setRemoteProtocol($remote_protocol);
 }
 
 try {
   $err = $engine->execute();
 } catch (DiffusionCommitHookRejectException $ex) {
   $console = PhutilConsole::getConsole();
 
   if (PhabricatorEnv::getEnvConfig('phabricator.serious-business')) {
     $preamble = pht('*** PUSH REJECTED BY COMMIT HOOK ***');
   } else {
     $preamble = pht(<<<EOTXT
 +---------------------------------------------------------------+
 |      * * * PUSH REJECTED BY EVIL DRAGON BUREAUCRATS * * *     |
 +---------------------------------------------------------------+
             \
              \                    ^    /^
               \                  / \  // \
                \   |\___/|      /   \//  .\
                 \  /V  V  \__  /    //  | \ \           *----*
                   /     /  \/_/    //   |  \  \          \   |
                   @___@`    \/_   //    |   \   \         \/\ \
                  0/0/|       \/_ //     |    \    \         \  \
              0/0/0/0/|        \///      |     \     \       |  |
           0/0/0/0/0/_|_ /   (  //       |      \     _\     |  /
        0/0/0/0/0/0/`/,_ _ _/  ) ; -.    |    _ _\.-~       /   /
                    ,-}        _      *-.|.-~-.           .~    ~
   \     \__/        `/\      /                 ~-. _ .-~      /
    \____(Oo)           *.   }            {                   /
    (    (--)          .----~-.\        \-`                 .~
    //__\\\\  \ DENIED!  ///.----..<        \             _ -~
   //    \\\\               ///-._ _ _ _ _ _ _{^ - - - - ~
 
 EOTXT
 );
   }
 
   $console->writeErr("%s\n\n", $preamble);
   $console->writeErr("%s\n\n", $ex->getMessage());
   $err = 1;
 }
 
 exit($err);
diff --git a/src/applications/config/option/PhabricatorClusterConfigOptions.php b/src/applications/config/option/PhabricatorClusterConfigOptions.php
index 830208823d..23d0827c18 100644
--- a/src/applications/config/option/PhabricatorClusterConfigOptions.php
+++ b/src/applications/config/option/PhabricatorClusterConfigOptions.php
@@ -1,58 +1,70 @@
 <?php
 
 final class PhabricatorClusterConfigOptions
   extends PhabricatorApplicationConfigOptions {
 
   public function getName() {
     return pht('Cluster Setup');
   }
 
   public function getDescription() {
     return pht('Configure Phabricator to run on a cluster of hosts.');
   }
 
   public function getOptions() {
     return array(
       $this->newOption('cluster.addresses', 'list<string>', array())
         ->setLocked(true)
         ->setSummary(pht('Address ranges of cluster hosts.'))
         ->setDescription(
           pht(
             'To allow Phabricator nodes to communicate with other nodes '.
             'in the cluster, provide an address whitelist of hosts that '.
             'are part of the cluster.'.
             "\n\n".
             'Hosts on this whitelist are permitted to use special cluster '.
             'mechanisms to authenticate requests. By default, these '.
             'mechanisms are disabled.'.
             "\n\n".
             'Define a list of CIDR blocks which whitelist all hosts in the '.
             'cluster. See the examples below for details.',
             "\n\n".
             'When cluster addresses are defined, Phabricator hosts will also '.
             'reject requests to interfaces which are not whitelisted.'))
         ->addExample(
           array(
             '23.24.25.80/32',
             '23.24.25.81/32',
           ),
           pht('Whitelist Specific Addresses'))
         ->addExample(
           array(
             '1.2.3.0/24',
           ),
           pht('Whitelist 1.2.3.*'))
         ->addExample(
           array(
             '1.2.0.0/16',
           ),
           pht('Whitelist 1.2.*.*'))
         ->addExample(
           array(
             '0.0.0.0/0',
           ),
           pht('Allow Any Host (Insecure!)')),
+      $this->newOption('cluster.instance', 'string', null)
+        ->setLocked(true)
+        ->setSummary(pht('Instance identifier for multi-tenant clusters.'))
+        ->setDescription(
+          pht(
+            'WARNING: This is a very advanced option, and only useful for '.
+            'hosting providers running multi-tenant clusters.'.
+            "\n\n".
+            'If you provide an instance identifier here (normally by '.
+            'injecting it with a `PhabricatorConfigSiteSource`), Phabricator '.
+            'will pass it to subprocesses and commit hooks in the '.
+            '`PHABRICATOR_INSTANCE` environmental variable.')),
     );
   }
 
