wpa2 hostap setup

i386 (soekris) 8-current

i currently have

wlans_ath0="wlan0 wlan1"
create_args_wlan0="wlanmode hostap channel 11 ssid rgnet-aden wep wepkey itsasecretsilly weptxkey 1 media autoselect mode 11g up"
create_args_wlan1="wlanmode hostap ssid rg-free up"
cloned_interfaces=bridge0
ifconfig_bridge0="192.168.0.1 addm vr1 addm vr2 addm vr3 addm wlan0 addm wlan1 up"
ifconfig_vr1=up
ifconfig_vr2=up
ifconfig_vr3=up

i want to go to a more reasonable over the air crypt sceheme, e.g. wpa2.
clients are mac, airport express, and winxp.  is there a well known
recipe?

i think i need to run hostapd with a hostapd.conf something like

    interface=wlan0
    ctrl_interface=/var/run/hostapd
    ctrl_interface_group=0
    ssid=rgnet-aden
    country_code=JP
    hw_mode=g
    channel=42
    auth_algs=3
    wpa=1
    wpa_passphrase=itsasecretsilly
    wpa_key_mgmt=WPA-PSK

i could not really understand the dual bssid stuff and many of the
options.  and when i get that sorted, what do i do to my /etc/rc.conf?

randy