denial of service: --on-demand-tls creates certs for missing apps

[tarasglek]

1.752843456775469e+09   info    waiting on internal rate limiter        {"identifiers": ["www91.sensoreddomain.dev"], "ca": "https://acme-v02.api.letsencrypt.org/directory", "accoun
t": ""}
1.7528434567755241e+09  info    done waiting on internal rate limiter   {"identifiers": ["www91.sensoreddomain.dev"], "ca": "https://acme-v02.api.letsencrypt.org/directory", "accoun
t": ""}
1.7528434567755516e+09  info    using ACME account      {"account_id": "https://acme-v02.api.letsencrypt.org/acme/acct/2536652211", "account_contact": []}
1.7528434573884435e+09  info    trying to solve challenge       {"identifier": "www91.sensoreddomain.dev", "challenge_type": "tls-alpn-01", "ca": "https://acme-v02.api.letsencrypt.o
rg/directory"}
2025/07/18 12:57:37 http: TLS handshake error from 127.0.0.1:48592: EOF
1.7528434592108474e+09  info    authorization finalized {"identifier": "www91.sensoreddomain.dev", "authz_status": "valid"}
1.7528434592109075e+09  info    validations succeeded; finalizing order {"order": "https://acme-v02.api.letsencrypt.org/acme/order/2536652211/408182343731"}
1.7528434624214652e+09  info    got renewal info        {"names": ["www91.sensoreddomain.dev"], "window_start": 1757947393, "window_end": 1758102843, "selected_time": 1758100188, "r
echeck_after": 1752865062.4214454, "explanation_url": ""}
1.7528434627605672e+09  info    got renewal info        {"names": ["www91.sensoreddomain.dev"], "window_start": 1757947393, "window_end": 1758102843, "selected_time": 1758059322, "r
echeck_after": 1752865062.7605443, "explanation_url": ""}
1.752843462760678e+09   info    successfully downloaded available certificate chains    {"count": 2, "first_url": "https://acme-v02.api.letsencrypt.org/acme/cert/0588623071b68d7f
5d384028c6b3f47dd430"}
Jul 18 12:57:42.772 INF 404: Not Found logger=http request.time=2025-07-18T12:57:42.771Z 

i'm using the vps docker compose config from docs with no mods beyond passing diff UID/GID via env vars