lychee.toml

# Lychee link checker configuration
# See: https://lychee.cli.rs/

# Accept these HTTP status codes as "OK"
accept = [200, 204, 301, 302]

# Root directory for resolving relative links
root_dir = "documentation/docs"

# Exclude SUMMARY.md — it uses mdBook's [Title]() syntax for section headers
exclude_path = ["documentation/docs/SUMMARY.md"]

# Check links to files on disk
include_verbatim = false

# Maximum number of concurrent requests
max_concurrency = 16

# Number of retries for transient failures (5xx, timeouts, connection resets)
max_retries = 3

# Wait time between retries (seconds)
retry_wait_time = 2

# HTTP timeout (seconds)
timeout = 30

# User-Agent header
user_agent = "lychee/0.15 (Cosmian KMS docs; https://github.com/Cosmian/kms)"

# ── Excluded URL patterns ──────────────────────────────────────────────────
# Sites that block automated crawlers, rate-limit, or return 5xx to bots

exclude = [
  # Local / internal references
  'localhost',
  'host\.docker\.internal',
  '@',
  'eviden_vm',
  'cbom',
  'sbom',
  'search/findex',
  '\.\./cosmian_cli',
  '\.\./cosmian_vm',
  '\.\./search',

  # URL schemes not supported by lychee
  'chrome://',
  'mailto:',

  # NIST/IETF publication servers — rate-limit / occasionally return 5xx to bots
  'csrc\.nist\.gov',
  'nvlpubs\.nist\.gov',
  'rfc-editor\.org',

  # readthedocs.io — returns 429 to automated requests
  'readthedocs\.io',

  # Sites that block automated crawlers (valid in browser but return 4xx/5xx to bots)
  'cosmian\.com',
  'package\.cosmian\.com',
  'www\.mysql\.com',
  'crates\.io',
  'support\.google\.com',
  'admin\.google\.com',
  'github\.com/sfackler',
  'jwt\.io',

  # Placeholder/example URLs used in documentation
  'vault\.azure\.net',
  'kms\.my_domain\.com',
  'pkce_auth_example\.md',

  # Autogenerated CLI reference — not a real page
  'kms_clients/cli/main_commands',
  'kms_clients/installation',

  # Miscellaneous sites that block or rate-limit bots
  'knowledge\.workspace\.google\.com',
  'dev\.mysql\.com',
  'techdocs\.broadcom\.com',
  'swagger\.io',

  # Kubernetes SIG documentation site — resets connections from automated crawlers
  'secrets-store-csi-driver\.sigs\.k8s\.io',
  # kubernetes.io — connection failures from CI runners
  'kubernetes\.io',
  # Google Workspace blog — aggressive 429 rate limiting from CI IPs
  'workspaceupdates\.googleblog\.com',
  # OVHcloud — blocks automated requests from CI runners
  'ovhcloud\.com',

  # Fragment/anchor patterns that are not real URLs
  'get--export',
  'not-possible',
  'wrapped-by-an-hsm-key',
]