 }
diff --git a/src/applications/repository/engine/PhabricatorRepositoryPullEngine.php b/src/applications/repository/engine/PhabricatorRepositoryPullEngine.php
index 8ac193fad7..6acc21fe05 100644
--- a/src/applications/repository/engine/PhabricatorRepositoryPullEngine.php
+++ b/src/applications/repository/engine/PhabricatorRepositoryPullEngine.php
@@ -1,472 +1,485 @@
 <?php
 
 /**
  * Manages execution of `git pull` and `hg pull` commands for
  * @{class:PhabricatorRepository} objects. Used by
  * @{class:PhabricatorRepositoryPullLocalDaemon}.
  *
  * This class also covers initial working copy setup through `git clone`,
  * `git init`, `hg clone`, `hg init`, or `svnadmin create`.
  *
  * @task pull     Pulling Working Copies
  * @task git      Pulling Git Working Copies
  * @task hg       Pulling Mercurial Working Copies
  * @task svn      Pulling Subversion Working Copies
  * @task internal Internals
  */
 final class PhabricatorRepositoryPullEngine
   extends PhabricatorRepositoryEngine {
 
 
 /* -(  Pulling Working Copies  )--------------------------------------------- */
 
 
   public function pullRepository() {
     $repository = $this->getRepository();
 
     $is_hg = false;
     $is_git = false;
     $is_svn = false;
 
     $vcs = $repository->getVersionControlSystem();
     $callsign = $repository->getCallsign();
 
     switch ($vcs) {
       case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
         // We never pull a local copy of non-hosted Subversion repositories.
         if (!$repository->isHosted()) {
           $this->skipPull(
             pht(
               "Repository '%s' is a non-hosted Subversion repository, which ".
               "does not require a local working copy to be pulled.",
               $callsign));
           return;
         }
         $is_svn = true;
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
         $is_git = true;
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
         $is_hg = true;
         break;
       default:
         $this->abortPull(pht('Unknown VCS "%s"!', $vcs));
         break;
     }
 
     $callsign = $repository->getCallsign();
     $local_path = $repository->getLocalPath();
     if ($local_path === null) {
       $this->abortPull(
         pht(
           "No local path is configured for repository '%s'.",
           $callsign));
     }
 
     try {
       $dirname = dirname($local_path);
       if (!Filesystem::pathExists($dirname)) {
         Filesystem::createDirectory($dirname, 0755, $recursive = true);
       }
 
       if (!Filesystem::pathExists($local_path)) {
         $this->logPull(
           pht(
             "Creating a new working copy for repository '%s'.",
             $callsign));
         if ($is_git) {
           $this->executeGitCreate();
         } else if ($is_hg) {
           $this->executeMercurialCreate();
         } else {
           $this->executeSubversionCreate();
         }
       } else {
         if (!$repository->isHosted()) {
           $this->logPull(
             pht(
               "Updating the working copy for repository '%s'.",
               $callsign));
           if ($is_git) {
             $this->verifyGitOrigin($repository);
             $this->executeGitUpdate();
           } else if ($is_hg) {
             $this->executeMercurialUpdate();
           }
         }
       }
 
       if ($repository->isHosted()) {
         if ($is_git) {
           $this->installGitHook();
         } else if ($is_svn) {
           $this->installSubversionHook();
         } else if ($is_hg) {
           $this->installMercurialHook();
         }
 
         foreach ($repository->getHookDirectories() as $directory) {
           $this->installHookDirectory($directory);
         }
       }
 
     } catch (Exception $ex) {
       $this->abortPull(
         pht('Pull of "%s" failed: %s', $callsign, $ex->getMessage()),
         $ex);
     }
 
     $this->donePull();
 
     return $this;
   }
 
   private function skipPull($message) {
     $this->log('%s', $message);
     $this->donePull();
   }
 
   private function abortPull($message, Exception $ex = null) {
     $code_error = PhabricatorRepositoryStatusMessage::CODE_ERROR;
     $this->updateRepositoryInitStatus($code_error, $message);
     if ($ex) {
       throw $ex;
     } else {
       throw new Exception($message);
     }
   }
 
   private function logPull($message) {
     $code_working = PhabricatorRepositoryStatusMessage::CODE_WORKING;
     $this->updateRepositoryInitStatus($code_working, $message);
     $this->log('%s', $message);
   }
 
   private function donePull() {
     $code_okay = PhabricatorRepositoryStatusMessage::CODE_OKAY;
     $this->updateRepositoryInitStatus($code_okay);
   }
 
   private function updateRepositoryInitStatus($code, $message = null) {
     $this->getRepository()->writeStatusMessage(
       PhabricatorRepositoryStatusMessage::TYPE_INIT,
       $code,
       array(
         'message' => $message,
       ));
   }
 
   private function installHook($path) {
     $this->log('%s', pht('Installing commit hook to "%s"...', $path));
 
