When a Server is in requireTLS mode, it will only accept and produce TLS traffic. This is safe, and an easy to understand security model.

When a client connects to a Unix Domain Socket, it knows that it and the server exist on the same host. After a connection has been established, no adversary can get in between them. TLS cannot work for these pairs, because Unix Domain Sockets cannot be meaningfully embedded into Subject Alternative Names. The cryptography provides no additional value.

As such, when a Server is in requireTLS, it should accept plaintext traffic over the Unix Domain Socket.