Why do you need read only WAL mode? Or do you just mean some processes are read only, while others can write?
The web server runs unprivileged and only needs read permission. Insert and vacuum are done as a user which has write permission.
The documentation says read only WAL mode is possible if there is write permission on the directory. So I put the database file in its own directory and set the mode of the database file to 0664 and set the mode of the directory to 3777. So an unprivileged process has permission to create WAL files which become group writable.