     $repository = $this->getRepository();
-    $callsign = $repository->getCallsign();
+    $identifier = $this->getHookContextIdentifier($repository);
 
     $root = dirname(phutil_get_library_root('phabricator'));
     $bin = $root.'/bin/commit-hook';
 
     $full_php_path = Filesystem::resolveBinary('php');
     $cmd = csprintf(
       'exec %s -f %s -- %s "$@"',
       $full_php_path,
       $bin,
-      $callsign);
+      $identifier);
 
     $hook = "#!/bin/sh\nexport TERM=dumb\n{$cmd}\n";
 
     Filesystem::writeFile($path, $hook);
     Filesystem::changePermissions($path, 0755);
   }
 
   private function installHookDirectory($path) {
     $readme = pht(
       "To add custom hook scripts to this repository, add them to this ".
       "directory.\n\nPhabricator will run any executables in this directory ".
       "after running its own checks, as though they were normal hook ".
       "scripts.");
 
     Filesystem::createDirectory($path, 0755);
     Filesystem::writeFile($path.'/README', $readme);
   }
 
+  private function getHookContextIdentifier(PhabricatorRepository $repository) {
+    $identifier = $repository->getCallsign();
+
+    $instance = PhabricatorEnv::getEnvConfig('cluster.instance');
+    if (strlen($instance)) {
+      $identifier = "{$identifier}:{$instance}";
+    }
+
+    return $identifier;
+  }
+
 
 /* -(  Pulling Git Working Copies  )----------------------------------------- */
 
 
   /**
    * @task git
    */
   private function executeGitCreate() {
     $repository = $this->getRepository();
 
     $path = rtrim($repository->getLocalPath(), '/');
 
     if ($repository->isHosted()) {
       $repository->execxRemoteCommand(
         'init --bare -- %s',
         $path);
     } else {
       $repository->execxRemoteCommand(
         'clone --bare -- %P %s',
         $repository->getRemoteURIEnvelope(),
         $path);
     }
   }
 
 
   /**
    * @task git
    */
   private function executeGitUpdate() {
     $repository = $this->getRepository();
 
     list($err, $stdout) = $repository->execLocalCommand(
       'rev-parse --show-toplevel');
 
     $message = null;
     $path = $repository->getLocalPath();
     if ($err) {
       // Try to raise a more tailored error message in the more common case
       // of the user creating an empty directory. (We could try to remove it,
       // but might not be able to, and it's much simpler to raise a good
       // message than try to navigate those waters.)
       if (is_dir($path)) {
         $files = Filesystem::listDirectory($path, $include_hidden = true);
         if (!$files) {
           $message =
             "Expected to find a git repository at '{$path}', but there ".
             "is an empty directory there. Remove the directory: the daemon ".
             "will run 'git clone' for you.";
         } else {
           $message =
             "Expected to find a git repository at '{$path}', but there is ".
             "a non-repository directory (with other stuff in it) there. Move ".
             "or remove this directory (or reconfigure the repository to use a ".
             "different directory), and then either clone a repository ".
             "yourself or let the daemon do it.";
         }
       } else if (is_file($path)) {
         $message =
           "Expected to find a git repository at '{$path}', but there is a ".
           "file there instead. Remove it and let the daemon clone a ".
           "repository for you.";
       } else {
         $message =
           "Expected to find a git repository at '{$path}', but did not.";
       }
     } else {
       $repo_path = rtrim($stdout, "\n");
 
       if (empty($repo_path)) {
         // This can mean one of two things: we're in a bare repository, or
         // we're inside a git repository inside another git repository. Since
         // the first is dramatically more likely now that we perform bare
         // clones and I don't have a great way to test for the latter, assume
         // we're OK.
       } else if (!Filesystem::pathsAreEquivalent($repo_path, $path)) {
         $err = true;
         $message =
           "Expected to find repo at '{$path}', but the actual ".
           "git repository root for this directory is '{$repo_path}'. ".
           "Something is misconfigured. The repository's 'Local Path' should ".
           "be set to some place where the daemon can check out a working ".
           "copy, and should not be inside another git repository.";
       }
     }
 
     if ($err && $repository->canDestroyWorkingCopy()) {
       phlog("Repository working copy at '{$path}' failed sanity check; ".
             "destroying and re-cloning. {$message}");
       Filesystem::remove($path);
       $this->executeGitCreate();
     } else if ($err) {
       throw new Exception($message);
     }
 
     $retry = false;
     do {
       // This is a local command, but needs credentials.
       if ($repository->isWorkingCopyBare()) {
         // For bare working copies, we need this magic incantation.
         $future = $repository->getRemoteCommandFuture(
           'fetch origin %s --prune',
           '+refs/heads/*:refs/heads/*');
       } else {
         $future = $repository->getRemoteCommandFuture(
           'fetch --all --prune');
       }
 
