enable on demand tls to see if that fixes issue with pds subdomain ssl

caddy/Caddyfile

···
     format console
   }
 
+  tls {
+		on_demand
+	}
+  
   # required as magicDNS (tailscale) doesn't support 
   # subdomains without running own dns server
   rewrite /.well-known/atproto-did /.well-known/atproto-did/{http.request.host}