Mac Studio, step by step¶

The example: Northwind, domain corp.example. A Mac Studio in the server closet becomes the office AI server at ai.corp.example: the model runs on its GPU, and Gate, the chat and HTTPS run next to it. The Mac does not join the domain.

What you end with: a private AI that never leaves the building. Each person's AI sees only what that person can open, under your guardrails, with a full audit trail.

Time: about an hour, plus the model download.

Which Mac¶

Mac	Memory	Model the installer picks
Mac Studio M5 Ultra	256 GB or more	Qwen 3.8 Flash-Next (`qwen3.8-flash-next:125b-mlx`, about 105 GB)
Mac Studio M5 Max	48 GB or more	Qwen 3.8 27B (`qwen3.8:27b`)

Smaller Macs work for a trial but run smaller models. macOS 13 or later.

What you need¶

The Mac on your network with a fixed IP, and ai.corp.example pointing at it in DNS.
An admin account on the Mac (you run the installer as yourself, not with sudo).
Homebrew installed.
The Ollama app from ollama.com/download, opened once.
A domain admin for about ten minutes, and your license file.

Step 1. Keep the Mac awake¶

An office server must not sleep. In System Settings:

Energy (or Battery → Options on some versions): turn on Prevent automatic sleeping when the display is off and Start up automatically after a power failure.
Users & Groups → Automatically log in as: your admin user. The model and containers run in your user session, so after a power cut the Mac must log back in on its own. (Turn off FileVault's login screen for this, or accept that someone must sign in after a restart.)

Step 2. The service account in Active Directory¶

Exactly as on Linux: create gate-svc, tick the two AES boxes, add HTTP/ai.corp.example, and set constrained delegation to cifs on your file servers and DCs. Follow Linux appliance, step 1.

Step 3. Install¶

In Terminal, as yourself:

curl -fsSLO https://get.acutisgo.com/dl/AcutisGate-Mac.tar.gz
tar xzf AcutisGate-Mac.tar.gz && cd AcutisGate-Linux-*
bash install.sh --name ai.corp.example --license ~/Downloads/acutis-gate.license

What happens:

If no container runtime is running (Docker Desktop, OrbStack or Colima), it installs Colima with Homebrew and starts it.
It installs Homebrew's OpenSSL for the certificate.
It pulls the model into the Ollama app by your Mac's memory, so it runs on the GPU. The first download is large; let it finish.
Gate, Postgres, HTTPS and the Open WebUI chat start in containers. Everything lives in ~/AcutisGate.

A firewall prompt

macOS may ask whether to allow incoming connections (for Colima or Docker). Click Allow, or people on the network cannot reach Gate.

Step 4. Start everything after a restart¶

Ollama: the app adds itself to Login Items. Check System Settings → General → Login Items lists it.
Colima (if the installer set it up): make it start at login:
```
brew services start colima
```
Docker Desktop and OrbStack have their own "start at login" setting.

The Gate containers restart by themselves once the runtime is up.

Step 5. The rest is the same as Linux¶

First admin and license: Linux step 3.
The certificate: the installer made a Gate CA. Trust ~/AcutisGate/gate-appliance/tls/ca.crt on your PCs by Group Policy, or install your own certificate with --cert/--key: Linux, the certificate.
Connect Active Directory: Linux step 4.
Windows sign-in: Linux step 5.
The chat: https://ai.corp.example:8443. The model is already there. For the company connection, edit ~/AcutisGate/gate-appliance/.env and run docker compose up -d open-webui in that folder: Linux step 6.
File shares, guardrails, prove it.

Day two¶

Task	How
Is it running?	`cd ~/AcutisGate/gate-appliance && docker compose ps`
Logs	`docker compose logs gate --tail 200` (same folder)
Model	`ollama ps` shows what is loaded and that it is on the GPU.
Upgrade	Download the new package, unpack, `bash install.sh --name ai.corp.example` again.
Back up	`~/AcutisGate/gate-appliance/.env` and `tls/`.
Stop everything	`docker compose stop` in that folder, then `colima stop` (if you use Colima).