feat(security): add CrowdStrike Falcon and Kolide to matic host

named-hosts/matic/default.nix

@@ -26,6 +26,10 @@ inputs.nixpkgs.lib.nixosSystem {
     # Hardware configuration
     ./hardware-configuration.nix
 
+    # Security/endpoint monitoring
+    ./falcon.nix # CrowdStrike Falcon sensor
+    ./kolide.nix # Kolide launcher with dpkg shim
+
     # Base system configuration
     (
       { config, lib, ... }:

named-hosts/matic/falcon.nix

@@ -0,0 +1,96 @@
+# CrowdStrike Falcon sensor configuration for NixOS
+#
+# Prerequisites (manual steps):
+# 1. Obtain the Falcon sensor .deb from IT
+# 2. Create /etc/falcon-sensor.env with: FALCON_CID=<your-cid>
+# 3. Extract and place sensor files (see README for details)
+#
+# Based on: https://gist.github.com/klDen/c90d9798828e31fecbb603f85e27f4f1
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  # FHS environment for CrowdStrike Falcon
+  # NixOS doesn't have standard /opt paths, so we create an FHS-compatible environment
+  falconFhs = pkgs.buildFHSEnv {
+    name = "falcon-sensor-fhs";
+    targetPkgs =
+      pkgs: with pkgs; [
+        # Runtime dependencies for Falcon sensor
+        bash
+        coreutils
+        curl
+        glibc
+        gnugrep
+        libnl
+        openssl
+        zlib
+      ];
+    runScript = "/opt/CrowdStrike/falcond";
+  };
+in
+{
+  # Create necessary directories and symlinks for CrowdStrike
+  systemd.tmpfiles.rules = [
+    # Create /opt/CrowdStrike directory
+    "d /opt/CrowdStrike 0770 root root -"
+  ];
+
+  # CrowdStrike Falcon sensor service
+  systemd.services.falcon-sensor = {
+    description = "CrowdStrike Falcon Sensor";
+    wantedBy = [ "multi-user.target" ];
+    after = [
+      "network.target"
+      "local-fs.target"
+    ];
+
+    # Load the CID from environment file
+    serviceConfig = {
+      Type = "forking";
+      ExecStartPre = pkgs.writeShellScript "falcon-sensor-pre" ''
+        # Ensure CID is configured
+        if [ ! -f /etc/falcon-sensor.env ]; then
+          echo "ERROR: /etc/falcon-sensor.env not found. Create it with FALCON_CID=<your-cid>"
+          exit 1
+        fi
+
+        # Source the CID
+        source /etc/falcon-sensor.env
+        if [ -z "$FALCON_CID" ]; then
+          echo "ERROR: FALCON_CID not set in /etc/falcon-sensor.env"
+          exit 1
+        fi
+
+        # Set the CID if not already set
+        if ! /opt/CrowdStrike/falconctl -g --cid | grep -q "$FALCON_CID"; then
+          /opt/CrowdStrike/falconctl -s --cid="$FALCON_CID"
+        fi
+      '';
+      ExecStart = "${falconFhs}/bin/falcon-sensor-fhs";
+      ExecStop = "/bin/kill -TERM $MAINPID";
+      Restart = "on-failure";
+      RestartSec = "10s";
+      KillMode = "process";
+
+      # Security hardening
+      ProtectHome = false;
+      ProtectSystem = false;
+      PrivateTmp = false;
+    };
+
+    # Add required tools to PATH
+    path = [
+      pkgs.bash
+      pkgs.coreutils
+      pkgs.gnugrep
+    ];
+  };
+
+  # Required kernel modules for Falcon sensor
+  boot.kernelModules = [ "falcon" ];
+}

