From a52704c0d993eea7aa31dcc04b4204c5cdbba4a8 Mon Sep 17 00:00:00 2001
From: Shun Kakinoki <shunkakinoki@gmail.com>
Date: Thu, 12 Mar 2026 07:41:13 +0900
Subject: [PATCH] fix(falcon): preserve AID across rebuilds to avoid duplicate
 Kolide nodes

Replace rm -rf + cp with rsync --exclude to keep falconstore intact
---
 named-hosts/matic/falcon.nix | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/named-hosts/matic/falcon.nix b/named-hosts/matic/falcon.nix
index 69bab8792..7bb9e006d 100644
--- a/named-hosts/matic/falcon.nix
+++ b/named-hosts/matic/falcon.nix
@@ -22,11 +22,16 @@ let
       ${pkgs.e2fsprogs}/bin/chattr -i -R /opt/CrowdStrike 2>/dev/null || true
     fi
 
-    rm -rf /opt/CrowdStrike
     install -d -m 0770 /opt/CrowdStrike
 
-    # Copy real files so Falcon can write falconstore/CsConfig
-    cp -a ${falcon}/opt/CrowdStrike/. /opt/CrowdStrike/
+    # Update binaries from the nix store, but preserve runtime state files.
+    # falconstore contains the Agent ID (AID) — if lost, the sensor re-registers
+    # as a new host and consumes another license seat.
+    ${pkgs.rsync}/bin/rsync -a --delete \
+      --exclude=falconstore \
+      --exclude=falconstore.bak \
+      --exclude=CsConfig \
+      "${falcon}/opt/CrowdStrike/" /opt/CrowdStrike/
 
     chown -R root:root /opt/CrowdStrike