docs: address review feedback (backport from PR #1857)

🤖 Generated by [robots](https://vyos.io)

29 files changed, 93 insertions, 125 deletions

diff --git a/docs/Makefile b/docs/Makefile
index 29ef3906..ae12b802 100644
--- a/docs/Makefile
+++ b/docs/Makefile
@@ -42,6 +42,8 @@ livehtml: swap
 	@trap '$(SWAP) --restore' EXIT; \
 		sphinx-autobuild --host $(AUTOHOST) --port $(AUTOPORT) \
 		--ignore '$(BUILDDIR)/**' \
+		--ignore '**/_build/**' \
+		--ignore '**/md-*' \
 		"$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
 
 defaultvalue: export VYOS_DEFAULT=True
diff --git a/docs/automation/md-cloud-init.md b/docs/automation/md-cloud-init.md
index d957688e..e7797d4c 100644
--- a/docs/automation/md-cloud-init.md
+++ b/docs/automation/md-cloud-init.md
@@ -369,14 +369,10 @@ From cli or GUI, power on VM, and after it boots, verify configuration
 
 ### References
 
-- VyOS [cloud-init-docs].
 - Cloud-init [network-config-docs].
 - Proxmox [Cloud-init-Support].
 
-
-
-[cloud-init-docs]: https://docs.vyos.io/en/equuleus/automation/cloud-init.html?highlight=cloud-init#vyos-cloud-init
-[cloud-init-support]: https://pve.proxmox.com/pve-docs/pve-admin-guide.html#qm_cloud_init
+[cloud-init-support]: <https://pve.proxmox.com/pve-docs/pve-admin-guide.html#qm_cloud_init>
 [cloud-init-write_files]: https://cloudinit.readthedocs.io/en/latest/topics/examples.html#writing-out-arbitrary-files
 [network-config-docs]: https://cloudinit.readthedocs.io/en/latest/topics/network-config.html
 [nocloud]: https://cloudinit.readthedocs.io/en/latest/reference/datasources/nocloud.html
diff --git a/docs/automation/md-vyos-api.md b/docs/automation/md-vyos-api.md
index fbd92fe6..5fcca88b 100644
--- a/docs/automation/md-vyos-api.md
+++ b/docs/automation/md-vyos-api.md
@@ -515,7 +515,7 @@ request, for example:
 
 ```none
 curl -k --location --request POST 'https://vyos/config-file' \
---form data='{"op": "merge", "string": "interfaces {\nethernet eth1 {\naddress "192.168.2.137/24"\ndescription "test"\n}\n}\n"}' \
+--form data='{"op": "merge", "string": "interfaces {\nethernet eth1 {\naddress \"192.168.2.137/24\"\ndescription \"test\"\n}\n}\n"}' \
 --form key='MY-HTTPS-API-PLAINTEXT-KEY'
 
 response:
@@ -536,7 +536,7 @@ int > 0. An example follows, in the alternative JSON format, for brevity,
 although the standard form-data format is fine:
 
 ```none
-curl -k -X POST -d '{"key": "MY-HTTPS-API-PLAINTEXT-KEY", "op": "merge", "string": "interfaces {\nethernet eth1 {\naddress '192.168.137.1/24'\ndescription 'internal'\n}\n}\n", "confirm_time": 1}' https://vyos/config-file
+curl -k -X POST -d '{"key": "MY-HTTPS-API-PLAINTEXT-KEY", "op": "merge", "string": "interfaces {\nethernet eth1 {\naddress \"192.168.137.1/24\"\ndescription \"internal\"\n}\n}\n", "confirm_time": 1}' https://vyos/config-file
 
