Panic serving XXX runtime error: invalid memory address or nil pointer dereference

The requested resource must have a CORS response header.

I don’t see you setting one at all in your Caddyfile. Is the upstream server meant to be issuing one?