@tdk-landscape/tdk-cli-core 1.3.121 → 1.3.123

package/cli/dist/utils/service-config-checks.js

@@ -0,0 +1,188 @@
+import { relative } from "node:path";
+import chalk from "chalk";
+import { checkDuplicateResourceNames } from "./doctor-wiring.js";
+import { formatCount } from "./formatting.js";
+import { findProjectRoot } from "./paths.js";
+import { SERVICE_MANIFEST_SCHEMA_VERSION } from "./service-manifest.js";
+import { discoverResourcesFromRoot } from "./services.js";
+function filePath(projectRoot, resource) {
+    return relative(projectRoot, resource.configPath) || resource.configPath;
+}
+/** The dependsOn names a service declares: none when absent, null when it is not an array of strings. */
+function declaredDependsOn(resource) {
+    const value = resource.config?.dependsOn;
+    if (value === undefined)
+        return [];
+    if (Array.isArray(value) && value.every((entry) => typeof entry === "string"))
+        return value;
+    return null;
+}
+/** Each cycle once, as service names starting from the alphabetically first, ending where it started. */
+function findDependencyCycles(resources) {
+    const known = new Set(resources.map((r) => r.name));
+    const edges = new Map(resources.map((r) => [r.name, (declaredDependsOn(r) ?? []).filter((dep) => known.has(dep))]));
+    const cycles = new Map();
+    const state = new Map();
+    const stack = [];
+    const visit = (name) => {
+        state.set(name, "visiting");
+        stack.push(name);
+        for (const dep of edges.get(name) ?? []) {
+            if (state.get(dep) === "visiting") {
+                const loop = stack.slice(stack.indexOf(dep));
+                const start = loop.indexOf([...loop].sort()[0] ?? dep);
+                const ordered = [...loop.slice(start), ...loop.slice(0, start)];
+                cycles.set(ordered.join(">"), [...ordered, ordered[0] ?? dep]);
+            }
+            else if (!state.has(dep)) {
+                visit(dep);
+            }
+        }
+        stack.pop();
+        state.set(name, "done");
+    };
+    for (const name of [...edges.keys()].sort()) {
+        if (!state.has(name))
+            visit(name);
+    }
+    return [...cycles.values()];
+}
+/** A dependsOn that is not a list of service names cannot be followed, so say so instead of failing later. */
+export function checkDependsOnShape(projectRoot = findProjectRoot() ?? process.cwd()) {
+    const problems = discoverResourcesFromRoot(projectRoot).flatMap((resource) => declaredDependsOn(resource) === null
+        ? [
+            `${filePath(projectRoot, resource)} dependsOn ${JSON.stringify(resource.config?.dependsOn)}: expected an array of service names`,
+        ]
+        : []);
+    if (problems.length === 0) {
+        return {
+            name: "dependsOn",
+            didPass: true,
+            message: "Every dependsOn is a list of service names",
+        };
+    }
+    return {
+        name: "dependsOn",
+        didPass: false,
+        message: `${formatCount(problems.length, "invalid dependsOn", "invalid dependsOn")}:\n    ${problems.join("\n    ")}`,
+        fix: 'Write "dependsOn" as an array of service names, for example ["postgres", "api"]',
+    };
+}
+/** Services that wait on each other can never both start. A dependsOn name that is not a service is left to the unknown-name check. */
+export function checkCircularDependencies(projectRoot = findProjectRoot() ?? process.cwd()) {
+    const resources = discoverResourcesFromRoot(projectRoot);
+    const byName = new Map(resources.map((r) => [r.name, r]));
+    const cycles = findDependencyCycles(resources);
+    if (cycles.length === 0) {
+        return {
+            name: "Circular dependencies",
+            didPass: true,
+            message: "No service depends on itself through dependsOn",
+        };
+    }
+    const lines = cycles.map((cycle) => {
+        const first = byName.get(cycle[0] ?? "");
+        const next = cycle[1] ?? "";
+        return `${first ? filePath(projectRoot, first) : cycle[0]} dependsOn "${next}": circular dependency ${cycle.join(" -> ")}`;
+    });
+    return {
+        name: "Circular dependencies",
+        didPass: false,
+        message: `${cycles.length} ${cycles.length === 1 ? "circular dependency" : "circular dependencies"}:\n    ${lines.join("\n    ")}`,