       $future->setCWD($path);
       list($err, $stdout, $stderr) = $future->resolve();
 
       if ($err && !$retry && $repository->canDestroyWorkingCopy()) {
         $retry = true;
         // Fix remote origin url if it doesn't match our configuration
         $origin_url = $repository->execLocalCommand(
           'config --get remote.origin.url');
         $remote_uri = $repository->getRemoteURIEnvelope();
         if ($origin_url != $remote_uri->openEnvelope()) {
           $repository->execLocalCommand(
             'remote set-url origin %P',
             $remote_uri);
         }
       } else if ($err) {
         throw new Exception(
           "git fetch failed with error #{$err}:\n".
           "stdout:{$stdout}\n\n".
           "stderr:{$stderr}\n");
       } else {
         $retry = false;
       }
     } while ($retry);
   }
 
 
   /**
    * @task git
    */
   private function installGitHook() {
     $repository = $this->getRepository();
     $root = $repository->getLocalPath();
 
     if ($repository->isWorkingCopyBare()) {
       $path = '/hooks/pre-receive';
     } else {
       $path = '/.git/hooks/pre-receive';
     }
 
     $this->installHook($root.$path);
   }
 
 
 /* -(  Pulling Mercurial Working Copies  )----------------------------------- */
 
 
   /**
    * @task hg
    */
   private function executeMercurialCreate() {
     $repository = $this->getRepository();
 
     $path = rtrim($repository->getLocalPath(), '/');
 
     if ($repository->isHosted()) {
       $repository->execxRemoteCommand(
         'init -- %s',
         $path);
     } else {
       $repository->execxRemoteCommand(
         'clone --noupdate -- %P %s',
         $repository->getRemoteURIEnvelope(),
         $path);
     }
   }
 
 
   /**
    * @task hg
    */
   private function executeMercurialUpdate() {
     $repository = $this->getRepository();
     $path = $repository->getLocalPath();
 
     // This is a local command, but needs credentials.
     $future = $repository->getRemoteCommandFuture('pull -u');
     $future->setCWD($path);
 
     try {
       $future->resolvex();
     } catch (CommandException $ex) {
       $err = $ex->getError();
       $stdout = $ex->getStdOut();
 
       // NOTE: Between versions 2.1 and 2.1.1, Mercurial changed the behavior
       // of "hg pull" to return 1 in case of a successful pull with no changes.
       // This behavior has been reverted, but users who updated between Feb 1,
       // 2012 and Mar 1, 2012 will have the erroring version. Do a dumb test
       // against stdout to check for this possibility.
       // See: https://github.com/phacility/phabricator/issues/101/
 
       // NOTE: Mercurial has translated versions, which translate this error
       // string. In a translated version, the string will be something else,
       // like "aucun changement trouve". There didn't seem to be an easy way
       // to handle this (there are hard ways but this is not a common problem
       // and only creates log spam, not application failures). Assume English.
 
       // TODO: Remove this once we're far enough in the future that deployment
       // of 2.1 is exceedingly rare?
       if ($err == 1 && preg_match('/no changes found/', $stdout)) {
         return;
       } else {
         throw $ex;
       }
     }
   }
 
 
   /**
    * @task hg
    */
   private function installMercurialHook() {
     $repository = $this->getRepository();
     $path = $repository->getLocalPath().'/.hg/hgrc';
 
+    $identifier = $this->getHookContextIdentifier($repository);
+
     $root = dirname(phutil_get_library_root('phabricator'));
     $bin = $root.'/bin/commit-hook';
 
     $data = array();
     $data[] = '[hooks]';
 
     // This hook handles normal pushes.
     $data[] = csprintf(
       'pretxnchangegroup.phabricator = %s %s %s',
       $bin,
-      $repository->getCallsign(),
+      $identifier,
       'pretxnchangegroup');
 
     // This one handles creating bookmarks.
     $data[] = csprintf(
       'prepushkey.phabricator = %s %s %s',
       $bin,
-      $repository->getCallsign(),
+      $identifier,
       'prepushkey');
 
     $data[] = null;
 
     $data = implode("\n", $data);
 
     $this->log('%s', pht('Installing commit hook config to "%s"...', $path));
 
     Filesystem::writeFile($path, $data);
   }
 
 
 /* -(  Pulling Subversion Working Copies  )---------------------------------- */
 
 
   /**
    * @task svn
    */
   private function executeSubversionCreate() {
     $repository = $this->getRepository();
 
     $path = rtrim($repository->getLocalPath(), '/');
     execx('svnadmin create -- %s', $path);
   }
 
