OpenClaw feels magical when the gateway stays up, channels reconnect after Wi-Fi blips, and your state directory is boring. It feels fragile when ~/.openclaw accidentally lives inside a synced folder, or when launchd starts before disks mount. This 2026 checklist targets dedicated Mac mini M4 hosts—like the ones you can rent on NodeMac with SSH/VNC in HK, JP, KR, SG, or US regions—so your automation behaves like infrastructure instead of a side project on a laptop.
Start from the long-form install narrative in comprehensive OpenClaw macOS installation, then tighten operations with doctor diagnostics and readiness probes & SLO. Secrets belong in the pattern described in secrets, env, and Keychain. Remote hands: VNC for permission prompts; pricing when you add hosts.
Why the state directory is the silent dependency
The gateway stores channel metadata, session caches, and local tool artifacts under the state path. If that path is subject to cloud sync, you will see intermittent SQLite or file-lock failures that do not correlate with code changes. If the path lives on an external volume, you must confirm mount order before launchd starts the gateway. On a dedicated cloud Mac, you control all three: disk layout, network stability, and reboot cadence.
Concrete rule: set OPENCLAW_STATE_DIR to /var/lib/openclaw (with correct ownership) or a service-user home subtree on APFS that is excluded from every sync client. Document the path in your CMDB.
Headless gateway expectations on Apple Silicon
Headless does not mean “no GUI ever”—it means no human is required for steady-state. Some macOS permissions still need one-time approval; plan a VNC session during bootstrap, then return to SSH automation. Pair the gateway with the launchd model your security team accepts: user LaunchAgents for developer-style hosts, stricter patterns for shared automation accounts.
- Bind addresses: confirm whether the gateway listens on loopback only or on a private RFC1918 interface; align firewall rules accordingly.
- Clock skew: enable NTP monitoring; JWT-style auth breaks silently when clocks drift.
- Log rotation: ship JSON logs off-host before disks fill; correlate with CI artifacts when channels flap.
Verification matrix before you declare production
| Check | Pass criteria | Owner |
|---|---|---|
| Doctor | No unresolved fatal errors; versions pinned in ticket | Platform engineer |
| Gateway status | Process healthy across reboot without manual login | On-call automation |
| Readiness probe | p95 < 200 ms from adjacent monitor (adjust to your SLO) | SRE |
| Secret rotation drill | Rotate LLM key without editing plist by hand | Security champion |
Failure modes we see on real M4 fleets
These are not hypotheticals—they are the tickets that reopen when documentation omits environment inheritance. If you recognize your incident here, jump to the token and plist alignment guide for deeper triage: gateway token & launchd drift.
- Interactive-only success: works in SSH session, fails at 03:00 after reboot—almost always missing plist environment.
- Silent partial startup: gateway binds alternate port when primary is busy; readiness checks still hit old port.
- Disk pressure: chatty debug logs plus retained traces fill APFS; add retention before enabling verbose channels.
FAQ
Can I keep OpenClaw state inside iCloud Drive on macOS?
No. Synced folders introduce file-lock races. Keep state on local APFS and treat the path like database storage.
Why use a dedicated cloud Mac instead of a laptop?
Uptime, networking, and ownership boundaries. Laptops sleep; cloud Macs stay reachable for webhooks and scheduled jobs.
What is the fastest verification after onboarding?
Doctor once, gateway status twice (before and after reboot), readiness probe from two vantage points on the network.