+        fix: 'Remove one "dependsOn" entry in each cycle so the services no longer wait on each other, or move what they share into a third service',
+    };
+}
+/** A port outside 1-65535 can never be bound, and `tdk up` would otherwise find out only when Docker fails. */
+export function checkServicePorts(projectRoot = findProjectRoot() ?? process.cwd()) {
+    const problems = discoverResourcesFromRoot(projectRoot).flatMap((resource) => {
+        const port = resource.config?.port;
+        if (port === undefined)
+            return [];
+        if (typeof port === "number" && Number.isInteger(port) && port >= 1 && port <= 65535)
+            return [];
+        return [
+            `${filePath(projectRoot, resource)} port ${JSON.stringify(port)}: not an integer from 1 to 65535`,
+        ];
+    });
+    if (problems.length === 0) {
+        return { name: "Service ports", didPass: true, message: "Every declared port is valid" };
+    }
+    return {
+        name: "Service ports",
+        didPass: false,
+        message: `${formatCount(problems.length, "invalid port")}:\n    ${problems.join("\n    ")}`,
+        fix: 'Set "port" to the port the service listens on, an integer from 1 to 65535',
+    };
+}
+/**
+ * A service.json with no schemaVersion is how every project began, so this is a warning: it keeps working, and only
+ * `tdk config migrate` writes the field. A version this tdk does not know is reported the same way, with a different fix.
+ */
+export function checkSchemaVersions(projectRoot = findProjectRoot() ?? process.cwd(), strict = false) {
+    const missing = [];
+    const unsupported = [];
+    for (const resource of discoverResourcesFromRoot(projectRoot)) {
+        const version = resource.config?.schemaVersion;
+        if (version === SERVICE_MANIFEST_SCHEMA_VERSION)
+            continue;
+        const file = filePath(projectRoot, resource);
+        if (version === undefined)
+            missing.push(`${file} schemaVersion: missing`);
+        else
+            unsupported.push(`${file} schemaVersion ${JSON.stringify(version)}: this tdk supports ${SERVICE_MANIFEST_SCHEMA_VERSION}`);
+    }
+    if (missing.length === 0 && unsupported.length === 0) {
+        return {
+            name: "schemaVersion",
+            didPass: true,
+            message: "Every service.json has a supported schemaVersion",
+        };
+    }
+    const fixes = [
+        ...(missing.length > 0 ? ["Run `tdk config migrate` to add the missing schemaVersion"] : []),
+        ...(unsupported.length > 0
+            ? ["A version this tdk does not support cannot be migrated: upgrade tdk"]
+            : []),
+    ];
+    return {
+        name: "schemaVersion",
+        didPass: false,
+        isWarning: !strict,
+        message: `${formatCount(missing.length + unsupported.length, "service.json file")} without a supported schemaVersion:\n    ${[...missing, ...unsupported].join("\n    ")}`,
+        fix: fixes.join(". "),
+    };
+}
+/** Prints the schemaVersion warning once. It never stops anything: the project keeps working as it is. */
+export function warnSchemaVersions(projectRoot) {
+    const check = checkSchemaVersions(projectRoot);
+    if (check.didPass)
+        return;
+    console.warn(chalk.yellow(`⚠ ${check.message}`));
+    if (check.fix)
+        console.warn(chalk.gray(`  ${check.fix}`));
+}
+/**
+ * Runs before anything starts (also under --dry-run, like the drift gate): duplicate service names, circular
+ * dependsOn and invalid ports exit with 1 and say which file, which field, and how to fix it.
+ */
+export function enforceServiceConfigGate(projectRoot, options = {}, exit = process.exit) {
+    const failed = [
+        checkDuplicateResourceNames(projectRoot),
+        checkDependsOnShape(projectRoot),
+        checkCircularDependencies(projectRoot),
+        checkServicePorts(projectRoot),
+    ].filter((check) => !check.didPass);
+    if (failed.length === 0)
+        return;
+    const text = failed
+        .map((check) => `${check.message}${check.fix ? `\nFix: ${check.fix}` : ""}`)
+        .join("\n");
+    options.onInvalid?.(text);
+    for (const check of failed) {
+        console.error(chalk.red(`✗ ${check.message}`));
+        if (check.fix)
+            console.error(chalk.gray(`  Fix: ${check.fix}`));
+    }
+    exit(1);
+}
+//# sourceMappingURL=service-config-checks.js.map