 
   /**
    * @task svn
    */
   private function installSubversionHook() {
     $repository = $this->getRepository();
     $root = $repository->getLocalPath();
 
     $path = '/hooks/pre-commit';
 
     $this->installHook($root.$path);
   }
 
 
 }
diff --git a/src/infrastructure/env/PhabricatorEnv.php b/src/infrastructure/env/PhabricatorEnv.php
index ae40ba4a5c..7e266ef469 100644
--- a/src/infrastructure/env/PhabricatorEnv.php
+++ b/src/infrastructure/env/PhabricatorEnv.php
@@ -1,611 +1,620 @@
 <?php
 
 /**
  * Manages the execution environment configuration, exposing APIs to read
  * configuration settings and other similar values that are derived directly
  * from configuration settings.
  *
  *
  * = Reading Configuration =
  *
  * The primary role of this class is to provide an API for reading
  * Phabricator configuration, @{method:getEnvConfig}:
  *
  *   $value = PhabricatorEnv::getEnvConfig('some.key', $default);
  *
  * The class also handles some URI construction based on configuration, via
  * the methods @{method:getURI}, @{method:getProductionURI},
  * @{method:getCDNURI}, and @{method:getDoclink}.
  *
  * For configuration which allows you to choose a class to be responsible for
  * some functionality (e.g., which mail adapter to use to deliver email),
  * @{method:newObjectFromConfig} provides a simple interface that validates
  * the configured value.
  *
  *
  * = Unit Test Support =
  *
  * In unit tests, you can use @{method:beginScopedEnv} to create a temporary,
  * mutable environment. The method returns a scope guard object which restores
  * the environment when it is destroyed. For example:
  *
  *   public function testExample() {
  *     $env = PhabricatorEnv::beginScopedEnv();
  *     $env->overrideEnv('some.key', 'new-value-for-this-test');
  *
  *     // Some test which depends on the value of 'some.key'.
  *
  *   }
  *
  * Your changes will persist until the `$env` object leaves scope or is
  * destroyed.
  *
  * You should //not// use this in normal code.
  *
  *
  * @task read     Reading Configuration
  * @task uri      URI Validation
  * @task test     Unit Test Support
  * @task internal Internals
  */
 final class PhabricatorEnv {
 
   private static $sourceStack;
   private static $repairSource;
   private static $overrideSource;
   private static $requestBaseURI;
   private static $cache;
 
   /**
    * @phutil-external-symbol class PhabricatorStartup
    */
   public static function initializeWebEnvironment() {
     self::initializeCommonEnvironment();
   }
 
   public static function initializeScriptEnvironment() {
     self::initializeCommonEnvironment();
 
     // NOTE: This is dangerous in general, but we know we're in a script context
     // and are not vulnerable to CSRF.
     AphrontWriteGuard::allowDangerousUnguardedWrites(true);
 
     // There are several places where we log information (about errors, events,
     // service calls, etc.) for analysis via DarkConsole or similar. These are
     // useful for web requests, but grow unboundedly in long-running scripts and
     // daemons. Discard data as it arrives in these cases.
     PhutilServiceProfiler::getInstance()->enableDiscardMode();
     DarkConsoleErrorLogPluginAPI::enableDiscardMode();
     DarkConsoleEventPluginAPI::enableDiscardMode();
   }
 
 
   private static function initializeCommonEnvironment() {
     PhutilErrorHandler::initialize();
 
     self::buildConfigurationSourceStack();
 
     // Force a valid timezone. If both PHP and Phabricator configuration are
     // invalid, use UTC.
     $tz = PhabricatorEnv::getEnvConfig('phabricator.timezone');
     if ($tz) {
       @date_default_timezone_set($tz);
     }
     $ok = @date_default_timezone_set(date_default_timezone_get());
     if (!$ok) {
       date_default_timezone_set('UTC');
     }
 
     // Prepend '/support/bin' and append any paths to $PATH if we need to.
     $env_path = getenv('PATH');
     $phabricator_path = dirname(phutil_get_library_root('phabricator'));
     $support_path = $phabricator_path.'/support/bin';
     $env_path = $support_path.PATH_SEPARATOR.$env_path;
     $append_dirs = PhabricatorEnv::getEnvConfig('environment.append-paths');
     if (!empty($append_dirs)) {
       $append_path = implode(PATH_SEPARATOR, $append_dirs);
       $env_path = $env_path.PATH_SEPARATOR.$append_path;
     }
     putenv('PATH='.$env_path);
 
     // Write this back into $_ENV, too, so ExecFuture picks it up when creating
     // subprocess environments.
     $_ENV['PATH'] = $env_path;
 
