Prepare, monitor, and troubleshoot a Mac mini so an agent host stays reachable through reboots without sacrificing security by default.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install mac-mini
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install mac-mini using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Mac mini Always-On Agent Host?
This Openclaw Skills guide helps developers set up and recover a Mac mini used as an always-on agent host. It covers private Tailscale networking, native macOS SSH, power recovery settings, LaunchAgent availability, and practical diagnostics for reboot and connectivity failures.
The skill makes the availability trade-off explicit: a per-user agent LaunchAgent requires a GUI login, while FileVault and automatic login cannot be enabled together. It never disables FileVault, stores login credentials, modifies macOS privacy databases, or opens SSH to the public internet. Humans retain control of security-sensitive choices and privacy permissions.
Mac mini Always-On Agent Host Use Cases
- Set up a new Mac mini as a remote agent host using an ordered bootstrap checklist.
- Diagnose why a Mac mini did not return after a reboot, power loss, or macOS update.
- Enable private remote access from home through Tailscale and native SSH.
- Verify that sleep, wake-on-network, and restart-after-power-loss settings took effect.
- Investigate an agent that is reachable over SSH but has no GUI session or cannot control the interface.
- Audit the health of multiple Macs and identify offline hosts or unloaded agent services.
How Mac mini Always-On Agent Host Works
- Establish a persistent remote-desktop service and configure Tailscale using its Homebrew formula, so the network daemon can run before a user logs in.
- Enable macOS Remote Login and install the agent account's public SSH key with restrictive file permissions.
- Configure sleep, disk sleep, wake-on-network, and restart-after-power-loss settings, then verify the resulting values immediately.
- Have the machine owner choose the login model in System Settings. FileVault stays enabled unless a human deliberately chooses otherwise; automatic login is not scripted.
- Install the agent as a per-user LaunchAgent and grant required GUI privacy permissions through human interaction on the Mac.
- Run a reboot drill and generate a host report covering FileVault, console login, power settings, memory pressure, Tailscale, and agent service state.
- For incidents, follow the failure tree from network reachability through SSH, GUI login, LaunchAgent status, and privacy permissions.
Mac mini Always-On Agent Host Setup
Complete the checklist in order. Steps that require a screen or privacy approval must be performed by a person through remote desktop or on site. Run sudo commands from an administrator account; keep the agent account standard and non-admin when using automatic login.
- Install a remote-desktop service that starts at login and is permitted to run in the background. Configure its unattended access and privacy permissions.
- Install Tailscale with the Homebrew formula, start it as a root service, and enroll the host with a reusable auth key. Disable node-key expiry in the Tailscale admin console if continuous enrollment is required. Store the auth key in a mode-600 temporary file and remove it after use:
(umask 077; pbpaste > "$HOME/.tskey")
brew install tailscale
sudo brew services start tailscale
sudo tailscale up --auth-key "file:$HOME/.tskey" --hostname=HOSTNAME; rm -f "$HOME/.tskey"; tailscale ip -4
sudo brew services list
Use native macOS SSH over the private Tailscale network, not tailscale up --ssh, to avoid browser reauthentication in unattended workflows. Enable Remote Login and verify that sshd answers locally:
sudo launchctl enable system/com.openssh.sshd
sudo launchctl bootstrap system /System/Library/LaunchDaemons/ssh.plist
nc -z -G 3 127.0.0.1 22; echo "sshd=$?"
- Add the public key to the agent account's
~/.ssh/authorized_keys; set the.sshdirectory to mode 700 and the file to mode 600. - Configure and verify power settings in the same command:
sudo pmset -a sleep 0 disksleep 0 womp 1 autorestart 1; pmset -g | grep -E '^ *(sleep|disksleep|womp|autorestart) '
- Decide between FileVault with human login after reboot, or the higher local-security risk of FileVault off with automatic login. Make this choice only in System Settings; never script it. Do not use automatic login on a laptop or a Mac containing unrelated personal data.
- Install the agent gateway as a LaunchAgent for the agent account. Configure Accessibility, Screen Recording, and Input Monitoring permissions manually for each GUI-driving binary.
- Consider an upstream smart plug for recovery after a power outage, then perform a reboot drill with someone on site. Run a host report after setup, updates, and incidents.
For SSH automation, use sudo -n when a command must fail promptly rather than wait for an unseen password prompt. Use bash for the provided fleet-health loop rather than pasting it into interactive zsh.
Mac mini Always-On Agent Host Data Schema & Taxonomy
The skill does not collect or transmit data. Persistent artifacts are limited to host configuration created during setup:
| Artifact or state | Purpose |
|---|---|
| Tailscale node | Private network identity and reachability; node-key expiry is managed in the Tailscale admin console. |
~/.ssh/authorized_keys |
Public keys authorized for SSH access; recommended permissions are directory mode 700 and file mode 600. |
| macOS power settings | sleep, disksleep, womp, and autorestart values managed with pmset. |
| LaunchAgent state | Indicates whether the per-user agent service is loaded in the logged-in GUI session. |
| Host report | Human-readable status for FileVault, auto-login, console user, power settings, memory pressure, tailscaled, and the agent. |
hosts.txt |
Optional fleet input file with one user@host entry per line for remote health checks. |
The temporary Tailscale auth-key file is removed after enrollment. The skill does not write login passwords, edit TCC.db, disable FileVault, or install passwordless sudo rules.
Mac mini Always-On Agent Host Advanced Features
- Uses the Tailscale Homebrew formula as a root LaunchDaemon so private network access survives user logout and is available before GUI login.
- Recommends reusable enrollment keys and disabling per-device node-key expiry for durable host connectivity; enrollment keys can be revoked after use.
- Provides read-only host reporting and a multi-host bash health-check workflow with connection timeouts and batch-mode SSH.
- Diagnoses failures in sequence, separating network, SSH, pre-boot disk unlock, GUI session, LaunchAgent, and privacy-permission problems.
- Includes a reboot drill for remote-desktop recovery, screen locking, reboot behavior, power restoration, and powered-off expectations.
- Documents macOS security boundaries: privacy grants require a human, FileVault and auto-login involve a deliberate trade-off, and no public internet port or credential-storage workaround is introduced.
SKILL.md
Loading
Related Openclaw Skills
Baby Food and Routine Planning Assistant
A prompt-driven assistant that creates personalized baby food introduction plans, weekly menus, allergy guidance, and daily routines from essential family and infant details.
International Trade Inquiry Reply Assistant
Turn an overseas buyer’s inquiry into a practical reply email, clear quote details, essential questions, and a follow-up plan.
Bravado
Bravado turns a product website, GitHub repository, resume, or portfolio into a researched, storyboarded, and reviewable motion film.
Huawei Cloud ECS Manage
A safety-first Openclaw Skills workflow for querying, diagnosing, creating, and managing Huawei Cloud ECS instances through KooCLI.
Software Concept Architect · Refine
An evidence-led coding-agent skill that finds the smallest justified change to improve a software concept or concept system.
Apple Calendar Pal
Apple Calendar Pal helps you manage recurring commitments and one-off plans while safely checking and updating your Apple Calendar.
Featured*
