Trying to avoid google analytics personally, but as you added them to your site you need a policy. You are the custodian and are sharing information to google through you. As you are the Data Controller: https://www.gdprsummary.com/gdpr-definitions/data-controller....

https://piwik.pro/blog/is-google-analytics-gdpr-compliant/#2...

Depending on the information logged by your nginx server, you may also need a policy. IP for instance is one thing you might need to cover.