[TimWolla]

> Thanks not only for making this, but also describing your process in a blog.

You're welcome. I like giving back to Open Source.

> but it's currently too limiting for my usecases

My personal experience is the opposite: For one project I specifically slapped on an haproxy in front of the nginx after the fact, because I considered it's HTTP "rewriting" abilities way superior. What I could do with a single ACL + http-response set-header (setting a specific CSP for a single path only) would have resulted in great pain with nginx only.