From bfcc59ace505a3c4905f3269e8c28663bef159b3 Mon Sep 17 00:00:00 2001 From: Shun Kakinoki Date: Wed, 4 Feb 2026 19:15:37 +0900 Subject: [PATCH 1/4] feat(security): add CrowdStrike Falcon and Kolide to matic host --- named-hosts/matic/default.nix | 4 ++ named-hosts/matic/falcon.nix | 85 +++++++++++++++++++++++++++ named-hosts/matic/kolide.nix | 107 ++++++++++++++++++++++++++++++++++ 3 files changed, 196 insertions(+) create mode 100644 named-hosts/matic/falcon.nix create mode 100644 named-hosts/matic/kolide.nix diff --git a/named-hosts/matic/default.nix b/named-hosts/matic/default.nix index 3cab4c01d..c3c2d7076 100644 --- a/named-hosts/matic/default.nix +++ b/named-hosts/matic/default.nix @@ -26,6 +26,10 @@ inputs.nixpkgs.lib.nixosSystem { # Hardware configuration ./hardware-configuration.nix + # Security/endpoint monitoring + ./falcon.nix # CrowdStrike Falcon sensor + ./kolide.nix # Kolide launcher with dpkg shim + # Base system configuration ( { config, lib, ... }: diff --git a/named-hosts/matic/falcon.nix b/named-hosts/matic/falcon.nix new file mode 100644 index 000000000..387b2d750 --- /dev/null +++ b/named-hosts/matic/falcon.nix @@ -0,0 +1,85 @@ +# CrowdStrike Falcon sensor configuration for NixOS +# +# Prerequisites (manual steps): +# 1. Obtain the Falcon sensor .deb from IT +# 2. Create /etc/falcon-sensor.env with: FALCON_CID= +# 3. Extract and place sensor files (see README for details) +# +# Based on: https://gist.github.com/klDen/c90d9798828e31fecbb603f85e27f4f1 +{ config, lib, pkgs, ... }: + +let + # FHS environment for CrowdStrike Falcon + # NixOS doesn't have standard /opt paths, so we create an FHS-compatible environment + falconFhs = pkgs.buildFHSEnv { + name = "falcon-sensor-fhs"; + targetPkgs = pkgs: with pkgs; [ + # Runtime dependencies for Falcon sensor + bash + coreutils + curl + glibc + gnugrep + libnl + openssl + zlib + ]; + runScript = "/opt/CrowdStrike/falcond"; + }; +in +{ + # Create necessary directories and symlinks for CrowdStrike + systemd.tmpfiles.rules = [ + # Create /opt/CrowdStrike directory + "d /opt/CrowdStrike 0770 root root -" + ]; + + # CrowdStrike Falcon sensor service + systemd.services.falcon-sensor = { + description = "CrowdStrike Falcon Sensor"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" "local-fs.target" ]; + + # Load the CID from environment file + serviceConfig = { + Type = "forking"; + ExecStartPre = pkgs.writeShellScript "falcon-sensor-pre" '' + # Ensure CID is configured + if [ ! -f /etc/falcon-sensor.env ]; then + echo "ERROR: /etc/falcon-sensor.env not found. Create it with FALCON_CID=" + exit 1 + fi + + # Source the CID + source /etc/falcon-sensor.env + if [ -z "$FALCON_CID" ]; then + echo "ERROR: FALCON_CID not set in /etc/falcon-sensor.env" + exit 1 + fi + + # Set the CID if not already set + if ! /opt/CrowdStrike/falconctl -g --cid | grep -q "$FALCON_CID"; then + /opt/CrowdStrike/falconctl -s --cid="$FALCON_CID" + fi + ''; + ExecStart = "${falconFhs}/bin/falcon-sensor-fhs"; + ExecStop = "/bin/kill -TERM $MAINPID"; + Restart = "on-failure"; + RestartSec = "10s"; + KillMode = "process"; + + # Security hardening + ProtectHome = false; + ProtectSystem = false; + PrivateTmp = false; + }; + + # Environment file for CID + environment = { + PATH = lib.makeBinPath [ pkgs.coreutils pkgs.gnugrep pkgs.bash ]; + }; + }; + + # Required kernel modules for Falcon sensor + boot.kernelModules = [ "falcon" ]; +} diff --git a/named-hosts/matic/kolide.nix b/named-hosts/matic/kolide.nix new file mode 100644 index 000000000..25537f698 --- /dev/null +++ b/named-hosts/matic/kolide.nix @@ -0,0 +1,107 @@ +# Kolide Launcher configuration for NixOS +# +# Prerequisites (manual steps): +# 1. Obtain the Kolide launcher .deb from IT +# 2. Extract the enrollment secret: +# nix-shell -p dpkg --run 'dpkg-deb -x ~/Downloads/kolide-launcher.deb /tmp/kolide-deb' +# cat /tmp/kolide-deb/etc/kolide-k2/secret +# 3. Install secret to /etc/kolide-k2/secret (root:root, 0600) +# +# The dpkg status shim below satisfies Kolide's osquery deb_packages check +# for CrowdStrike compliance on NixOS (which has no dpkg database). +{ config, lib, pkgs, ... }: + +let + # Kolide launcher package (download from company portal) + # This is a placeholder - the actual binary needs to be extracted from the .deb + kolideLauncher = pkgs.stdenv.mkDerivation { + pname = "kolide-launcher"; + version = "1.0.0"; + + # No source - we expect the binary to be manually installed to /opt/kolide-k2 + dontUnpack = true; + dontBuild = true; + + installPhase = '' + mkdir -p $out/bin + # Create a wrapper that points to the manually installed binary + cat > $out/bin/kolide-launcher << 'EOF' + #!/bin/sh + exec /opt/kolide-k2/bin/launcher "$@" + EOF + chmod +x $out/bin/kolide-launcher + ''; + }; + + # FHS environment for Kolide launcher + kolideFhs = pkgs.buildFHSEnv { + name = "kolide-launcher-fhs"; + targetPkgs = pkgs: with pkgs; [ + bash + coreutils + gnugrep + glibc + openssl + zlib + ]; + runScript = "/opt/kolide-k2/bin/launcher"; + }; +in +{ + # dpkg status shim for Kolide/osquery compliance + # NixOS has no dpkg database, so Kolide's osquery deb_packages check fails. + # This shim reports falcon-sensor as "installed" to satisfy the CrowdStrike check. + systemd.tmpfiles.rules = [ + # Create dpkg directory + "d /var/lib/dpkg 0755 root root -" + # Create dpkg status file with falcon-sensor entry + "f /var/lib/dpkg/status 0644 root root - Package: falcon-sensor\nStatus: install ok installed\nPriority: optional\nSection: misc\nInstalled-Size: 0\nMaintainer: CrowdStrike\nArchitecture: amd64\nVersion: 7.31.0-18410\nDescription: CrowdStrike Falcon Sensor (shim for Kolide/osquery on NixOS)\n" + + # Create Kolide directories + "d /etc/kolide-k2 0755 root root -" + "d /opt/kolide-k2 0755 root root -" + "d /var/kolide-k2 0755 root root -" + ]; + + # Kolide Launcher service + systemd.services.kolide-launcher = { + description = "Kolide Launcher"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" "local-fs.target" ]; + + serviceConfig = { + Type = "simple"; + ExecStartPre = pkgs.writeShellScript "kolide-launcher-pre" '' + # Ensure enrollment secret exists + if [ ! -f /etc/kolide-k2/secret ]; then + echo "ERROR: /etc/kolide-k2/secret not found." + echo "Extract from company .deb and install with:" + echo " sudo install -d -m 755 /etc/kolide-k2" + echo " sudo sh -c 'cat > /etc/kolide-k2/secret'" + echo " sudo chown root:root /etc/kolide-k2/secret" + echo " sudo chmod 600 /etc/kolide-k2/secret" + exit 1 + fi + + # Ensure launcher binary exists + if [ ! -x /opt/kolide-k2/bin/launcher ]; then + echo "ERROR: /opt/kolide-k2/bin/launcher not found." + echo "Extract from company .deb and install to /opt/kolide-k2/" + exit 1 + fi + ''; + ExecStart = "${kolideFhs}/bin/kolide-launcher-fhs --enroll_secret_path=/etc/kolide-k2/secret --root_directory=/var/kolide-k2"; + Restart = "on-failure"; + RestartSec = "10s"; + + # Kolide needs access to system information + ProtectHome = false; + ProtectSystem = false; + PrivateTmp = false; + }; + + environment = { + PATH = lib.makeBinPath [ pkgs.coreutils pkgs.gnugrep pkgs.bash ]; + }; + }; +} From 57645a1a7dce96267d1ce7818d520ad0472bb1e6 Mon Sep 17 00:00:00 2001 From: Shun Kakinoki Date: Wed, 4 Feb 2026 19:26:50 +0900 Subject: [PATCH 2/4] feat(kolide): add gnugrep and nodejs to target packages --- named-hosts/matic/kolide.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/named-hosts/matic/kolide.nix b/named-hosts/matic/kolide.nix index 25537f698..a63ca096f 100644 --- a/named-hosts/matic/kolide.nix +++ b/named-hosts/matic/kolide.nix @@ -39,8 +39,9 @@ let targetPkgs = pkgs: with pkgs; [ bash coreutils - gnugrep glibc + gnugrep + nodejs openssl zlib ]; From 98f4eb2097344929c7e14fda27024cd4bd170ed0 Mon Sep 17 00:00:00 2001 From: Shun Kakinoki Date: Wed, 4 Feb 2026 19:28:40 +0900 Subject: [PATCH 3/4] style: format code for better readability in falcon.nix and kolide.nix --- named-hosts/matic/default.nix | 4 ++-- named-hosts/matic/falcon.nix | 41 +++++++++++++++++++++++------------ named-hosts/matic/kolide.nix | 37 +++++++++++++++++++++---------- 3 files changed, 54 insertions(+), 28 deletions(-) diff --git a/named-hosts/matic/default.nix b/named-hosts/matic/default.nix index c3c2d7076..8ea32c2de 100644 --- a/named-hosts/matic/default.nix +++ b/named-hosts/matic/default.nix @@ -27,8 +27,8 @@ inputs.nixpkgs.lib.nixosSystem { ./hardware-configuration.nix # Security/endpoint monitoring - ./falcon.nix # CrowdStrike Falcon sensor - ./kolide.nix # Kolide launcher with dpkg shim + ./falcon.nix # CrowdStrike Falcon sensor + ./kolide.nix # Kolide launcher with dpkg shim # Base system configuration ( diff --git a/named-hosts/matic/falcon.nix b/named-hosts/matic/falcon.nix index 387b2d750..b9d1c0a4e 100644 --- a/named-hosts/matic/falcon.nix +++ b/named-hosts/matic/falcon.nix @@ -6,24 +6,30 @@ # 3. Extract and place sensor files (see README for details) # # Based on: https://gist.github.com/klDen/c90d9798828e31fecbb603f85e27f4f1 -{ config, lib, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: let # FHS environment for CrowdStrike Falcon # NixOS doesn't have standard /opt paths, so we create an FHS-compatible environment falconFhs = pkgs.buildFHSEnv { name = "falcon-sensor-fhs"; - targetPkgs = pkgs: with pkgs; [ - # Runtime dependencies for Falcon sensor - bash - coreutils - curl - glibc - gnugrep - libnl - openssl - zlib - ]; + targetPkgs = + pkgs: with pkgs; [ + # Runtime dependencies for Falcon sensor + bash + coreutils + curl + glibc + gnugrep + libnl + openssl + zlib + ]; runScript = "/opt/CrowdStrike/falcond"; }; in @@ -38,7 +44,10 @@ in systemd.services.falcon-sensor = { description = "CrowdStrike Falcon Sensor"; wantedBy = [ "multi-user.target" ]; - after = [ "network.target" "local-fs.target" ]; + after = [ + "network.target" + "local-fs.target" + ]; # Load the CID from environment file serviceConfig = { @@ -76,7 +85,11 @@ in # Environment file for CID environment = { - PATH = lib.makeBinPath [ pkgs.coreutils pkgs.gnugrep pkgs.bash ]; + PATH = lib.makeBinPath [ + pkgs.coreutils + pkgs.gnugrep + pkgs.bash + ]; }; }; diff --git a/named-hosts/matic/kolide.nix b/named-hosts/matic/kolide.nix index a63ca096f..4d6e11461 100644 --- a/named-hosts/matic/kolide.nix +++ b/named-hosts/matic/kolide.nix @@ -9,7 +9,12 @@ # # The dpkg status shim below satisfies Kolide's osquery deb_packages check # for CrowdStrike compliance on NixOS (which has no dpkg database). -{ config, lib, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: let # Kolide launcher package (download from company portal) @@ -36,15 +41,16 @@ let # FHS environment for Kolide launcher kolideFhs = pkgs.buildFHSEnv { name = "kolide-launcher-fhs"; - targetPkgs = pkgs: with pkgs; [ - bash - coreutils - glibc - gnugrep - nodejs - openssl - zlib - ]; + targetPkgs = + pkgs: with pkgs; [ + bash + coreutils + glibc + gnugrep + nodejs + openssl + zlib + ]; runScript = "/opt/kolide-k2/bin/launcher"; }; in @@ -68,7 +74,10 @@ in systemd.services.kolide-launcher = { description = "Kolide Launcher"; wantedBy = [ "multi-user.target" ]; - after = [ "network.target" "local-fs.target" ]; + after = [ + "network.target" + "local-fs.target" + ]; serviceConfig = { Type = "simple"; @@ -102,7 +111,11 @@ in }; environment = { - PATH = lib.makeBinPath [ pkgs.coreutils pkgs.gnugrep pkgs.bash ]; + PATH = lib.makeBinPath [ + pkgs.coreutils + pkgs.gnugrep + pkgs.bash + ]; }; }; } From 94939cb7692e6a06b641eca86da54b1df326fc33 Mon Sep 17 00:00:00 2001 From: Shun Kakinoki Date: Wed, 4 Feb 2026 19:35:58 +0900 Subject: [PATCH 4/4] feat: update environment configuration to use 'path' for required tools in falcon.nix and kolide.nix --- named-hosts/matic/falcon.nix | 14 ++++++-------- named-hosts/matic/kolide.nix | 13 ++++++------- 2 files changed, 12 insertions(+), 15 deletions(-) diff --git a/named-hosts/matic/falcon.nix b/named-hosts/matic/falcon.nix index b9d1c0a4e..31d2b8d60 100644 --- a/named-hosts/matic/falcon.nix +++ b/named-hosts/matic/falcon.nix @@ -83,14 +83,12 @@ in PrivateTmp = false; }; - # Environment file for CID - environment = { - PATH = lib.makeBinPath [ - pkgs.coreutils - pkgs.gnugrep - pkgs.bash - ]; - }; + # Add required tools to PATH + path = [ + pkgs.bash + pkgs.coreutils + pkgs.gnugrep + ]; }; # Required kernel modules for Falcon sensor diff --git a/named-hosts/matic/kolide.nix b/named-hosts/matic/kolide.nix index 4d6e11461..fa1487d57 100644 --- a/named-hosts/matic/kolide.nix +++ b/named-hosts/matic/kolide.nix @@ -110,12 +110,11 @@ in PrivateTmp = false; }; - environment = { - PATH = lib.makeBinPath [ - pkgs.coreutils - pkgs.gnugrep - pkgs.bash - ]; - }; + # Add required tools to PATH + path = [ + pkgs.bash + pkgs.coreutils + pkgs.gnugrep + ]; }; }