Mac mini Datacenter Preparation Guide¶

Scope¶

This document describes the standard preparation steps for a Mac mini before placing it in a datacenter environment.
The goal is to ensure consistency, remote manageability, and predictable behavior.
This document assumes physical access is available during initial setup only.

Preconditions¶

Device will be connected via Ethernet in the datacenter.
Wi-Fi and Bluetooth are not required during or after setup.
The device will be managed remotely via SSH and Screen Sharing.
Power interruptions are possible; the device must recover automatically.

Initial macOS Setup (Manual)¶

First Boot Configuration¶

Power on the Mac mini.
Complete the macOS setup wizard with the following selections:
- Language: English
- Region: United States
- Accessibility: skipped
- Migration Assistant: skipped
- Network: You can connect to a Wi-Fi or Ethernet and skip this step because you will configure the network later.
- Data & Privacy: skipped
- User Account:
  - Username: appcircle
  - Password: strong password
  - Account type: administrator
- Apple ID: not signed in
- Terms & Conditions: accepted
- Location Services: disabled
- Time Zone: UTC
- Analytics & Diagnostics: disabled
- Screen Time: disabled
- Apple Intelligence: skipped
- FileVault: skipped
- Theme: Light
- Update Mac Automatically: Only Download Automatically

Update Hostname¶

Get the serial number of the device.

system_profiler SPHardwareDataType | grep "Serial Number"

Update the hostname of the device.

sudo scutil --set ComputerName "serial-number"
sudo scutil --set LocalHostName "serial-number"
sudo scutil --set HostName "serial-number"

System Configuration (Manual)¶

Navigate to System Settings > General > Sharing
Enable the following services:
- Screen Sharing
- Remote Login
For Remote Login:
- Click the information icon
- Enable full disk access for remote users
- Restrict access to intended administrative users only
For remote management: - Click the information icon - Allow access for the following users: - appcircle

Software Update Policy¶

Automatic macOS updates must be disabled.
OS updates are applied manually and in a controlled manner.

sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -bool false
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate CriticalUpdateInstall -int 0
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled -bool false
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates -int 0
sudo defaults write /Library/Preferences/com.apple.commerce AutoUpdate -int 0

Power Management Configuration¶

The device must operate in server-like mode.
Sleep and power-saving features are disabled.

sudo pmset -a sleep 0
sudo pmset -a powernap 0
sudo pmset -a disksleep 0
sudo pmset -a displaysleep 0
sudo pmset -a womp 1
sudo pmset -a standby 0
sudo systemsetup -setrestartpowerfailure on

Energy Saver Settings¶

Navigate to: System Settings > Energy Saver
Energy Mode: High Power
Ensure the following options are enabled:
- Wake for network access
- Start up automatically after power failure (This should be already enabled by the previous step)

Network Configuration¶

Ethernet is the primary network interface.
After validation, wireless interfaces should be disabled if not required.

Optional actions:

Disable Wi-Fi
Disable Bluetooth

These actions can be performed manually or via automation.

Automated Configuration Script¶

An automation script is available to apply standard settings:
Disable automatic updates
Configure power management
Enable SSH
Disable Wi-Fi and Bluetooth
Perform basic verification checks
The script must be executed with sudo.
The script does not replace the initial manual setup steps.
The script can be executed with the following commands:
- Only check and validate the configurations:
```
sudo bash ./setup.sh
```
- Apply the configurations:
```
sudo bash ./setup.sh apply
```

#!/bin/bash
set -uo pipefail

# ============================================================
# Read-only system compliance check (macOS)
# ============================================================

if [[ "$EUID" -ne 0 ]]; then
  echo "ERROR: Must be run as root"
  exit 1
fi

DRIFT=0

section() {
  echo
  echo "== $1 =="
}

ok()    { echo "OK     $1"; }
drift() { echo "DRIFT  $1 (expected: $2, actual: $3)"; DRIFT=1; }

bool_check() {
  [[ "$2" == "$3" ]] && ok "$1" || drift "$1" "$2" "$3"
}

# ============================================================
section "Hostname Policy"
# ============================================================

SERIAL="$(system_profiler SPHardwareDataType | awk -F': ' '/Serial Number/{print $2}')"
HOSTNAME="$(scutil --get ComputerName 2>/dev/null || echo "")"

if [[ -z "$SERIAL" || -z "$HOSTNAME" ]]; then
  drift "Hostname == Serial" "$SERIAL" "$HOSTNAME"
else
  [[ "$HOSTNAME" == "$SERIAL" ]] \
    && ok "Hostname matches Serial ($SERIAL)" \
    || drift "Hostname == Serial" "$SERIAL" "$HOSTNAME"
fi