package/cli/dist/utils/startup-report.js

@@ -1,4 +1,5 @@
 import { parseTiltResourceFailures, summarizeTiltBuildError } from "./doctor-runtime.js";
+import { portConflictFix } from "./port-conflict-fix.js";
 import { isTiltResourcePending } from "./tilt-resource-state.js";
 import { onlyEnabledResources } from "./up-readiness.js";
 export function transitiveDependencies(name, dependsOn) {
@@ -52,8 +53,12 @@ export function isStartupStalled(jsonText, dependsOn, deferred = new Set()) {
 }
 export function formatStartupReport(report, timedOut) {
     const lines = [];
-    for (const { name, message } of report.failed)
+    for (const { name, message } of report.failed) {
         lines.push(`✗ ${name} failed: ${message}`);
+        const fix = portConflictFix(message);
+        if (fix)
+            lines.push(`  ${fix}`);
+    }
     for (const { name, because } of report.blocked) {
         lines.push(`✗ ${name} is not ready because ${because.join(", ")} failed`);
     }

package/cli/dist/utils/tilt-events.js

@@ -0,0 +1,195 @@
+import { STANDARD_PORTS } from "./constants.js";
+import { runTilt } from "./tilt.js";
+export class TiltEventsLoadError extends Error {
+    kind;
+    constructor(message, kind) {
+        super(message);
+        this.kind = kind;
+        this.name = "TiltEventsLoadError";
+    }
+}
+function asRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : null;
+}
+// Tilt-controlled text is rendered in the terminal, so drop ANSI/OSC escape sequences and
+// other control characters (keeping tab/newline for later whitespace normalization).
+const ESC = String.fromCharCode(0x1b);
+const BEL = String.fromCharCode(0x07);
+const ANSI_SEQUENCE = new RegExp(`${ESC}(?:\\[[0-?]*[ -/]*[@-~]|\\][^${BEL}${ESC}]*(?:${BEL}|${ESC}\\\\)?|[@-Z\\\\-_])`, "g");
+// A regex literal would trip noControlCharactersInRegex, so this stays a string; keep the autofix from rewriting it.
+// biome-ignore lint/complexity/useRegexLiterals: the control-character range must stay in a string
+const CONTROL_CHARS = new RegExp("[\\u0000-\\u0008\\u000b-\\u001f\\u007f-\\u009f]", "g");
+export function stripTerminalControls(value) {
+    return value.replace(ANSI_SEQUENCE, "").replace(CONTROL_CHARS, "");
+}
+function readString(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const cleaned = stripTerminalControls(value).trim();
+    return cleaned || undefined;
+}
+function readStringArray(value) {
+    return Array.isArray(value)
+        ? value.flatMap((item) => {
+            const cleaned = readString(item);
+            return cleaned ? [cleaned] : [];
+        })
+        : [];
+}
+export function parseTiltUiResourceList(value) {
+    const list = asRecord(value);
+    if (!list || !Array.isArray(list.items)) {
+        throw new Error("Tilt returned an invalid UIResource list");
+    }
+    const resources = [];
+    const events = [];
+    for (const value of list.items) {
+        const item = asRecord(value);
+        const metadata = asRecord(item?.metadata);
+        const resourceName = readString(metadata?.name);
+        if (!item || !resourceName)
+            continue;
+        const status = asRecord(item.status);
+        resources.push({
+            name: resourceName,
+            runtimeStatus: readString(status?.runtimeStatus),
+            updateStatus: readString(status?.updateStatus),
+            hasPendingChanges: typeof status?.hasPendingChanges === "boolean" ? status.hasPendingChanges : undefined,
+        });
+        const history = Array.isArray(status?.buildHistory) ? status.buildHistory : [];
+        for (const [buildIndex, value] of history.entries()) {
+            const build = asRecord(value);
+            if (!build)
+                continue;
+            const error = readString(build.error);
+            const warnings = readStringArray(build.warnings);
+            const details = [error, ...warnings].filter((entry) => Boolean(entry));
+            const spanId = readString(build.spanID);
+            events.push({
+                id: `${resourceName}:build:${spanId ?? String(buildIndex)}`,
+                resourceName,
+                kind: error ? "failed" : warnings.length ? "warning" : "success",
+                title: error
+                    ? "Build failed"
+                    : warnings.length
+                        ? "Build completed with warnings"
+                        : "Build completed",
+                occurredAt: readString(build.finishTime) ?? readString(build.startTime),
+                details: details.length ? details.join("; ") : undefined,
+            });
+        }
+        const currentBuild = asRecord(status?.currentBuild);
+        if (currentBuild) {