+
+    // If an instance identifier is defined, write it into the environment so
+    // it's available to subprocesses.
+    $instance = PhabricatorEnv::getEnvConfig('cluster.instance');
+    if (strlen($instance)) {
+      putenv('PHABRICATOR_INSTANCE='.$instance);
+      $_ENV['PHABRICATOR_INSTANCE'] = $instance;
+    }
+
     PhabricatorEventEngine::initialize();
 
     $translation = PhabricatorEnv::newObjectFromConfig('translation.provider');
     PhutilTranslator::getInstance()
       ->setLanguage($translation->getLanguage())
       ->addTranslations($translation->getCleanTranslations());
   }
 
   private static function buildConfigurationSourceStack() {
     self::dropConfigCache();
 
     $stack = new PhabricatorConfigStackSource();
     self::$sourceStack = $stack;
 
     $default_source = id(new PhabricatorConfigDefaultSource())
       ->setName(pht('Global Default'));
     $stack->pushSource($default_source);
 
     $env = self::getSelectedEnvironmentName();
     if ($env) {
       $stack->pushSource(
         id(new PhabricatorConfigFileSource($env))
           ->setName(pht("File '%s'", $env)));
     }
 
     $stack->pushSource(
       id(new PhabricatorConfigLocalSource())
         ->setName(pht('Local Config')));
 
     // If the install overrides the database adapter, we might need to load
     // the database adapter class before we can push on the database config.
     // This config is locked and can't be edited from the web UI anyway.
     foreach (PhabricatorEnv::getEnvConfig('load-libraries') as $library) {
       phutil_load_library($library);
     }
 
     // If custom libraries specify config options, they won't get default
     // values as the Default source has already been loaded, so we get it to
     // pull in all options from non-phabricator libraries now they are loaded.
     $default_source->loadExternalOptions();
 
     // If this install has site config sources, load them now.
     $site_sources = id(new PhutilSymbolLoader())
       ->setAncestorClass('PhabricatorConfigSiteSource')
       ->loadObjects();
     $site_sources = msort($site_sources, 'getPriority');
     foreach ($site_sources as $site_source) {
       $stack->pushSource($site_source);
     }
 
     try {
       $stack->pushSource(
         id(new PhabricatorConfigDatabaseSource('default'))
           ->setName(pht('Database')));
     } catch (AphrontQueryException $exception) {
       // If the database is not available, just skip this configuration
       // source. This happens during `bin/storage upgrade`, `bin/conf` before
       // schema setup, etc.
     }
   }
 
   public static function repairConfig($key, $value) {
     if (!self::$repairSource) {
       self::$repairSource = id(new PhabricatorConfigDictionarySource(array()))
         ->setName(pht('Repaired Config'));
       self::$sourceStack->pushSource(self::$repairSource);
     }
     self::$repairSource->setKeys(array($key => $value));
     self::dropConfigCache();
   }
 
   public static function overrideConfig($key, $value) {
     if (!self::$overrideSource) {
       self::$overrideSource = id(new PhabricatorConfigDictionarySource(array()))
         ->setName(pht('Overridden Config'));
       self::$sourceStack->pushSource(self::$overrideSource);
     }
     self::$overrideSource->setKeys(array($key => $value));
     self::dropConfigCache();
   }
 
   public static function getUnrepairedEnvConfig($key, $default = null) {
     foreach (self::$sourceStack->getStack() as $source) {
       if ($source === self::$repairSource) {
         continue;
       }
       $result = $source->getKeys(array($key));
       if ($result) {
         return $result[$key];
       }
     }
     return $default;
   }
 
   public static function getSelectedEnvironmentName() {
     $env_var = 'PHABRICATOR_ENV';
 
     $env = idx($_SERVER, $env_var);
 
     if (!$env) {
       $env = getenv($env_var);
     }
 
     if (!$env) {
       $env = idx($_ENV, $env_var);
     }
 
     if (!$env) {
       $root = dirname(phutil_get_library_root('phabricator'));
       $path = $root.'/conf/local/ENVIRONMENT';
       if (Filesystem::pathExists($path)) {
         $env = trim(Filesystem::readFile($path));
       }
     }
 
     return $env;
   }
 
   public static function calculateEnvironmentHash() {
     $keys = array_keys(self::getAllConfigKeys());
     sort($keys);
 
     $skip_keys = self::getEnvConfig('phd.variant-config');
     $keys = array_diff($keys, $skip_keys);
 
     $values = array();
     foreach ($keys as $key) {
       $values[$key] = self::getEnvConfigIfExists($key);
     }
     return PhabricatorHash::digest(json_encode($values));
   }
 
 
 /* -(  Reading Configuration  )---------------------------------------------- */
 
 
   /**
    * Get the current configuration setting for a given key.
    *
    * If the key is not found, then throw an Exception.
    *
    * @task read
    */
   public static function getEnvConfig($key) {
     if (isset(self::$cache[$key])) {
       return self::$cache[$key];
     }
 
     if (array_key_exists($key, self::$cache)) {
       return self::$cache[$key];
     }
 
