# Upgrade to latest release failed 8/21/25
**URL:** https://meta.discourse.org/t/upgrade-to-latest-release-failed-8-21-25/379559
**Category:** Self-hosting
**Created:** [August 21, 2025, 6:50am UTC](https://meta.discourse.org/t/upgrade-to-latest-release-failed-8-21-25/379559 "2025-08-21T06:50:19Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@MikeNolan](https://meta.discourse.org/u/MikeNolan)
#### Post date: [August 21, 2025, 6:50am UTC](https://meta.discourse.org/t/upgrade-to-latest-release-failed-8-21-25/379559/1 "2025-08-21T06:50:19Z")
> The latest upgrade required rebuilding the app in launcher, but it failed.
>
> First it complained about having the adplugin as a separate install, so I removed that.
Looks like then it failed trying to migrate the secondsite database:
2025-08-21 06:44:42.493 UTC [867] discourse@discourse\_nu ERROR: must be owner of extension vector
2025-08-21 06:44:42.493 UTC [867] discourse@discourse\_nu STATEMENT: ALTER EXTENSION vector UPDATE TO ‘0.7.0’;
* * *
1 migrations failed!
Failed to migrate secondsite
---
### Author:  [@jahan\_gagan](https://meta.discourse.org/u/jahan_gagan)
#### Post date: [August 21, 2025, 7:03am UTC](https://meta.discourse.org/t/upgrade-to-latest-release-failed-8-21-25/379559/2 "2025-08-21T07:03:58Z")
### Cause
- The migration tries to upgrade the “vector” extension.
- The PostgreSQL user running the migration (e.g. discourse) must be the owner of the extension, but it’s owned by a different user (often postgres).
### Solution
- Connect to your database as the owner
- Run the update as the owner
Checkout the discussion on the same [Still an issue: ERROR: must be owner of extension vector - #2 by Falco](https://meta.discourse.org/t/still-an-issue-error-must-be-owner-of-extension-vector/339808/2)
---
### Author:  [@MikeNolan](https://meta.discourse.org/u/MikeNolan)
#### Post date: [August 21, 2025, 7:38am UTC](https://meta.discourse.org/t/upgrade-to-latest-release-failed-8-21-25/379559/3 "2025-08-21T07:38:55Z")
That fixed it.
However, the problem with nginx and secondsites that I reported over a year ago is still there,
in the nginx config files within the container, it checks to see if the URL is not for the first site and changes it to that. I commented out that code–again.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [August 23, 2025, 11:48pm UTC](https://meta.discourse.org/t/upgrade-to-latest-release-failed-8-21-25/379559/4 "2025-08-23T23:48:24Z")
> [@MikeNolan](#):
>
> in the nginx config files within the container, it checks to see if the URL is not for the first site and changes it to that. I commented out that code–again
There have been big changes in how the nginx config is handled.
Do you have a multisite setup with no reverse proxy?
---
### Author:  [@MikeNolan](https://meta.discourse.org/u/MikeNolan)
#### Post date: [August 23, 2025, 11:55pm UTC](https://meta.discourse.org/t/upgrade-to-latest-release-failed-8-21-25/379559/5 "2025-08-23T23:55:31Z")
Well, it’s been nearly 2 years since I’ve looked at nginx much, but this problem existed when I first moved over to Discourse 2 years ago, so it is not new.
Here’s an excerpt from the nginx.conf file:
```plaintext
server {
server_name huskerlist.tssi.com;
root /var/www/html;
allow 162.210.7.125;
allow 162.210.7.112;
allow 162.210.7.116;
allow 76.84.125.160;
allow 172.17.0.2;
allow 72.250.242.47;
allow all;
if ( $lockdown ) {
set $custom_server_name "lists.tssi.com";
return 300 "site is down for maintenance";
}
client_max_body_size 100M;
