Buildsmacosalways-on

Turning an old Mac into a permanent worker

Christian Drexler

I have an older MacBook that stopped being a laptop two years ago. It sits on a shelf with the lid closed, runs scheduled jobs and the occasional build, and I touch it through SSH when something needs attention. It cost nothing because I already owned it, and it has been more reliable than the small cloud box it replaced. Here is the setup, in the order I would do it again.

A dedicated user

Make a fresh standard user for the jobs. Not your own account, because your account has your browser, your keychain and your habit of logging out. The worker user owns the scripts, the logs and nothing else. Give it a home directory outside anything you sync.

Auto-login

System Settings, Users and Groups, Automatic login, pick the worker user. Without this a reboot (and macOS reboots for updates whether you like it or not) lands on the login screen and nothing that runs in a user session starts. If FileVault is on, automatic login is greyed out; for a shelf machine on your own network I turn FileVault off and accept that.

Never sleep, lid closed

This is the part most guides get half right. The lid-closed case has its own rule: a MacBook with a closed lid stays awake only while it is on power and sleep is disabled for the charger profile.

sudo pmset -c sleep 0 disksleep 0 displaysleep 10
sudo pmset -c womp 1
sudo pmset -a hibernatemode 0

-c is the charger profile, which is the only one that matters since the machine is never on battery. womp is wake on network access. hibernatemode 0 keeps it from writing memory to disk on the rare sleep it still takes. Check with pmset -g and look for sleep 0 in the output. I do not use caffeinate as a permanent thing; if one job needs the machine awake for certain, wrap that job in caffeinate -i and leave the system rules to pmset.

Screen Sharing off, Tailscale on

Screen Sharing stays off. I never need the desktop, and an open VNC port on a machine that logs itself in is a bad combination. Remote Login (SSH) stays on. For reaching it from outside the house I use Tailscale, which gives the machine a stable name and an encrypted path without opening anything on the router. Install it, sign in once as the worker user, and tick "start at login".

What to check after a macOS update

Updates reset more than they admit. My list, run once the machine comes back:

  • pmset -g still shows sleep 0 for the charger profile
  • automatic login still points at the worker user
  • Remote Login still on, Screen Sharing still off
  • Tailscale is up and the machine answers on its Tailscale name
  • every scheduled job has written to its log since the reboot

The last line is the one that catches real problems. A job that started fine for a year can stop after an update because a permission prompt appeared on a desktop nobody is looking at. If a log goes quiet, turn Screen Sharing on for ten minutes, log in once, approve whatever is waiting, turn it off again.

It is not glamorous. It is an old laptop with four settings changed, and it has been running longer than most things I pay for.

macosalways-onhardware