     $result = self::$sourceStack->getKeys(array($key));
     if (array_key_exists($key, $result)) {
       self::$cache[$key] = $result[$key];
       return $result[$key];
     } else {
       throw new Exception("No config value specified for key '{$key}'.");
     }
   }
 
 
   /**
    * Get the current configuration setting for a given key. If the key
    * does not exist, return a default value instead of throwing. This is
    * primarily useful for migrations involving keys which are slated for
    * removal.
    *
    * @task read
    */
   public static function getEnvConfigIfExists($key, $default = null) {
     try {
       return self::getEnvConfig($key);
     } catch (Exception $ex) {
       return $default;
     }
   }
 
 
   /**
    * Get the fully-qualified URI for a path.
    *
    * @task read
    */
   public static function getURI($path) {
     return rtrim(self::getAnyBaseURI(), '/').$path;
   }
 
 
   /**
    * Get the fully-qualified production URI for a path.
    *
    * @task read
    */
   public static function getProductionURI($path) {
     // If we're passed a URI which already has a domain, simply return it
     // unmodified. In particular, files may have URIs which point to a CDN
     // domain.
     $uri = new PhutilURI($path);
     if ($uri->getDomain()) {
       return $path;
     }
 
     $production_domain = self::getEnvConfig('phabricator.production-uri');
     if (!$production_domain) {
       $production_domain = self::getAnyBaseURI();
     }
     return rtrim($production_domain, '/').$path;
   }
 
   public static function getAllowedURIs($path) {
     $uri = new PhutilURI($path);
     if ($uri->getDomain()) {
       return $path;
     }
 
     $allowed_uris = self::getEnvConfig('phabricator.allowed-uris');
     $return = array();
     foreach ($allowed_uris as $allowed_uri) {
       $return[] = rtrim($allowed_uri, '/').$path;
     }
 
     return $return;
   }
 
 
   /**
    * Get the fully-qualified production URI for a static resource path.
    *
    * @task read
    */
   public static function getCDNURI($path) {
     $alt = self::getEnvConfig('security.alternate-file-domain');
     if (!$alt) {
       $alt = self::getAnyBaseURI();
     }
     $uri = new PhutilURI($alt);
     $uri->setPath($path);
     return (string)$uri;
   }
 
 
   /**
    * Get the fully-qualified production URI for a documentation resource.
    *
    * @task read
    */
   public static function getDoclink($resource, $type = 'article') {
     $uri = new PhutilURI('https://secure.phabricator.com/diviner/find/');
     $uri->setQueryParam('name', $resource);
     $uri->setQueryParam('type', $type);
     $uri->setQueryParam('jump', true);
     return (string)$uri;
   }
 
 
   /**
    * Build a concrete object from a configuration key.
    *
    * @task read
    */
   public static function newObjectFromConfig($key, $args = array()) {
     $class = self::getEnvConfig($key);
     return newv($class, $args);
   }
 
   public static function getAnyBaseURI() {
     $base_uri = self::getEnvConfig('phabricator.base-uri');
 
     if (!$base_uri) {
       $base_uri = self::getRequestBaseURI();
     }
 
     if (!$base_uri) {
       throw new Exception(
         "Define 'phabricator.base-uri' in your configuration to continue.");
     }
 
     return $base_uri;
   }
 
   public static function getRequestBaseURI() {
     return self::$requestBaseURI;
   }
 
   public static function setRequestBaseURI($uri) {
     self::$requestBaseURI = $uri;
   }
 
 /* -(  Unit Test Support  )-------------------------------------------------- */
 
 
   /**
    * @task test
    */
   public static function beginScopedEnv() {
     return new PhabricatorScopedEnv(self::pushTestEnvironment());
   }
 
 
   /**
    * @task test
    */
   private static function pushTestEnvironment() {
     self::dropConfigCache();
     $source = new PhabricatorConfigDictionarySource(array());
     self::$sourceStack->pushSource($source);
     return spl_object_hash($source);
   }
 
 
   /**
    * @task test
    */
   public static function popTestEnvironment($key) {
     self::dropConfigCache();
     $source = self::$sourceStack->popSource();
     $stack_key = spl_object_hash($source);
     if ($stack_key !== $key) {
       self::$sourceStack->pushSource($source);
       throw new Exception(
         'Scoped environments were destroyed in a diffent order than they '.
         'were initialized.');
     }
   }
 
