[{"data":1,"prerenderedAt":1001},["ShallowReactive",2],{"content-index":3,"guide-en-self-hosting-mac-mini-home-server":80,"guides-navigation-en":906},{"en":4,"de":54,"es":67},{"paths":5,"docs":29},[6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28],"\u002Fdocs\u002Fgetting-started","\u002Fdocs\u002Flinux","\u002Fdocs\u002Fmacos","\u002Fdocs\u002Fwindows","\u002Fdocs\u002Fdocker","\u002Fdocs\u002Fcreate-api-key","\u002Fguides\u002Ffind-your-public-ip-address\u002Ffind-your-ip-address-on-linux","\u002Fguides\u002Ffind-your-public-ip-address\u002Ffind-your-ip-address-on-mac","\u002Fguides\u002Ffind-your-public-ip-address\u002Ffind-your-ip-address-on-windows","\u002Fguides\u002Ffind-your-public-ip-address","\u002Fguides\u002Fself-hosting\u002Fdocker-desktop-mac-client-ip","\u002Fguides\u002Fself-hosting\u002Fexpose-docker-containers-to-the-internet","\u002Fguides\u002Fself-hosting\u002Fexpose-home-server-to-internet","\u002Fguides\u002Fself-hosting\u002Fgetpublicip-vs-cloudflare-tunnel-vs-tailscale","\u002Fguides\u002Fself-hosting\u002Fmac-mini-home-server","\u002Fguides\u002Fself-hosting\u002Fport-forwarding-not-working","\u002Fguides\u002Fself-hosting\u002Fself-hosting-behind-carrier-grade-nat-cgnat","\u002Fguides\u002Fself-hosting\u002Fwireguard-simple-watchdog-script","\u002Fguides\u002Fstatic-public-ip-address\u002Fhow-to-get-a-public-ip-address","\u002Fguides\u002Fstatic-public-ip-address\u002Fhow-to-get-a-static-ip-address","\u002Fguides\u002Fstatic-public-ip-address","\u002Fguides\u002Fuse-cases\u002Fhome-server","\u002Fguides\u002Fuse-cases\u002Foffice-server",[30,34,38,42,46,50],{"path":6,"title":31,"icon":32,"stem":33},"Getting Started","mdi-file-document-outline","docs\u002F1.getting-started",{"path":7,"title":35,"icon":36,"stem":37},"Linux","mdi-linux","docs\u002F2.linux",{"path":8,"title":39,"icon":40,"stem":41},"macOS","mdi-apple","docs\u002F3.macos",{"path":9,"title":43,"icon":44,"stem":45},"Windows","mdi-microsoft-windows","docs\u002F3.windows",{"path":10,"title":47,"icon":48,"stem":49},"Docker","mdi-docker","docs\u002F4.docker",{"path":11,"title":51,"icon":52,"stem":53},"Create API Key","mdi-key","docs\u002F5.create-api-key",{"paths":55,"docs":58},[6,7,8,9,10,11,12,14,15,56,17,18,57,19,21,22,24,25,26,27,28],"\u002Fguides\u002Fself-hosting\u002Fdyndns-hinter-cgnat","\u002Fguides\u002Fself-hosting\u002Ffritzbox-portfreigabe-ds-lite",[59,61,62,63,64,65],{"path":6,"title":60,"icon":32,"stem":33},"Erste Schritte",{"path":7,"title":35,"icon":36,"stem":37},{"path":8,"title":39,"icon":40,"stem":41},{"path":9,"title":43,"icon":44,"stem":45},{"path":10,"title":47,"icon":48,"stem":49},{"path":11,"title":66,"icon":52,"stem":53},"API-Schlüssel erstellen",{"paths":68,"docs":71},[6,7,8,9,10,11,12,14,15,69,70,17,18,19,21,22,24,25,26,27,28],"\u002Fguides\u002Fself-hosting\u002Fcomo-saber-si-tengo-cgnat","\u002Fguides\u002Fself-hosting\u002Fddns-detras-de-cgnat",[72,74,75,76,77,78],{"path":6,"title":73,"icon":32,"stem":33},"Primeros pasos",{"path":7,"title":35,"icon":36,"stem":37},{"path":8,"title":39,"icon":40,"stem":41},{"path":9,"title":43,"icon":44,"stem":45},{"path":10,"title":47,"icon":48,"stem":49},{"path":11,"title":79,"icon":52,"stem":53},"Crear clave API",{"id":81,"title":82,"body":83,"createdAt":887,"description":888,"extension":889,"faq":890,"meta":898,"navigation":899,"path":20,"seo":902,"stem":903,"updatedAt":904,"__hash__":905},"content_en\u002Fguides\u002Fself-hosting\u002Fmac-mini-home-server.md","Mac mini Home Server: Setup, Power and Remote Access",{"type":84,"value":85,"toc":869},"minimark",[86,91,104,107,148,255,324,442,702,726,766,839,843],[87,88,90],"h1",{"id":89},"how-to-use-a-mac-mini-as-a-home-server","How to Use a Mac mini as a Home Server",[92,93,96],"guide-quick-answer",{"cta-title":94,"cta-text":95},"Behind CGNAT?","Get a dedicated public IPv4 and IPv6 that accepts inbound connections on any port, routed to your Mac mini.",[97,98,99,103],"p",{},[100,101,102],"strong",{},"A Mac mini makes a quiet, low-power home server."," Apple lists the M6 model at 4 W when idle. To run one unattended, stop it sleeping, set it to start again after a power