diff --git a/.etckeeper b/.etckeeper
index e9fe7e6e..269c541a 100755
--- a/.etckeeper
+++ b/.etckeeper
@@ -3970,6 +3970,9 @@ maybe chmod 0755 'rcS.d'
 maybe chown 'redis' 'redis'
 maybe chgrp 'redis' 'redis'
 maybe chmod 2770 'redis'
+maybe chown 'redis' 'redis/redis-bayes.conf'
+maybe chgrp 'redis' 'redis/redis-bayes.conf'
+maybe chmod 0640 'redis/redis-bayes.conf'
 maybe chgrp 'redis' 'redis/redis-server.post-down.d'
 maybe chmod 2755 'redis/redis-server.post-down.d'
 maybe chgrp 'redis' 'redis/redis-server.post-down.d/00_example'
diff --git a/group b/group
index 1ac41888..9a96a303 100644
--- a/group
+++ b/group
@@ -51,7 +51,7 @@ ssh:x:111:
 systemd-coredump:x:999:
 caelebfi:x:1000:
 mysql:x:112:
-redis:x:113:
+redis:x:113:_rspamd
 ssl-cert:x:114:
 ntp:x:115:
 postfix:x:116:
diff --git a/gshadow b/gshadow
index a89802a0..a3c8943e 100644
--- a/gshadow
+++ b/gshadow
@@ -51,7 +51,7 @@ ssh:!::
 systemd-coredump:!!::
 caelebfi:!::
 mysql:!::
-redis:!::
+redis:!::_rspamd
 ssl-cert:!::
 ntp:!::
 postfix:!::
diff --git a/gshadow- b/gshadow-
index 27943d83..a89802a0 100644
--- a/gshadow-
+++ b/gshadow-
@@ -66,3 +66,5 @@ postgrey:!::
 amavis:!::
 cmk-agent:!::
 unbound:!::
+vmail:x::
+wheel:x::caelebfi
diff --git a/redis/redis-bayes.conf b/redis/redis-bayes.conf
new file mode 100644
index 00000000..534e51a7
--- /dev/null
+++ b/redis/redis-bayes.conf
@@ -0,0 +1,24 @@
+# this is the redis instance used for bayes db,
+# with volatile-ttl eviction policy
+
+# read settings from redis.conf, then override
+include /etc/redis/redis.conf
+
+requirepass 3<kq43j=uB<d7q-e
+
+bind 127.0.0.1
+port 0
+unixsocket /var/run/redis-bayes/redis-server.sock
+unixsocketperm 770
+timeout 0
+pidfile /var/run/redis-bayes/redis-server.pid
+loglevel notice
+logfile /var/log/redis/redis-server-bayes.log
+
+dbfilename bayes.rdb
+
+maxmemory 1GB
+maxmemory-policy volatile-ttl
+
+lazyfree-lazy-eviction yes
+lazyfree-lazy-expire yes
diff --git a/redis/redis.conf b/redis/redis.conf
index 74935a91..3f4317b4 100644
--- a/redis/redis.conf
+++ b/redis/redis.conf
@@ -81,7 +81,7 @@ protected-mode yes
 
 # Accept connections on the specified port, default is 6379 (IANA #815344).
 # If port 0 is specified Redis will not listen on a TCP socket.
-port 6379
+port 0
 
 # TCP listen() backlog.
 #
@@ -99,7 +99,7 @@ tcp-backlog 511
 # on a unix socket when not specified.
 #
 unixsocket /var/run/redis/redis.sock
-# unixsocketperm 700
+unixsocketperm 770
 
 # Close the connection after a client is idle for N seconds (0 to disable)
 timeout 0
@@ -535,7 +535,7 @@ rename-command CONFIG 1142eatmyass
 # limit for maxmemory so that there is some free RAM on the system for slave
 # output buffers (but this is not needed if the policy is 'noeviction').
 #
-maxmemory 1000mb
+#maxmemory 1000mb
 
 # MAXMEMORY POLICY: how Redis will select what to remove when maxmemory
 # is reached. You can select among five behaviors:
diff --git a/rspamd/local.d/classifier-bayes.inc b/rspamd/local.d/classifier-bayes.inc
index 9fd58a0d..fb43dc43 100644
--- a/rspamd/local.d/classifier-bayes.inc
+++ b/rspamd/local.d/classifier-bayes.inc
@@ -1,4 +1,5 @@
 backend = "redis";
-
+servers = "/var/run/redis-bayes/redis-server.sock";
+password = "3<kq43j=uB<d7q-e";
 new_schema = true;
 expire = 1209600O;
diff --git a/rspamd/local.d/redis.conf b/rspamd/local.d/redis.conf
index 9fc2fa2b..63b3e793 100644
--- a/rspamd/local.d/redis.conf
+++ b/rspamd/local.d/redis.conf
@@ -1,3 +1,4 @@
-servers = "127.0.0.1:6379";
+#servers = "127.0.0.1:6379";
+servers = "/var/run/redis/redis.sock";
 password = "3<kq43j=uB<d7q-e";
 compress = true;