@flisk-sh/flisk 0.0.0-stage → 1.3.190

package/engine/topologies/platform/docker/layers/prisma/secret_resolution.star

@@ -0,0 +1,121 @@
+# Copyright (c) 2026 Flisk Landscape contributors
+# SPDX-License-Identifier: MIT
+"""
+Secret Resolution Shell Fragment
+
+Generates the shell script block responsible for resolving DATABASE_URL at
+runtime.  Priority order:
+  1. Infisical API (when INFISICAL_TOKEN + INFISICAL_PROJECT_ID are present)
+  2. Individual DB_* env vars assembled into a connection string
+  3. Pre-injected DATABASE_URL (docker-compose / Tilt direct injection)
+
+Returns a plain string that is embedded verbatim inside migrate.sh.
+"""
+
+load('../../../../tilt/common/utils_debug.star', 'DEBUG_MODE')
+load(
+    './constants.star',
+    'DATABASE_URL_UNSET_CONDITION',
+    'DB_URL_COMPONENT_ENV_KEYS',
+    'DB_URL_FROM_COMPONENTS',
+    'DEFAULT_INFISICAL_URL',
+    'INFISICAL_SECRET_ENV_KEYS',
+)
+load('../../../../tilt/generators/infisical/path_manager.star', 'PathManager')
+
+
+def _export_secret_line(secret_key):
+    return (
+        "    export " + secret_key + "=$(echo \"$RESPONSE\" | jq -r --arg k \"" + secret_key + "\" "
+        + "'.secrets[] | select(.secretKey==$k) | .secretValue' || true)\n"
+    )
+
+
+def _infisical_export_block():
+    lines = []
+    for secret_key in INFISICAL_SECRET_ENV_KEYS:
+        lines.append(_export_secret_line(secret_key))
+    return "".join(lines)
+
+
+def _all_env_present_condition(env_keys):
+    checks = []
+    for env_key in env_keys:
+        checks.append("[ -n \"$" + env_key + "\" ]")
+    return " && ".join(checks)
+
+
+def _infisical_fetch_block(log_fetch, log_fetch_ok, log_fetch_fail):
+    """Build the Infisical curl block using Starlark path manager."""
+    else_block = ("  else\n" + log_fetch_fail + "  fi\n") if log_fetch_fail else "  fi\n"
+    # Use default database subpath from PathManager constants
+    default_secret_path = PathManager.RESOURCE_SUBPATHS[0] if PathManager.RESOURCE_SUBPATHS else ""
+    # Note: In shell, we use env var with fallback. The actual path resolution
+    # happens at runtime, but we document the Starlark-managed path convention here.
+    return (
+        "if [ -n \"$INFISICAL_TOKEN\" ] && [ -n \"$INFISICAL_PROJECT_ID\" ]; then\n"
+        + log_fetch
+        + "  INFISICAL_URL=\"${INFISICAL_API_URL:-${INFISICAL_URL:-" + DEFAULT_INFISICAL_URL + "}}\"\n"
+        + "  INFISICAL_ENV=\"${INFISICAL_ENVIRONMENT:-dev}\"\n"
+        + "  # Using Starlark-managed path: /services/$RESOURCE_NAME" + default_secret_path + "\n"
+        + "  SECRET_PATH=\"${INFISICAL_SECRET_PATH:-/services/$RESOURCE_NAME/database}\"\n"
+        + "  RESPONSE=$(curl -s -f -H \"Authorization: Bearer $INFISICAL_TOKEN\" "
+        + "\"${INFISICAL_URL}/api/v3/secrets/raw?environment=${INFISICAL_ENV}"
+        + "&workspaceId=${INFISICAL_PROJECT_ID}&secretPath=${SECRET_PATH}\") || true\n"
+        + "  if [ -n \"$RESPONSE\" ]; then\n"
+        + log_fetch_ok
+        + _infisical_export_block()
+        + else_block
+        + "fi\n"
+    )
+
+
+def _component_url_build_block(log_built):
+    """Build DATABASE_URL from individual DB_* parts when it is absent."""