 response:
 {
diff --git a/docs/automation/md-vyos-govyos.md b/docs/automation/md-vyos-govyos.md
index 2d09ac47..4edc977c 100644
--- a/docs/automation/md-vyos-govyos.md
+++ b/docs/automation/md-vyos-govyos.md
@@ -77,7 +77,7 @@ fmt.Println(out.Success)
 ```none
 out, resp, err := c.Show.Do(ctx, "interfaces dummy dum1 address")
 if err != nil {
-    panic("Error: %v", err)
+    panic(fmt.Sprintf("Error: %v", err))
 }
 
 fmt.Println(out.Success)
@@ -89,7 +89,7 @@ fmt.Printf("Data: %v\n", out.Data)
 ```none
 out, resp, err := c.Conf.Get(ctx, "interfaces dummy dum1", nil)
 if err != nil {
-    panic("Error: %v", err)
+    panic(fmt.Sprintf("Error: %v", err))
 }
 
 fmt.Println(out.Success)
@@ -105,7 +105,7 @@ options := RetrieveOptions{
 
 out, resp, err := c.Conf.Get(ctx, "interfaces dummy dum1", options)
 if err != nil {
-    panic("Error: %v", err)
+    panic(fmt.Sprintf("Error: %v", err))
 }
 
 fmt.Println(out.Success)
@@ -116,7 +116,7 @@ fmt.Println(out.Success)
 ```none
 out, resp, err := c.Conf.Delete(ctx, "interfaces dummy dum1")
 if err != nil {
-    panic("Error: %v", err)
+    panic(fmt.Sprintf("Error: %v", err))
 }
 
 fmt.Println(out.Success)
@@ -128,7 +128,7 @@ fmt.Println(out.Success)
 out, resp, err := c.Conf.Save(ctx, "")
 
 if err != nil {
-    panic("Error: %v", err)
+    panic(fmt.Sprintf("Error: %v", err))
 }
 
 fmt.Println(out.Success)
@@ -140,7 +140,7 @@ fmt.Println(out.Success)
 out, resp, err := c.Conf.Save(ctx, "/config/test300.config")
 
 if err != nil {
-    panic("Error: %v", err)
+    panic(fmt.Sprintf("Error: %v", err))
 }
 
 fmt.Println(out.Success)
@@ -151,7 +151,7 @@ fmt.Println(out.Success)
 ```none
 out, resp, err := c.Show.Do(ctx, "system image")
 if err != nil {
-    panic("Error: %v", err)
+    panic(fmt.Sprintf("Error: %v", err))
 }
 
 fmt.Println(out.Success)
@@ -163,7 +163,7 @@ fmt.Printf("Data: %v\n", out.Data)
 ```none
 out, resp, err := c.Generate.Do(ctx, "pki wireguard key-pair")
 if err != nil {
-    panic("Error: %v", err)
+    panic(fmt.Sprintf("Error: %v", err))
 }
 
 fmt.Println(out.Success)
@@ -175,7 +175,7 @@ fmt.Printf("Data: %v\n", out.Data)
 ```none
 out, resp, err := c.Reset.Do(ctx, "ip bgp 192.0.2.11")
 if err != nil {
-    panic("Error: %v", err)
+    panic(fmt.Sprintf("Error: %v", err))
 }
 