cut, give it a fixed local address and turn on Remote Login. Then choose how the internet reaches it: port forwarding, Cloudflare Tunnel, Tailscale or a public IP of its own.",[97,105,106],{},"This guide comes from setting up a Mac mini on macOS 27.0.1 as a test server for our own software in November 2026. Where something here was tested on that machine, it says so.",[108,109,119,124],"v-sheet",{"className":110,"rounded":117,"max-width":118},[111,112,113,114,115,116],"mx-auto","pa-lg-4","pa-2","mt-2","mb-4","ma-0","","1200",[120,121,123],"h2",{"id":122},"key-takeaways","Key takeaways",[125,126,127,131,134,137,145],"ul",{},[128,129,130],"li",{},"The Mac mini idles at 4 W (Apple's figure for the M6 model), about 35 kWh a year if it did nothing else.",[128,132,133],{},"Before it can run unattended, it needs sleep turned off, a restart after power cuts, a fixed local IP address and Remote Login.",[128,135,136],{},"With FileVault on, it waits for a password after every restart. macOS 26 and later can unlock it over SSH.",[128,138,139,140,144],{},"Docker Desktop only runs while you're signed in, and containers behind its published ports see every visitor as ",[141,142,143],"code",{},"192.168.65.1",". Native apps don't have either problem.",[128,146,147],{},"Behind CGNAT, port forwarding can't work. Cloudflare Tunnel covers websites; anything else needs a public IP routed to the Mac. GetPublicIP for Mac does that from the Mac itself, and programs running on macOS see each visitor's real address.",[108,149,151,155,166,221,224,227,230],{"className":150,"rounded":117,"max-width":118},[111,112,113,114,115,116],[120,152,154],{"id":153},"why-a-mac-mini-works-as-a-server","Why a Mac mini works as a server",[97,156,157,158,165],{},"It uses very little power. These are Apple's own figures from its ",[159,160,164],"a",{"href":161,"rel":162},"https:\u002F\u002Fsupport.apple.com\u002F103253",[163],"nofollow","Mac mini power consumption page",", where idle means Finder open with the default power settings:",[167,168,169,185],"table",{},[170,171,172],"thead",{},[173,174,175,179,182],"tr",{},[176,177,178],"th",{},"Mac mini",[176,180,181],{},"Idle",[176,183,184],{},"Maximum",[186,187,188,200,211],"tbody",{},[173,189,190,194,197],{},[191,192,193],"td",{},"Mac mini (M6)",[191,195,196],{},"4 W",[191,198,199],{},"70 W",[173,201,202,205,208],{},[191,203,204],{},"Mac mini (M5 Pro)",[191,206,207],{},"6 W",[191,209,210],{},"145 W",[173,212,213,216,218],{},[191,214,215],{},"Mac mini (2024), M4",[191,217,196],{},[191,219,220],{},"65 W",[97,222,223],{},"At 4 W around the clock, that's about 35 kWh a year. A server that's actually serving uses more, but most home services sit near idle most of the time.",[97,225,226],{},"It's also quiet, small enough to sit next to a router, and macOS already includes several server features: file sharing, Time Machine backups to the Mac, SSH and screen sharing.",[97,228,229],{},"Where it falls short:",[125,231,232,241,249,252],{},[128,233,234,235,240],{},"There's no macOS Server any more. Apple ",[159,236,239],{"href":237,"rel":238},"https:\u002F\u002Fwww.macrumors.com\u002F2022\u002F04\u002F21\u002Fapple-discontinues-macos-server",[163],"discontinued it on 21 April 2022","; file sharing, Time Machine and caching moved into macOS. Everything else comes from Homebrew, native apps or Docker.",[128,242,243,244,248],{},"Docker runs in a virtual machine. Linux containers need Docker Desktop (or OrbStack), which reserves memory for its VM and changes how network traffic reaches containers. See ",[159,245,247],{"href":246},"#native-apps-or-docker","Native apps or Docker",".",[128,250,251],{},"There are no drive bays, so a media library usually lives on a USB or Thunderbolt drive.",[128,253,254],{},"macOS updates restart it, which matters most with FileVault on (see below).",[108,256,258,262,271,301,304,309,312,321],{"className":257,"rounded":117,"max-width":118},[111,112,113,114,115,116],[120,259,261],{"id":260},"set-up-macos-to-run-unattended","Set up macOS to run unattended",[97,263,264,265,270],{},"Apple has its own short