+    components_ready = _all_env_present_condition(DB_URL_COMPONENT_ENV_KEYS)
+    return (
+        "# Build DATABASE_URL from components if not present\n"
+        + "if " + DATABASE_URL_UNSET_CONDITION + "; then\n"
+        + "  if " + components_ready + "; then\n"
+        + "    export DATABASE_URL=\"" + DB_URL_FROM_COMPONENTS + "\"\n"
+        + log_built
+        + "  fi\n"
+        + "fi\n"
+    )
+
+
+def _validate_url_block():
+    """Hard-fail when DATABASE_URL is still missing after all attempts."""
+    return (
+        "if " + DATABASE_URL_UNSET_CONDITION + "; then\n"
+        + "  echo \"\\u274c ERROR: DATABASE_URL is not set."
+        + " Set it via Infisical or environment variables.\"\n"
+        + "  exit 1\n"
+        + "fi\n"
+    )
+
+
+def secret_resolution_script():
+    """
+    Return the complete shell fragment that resolves DATABASE_URL.
+
+    Uses DEBUG_MODE to include/suppress verbose log lines.
+    """
+    if DEBUG_MODE:
+        log_fetch      = "  echo \"\\U0001f510 Fetching secrets from Infisical...\"\n"
+        log_fetch_ok   = "    echo \"\\u2705 Successfully fetched secrets from Infisical\"\n"
+        log_fetch_fail = "    echo \"\\u26a0\\ufe0f  Infisical did not return secrets (or not reachable)\"\n"
+        log_built      = "    echo \"\\U0001f511 Built DATABASE_URL from components\"\n"
+    else:
+        log_fetch = ""
+        log_fetch_ok = ""
+        log_fetch_fail = ""
+        log_built = ""
+
+    return (
+        _infisical_fetch_block(log_fetch, log_fetch_ok, log_fetch_fail)
+        + _component_url_build_block(log_built)
+        + _validate_url_block()
+    )
+
+DEBUG = {}

package/engine/topologies/platform/docker/networking/api_path_constants.star

@@ -0,0 +1,206 @@
+# Copyright (c) 2026 Flisk contributors
+# SPDX-License-Identifier: MIT
+# =============================================================================
+# 🌐 - API PATH CONSTANTS (Dynamic)
+# =============================================================================
+# API paths are generated dynamically from manifest stack and appName fields
+# No hardcoded resource names - all from service.json
+# =============================================================================
+
+
+
+# =============================================================================
+# API VERSION AND BASE PATH
+# =============================================================================
+
+# === INLINED CONSTANTS for pure extension loading ===
+HEALTH_CHECK_PATH = "/health"
+# === END INLINED CONSTANTS ===
+
+
+API_VERSION_V1 = "v1"
+API_BASE_PATH = "/api"
+
+# =============================================================================
+# DYNAMIC API PATH GENERATION
+# =============================================================================
+
+def generate_api_path(stack, app_name):
+    """Generate API path from manifest stack and appName.
+    
+    URL Restructuring: Changed from /api/v1/{app-name} to /api/{stack}-management
+    This provides clean separation between frontend and backend while removing version from path.
+    """
+    # NEW: Use /api/{stack}-management pattern
+    # Examples: /api/user-management, /api/order-management
+    return "/api/" + stack + "-management"
+
+# =============================================================================
+# HELPER FUNCTIONS
+# =============================================================================
+
+def _pluralize_stack(stack):
+    """Convert stack to proper plural form.
+    
+    Handles irregular plurals and special cases for platform stacks.
+    
+    Args:
+        stack: Singular stack name (e.g., "user", "order", "product")
+    
+    Returns:
+        str: Pluralized stack name (e.g., "users", "orders", "products")
+    """
+    # Already plural
+    if stack.endswith("s"):
+        return stack
+    
+    # Special cases - irregular plurals (common English patterns)
+    irregulars = {
+        "category": "categories",
+        "city": "cities",
+        "company": "companies",
+        "story": "stories",
+    }
+    
+    if stack in irregulars:
+        return irregulars[stack]
+    
+    # Words ending in 'y' (not preceded by a vowel) -> 'ies'
+    if stack.endswith("y") and len(stack) > 1 and stack[-2] not in "aeiou":
+        return stack[:-1] + "ies"
+    
+    # Words ending in 'ch', 'sh', 'ss', 'x', 'z', 'o' -> add 'es'
+    if stack.endswith(("ch", "sh", "ss", "x", "z", "o")):
+        return stack + "es"
+    
+    # Default: add 's'
+    return stack + "s"
+
+
+def get_api_path_for_stack(stack, manifest=None):
+    """Returns the full API path for a service stack.
