perf: convert all images to WebP with PDF fallback

Add WebP versions of all 187 PNG/JPG images (38MB → 17MB, 55% reduction).
Update RST/MD references to use Sphinx wildcard syntax (.*) so HTML builds
use WebP while PDF/LaTeX builds fall back to original PNG/JPG.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

26 files changed, 46 insertions, 46 deletions

diff --git a/docs/configexamples/ansible.rst b/docs/configexamples/ansible.rst
index 0f4dbbda..ab3413eb 100644
--- a/docs/configexamples/ansible.rst
+++ b/docs/configexamples/ansible.rst
@@ -14,7 +14,7 @@ We have four pre-configured routers with this configuration:
 
 Using the general schema for example:
 
-.. image:: /_static/images/ansible.png
+.. image:: /_static/images/ansible.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst b/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst
index 77f9b118..f2a98479 100644
--- a/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst
+++ b/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst
@@ -18,7 +18,7 @@ The topology has 3 VyOS routers and one client. Between the DHCP Server and
 the DHCP Relay is a GRE tunnel. The `transport` VyOS represent a large
 Network.
 
-.. image:: _include/topology.png
+.. image:: _include/topology.*
   :alt: Ansible Example topology image
 
 *************
diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/_include/topology.webp b/docs/configexamples/autotest/DHCPRelay_through_GRE/_include/topology.webp
new file mode 100644
index 00000000..592484cb
--- /dev/null
+++ b/docs/configexamples/autotest/DHCPRelay_through_GRE/_include/topology.webp
diff --git a/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst b/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst
index 2a528852..6092199b 100644
--- a/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst
+++ b/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst
@@ -53,7 +53,7 @@ Topology
 
 We use the following network topology in this example:
 
-.. image:: _include/topology.png
+.. image:: _include/topology.*
   :alt: L3VPN EVPN with VyOS topology image
 
 
diff --git a/docs/configexamples/autotest/L3VPN_EVPN/_include/topology.webp b/docs/configexamples/autotest/L3VPN_EVPN/_include/topology.webp
new file mode 100644
index 00000000..f3218799
--- /dev/null
+++ b/docs/configexamples/autotest/L3VPN_EVPN/_include/topology.webp
diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst
index 6666399d..0ddd7e3e 100644
--- a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst
+++ b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst
@@ -14,7 +14,7 @@ Topology consists of:
  * VyOS as a OpenVPN Server
  * VyOS as Client
 
-.. image:: _include/topology.png
+.. image:: _include/topology.*
   :alt: OpenVPN with LDAP topology image
 
 Active Directory on Windows server
diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/_include/topology.webp b/docs/configexamples/autotest/OpenVPN_with_LDAP/_include/topology.webp
new file mode 100644
index 00000000..13bf2d73
--- /dev/null
+++ b/docs/configexamples/autotest/OpenVPN_with_LDAP/_include/topology.webp
diff --git a/docs/configexamples/autotest/Wireguard/Wireguard.rst b/docs/configexamples/autotest/Wireguard/Wireguard.rst
index 1feb03e8..7d7b216a 100644
--- a/docs/configexamples/autotest/Wireguard/Wireguard.rst
+++ b/docs/configexamples/autotest/Wireguard/Wireguard.rst
@@ -17,7 +17,7 @@ Topology
 The topology have a central and a branch VyOS router and one client, to
 test, in each site.
 
-.. image:: _include/topology.png
+.. image:: _include/topology.*
   :alt: Ansible Example topology image
 
 *************
diff --git a/docs/configexamples/autotest/Wireguard/_include/topology.webp b/docs/configexamples/autotest/Wireguard/_include/topology.webp
new file mode 100644
index 00000000..3cc5e992
--- /dev/null
+++ b/docs/configexamples/autotest/Wireguard/_include/topology.webp
diff --git a/docs/configexamples/autotest/tunnelbroker/_include/topology.webp b/docs/configexamples/autotest/tunnelbroker/_include/topology.webp
new file mode 100644
index 00000000..c3a812ab
--- /dev/null
+++ b/docs/configexamples/autotest/tunnelbroker/_include/topology.webp
diff --git a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst
index 370cf9d6..194fbbad 100644
--- a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst
+++ b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst
@@ -28,7 +28,7 @@ Topology
 The example topology has 2 VyOS routers. One as The WAN Router and on as a
 Client, to test a single LAN setup
 