+            events.push({
+                id: `${resourceName}:current-build`,
+                resourceName,
+                kind: "running",
+                title: "Build in progress",
+                occurredAt: readString(currentBuild.startTime),
+            });
+        }
+        const pendingSince = readString(status?.pendingBuildSince);
+        if (!currentBuild && (status?.queued === true || pendingSince)) {
+            events.push({
+                id: `${resourceName}:queued`,
+                resourceName,
+                kind: "warning",
+                title: "Update queued",
+                occurredAt: pendingSince,
+            });
+        }
+        const lastDeployTime = readString(status?.lastDeployTime);
+        const deployTimestamp = lastDeployTime ? Date.parse(lastDeployTime) : Number.NaN;
+        const matchingBuild = events.some((event) => event.resourceName === resourceName &&
+            event.kind === "success" &&
+            event.occurredAt !== undefined &&
+            Date.parse(event.occurredAt) === deployTimestamp);
+        if (lastDeployTime && !matchingBuild) {
+            events.push({
+                id: `${resourceName}:last-deploy`,
+                resourceName,
+                kind: "success",
+                title: "Last deployed",
+                occurredAt: lastDeployTime,
+            });
+        }
+        const conditions = Array.isArray(status?.conditions) ? status.conditions : [];
+        for (const [conditionIndex, value] of conditions.entries()) {
+            const condition = asRecord(value);
+            if (!condition)
+                continue;
+            const type = readString(condition.type);
+            const state = readString(condition.status);
+            const reason = readString(condition.reason);
+            const message = readString(condition.message);
+            if ((!type && !reason && !message) || (state === "True" && !reason && !message))
+                continue;
+            const detail = [reason, message]
+                .filter((entry) => Boolean(entry))
+                .join(": ");
+            events.push({
+                id: `${resourceName}:condition:${conditionIndex}:${type ?? "status"}`,
+                resourceName,
+                kind: state === "False" ? "warning" : "status",
+                title: `Condition ${type ?? "status"}${state ? `: ${state}` : ""}`,
+                occurredAt: readString(condition.lastTransitionTime),
+                details: detail || undefined,
+            });
+        }
+    }
+    events.sort((left, right) => {
+        if (left.kind === "running" && right.kind !== "running")
+            return -1;
+        if (right.kind === "running" && left.kind !== "running")
+            return 1;
+        const leftTime = left.occurredAt ? Date.parse(left.occurredAt) : Number.NaN;
+        const rightTime = right.occurredAt ? Date.parse(right.occurredAt) : Number.NaN;
+        if (Number.isNaN(leftTime)) {
+            return Number.isNaN(rightTime) ? left.resourceName.localeCompare(right.resourceName) : 1;
+        }
+        if (Number.isNaN(rightTime))
+            return -1;
+        return rightTime - leftTime;
+    });
+    return { resources, events };
+}
+export async function loadTiltEvents() {
+    const port = process.env.TILT_PORT ?? String(STANDARD_PORTS.tiltUi);
+    let result;
+    try {
+        result = await runTilt("get", ["uiresources", "-o", "json", "--port", port], {
+            inheritStdio: false,
+            timeoutMs: 10_000,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const kind = /ENOENT|not found|no such file|connection refused|failed to connect|could not connect|unable to connect|Tilt is not running/i.test(message)
+            ? "unavailable"
+            : "error";
+        throw new TiltEventsLoadError(message, kind);
+    }
+    if (result.exitCode !== 0) {
+        const message = result.stderr.trim() || `tilt get exited with code ${result.exitCode}`;
+        const kind = /connection refused|failed to connect|could not connect|unable to connect|Tilt is not running|no running Tilt/i.test(message)
+            ? "unavailable"
+            : "error";
+        throw new TiltEventsLoadError(message, kind);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(result.stdout);
+    }
+    catch {
+        throw new TiltEventsLoadError("Tilt returned invalid UIResource JSON", "error");
+    }
+    try {
+        return parseTiltUiResourceList(parsed);
+    }
+    catch (error) {
+        throw new TiltEventsLoadError(error instanceof Error ? error.message : "Tilt returned an invalid UIResource list", "error");
+    }
+}
+//# sourceMappingURL=tilt-events.js.map

