diff --git a/data_bags/credentials/redis.json b/data_bags/credentials/redis.json
new file mode 100644
index 0000000..594a2e7
--- /dev/null
+++ b/data_bags/credentials/redis.json
@@ -0,0 +1,10 @@
+{
+  "id": "redis",
+  "password": {
+    "encrypted_data": "M2Cr7oNhL735D3coHnMc9yLuUzYlhkl+TfyMx1ccplFOyVZ+fXRF9UdDqxJ2\nyFIDJ+Yg\n",
+    "iv": "nEQz0SCUuFAEmxMd\n",
+    "auth_tag": "uuwSJdMZfLcRs7yjVrRlAQ==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  }
+}
\ No newline at end of file
diff --git a/roles/redis_replica.rb b/roles/redis_replica.rb
index ddcc9d1..6e37dfd 100644
--- a/roles/redis_replica.rb
+++ b/roles/redis_replica.rb
@@ -1,15 +1,17 @@
 name "redis_replica"
 
-run_list %w(
+default_run_list = %w(
+  kosmos_redis::replica
+)
+
+production_run_list = %w(
   kosmos_redis::replica
   kosmos_redis::firewall
 )
+# TODO: Replace the old backup
 
-default_attributes({
-  'redisio' => {
-    'default_settings' => {
-      'slaveservestaledata' => 'yes',
-      'slavereadonly' => 'yes'
-    }
-  }
-})
+env_run_lists(
+  '_default' => default_run_list,
+  'development' => default_run_list,
+  'production' => production_run_list
+)
diff --git a/roles/redis_server.rb b/roles/redis_server.rb
index e50219b..10e555e 100644
--- a/roles/redis_server.rb
+++ b/roles/redis_server.rb
@@ -7,8 +7,8 @@ default_run_list = %w(
 production_run_list = %w(
   kosmos_redis::default
   kosmos_redis::firewall
-  kosmos_redis::backup
 )
+# TODO: Replace the old backup
 
 env_run_lists(
   '_default' => default_run_list,
diff --git a/site-cookbooks/kosmos_redis/attributes/default.rb b/site-cookbooks/kosmos_redis/attributes/default.rb
index e35a8a7..adab69b 100644
--- a/site-cookbooks/kosmos_redis/attributes/default.rb
+++ b/site-cookbooks/kosmos_redis/attributes/default.rb
@@ -1 +1,5 @@
-node.override["redisio"]["version"] = "7.0.11"
+# frozen_string_literal: true
+
+default["kosmos_redis"]["add_redisio_repository"] = true
+default["kosmos_redis"]["package_name"] = "redis"
+default["kosmos_redis"]["port"] = 6379
diff --git a/site-cookbooks/kosmos_redis/metadata.rb b/site-cookbooks/kosmos_redis/metadata.rb
index e58b021..c5ee33b 100644
--- a/site-cookbooks/kosmos_redis/metadata.rb
+++ b/site-cookbooks/kosmos_redis/metadata.rb
@@ -1,11 +1,14 @@
-name             'kosmos_redis'
-maintainer       'Kosmos'
-maintainer_email 'mail@kosmos.org'
-license          'MIT'
-description      'redis wrapper cookbook'
-long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
-version          '0.2.0'
+# frozen_string_literal: true
 
-depends 'redisio'
-depends 'backup'
-depends 'kosmos-base'
+name "kosmos_redis"
+maintainer "Kosmos"
+maintainer_email "mail@kosmos.org"
+license "MIT"
+description "redisio wrapper cookbook"
+version "0.2.0"
+chef_version "~> 18.0" # apt_repository resource
+
+depends "redisio"
+depends "backup"
+depends "kosmos-base"
+depends "apt"
diff --git a/site-cookbooks/kosmos_redis/recipes/backup.rb b/site-cookbooks/kosmos_redis/recipes/backup.rb
index 44041f6..d842f05 100644
--- a/site-cookbooks/kosmos_redis/recipes/backup.rb
+++ b/site-cookbooks/kosmos_redis/recipes/backup.rb
@@ -1,10 +1,12 @@
+# frozen_string_literal: true
+
 #
-# Cookbook Name:: kosmos_redis
+# Cookbook:: kosmos_redis
 # Recipe:: backup
 #
 
-databases = node['redisio']['servers'].map do |server, _|
-  "dump-#{server['port']}"
+databases = node["redisio"]["servers"].map do |server, _|
+  "dump-#{server["port"]}"
 end
 node.override["backup"]["redis"]["databases"] = databases
 
diff --git a/site-cookbooks/kosmos_redis/recipes/default.rb b/site-cookbooks/kosmos_redis/recipes/default.rb
index dfc0031..05faaf0 100644
--- a/site-cookbooks/kosmos_redis/recipes/default.rb
+++ b/site-cookbooks/kosmos_redis/recipes/default.rb
@@ -1,12 +1,21 @@
+# frozen_string_literal: true
+
 #
-# Cookbook Name:: kosmos_redis
+# Cookbook:: kosmos_redis
 # Recipe:: default
 #
 