 fmt.Println(out.Success)
@@ -187,5 +187,3 @@ fmt.Printf("Data: %v\n", out.Data)
 ```none
 out, resp, err := c.ConfigFile.Load(ctx, "/config/test300.config")
 ```
-
-[go-vyos]: https://github.com/ganawaj/go-vyos
diff --git a/docs/automation/md-vyos-napalm.md b/docs/automation/md-vyos-napalm.md
index 8ca78813..838824ea 100644
--- a/docs/automation/md-vyos-napalm.md
+++ b/docs/automation/md-vyos-napalm.md
@@ -138,5 +138,3 @@ $./vyos-napalm.py
 +name-server 203.0.113.8
 [edit]
 ```
-
-[napalm]: https://napalm.readthedocs.io/en/latest/base.html
diff --git a/docs/automation/md-vyos-pyvyos.md b/docs/automation/md-vyos-pyvyos.md
index 462ee63e..38da8ec6 100644
--- a/docs/automation/md-vyos-pyvyos.md
+++ b/docs/automation/md-vyos-pyvyos.md
@@ -134,5 +134,3 @@ if not response.error:
 ```none
 response = device.config_file_load(file="/config/test300.config")
 ```
-
-[pyvyos]: https://github.com/robertoberto/pyvyos
diff --git a/docs/automation/terraform/md-terraformAWS.md b/docs/automation/terraform/md-terraformAWS.md
index 013a24e5..29dfa2a8 100644
--- a/docs/automation/terraform/md-terraformAWS.md
+++ b/docs/automation/terraform/md-terraformAWS.md
@@ -530,8 +530,5 @@ can be found in the [vyos-automation] repository.
 
 
 [group]: https://docs.aws.amazon.com/cli/latest/userguide/cli-services-ec2-sg.html
-[image]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html
-[install]: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli
-[link]: https://developer.hashicorp.com/terraform/intro
 [pair]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/create-key-pairs.html
-[vyos-automation]: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/AWS_terraform_ansible_single_vyos_instance-main
+[vyos-automation]: <https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/AWS_terraform_ansible_single_vyos_instance-main>
diff --git a/docs/automation/terraform/md-terraformAZ.md b/docs/automation/terraform/md-terraformAZ.md
index 686e6e10..daa7d630 100644
--- a/docs/automation/terraform/md-terraformAZ.md
+++ b/docs/automation/terraform/md-terraformAZ.md
@@ -388,7 +388,8 @@ variable "admin_username" {
 
 variable "admin_password" {
   description = "Administrator password"
-  default     = "Vyos0!"
+  type        = string
+  sensitive   = true
 }
 
 variable "source_network" {
@@ -474,7 +475,7 @@ ansible_network_os: vyos.vyos.vyos
 
 # user and password gets from terraform variables "admin_username" and "admin_password" in the file /root/azvyos/var.tf
 ansible_user: vyos
-ansible_ssh_pass: Vyos0!
+ansible_ssh_pass: "{{ vault_vyos_ssh_pass }}"
 ```
 
 ## Source files on GitHub
diff --git a/docs/automation/terraform/md-terraformGoogle.md b/docs/automation/terraform/md-terraformGoogle.md
index e0f28ebc..5c1a179a 100644
--- a/docs/automation/terraform/md-terraformGoogle.md
+++ b/docs/automation/terraform/md-terraformGoogle.md
@@ -460,12 +460,12 @@ resource "google_compute_firewall" "udp_500_4500" {
   name    = "${var.goog_cm_deployment_name}-udp-500-4500"
   network = element(var.networks, 0)
 
-allow {
-  ports    = ["500", "4500"]
-  protocol = "udp"
-}
+  allow {
+    ports    = ["500", "4500"]
+    protocol = "udp"
+  }
 
-source_ranges = ["0.0.0.0/0"]
+  source_ranges = ["0.0.0.0/0"]
 
   target_tags = ["${var.goog_cm_deployment_name}-deployment"]
 }
diff --git a/docs/automation/terraform/md-terraformvSphere.md b/docs/automation/terraform/md-terraformvSphere.md
index 6a4dd2ca..ed5e1be1 100644
--- a/docs/automation/terraform/md-terraformvSphere.md
+++ b/docs/automation/terraform/md-terraformvSphere.md
@@ -345,7 +345,7 @@ instance.yml
 # About tasks:
 # "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds
 # "Configure general settings for the VyOS hosts group" - make provisioning into vSphere VyOS node
-# You have to add all necessary cammans of VyOS under the block "lines:"
+# You have to add all necessary commands of VyOS under the block "lines:"
 ##############################################################################
 
 
diff --git a/docs/conf.py b/docs/conf.py
index 6cccac3e..8c3e93fc 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -84,7 +84,10 @@ gettext_uuid = False
 # List of patterns, relative to source directory, that match files and
 # directories to ignore when looking for source files.
 # This pattern also affects html_static_path and html_extra_path .
-exclude_patterns = [u'_build', 'Thumbs.db', '.DS_Store', '_include/vyos-1x']
+exclude_patterns = [
+    u'_build', 'Thumbs.db', '.DS_Store', '_include/vyos-1x',
+    'md-*.md', '**/md-*.md',
+]
 
