macOS Deployment
Use a LaunchAgent for a daemon that runs while one user is logged in. Use a LaunchDaemon for a shared daemon that starts at boot. These examples use the supported Apple Silicon binary and require administrator access for shared files.
Prepare the Mac
Install a verified binary using Installation, then copy it to a fixed administrator-owned path:
Complete Configuration and Managed Clients. Use
/opt/nvidia/bin/nemo-relay as the dispatcher and http://127.0.0.1:47632 as the
bundle endpoint. Choose one of the two launchd jobs below.
User LaunchAgent
Create directories as the target user:
Save the following as
~/Library/LaunchAgents/com.nvidia.nemo-relay.daemon.plist.
Replace /Users/alex with the user’s absolute home path in all three locations.
launchd does not expand ~ or shell variables inside a plist.
Load and inspect the job from that user’s desktop login session:
The job starts again at login. It is not a boot-time service for logged-out users. For multiple simultaneous user daemons, assign separate ports and bundles.
System LaunchDaemon
Use a dedicated hidden service account called _nemo-relay. Check that the name
is unused and select an unused numeric ID. The following example uses 499;
check both listings before using it and replace it if occupied:
As an administrator, create the account and its private home:
Keep logs in the service account’s private home directory to preserve them
across macOS upgrades. The _nemo-relay account owns this directory. If someone
removes the logs directory, launchd can create it again as _nemo-relay.
The plist sets Umask to 63 (octal 077). This setting keeps new directories
and log files private.
Avoid /Library/Logs/NeMoRelay for this non-root LaunchDaemon. macOS upgrades
can remove custom directories under /Library/Logs. Root owns that parent
directory. The _nemo-relay account lacks permission to create directories
there, so launchd fails before Relay starts. It reports
Unable to create stdout directory ... Permission denied and exit code 78
(EX_CONFIG).
Save /Library/LaunchDaemons/com.nvidia.nemo-relay.daemon.plist:
Set ownership and start it:
If your installation uses /Library/Logs/NeMoRelay, change the log paths with
these steps:
-
Close harness sessions.
-
Unload the system job:
-
Create
/var/lib/nemo-relay/logswith theinstallcommand above. It sets_nemo-relayas the owner and group, with0700permissions. -
Optional: Copy any old logs you want to keep from
/Library/Logs/NeMoRelayto/var/lib/nemo-relay/logs. Set_nemo-relayas the owner and group of each copied file, with0600permissions. Skip this step if the old logs are gone. -
Update
StandardOutPathandStandardErrorPathin the installed plist to match the example above. -
Run the
plutil -lint,launchctl bootstrap,launchctl print, andtailcommands above to check the plist, start the job, and check its status and logs. -
Update any log rotation settings to use the new paths. Configure the rotation tool to create replacement log files with
_nemo-relayas the owner and group, with0600permissions. If root owns these files with0600permissions, the daemon cannot open them at the next start.
Hooks run as each user and check the daemon’s TLS certificate before they send anything. They cannot read the service account’s files, so publish the certificate, never the key, in the system configuration directory. Export it as the service account with the service’s environment:
The certificate stays the same across restarts and upgrades. Publish it again
only if the service identity under
/var/lib/nemo-relay/.config/nemo-relay/bootstrap is removed.
The service identity lives under /var/lib/nemo-relay/.config/nemo-relay/daemon.
Keep it across upgrades. User workers still load /etc/nemo-relay, and their
identities remain in each user’s config directory.
Verify, Restart, and Remove
Check daemon health and assigned workers, then complete worker-backed verification:
Restart after a binary update with the command for your job:
Close harness sessions before restarting. For plist changes, unload the job with
bootout, then run its bootstrap command again. Test a planned logout/login
or reboot. Configure your log rotation tool for the two log files; launchd’s
file redirection does not itself bound their size.
To remove a user job:
To remove a system job:
Retain the identity directory and service account for rollback. Follow Operations for upgrades and complete removal. Apple’s launchd guide explains the LaunchAgent and LaunchDaemon file layout.