There is probably a nicer way to do it:
{% if page.extra.image %}
{% set page_image_hash = get_hash(literal=macros::image_style(url=page.extra.image), base64=true, sha_type=512) %}
{% else %}
{% set default_post_image_hash = get_hash(literal=macros::image_style(url=get_url(path=config.extra.default_post_image)), base64=true, sha_type=512) %}
{% endif %}
{% set main_images_hash = get_hash(literal=macros::main_images_style(home_url=get_url(path=config.extra.home_image), posts_url=get_url(path=config.extra.post_list_image)), base64=true, sha_type=512) %}
macros:
{%- macro main_images_style(home_url, posts_url) -%}
#posts .block-left {background: linear-gradient(rgba(0, 0, 0, 0.5), rgba(0, 0, 0, 0.5)), url("{{ posts_url | safe }}") no-repeat;background-size: cover, cover;} .block-left {background: linear-gradient(rgba(44,45,51,0.9), rgba(44,45,51,0.9)), url("{{ home_url | safe }}") no-repeat;background-size: cover;}
{%- endmacro main_images_style -%}
{%- macro image_style(url) -%}
#posts.inner-post-page .block-left {background: linear-gradient(rgba(0, 0, 0, 0.5), rgba(0, 0, 0, 0.5)), url("{{ url | safe }}") no-repeat;background-size: cover;}
{%- endmacro image_style -%}
CSP value for external images in posts:
{% if page.extra.image %}{% if page.extra.image is starting_with("https://") %}{{ page.extra.image }}{% endif %}{% endif %}
CSP value for css:
{% if page_image_hash %}'sha512-{{ page_image_hash | safe }}'{% else %}'sha512-{{ default_post_image_hash | safe }}'{% endif %} 'sha512-{{ main_images_hash | safe }}
This is still not enough for GHP due the lack of header tunings so I moved to netlify https://failsafe.monster/