Falcon package

falcon-default.nix

{ stdenv, lib, pkgs, dpkg,                                                                                                                                                                                                                                                                            
openssl, libnl, zlib,                                                                                                                                                                                                                                                                                 
fetchurl, autoPatchelfHook, buildFHSUserEnv, writeScript, ... }:                                                                                                                                                                                                                                      
let                                                                                                                                                                                                                                                                                                   
  pname = "falcon-sensor";                                                                                                                                                                                                                                                                            
  version = "6.31.0-12803";                                                                                                                                                                                                                                                                           
  arch = "amd64";                                                                                                                                                                                                                                                                                     
  src = /opt/CrowdStrike + "/ubuntu_${pname}_${version}_${arch}.deb";                                                                                                                                                                                                                                 
  falcon-sensor = stdenv.mkDerivation {                                                                                                                                                                                                                                                               
    inherit version arch src;                                                                                                                                                                                                                                                                         
    name = pname;                                                                                                                                                                                                                                                                                     
                                                                                                                                                                                                                                                                                                      
    buildInputs = [ dpkg zlib autoPatchelfHook ];                                                                                                                                                                                                                                                     
                                                                                                                                                                                                                                                                                                      
    sourceRoot = ".";                                                                                                                                                                                                                                                                                 
                                                                                                                                                                                                                                                                                                      
    unpackPhase = ''                                                                                                                                                                                                                                                                                  
        dpkg-deb -x $src .                                                                                                                                                                                                                                                                            
    '';                                                                                                                                                                                                                                                                                               
                                                                                                                                                                                                                                                                                                      
    installPhase = ''                                                                                                                                                                                                                                                                                 
        cp -r . $out                                                                                                                                                                                                                                                                                  
    '';                                                                                                                                                                                                                                                                                               
                                                                                                                                                                                                                                                                                                      
    meta = with lib; {                                                                                                                                                                                                                                                                                
      description = "Crowdstrike Falcon Sensor";                                                                                                                                                                                                                                                      
      homepage    = "https://www.crowdstrike.com/";                                                                                                                                                                                                                                                   
      license     = licenses.unfree;                                                                                                                                                                                                                                                                  
      platforms   = platforms.linux;                                                                                                                                                                                                                                                                  
      maintainers = with maintainers; [ klden ];                                                                                                                                                                                                                                                      
    };                                                                                                                                                                                                                                                                                                
  };                                                                                                                                                                                                                                                                                                  
in buildFHSUserEnv {                                                                                                                                                                                                                                                                                  
  name = "fs-bash";                                                                                                                                                                                                                                                                                   
  targetPkgs = pkgs: [ libnl openssl zlib ];                                                                                                                                                                                                                                                          
                                                                                                                                                                                                                                                                                                      
  extraInstallCommands = ''                                                                                                                                                                                                                                                                           
    ln -s ${falcon-sensor}/* $out/                                                                                                                                                                                                                                                                    
  '';                                                                                                                                                                                                                                                                                                 
                                                                                                                                                                                                                                                                                                      
  runScript = "bash";                                                                                                                                                                                                                                                                                 
}         

falcon.nix

{  pkgs, ... }:                                                                                                                                                                                                                                                                                       
let                                                                                                                                                                                                                                                                                                   
  falcon = pkgs.callPackage ./falcon { };                                                                                                                                                                                                                                                             
  startPreScript = pkgs.writeScript "init-falcon" ''                                                                                                                                                                                                                                                  
    #! ${pkgs.bash}/bin/sh                                                                                                                                                                                                                                                                            
    /run/current-system/sw/bin/mkdir -p /opt/CrowdStrike                                                                                                                                                                                                                                              
    ln -sf ${falcon}/opt/CrowdStrike/* /opt/CrowdStrike                                                                                                                                                                                                                                               
    ${falcon}/bin/fs-bash -c "${falcon}/opt/CrowdStrike/falconctl -g --cid"                                                                                                                                                                                                                           
  '';                                                                                                                                                                                                                                                                                                 
in {                                                                                                                                                                                                                                                                                                  
  systemd.services.falcon-sensor = {                                                                                                                                                                                                                                                                  
    enable = true;                                                                                                                                                                                                                                                                                    
    description = "CrowdStrike Falcon Sensor";                                                                                                                                                                                                                                                        
    unitConfig.DefaultDependencies = false;                                                                                                                                                                                                                                                           
    after = [ "local-fs.target" ];                                                                                                                                                                                                                                                                    
    conflicts = [ "shutdown.target" ];                                                                                                                                                                                                                                                                
    before = [ "sysinit.target" "shutdown.target" ];                                                                                                                                                                                                                                                  
    serviceConfig = {                                                                                                                                                                                                                                                                                 
      ExecStartPre = "${startPreScript}";                                                                                                                                                                                                                                                             
      ExecStart = "${falcon}/bin/fs-bash -c \"${falcon}/opt/CrowdStrike/falcond\"";                                                                                                                                                                                                                   
      Type = "forking";                                                                                                                                                                                                                                                                               
      PIDFile = "/run/falcond.pid";                                                                                                                                                                                                                                                                   
      Restart = "no";                                                                                                                                                                                                                                                                                 
      TimeoutStopSec = "60s";                                                                                                                                                                                                                                                                         
      KillMode = "process";                                                                                                                                                                                                                                                                           
    };                                                                                                                                                                                                                                                                                                
    wantedBy = [ "multi-user.target" ];                                                                                                                                                                                                                                                               
  };                                                                                                                                                                                                                                                                                                  
}

Glad it worked well for you!