package/cli/dist/utils/tilt-unreachable-message.js

@@ -0,0 +1,8 @@
+/**
+ * What `tdk logs` says when no Tilt answers on the port. The usual cause is that the stack is not up, so the message
+ * names the command that starts it; Tilt's own connection error is not repeated, because it only restates that.
+ */
+export function tiltUnreachableMessage(port) {
+    return `Could not reach Tilt on port ${port}. The stack is not running, or Tilt is on another port. Start it with: tdk up`;
+}
+//# sourceMappingURL=tilt-unreachable-message.js.map

package/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tdk-cli-internal",
   "private": true,
-  "version": "1.3.121",
+  "version": "1.3.123",
   "description": "TDK CLI — start services on your laptop.",
   "keywords": [
     "tdk",

package/cli/templates/TILT_TECH_STACK.star.hbs

@@ -69,15 +69,15 @@ def validate_tech_stack(config, strict=False):
                     ))
                 elif strict:
                     errors.append(
-                        "❌ Tech Stack Error: {}: '{}' is not supported. " +
-                        "Platform standard is '{}'. Use _override_reason to document exceptions.".format(
+                        ("❌ Tech Stack Error: {}: '{}' is not supported. " +
+                        "Platform standard is '{}'. Use _override_reason to document exceptions.").format(
                             key, value, standard
                         )
                     )
                 else:
                     warnings.append(
-                        "⚠️ Tech Stack Warning: {}: '{}' is not standard. " +
-                        "Platform standard is '{}'.".format(key, value, standard)
+                        ("⚠️ Tech Stack Warning: {}: '{}' is not standard. " +
+                        "Platform standard is '{}'.").format(key, value, standard)
                     )
     
     # Optional validations (warnings if missing or different)

package/engine/topologies/platform/docker/compose/compose.star

@@ -450,79 +450,6 @@ def _generate_port_anchors(resource_entries):
     return "\n".join(anchors)
 
 
-def _detect_sdk_in_entries(resource_entries):
-    """Check if any entry is an SDK."""
-    for entry in resource_entries:
-        if "-sdk:" in entry or entry.strip().startswith("identity-sdk:"):
-            return True
-    return False
-
-def _detect_frontend_in_entries(resource_entries):
-    """Check if any entry is a frontend."""
-    for entry in resource_entries:
-        if "<<: *frontend-memory-limit" in entry:
-            return True
-    return False
-
-def _detect_backend_in_entries(resource_entries):
-    """Check if any entry is a backend."""
-    for entry in resource_entries:
-        if _is_backend_entry(entry):
-            return True
-    return False
-
-def _is_sdk_entry(entry):
-    """Check if a specific entry is an SDK."""
-    return "-sdk:" in entry or entry.strip().startswith("identity-sdk:")
-
-def _is_backend_entry(entry):
-    """Check if a specific entry is a backend (not frontend, not SDK)."""
-    if "-sdk:" in entry or entry.strip().startswith("identity-sdk:"):
-        return False
-    if "<<: *frontend-memory-limit" in entry:
-        return False
-    # Backend entries have healthcheck with backend port pattern
-    if "healthcheck:" in entry and "curl" in entry:
-        return True
-    return False
-
-def _replace_ports_with_anchors(entry, has_sdk=False, has_frontend=False, has_backend=False):
-    """Replace hardcoded ports with YAML anchors in an entry."""
-    is_sdk = _is_sdk_entry(entry)
-    is_backend = _is_backend_entry(entry)
-    lines = entry.split("\n")
-    result = []
-
-    for line in lines:
-        new_line = line
-        # NOTE: We do NOT replace PORT=3000 with an anchor because YAML anchors
-        # in environment variable values are treated as literal strings, not resolved.
-        # The actual port value is already correctly set by _generate_single_backend_entry
-        # using the internal_port variable. Keep PORT=3000 as-is.
-
-        # YAML anchors do not resolve inside quoted Docker labels. Traefik must
-        # see a numeric loadbalancer.port (e.g. 4000), not `*backend-port`.
-        # NOTE: We do NOT replace healthcheck URLs with YAML anchors because anchors
-        # don't work inside quoted strings. The wget healthcheck URLs must use actual
-        # port numbers (e.g., http://127.0.0.1:3000), not anchor references.
-        # The correct port is already set by generate_frontend_compose.
-        # NOTE: We do NOT replace healthcheck URLs with anchors because YAML anchors
-        # don't work inside quoted strings. The healthcheck URL must use the actual
-        # port number (e.g., http://localhost:3000/health), not an anchor reference.
-        # The _generate_single_backend_entry function already uses the correct port
-        # via the internal_port variable in the healthcheck URL.
-
-        result.append(new_line)
-
-    return "\n".join(result)
-
-def _process_entries_with_anchors(resource_entries, has_sdk, has_frontend, has_backend):
-    """Replace ports with anchors in all entries."""
-    result = []
-    for entry in resource_entries:
-        result.append(_replace_ports_with_anchors(entry, has_sdk, has_frontend, has_backend))
-    return result
-
 def generate_app_compose_from_entries(resource_path, resource_entries, write_fn=None):
     """Generate docker-compose.app.autogenerated.yml from service entries with port anchors.
 
