Tutorial: Setting Up a macOS Machine for Archerships

This tutorial covers setting up a macOS machine from a fresh install (or a clean reset) for the way I work: minimal Apple bloat, no Music.app launching on media keys, development tools installed, and API keys stored securely in the system keyring instead of plaintext files.

Prerequisites

• A fresh or recently reset macOS installation (Sequoia 15.x or macOS 26.x)
• An active internet connection
• An Apple ID (for App Store downloads if needed)
• About 30 minutes

Step 1: Initial system settings

Run the initial setup assistant, create your user account, and skip iCloud login during setup if you prefer – you can sign in later.

Open System Settings and adjust:

• General > Software Update: Install any pending updates. Restart if needed.
• Privacy & Security: Review Location Services, Analytics, and Apple Advertising. Disable anything that doesn’t serve you.
• Desktop & Dock: Disable “Show suggested and recent apps in Dock” to prevent Apple automatically inserting apps you dont want.

Step 2: Disable telemetry and analytics

# Disable diagnostic data submission
sudo defaults write /Library/Application\ Support/CrashReporter/DiagnosticMessagesHistory.plist AutoSubmit -bool false
sudo defaults write /Library/Application\ Support/CrashReporter/DiagnosticMessagesHistory.plist ThirdPartyDataSubmit -bool false

# Disable personalized ads (this is tied to your Apple ID)
defaults write com.apple.AdLib allowApplePersonalizedAdvertising -bool false

# Disable Siri analytics (if you use Siri; I dont)
defaults write com.apple.assistant.support "Siri Data Sharing Opt-In Status" -int 2

Step 3: Install essential tools

I use Homebrew for package management. Install it, then the tools I rely on:

# Homebrew itself
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

# Development essentials
brew install git neovim gh node python uv yt-dlp

# Utilities
brew install lua-language-server bash-language-server ripgrep fd lazygit

# Browsers (I use Brave and Chromium)
brew install --cask brave-browser chromium

# Communication
brew install --cask signal whatsapp kitty

Some of these may differ for your needs, but this is the baseline. Kitty is my terminal emulator of choice; Neovim is my editor.

Step 4: Remove (or hide) Apple bloatware

On modern macOS (Sequoia and later), system apps live in /System/Applications/ on a read-only signed system volume (SSV). You cannot delete them without disabling SIP. Instead, we remove them from the Dock and disable their ability to auto-launch.

Step 4a: Clean the Dock

The Dock stores app entries in ~/Library/Preferences/com.apple.dock.plist under the persistent-apps key. Use Python to read, filter, and write back:

# remove-dock-apps.py
import subprocess, plistlib
from pathlib import Path

dock_plist = Path.home() / 'Library/Preferences/com.apple.dock.plist'
with open(dock_plist, 'rb') as f:
    plist = plistlib.load(f)

apps = plist.get('persistent-apps', [])
# Bundle IDs of apps to remove from dock
to_remove = {
    'com.apple.Photos',
    'com.apple.ScreenContinuity',  # iPhone Mirroring
    'com.apple.Music',
    'com.apple.TV',
    'com.apple.Podcasts',
    'com.apple.Books',
    'com.apple.News',
    'com.apple.FaceTime',
    'com.apple.Messages',
    'com.apple.Mail',
    'com.apple.Maps',
    'com.apple.Home',
    'com.apple.FindMy',
}

apps = [a for a in apps if a.get('tile-data', {}).get('bundle-identifier', '') not in to_remove]
plist['persistent-apps'] = apps

with open(dock_plist, 'wb') as f:
    plistlib.dump(plist, f)

Save and run this script, then restart the Dock:

python3 remove-dock-apps.py
killall Dock

The apps are still installed on the system; they just wont appear in your Dock.

Step 4b: Stop Apple Music from auto-launching on media keys

Apple Music registers itself to respond to media key events (play/pause, next track, previous track) from keyboards, Touch Bar, and Bluetooth devices. If you never use Apple Music, disable its response:

defaults write com.apple.Music dontRespondToMediaKeys -bool true

You can also disable the symbolic hotkeys that trigger media playback, as an additional measure:

defaults write com.apple.symbolichotkeys AppleSymbolicHotKeys -dict-add 32 "{ enabled = 0; }"   # Next Track
defaults write com.apple.symbolichotkeys AppleSymbolicHotKeys -dict-add 33 "{ enabled = 0; }"   # Previous Track
defaults write com.apple.symbolichotkeys AppleSymbolicHotKeys -dict-add 34 "{ enabled = 0; }"   # Play/Pause

These settings survive reboots. Music.app will never launch uninvited.

Step 4c: Hide apps from Launchpad (optional)

If you want Launchpad to be even cleaner, use defaults to hide individual apps from Spotlight and Launchpad. This doesnt delete the app but prevents it from showing up in search results or the grid:

# Example: hide Music and TV from Spotlight search results
sudo mdutil -E /
# Then add apps to the Spotlight Privacy list via System Settings > Siri & Spotlight > Spotlight Privacy

Alternatively, for a given app you can remove the .app from the Launchpad database, but it will reappear after updates. The Dock removal in Step 4a covers 90 percent of the annoyance.

Step 5: Secure API keys in the system keyring

Dont store API keys in plaintext .env files or shell config. Use the macOS Keychain via Python’s keyring library:

# Install keyring
pip3 install --break-system-packages keyring

# Store a key
python3 -c "import keyring; keyring.set_password('grok', 'xai-api-key', 'xai-your-key-here')"

# Retrieve a key (for use in wrapper scripts)
python3 -c "import keyring; print(keyring.get_password('grok', 'xai-api-key'))"

Wrapper script pattern

For CLI tools that need an API key, create a small wrapper script that reads from keyring and sets the environment variable, then execs the real binary:

#!/usr/bin/env bash
# ~/av/bin/grok-cli
eval "$(python3 << 'PYEOF'
import keyring, shlex
v = keyring.get_password('grok', 'xai-api-key') or ''
print('export XAI_API_KEY=*** + shlex.quote(v))
PYEOF
)"
exec ~/.grok/bin/grok "$@"

Make it executable and alias it:

chmod +x ~/av/bin/grok-cli
echo 'alias grok="~/av/bin/grok-cli"' >> ~/.zshrc

The key exists in plaintext only in process memory during runtime – never on disk.

Step 6: Install Grok Build (xAI CLI)

Grok Build is xAI’s terminal-based coding agent. Install from the official channel:

curl -fsSL https://x.ai/cli/install.sh | bash

This places the native binary at ~/.grok/bin/grok and the agent symlink at ~/.grok/bin/agent. The installer also adds ~/.grok/bin to your PATH in .zshrc.

Grok authenticates via XAI_API_KEY environment variable (set by the wrapper from Step 5) or via interactive browser login. For the free deployment key approach:

GROK_DEPLOYMENT_KEY=your-key grok

Step 7: Verify and iterate

After completing the steps above, verify:

1. Music does not launch – Press the play/pause media key on your keyboard. Music.app should not appear.
2. Dock is clean – Only the apps you actually use appear in the Dock.
3. Grok works – Run grok --version. It should print 0.2.103 or later.
4. Keyring works – Run python3 -c "import keyring; print(keyring.get_password('grok', 'xai-api-key')[:12])" and see your key prefix.

Notes