Printable checklist

Every step of the guide on one sheet. Tick items off here — your progress is saved in this browser — or print it and keep it next to the Mac. Each heading links to the full instructions.

Print checklistClear ticks0 of 52 done

1. Hardware

• Apple silicon Mac mini with enough memory for your workload 16 GB min, 24–32 GB for parallel agents
• Connected by Ethernet
• Plugged into a UPS, UPS USB cable connected to the Mac
• Ventilated, physically secure spot near the router

2. macOS setup

• macOS fully updated (26 Tahoe or later preferred)
• Admin account created; optional standard account for agents
• Computer name and local hostname set scutil --set LocalHostName your-mac-mini
• Automatic updates: download on, macOS install off, Security Responses on
• Screen saver never; display off after a few minutes; password on wake

3. Always on

• setup-power.sh --apply run; dry run now reports nothing to do
• pmset -g shows sleep 0 and autorestart 1
• Restart after freeze is On sudo systemsetup -getrestartfreeze
• Optional daily power-on scheduled pmset -g sched
• UPS shutdown threshold set in System Settings → Energy
• Chose FileVault on (A) or FileVault off + auto-login (B)
• A: fdesetup authrestart tested for planned reboots
• A: FileVault unlock over SSH tested from the LAN (macOS 26+)
• Pulled the power cable; the Mac started by itself

4. Remote access

• Tailscale installed, signed in, launches at login
• Key expiry disabled for this machine in the Tailscale admin console
• Remote Login on, only your account allowed
• SSH key login works; password login disabled
• Screen Sharing on, only your account allowed
• Tested SSH and Screen Sharing from mobile data
• No ports forwarded on the router

5. Login items & LaunchAgents

• Apps added to Open at Login Cursor, Claude, Tailscale, sync clients
• Their helpers enabled under Allow in the Background
• Headless jobs installed as LaunchAgents (install-launchagent.sh)
• Each job writes logs to ~/Library/Logs/<label>/
• Privacy prompts approved once by hand for jobs that need them

6. Cloud storage

• Code in ~/code (git), not in a synced folder
• Agent folders set to keep downloaded / available offline
• Inbox / Outbox / Archive folders created

7. AI tools

• Homebrew installed and on PATH brew doctor
• Node and Python (uv) installed
• Cursor installed and signed in
• Cursor CLI installed; agent login done
• Cursor self-hosted worker running as a LaunchAgent
• Claude app and Claude Code installed and signed in
• Brewfile saved brew bundle dump --file ~/Brewfile --force

8. Security

• Firewall on (stealth mode optional)
• Unused sharing services and AirPlay Receiver off
• API keys in the Keychain, not in plists or dotfiles
• Least-privilege, expiring tokens for each agent
• Agent command approvals on outside disposable environments
• Find My Mac on; SIP and Gatekeeper enabled

9. Backups

• Time Machine to an encrypted disk or NAS, hourly
• Off-site, encrypted, versioned backup running
• Restored a folder from each backup successfully

10. Final check

• Restarted on purpose; health-check.sh shows no FAIL
• Hourly health check installed as a LaunchAgent (optional)
• Filled in the notes box below and stored this sheet somewhere safe

Notes for this server

• Server name:
• Tailscale name:
• FileVault option (A / B):
• LaunchAgent labels:
• Backup disk / service:
• Last restore test:

Printed from the Mac mini AI Server guide. Re-run health-check.sh after every restart.