+    
+    URL Restructuring: Changed from /api/v1/{stack}s to /api/{stack}-management
+    This aligns API paths with resource naming conventions.
+    
+    Args:
+        stack: Service stack name from manifest.json
+        manifest: Optional manifest dict that may contain 'apiPath' override
+    
+    Returns:
+        Full API path string (e.g., "/api/user-management")
+        Falls back to "/api/{stack}-management" if not found
+        Returns apiPath from manifest if explicitly specified
+    """
+    # Check for explicit apiPath override in manifest
+    if manifest and manifest.get("apiPath"):
+        return manifest.get("apiPath")
+    
+    # NEW: Use /api/{stack}-management pattern instead of /api/v1/{pluralized}
+    return "/api/" + stack + "-management"
+
+# Backwards compatibility alias
+get_api_path_for_domain = get_api_path_for_stack
+
+
+def get_frontend_base_path(manifest, res_name=None):
+    """Returns the public route a frontend is served under, e.g. "/floor-app".
+
+    Single source of truth. Three separate generators need this value and they
+    MUST agree, because they are three halves of one route:
+
+      - compose.star   -> the Traefik router rule and its stripprefix middleware
+      - vite/frontend  -> `base`, which prefixes every asset URL in index.html
+      - env.star       -> PUBLIC_URL
+
+    If they disagree the app still "starts" but serves a white page: Traefik
+    routes /a, index.html asks for /b/assets/*, and nothing answers. They used
+    to default to `stack + 's'`, `'/' + stack + 's'` and `'/' + stack`
+    respectively -- three different answers, one of which ("operations" + "s")
+    produced the nonsense route /operationss.
+
+    Defaults to the service name: it is unique per service (a stack with two
+    frontends would otherwise collide on one route) and it matches the URL
+    `flisk up` prints, so what the CLI advertises is what Traefik serves.
+    """
+    base_path = manifest.get('basePath') if manifest else None
+    if not base_path:
+        base_path = res_name or (manifest.get('appName') if manifest else None) or ''
+    if not base_path:
+        return ''
+    if not base_path.startswith('/'):
+        base_path = '/' + base_path
+    return base_path
+
+def get_api_path_for_resource(resource_name):
+    """Returns the full API path for a resource name.
+    
+    Args:
+        resource_name: Resource appName from manifest
+    
+    Returns:
+        Full API path string
+    """
+    # Extract stack from resource name using pattern matching
+    # No hardcoded resource names - all patterns derived from naming conventions
+    if "-management-backend" in resource_name:
+        stack = resource_name.replace("-management-backend", "")
+    elif "-management-frontend" in resource_name:
+        stack = resource_name.replace("-management-frontend", "")
+    elif "-planner-backend" in resource_name:
+        stack = resource_name.replace("-planner-backend", "")
+    elif "-planner-frontend" in resource_name:
+        stack = resource_name.replace("-planner-frontend", "")
+    elif "-backend" in resource_name:
+        stack = resource_name.replace("-backend", "")
+    elif "-frontend" in resource_name:
+        stack = resource_name.replace("-frontend", "")
+    else:
+        stack = resource_name
+    
+    return get_api_path_for_stack(stack)
+
+# Backwards compatibility alias
+get_api_path_for_service = get_api_path_for_resource
+
+# Load project name for dynamic localhost domain
+# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+def _load_project_localhost():
+    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_json_path = '.tdk/project.json'
+    if project_root:
+        project_json_path = project_root + '/' + project_json_path
+    
+    if os.path.exists(project_json_path):
+        _project_json = read_json(project_json_path)
+        return _project_json.get('project', {}).get('name', 'tdk-project') + ".localhost"
+    return "tdk-project.localhost"
+
+_PROJECT_LOCALHOST = _load_project_localhost()
+
+def build_traefik_url(api_path, host=None, scheme="http"):
+    """Builds full Traefik gateway URL from API path.
