How to set up a headless Mac mini that stays reachable

Do all of this while the monitor is still plugged in. Every step below is far easier with a screen attached, and two of them are close to impossible without one. The single most common way this goes wrong is unplugging the display first and then discovering that remote login was never switched on.

Step 1: turn on the two services you will need

There are two separate doors into a Mac and you want both, because they fail independently and each rescues the other. Screen Sharing gives you the graphical desktop over VNC. Remote Login gives you SSH, which keeps working when the window server is confused, the machine is under heavy load, or you simply want to run one command without waiting for a picture to arrive. Open System Settings, go to General and then Sharing, and switch on both Screen Sharing and Remote Login. You can do the same from the command line, which is worth knowing because it is how you will fix things later:

• sudo systemsetup -setremotelogin on - turns on SSH.
• sudo systemsetup -getremotelogin - confirms it took.
• scutil --get LocalHostName - shows the .local name you will use to reach the machine on your own network.

While you are in Sharing, give the machine a name you will actually recognise. A Mac called something like mini-server is much easier to live with than the default, which tends to be your full name with an apostrophe in it that then has to be escaped every time you type it.

Step 2: stop it going to sleep

This is the step people skip, and it produces the most confusing symptom: the machine works perfectly for an hour and then stops answering, apparently at random. A sleeping Mac does not respond to screen sharing or SSH. The pmset command controls all of this, and the -a flag applies the setting to every power source:

• sudo pmset -a sleep 0 - never put the system to sleep.
• sudo pmset -a disksleep 0 - keep the disks spinning, which matters if the machine serves files.
• sudo pmset -a displaysleep 0 - there is no display, but leaving this on can still confuse some remote clients.
• sudo pmset -a womp 1 - wake the machine when it receives a network packet, as a safety net.
• pmset -g - print the current settings so you can check your work.

One caveat worth knowing: on Apple silicon a Mac mini idles at a few watts, so leaving it awake permanently costs very little in electricity. This is much less of a trade-off than it was on Intel machines, and it is the right default for a server.

Step 3: make it survive a power cut

A machine on a shelf will eventually lose power, and the question is whether it comes back on its own or waits for you to walk over and press the button. Run sudo pmset -a autorestart 1 so the Mac powers itself back on after a power failure. In System Settings under Energy you will find the equivalent switch if you prefer clicking.

Then there is FileVault, and this is a genuine trade-off rather than a setting with a correct answer. With FileVault on, a Mac that reboots stops at the unlock screen and waits for a password before it finishes booting, which means no network, no SSH and no screen sharing until somebody types it. With FileVault off, the machine boots all the way to the login window or straight into the desktop if you have enabled automatic login, and comes back on its own. For a machine holding real data in a home you share with other people, keeping FileVault on and accepting the manual restart is the defensible choice. For a build box on a shelf with nothing sensitive on the disk, turning it off and enabling automatic login in Users and Groups is reasonable. Decide deliberately, because the failure mode only shows up weeks later during a power cut you are not home for.

Step 4: fix the resolution problem

With no display connected, macOS has no display to describe, so it falls back to a default that is often small and the wrong shape. You connect from your iPad expecting a desktop and get a cramped little rectangle in the corner. There are two ways out. The cheap and reliable one is a dummy HDMI plug - a two-pound adapter that pretends to be a monitor, so macOS sees a real display and offers real resolutions. The other is to use a remote tool that negotiates the resolution itself rather than inheriting whatever the Mac decided on its own. Apple silicon Macs handle the headless case better than Intel ones did, but the dummy plug is still the answer that always works, and it is worth buying one before you need it.

Step 5: reaching it from outside your network

Everything so far works on your own Wi-Fi. The moment you leave the house, both Screen Sharing and SSH stop being reachable, because your router does not accept unsolicited inbound connections and your home IP address changes when your provider feels like it. Many people are also behind carrier-grade NAT, which means there is no inbound path to forward even if you want one.

Port forwarding is the one to rule out immediately: exposing VNC or SSH directly to the internet puts them in front of automated scanners within hours, and it does not work behind CGNAT anyway. That leaves two real options. The first is to let an app solve the network for you, which is what Servey does - you sign in on both devices and the mini is reachable, with nothing open on your router and no dynamic DNS to maintain. The second is a mesh VPN such as Tailscale, which is genuinely good and worth knowing about: free for personal use, and it solves CGNAT properly. Its honest cost is that it is another service to install, keep updated and reason about on every device you own, and what it gives you is a network route rather than a usable screen and shell on a phone.

Driving it from an iPhone or iPad

The other approach is a tool that does the network part for you, and if the device in your hand is an iPhone or iPad this is where Servey fits. You install it on the Mac mini and on your phone or tablet, sign in with Google on both, and the mini appears - no VPN to maintain, no ports open, no dynamic DNS. On your own Wi-Fi it streams hardware-encoded HEVC, so the terminal text on a headless build box is sharp enough to read and you can pinch to zoom into it. Away from home it switches automatically to a private, end-to-end encrypted peer-to-peer link between your own two devices, and it holds up on mobile networks that defeat most tools.

The part that matters most for a headless machine is that Servey ships a real terminal next to the screen, one tap away. Most of what you do to a Mac mini on a shelf is command-line work - restart a service, tail a log, check why a job stalled, kick off a rebuild - and for that you do not want to wait for a desktop to render and then drive a mouse pointer with your thumb. Where it is honestly not the right fit: Servey is Apple-only, so if half your machines run Linux you want something else, and it cannot be self-hosted, which is the whole point of the mesh VPN approach for some people. It launches soon from $1.99 a month.

A sanity check before you unplug the monitor

• Screen Sharing and Remote Login are both on, and you have tested each from another device on the same network.
• pmset -g shows sleep and disksleep at 0.
• autorestart is enabled, and you have decided what you are doing about FileVault.
• The machine has a memorable name, and you know its .local address.
• You have a way in from outside the house - Servey, a mesh VPN, something - and you have tested it from mobile data rather than assuming.
• A dummy HDMI plug is either fitted or on order.

Bottom line

Setting up a headless Mac mini is less about any single clever trick and more about doing five ordinary things in the right order, while you still have a screen to do them on. Turn on both doors, stop it sleeping, make it come back after a power cut, give it a real resolution, and pick a way in from outside that does not involve opening a port. Do that and the machine will sit on its shelf and simply work, which is the entire reason to own one. For the last step, Servey is the shortest path if your other device is an iPhone or iPad: the mini's screen and a real shell in one app, sharp enough to read, with nothing exposed on your router and nothing to maintain. It launches soon from $1.99 a month.