 # MyST-Parser configuration
 myst_enable_extensions = ["colon_fence", "deflist", "fieldlist", "substitution"]
diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/md-DHCPRelay_through_GRE.md b/docs/configexamples/autotest/DHCPRelay_through_GRE/md-DHCPRelay_through_GRE.md
index 6581cfb3..ec90f3d3 100644
--- a/docs/configexamples/autotest/DHCPRelay_through_GRE/md-DHCPRelay_through_GRE.md
+++ b/docs/configexamples/autotest/DHCPRelay_through_GRE/md-DHCPRelay_through_GRE.md
@@ -1,4 +1,4 @@
-# DHCP Relay trough GRE-Bridge
+# DHCP Relay through GRE-Bridge
 
 Testdate: 2023-05-11
 
diff --git a/docs/configexamples/autotest/tunnelbroker/md-tunnelbroker.md b/docs/configexamples/autotest/tunnelbroker/md-tunnelbroker.md
index 388a459d..6789fa79 100644
--- a/docs/configexamples/autotest/tunnelbroker/md-tunnelbroker.md
+++ b/docs/configexamples/autotest/tunnelbroker/md-tunnelbroker.md
@@ -174,7 +174,7 @@ The format of these addresses:
 - `2001:470:xxxx::/48`: The whole subnet. xxxx should come from Tunnelbroker.
 - `2001:470:xxxx:1::/64`: A subnet suitable for a LAN
 - `2001:470:xxxx:2::/64`: Another subnet
-- `2001:470:xxxx:ffff:/64`: The last usable /64 subnet.
+- `2001:470:xxxx:ffff::/64`: The last usable /64 subnet.
 
 In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff
 (1-65535).
diff --git a/docs/configexamples/md-azure-vpn-bgp.md b/docs/configexamples/md-azure-vpn-bgp.md
index 8020aca0..0228795f 100644
--- a/docs/configexamples/md-azure-vpn-bgp.md
+++ b/docs/configexamples/md-azure-vpn-bgp.md
@@ -98,7 +98,7 @@ set interfaces vti vti1 ip adjust-mss 1350
 set vpn ipsec authentication psk azure id '198.51.100.3'
 set vpn ipsec authentication psk azure id '203.0.113.2'
 set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk'
-set vpn ipsec site-to-site peer azure authentication local-id '198.51.100.3'
+set vpn ipsec site-to-site peer 203.0.113.2 authentication local-id '198.51.100.3'
 set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
 set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2'
 set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'initiate'
@@ -106,7 +106,7 @@ set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
 set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
 set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'
 set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5'
-set vpn ipsec site-to-site peer azure remote-address '203.0.113.2'
+set vpn ipsec site-to-site peer 203.0.113.2 remote-address '203.0.113.2'
 set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1'
 set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE'
 ```
diff --git a/docs/configexamples/md-dmvpn-dualhub-dualcloud.md b/docs/configexamples/md-dmvpn-dualhub-dualcloud.md
index aa526366..acf5b6fb 100644
--- a/docs/configexamples/md-dmvpn-dualhub-dualcloud.md
+++ b/docs/configexamples/md-dmvpn-dualhub-dualcloud.md
@@ -6,7 +6,7 @@ lastproofread: '2024-02-21'
 
 # DMVPN Dual HUB Dual Cloud
 
-This document is to describe a basic setup to build DVMPN network with two Hubs and two clouds using DMVPN Phase3.
+This document is to describe a basic setup to build DMVPN network with two Hubs and two clouds using DMVPN Phase3.
 OSPF is used as routing protocol inside DMVPN.
 
 In this example we use VyOS 1.5 as HUBs and Spokes (HUB-1, HUB-2, SPOKE-2, SPOKE-3) and Cisco IOSv 15.5(3)M (SPOKE-1)
diff --git a/docs/configexamples/md-fwall-and-bridge.md b/docs/configexamples/md-fwall-and-bridge.md
index 802346ff..988eed70 100644
--- a/docs/configexamples/md-fwall-and-bridge.md
+++ b/docs/configexamples/md-fwall-and-bridge.md
@@ -13,7 +13,7 @@ own requirements.
 
 - Bridge br0:  
   - Isolated layer 2 bridge.
-  - Accept only IPv6 communication whithin the bridge.
+  - Accept only IPv6 communication within the bridge.
 
 - Bridge br1:  
   - Drop all DHCP discover packets.
@@ -212,7 +212,7 @@ set firewall bridge name br1-fwd rule 20 description 'Accept ipv4 from host'
 set firewall bridge name br1-fwd rule 20 action 'accept'
 set firewall bridge name br1-fwd rule 20 source address '10.1.1.102'
 set firewall bridge name br1-fwd rule 20 state 'new'
-  # Drop everythin else within the bridge:
+  # Drop everything else within the bridge:
 set firewall bridge name br1-fwd default-action 'drop'
 
 ### br2 - br2-fwd
@@ -355,7 +355,7 @@ Sep 17 14:28:19 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff
 And with operational mode commands, we can check rules matchers, actions, and
 counters.
 
-Bridge firewall rulset:
+Bridge firewall ruleset:
 
