Add auth2api

pkgs/auth2api/no-auth.patch

@@ -0,0 +1,30 @@
+--- a/src/config.ts
++++ b/src/config.ts
+@@ -137,15 +137,7 @@
+ 
+   raw.debug = normalizeDebugMode(raw.debug);
+ 
+-  // Auto-generate API key if none configured
+-  if (!raw["api-keys"] || raw["api-keys"].length === 0) {
+-    const key = generateApiKey();
+-    raw["api-keys"] = [key];
+-    fs.writeFileSync(filePath, yaml.dump(raw, { lineWidth: -1 }), {
+-      mode: 0o600,
+-    });
+-    console.log(`\nGenerated API key (saved to ${filePath}):\n\n  ${key}\n`);
+-  }
++  // Empty api-keys = unauthenticated mode (safe when binding to localhost).
+ 
+   return { ...raw, "api-keys": new Set(raw["api-keys"]) };
+ }
+--- a/src/server.ts
++++ b/src/server.ts
+@@ -94,6 +94,8 @@
+   // API key auth middleware — accepts both OpenAI style (Authorization: Bearer)
+   // and Anthropic style (x-api-key), so Claude Code and OpenAI clients both work
+   const requireApiKey: express.RequestHandler = (req, res, next) => {
++    // No keys configured — unauthenticated mode (localhost-only).
++    if (config["api-keys"].size === 0) { next(); return; }
+     const key = extractApiKey(req.headers);
+     if (!key) {
+       res.status(401).json({ error: { message: "Missing API key" } });

pkgs/auth2api/package.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  buildNpmPackage,
+  nodejs_20,
+  makeWrapper,
+  sources,
+}:
+
+buildNpmPackage {
+  pname = "auth2api";
+  version = sources.auth2api.version;
+  src = sources.auth2api.src;
+
+  nodejs = nodejs_20;
+
+  npmDepsHash = "sha256-lHwY5MQ0nRoOPcURzmJCiXiUxEx9ZwZJSWKbkD4ZuIA=";
+
+  # Patch to allow running with an empty api-keys list (unauthenticated).
+  # Safe because the service binds to 127.0.0.1 by default.
+  patches = [ ./no-auth.patch ];
+
+  # auth2api's build script is `tsc` (TypeScript compile → dist/)
+  # devDeps (typescript, tsx) are needed for the build; buildNpmPackage
+  # prunes them automatically after the build step completes.
+  npmBuildScript = "build";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  # buildNpmPackage installs the package under $out/lib/node_modules/auth2api/.
+  # Wire up a $out/bin/auth2api wrapper pointing at the compiled entry-point.
+  postInstall = ''
+    makeWrapper ${nodejs_20}/bin/node $out/bin/auth2api \
+      --add-flags "$out/lib/node_modules/auth2api/dist/index.js"
+  '';
+
+  meta = {
+    description = "Lightweight Claude OAuth to OpenAI-compatible API proxy";
+    homepage = "https://github.com/AmazingAng/auth2api";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+    platforms = lib.platforms.linux;
+    mainProgram = "auth2api";
+  };
+}