# Load configuration files for the default server block.
#include /etc/nginx/default.d/*.conf;
location / {
proxy_pass https://127.0.0.1:8443/;
#proxy_pass http://unix:/var/discourse/shared/standalone/nginx.http.sock;
proxy_set_header Host $http_host;
proxy_http_version 1.1;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
}
error_page 404 /404.html;
location = /usr/share/nginx/html/40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /usr/share/nginx/html/50x.html {
}
listen [::]:443 ssl; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/lists.tssi.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/lists.tssi.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
```
}
```plaintext
server {
server_name nu-sports.tssi.com;
root /var/www/html;
allow 162.210.7.125;
allow 162.210.7.112;
allow 162.210.7.116;
allow 76.84.125.160;
allow 172.17.0.2;
allow 72.250.242.47;
allow all;
if ( $lockdown ) {
set $custom_server_name "lists.tssi.com";
rewrite ^ https://lists.tssi.com/n-maint.html;
}
client_max_body_size 100M;
# Load configuration files for the default server block.
#include /etc/nginx/default.d/*.conf;
location / {
proxy_pass https://127.0.0.1:8443/;
#proxy_pass http://unix:/var/discourse/shared/standalone/nginx2.http.sock:;
proxy_set_header Host $http_host;
proxy_http_version 1.1;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
}
error_page 404 /404.html;
location = /usr/share/nginx/html/40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /usr/share/nginx/html/50x.html {
}
listen [::]:443 ssl; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/lists.tssi.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/lists.tssi.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
```
}
---
### Author:  [@MikeNolan](https://meta.discourse.org/u/MikeNolan)
#### Post date: [September 11, 2025, 1:38am UTC](https://meta.discourse.org/t/upgrade-to-latest-release-failed-8-21-25/379559/6 "2025-09-11T01:38:05Z")
Apparently every time it set up a new container (such as during a reboot) it rewrites the
/etc/nginx/conf.d/outlets/server/20-https.conf file, and these lines cause a redirect to the default discourse system:
if ($https\_host != [huskerlist.tssi.com](http://huskerlist.tssi.com)) {
rewrite (.$) [https://huskerlist.tssi.com](https://huskerlist.tssi.com)
}
Is there a way to avoid this? What purpose does this code serve?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [September 12, 2025, 10:14pm UTC](https://meta.discourse.org/t/upgrade-to-latest-release-failed-8-21-25/379559/7 "2025-09-12T22:14:49Z")
> [@MikeNolan](#):
>
> Apparently every time it set up a new container (such as during a reboot) it rewrites the
>
> /etc/nginx/conf.d/outlets/server/20-https.conf file
That’s right. Are you editing that file inside of the container? Building a new container builds a new container. It’s not rewriting that file, but all files.
> [@MikeNolan](#):
>
> Is there a way to avoid this
You can add stuff to your `app.yml` to change the file after it’s rewritten.
> [@MikeNolan](#):
>
> What purpose does this code serve?
What changes are you making to that file? Why?
Oh. Wait.
> [@pfaffman](#):
>
> Do you have a multisite setup with no reverse proxy?
You didn’t answer this question, but I think the answer is yes.
It forces the site since you mostly never want your site to be available by more than one hostname.
So you’ll need to add some code to your `app.yml` to un-do that.
A long time ago, I had a solution for this in [Setup Multisite Configuration with Let's Encrypt and no Reverse Proxy](https://meta.discourse.org/t/setup-multisite-configuration-with-lets-encrypt-and-no-reverse-proxy/175285)
> [@Setup Multisite Configuration with Let's Encrypt and no Reverse Proxy](https://meta.discourse.org/t/setup-multisite-configuration-with-lets-encrypt-and-no-reverse-proxy/175285/1):
>
> But right now (2023.02.11) these instructions do not work!! (See [Set up Let’s Encrypt with multiple domains / redirects](https://meta.discourse.org/t/set-up-let-s-encrypt-with-multiple-domains-redirects/56685) for how to update the letsencrypt setting to add the `fullpath` part. I’ll update this to reflect those changes Real Soon Now.)
So you’ll need to add a `sed` in an `exec` or maybe use some `replace` stanza(s) to remove or modify that bit. ~~You probably still need to follow the stuff in that topic (that I think may still work) to get multiple~~ You can now use the ` DISCOURSE_HOSTNAME_ALIASES: www.domain.com,otherdomain.org,www.otherdomain.org` to get certs for the additional hostnames.
I suppose the most clever solution might be to contrive to add the other hostname aliases into that `if ($http_host !=` code somehow. I don’t have any sites set up that way right now, so I’m not likely to want to spend time figuring it out for fun.