 ``` none
 vyos@bri:~$ show firewall bridge
@@ -439,7 +439,7 @@ default  drop      all                 0        0
 vyos@bridge:~$ 
 ```
 
-IPv4 firewall rulset:
+IPv4 firewall ruleset:
 
 ``` none
 vyos@bridge:~$ show firewall ipv4
diff --git a/docs/configexamples/md-ha.md b/docs/configexamples/md-ha.md
index b272f38e..c3fd4f84 100644
--- a/docs/configexamples/md-ha.md
+++ b/docs/configexamples/md-ha.md
@@ -489,7 +489,7 @@ You should now be able to see the advertised network on the other host.
 ### Duplicate configuration
 
 At this point, you now need to create the X link between all four routers.
-Use amdifferent /30 for each link.
+Use a different /30 for each link.
 
 ### Priorities
 
diff --git a/docs/configexamples/md-ipsec-pa-route-based.md b/docs/configexamples/md-ipsec-pa-route-based.md
index 27d97f8f..a503ce0f 100644
--- a/docs/configexamples/md-ipsec-pa-route-based.md
+++ b/docs/configexamples/md-ipsec-pa-route-based.md
@@ -127,15 +127,15 @@ set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14'
 set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128'
 set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1'
 set vpn ipsec options disable-route-autoinstall
-set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2'
-set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret'
-set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2'
-set vpn ipsec site-to-site peer CISCO connection-type 'initiate'
-set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP'
-set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP'
-set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2'
-set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2'
-set vpn ipsec site-to-site peer CISCO vti bind 'vti1'
+set vpn ipsec site-to-site peer PA authentication local-id '10.0.1.2'
+set vpn ipsec site-to-site peer PA authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer PA authentication remote-id '10.0.2.2'
+set vpn ipsec site-to-site peer PA connection-type 'initiate'
+set vpn ipsec site-to-site peer PA default-esp-group 'ESP-GROUP'
+set vpn ipsec site-to-site peer PA ike-group 'IKE-GROUP'
+set vpn ipsec site-to-site peer PA local-address '10.0.1.2'
+set vpn ipsec site-to-site peer PA remote-address '10.0.2.2'
+set vpn ipsec site-to-site peer PA vti bind 'vti1'
 ```
 
 ### Palo Alto
diff --git a/docs/configexamples/md-l3vpn-hub-and-spoke.md b/docs/configexamples/md-l3vpn-hub-and-spoke.md
index 97ce2e2a..e867c3bd 100644
--- a/docs/configexamples/md-l3vpn-hub-and-spoke.md
+++ b/docs/configexamples/md-l3vpn-hub-and-spoke.md
@@ -122,7 +122,7 @@ set protocols mpls ldp interface 'eth5'
 set protocols mpls ldp router-id '10.0.0.3'
 set protocols ospf area 0 network '0.0.0.0/0'
 set protocols ospf parameters abr-type 'cisco'
-set protocols ospf parameters router-id '10.0.0.3
+set protocols ospf parameters router-id '10.0.0.3'
 ```
 