checklist, ",[159,266,269],{"href":267,"rel":268},"https:\u002F\u002Fsupport.apple.com\u002Fguide\u002Fmac-mini\u002Fapd05a94454f\u002Fmac",[163],"Set up your Mac mini as a server",". These are the steps that matter for a home server, in order:",[272,273,274,283,286,292,295,298],"ol",{},[128,275,276,277,282],{},"Stop it sleeping. Open System Settings › Energy and turn on \"Prevent automatic sleeping when the display is off\". Turn on \"Wake for network access\" too. These are the names in Apple's ",[159,278,281],{"href":279,"rel":280},"https:\u002F\u002Fsupport.apple.com\u002Fguide\u002Fmac-help\u002Fmchle41a6ccd\u002Fmac",[163],"sleep and wake settings",". A sleeping Mac answers nothing.",[128,284,285],{},"Make it start again after a power cut. In the same Energy settings, Apple's server checklist points to the \"Start up when power is connected\" option.",[128,287,288,289,248],{},"Give it a fixed local IP address. Either reserve an address for it in your router, or set it on the Mac: System Settings › Network › your connection › Details › TCP\u002FIP, and choose \"Using DHCP with manual address\". Apple's checklist recommends this. Our test Mac keeps its address this way; the Terminal equivalent is ",[141,290,291],{},"networksetup -setmanualwithdhcprouter Wi-Fi 192.168.1.50",[128,293,294],{},"Turn on Remote Login and Screen Sharing in System Settings › General › Sharing, so you can manage it without a display. Remote Login is SSH.",[128,296,297],{},"Decide what happens with FileVault (next section).",[128,299,300],{},"Leave the firewall's \"Block all incoming connections\" off. Apple's checklist suggests turning the macOS firewall on, which is fine: it may ask once whether each program can accept connections. \"Block all incoming connections\" refuses connections to every program, so nothing on the server can be reached.",[97,302,303],{},"Wi-Fi works, but Ethernet is steadier, and in one published test the FileVault unlock over SSH first worked only over Ethernet (see below).",[305,306,308],"h3",{"id":307},"filevault-and-restarts","FileVault and restarts",[97,310,311],{},"With FileVault on, a Mac that restarts, after an update or a power cut, stops at the login window until someone types a password. Nothing you've installed starts before that, and Apple turns off automatic login while FileVault is on.",[97,313,314,315,320],{},"macOS 26 and later can be unlocked over SSH: if Remote Login is on, you can connect before anyone has logged in and enter an administrator's password, and the Mac finishes starting up. Jeff Geerling ",[159,316,319],{"href":317,"rel":318},"https:\u002F\u002Fwww.jeffgeerling.com\u002Fblog\u002F2025\u002Fyou-can-finally-manage-macs-filevault-remotely-tahoe\u002F",[163],"tested this on a Mac mini"," and found it worked over Ethernet but not Wi-Fi at first, and over Wi-Fi as well from macOS 26.5.",[97,322,323],{},"So a FileVault Mac mini can stay encrypted and still be managed remotely, as long as someone can SSH in after each restart. Turning FileVault off avoids that, but leaves the disk unencrypted if the Mac is stolen.",[108,325,327,330,333,398,418,421,439],{"className":326,"rounded":117,"max-width":118},[111,112,113,114,115,116],[120,328,247],{"id":329},"native-apps-or-docker",[97,331,332],{},"Most self-hosted software runs either directly on macOS or in Docker Desktop. On a Mac the choice affects more than it does on Linux:",[167,334,335,347],{},[170,336,337],{},[173,338,339,341,344],{},[176,340],{},[176,342,343],{},"Native (Homebrew or an app)",[176,345,346],{},"Docker Desktop",[186,348,349,364,377,387],{},[173,350,351,354,361],{},[191,352,353],{},"Starts after a restart",[191,355,356,357,360],{},"Yes, with ",[141,358,359],{},"sudo brew services start"," (a launch daemon, started at boot)",[191,362,363],{},"Only once you sign in to the Mac",[173,365,366,369,372],{},[191,367,368],{},"Sees each visitor's real IP address",[191,370,371],{},"Yes",[191,373,374,375],{},"No: containers see ",[141,376,143],{},[173,378,379,382,385],{},[191,380,381],{},"Runs Linux-only software",[191,383,384],{},"No",[191,386,371],{},[173,388,389,392,395],{},[191,390,391],{},"Memory",[191,393,394],{},"Only what the program