fix: attach extra_networks to service containers

ServiceContainerSpec was silently dropping extra_networks from
orchestrator_opts. Services were only attached to bridge and the
database overlay, even when extra networks were specified.

Mirror the existing Postgres spec.go pattern to append ExtraNetworks
with target and aliases.

Author: rshoemaker

server/internal/orchestrator/swarm/service_spec.go

@@ -67,9 +67,18 @@ func ServiceContainerSpec(opts *ServiceContainerSpecOptions) (swarm.ServiceSpec,
 		"pgedge.host.id":             opts.HostID,
 	}
 
-	// Merge user-provided extra labels (matches Postgres ExtraLabels behavior)
-	if opts.ServiceSpec.OrchestratorOpts != nil && opts.ServiceSpec.OrchestratorOpts.Swarm != nil {
-		for k, v := range opts.ServiceSpec.OrchestratorOpts.Swarm.ExtraLabels {
+	// Extract swarm orchestrator options (matches Postgres pattern in spec.go).
+	// NOTE: ExtraVolumes is not supported for service containers — services get
+	// their bind mounts configured per service type below. Add support here if a
+	// use case arises.
+	var swarmOpts *database.SwarmOpts
+	if opts.ServiceSpec.OrchestratorOpts != nil {
+		swarmOpts = opts.ServiceSpec.OrchestratorOpts.Swarm
+	}
+
+	// Merge user-provided extra labels
+	if swarmOpts != nil {
+		for k, v := range swarmOpts.ExtraLabels {
 			labels[k] = v
 		}
 	}
@@ -90,6 +99,18 @@ func ServiceContainerSpec(opts *ServiceContainerSpecOptions) (swarm.ServiceSpec,
 		},
 	}
 
+	// Append user-requested extra networks (e.g. Traefik, reverse proxy).
+	// NOTE: DriverOpts on ExtraNetworkSpec is accepted by the API but not
+	// passed through here or in Postgres spec.go — add if needed.
+	if swarmOpts != nil {
+		for _, net := range swarmOpts.ExtraNetworks {
+			networks = append(networks, swarm.NetworkAttachmentConfig{
+				Target:  net.ID,
+				Aliases: net.Aliases,
+			})
+		}
+	}
+
 	// Get container image (already resolved in ServiceImage)
 	image := opts.ServiceImage.Tag
 

server/internal/orchestrator/swarm/service_spec_test.go

@@ -309,6 +309,86 @@ func intPtr(i int) *int {
 	return &i
 }
 
+func TestServiceContainerSpec_ExtraNetworks(t *testing.T) {
+	opts := &ServiceContainerSpecOptions{
+		ServiceSpec: &database.ServiceSpec{
+			ServiceID:   "mcp-server",
+			ServiceType: "mcp",
+			OrchestratorOpts: &database.OrchestratorOpts{
+				Swarm: &database.SwarmOpts{
+					ExtraNetworks: []database.ExtraNetworkSpec{
+						{ID: "traefik_us-west-2a", Aliases: []string{"mcp"}},
+						{ID: "monitoring"},
+					},
+				},
+			},
+		},
+		ServiceInstanceID: "db1-mcp-host1",
+		DatabaseID:        "db1",
+		DatabaseName:      "testdb",
+		HostID:            "host1",
+		ServiceName:       "db1-mcp-host1",
+		Hostname:          "mcp-host1",
+		CohortMemberID:    "node-123",
+		ServiceImage:      &ServiceImage{Tag: "ghcr.io/pgedge/postgres-mcp:latest"},
+		Credentials:       &database.ServiceUser{Username: "svc_mcp", Password: "pw"},
+		DatabaseNetworkID: "db1-database",
+		Port:              intPtr(8080),
+		DataPath:          "/var/lib/pgedge/services/db1-mcp-host1",
+	}
+
+	spec, err := ServiceContainerSpec(opts)
+	if err != nil {
+		t.Fatalf("ServiceContainerSpec() error = %v", err)
+	}
+
+	networks := spec.TaskTemplate.Networks
+	// [0]=bridge, [1]=database overlay, [2..]=extra networks
+	if len(networks) != 4 {
+		t.Fatalf("got %d networks, want 4", len(networks))
+	}
+	if networks[2].Target != "traefik_us-west-2a" {
+		t.Errorf("networks[2].Target = %q, want %q", networks[2].Target, "traefik_us-west-2a")
+	}
+	if len(networks[2].Aliases) != 1 || networks[2].Aliases[0] != "mcp" {
+		t.Errorf("networks[2].Aliases = %v, want [mcp]", networks[2].Aliases)
+	}
+	if networks[3].Target != "monitoring" {
+		t.Errorf("networks[3].Target = %q, want %q", networks[3].Target, "monitoring")
+	}
+}
+
+func TestServiceContainerSpec_NoExtraNetworks(t *testing.T) {
+	opts := &ServiceContainerSpecOptions{
+		ServiceSpec: &database.ServiceSpec{
+			ServiceID:   "mcp-server",
+			ServiceType: "mcp",
+		},
+		ServiceInstanceID: "db1-mcp-host1",
+		DatabaseID:        "db1",
+		DatabaseName:      "testdb",
+		HostID:            "host1",
+		ServiceName:       "db1-mcp-host1",
+		Hostname:          "mcp-host1",
+		CohortMemberID:    "node-123",
+		ServiceImage:      &ServiceImage{Tag: "ghcr.io/pgedge/postgres-mcp:latest"},
+		Credentials:       &database.ServiceUser{Username: "svc_mcp", Password: "pw"},
+		DatabaseNetworkID: "db1-database",
+		Port:              intPtr(8080),
+		DataPath:          "/var/lib/pgedge/services/db1-mcp-host1",
+	}
+
+	spec, err := ServiceContainerSpec(opts)
+	if err != nil {
+		t.Fatalf("ServiceContainerSpec() error = %v", err)
+	}
+
+	networks := spec.TaskTemplate.Networks
+	if len(networks) != 2 {
+		t.Fatalf("got %d networks, want 2", len(networks))
+	}
+}
+
 // --- PostgREST container spec tests ---
 
 func makePostgRESTSpecOpts() *ServiceContainerSpecOptions {

server/internal/orchestrator/swarm/spec.go

@@ -71,6 +71,8 @@ func DatabaseServiceSpec(
 			mounts = append(mounts, docker.BuildMount(vol.HostPath, vol.DestinationPath, false))
 		}
 
+		// NOTE: DriverOpts on ExtraNetworkSpec is accepted by the API but not
+		// passed through here — add if needed.
 		for _, net := range instance.OrchestratorOpts.Swarm.ExtraNetworks {
 			networks = append(networks, swarm.NetworkAttachmentConfig{
 				Target:  net.ID,