I'm planning to use ChaCha20 just as a CSPRNG. Key is random (taken from strong initial entropy source) and will be constantly replaced via DJB's fast key-erasure scheme. What should I use as the nonce? Does it matter? Is it safe to just use zero?
No, as you won't be switching the nonce on a per message basis, just outputting a stream of random data.
However, remember, your key will only produce an output stream valid until the internal counter overflows.
ChaCha20 uses a
96-bit nonce and 32-bit counter,
XChaCha20 uses a
192-bit nonce and
64-bit counter. The
64-bit counter lets it encrypt
Zettabyte of data, i.e. output a large random dataset.