uses",[191,396,397],{},"Plus the memory reserved for Docker's VM",[97,399,400,401,404,405,408,409,412,413,248],{},"With Homebrew, ",[141,402,403],{},"brew services start \u003Cformula>"," starts a service and runs it again at every login. With ",[141,406,407],{},"sudo",", it's installed in ",[141,410,411],{},"\u002FLibrary\u002FLaunchDaemons"," and starts at boot instead, which is what a server wants. That's from Homebrew's ",[159,414,417],{"href":415,"rel":416},"https:\u002F\u002Fdocs.brew.sh\u002FManpage",[163],"own documentation",[97,419,420],{},"Docker Desktop is an app that runs in your user session. It starts when you sign in, if \"Start Docker Desktop when you sign in to your computer\" is on, and not before. A Mac mini that restarts runs no containers until someone signs in, at the Mac or over Screen Sharing.",[97,422,423,424,426,427,430,431,434,435,438],{},"Docker Desktop also hides visitors' addresses. It relays each published port through its own process on the Mac, so every container behind one sees the visitor as ",[141,425,143],{},". Logs, rate limits and fail2ban stop working properly. We measured this on our test Mac; ",[159,428,429],{"href":16},"why Docker on a Mac sees 192.168.65.1"," has the details and the fixes. Publish ports as ",[141,432,433],{},"\"80:80\"",", not ",[141,436,437],{},"\"0.0.0.0:80:80\"",": the second accepts IPv4 only.",[97,440,441],{},"One more macOS detail: it lets a program that isn't root listen on port 80 or 443 as long as it listens on all addresses. Binding one specific address on those ports fails with \"permission denied\" unless the program runs as root. We hit this on our test Mac.",[108,443,445,449,468,478,565,582,585,596,599,603,613,631,640,643,680,683,687,699],{"className":444,"rounded":117,"max-width":118},[111,112,113,114,115,116],[120,446,448],{"id":447},"make-it-reachable-from-the-internet","Make it reachable from the internet",[97,450,451,452,455,456,459,460,463,464,467],{},"First, check whether your connection can accept inbound connections at all. Compare your router's WAN address with your public IP address (",[141,453,454],{},"curl -4 ip.getpublicip.com"," in Terminal). If they differ, or the WAN address is between ",[141,457,458],{},"100.64.0.0"," and ",[141,461,462],{},"100.127.255.255",", your ISP uses CGNAT and port forwarding can't work. ",[159,465,466],{"href":15},"How to find your public IP address"," has the details.",[97,469,470],{},[471,472],"img",{"alt":473,"className":474,"src":477},"Comparison diagram of five ways to expose a home server to the internet and how traffic flows for each",[475,476],"w-100","my-4","\u002Fimages\u002Fguides\u002Fhome_server_exposure_methods.svg",[167,479,480,499],{},[170,481,482],{},[173,483,484,487,490,493,496],{},[176,485,486],{},"Method",[176,488,489],{},"Works behind CGNAT",[176,491,492],{},"What it carries",[176,494,495],{},"Visitors need software",[176,497,498],{},"Cost",[186,500,501,516,534,550],{},[173,502,503,506,508,511,513],{},[191,504,505],{},"Port forwarding on your router",[191,507,384],{},[191,509,510],{},"Any TCP or UDP port",[191,512,384],{},[191,514,515],{},"Free",[173,517,518,521,523,529,532],{},[191,519,520],{},"Cloudflare Tunnel",[191,522,371],{},[191,524,525,526],{},"Websites; other TCP only for visitors running ",[141,527,528],{},"cloudflared",[191,530,531],{},"No, for websites",[191,533,515],{},[173,535,536,539,541,544,547],{},[191,537,538],{},"Tailscale",[191,540,371],{},[191,542,543],{},"Anything, between your own devices; Funnel publishes TLS on ports 443, 8443 and 10000",[191,545,546],{},"Yes, except through Funnel",[191,548,549],{},"Free personal plan",[173,551,552,555,557,560,562],{},[191,553,554],{},"A public IP address (GetPublicIP)",[191,556,371],{},[191,558,559],{},"Any TCP or UDP port, IPv4 and IPv6",[191,561,384],{},[191,563,564],{},"$8.99 a month per address",[97,566,567,568,576,577,248],{},"The sources: Cloudflare says non-HTTP services ",[159,569,572,573,575],{"href":570,"rel":571},"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fconnections\u002Fconnect-networks\u002Frouting-to-tunnel\u002Fprotocols\u002F",[163],"\"require installing ",[141,574,528],{}," on the client\"",", and Tailscale says ",[159,578,581],{"href":579,"rel":580},"https:\u002F\u002Ftailscale.com\u002Fkb\u002F1223\u002Ftailscale-funnel",[163],"\"Funnel can only listen on ports 443, 8443, and 10000\"",[97,583,584],{},"Which to pick:",[125,586,587,590,593],{},[128,588,589],{},"For a website or web app behind CGNAT, Cloudflare Tunnel is free and usually enough.",[128,591,592],{},"If only you and your family need access, use Tailscale, with its app on each device.",[128,594,595],{},"Game servers, mail, VoIP, and anything else other people connect to with their own software need a public IP address on the Mac's side, either from your ISP with port forwarding, or routed to the Mac over a tunnel.",[97,597,598],{},"GetPublicIP gives you a dedicated public IPv4 and IPv6 address routed to your server over an encrypted WireGuard tunnel, with any TCP or UDP port forwarded. On a Mac mini you can use it through our Mac app or our Docker image.",[305,600,602],{"id":601},"with-getpublicip-for-mac","With GetPublicIP for Mac",[97,604,605,608,609,612],{},[159,606,607],{"href":8},"GetPublicIP for Mac"," (beta) connects the Mac itself. It runs on macOS 15 Sequoia or later, and ",[159,610,611],{"href":8},"the setup guide"," has each step with screenshots:",[272,614,615,618,625],{},[128,616,617],{},"Drag the app into Applications, open it, and approve its network extension in System Settings. macOS asks for that once.",[128,619,620,621,624],{},"Sign in with your IP address's ",[159,622,623],{"href":11},"API key",". The app downloads its configuration and connects; there's no config file to import.",[128,626,627,628,248],{},"Add a port mapping for each service in the Port Mappings tab. The Listening column shows whether a service listens on all addresses, which forwarded connections need, or only on ",[141,629,630],{},"127.0.0.1",[97,632,633,634,636,637,639],{},"Programs running directly on macOS then see each visitor's real address, over IPv4 and IPv6. Containers in Docker Desktop still see ",[141,635,143],{},", because Docker Desktop's relay sits in between (see ",[159,638,247],{"href":246},").",[97,641,642],{},"For a server, three settings matter:",[125,644,645,655,666],{},[128,646,647,654],{},[100,648,649,650,653],{},"Leave ",[141,651,652],{},"Reconnect automatically"," on",", in the Connection tab. macOS then brings the tunnel back after a restart, sleep or a change of network, even with the app closed. Our test Mac signs in automatically; after a restart, the tunnel was back about 6 seconds after login and its port mappings answered on IPv4 and IPv6. We haven't yet tested whether it connects before anyone signs in, so if your Mac waits at the login window after a restart, check that it reconnected once someone signs in.",[128,656,657,660,661,665],{},[100,658,659],{},"Choose an outbound mode."," Full tunnel, the default, sends all the Mac's traffic out from your GetPublicIP address. Split tunnel keeps outbound traffic, such as downloads and updates, on your home connection. Port mappings work in both, with one exception for UDP services in Split tunnel, which ",[159,662,664],{"href":663},"\u002Fdocs\u002Fmacos#troubleshooting","the docs"," explain.",[128,667,668,671,672,675,676,679],{},[100,669,670],{},"Turn on the command line if you manage the Mac over SSH."," With Settings › General › Command line turned on, ",[141,673,674],{},"getpublicip status"," shows the tunnel and the address, and ",[141,677,678],{},"getpublicip doctor"," checks the tunnel, every port mapping and the macOS firewall, all from an SSH session.",[97,681,682],{},"The Mac must still stay awake. A sleeping Mac answers nothing, through the tunnel or otherwise.",[305,684,686],{"id":685},"with-the-docker-image","With the Docker image",[97,688,689,690,694,695,698],{},"GetPublicIP also runs on a Mac as our ",[159,691,693],{"href":692},"\u002Fdocs\u002Fdocker#macos","Docker image in Docker Desktop",", forwarding ports to your other containers. Docker Desktop's limits above apply to it: it runs while you're signed in. Its option for passing visitors' real addresses to your containers (",[141,696,697],{},"GETPUBLICIP_PRESERVE_CLIENT_IP",") works on Linux, and we haven't tested it on a Mac yet.",[97,700,701],{},"Use one or the other for each IP address. The app and the Docker image signed in with the same API key fight over the connection.",[108,703,705,709],{"className":704,"rounded":117,"max-width":118},[111,112,113,114,115,116],[120,706,708],{"id":707},"what-people-run-on-a-mac-mini-server","What people run on a Mac mini server",[125,710,711,714,717,720,723],{},[128,712,713],{},"Plex Media Server and Jellyfin both have native macOS builds, so they see each visitor's real address and start without Docker.",[128,715,716],{},"File sharing and Time Machine backups are built into macOS, under System Settings › General › Sharing. Other Macs on your network can back up to it.",[128,718,719],{},"Websites and web apps run with Caddy or nginx from Homebrew, or in Docker Desktop.",[128,721,722],{},"A Minecraft Java server runs natively with Java. Players connect with the game itself, which can't use Cloudflare Tunnel without extra software on every player's computer, so a game server needs port forwarding or a public IP address.",[128,724,725],{},"BlueBubbles is an open-source server that relays iMessage from a Mac to Android, Windows and web clients. It needs a Mac signed in to iMessage, which makes it one of the few servers only a Mac can run.",[108,727,729,733],{"className":728,"rounded":117,"max-width":118},[111,112,113,114,115,116],[120,730,732],{"id":731},"common-mistakes","Common mistakes",[125,734,735,738,741,747,754,757,763],{},[128,736,737],{},"The Mac goes to sleep, and everything stops answering after the display turns off. Turn on \"Prevent automatic sleeping when the display is off\".",[128,739,740],{},"FileVault is on and the power goes off. The Mac sits at the login window and nothing starts. Plan how you'll unlock it, or decide to turn FileVault off.",[128,742,743,744,746],{},"A service listens only on ",[141,745,630],{},". It's reachable from the Mac itself and from nowhere else. Make it listen on all addresses.",[128,748,749,750,753],{},"A Docker port is published as ",[141,751,752],{},"0.0.0.0:port:port",". IPv6 visitors are refused. Leave the address out.",[128,755,756],{},"\"Block all incoming connections\" is on in the macOS firewall. It blocks every server on the Mac.",[128,758,759,760,248],{},"Port forwarding is set up behind CGNAT. The rule on your router is correct, and nothing arrives, because the ISP drops it first. See ",[159,761,762],{"href":21},"port forwarding not working",[128,764,765],{},"One API key is in use on two devices, such as GetPublicIP for Mac and the Docker image. They fight over the connection. Use each IP address on one device.",[108,767,769,773,785,794,803,812,821,830],{"className":768,"rounded":117,"max-width":118},[111,112,113,114,115,116],[120,770,772],{"id":771},"frequently-asked-questions","Frequently Asked Questions",[774,775,778,782],"details",{"className":776},[777],"faq-item",[779,780,781],"summary",{},"Is a Mac mini a good home server?",[97,783,784],{},"For most home services, yes. Apple lists the Mac mini (M6) at 4 W when idle, it's silent, and macOS includes file sharing, Time Machine and SSH. The trade-offs: Docker runs inside a virtual machine, storage beyond the internal drive is external, and macOS updates restart it. It needs a few settings changed before it can run unattended.",[774,786,788,791],{"className":787},[777],[779,789,790],{},"How much power does a Mac mini use as a server?",[97,792,793],{},"Apple's figures are 4 W idle and 70 W maximum for the Mac mini (M6), and 4 W idle and 65 W maximum for the 2024 model with M4. Running at idle around the clock, 4 W comes to about 35 kWh a year. A server that's doing work uses more.",[774,795,797,800],{"className":796},[777],[779,798,799],{},"How do I stop a Mac mini from sleeping?",[97,801,802],{},"Open System Settings › Energy and turn on Prevent automatic sleeping when the display is off. Turn on Wake for network access as well. Apple's server checklist also suggests setting the Mac mini to start up again when power is restored after an