+
+    Args:
+        api_path: API path
+        host: Gateway host (default: {project}.localhost from project.json)
+        scheme: URL scheme (default: http)
+
+    Returns:
+        Full URL string
+    """
+    if host == None:
+        host = _PROJECT_LOCALHOST
+    return scheme + "://" + host + api_path
+
+def build_health_endpoint(api_path, health_path="/health"):
+    """Builds health check endpoint path from API path.
+    
+    Args:
+        api_path: API path
+        health_path: Health endpoint suffix (default: /health)
+    
+    Returns:
+        Full health endpoint path
+    """
+    return api_path + health_path

package/engine/topologies/platform/docker/networking/sablier_container_cycle.star

@@ -0,0 +1,31 @@
+# Copyright (c) 2026 Flisk Landscape contributors
+# SPDX-License-Identifier: MIT
+# =============================================================================
+# On-demand scaling: Sablier + Traefik (free-tier stub)
+# =============================================================================
+# Path: engine/topologies/platform/docker/networking/sablier_container_cycle.star
+# =============================================================================
+# The real generator (Sablier + Traefik label wiring that stops idle
+# containers and wakes them on the next request) is part of a paid Flisk
+# license. When a valid license grants the "sablier" resource,
+# cli/src/generator/template-engine.ts (vendorTdkExtension) overwrites this
+# file with the licensed version fetched via extension-fetch.ts before Tilt
+# loads it. Same function signatures either way, so nothing else in the
+# generator pipeline changes -- every call site just gets "disabled" back
+# for a manifest's `sablier` block until then.
+# =============================================================================
+
+
+def _sablier_config(_manifest):
+    """Free-tier stub - see module header. Always disabled."""
+    return False, "", ""
+
+
+def sablier_middleware_suffix(_manifest, _res_name):
+    """Free-tier stub - see module header. Always disabled."""
+    return "", False
+
+
+def sablier_container_labels(_manifest, _res_name, _indent):
+    """Free-tier stub - see module header. No labels to add."""
+    return ""

package/engine/topologies/platform/docker/networking/traefik.star

@@ -0,0 +1,266 @@
+# Copyright (c) 2026 Flisk Landscape contributors
+# SPDX-License-Identifier: MIT
+# =============================================================================
+# 🐳 TILT SDK - TRAEFIK LABELS GENERATOR
+# =============================================================================
+
+load(
+    "./traefik_constants.star",
+    "TRAEFIK_BACKEND_ENABLE_HTTP",
+    "TRAEFIK_BACKEND_ENABLE_HTTPS",
+    "TRAEFIK_PROJECT_HOST",
+    "TRAEFIK_PROJECT_API_HOST",
+    "TRAEFIK_DOCKER_NETWORK",
+    "TRAEFIK_ENABLE_LABEL",
+    "TRAEFIK_FRONTEND_ENABLE_HTTP",
+    "TRAEFIK_FRONTEND_ENABLE_HTTPS",
+    "TRAEFIK_FRONTEND_PRIORITY_BASE",
+    "TRAEFIK_MIDDLEWARE_SUFFIX",
+    "TRAEFIK_WEB_ENTRYPOINT",
+    "TRAEFIK_WEBSECURE_ENTRYPOINT",
+    "TRAEFIK_API_VERSION",
+    "TRAEFIK_HEALTHCHECK_INTERVAL",
+    "TRAEFIK_HEALTHCHECK_TIMEOUT",
+    "TRAEFIK_HEALTHCHECK_RETRIES",
+    "TRAEFIK_STARTUP_GRACE_PERIOD",
+    "TRAEFIK_API_BASE_PATH",
+)
+load("./traefik_helpers.star",
+    "backend_rule",
+    "build_entrypoints",
+    "cli_api_path",
+    "frontend_rule",
+    "get_api_path",
+    "project_backend_rule",
+)
+load("./sablier_container_cycle.star",
+    "sablier_middleware_suffix",
+    "sablier_container_labels",
+)
+
+
+def get_frontend_traefik_labels(res_name, domain, base_path, port, traefik_host=None, manifest=None):
+    """Generate Traefik labels for frontend services."""
