nix: Check static executable for /nix/store references

This makes the static build fail in case any references to the nix store
are left over. Those will increase the closure size of the nix derivation
massively and lead to a huge docker image.

At the same time, those references will not be functional on non-nix systems,
to which the static executable is distributed, anyway.

nix/static.nix

@@ -49,14 +49,31 @@ let
   makeExecutableStatic = drv: pkgs.lib.pipe drv [
     (lib.compose.appendConfigureFlags [ "--enable-executable-static" ])
     lib.compose.justStaticExecutables
+
+    # To successfully compile a redistributable, fully static executable we need to:
+    # 1. make executable really statically linked.
+    # 2. avoid any references to /nix/store to prevent blowing up the closure size.
+    # 3. be able to run the executable.
+    # When checking for references, we ignore the following:
+    # - eeee... are removed references which don't actually exist
+    # - openssl-etc references are purposely designed to be very small
     (lib.compose.overrideCabal (drv: {
-      postInstall = ''
+      postFixup = drv.postFixup + ''
         exe="$out/bin/postgrest"
+
         if ! (file "$exe" | grep 'statically linked') then
           echo "not a static executable, ldd output:"
           ldd "$exe"
           exit 1
         fi
+
+        echo "Checking for references to /nix/store..."
+        (${pkgsStatic.binutils}/bin/strings "$exe" \
+          | grep -v /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee \
+          | grep -v -etc/etc/ssl \
+          | grep /nix/store || exit 0 && exit 1)
+        echo "No references to /nix/store found"
+
         "$exe" --help
       '';
     }))