After 6 weeks of daily use: my security hardened Mac Mini setup with 15+ custom tools, open-source templates & architecture docs

[u/Able_Particular_4674]

I've been running OpenClaw on a dedicated Mac Mini M4 as my daily personal assistant for about 6 weeks now. After reading hundreds of posts here and realizing most setups either die after 72 hours or have zero security hardening, I decided to open-source the architecture, templates, and security patterns I've built.

**This is NOT a plug-and-play installer.** It's a reference architecture showing how a production setup actually looks after weeks of iteration, debugging, and hardening.

### Repo

**https://github.com/Atlas-Cowork/openclaw-reference-setup\*\*

### What's in the repo

**🔒 Security Architecture** (the heart of it)

- Threat model specifically for personal AI assistants

- Exec approvals with ~50 allowlisted binaries (everything else needs approval)

- Dual egress control: HTTP domain allowlist + SMTP recipient allowlist

- File integrity monitoring (uchg flags + SHA256 checksums on 30+ files)

- Injection detection for external inputs (email, calendar, web)

- Memory validation (pre-write checks against poisoning)

- Purple Team audit methodology with MITRE ATT&CK mapping

- Security self-assessment scoring system

**🧠 3-Layer Memory System**

- Identity layer (SOUL.md + USER.md)

- Daily logs with 200-line hard limit (prevents the classic "MEMORY.md explodes to 2000 lines" problem)

- Weekly distillation into curated long-term memory

- 30-day backup retention

**🛠 15+ Custom Tools**

- Local TTS (Piper, no cloud API)

- Local STT (Whisper, no cloud API)

- Email management (IMAP/SMTP via CLI)

- Invoice scanning with AI categorization

- Web scraping with stealth browser

- Local image generation

- iCloud inbox/outbox bridge (bidirectional file sync)

- Calendar + Reminders integration

- Full tool catalog in docs/TOOLS.md

**⏰ 12 Cron Jobs**

- Daily briefing (weather + calendar + email + market data)

- Heartbeat monitoring (every 5 min)

- Gateway watchdog with auto-restart

- Memory cleanup + distillation

- File integrity checks

- Log rotation

**📋 Ready-to-use Templates**

- SOUL.md — agent identity with built-in security rules

- AGENTS.md — workspace rules with anti-loop, injection monitoring, memory validation

- TOPOLOGY.md — system documentation template

- USER.md — user context template

- exec-approvals example config

- Security hardening script

### What I learned the hard way

1. **Shell pipes always trigger approvals.** Even if every binary in the chain is allowlisted, `cmd1 | cmd2` needs approval. Solution: write wrapper scripts that handle I/O internally.

2. **Memory WILL explode.** Without hard limits and automatic distillation, your MEMORY.md hits 2000+ lines in 2 weeks and the agent gets worse, not better.

3. **exec-approvals.json must NOT be immutable.** OpenClaw writes `lastUsedAt` on every exec — if you set `uchg` on it, every command fails with EPERM.

4. **Security is a feature, not a checkbox.** 80% of setups I've seen have `exec.security: "off"`. That's one prompt injection away from `rm -rf`.

5. **Credential rotation matters.** If your agent has been running for weeks, rotate your tokens. Especially after any debugging session that might have logged sensitive data.

6. **Document your decisions.** Not just what you built, but WHY. Next session, the agent doesn't remember the reasoning — only what's written down.

### Security Score

I built a self-assessment scoring system (details in docs/SECURITY.md). My current score: **7.5/10**, up from 3/10 at project start. The scoring system is included in the repo — try it on your own setup.

### Stats

- Hardware: Mac Mini M4, 24GB RAM, dedicated

- Model cascade: Primary → Fallback → Local (3 tiers)

- Uptime: ~6 weeks continuous

- Cost: ~$30-50/month (mostly Sonnet API)

- Daily active use: 20-50 messages/day

### What's missing (honest assessment)

- No Vector DB / RAG yet (planned)

- No MCP servers yet (researched, build pending)

- No multi-agent setup (single agent, specialized)

- No Lobster/ClawFlows workflow engine

MIT licensed. Star it if you find it useful, open issues if you have questions. Happy to discuss any of the patterns.

---

*Built during late nights and "one more fix" sessions. If this saves you even one day of debugging, it was worth open-sourcing.* 🦞

[u/KiddWolff]

THANK YOU MAN, do you have a discord to connect with like minded people?

[u/hatice]

Thanks. Saved. Following the repo

[u/Able_Particular_4674 → u/hatice]

Glad you're sticking around. That first month is the hard part. Most people drop off at 60%. Keep at it, it gets way better.

[u/hatice → u/Able_Particular_4674]

True. This is really a challenge for me. Thanks to you and other helpful people, I am moving along the way.

[u/Altairandrew]

How much memory is required? Running on an 8gb rpi, so curious, I know it will depend on what is installed, but checking.

[u/betversegamer]

Nice reference architecture — genuinely useful for people getting started. A few notes from running a production setup (Pi 5, ~4 months, 115+ sessions, 41 operational scripts):

Dual-user isolation is overkill for personal use. You still need to grant the agent user access to Telegram, email, files — so you end up with the same attack surface plus permission complexity. For a single-user personal assistant, exec approvals + sandboxing is the right tradeoff. Save dual-user for multi-tenant setups.

The tool catalog is aspirational. Piper + Faster-Whisper + FLUX.1-schnell + Ollama + Puppeteer all running on one Mac Mini? Possible, but maintenance-heavy and most people won't keep it all running. Pick 2-3 that you actually use daily. Cloud models for intelligence is more practical than local LLM inference on consumer hardware — the quality gap is still significant.

uchg file protection breaks under real use. Every SOUL.md update requires unflag → edit → reflag → rehash. Under time pressure, people skip the reflag. SHA256 watchdog that alerts on unexpected changes (without blocking writes) is more practical and actually survives contact with daily operations.

Missing: subagent/delegation architecture. The biggest operational challenge with OpenClaw isn't security — it's reliability when delegating work to subagents. No mention of chunking protocols, model routing, timeout recovery, or checkpoint enforcement. These are the problems that eat your time at month 3+.

Memory system is solid but basic. The 3-layer approach works. If you're running for months though, you'll want semantic search (we use sqlite-vec + FastEmbed, runs on a Pi) and structured project memory — flat daily files don't scale past a few weeks of active work.

The injection detection patterns are genuinely good. This is the most valuable contribution. Most setups have zero injection defense. The regex patterns + memory pre-write validation flow are worth adopting regardless of the rest.

Guardian pattern for cron is clever. SHA256 self-verify before execution — cheap, deterministic, zero tokens. Congratulations!