+    # Priority based on path length ensures more specific paths win over broader ones
+    router_priority = TRAEFIK_FRONTEND_PRIORITY_BASE + len(base_path or "")
+    frontend_route_rule = frontend_rule(res_name, base_path, traefik_host)
+    frontend_entrypoints = build_entrypoints(
+        TRAEFIK_FRONTEND_ENABLE_HTTP,
+        TRAEFIK_FRONTEND_ENABLE_HTTPS,
+    )
+    middleware_name = res_name + TRAEFIK_MIDDLEWARE_SUFFIX
+    
+    # Check if maintenance feature is enabled
+    features = manifest.get('featuresEnabled', []) if manifest else []
+    maintenance_middleware = ""
+    if 'maintenance' in features:
+        maintenance_middleware = ",maintenance@file"
+
+    # On-demand scaling: attach the Sablier middleware when opted in via the manifest
+    sablier_middleware, sablier_enabled = sablier_middleware_suffix(manifest, res_name)
+
+    labels = """        - "{traefik_enable_label}"
+        - 'traefik.http.routers.{res_name}.rule={frontend_route_rule}'
+        - "traefik.http.routers.{res_name}.entrypoints={frontend_entrypoints}"
+        - "traefik.http.routers.{res_name}.priority={router_priority}"
+        - "traefik.http.routers.{res_name}.middlewares={middleware_name}{maintenance_middleware}{sablier_middleware}"
+        - "traefik.http.middlewares.{middleware_name}.stripprefix.prefixes={base_path}"
+        - "traefik.http.services.{res_name}.loadbalancer.server.port={port}"
+        - "traefik.docker.network={traefik_network}\"""".format(
+        res_name=res_name,
+        traefik_enable_label=TRAEFIK_ENABLE_LABEL,
+        frontend_route_rule=frontend_route_rule,
+        frontend_entrypoints=frontend_entrypoints,
+        middleware_name=middleware_name,
+        base_path=base_path,
+        port=port,
+        router_priority=router_priority,
+        traefik_network=TRAEFIK_DOCKER_NETWORK,
+        maintenance_middleware=maintenance_middleware,
+        sablier_middleware=sablier_middleware,
+    )
+
+    if sablier_enabled:
+        labels += sablier_container_labels(manifest, res_name, "        ")
+
+    return labels
+
+def _stack_is_shared(manifest):
+    """True when this backend shares its stack with another routable backend (`_stackBackendCount`, set by register_compose_resources).
+
+    The stack-scoped routers (the host/`pathPrefix` router and `<name>-management`) carry one rule per stack. With two backends in
+    one stack they would carry the same rule, so Traefik would pick between them arbitrarily. Each backend keeps its own
+    `<name>-project` router (`/api/<name>`).
+    """
+    return bool(manifest) and manifest.get('_stackBackendCount', 1) > 1
+
+
+def _explicit_backend_route(manifest):
+    """The `traefik.host` / `traefik.pathPrefix` a manifest set on purpose, as (host, path); either may be empty."""
+    traefik_cfg = (manifest.get('traefik') or {}) if manifest else {}
+    return traefik_cfg.get('host') or '', traefik_cfg.get('pathPrefix') or ''
+
+
+def get_backend_traefik_labels(
+    resource_entry_name,
+    traefik_host,
+    traefik_path,
+    traefik_resource_name,
+    internal_port,
+    health_path,
+    manifest=None,
+):
+    """Generate Traefik labels for backend services with enhanced health checks."""
