Did you run discourse-setup? It attempts to connect to itself to check that DNS points to the server and the ports are open, but it’s a crude test.
If you run a rebuild more than a few times without DNS and ports properly configured, you’ll hit let’s encrypt rate limits. If that’s the case, and I suspect it is, you’ll need to wait a week or use a different subdomain (or follow some complicated instructions to request a cert for the subdomain you want and another).
I think if you run docker logs app you might see where acme is failing to get a cert.