-.. image:: _include/topology.png
+.. image:: _include/topology.*
   :alt: Tunnelbroker topology image
 
 
diff --git a/docs/configexamples/dmvpn-dualhub-dualcloud.rst b/docs/configexamples/dmvpn-dualhub-dualcloud.rst
index 5a789647..7bcfcf84 100644
--- a/docs/configexamples/dmvpn-dualhub-dualcloud.rst
+++ b/docs/configexamples/dmvpn-dualhub-dualcloud.rst
@@ -15,7 +15,7 @@ as a Spoke.
 Network Topology
 ================
 
-.. image:: /_static/images/dual-hub-DMVPN.png
+.. image:: /_static/images/dual-hub-DMVPN.*
    :width: 80%
    :align: center
    :alt: DMVPN Network Topology
diff --git a/docs/configexamples/fwall-and-vrf.rst b/docs/configexamples/fwall-and-vrf.rst
index 38663a18..fb65e3a4 100644
--- a/docs/configexamples/fwall-and-vrf.rst
+++ b/docs/configexamples/fwall-and-vrf.rst
@@ -8,7 +8,7 @@ This example shows how to configure a VyOS router with VRFs and firewall rules.
 
 Diagram used in this example:
 
-.. image:: /_static/images/firewall-and-vrf-blueprints.png
+.. image:: /_static/images/firewall-and-vrf-blueprints.*
     :width: 80%
     :align: center
     :alt: Network Topology Diagram
diff --git a/docs/configexamples/inter-vrf-routing-vrf-lite.rst b/docs/configexamples/inter-vrf-routing-vrf-lite.rst
index 11c23bf0..fd4f6489 100644
--- a/docs/configexamples/inter-vrf-routing-vrf-lite.rst
+++ b/docs/configexamples/inter-vrf-routing-vrf-lite.rst
@@ -70,7 +70,7 @@ community(ies) into that prefix.
 ********
 Topology
 ********
-.. image:: /_static/images/inter-vrf-routing-vrf-lite.png
+.. image:: /_static/images/inter-vrf-routing-vrf-lite.*
    :width: 70%
    :align: center
    :alt: Network Topology Diagram
diff --git a/docs/configexamples/ipsec-cisco-policy-based.rst b/docs/configexamples/ipsec-cisco-policy-based.rst
index 787c1140..257d98a1 100644
--- a/docs/configexamples/ipsec-cisco-policy-based.rst
+++ b/docs/configexamples/ipsec-cisco-policy-based.rst
@@ -15,7 +15,7 @@ initiator role on VyOS side.
 Network Topology
 ================
 
-.. image:: /_static/images/cisco-vpn-ipsec.png
+.. image:: /_static/images/cisco-vpn-ipsec.*
    :align: center
    :alt: Network Topology Diagram
 
diff --git a/docs/configexamples/ipsec-cisco-route-based.rst b/docs/configexamples/ipsec-cisco-route-based.rst
index f7c3cb08..955c21d4 100644
--- a/docs/configexamples/ipsec-cisco-route-based.rst
+++ b/docs/configexamples/ipsec-cisco-route-based.rst
@@ -16,7 +16,7 @@ inside the tunnel.
 Network Topology
 ================
 
-.. image:: /_static/images/cisco-vpn-ipsec.png
+.. image:: /_static/images/cisco-vpn-ipsec.*
    :align: center
    :alt: Network Topology Diagram
 
diff --git a/docs/configexamples/ipsec-pa-route-based.rst b/docs/configexamples/ipsec-pa-route-based.rst
index b6f6f3a7..0b629041 100644
--- a/docs/configexamples/ipsec-pa-route-based.rst
+++ b/docs/configexamples/ipsec-pa-route-based.rst
@@ -17,7 +17,7 @@ include firewall configuration.
 Network Topology
 ================
 
-.. image:: /_static/images/ipsec-vyos-pa.png
+.. image:: /_static/images/ipsec-vyos-pa.*
    :align: center
    :alt: Network Topology Diagram
 
@@ -137,36 +137,36 @@ Palo Alto
 GUI Configuration:
  Network -> Network Profiles -> IKE Crypto
 
- .. image:: /_static/images/PA-IKE-group.png
+ .. image:: /_static/images/PA-IKE-group.*
    :align: center
 
  Network -> Network Profiles -> IKE Gateways
 
- .. image:: /_static/images/PA-IKE-GW-1.png
+ .. image:: /_static/images/PA-IKE-GW-1.*
    :align: center
 
- .. image:: /_static/images/PA-IKE-GW-2.png
+ .. image:: /_static/images/PA-IKE-GW-2.*
    :align: center
 
  Network -> Network Profiles -> IPSec Crypto
 
- .. image:: /_static/images/PA-ESP-group.png
+ .. image:: /_static/images/PA-ESP-group.*
    :align: center
 