+    backend_route_rule = backend_rule(traefik_host, traefik_path)
+    backend_entrypoints = build_entrypoints(
+        TRAEFIK_BACKEND_ENABLE_HTTP,
+        TRAEFIK_BACKEND_ENABLE_HTTPS,
+    )
+    middleware_name = resource_entry_name + TRAEFIK_MIDDLEWARE_SUFFIX
+    
+    # Check if maintenance feature is enabled
+    features = manifest.get('featuresEnabled', []) if manifest else []
+    maintenance_middleware = ""
+    if 'maintenance' in features:
+        maintenance_middleware = ",maintenance@file"
+
+    # On-demand scaling: attach the Sablier middleware when opted in via the manifest
+    sablier_middleware, sablier_enabled = sablier_middleware_suffix(manifest, resource_entry_name)
+
+    # Build middleware config only if traefik_path is not empty
+    if traefik_path:
+        middleware_config_lines = [
+            '      - "traefik.http.routers.' + resource_entry_name + '.middlewares=' + middleware_name + maintenance_middleware + sablier_middleware + '"',
+            '      - "traefik.http.middlewares.' + middleware_name + '.stripprefix.prefixes=' + traefik_path + '"',
+        ]
+        middleware_config = "\n".join(middleware_config_lines)
+    elif sablier_middleware:
+        # No strip-prefix path, but still front the router with the Sablier middleware
+        middleware_config = '      - "traefik.http.routers.' + resource_entry_name + '.middlewares=' + sablier_middleware.lstrip(",") + '"'
+    else:
+        # No middleware if path is empty - router has no middlewares
+        middleware_config = ""
+
+    stack_shared = _stack_is_shared(manifest)
+    explicit_host, explicit_path = _explicit_backend_route(manifest)
+    if stack_shared:
+        # Another backend in this stack would match the same stack rule, so it is not emitted. The service labels stay (the
+        # -project router points at the service). A manifest that set its own host or pathPrefix keeps a router, but one whose
+        # rule is only what it set, never the shared stack host or path.
+        backend_route_rule = backend_rule(explicit_host, explicit_path)
+
+    if stack_shared and not backend_route_rule:
+        backend_router_labels = ""
+    else:
+        backend_router_labels = """      - "traefik.http.routers.{resource_entry_name}.rule={backend_route_rule}"
+      - "traefik.http.routers.{resource_entry_name}.entrypoints={backend_entrypoints}"
+      - "traefik.http.routers.{resource_entry_name}.service={traefik_resource_name}"
+{middleware_config}
+""".format(
+            resource_entry_name=resource_entry_name,
+            backend_route_rule=backend_route_rule,
+            backend_entrypoints=backend_entrypoints,
+            traefik_resource_name=traefik_resource_name,
+            middleware_config=middleware_config,
+        )
+
+    # No health path (a bring-your-own service that does not speak HTTP): Traefik balances without an active HTTP probe rather than
+    # probing a path the service never serves.
+    traefik_healthcheck_labels = ""
+    if health_path:
+        traefik_healthcheck_labels = """      - "traefik.http.services.{traefik_resource_name}.loadbalancer.healthcheck.path={health_path}"
+      - "traefik.http.services.{traefik_resource_name}.loadbalancer.healthcheck.interval={health_interval}"
+      - "traefik.http.services.{traefik_resource_name}.loadbalancer.healthcheck.timeout={health_timeout}"
+      - "traefik.http.services.{traefik_resource_name}.loadbalancer.healthcheck.followredirects=false"
+""".format(
+            traefik_resource_name=traefik_resource_name,
+            health_path=health_path,
+            health_interval=TRAEFIK_HEALTHCHECK_INTERVAL,
+            health_timeout=TRAEFIK_HEALTHCHECK_TIMEOUT,
+        )
+
+    labels = """      - "{traefik_enable_label}"
+{backend_router_labels}      - "traefik.http.services.{traefik_resource_name}.loadbalancer.server.port={internal_port}"
+{traefik_healthcheck_labels}      - "traefik.docker.network={traefik_network}"
+""".format(
+        resource_entry_name=resource_entry_name,
+        traefik_enable_label=TRAEFIK_ENABLE_LABEL,
+        backend_router_labels=backend_router_labels,
+        traefik_resource_name=traefik_resource_name,
