This wasn't dead trivial to set up, so I'm documenting it. What's needed, first, is a read-only user on the database. That user needs to have read permissions (I included views here), and also needs Lock Tables (presumably everything is locked during the dump process). Finally, that user needs to have explicit rights to "localhost"; the generic "%" will not do.

Once the user is set up, create a script on the db server which first deletes the old version of the file you want to dump to (otherwise the dump will fail); then runs the dump command. That command looks like this:

/usr/bin/mysqldump --xml --user=[readonlyuser] --password=[password] landscapes_live > /home1t/[user]/www/[outputfile].xml

In this case, we put it in www so that it can be retrieved easily by a Jenkins build process which makes use of it.

Finally, crontab -e to edit your crontab, and add the following line (this dumps every midnight):

0 0 * * * /home1t/user/[script].sh