[crote]

It depends on how nginx is designed. In theory you could separate log writing into a different process, and drop those permissions from the worker process.

Or just write to stdout and have systemd handle the logging for you, that'd work too.