  Network -> Interfaces
 
- .. image:: /_static/images/PA-tunnel-1.png
+ .. image:: /_static/images/PA-tunnel-1.*
    :align: center
 
- .. image:: /_static/images/PA-tunnel-2.png
+ .. image:: /_static/images/PA-tunnel-2.*
    :align: center
 
- .. image:: /_static/images/PA-tunnel-3.png
+ .. image:: /_static/images/PA-tunnel-3.*
    :align: center
 
  Network -> IPSec Tunnels
 
- .. image:: /_static/images/PA-IPsec-tunnel.png
+ .. image:: /_static/images/PA-IPsec-tunnel.*
    :align: center
 
 CLI configuration with OSPF:
diff --git a/docs/configexamples/l3vpn-hub-and-spoke.rst b/docs/configexamples/l3vpn-hub-and-spoke.rst
index e4b0d933..1533d0d8 100644
--- a/docs/configexamples/l3vpn-hub-and-spoke.rst
+++ b/docs/configexamples/l3vpn-hub-and-spoke.rst
@@ -53,7 +53,7 @@ General information can be found in the :ref:`configuration/vrf/index:L3VPN VRFs
 ********
 Topology
 ********
-.. image:: /_static/images/L3VPN_hub_and_spoke.png
+.. image:: /_static/images/L3VPN_hub_and_spoke.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
diff --git a/docs/configexamples/lac-lns.rst b/docs/configexamples/lac-lns.rst
index 8443ddff..98bad773 100644
--- a/docs/configexamples/lac-lns.rst
+++ b/docs/configexamples/lac-lns.rst
@@ -20,7 +20,7 @@ All users with domain **vyos.io** will be tunneled to LNS via L2TP.
 Network Topology
 ================
 
-.. image:: /_static/images/lac-lns-diagram.jpg
+.. image:: /_static/images/lac-lns-diagram.*
    :width: 60%
    :align: center
    :alt: Network Topology Diagram
@@ -105,7 +105,7 @@ Client
 
 In this lab we use Windows PPPoE client.
 
-.. image:: /_static/images/lac-lns-winclient.jpg
+.. image:: /_static/images/lac-lns-winclient.*
    :width: 100%
    :align: center
    :alt: Window PPPoE Client Configuration
diff --git a/docs/configexamples/nmp.rst b/docs/configexamples/nmp.rst
index 913e7107..b25142cd 100644
--- a/docs/configexamples/nmp.rst
+++ b/docs/configexamples/nmp.rst
@@ -27,37 +27,37 @@ Configuration 'NMP'
 
 Next, you just  should follow the pictures:
 
-.. image:: /_static/images/nmp1.png
+.. image:: /_static/images/nmp1.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
    
-.. image:: /_static/images/nmp2.png
+.. image:: /_static/images/nmp2.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
    
-.. image:: /_static/images/nmp3.png
+.. image:: /_static/images/nmp3.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
    
-.. image:: /_static/images/nmp4.png
+.. image:: /_static/images/nmp4.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
 
-.. image:: /_static/images/nmp5.png
+.. image:: /_static/images/nmp5.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
 
-.. image:: /_static/images/nmp6.png
+.. image:: /_static/images/nmp6.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
 
-.. image:: /_static/images/nmp7.png
+.. image:: /_static/images/nmp7.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
diff --git a/docs/configexamples/policy-based-ipsec-and-firewall.rst b/docs/configexamples/policy-based-ipsec-and-firewall.rst
index 60f8b888..cb93daa9 100644
--- a/docs/configexamples/policy-based-ipsec-and-firewall.rst
+++ b/docs/configexamples/policy-based-ipsec-and-firewall.rst
@@ -40,7 +40,7 @@ This configuration example and the requirements consists of:
     - Allow connections from LANs to LANs through the tunnel.
 
 
-.. image:: /_static/images/policy-based-ipsec-and-firewall.png
+.. image:: /_static/images/policy-based-ipsec-and-firewall.*
 
 
 Configuration
diff --git a/docs/configexamples/pppoe-ipv6-basic.rst b/docs/configexamples/pppoe-ipv6-basic.rst
index ad588def..520ca00b 100644
--- a/docs/configexamples/pppoe-ipv6-basic.rst
+++ b/docs/configexamples/pppoe-ipv6-basic.rst
@@ -17,7 +17,7 @@ please contact your ISP for more information.
 Network Topology
 ================
 