outage.",[774,804,806,809],{"className":805},[777],[779,807,808],{},"Is there still a macOS Server app?",[97,810,811],{},"No. Apple discontinued macOS Server on 21 April 2022. File sharing, Time Machine backups to the Mac and content caching are built into macOS, and other server software, such as web servers, databases and media servers, installs from Homebrew, as native apps, or in Docker.",[774,813,815,818],{"className":814},[777],[779,816,817],{},"Can I run a Mac mini server without a monitor?",[97,819,820],{},"Yes. Turn on Remote Login (SSH) and Screen Sharing in System Settings › General › Sharing before you unplug the display. If FileVault is on, the Mac waits for a password after every restart; macOS 26 and later can be unlocked over SSH when Remote Login is on.",[774,822,824,827],{"className":823},[777],[779,825,826],{},"Can I host a website on a Mac mini behind CGNAT?",[97,828,829],{},"Yes, but not with port forwarding, because CGNAT stops inbound connections before they reach your router. Cloudflare Tunnel is free and works well for websites. For other protocols, game servers or anything that needs the visitor's real IP address, you need a public IP address routed to the Mac. GetPublicIP for Mac does that: it connects the Mac to a dedicated public IPv4 and IPv6 address and forwards the ports you choose.",[774,831,833,836],{"className":832},[777],[779,834,835],{},"Does GetPublicIP for Mac reconnect after the Mac mini restarts?",[97,837,838],{},"Yes, if Reconnect automatically is on in the app's Connection tab. macOS then brings the tunnel back after a restart, sleep or a network change, even with the app closed. On our test Mac, which signs in automatically, it was back about 6 seconds after login. We haven't yet tested whether it connects before anyone signs in.",[120,840,842],{"id":841},"related-guides","Related guides",[125,844,845,851,857,863],{},[128,846,847,850],{},[159,848,849],{"href":16},"Why Docker on a Mac sees 192.168.65.1",": the client IP problem, and the fixes",[128,852,853,856],{},[159,854,855],{"href":18},"How to expose your home server to the internet",": the five methods, compared",[128,858,859,862],{},[159,860,861],{"href":22},"Self-hosting behind CGNAT",": what CGNAT is and how to get round it",[128,864,865,868],{},[159,866,867],{"href":19},"GetPublicIP vs Cloudflare Tunnel vs Tailscale",": a closer comparison",{"title":117,"searchDepth":870,"depth":870,"links":871},2,[872,873,874,878,879,883,884,885,886],{"id":122,"depth":870,"text":123},{"id":153,"depth":870,"text":154},{"id":260,"depth":870,"text":261,"children":875},[876],{"id":307,"depth":877,"text":308},3,{"id":329,"depth":870,"text":247},{"id":447,"depth":870,"text":448,"children":880},[881,882],{"id":601,"depth":877,"text":602},{"id":685,"depth":877,"text":686},{"id":707,"depth":870,"text":708},{"id":731,"depth":870,"text":732},{"id":771,"depth":870,"text":772},{"id":841,"depth":870,"text":842},"2026-11-03","Set up a Mac mini as a home server: sleep and power settings, FileVault after a restart, Docker or native apps, and how to reach it from the internet.","md",[891,892,893,894,895,896,897],{"question":781,"answer":784},{"question":790,"answer":793},{"question":799,"answer":802},{"question":808,"answer":811},{"question":817,"answer":820},{"question":826,"answer":829},{"question":835,"answer":838},{},{"title":900,"icon":40,"description":901},"Mac mini as a Home Server","Set up a Mac mini to run unattended as a home server, choose native apps or Docker, and make it reachable from the internet.",{"title":82,"description":888},"guides\u002Fself-hosting\u002Fmac-mini-home-server","2026-11-05","2Y8J_xgJd59SvFcszXDtlt3CHBhbLnrveYLcDnTsPmg",[907,926,972,986],{"path":15,"title":908,"icon":909,"children":910},"Find Your Public IP Address","mdi-folder",[911,917,922],{"path":12,"title":912,"navigation":913},"Get Your Public IP on Linux: One curl Command (2026)",{"title":914,"icon":915,"description":916},"Find your IP Address on Linux","mdi-penguin","Find your public and local IP address on Linux using curl, wget, dig, and built-in tools.",{"path":13,"title":918,"navigation":919},"How to Find Your IP Address on a Mac (Local and Public)",{"title":920,"icon":40,"description":921},"Find your IP Address on Mac","Find your local and public IP address on macOS in System Settings or Terminal, and check whether you're behind CGNAT.",{"path":14,"title":923,"navigation":924},"Find your IP Address on Windows",{"title":923,"icon":44,"description":925},"Find your public and local IP address on Windows using PowerShell and Command Prompt.",{"path":927,"title":928,"icon":909,"children":929},"\u002Fguides\u002Fself-hosting","Self Hosting",[930,935,940,946,952,954,960,966],{"path":16,"title":931,"navigation":932},"Docker on Mac Sees 192.168.65.1? Why, and How to Fix It",{"title":933,"icon":48,"description":934},"Docker on Mac Sees 192.168.65.1","Why containers in Docker Desktop for Mac see 192.168.65.1 instead of the client's IP address, and the fixes that work.",{"path":17,"title":936,"navigation":937},"How to Expose Docker Containers to the Internet (Without Port Forwarding)",{"title":938,"icon":48,"description":939},"Expose Docker Containers to the Internet","Four ways to make a Docker Compose stack reachable from the internet, and why a dedicated public IP needs no published ports at all.",{"path":18,"title":941,"navigation":942},"Expose a Home Server to the Internet: 5 Methods (2026)",{"title":943,"icon":944,"description":945},"Expose Your Home Server to the Internet","mdi-server-network","Five realistic methods to make your home server reachable from the internet, from port forwarding to a dedicated public IP.",{"path":19,"title":947,"navigation":948},"GetPublicIP vs Cloudflare Tunnel vs Tailscale for Self-Hosting",{"title":949,"icon":950,"description":951},"GetPublicIP vs Cloudflare vs Tailscale","mdi-compare","Compare GetPublicIP, Cloudflare Tunnel and Tailscale for self-hosting servers at home or the office.",{"path":20,"title":82,"navigation":953},{"title":900,"icon":40,"description":901},{"path":21,"title":955,"navigation":956},"Port Forwarding Not Working? 6 Causes & Fixes (2026)",{"title":957,"icon":958,"description":959},"Port Forwarding Not Working?","mdi-lan-disconnect","Diagnose the 6 most common reasons port forwarding fails and learn how to fix each one, including the hidden CGNAT problem.",{"path":22,"title":961,"navigation":962},"How to Self-Host Behind CGNAT: Bypass It (2026)",{"title":963,"icon":964,"description":965},"What is carrier grade NAT?","mdi-lan-pending","Learn what CGNAT is, how to check if you're behind it, which ISPs use it, and how to self-host a real public IP bypassing carrier-grade NAT.",{"path":23,"title":967,"navigation":968},"WireGuard Simple Watchdog Script",{"title":969,"icon":970,"description":971},"WireGuard Watchdog Script","mdi-shield-check","A simple watchdog script to monitor and restart WireGuard connections when network conditions change.",{"path":26,"title":973,"icon":909,"children":974},"Static Public IP Address",[975,981],{"path":24,"title":976,"navigation":977},"How to Get a Public IP Address (4 Methods, 2026)",{"title":978,"icon":979,"description":980},"How to get a public IP address","mdi-earth","What a public IP is, how to check yours, and 4 ways to get a dedicated public IP for self-hosting.",{"path":25,"title":982,"navigation":983},"How to get a static IP address",{"title":982,"icon":984,"description":985},"mdi-ip-network","We discuss what a static IP address is, what your options are to get one, and the best way to get a static IP address.",{"path":987,"title":988,"icon":909,"children":989},"\u002Fguides\u002Fuse-cases","Use Cases",[990,996],{"path":27,"title":991,"navigation":992},"Self-Hosting at Home - Privacy & Independence",{"title":993,"icon":994,"description":995},"Home Server Solutions","mdi-home-account","Build a sovereign personal cloud. Get a public IP address delivered to your home server so you can run your own email and chat services.",{"path":28,"title":997,"navigation":998},"Office Server Solutions & Benefits",{"title":999,"icon":944,"description":1000},"Office Server Solutions","Discover why forward-thinking companies are moving specific workloads back to the office to reduce cloud spend and increase agility.",1793914025639]