I Turned My M4 Mac Mini into a Powerful, Secure Headless Server

When the M4 Mac Mini first released back in late 2024, I was quick to pick one up. I had previously used the older Mac Mini M1, which was a good machine, but it only had 8GB of RAM and its Thunderbolt ports were much slower. So when I noticed that Apple released a Mac Mini with the newest M4 chip, and for an incredibly affordable price, I jumped ship and traded my old mini for the newer one... and it was a great choice!

But until now, I've been using it as a home server in the messiest way possible. I had Docker folders scattered across the desktop, scripts in my Downloads folder, and honestly just hoped nothing would break during every reboot...

Well that changes today! I've gotten tired of it and I decided to use it properly this time - so this is my attempt of turning my M4 Mac Mini into a powerful, headless server!

Clean Install & Preparing macOS

The first step was nuking the whole thing and starting fresh. Luckily, macOS makes this pretty easy:
System Settings > General > Transfer or Reset > Erase All Content & Settings

Before wiping the machine, I didn't forget to make a backup of my docker-compose.yml files scattered across the desktop, since those will come in handy after I finish the setup. I also made sure to backup my data with rsync just in-case, since I've been using an external drive to store my media.

About thirty minutes later and we're on a clean desktop! After going through the initial macOS setup, including creating my user account (I used admin as the username), it was ready to go.

But before disconnecting my monitor and peripherals, there are a few settings worth configuring first.

Enable SSH

First, we need to enable SSH for remote access by navigating to: System Settings > General > Sharing

Turn on Remote Login, then click the (i) button and make sure Allow full disk access for remote users is enabled. This allows us to access the entire filesystem during SSH sessions.

While you're here, make sure Local hostname is set to whatever you'd like, as it'll make your SSH connection much easier later (I'll be using server.local).

Optionally, you can also enable Remote Management as well in-case you need access over remote desktop (VNC). You can click the (i) icon and choose Options to enable certain permissions for computer access (like Control).

Enable FileVault

Now, let's make sure FileVault is enabled by heading to: System Settings > Privacy & Security > FileVault

If FileVault isn't already enabled, click Turn On and write down the recovery key displayed!

FileVault enables full-disk encryption of your Mac's disk to prevent unauthorized access if the machine is ever lost or stolen. The only disadvantage this comes with is that the drive must be unlocked after every reboot, but thankfully newer versions of macOS make it pretty easy to handle remotely (I'll cover that later)!

Configure Energy Settings

Finally, we need to adjust a few energy settings by navigating to: System Settings > Energy

Here, make sure all of these are enabled:

• Prevent automatic sleeping when the display is off
• Start up automatically after a power failure
• Wake for network access

At this point, we can finally shove the Mac Mini into our closet and finish everything remotely via SSH:

ssh admin@server.local

Installation & Setup

Next, we'll need to install some prerequisites. Since this is a headless setup, we'll be using Colima (aka. containers on Lima) instead of Docker Desktop.

Install Homebrew if you haven't already:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Then install Docker and Colima:

brew install docker docker-compose colima

Now, we need to create our Colima virtual machine:

colima start \
  -t vz \                    # use the macOS Virtualization.Framework as the VM type
  -c 10 \                    # allocate 10 CPU cores to the VM
  -m 16 \                    # allocate 16 GB of memory to the VM
  -d 128 \                   # set the VM's disk size to 128 GB
  -V /Volumes/primary:w \    # mount external volume into the VM with write perms
  --mount-type virtiofs \    # use virtiofs as the filesystem mount protocol (it's faster than sshfs!)
  --save-config              # save settings as the default

You can replace these configurations with whatever resource allocations you'd like, but I'm maxing it out since this computer won't be used for anything else. Replace /Volumes/primary with the path to your own drive, or remove it if you're not using an external drive.

And that's it! Once the Colima runtime starts, we can start our containers normally: docker-compose up -d

Handling Reboots

This is where things get a little interesting. If the Mac reboots, FileVault holds the boot process hostage at the login screen, meaning none of your services will start until someone "unlocks" it. Since we don't have a monitor plugged in, we'll need to do it over SSH.

Luckily, macOS 26 Tahoe introduced a pre-boot SSH server, which lets you SSH in before the OS fully loads.

After rebooting, wait about 30-60 seconds and SSH into the Mac as usual:

ssh admin@server.local

Upon first connection, the connection will drop immediately and you'll see a message like:

This system is locked. To unlock it, use a local account name and password. Once successfully unlocked, you will be able to connect normally.

This is completely normal - the Mac is just decrypting the drive and booting up during this process! Wait another minute, SSH back in, and start Colima manually:

colima start

Storage & External Drives

If you're using an external drive for your data (aka. the volume we mounted to Colima earlier), you may experience permission issues. This can occur when the drive's ownership is set to the root user, because Colima runs on the standard user account.

To solve this, you'll need to transfer drive ownership to your user account:

sudo chown -R $(whoami):staff /Volumes/primary  # transfer drive ownership
sudo chmod -R 770 /Volumes/primary              # standardize permissions across all files

Additionally, you should force auto-mounting of your external drives on system boot, or else they won't be accessible over SSH and you'll have to login using the OS interface:

sudo defaults write /Library/Preferences/SystemConfiguration/autodiskmount AutomountDisksWithoutUserLogin -bool true

Handling Encrypted Volumes

If you're using an external drive with APFS encryption like myself, you'll need to unlock it after every reboot as well:

diskutil apfs unlockVolume /Volumes/primary

Enter the passphrase to your drive when prompted, and you'll see "Unlocked and mounted APFS Volume" once it's ready!

Conclusion

And that's it!

With this new and improved setup, I've managed to turn my Mac mini into an organized, compact, fully headless server that I can manage entirely over SSH. Much better compared to the disorganized setup I started with.

What's next? I'll be attempting to install Coolify on my new headless setup to make management even easier! Check it out here.