-.. image:: /_static/images/pppoe-ipv6-pd-diagram.jpg
+.. image:: /_static/images/pppoe-ipv6-pd-diagram.*
    :width: 60%
    :align: center
    :alt: Network Topology Diagram
diff --git a/docs/configexamples/qos.rst b/docs/configexamples/qos.rst
index 842719c5..66751286 100644
--- a/docs/configexamples/qos.rst
+++ b/docs/configexamples/qos.rst
@@ -15,7 +15,7 @@ We recommend you to go through the main article about `QoS <https://docs.vyos.io
 
 Using the general schema for example:
 
-.. image:: /_static/images/qos1.png
+.. image:: /_static/images/qos1.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
@@ -66,21 +66,21 @@ Main rules:
 
 Check the result
 
-.. image:: /_static/images/qos2.png
+.. image:: /_static/images/qos2.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
 
 Before the interface eth0 on router VyOS3
 
-.. image:: /_static/images/qos3.png
+.. image:: /_static/images/qos3.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
 
 After the interface eth0 on router VyOS3
 
-.. image:: /_static/images/qos4.png
+.. image:: /_static/images/qos4.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
@@ -105,7 +105,7 @@ On the router, VyOS4 set all traffic as CS4. We have to configure the default cl
 
 Next on the router VyOS2 we will change labels on all incoming traffic only from CS4-> CS6
 
-.. image:: /_static/images/qos5.png
+.. image:: /_static/images/qos5.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
@@ -128,28 +128,28 @@ Next on the router VyOS2 we will change labels on all incoming traffic only from
 	set qos policy shaper vyos2 default queue-type 'fair-queue'
         set qos interface eth2 egress 'vyos2'
 
-.. image:: /_static/images/qos6.png
+.. image:: /_static/images/qos6.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
 
 * 172.17.1.2/24 CS0 
 
-.. image:: /_static/images/qos7.png
+.. image:: /_static/images/qos7.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
 
 * 172.17.1.2/24 CS0 - > CS4
 
-.. image:: /_static/images/qos8.png
+.. image:: /_static/images/qos8.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
 
 * 172.17.1.2/24 CS4 - > CS5
 
-.. image:: /_static/images/qos9.png
+.. image:: /_static/images/qos9.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
@@ -174,7 +174,7 @@ Set up bandwidth limits on the eth2 interface of the router “VyOS2”.
 
 Check the result.
 
-.. image:: /_static/images/qos10.png
+.. image:: /_static/images/qos10.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
diff --git a/docs/configexamples/segment-routing-isis.rst b/docs/configexamples/segment-routing-isis.rst
index d9bc439b..86cbec26 100644
--- a/docs/configexamples/segment-routing-isis.rst
+++ b/docs/configexamples/segment-routing-isis.rst
@@ -11,7 +11,7 @@ blue print as an initial setup to get MPLS ISIS-SR working between those two
 devices.The lab was build using :abbr:`EVE-NG (Emulated Virtual
 Environment NG)`.
 
-.. figure:: /_static/images/vyos-sr-isis.png
+.. figure:: /_static/images/vyos-sr-isis.*
    :alt: ISIS-SR network
 
    ISIS-SR example network
diff --git a/docs/configexamples/wan-load-balancing.rst b/docs/configexamples/wan-load-balancing.rst
index 0952cfe5..906078bb 100644
--- a/docs/configexamples/wan-load-balancing.rst
+++ b/docs/configexamples/wan-load-balancing.rst
@@ -13,7 +13,7 @@ Example 1: Distributing load evenly
 
 The setup used in this example is shown in the following diagram:
 
-.. image:: /_static/images/Wan_load_balancing1.png
+.. image:: /_static/images/Wan_load_balancing1.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram
@@ -158,7 +158,7 @@ Example 5: Exclude traffic from load balancing
 In this example two LAN interfaces exist in different subnets instead
 of one like in the previous examples:
 
-.. image:: /_static/images/Wan_load_balancing_exclude1.png                      
+.. image:: /_static/images/Wan_load_balancing_exclude1.*                      
    :width: 80%                                                          
    :align: center                                                       
    :alt: Network Topology Diagram 
diff --git a/docs/configexamples/zone-policy.rst b/docs/configexamples/zone-policy.rst
index d0101ebf..3c387519 100644
--- a/docs/configexamples/zone-policy.rst
+++ b/docs/configexamples/zone-policy.rst
@@ -39,7 +39,7 @@ adapted for however many NICs you have**:
 * DMZ cannot access LAN resources.
 * Inbound WAN connect to DMZ host.
 
-.. image:: /_static/images/zone-policy-diagram.png
+.. image:: /_static/images/zone-policy-diagram.*
    :width: 80%
    :align: center
    :alt: Network Topology Diagram