fix(matic): remove conditional check for falcon .deb

[shunkakinoki]

Changes

• Remove builtins.pathExists conditional from falcon.nix

Technical Details

• builtins.pathExists doesn't work reliably with flakes for paths outside the flake
• The check happens during pure evaluation, which doesn't see external paths
• Now the module is always enabled - if .deb is missing, build fails with clear error

Prerequisites (on matic)

sudo cp ~/Downloads/falcon-sensor*.deb /etc/nixos/falcon-sensor.deb

Testing

• Rebuild on matic and verify falcon-sensor service is registered

Generated with Claude Code by Claude

---

Summary by cubic

Always enable the Falcon sensor module on matic by removing the unreliable builtins.pathExists check for the .deb. Builds now fail fast with a clear error if the package is missing, preventing silent disables under flakes.

• Migration
  • Copy the sensor .deb to /etc/nixos/falcon-sensor.deb.
  • Create /etc/falcon-sensor.env with FALCON_CID=, then rebuild and verify the falcon-sensor service.

^{Written for commit aa86229. Summary will update on new commits.}

[gemini-code-assist]

Summary of Changes

Hello @shunkakinoki, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request refines the configuration for the CrowdStrike Falcon sensor on the matic host by eliminating an unreliable conditional check. Previously, the module attempted to detect the presence of the falcon-sensor.deb file using builtins.pathExists, which proved problematic in a flake-based environment. By removing this check, the module is now unconditionally enabled, ensuring that any missing dependencies are surfaced as clear build failures, thereby improving the robustness and transparency of the deployment process.

Highlights

• Conditional Check Removal: The builtins.pathExists conditional check for the falcon-sensor.deb file has been removed from falcon.nix.
• Flake Compatibility Fix: This change addresses an issue where builtins.pathExists was unreliable with flakes for paths outside the flake's scope, leading to incorrect module behavior.
• Improved Error Handling: The Falcon sensor module is now always enabled; if the .deb file is missing, the build will explicitly fail, providing clearer feedback than silent deactivation.

Changelog

• named-hosts/matic/falcon.nix
  • Removed the falconDebPath and falconDebExists variable definitions, which were used for the conditional check.
  • Eliminated the if falconDebExists then ... else ... block, making the Falcon sensor service configuration unconditional.
  • Updated comments to reflect the removal of the automatic module disabling logic.

Activity

• No human activity (comments, reviews) has been recorded on this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[coderabbitai]

📝 Walkthrough

Walkthrough

The pull request removes a conditional dependency check (falconDebExists) from the Falcon sensor configuration, making the systemd tmpfiles and falcon-sensor service definitions unconditionally present. The service configuration and tmpfiles rules remain functionally identical; only the conditional gating structure is eliminated.

Changes

Cohort / File(s)	Summary
Falcon Sensor Configuration named-hosts/matic/falcon.nix	Removes falconDebExists conditional block; systemd.tmpfiles.rules and systemd.services.falcon-sensor are now always defined regardless of .deb file presence.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• feat(security): add CrowdStrike Falcon and Kolide to matic host #724: Introduced the falconDebExists conditional gating in falcon.nix that this PR removes, making these changes directly related through the same configuration scope.

Poem

🐰 A conditional falls away,
Like morning mist at break of day—
No gates to guard the falcon's flight,
The service runs both day and night! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: removing a conditional check for the falcon .deb file from the matic falcon.nix configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check	✅ Passed	The pull request description directly addresses the changeset by explaining the removal of the builtins.pathExists conditional and providing technical rationale for the change.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/falcon-remove-conditional

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[mesa-dot-dev]

Mesa Description

TL;DR

Removed a faulty conditional check for the falcon .deb package in the NixOS configuration on matic.

What changed?

• Removed builtins.pathExists conditional from falcon.nix.
• This change ensures the falcon module is always enabled.
• If the .deb file is missing, the build will now fail with a clear error.

^{Description generated by Mesa. Update settings}

[cubic-dev-ai]

No issues found across 1 file

[gemini-code-assist]

Code Review

This pull request successfully removes the conditional check for the falcon-sensor.deb file, addressing the unreliability of builtins.pathExists with flakes for external paths. The module is now always enabled, and the build will fail with a clear error if the .deb is missing, which is a more robust approach. The changes align well with the provided technical details and simplify the configuration.

[mesa-dot-dev]

Performed full review of 8aa885b...aa86229

Analysis

1. The removal of the pathExists check creates a hard dependency on a manually-placed proprietary binary (.deb file), causing immediate build failure if missing, which breaks reproducibility and violates Nix principles.

2. This approach introduces fragility in CI/CD, disaster recovery scenarios, and for other developers using this repository, as the configuration will fail to evaluate without the non-tracked binary.

3. The solution trades proper error handling for a brittle build-time dependency, negatively impacting developer experience and system robustness.

4. Better alternatives exist: using a module with an explicit enable option, runtime assertions, making it a separate optional import, or using fetchurl with a hash for reproducibility.

Tip

Help

Slash Commands:

• /review - Request a full code review
• /review latest - Review only changes since the last review
• /describe - Generate PR description. This will update the PR body or issue comment depending on your configuration
• /help - Get help with Mesa commands and configuration options

^{0 files reviewed | 0 comments | Edit Agent Settings • Read Docs}

[Copilot]

Pull request overview

This PR fixes a technical issue with the Falcon sensor configuration by removing a problematic conditional check that doesn't work reliably with Nix flakes.

Changes:

• Removed builtins.pathExists check and related conditional logic for falcon-sensor.deb
• Module is now always enabled; build fails with clear error if .deb file is missing
• Updated documentation comments to reflect the new behavior

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.