nginx: Lower default error log severity

modules/nginx.nix

@@ -35,9 +35,12 @@ in
       '';
     })
     (lib.mkIf cfg.privacy.enable {
-      services.nginx.commonHttpConfig = ''
+      services.nginx = {
-        access_log off;
+        logError = "stderr crit"; # error (the default severity) logs potential PII (IP addresses) on 404 errors
-      '';
+        commonHttpConfig = ''
+          access_log off;
+        '';
+      };
     })
     (lib.mkIf cfg.recommended.enable {
       services.nginx = {