initial commit

roles/falcon_onboarding/defaults/main.yml

@@ -0,0 +1,9 @@
+---
+# The sensor can only be downloaded via an authenticated CrowdStrike API/
+# console session, so exactly one of these must be provided per environment:
+#   falcon_onboarding_sensor_package_url - internal hosted download URL
+#   falcon_onboarding_sensor_package_src - local path on the control node
+falcon_onboarding_sensor_package_url: ""
+falcon_onboarding_sensor_package_src: ""
+falcon_onboarding_provisioning_token: ""
+falcon_onboarding_cloud_region: "eu-1"

roles/falcon_onboarding/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: restart falcon-sensor
+  ansible.builtin.systemd:
+    name: falcon-sensor
+    state: restarted

roles/falcon_onboarding/tasks/main.yml

@@ -0,0 +1,100 @@
+---
+- name: Include OS-family-specific variables
+  ansible.builtin.include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ ansible_facts['os_family'] }}.yml"
+    - "default.yml"
+  tags: [falcon_onboarding, always]
+
+- name: Verify a sensor package source is defined
+  ansible.builtin.assert:
+    that:
+      - falcon_onboarding_sensor_package_url | length > 0 or falcon_onboarding_sensor_package_src | length > 0
+    fail_msg: >-
+      Neither falcon_onboarding_sensor_package_url nor
+      falcon_onboarding_sensor_package_src is set. Provide the sensor
+      package matching this host's OS (see roles/falcon_onboarding/defaults/main.yml).
+  tags: [falcon_onboarding]
+
+- name: Download sensor package from internal URL
+  ansible.builtin.get_url:
+    url: "{{ falcon_onboarding_sensor_package_url }}"
+    dest: "/tmp/falcon-sensor.{{ falcon_onboarding_package_ext }}"
+    owner: root
+    group: root
+    mode: "0644"
+  when: falcon_onboarding_sensor_package_url | length > 0
+  tags: [falcon_onboarding]
+
+- name: Copy sensor package from the Ansible control node
+  ansible.builtin.copy:
+    src: "{{ falcon_onboarding_sensor_package_src }}"
+    dest: "/tmp/falcon-sensor.{{ falcon_onboarding_package_ext }}"
+    owner: root
+    group: root
+    mode: "0644"
+  when: falcon_onboarding_sensor_package_url | length == 0 and falcon_onboarding_sensor_package_src | length > 0
+  tags: [falcon_onboarding]
+
+- name: Install Falcon sensor (RedHat family)
+  ansible.builtin.dnf:
+    name: "/tmp/falcon-sensor.rpm"
+    state: present
+    disable_gpg_check: false
+  when: ansible_facts['os_family'] == "RedHat"
+  register: falcon_onboarding_install_result
+  tags: [falcon_onboarding]
+
+- name: Install Falcon sensor (Debian family)
+  ansible.builtin.apt:
+    deb: "/tmp/falcon-sensor.deb"
+  when: ansible_facts['os_family'] == "Debian"
+  register: falcon_onboarding_install_result
+  tags: [falcon_onboarding]
+
+- name: Remove downloaded/copied sensor package
+  ansible.builtin.file:
+    path: "/tmp/falcon-sensor.{{ falcon_onboarding_package_ext }}"
+    state: absent
+  tags: [falcon_onboarding]
+
+- name: Configure Customer ID (CID)
+  ansible.builtin.command: "/opt/CrowdStrike/falconctl -s --cid={{ falcon_cid }}"
+  changed_when: true
+  no_log: true
+  notify: restart falcon-sensor
+  tags: [falcon_onboarding]
+
+- name: Configure provisioning token if required
+  ansible.builtin.command: "/opt/CrowdStrike/falconctl -s --provisioning-token={{ falcon_onboarding_provisioning_token }}"
+  changed_when: true
+  no_log: true
+  when: falcon_onboarding_provisioning_token | length > 0
+  notify: restart falcon-sensor
+  tags: [falcon_onboarding]
+
+- name: Enable and start the Falcon sensor service
+  ansible.builtin.systemd:
+    name: falcon-sensor
+    enabled: true
+    state: started
+  tags: [falcon_onboarding]
+
+- name: Check reduced-functionality mode (RFM)
+  ansible.builtin.command: /opt/CrowdStrike/falconctl -g --rfm-state
+  register: falcon_onboarding_rfm_state
+  changed_when: false
+  failed_when: false
+  tags: [falcon_onboarding]
+
+- name: Query agent ID (AID) for verification
+  ansible.builtin.command: /opt/CrowdStrike/falconctl -g --aid
+  register: falcon_onboarding_aid
+  changed_when: false
+  failed_when: false
+  tags: [falcon_onboarding]
+
+- name: Report Falcon onboarding status
+  ansible.builtin.debug:
+    msg: "CrowdStrike Falcon on {{ inventory_hostname }} - {{ falcon_onboarding_rfm_state.stdout }} | {{ falcon_onboarding_aid.stdout }}"
+  tags: [falcon_onboarding]

roles/falcon_onboarding/vars/Debian.yml

@@ -0,0 +1,2 @@
+---
+falcon_onboarding_package_ext: deb

roles/falcon_onboarding/vars/RedHat.yml

@@ -0,0 +1,2 @@
+---
+falcon_onboarding_package_ext: rpm