-node.normal['redisio']['servers'] = [{
-  'port' => '6379',
-  'protected_mode' => 'no'
-}]
+include_recipe "kosmos_redis::repo" if node["kosmos_redis"]["add_redisio_repository"]
 
-include_recipe 'redisio::default'
-include_recipe 'redisio::enable'
+credentials = data_bag_item("credentials", "redis")
+
+redisio_install "default" do
+  package_install true
+  package_name node["kosmos_redis"]["package_name"]
+end
+
+redisio_server node["kosmos_redis"]["port"].to_s do
+  package_install true
+  package_name node["kosmos_redis"]["package_name"]
+  requirepass credentials["password"]
+end
diff --git a/site-cookbooks/kosmos_redis/recipes/firewall.rb b/site-cookbooks/kosmos_redis/recipes/firewall.rb
index 4911854..94deb43 100644
--- a/site-cookbooks/kosmos_redis/recipes/firewall.rb
+++ b/site-cookbooks/kosmos_redis/recipes/firewall.rb
@@ -1,17 +1,15 @@
+# frozen_string_literal: true
+
 #
-# Cookbook Name:: kosmos_redis
+# Cookbook:: kosmos_redis
 # Recipe:: firewall
 #
 
 include_recipe "kosmos-base::firewall"
 
-ports = node['redisio']['servers'].map do |server, _|
-  server['port']
-end
-
 firewall_rule "redis" do
-  port     ports
-  source   "10.1.1.0/24" # zerotier
+  port node["kosmos_redis"]["port"]
+  source "10.1.1.0/24" # zerotier
   protocol :tcp
-  command  :allow
+  command :allow
 end
diff --git a/site-cookbooks/kosmos_redis/recipes/replica.rb b/site-cookbooks/kosmos_redis/recipes/replica.rb
index d968c7b..1b00666 100644
--- a/site-cookbooks/kosmos_redis/recipes/replica.rb
+++ b/site-cookbooks/kosmos_redis/recipes/replica.rb
@@ -1,19 +1,28 @@
+# frozen_string_literal: true
+
 #
-# Cookbook Name:: kosmos_redis
+# Cookbook:: kosmos_redis
 # Recipe:: replica
 #
 
-primary_host = search(:node, 'role:redis_server').first['knife_zero']['host'] rescue nil
+primary_host = search(:node, "role:redis_server").first&.dig("knife_zero", "host")
 
 if primary_host.nil?
   Chef::Log.warn("No node found with 'redis_server' role. Stopping here.")
   return
 end
 
-node.normal['redisio']['servers'] = [{
-  'port' => '6379',
-  'replicaof' => { 'address' => primary_host, 'port' => '6379' }
-}]
+credentials = data_bag_item("credentials", "redis")
 
-include_recipe 'redisio::default'
-include_recipe 'redisio::enable'
+redisio_install "default" do
+  package_install true
+  package_name node["kosmos_redis"]["package_name"]
+end
+
+redisio_server node["kosmos_redis"]["port"].to_s do
+  package_install true
+  package_name node["kosmos_redis"]["package_name"]
+  replicaof({"address" => primary_host, "port" => node["kosmos_redis"]["port"]})
+  requirepass credentials["password"]
+  masterauth credentials["password"]
+end
diff --git a/site-cookbooks/kosmos_redis/recipes/repo.rb b/site-cookbooks/kosmos_redis/recipes/repo.rb
new file mode 100644
index 0000000..0514341
--- /dev/null
+++ b/site-cookbooks/kosmos_redis/recipes/repo.rb
@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+#
+# Cookbook:: kosmos_redis
+# Recipe:: repo
+#
+
+# Download+dearmor exactly like the manual command
+execute "create redis signing keyring" do
+  command "curl -fsSL https://packages.redis.io/gpg | gpg --dearmor -o /usr/share/keyrings/redis-archive-keyring.gpg"
+  creates "/usr/share/keyrings/redis-archive-keyring.gpg"
+end
+
+file "/usr/share/keyrings/redis-archive-keyring.gpg" do
+  mode "0644"
+end
+
+# # Add Redis repo
+# apt_repository "redis" do
+#   uri "https://packages.redis.io/deb"
+#   components ["main"]
+# end
+
+# Ensure apt sources.list.d entry uses signed-by (Chef's apt_repository doesn't
+# always expose signed-by cleanly)
+file "/etc/apt/sources.list.d/redis.list" do
+  content "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb #{node["lsb"]["codename"]} main\n"
+  mode "0644"
+  notifies :update, "apt_update[redis repo]", :immediately
+end
+
+apt_update "redis repo"