We are in the process of implementing a strict Content Security Policy for Cross-site scripting

We are in the process of implementing a strict Content Security Policy for our site to protect against potential security risks such as Cross-Site Scripting (XSS). The aim is to enforce a policy that only allows trusted resources (like external scripts, styles, images, etc.) to be loaded, while preventing any untrusted or unauthorized code execution. However, one key aspect is that our page relies on inline JavaScript for certain functionalities, such as defining client-side variables and interacting with external analytics services. We are seeking guidance on how to configure the CSP header in such a way that we can enforce