workaround for huge musl binaries

something in our configuration is causing gcc to generate binaries
in excess of 68K for "hello world". hardeningDisable seems to stop it
doing that, turning it on for s6 which writes _lots_ of binaries
but would be good to get to the bottom of this

https://discourse.nixos.org/t/crosscompilation-to-musl32-problems/3110
may have more

overlay.nix

@@ -15,22 +15,25 @@ let
       builtins.filter (x: (builtins.match "(PLAT|MYLIBS).*" x) == null)
         o.makeFlags;
   });
+
   s6 = prev.s6.overrideAttrs(o:
-    let patch = fetchpatch {
-          # add "p" directive in s6-log
-          url = "https://github.com/skarnet/s6/commit/ddc76841398dfd5e18b22943727ad74b880236d3.patch";
-          hash = "sha256-fBtUinBdp5GqoxgF6fcR44Tu8hakxs/rOShhuZOgokc=";
-        };
-        config = builtins.filter
-          (x: (builtins.match ".*shared.*" x) == null)
-          o.configureFlags;
-        patch_needed = builtins.compareVersions o.version "2.11.1.2" <= 0;
+    let
+      patch = fetchpatch {
+        # add "p" directive in s6-log
+        url = "https://github.com/skarnet/s6/commit/ddc76841398dfd5e18b22943727ad74b880236d3.patch";
+        hash = "sha256-fBtUinBdp5GqoxgF6fcR44Tu8hakxs/rOShhuZOgokc=";
+      };
+      patch_needed = builtins.compareVersions o.version "2.11.1.2" <= 0;
     in {
-      configureFlags = config ++ [
+      configureFlags = (builtins.filter
+        (x: (builtins.match ".*shared.*" x) == null)
+        o.configureFlags) ++
+      [
         "--disable-allstatic"
         "--disable-static"
         "--enable-shared"
       ];
+      hardeningDisable = ["all"];
       stripAllList = [ "sbin" "bin" ];
       patches =
         (if o ? patches then o.patches else []) ++
@@ -121,7 +124,32 @@ extraPkgs // {
       nettle = null;
     };
 
-  hostapd = prev.hostapd.override { sqlite = null; };
+  hostapd =
+    let
+      config =  [
+        "CONFIG_DRIVER_NL80211=y"
+        "CONFIG_IAPP=y"
+        "CONFIG_IEEE80211AC=y"
+        "CONFIG_IEEE80211N=y"
+        "CONFIG_IEEE80211W=y"
+        "CONFIG_INTERNAL_LIBTOMMATH=y"
+        "CONFIG_INTERNAL_LIBTOMMATH_FAST=y"
+        "CONFIG_IPV6=y"
+        "CONFIG_LIBNL32=y"
+        "CONFIG_PKCS12=y"
+        "CONFIG_RSN_PREAUTH=y"
+        "CONFIG_TLS=internal"
+      ];
+      h = prev.hostapd.overrideAttrs(o: {
+        extraConfig = "";
+        configurePhase = ''
+          cat > hostapd/defconfig <<EOF
+          ${builtins.concatStringsSep "\n" config}
+          EOF
+          ${o.configurePhase}
+        '';
+      });
+    in h.override { openssl = null; sqlite = null; };
 
   dropbear = prev.dropbear.overrideAttrs (o: {
     postPatch = ''