refactor: update job timeout

packages/syft-enclave/Justfile

@@ -7,7 +7,7 @@ vm_default := "syft-enclave-vm"
 secret_name_default := "syft-enclave-token"
 sa_name_default := "syft-enclave-service-account"
 tf_dir := "terraform"
-job_timeout_seconds := "1800" # 30 minutes
+job_timeout_seconds := "2592000" # 30 days
 
 # Shared shell snippet: loads settings from ~/.syft-enclaves/settings.json.
 # `project_id` and `zone` are written by `just init`.
@@ -133,7 +133,7 @@ _whoami:
 # Print the active gcloud account
 whoami: _whoami
 
-# Enable APIs, grant attestation IAM role, create firewall rule (idempotent)
+# Enable the required GCP APIs (idempotent).
 _provision: _whoami
     #!/bin/bash
     set -e
@@ -145,12 +145,6 @@ _provision: _whoami
       confidentialcomputing.googleapis.com \
       --project="$project_id"
 
-    # grant attestation role to default compute SA
-    project_number=$(gcloud projects describe "$project_id" --format='get(projectNumber)')
-    gcloud projects add-iam-policy-binding "$project_id" \
-      --member="serviceAccount:${project_number}-compute@developer.gserviceaccount.com" \
-      --role="roles/confidentialcomputing.workloadUser"
-
 
 # Provision Secret Manager + a dedicated service account for the
 # enclave runtime. The SA gets `secretmanager.secretAccessor` on the
@@ -209,17 +203,16 @@ provision-secret-sa token_path secret=secret_name_default sa=sa_name_default: _p
 # its token via the VM's attached service account + Secret Manager.
 # No WIF — use when org policy blocks WIF provider creation. Requires
 # `just provision-secret-sa <token>` first.
-# Pass logs=true to debug a failing deployment.
 [group('deploy')]
-start email name=vm_default logs="false" machine_type=machine_type_default machine_boot_size=machine_boot_size_default job_timeout_seconds=job_timeout_seconds: _provision
+start email name=vm_default machine_type=machine_type_default machine_boot_size=machine_boot_size_default job_timeout_seconds=job_timeout_seconds: _provision
     #!/bin/bash
     set -e
     {{load_settings}}
     [ -n "$sa_email" ] || { echo "Error: SA not provisioned. Run: just provision-secret-sa <token_path>" >&2; exit 1; }
     [ -n "$secret_resource" ] || { echo "Error: secret not provisioned. Run: just provision-secret-sa <token_path>" >&2; exit 1; }
     [ -n "$data_owners" ] || { echo "Error: data_owners not set. Re-run: just init <project_id> <token_path> <data_owners>" >&2; exit 1; }
 
-    # Optional job-timeout override; when unset the container uses syft-job's built-in default (600s).
+    # Job timeout: defaults to 30 days (job_timeout_seconds); pass an empty value to fall back to the container default (600s).
     job_timeout_env=""
     if [ -n "{{job_timeout_seconds}}" ]; then
       job_timeout_env="~tee-env-SYFT_DEFAULT_JOB_TIMEOUT_SECONDS={{job_timeout_seconds}}"
@@ -239,7 +232,7 @@ start email name=vm_default logs="false" machine_type=machine_type_default machi
       --image-project=confidential-space-images \
       --scopes=cloud-platform \
       --service-account="$sa_email" \
-      --metadata="^~^tee-image-reference={{image}}~tee-restart-policy=Never~tee-container-log-redirect={{logs}}~tee-env-SYFT_ENCLAVE_EMAIL={{email}}~tee-env-SYFT_ENCLAVE_DATA_OWNERS=${data_owners}~tee-env-SYFT_ENCLAVE_REQUIRE_TEE=true~tee-env-SYFT_BOOTSTRAP=sa~tee-env-SYFT_BOOTSTRAP_SA_SECRET=${secret_resource}~tee-env-SYFT_ENCLAVE_USE_ENCRYPTION=true${job_timeout_env}"
+      --metadata="^~^tee-image-reference={{image}}~tee-restart-policy=Never~tee-env-SYFT_ENCLAVE_EMAIL={{email}}~tee-env-SYFT_ENCLAVE_DATA_OWNERS=${data_owners}~tee-env-SYFT_ENCLAVE_REQUIRE_TEE=true~tee-env-SYFT_BOOTSTRAP=sa~tee-env-SYFT_BOOTSTRAP_SA_SECRET=${secret_resource}~tee-env-SYFT_ENCLAVE_USE_ENCRYPTION=true${job_timeout_env}"
 
 
 [group('deploy')]
@@ -251,7 +244,7 @@ start-debug email name=vm_default machine_type=machine_type_default machine_boot
     [ -n "$secret_resource" ] || { echo "Error: secret not provisioned. Run: just provision-secret-sa <token_path>" >&2; exit 1; }
     [ -n "$data_owners" ] || { echo "Error: data_owners not set. Re-run: just init <project_id> <token_path> <data_owners>" >&2; exit 1; }
 
-    # Optional job-timeout override; when unset the container uses syft-job's built-in default (600s).
+    # Job timeout: defaults to 30 days (job_timeout_seconds); pass an empty value to fall back to the container default (600s).
     job_timeout_env=""
     if [ -n "{{job_timeout_seconds}}" ]; then
       job_timeout_env="~tee-env-SYFT_DEFAULT_JOB_TIMEOUT_SECONDS={{job_timeout_seconds}}"

packages/syft-enclave/terraform/terraform.tfvars.example

@@ -13,5 +13,5 @@ token_file    = "/absolute/path/to/token_enclave.json"
 # machine_type        = "n2d-standard-2"
 # boot_disk_size_gb   = 200
 # container_image     = "docker.io/openminedreleasebot/syft-client-enclave:latest"
-# use_encryption      = true          # default: true in prod, false in dev mode
-# job_timeout_seconds = 600
+# use_encryption      = false         # dev-mode override only (default false); production always encrypts
+# job_timeout_seconds = 2592000   # 30 days (default); set to null to use the container default (600s)

packages/syft-enclave/terraform/variables.tf

@@ -77,12 +77,12 @@ variable "use_encryption" {
   type        = bool
   default     = null
   nullable    = true
-  description = "Override SYFT_ENCLAVE_USE_ENCRYPTION. Default: true in production, false in dev mode."
+  description = "Override SYFT_ENCLAVE_USE_ENCRYPTION in dev mode only (default false there). Ignored in production, which always encrypts"
 }
 
 variable "job_timeout_seconds" {
   type        = number
-  default     = null
+  default     = 2592000 # 30 days
   nullable    = true
-  description = "Optional SYFT_DEFAULT_JOB_TIMEOUT_SECONDS; unset means the container default (600s)."
+  description = "SYFT_DEFAULT_JOB_TIMEOUT_SECONDS. Default: 2592000 (30 days). Set to null to omit the env var and fall back to the container default (600s)."
 }

packages/syft-enclave/terraform/vm.tf

@@ -4,7 +4,10 @@ data "google_compute_image" "confidential_space" {
 }
 
 locals {
-  use_encryption = coalesce(var.use_encryption, !var.dev_mode)
+  # Production always encrypts
+  # Dev mode defaults to off but honors the use_encryption override
+  # Prod ignores the override.
+  use_encryption = var.dev_mode ? coalesce(var.use_encryption, false) : true
 
   tee_metadata = merge(
     {