Best practise for redundant registry in docker swarm?

When running a registry in a swarm, what is the best way to make it redundant and fault tolerant?

The use case:

A docker swarm where every node has its own “copy” of the registry, in case of hardware failure.
The problem is how do you guarantee that both instances of the registry have the same version of the images?

The first idea was to have the registry running with replicas for each node and have ceph for image storage. But i am not sure if this makes sense for the registry.