 
 /* -(  URI Validation  )----------------------------------------------------- */
 
 
   /**
    * Detect if a URI satisfies either @{method:isValidLocalWebResource} or
    * @{method:isValidRemoteWebResource}, i.e. is a page on this server or the
    * URI of some other resource which has a valid protocol. This rejects
    * garbage URIs and URIs with protocols which do not appear in the
    * ##uri.allowed-protocols## configuration, notably 'javascript:' URIs.
    *
    * NOTE: This method is generally intended to reject URIs which it may be
    * unsafe to put in an "href" link attribute.
    *
    * @param string URI to test.
    * @return bool True if the URI identifies a web resource.
    * @task uri
    */
   public static function isValidWebResource($uri) {
     return self::isValidLocalWebResource($uri) ||
            self::isValidRemoteWebResource($uri);
   }
 
 
   /**
    * Detect if a URI identifies some page on this server.
    *
    * NOTE: This method is generally intended to reject URIs which it may be
    * unsafe to issue a "Location:" redirect to.
    *
    * @param string URI to test.
    * @return bool True if the URI identifies a local page.
    * @task uri
    */
   public static function isValidLocalWebResource($uri) {
     $uri = (string)$uri;
 
     if (!strlen($uri)) {
       return false;
     }
 
     if (preg_match('/\s/', $uri)) {
       // PHP hasn't been vulnerable to header injection attacks for a bunch of
       // years, but we can safely reject these anyway since they're never valid.
       return false;
     }
 
     // Chrome (at a minimum) interprets backslashes in Location headers and the
     // URL bar as forward slashes. This is probably intended to reduce user
     // error caused by confusion over which key is "forward slash" vs "back
     // slash".
     //
     // However, it means a URI like "/\evil.com" is interpreted like
     // "//evil.com", which is a protocol relative remote URI.
     //
     // Since we currently never generate URIs with backslashes in them, reject
     // these unconditionally rather than trying to figure out how browsers will
     // interpret them.
     if (preg_match('/\\\\/', $uri)) {
       return false;
     }
 
     // Valid URIs must begin with '/', followed by the end of the string or some
     // other non-'/' character. This rejects protocol-relative URIs like
     // "//evil.com/evil_stuff/".
     return (bool)preg_match('@^/([^/]|$)@', $uri);
   }
 
 
   /**
    * Detect if a URI identifies some valid remote resource.
    *
    * @param string URI to test.
    * @return bool True if a URI idenfies a remote resource with an allowed
    *              protocol.
    * @task uri
    */
   public static function isValidRemoteWebResource($uri) {
     $uri = (string)$uri;
 
     $proto = id(new PhutilURI($uri))->getProtocol();
     if (!$proto) {
       return false;
     }
 
     $allowed = self::getEnvConfig('uri.allowed-protocols');
     if (empty($allowed[$proto])) {
       return false;
     }
 
     return true;
   }
 
   public static function isClusterRemoteAddress() {
     $address = idx($_SERVER, 'REMOTE_ADDR');
     if (!$address) {
       throw new Exception(
         pht(
           'Unable to test remote address against cluster whitelist: '.
           'REMOTE_ADDR is not defined.'));
     }
 
     return self::isClusterAddress($address);
   }
 
   public static function isClusterAddress($address) {
     $cluster_addresses = PhabricatorEnv::getEnvConfig('cluster.addresses');
     if (!$cluster_addresses) {
       throw new Exception(
         pht(
           'Phabricator is not configured to serve cluster requests. '.
           'Set `cluster.addresses` in the configuration to whitelist '.
           'cluster hosts before sending requests that use a cluster '.
           'authentication mechanism.'));
     }
 
     return PhutilCIDRList::newList($cluster_addresses)
       ->containsAddress($address);
   }
 
 /* -(  Internals  )---------------------------------------------------------- */
 
 
   /**
    * @task internal
    */
   public static function envConfigExists($key) {
     return array_key_exists($key, self::$sourceStack->getKeys(array($key)));
   }
 
 
   /**
    * @task internal
    */
   public static function getAllConfigKeys() {
     return self::$sourceStack->getAllKeys();
   }
 
   public static function getConfigSourceStack() {
     return self::$sourceStack;
   }
 
   /**
    * @task internal
    */
   public static function overrideTestEnvConfig($stack_key, $key, $value) {
     $tmp = array();
 
     // If we don't have the right key, we'll throw when popping the last
     // source off the stack.
     do {
       $source = self::$sourceStack->popSource();
       array_unshift($tmp, $source);
       if (spl_object_hash($source) == $stack_key) {
         $source->setKeys(array($key => $value));
         break;
       }
     } while (true);
 
     foreach ($tmp as $source) {
       self::$sourceStack->pushSource($source);
     }
 
     self::dropConfigCache();
   }
 
   private static function dropConfigCache() {
     self::$cache = array();
   }
 
 }