CSP Maker lets you define a Content Security Policy using a DSL and encode it into a header string. It has support for nonces, and includes a Rack middleware that automates generating and assigning the header. The code was extracted from ActionDispatch::ContentSecurityPolicy in Rails ActionPack, with some minor modifications. The DSL as described in Rails docs should be usable 1:1 here.