@@ -535,14 +462,6 @@ def generate_app_compose_from_entries(resource_path, resource_entries, write_fn=
         str: Generated docker-compose YAML content
     """
 
-    # Detect service types
-    has_sdk = _detect_sdk_in_entries(resource_entries)
-    has_frontend = _detect_frontend_in_entries(resource_entries)
-    has_backend = _detect_backend_in_entries(resource_entries)
-
-    # Replace ports with anchors in entries
-    processed_entries = _process_entries_with_anchors(resource_entries, has_sdk, has_frontend, has_backend)
-
     # Generate port anchors
     port_anchors = _generate_port_anchors(resource_entries)
 
@@ -598,15 +517,11 @@ networks:
         network_infisical=PlatformDockerConstants.NETWORK_INFISICAL,
     )
 
-    content = header + "\n".join(processed_entries) + footer
+    content = header + "\n".join(resource_entries) + footer
 
     if write_fn:
         compose_path = resource_path + '/' + OUTPUT.AUTOGENERATED_FOLDER + '/docker-compose.app.autogenerated.yml'
-        print("DEBUG COMPOSE GEN: Writing {} bytes to {}".format(len(content), compose_path))
         write_fn(compose_path, content)
-        print("DEBUG COMPOSE GEN: Write completed")
-    else:
-        print("DEBUG COMPOSE GEN: No write_fn provided!")
 
     return content
 

package/engine/topologies/platform/docker/compose/traefik_standalone.star

@@ -10,7 +10,7 @@ load("../config/healthcheck.star", "compose_healthcheck_timing")
 load("../networking/traefik_static_routes.star", "normalize_abs_path")
 
 
-def generate_standalone_traefik_compose(sablier_enabled = False, http_host_port = "8080", https_host_port = "8443"):
+def generate_standalone_traefik_compose(sablier_enabled = False, http_host_port = "8080", https_host_port = "8443", bind_address = "127.0.0.1"):
     """Minimal Traefik that routes Docker labels on api.{project}.localhost.
 
     The Sablier plugin, the sablier container and the wake gateway are only
@@ -31,7 +31,6 @@ services:
     container_name: {name}_traefik
     restart: unless-stopped
 {traefik_depends_on}    command:
-      - "--api.insecure=true"
       - "--ping=true"
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
@@ -48,8 +47,8 @@ services:
       - "--entrypoints.websecure.address=:443"
       - "--log.level=INFO"
 {sablier_flags}    ports:
-      - "{http_host_port}:80"
-      - "{https_host_port}:443"
+      - "{bind_address}:{http_host_port}:80"
+      - "{bind_address}:{https_host_port}:443"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - ./{dynamic_dir_name}:/etc/traefik/dynamic:ro
@@ -67,6 +66,7 @@ services:
         network=network,
         http_host_port=http_host_port,
         https_host_port=https_host_port,
+        bind_address=bind_address,
         healthcheck_timing=compose_healthcheck_timing(10),
         traefik_depends_on=_SABLIER_DEPENDS_ON if sablier_enabled else "",
         sablier_flags=_SABLIER_FLAGS if sablier_enabled else "",

