The real reason I need WAL mode is so I can read the database while vacuum is running.

The web server runs unprivileged and only needs read permission. Insert and vacuum are done as a user which has write permission.

The documentation says read only WAL mode is possible if there is write permission on the directory. So I put the database file in its own directory and set the mode of the database file to 0664 and set the mode of the directory to 3777. So an unprivileged process has permission to create WAL files which become group writable.