create hostkey group which has read access to host certificate key

roles/pki/tasks/main.yml

@@ -1,5 +1,10 @@
 ---
 
+- name: create hostkey group
+  group:
+    name: hostkey
+    system: true
+
 - name: copy ca certificate
   copy:
     src: "/srv/ca/certs/ca.crt"
@@ -20,6 +25,6 @@
   copy:
     src: "/srv/ca/private/{{ inventory_hostname }}.key"
     dest: "{{ tls_private }}/{{ inventory_hostname }}.key"
-    mode: 0600
+    mode: 0640
     owner: root
-    group: "{{ ansible_wheel }}"
+    group: hostkey