Give the NAT lab per-run generated configs

The NAT lab wrote its generated node configs to one shared directory, unlike
the static and firewall labs which already scope theirs by run. The directory
is bind-mounted by compose and read back by the suite scripts after the
containers are up, so two overlapping runs let the second run's generator
overwrite the npubs the first is about to ping.

Scope the directory with FIPS_CI_NAME_SUFFIX at all three places that have to
agree: the generator's output path, the ten compose bind-mounts, and the
CONFIG_DIR the suite scripts read back from. An unset suffix renders the plain
path the lab has always used, so a bare invocation and the GitHub matrix are
unaffected. The run teardown removes the per-run directory alongside the static
and firewall ones, and the gitignore is widened to cover the suffixed form.

Rendering the compose file with every profile and no suffix set reproduces
today's exact ten paths; setting a suffix moves all ten.

This lands on its own, ahead of the network and address work, so that a failure
of the two-overlapping-runs acceptance test can be bisected between the config
fix and the address conversion.

testing/ci-local.sh

@@ -429,6 +429,7 @@ ci_teardown() {
     if [[ $run_status -eq 0 && -n "${CI_RUN_NAME_SUFFIX:-}" ]]; then
         rm -rf "$SCRIPT_DIR/static/generated-configs${CI_RUN_NAME_SUFFIX}"
         rm -rf "$SCRIPT_DIR/firewall/generated-configs${CI_RUN_NAME_SUFFIX}"
+        rm -rf "$SCRIPT_DIR/nat/generated-configs${CI_RUN_NAME_SUFFIX}"
     fi
 
     # 4. This run's build context. Unlike the generated configs it is removed

testing/nat/.gitignore

@@ -1 +1 @@
-generated-configs
+generated-configs*

testing/nat/docker-compose.yml

@@ -126,7 +126,7 @@ services:
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
       - ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro
-      - ./generated-configs/cone/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/cone/node-a.yaml:/etc/fips/fips.yaml:ro
     network_mode: none
 
   cone-b:
@@ -152,7 +152,7 @@ services:
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
       - ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro
-      - ./generated-configs/cone/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/cone/node-b.yaml:/etc/fips/fips.yaml:ro
     network_mode: none
 
   symmetric-a:
@@ -178,7 +178,7 @@ services:
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
       - ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro
-      - ./generated-configs/symmetric/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/symmetric/node-a.yaml:/etc/fips/fips.yaml:ro
     network_mode: none
 
   symmetric-b:
@@ -204,7 +204,7 @@ services:
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
       - ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro
-      - ./generated-configs/symmetric/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/symmetric/node-b.yaml:/etc/fips/fips.yaml:ro
     network_mode: none
 
   lan-a:
@@ -217,7 +217,7 @@ services:
       - stun
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/lan/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/lan/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       shared-lan:
         ipv4_address: 172.31.10.10
@@ -232,7 +232,7 @@ services:
       - stun
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/lan/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/lan/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       shared-lan:
         ipv4_address: 172.31.10.11
@@ -254,7 +254,7 @@ services:
       - stun
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/nostr-publish-consume/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/nostr-publish-consume/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       shared-lan:
         ipv4_address: 172.31.10.20
@@ -269,7 +269,7 @@ services:
       - stun
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/nostr-publish-consume/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/nostr-publish-consume/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       shared-lan:
         ipv4_address: 172.31.10.21
@@ -298,7 +298,7 @@ services:
       - stun
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/stun-faults/stun-fault-node.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/stun-faults/stun-fault-node.yaml:/etc/fips/fips.yaml:ro
     networks:
       shared-lan:
         ipv4_address: 172.31.10.50
@@ -319,7 +319,7 @@ services:
       - stun
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/stun-faults/stun-fault-peer.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/stun-faults/stun-fault-peer.yaml:/etc/fips/fips.yaml:ro
     networks:
       shared-lan:
         ipv4_address: 172.31.10.51

testing/nat/scripts/generate-configs.sh

@@ -6,7 +6,12 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 NAT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 ROOT_DIR="$(cd "$NAT_DIR/../.." && pwd)"
 DERIVE_KEYS="$ROOT_DIR/testing/lib/derive_keys.py"
-OUTPUT_DIR="$NAT_DIR/generated-configs"
+# Per-run, for the same reason static's and firewall's generators are: this
+# directory is bind-mounted by compose and read back by the suite scripts
+# AFTER the containers are up, so a shared path lets a second run's generator
+# overwrite the npubs a first run is about to ping. Empty suffix renders
+# today's plain path, so a bare invocation is unchanged.
+OUTPUT_DIR="$NAT_DIR/generated-configs${FIPS_CI_NAME_SUFFIX:-}"
 SCENARIO="${1:?usage: generate-configs.sh <cone|symmetric|lan> [mesh-name]}"
 MESH_NAME="${2:-nat-lab-$(date +%s)-$$}"
 

