xxxxxxxxxx
// use process.env.NODE_ENV
// It can be either "development" | "production" | "testing"
// You might want it for CSP:
const nonce = randomBytes(128).toString('base64');
const is_dev = process.env.NODE_ENV === 'development';
const csp = `object-src 'none'; base-uri 'none'; script-src 'self' ${is_dev ? '' : "'unsafe-eval'"} 'unsafe-inline' https: http: 'nonce-${nonce}' 'strict-dynamic'`