# ============================================================
section "Software Update Policy"
# ============================================================

bool_check "AutomaticDownload" \
  "0" "$(defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload 2>/dev/null || echo 1)"

bool_check "AutomaticCheckEnabled" \
  "0" "$(defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled 2>/dev/null || echo 1)"

bool_check "App Store AutoUpdate" \
  "0" "$(defaults read /Library/Preferences/com.apple.commerce AutoUpdate 2>/dev/null || echo 1)"

# ============================================================
section "Power Management"
# ============================================================

PM="$(pmset -g)"

echo "Origin PM output:"
echo "$PM"

bool_check "Sleep"            "0" "$(awk '/^[[:space:]]*sleep/{print $2}' <<<"$PM")"
bool_check "Disk Sleep"       "0" "$(awk '/^[[:space:]]*disksleep/{print $2}' <<<"$PM")"
bool_check "Display Sleep"    "0" "$(awk '/^[[:space:]]*displaysleep/{print $2}' <<<"$PM")"
bool_check "PowerNap"         "0" "$(awk '/^[[:space:]]*powernap/{print $2}' <<<"$PM")"
bool_check "TCP Keepalive"    "1" "$(awk '/^[[:space:]]*tcpkeepalive/{print $2}' <<<"$PM")"
bool_check "Wake on LAN"      "1" "$(awk '/^[[:space:]]*womp/{print $2}' <<<"$PM")"
bool_check "Standby"          "0" "$(awk '/^[[:space:]]*standby/{print $2}' <<<"$PM")"

PF="$(systemsetup -getrestartpowerfailure | awk '{print $NF}')"
bool_check "RestartAfterPowerFailure" "On" "$PF"

# ============================================================
section "Remote Access"
# ============================================================

systemsetup -getremotelogin | grep -q "On" \
  && ok "SSH Service" \
  || drift "SSH Service" "enabled" "disabled"

# ============================================================
section "Screen Sharing"
# ============================================================

launchctl list | grep -q com.apple.screensharing \
  && ok "Screen Sharing Service" \
  || drift "Screen Sharing Service" "enabled" "disabled"

# ============================================================
section "Network Interfaces"
# ============================================================

WIFI_IF="$(networksetup -listallhardwareports | awk '/Wi-Fi/{getline; print $2}')"

if [[ -n "$WIFI_IF" ]]; then
  WIFI_STATE="$(networksetup -getairportpower "$WIFI_IF" | awk '{print $NF}')"
  bool_check "Wi-Fi ($WIFI_IF)" "Off" "$WIFI_STATE"
else
  echo "INFO   No Wi-Fi interface present"
fi

system_profiler SPBluetoothDataType | grep -q 'State: On' \
  && drift "Bluetooth" "Off" "On" \
  || ok "Bluetooth"

# ============================================================
section "Homebrew"
# ============================================================

if command -v brew >/dev/null 2>&1; then
  ok "Homebrew installed ($(brew --version | head -n1))"
else
  drift "Homebrew" "installed" "not installed"
fi

# ============================================================
section "Tart"
# ============================================================

if command -v tart >/dev/null 2>&1; then
  ok "Tart installed ($(tart --version 2>/dev/null || echo unknown))"
else
  drift "Tart" "installed" "not installed"
fi

# ============================================================
section "Tart VM Inventory"
# ============================================================

if command -v tart >/dev/null 2>&1; then
  TART_LINES="$(ls -lh /Users/appcircle/.tart/vms | wc -l | tr -d ' ')"
  if [[ "$TART_LINES" -ge 2 ]]; then
    ok "tart list entries ($TART_LINES lines)"
  else
    drift "tart list entries" ">= 2 lines" "$TART_LINES lines"
  fi
else
  drift "tart list" "available" "tart not installed"
fi

# ============================================================
section "Summary"
# ============================================================

if [[ "$DRIFT" -eq 0 ]]; then
  echo "System is compliant"
  exit 0
else
  echo "Configuration drift detected"
  exit 2
fi

Post-Setup Checklist¶

SSH access verified
Screen Sharing access verified
Device reachable after reboot
Automatic login disabled
Admin password rotated
Device hostname configured according to internal standards
Device placed in rack or designated shelf
Ethernet connection confirmed
Power recovery tested

Notes¶

FileVault is intentionally disabled to avoid remote recovery issues in a datacenter environment.
This device is treated as infrastructure, not as an end-user workstation.
Any deviation from this document must be documented and approved.

Mac mini Datacenter Preparation Guide¶

Scope¶

Preconditions¶

Initial macOS Setup (Manual)¶

First Boot Configuration¶

Update Hostname¶

System Configuration (Manual)¶

Sharing and Remote Access¶

Software Update Policy¶

Power Management Configuration¶

Energy Saver Settings¶

Network Configuration¶

Automated Configuration Script¶

Post-Setup Checklist¶

Notes¶