fix(falcon): preserve AID across rebuilds

SH
8mo ago
+8-3

Summary

  • Replace destructive rm -rf + cp -a with rsync --delete --exclude in Falcon sensor init script
  • Preserves falconstore, falconstore.bak, and CsConfig runtime state files across NixOS rebuilds
  • Prevents the sensor from re-registering as a new host and consuming duplicate Kolide license seats

Test plan

  • nixos-rebuild switch completes successfully
  • sudo /opt/CrowdStrike/falconctl -g --aid shows the same AID before and after rebuild
  • No duplicate node appears in Kolide dashboard

Summary by cubic

Preserves the CrowdStrike Falcon AID and runtime state across NixOS rebuilds to prevent sensor re-registration and duplicate Kolide seats. Switches the init script to rsync -a --delete with excludes for falconstore, falconstore.bak, and CsConfig under /opt/CrowdStrike.