testing/nat/scripts/nat-test.sh

@@ -9,6 +9,10 @@ BUILD_SCRIPT="$ROOT_DIR/testing/scripts/build.sh"
 GENERATE_SCRIPT="$SCRIPT_DIR/generate-configs.sh"
 TOPOLOGY_SCRIPT="$SCRIPT_DIR/setup-topology.sh"
 WAIT_LIB="$ROOT_DIR/testing/lib/wait-converge.sh"
+# Must track generate-configs.sh's OUTPUT_DIR and the compose bind-mounts: the
+# npubs are read back here after the containers are up, so reading a different
+# directory than the one the generator wrote pings an npub no node owns.
+CONFIG_DIR="$NAT_DIR/generated-configs${FIPS_CI_NAME_SUFFIX:-}"
 
 SCENARIO="${1:-all}"
 COMPOSE=(docker compose -f "$NAT_DIR/docker-compose.yml")
@@ -358,7 +362,7 @@ run_cone() {
     assert_link_path fips-nat-cone-a${FIPS_CI_NAME_SUFFIX:-} 172.31.254.
     assert_link_path fips-nat-cone-b${FIPS_CI_NAME_SUFFIX:-} 172.31.254.
     # shellcheck disable=SC1090
-    source "$NAT_DIR/generated-configs/cone/npubs.env"
+    source "$CONFIG_DIR/cone/npubs.env"
     ping_peer fips-nat-cone-a${FIPS_CI_NAME_SUFFIX:-} "$NPUB_B"
     ping_peer fips-nat-cone-b${FIPS_CI_NAME_SUFFIX:-} "$NPUB_A"
     cleanup
@@ -385,7 +389,7 @@ run_symmetric() {
     require_bootstrap_activity fips-nat-symmetric-a${FIPS_CI_NAME_SUFFIX:-}
     require_bootstrap_activity fips-nat-symmetric-b${FIPS_CI_NAME_SUFFIX:-}
     # shellcheck disable=SC1090
-    source "$NAT_DIR/generated-configs/symmetric/npubs.env"
+    source "$CONFIG_DIR/symmetric/npubs.env"
     ping_peer fips-nat-symmetric-a${FIPS_CI_NAME_SUFFIX:-} "$NPUB_B"
     ping_peer fips-nat-symmetric-b${FIPS_CI_NAME_SUFFIX:-} "$NPUB_A"
     cleanup
@@ -409,7 +413,7 @@ run_lan() {
     assert_link_path fips-nat-lan-a${FIPS_CI_NAME_SUFFIX:-} 172.31.10.
     assert_link_path fips-nat-lan-b${FIPS_CI_NAME_SUFFIX:-} 172.31.10.
     # shellcheck disable=SC1090
-    source "$NAT_DIR/generated-configs/lan/npubs.env"
+    source "$CONFIG_DIR/lan/npubs.env"
     ping_peer fips-nat-lan-a${FIPS_CI_NAME_SUFFIX:-} "$NPUB_B"
     ping_peer fips-nat-lan-b${FIPS_CI_NAME_SUFFIX:-} "$NPUB_A"
     # Skip the final teardown when the mesh-lab harness wraps this

testing/nat/scripts/nostr-relay-test.sh

@@ -21,6 +21,8 @@ ROOT_DIR="$(cd "$NAT_DIR/../.." && pwd)"
 BUILD_SCRIPT="$ROOT_DIR/testing/scripts/build.sh"
 GENERATE_SCRIPT="$SCRIPT_DIR/generate-configs.sh"
 WAIT_LIB="$ROOT_DIR/testing/lib/wait-converge.sh"
+# Must track generate-configs.sh's OUTPUT_DIR and the compose bind-mounts.
+CONFIG_DIR="$NAT_DIR/generated-configs${FIPS_CI_NAME_SUFFIX:-}"
 
 PROFILE="nostr-publish-consume"
 SCENARIO="$PROFILE"
@@ -342,7 +344,7 @@ run_test() {
     fi
 
     # shellcheck disable=SC1090
-    source "$NAT_DIR/generated-configs/$SCENARIO/npubs.env"
+    source "$CONFIG_DIR/$SCENARIO/npubs.env"
     echo "  NPUB_A=$NPUB_A"
     echo "  NPUB_B=$NPUB_B"