fix(falcon): preserve AID across rebuilds

[shunkakinoki]

Summary

• Replace destructive rm -rf + cp -a with rsync --delete --exclude in Falcon sensor init script
• Preserves falconstore, falconstore.bak, and CsConfig runtime state files across NixOS rebuilds
• Prevents the sensor from re-registering as a new host and consuming duplicate Kolide license seats

Test plan

• nixos-rebuild switch completes successfully
• sudo /opt/CrowdStrike/falconctl -g --aid shows the same AID before and after rebuild
• No duplicate node appears in Kolide dashboard

---

Summary by cubic

Preserves the CrowdStrike Falcon AID and runtime state across NixOS rebuilds to prevent sensor re-registration and duplicate Kolide seats. Switches the init script to rsync -a --delete with excludes for falconstore, falconstore.bak, and CsConfig under /opt/CrowdStrike.

^{Written for commit a52704c. Summary will update on new commits.}

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request refactors the Falcon sensor's initialization process within NixOS to ensure its persistent state is maintained across system rebuilds. By switching from a full directory removal and copy to a more granular synchronization method, the sensor's unique identifier and configuration are preserved, eliminating the issue of duplicate host registrations and unnecessary license consumption.

Highlights

• Falcon Sensor State Preservation: Replaced the destructive rm -rf and cp -a commands with rsync --delete --exclude in the Falcon sensor initialization script to prevent loss of critical runtime state.
• Agent ID (AID) Persistence: Ensured that falconstore, falconstore.bak, and CsConfig files are preserved across NixOS rebuilds, which contain the Agent ID (AID).
• License Seat Optimization: Prevented the Falcon sensor from re-registering as a new host after a rebuild, thereby avoiding the consumption of duplicate Kolide license seats.

Changelog

• named-hosts/matic/falcon.nix
  • Replaced rm -rf and cp -a with rsync for updating the /opt/CrowdStrike directory.
  • Added --exclude flags to rsync to preserve falconstore, falconstore.bak, and CsConfig files.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[mesa-dot-dev]

You do not have enough credits to review this pull request. Please purchase more credits to continue.

[coderabbitai]

📝 Walkthrough

Walkthrough

Replaces removal and copying of the CrowdStrike directory with rsync-based synchronization that updates files from the nix store to /opt/CrowdStrike while excluding runtime state files (falconstore, falconstore.bak, CsConfig) and maintaining ownership settings.

Changes

Cohort / File(s)	Summary
CrowdStrike Synchronization named-hosts/matic/falcon.nix	Changes from rm -rf followed by cp -r to rsync with state preservation, excluding specified runtime files and adding clarifying comments.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• feat(security): add CrowdStrike Falcon and Kolide to matic host #724: Modifies falcon.nix service to use rsync-based synchronization approach for preserving runtime state in CrowdStrike sensor updates.
• feat(matic): enable PAM fingerprint auth and fix falcon init #743: Adjusts falcon initialization logic to skip cleanup when falcond exists, complementing state preservation efforts in CrowdStrike updates.

Poem

🐰 A clever switch from copy's way,
Rsync syncs both night and day,
Runtime state won't go astray,
Files preserved in their own way! 🎉

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: replacing a destructive approach with rsync to preserve the Falcon AID across rebuilds.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check	✅ Passed	The pull request description clearly relates to the changeset, explaining the purpose of replacing rm -rf + cp -a with rsync, and describing what runtime state files are being preserved.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/falcon-aid-persistence

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[mesa-dot-dev]

Mesa Description

TL;DR

Preserved Falcon sensor AID across NixOS rebuilds to prevent duplicate Kolide host registrations.

What changed?

• Replaced destructive rm -rf + cp -a with rsync --delete --exclude in the Falcon sensor init script.
• This change ensures falconstore, falconstore.bak, and CsConfig runtime state files are preserved across NixOS rebuilds.

^{Description generated by Mesa. Update settings}

[gemini-code-assist]

Code Review

This pull request correctly addresses an issue where the Falcon sensor's Agent ID (AID) was not preserved across NixOS rebuilds, which caused duplicate host registrations. The change from a destructive rm -rf and cp -a to an rsync with exclusions for state files is a good solution. However, I've found one potential issue with the new rsync command that could lead to incorrect directory permissions on /opt/CrowdStrike, which I've detailed in a comment. With that one change, this PR should be good to merge.

[gemini-code-assist]

The rsync -a command includes the -p (--perms) flag, which causes the destination directory's permissions to be updated to match the source. This could override the 0770 permissions set on /opt/CrowdStrike by the install -d command on line 25, potentially making it world-readable depending on the permissions in the Nix store. This is a change in behavior from the previous cp -a .../. .../ command, which does not affect the target directory's permissions.

To ensure /opt/CrowdStrike retains its restrictive permissions, please re-apply them after the rsync command by adding:

chmod 0770 /opt/CrowdStrike

This should be placed after the rsync command.

[cubic-dev-ai]

No issues found across 1 file

[Copilot]

Pull request overview

Updates the Falcon sensor initialization in the matic NixOS host module to preserve the sensor’s runtime identity state across rebuilds, avoiding unintended re-registration and duplicate license seat consumption.

Changes:

• Replaces a destructive /opt/CrowdStrike wipe-and-copy with an rsync --delete sync from the Nix store.
• Excludes falconstore, falconstore.bak, and CsConfig from sync to preserve Falcon runtime state (including AID).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.