But yeah, the `web ssl template` has this:
```plaintext
if (\$http_host != ${DISCOURSE_HOSTNAME}) {
rewrite (.*) https://${DISCOURSE_HOSTNAME}\$1 permanent;
}
```
so you could either delete it or find a way to make it also check for your other hostnames.
---
### Author:  [@MikeNolan](https://meta.discourse.org/u/MikeNolan)
#### Post date: [September 13, 2025, 12:12am UTC](https://meta.discourse.org/t/upgrade-to-latest-release-failed-8-21-25/379559/8 "2025-09-13T00:12:08Z")
So, essentially what you’re saying is that the ‘secondsite’ method for hosting two independent forums on one server is broken and not on the list of things to fix.
> so you could either delete it or find a way to make it also check for your other hostnames.
Deleting it in the container is what I’ve been doing, but every time a container starts up or a new container image is generated, it puts that code back, so it needs to be changed in the source somewhere so that when it builds a new container it builds it correctly checking for multiple domains in app.yml. (That’s probably preferable to just deleting those 3 lines of code.)
If the code that builds the web ssl template isn’t going to be updated to check app.yml for a secondsite (and thirdsite and …) it sounds like this needs to happen in app.yml, which makes it a custom fix for me rather than a fix for all users running multiple forums on a single server using the apparently-broken secondsite method.
Right now I’m in the middle of a major system migration project for a client, and these sites are most active during football season anyway, so I need to set up my testbed server to test writing app.yml corrections rather than try to fix the live system on the fly.
---
### Author:  [@MikeNolan](https://meta.discourse.org/u/MikeNolan)
#### Post date: [September 13, 2025, 12:41am UTC](https://meta.discourse.org/t/upgrade-to-latest-release-failed-8-21-25/379559/9 "2025-09-13T00:41:04Z")
Thinking about it briefly, fixing the ssl template is somewhat challenging.
The current logic says: If the site isn’t A, make it A.
Introducing a secondsite complicates things, because if it isn’t A and it isn’t B, it also isn’t clear that changing it to either A or B is the right thing to do. (That may be why this hasn’t been addressed by Discourse.)
Maybe deleting those lines of code is the right thing to do when there are multiple sites after all, because the outside ngingx server should only be sending through https packets that match either A or B. Forcing HTTP to HTTPS should already be happening in the outside nginx server.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [September 13, 2025, 1:06am UTC](https://meta.discourse.org/t/upgrade-to-latest-release-failed-8-21-25/379559/10 "2025-09-13T01:06:42Z")
> [@MikeNolan](#):
>
> So, essentially what you’re saying is that the ‘secondsite’ method for hosting two independent forums on one server is broken and not on the list of things to fix.
It was never on the list of things to support. The recommended was was always to use a reverse proxy. I contrived a way to do it without a reverse proxy. And my hack broke a couple years ago.
Doing multisite without a reverse proxy was always a parlor trick. If you’re a pro, you should remove the ssl and let’s encrypt templates and use a reverse proxy that handles ssl. Cdck uses haproxy. I’ve been using traefik. Caddy is pretty easy to manage. I quit using it because if someone removed the cname for their site it would cause all cert renewals to fail (that may no longer be the case, it’s been years).
---
### Author:  [@MikeNolan](https://meta.discourse.org/u/MikeNolan)
#### Post date: [September 13, 2025, 2:49am UTC](https://meta.discourse.org/t/upgrade-to-latest-release-failed-8-21-25/379559/11 "2025-09-13T02:49:06Z")
Since I’m using nginx with proxy\_pass to pass traffic to the container for two different FQDNs, am I correct that mean I’m using the reverse proxy method for multisite?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [September 13, 2025, 10:28am UTC](https://meta.discourse.org/t/upgrade-to-latest-release-failed-8-21-25/379559/12 "2025-09-13T10:28:59Z")
Yes. I forgot about that one!
Have nginx proxy do the https and remove the ssl and let’s encrypt templates from your yml file and rebuild.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [October 13, 2025, 10:29am UTC](https://meta.discourse.org/t/upgrade-to-latest-release-failed-8-21-25/379559/13 "2025-10-13T10:29:26Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.