First-hour setup: securing and preparing your hosted Mac mini

A short checklist to run right after your first login — lock down access, keep the machine awake and self-recovering, and get it update-ready.

Your mini arrives ready to use, but ten minutes of setup makes it secure and keeps it reliably online. Run this once, right after your first login through the browser console.

1. Lock down SSH

Switch to key-based login and turn off passwords. From your own machine, copy your key up:

# run on: your local computer
ssh-copy-id youruser@YOUR.MINI.IP.ADDRESS

Then, on the mini, disable password authentication:

# run on: your Mac mini
sudo sed -i '' 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo launchctl kickstart -k system/com.openssh.sshd

Confirm your key works in a second terminal before you close the first one. Locked yourself out anyway? The browser console still gets you in — it doesn't depend on SSH.

2. Keep it awake

A server that goes to sleep isn't a server. Disable system and disk sleep:

# run on: your Mac mini
sudo pmset -a sleep 0 disksleep 0 displaysleep 0
sudo pmset -a womp 1

3. Make it recover on its own

If power blips, the mini should come back without you. Turn on automatic restart after a power failure:

# run on: your Mac mini
sudo systemsetup -setrestartpowerfailure on

If you want the machine to reach a usable state unattended (for a runner or an agent), set auto-login for your user in System Settings → Users & Groups → Automatically log in as. Weigh that against the fact that it decrypts the session at boot — fine for a dedicated build box, think twice for anything holding secrets.

4. Update, then pin

Bring macOS current before you build your environment on top of it:

# run on: your Mac mini
sudo softwareupdate -ia

For a CI machine, once you're on the macOS and Xcode versions your project targets, stop auto-updating so a surprise OS bump doesn't break a build overnight. Update on your schedule, not Apple's.

5. Set the hostname and timezone

# run on: your Mac mini
sudo scutil --set HostName mini01.yourdomain.com
sudo systemsetup -settimezone America/Phoenix

6. Decide your firewall posture

macOS has its own application firewall (System Settings → Network → Firewall), which is worth enabling. For real edge control, add our managed firewall and we'll scope SSH, VNC, and anything else to your allowlist at the network edge — before traffic ever touches the Mac. Open a ticket to turn it on.

Setup checklist

• [ ] Key-based SSH, passwords off
• [ ] Sleep disabled
• [ ] Auto-restart after power failure on
• [ ] macOS updated, then pinned for CI
• [ ] Hostname + timezone set
• [ ] Firewall posture chosen

Next: turn the mini into a CI runner or an always-on agent host.