package/engine/topologies/platform/docker/networking/traefik.star

@@ -83,6 +83,22 @@ def get_frontend_traefik_labels(res_name, domain, base_path, port, traefik_host=
 
     return labels
 
+def _stack_is_shared(manifest):
+    """True when this backend shares its stack with another routable backend (`_stackBackendCount`, set by register_compose_resources).
+
+    The stack-scoped routers (the host/`pathPrefix` router and `<name>-management`) carry one rule per stack. With two backends in
+    one stack they would carry the same rule, so Traefik would pick between them arbitrarily. Each backend keeps its own
+    `<name>-project` router (`/api/<name>`).
+    """
+    return bool(manifest) and manifest.get('_stackBackendCount', 1) > 1
+
+
+def _explicit_backend_route(manifest):
+    """The `traefik.host` / `traefik.pathPrefix` a manifest set on purpose, as (host, path); either may be empty."""
+    traefik_cfg = (manifest.get('traefik') or {}) if manifest else {}
+    return traefik_cfg.get('host') or '', traefik_cfg.get('pathPrefix') or ''
+
+
 def get_backend_traefik_labels(
     resource_entry_name,
     traefik_host,
@@ -123,12 +139,31 @@ def get_backend_traefik_labels(
         # No middleware if path is empty - router has no middlewares
         middleware_config = ""
 
-    labels = """      - "{traefik_enable_label}"
-      - "traefik.http.routers.{resource_entry_name}.rule={backend_route_rule}"
+    stack_shared = _stack_is_shared(manifest)
+    explicit_host, explicit_path = _explicit_backend_route(manifest)
+    if stack_shared:
+        # Another backend in this stack would match the same stack rule, so it is not emitted. The service labels stay (the
+        # -project router points at the service). A manifest that set its own host or pathPrefix keeps a router, but one whose
+        # rule is only what it set, never the shared stack host or path.
+        backend_route_rule = backend_rule(explicit_host, explicit_path)
+
+    if stack_shared and not backend_route_rule:
+        backend_router_labels = ""
+    else:
+        backend_router_labels = """      - "traefik.http.routers.{resource_entry_name}.rule={backend_route_rule}"
       - "traefik.http.routers.{resource_entry_name}.entrypoints={backend_entrypoints}"
       - "traefik.http.routers.{resource_entry_name}.service={traefik_resource_name}"
 {middleware_config}
-      - "traefik.http.services.{traefik_resource_name}.loadbalancer.server.port={internal_port}"
+""".format(
+            resource_entry_name=resource_entry_name,
+            backend_route_rule=backend_route_rule,
+            backend_entrypoints=backend_entrypoints,
+            traefik_resource_name=traefik_resource_name,
+            middleware_config=middleware_config,
+        )
+
+    labels = """      - "{traefik_enable_label}"
+{backend_router_labels}      - "traefik.http.services.{traefik_resource_name}.loadbalancer.server.port={internal_port}"
       - "traefik.http.services.{traefik_resource_name}.loadbalancer.healthcheck.path={health_path}"
       - "traefik.http.services.{traefik_resource_name}.loadbalancer.healthcheck.interval={health_interval}"
       - "traefik.http.services.{traefik_resource_name}.loadbalancer.healthcheck.timeout={health_timeout}"
@@ -137,10 +172,8 @@ def get_backend_traefik_labels(
 """.format(
         resource_entry_name=resource_entry_name,
         traefik_enable_label=TRAEFIK_ENABLE_LABEL,
-        backend_route_rule=backend_route_rule,
-        backend_entrypoints=backend_entrypoints,
+        backend_router_labels=backend_router_labels,
         traefik_resource_name=traefik_resource_name,
-        middleware_config=middleware_config,
         internal_port=internal_port,
         health_path=health_path,
         health_interval=TRAEFIK_HEALTHCHECK_INTERVAL,
@@ -188,7 +221,7 @@ def get_backend_traefik_labels(
             router_priority=router_priority,
         )
 
-        if management_path and management_path != api_path:
+        if management_path and management_path != api_path and not stack_shared:
             labels += """
       - "traefik.http.routers.{resource_entry_name}-management.rule=Host(`{api_host}`) && PathPrefix(`{management_path}`)"
       - "traefik.http.routers.{resource_entry_name}-management.entrypoints={project_entrypoints}"