From fbff52d85e1cbd8ca6fae506ea5a2dc66d318a2d Mon Sep 17 00:00:00 2001 From: Johnathan Corgan Date: Mon, 27 Jul 2026 14:34:33 +0000 Subject: [PATCH] Give the NAT lab per-run generated configs The NAT lab wrote its generated node configs to one shared directory, unlike the static and firewall labs which already scope theirs by run. The directory is bind-mounted by compose and read back by the suite scripts after the containers are up, so two overlapping runs let the second run's generator overwrite the npubs the first is about to ping. Scope the directory with FIPS_CI_NAME_SUFFIX at all three places that have to agree: the generator's output path, the ten compose bind-mounts, and the CONFIG_DIR the suite scripts read back from. An unset suffix renders the plain path the lab has always used, so a bare invocation and the GitHub matrix are unaffected. The run teardown removes the per-run directory alongside the static and firewall ones, and the gitignore is widened to cover the suffixed form. Rendering the compose file with every profile and no suffix set reproduces today's exact ten paths; setting a suffix moves all ten. This lands on its own, ahead of the network and address work, so that a failure of the two-overlapping-runs acceptance test can be bisected between the config fix and the address conversion. --- testing/ci-local.sh | 1 + testing/nat/.gitignore | 2 +- testing/nat/docker-compose.yml | 20 ++++++++++---------- testing/nat/scripts/generate-configs.sh | 7 ++++++- testing/nat/scripts/nat-test.sh | 10 +++++++--- testing/nat/scripts/nostr-relay-test.sh | 4 +++- 6 files changed, 28 insertions(+), 16 deletions(-) diff --git a/testing/ci-local.sh b/testing/ci-local.sh index d0330df..b02a23b 100755 --- a/testing/ci-local.sh +++ b/testing/ci-local.sh @@ -429,6 +429,7 @@ ci_teardown() { if [[ $run_status -eq 0 && -n "${CI_RUN_NAME_SUFFIX:-}" ]]; then rm -rf "$SCRIPT_DIR/static/generated-configs${CI_RUN_NAME_SUFFIX}" rm -rf "$SCRIPT_DIR/firewall/generated-configs${CI_RUN_NAME_SUFFIX}" + rm -rf "$SCRIPT_DIR/nat/generated-configs${CI_RUN_NAME_SUFFIX}" fi # 4. This run's build context. Unlike the generated configs it is removed diff --git a/testing/nat/.gitignore b/testing/nat/.gitignore index 31315f6..b06c7df 100644 --- a/testing/nat/.gitignore +++ b/testing/nat/.gitignore @@ -1 +1 @@ -generated-configs +generated-configs* diff --git a/testing/nat/docker-compose.yml b/testing/nat/docker-compose.yml index d428ecc..0dd3055 100644 --- a/testing/nat/docker-compose.yml +++ b/testing/nat/docker-compose.yml @@ -126,7 +126,7 @@ services: volumes: - ../docker/resolv.conf:/etc/resolv.conf:ro - ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro - - ./generated-configs/cone/node-a.yaml:/etc/fips/fips.yaml:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/cone/node-a.yaml:/etc/fips/fips.yaml:ro network_mode: none cone-b: @@ -152,7 +152,7 @@ services: volumes: - ../docker/resolv.conf:/etc/resolv.conf:ro - ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro - - ./generated-configs/cone/node-b.yaml:/etc/fips/fips.yaml:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/cone/node-b.yaml:/etc/fips/fips.yaml:ro network_mode: none symmetric-a: @@ -178,7 +178,7 @@ services: volumes: - ../docker/resolv.conf:/etc/resolv.conf:ro - ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro - - ./generated-configs/symmetric/node-a.yaml:/etc/fips/fips.yaml:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/symmetric/node-a.yaml:/etc/fips/fips.yaml:ro network_mode: none symmetric-b: @@ -204,7 +204,7 @@ services: volumes: - ../docker/resolv.conf:/etc/resolv.conf:ro - ./node/entrypoint.sh:/usr/local/bin/nat-node-entrypoint.sh:ro - - ./generated-configs/symmetric/node-b.yaml:/etc/fips/fips.yaml:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/symmetric/node-b.yaml:/etc/fips/fips.yaml:ro network_mode: none lan-a: @@ -217,7 +217,7 @@ services: - stun volumes: - ../docker/resolv.conf:/etc/resolv.conf:ro - - ./generated-configs/lan/node-a.yaml:/etc/fips/fips.yaml:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/lan/node-a.yaml:/etc/fips/fips.yaml:ro networks: shared-lan: ipv4_address: 172.31.10.10 @@ -232,7 +232,7 @@ services: - stun volumes: - ../docker/resolv.conf:/etc/resolv.conf:ro - - ./generated-configs/lan/node-b.yaml:/etc/fips/fips.yaml:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/lan/node-b.yaml:/etc/fips/fips.yaml:ro networks: shared-lan: ipv4_address: 172.31.10.11 @@ -254,7 +254,7 @@ services: - stun volumes: - ../docker/resolv.conf:/etc/resolv.conf:ro - - ./generated-configs/nostr-publish-consume/node-a.yaml:/etc/fips/fips.yaml:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/nostr-publish-consume/node-a.yaml:/etc/fips/fips.yaml:ro networks: shared-lan: ipv4_address: 172.31.10.20 @@ -269,7 +269,7 @@ services: - stun volumes: - ../docker/resolv.conf:/etc/resolv.conf:ro - - ./generated-configs/nostr-publish-consume/node-b.yaml:/etc/fips/fips.yaml:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/nostr-publish-consume/node-b.yaml:/etc/fips/fips.yaml:ro networks: shared-lan: ipv4_address: 172.31.10.21 @@ -298,7 +298,7 @@ services: - stun volumes: - ../docker/resolv.conf:/etc/resolv.conf:ro - - ./generated-configs/stun-faults/stun-fault-node.yaml:/etc/fips/fips.yaml:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/stun-faults/stun-fault-node.yaml:/etc/fips/fips.yaml:ro networks: shared-lan: ipv4_address: 172.31.10.50 @@ -319,7 +319,7 @@ services: - stun volumes: - ../docker/resolv.conf:/etc/resolv.conf:ro - - ./generated-configs/stun-faults/stun-fault-peer.yaml:/etc/fips/fips.yaml:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/stun-faults/stun-fault-peer.yaml:/etc/fips/fips.yaml:ro networks: shared-lan: ipv4_address: 172.31.10.51 diff --git a/testing/nat/scripts/generate-configs.sh b/testing/nat/scripts/generate-configs.sh index b307d95..ec4c40f 100755 --- a/testing/nat/scripts/generate-configs.sh +++ b/testing/nat/scripts/generate-configs.sh @@ -6,7 +6,12 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" NAT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)" ROOT_DIR="$(cd "$NAT_DIR/../.." && pwd)" DERIVE_KEYS="$ROOT_DIR/testing/lib/derive_keys.py" -OUTPUT_DIR="$NAT_DIR/generated-configs" +# Per-run, for the same reason static's and firewall's generators are: this +# directory is bind-mounted by compose and read back by the suite scripts +# AFTER the containers are up, so a shared path lets a second run's generator +# overwrite the npubs a first run is about to ping. Empty suffix renders +# today's plain path, so a bare invocation is unchanged. +OUTPUT_DIR="$NAT_DIR/generated-configs${FIPS_CI_NAME_SUFFIX:-}" SCENARIO="${1:?usage: generate-configs.sh [mesh-name]}" MESH_NAME="${2:-nat-lab-$(date +%s)-$$}" diff --git a/testing/nat/scripts/nat-test.sh b/testing/nat/scripts/nat-test.sh index c1eea64..a64cd44 100755 --- a/testing/nat/scripts/nat-test.sh +++ b/testing/nat/scripts/nat-test.sh @@ -9,6 +9,10 @@ BUILD_SCRIPT="$ROOT_DIR/testing/scripts/build.sh" GENERATE_SCRIPT="$SCRIPT_DIR/generate-configs.sh" TOPOLOGY_SCRIPT="$SCRIPT_DIR/setup-topology.sh" WAIT_LIB="$ROOT_DIR/testing/lib/wait-converge.sh" +# Must track generate-configs.sh's OUTPUT_DIR and the compose bind-mounts: the +# npubs are read back here after the containers are up, so reading a different +# directory than the one the generator wrote pings an npub no node owns. +CONFIG_DIR="$NAT_DIR/generated-configs${FIPS_CI_NAME_SUFFIX:-}" SCENARIO="${1:-all}" COMPOSE=(docker compose -f "$NAT_DIR/docker-compose.yml") @@ -358,7 +362,7 @@ run_cone() { assert_link_path fips-nat-cone-a${FIPS_CI_NAME_SUFFIX:-} 172.31.254. assert_link_path fips-nat-cone-b${FIPS_CI_NAME_SUFFIX:-} 172.31.254. # shellcheck disable=SC1090 - source "$NAT_DIR/generated-configs/cone/npubs.env" + source "$CONFIG_DIR/cone/npubs.env" ping_peer fips-nat-cone-a${FIPS_CI_NAME_SUFFIX:-} "$NPUB_B" ping_peer fips-nat-cone-b${FIPS_CI_NAME_SUFFIX:-} "$NPUB_A" cleanup @@ -385,7 +389,7 @@ run_symmetric() { require_bootstrap_activity fips-nat-symmetric-a${FIPS_CI_NAME_SUFFIX:-} require_bootstrap_activity fips-nat-symmetric-b${FIPS_CI_NAME_SUFFIX:-} # shellcheck disable=SC1090 - source "$NAT_DIR/generated-configs/symmetric/npubs.env" + source "$CONFIG_DIR/symmetric/npubs.env" ping_peer fips-nat-symmetric-a${FIPS_CI_NAME_SUFFIX:-} "$NPUB_B" ping_peer fips-nat-symmetric-b${FIPS_CI_NAME_SUFFIX:-} "$NPUB_A" cleanup @@ -409,7 +413,7 @@ run_lan() { assert_link_path fips-nat-lan-a${FIPS_CI_NAME_SUFFIX:-} 172.31.10. assert_link_path fips-nat-lan-b${FIPS_CI_NAME_SUFFIX:-} 172.31.10. # shellcheck disable=SC1090 - source "$NAT_DIR/generated-configs/lan/npubs.env" + source "$CONFIG_DIR/lan/npubs.env" ping_peer fips-nat-lan-a${FIPS_CI_NAME_SUFFIX:-} "$NPUB_B" ping_peer fips-nat-lan-b${FIPS_CI_NAME_SUFFIX:-} "$NPUB_A" # Skip the final teardown when the mesh-lab harness wraps this diff --git a/testing/nat/scripts/nostr-relay-test.sh b/testing/nat/scripts/nostr-relay-test.sh index 718120d..26c0b9e 100755 --- a/testing/nat/scripts/nostr-relay-test.sh +++ b/testing/nat/scripts/nostr-relay-test.sh @@ -21,6 +21,8 @@ ROOT_DIR="$(cd "$NAT_DIR/../.." && pwd)" BUILD_SCRIPT="$ROOT_DIR/testing/scripts/build.sh" GENERATE_SCRIPT="$SCRIPT_DIR/generate-configs.sh" WAIT_LIB="$ROOT_DIR/testing/lib/wait-converge.sh" +# Must track generate-configs.sh's OUTPUT_DIR and the compose bind-mounts. +CONFIG_DIR="$NAT_DIR/generated-configs${FIPS_CI_NAME_SUFFIX:-}" PROFILE="nostr-publish-consume" SCENARIO="$PROFILE" @@ -342,7 +344,7 @@ run_test() { fi # shellcheck disable=SC1090 - source "$NAT_DIR/generated-configs/$SCENARIO/npubs.env" + source "$CONFIG_DIR/$SCENARIO/npubs.env" echo " NPUB_A=$NPUB_A" echo " NPUB_B=$NPUB_B"