Best Practices for Configuring Your macOS Server

Some baseline settings that are useful when running a headless Mac server in a data center. If you are renting a Mac with us, most of these are already configured, but it is worth double checking, especially after a macOS upgrade as some settings can get reset.Most of these can be done through System Settings, but we list the Terminal commands here so you can include them in your deploy scripts.

Be smart

Read our guide on what NOT to do with your hosted Mac

Disable Spotlight indexing

Unless you are using the remote Mac as a desktop, Spotlight indexing is just overhead. We have seen it cause performance problems and interfere with other processes, sometimes affecting server stability. If you do not need search, just turn it off.

sudo mdutil -a -i off

Energy, sleep and boot settings

A headless server needs to come back up on its own after power events and should never go to sleep. These settings disable all sleep and hibernate modes, enable automatic restart after power loss, and set a daily wake schedule as a safety net in case the server was accidentally shut down.

Run these after every macOS upgrade, as they can get reset.

sudo systemsetup -setallowpowerbuttontosleepcomputer off
sudo systemsetup -setcomputersleep Off
sudo systemsetup -setrestartfreeze on
sudo pmset sleep 0
sudo pmset displaysleep 0
sudo pmset autorestart 1
sudo pmset autorestartatconnect 1
sudo pmset womp 1
sudo pmset repeat wakeorpoweron MTWRFSU 07:00:00
sudo pmset -c powernap 0
sudo pmset -a standby 0
sudo pmset -a disksleep 0
sudo pmset -a hibernatemode 0
sudo defaults write /Library/Preferences/com.apple.screensaver loginWindowIdleTime 0

A quick overview of what these do:

  • sleep, displaysleep, disksleep, standby, hibernatemode, powernap, computersleep: all set to off/0 to prevent the Mac from sleeping in any form.

  • autorestart: automatically boot after a power failure.

  • autorestartatconnect: automatically boot as soon as power is connected (no physical button press needed)

  • womp: wake on network access (Wake on LAN).

  • repeat wakeorpoweron: power on every day at 07:00 as a fallback.

  • restartfreeze: automatically restart if the system hangs.

  • loginWindowIdleTime: prevent the screen saver from activating at the login window, which can interfere with VNC sessions.

Disable Wi-Fi and Bluetooth

A server in a data center has a wired Ethernet connection. Wi-Fi and Bluetooth are unnecessary and can cause confusion. Disable both.

sudo networksetup -setnetworkserviceenabled Wi-Fi off
sudo networksetup -setnetworkserviceenabled "Bluetooth PAN" off
sudo networksetup -setnetworkserviceenabled "Bluetooth DUN" off

sudo defaults write /Library/Preferences/com.apple.Bluetooth ControllerPowerState 0
sudo defaults write /Library/Preferences/com.apple.Bluetooth BluetoothAutoSeekKeyboard 0
sudo defaults write /Library/Preferences/com.apple.Bluetooth BluetoothAutoSeekPointingDevice 0

Do not enable FileVault (unless you have a reason to)

We sometimes see customers enable FileVault full disk encryption as a general security measure. On a server, this usually causes more problems than it solves. FileVault prevents the Mac from booting unattended, which means after any reboot, power event, or kernel panic, your server sits at a password screen until you manually unlock it.

Your Mac's SSD is already hardware-encrypted by the Secure Enclave, and in our data center physical access is restricted to authorised staff. FileVault adds protection mainly against physical theft or us resetting your password through Recovery Mode. For most customers, that does not justify the risk of downtime after every unexpected reboot.

If you need to encrypt sensitive data on a running server, there are better options that do not affect boot. And if you have a compliance requirement that specifically demands full disk encryption, FileVault is the right tool, but make sure you understand the trade-offs.

See our article Encrypting Data on Your Hosted Mac and FileVault on your hosted Mac Servers for a full overview of your options.

Questions?

If you are unsure about any of these settings or need help checking your configuration, reach out to us