Since this will be executed by puppet, maybe the group should be puppet so we can use mode 0640?