+        internal_port=internal_port,
+        traefik_healthcheck_labels=traefik_healthcheck_labels,
+        traefik_network=TRAEFIK_DOCKER_NETWORK,
+    )
+
+    # Emit Sablier discovery labels so the Sablier container can wake/stop this workload
+    if sablier_enabled:
+        labels += sablier_container_labels(manifest, resource_entry_name, "      ")
+
+    # Generate project localhost routing to match `flisk up` URLs:
+    # http://api.{project}.localhost/api/{resource-name}
+    if manifest:
+        stack = manifest.get("stack", "")
+        api_path = cli_api_path(resource_entry_name, manifest)
+        project_rule = project_backend_rule(manifest, resource_entry_name)
+        project_entrypoints = build_entrypoints(
+            TRAEFIK_BACKEND_ENABLE_HTTP,
+            TRAEFIK_BACKEND_ENABLE_HTTPS,
+        )
+        # Calculate priority based on path length (more specific = higher priority)
+        router_priority = TRAEFIK_FRONTEND_PRIORITY_BASE + len(api_path)
+
+        # Generate old path pattern for redirect (e.g., /{stack}-management/api/v1/)
+        old_path_pattern = "/{stack}-management/api/v1".format(stack=stack) if stack else ""
+        management_path = get_api_path(stack, manifest) if stack else ""
+
+        labels += """
+      - "traefik.http.routers.{resource_entry_name}-project.rule={project_rule}"
+      - "traefik.http.routers.{resource_entry_name}-project.entrypoints={project_entrypoints}"
+      - "traefik.http.routers.{resource_entry_name}-project.service={traefik_resource_name}"
+      - "traefik.http.routers.{resource_entry_name}-project.middlewares={middleware_name}-project{maintenance_middleware}{sablier_middleware}"
+      - "traefik.http.middlewares.{middleware_name}-project.stripprefix.prefixes={api_path}"
+      - "traefik.http.routers.{resource_entry_name}-project.priority={router_priority}"
+""".format(
+            resource_entry_name=resource_entry_name,
+            traefik_resource_name=traefik_resource_name,
+            project_rule=project_rule,
+            project_entrypoints=project_entrypoints,
+            middleware_name=middleware_name,
+            maintenance_middleware=maintenance_middleware,
+            sablier_middleware=sablier_middleware,
+            api_path=api_path,
+            router_priority=router_priority,
+        )
+
+        if management_path and management_path != api_path and not stack_shared:
+            labels += """
+      - "traefik.http.routers.{resource_entry_name}-management.rule=Host(`{api_host}`) && PathPrefix(`{management_path}`)"
+      - "traefik.http.routers.{resource_entry_name}-management.entrypoints={project_entrypoints}"
+      - "traefik.http.routers.{resource_entry_name}-management.service={traefik_resource_name}"
+      - "traefik.http.routers.{resource_entry_name}-management.middlewares={middleware_name}-management{sablier_middleware}"
+      - "traefik.http.middlewares.{middleware_name}-management.stripprefix.prefixes={management_path}"
+      - "traefik.http.routers.{resource_entry_name}-management.priority={mgmt_priority}"
+""".format(
+                resource_entry_name=resource_entry_name,
+                traefik_resource_name=traefik_resource_name,
+                api_host=TRAEFIK_PROJECT_API_HOST,
+                management_path=management_path,
+                project_entrypoints=project_entrypoints,
+                middleware_name=middleware_name,
+                sablier_middleware=sablier_middleware,
+                mgmt_priority=TRAEFIK_FRONTEND_PRIORITY_BASE + len(management_path),
+            )
+
+        if old_path_pattern:
+            labels += """
+      # Redirect middleware for URL restructuring: old path -> new path
+      - "traefik.http.middlewares.{resource_entry_name}-redirect.redirectregex.regex=^`{old_path_pattern}/(.*)`"
+      - "traefik.http.middlewares.{resource_entry_name}-redirect.redirectregex.replacement=`{api_path}/$$1`"
+      - "traefik.http.middlewares.{resource_entry_name}-redirect.redirectregex.permanent=true"
+""".format(
+                resource_entry_name=resource_entry_name,
+                old_path_pattern=old_path_pattern,
+                api_path=api_path,
+            )
+
+    return labels