named-hosts/matic/kolide.nix

@@ -0,0 +1,120 @@
+# Kolide Launcher configuration for NixOS
+#
+# Prerequisites (manual steps):
+# 1. Obtain the Kolide launcher .deb from IT
+# 2. Extract the enrollment secret:
+#    nix-shell -p dpkg --run 'dpkg-deb -x ~/Downloads/kolide-launcher.deb /tmp/kolide-deb'
+#    cat /tmp/kolide-deb/etc/kolide-k2/secret
+# 3. Install secret to /etc/kolide-k2/secret (root:root, 0600)
+#
+# The dpkg status shim below satisfies Kolide's osquery deb_packages check
+# for CrowdStrike compliance on NixOS (which has no dpkg database).
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  # Kolide launcher package (download from company portal)
+  # This is a placeholder - the actual binary needs to be extracted from the .deb
+  kolideLauncher = pkgs.stdenv.mkDerivation {
+    pname = "kolide-launcher";
+    version = "1.0.0";
+
+    # No source - we expect the binary to be manually installed to /opt/kolide-k2
+    dontUnpack = true;
+    dontBuild = true;
+
+    installPhase = ''
+      mkdir -p $out/bin
+      # Create a wrapper that points to the manually installed binary
+      cat > $out/bin/kolide-launcher << 'EOF'
+      #!/bin/sh
+      exec /opt/kolide-k2/bin/launcher "$@"
+      EOF
+      chmod +x $out/bin/kolide-launcher
+    '';
+  };
+
+  # FHS environment for Kolide launcher
+  kolideFhs = pkgs.buildFHSEnv {
+    name = "kolide-launcher-fhs";
+    targetPkgs =
+      pkgs: with pkgs; [
+        bash
+        coreutils
+        glibc
+        gnugrep
+        nodejs
+        openssl
+        zlib
+      ];
+    runScript = "/opt/kolide-k2/bin/launcher";
+  };
+in
+{
+  # dpkg status shim for Kolide/osquery compliance
+  # NixOS has no dpkg database, so Kolide's osquery deb_packages check fails.
+  # This shim reports falcon-sensor as "installed" to satisfy the CrowdStrike check.
+  systemd.tmpfiles.rules = [
+    # Create dpkg directory
+    "d /var/lib/dpkg 0755 root root -"
+    # Create dpkg status file with falcon-sensor entry
+    "f /var/lib/dpkg/status 0644 root root - Package: falcon-sensor\nStatus: install ok installed\nPriority: optional\nSection: misc\nInstalled-Size: 0\nMaintainer: CrowdStrike\nArchitecture: amd64\nVersion: 7.31.0-18410\nDescription: CrowdStrike Falcon Sensor (shim for Kolide/osquery on NixOS)\n"
+
+    # Create Kolide directories
+    "d /etc/kolide-k2 0755 root root -"
+    "d /opt/kolide-k2 0755 root root -"
+    "d /var/kolide-k2 0755 root root -"
+  ];
+
+  # Kolide Launcher service
+  systemd.services.kolide-launcher = {
+    description = "Kolide Launcher";
+    wantedBy = [ "multi-user.target" ];
+    after = [
+      "network.target"
+      "local-fs.target"
+    ];
+
+    serviceConfig = {
+      Type = "simple";
+      ExecStartPre = pkgs.writeShellScript "kolide-launcher-pre" ''
+        # Ensure enrollment secret exists
+        if [ ! -f /etc/kolide-k2/secret ]; then
+          echo "ERROR: /etc/kolide-k2/secret not found."
+          echo "Extract from company .deb and install with:"
+          echo "  sudo install -d -m 755 /etc/kolide-k2"
+          echo "  sudo sh -c 'cat <secret> > /etc/kolide-k2/secret'"
+          echo "  sudo chown root:root /etc/kolide-k2/secret"
+          echo "  sudo chmod 600 /etc/kolide-k2/secret"
+          exit 1
+        fi
+
+        # Ensure launcher binary exists
+        if [ ! -x /opt/kolide-k2/bin/launcher ]; then
+          echo "ERROR: /opt/kolide-k2/bin/launcher not found."
+          echo "Extract from company .deb and install to /opt/kolide-k2/"
+          exit 1
+        fi
+      '';
+      ExecStart = "${kolideFhs}/bin/kolide-launcher-fhs --enroll_secret_path=/etc/kolide-k2/secret --root_directory=/var/kolide-k2";
+      Restart = "on-failure";
+      RestartSec = "10s";
+
+      # Kolide needs access to system information
+      ProtectHome = false;
+      ProtectSystem = false;
+      PrivateTmp = false;
+    };
+
+    # Add required tools to PATH
+    path = [
+      pkgs.bash
+      pkgs.coreutils
+      pkgs.gnugrep
+    ];
+  };
+}