diff --git a/secrets/mysql_root_password b/secrets/mysql_root_password
index b1873c6..73894f6 100644
--- a/secrets/mysql_root_password
+++ b/secrets/mysql_root_password
@@ -1 +1 @@
-wiochohv8foR9eDo5ol5
+wiochohv8foR9eDo5ol5
\ No newline at end of file
diff --git a/services/mysql-backup.hcl b/services/mysql-backup.hcl
new file mode 100644
index 0000000..df605e1
--- /dev/null
+++ b/services/mysql-backup.hcl
@@ -0,0 +1,37 @@
+job "mysql-backup" {
+  datacenters = ["alo"]
+  type = "batch"
+
+  periodic {
+    cron = "23 23 * * * *"
+    prohibit_overlap = true
+  }
+
+  group "db" {
+    task "backup" {
+      driver = "raw_exec"
+
+      config {
+        command = "/bin/sh"
+        args = [ "local/script.sh" ]
+      }
+
+      template {
+        destination = "local/script.sh"
+        data = <<EOH
+          set -e
+          /run/current-system/sw/bin/nomad alloc exec -job -task=mysqld mysql \
+            mysqldump -u root --password="$MYSQL_ROOT_PASS" --all-databases > /data/compute/appdata/db-backups/mysql/backup.sql
+        EOH
+      }
+
+      template {
+        destination = "secrets/file.env"
+        env = true
+        data = <<EOH
+          {{- with nomadVar "secrets/mysql" -}}MYSQL_ROOT_PASS="{{ .root_password }}"{{- end -}}
+        EOH
+      }
+    }
+  }
+}
diff --git a/stateful-commands.txt b/stateful-commands.txt
index 85094a1..3bbcbd9 100644
--- a/stateful-commands.txt
+++ b/stateful-commands.txt
@@ -24,4 +24,4 @@ glusterfs tweaking for wordpress performance:
   * gluster volume set compute server.outstanding-rpc-limit 256
 
 mysql credentials
-  * ./utils/file_to_nomad_var.sh secrets/mysql_root_password jobs/mysql root_password
+  * Put secrets/mysql_root_password into a Nomad var named secrets/mysql
diff --git a/utils/file_to_nomad_var.sh b/utils/file_to_nomad_var.sh
deleted file mode 100755
index dbf8b1f..0000000
--- a/utils/file_to_nomad_var.sh
+++ /dev/null
@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-# 
-# Loads file contents into a nomad variable.
-# 
-# Usage: file_to_nomad_var.sh <filename> <variablename> <var_key>
-# 
-# filename can be - for stdin.
-# 
-# read the var back out with:
-#  - nomad var get <variablename>
-#
-# From https://github.com/gerrowadat/nomad-homelab/blob/main/utilities/file_to_nomad_var.sh
-
-function print_usage() {
-  echo "Usage: ${0} <file or -> <nomad var> <var key>"
-}
-
-filename=$1
-nomad_var=$2
-var_key=$3
-
-if [ "${filename}" !=  "-" ];
-then
-  if [ ! -f "${filename}" ]
-  then
-    echo "${filename} does not exist"
-    exit
-  fi
-fi
-
-var_contents=$(cat ${filename})
-
-if [[ "${nomad_var}" == "" || "${var_key}" == "" ]];
-then
-  print_usage
-  exit
-fi
-
-echo "Copying ${filename} to ${nomad_var}:${var_key}..."
-
-nomad var put -force -in hcl - <<EOF
-path = "${nomad_var}"
-
-items {
-    ${var_key} = <<OMGUNIQUETOKEN
-${var_contents}
-OMGUNIQUETOKEN
-}
-EOF
-