 - VyOS-P2:
diff --git a/docs/configexamples/md-nmp.md b/docs/configexamples/md-nmp.md
index b30476ae..bb45aed9 100644
--- a/docs/configexamples/md-nmp.md
+++ b/docs/configexamples/md-nmp.md
@@ -25,7 +25,7 @@ set service snmp community router network '0.0.0.0/0'
 
 ## Configuration 'NMP'
 
-Next, you just should follow the pictures:
+Next, you should just follow the pictures:
 
 <img src="/_static/images/nmp1.webp" class="align-center" style="width:80.0%" alt="Network Topology Diagram" />
 
diff --git a/docs/configexamples/md-policy-based-ipsec-and-firewall.md b/docs/configexamples/md-policy-based-ipsec-and-firewall.md
index 13b990f6..d621f565 100644
--- a/docs/configexamples/md-policy-based-ipsec-and-firewall.md
+++ b/docs/configexamples/md-policy-based-ipsec-and-firewall.md
@@ -166,7 +166,7 @@ set firewall ipv4 input filter rule 20 destination port '22'
 set firewall ipv4 input filter rule 20 protocol 'tcp'
 set firewall ipv4 input filter rule 20 source group network-group 'TRUSTED'
 
-# Input traffic: accepd dns requests only from local networks.
+# Input traffic: accept dns requests only from local networks.
 set firewall ipv4 input filter rule 25 action 'accept'
 set firewall ipv4 input filter rule 25 destination port '53'
 set firewall ipv4 input filter rule 25 protocol 'udp'
diff --git a/docs/configexamples/md-pppoe-ipv6-basic.md b/docs/configexamples/md-pppoe-ipv6-basic.md
index 1314fcf1..4911bfdd 100644
--- a/docs/configexamples/md-pppoe-ipv6-basic.md
+++ b/docs/configexamples/md-pppoe-ipv6-basic.md
@@ -28,7 +28,7 @@ please contact your ISP for more information.
 
 ```none
 set interfaces pppoe pppoe0 authentication password <YOUR PASSWORD>
-set interfaces pppoe pppoe0 authentication user <YOUR USERNAME>
+set interfaces pppoe pppoe0 authentication username <YOUR USERNAME>
 set interfaces pppoe pppoe0 service-name <YOUR SERVICENAME>
 set interfaces pppoe pppoe0 source-interface 'eth0'
 ```
diff --git a/docs/configexamples/md-zone-policy.md b/docs/configexamples/md-zone-policy.md
index be80ee55..a82083bd 100644
--- a/docs/configexamples/md-zone-policy.md
+++ b/docs/configexamples/md-zone-policy.md
@@ -284,6 +284,7 @@ ipv6-name dmz-wan-6 {
     log enable
     state {
       invalid enable
+    }
   }
   rule 100 {
     action accept
diff --git a/docs/configuration/container/md-index.md b/docs/configuration/container/md-index.md
index 6cb64225..db46db38 100644
--- a/docs/configuration/container/md-index.md
+++ b/docs/configuration/container/md-index.md
@@ -5,7 +5,7 @@ lastproofread: '2024-07-03'
 # Container
 
 The VyOS container implementation is based on [Podman](https://podman.io/) as
-a deamonless container engine.
+a daemonless container engine.
 
 ## Configuration
 
@@ -270,17 +270,17 @@ Default health check is run for the container if defined by the image.
 Override the default health check command from the image for a container.
 ```
 
-```{cfgcmd} set container name \<name\> health check interval \<interval\>
+```{cfgcmd} set container name \<name\> health-check interval \<interval\>
 
 Override the default health-check interval. For example: `60`
 ```
 
-```{cfgcmd} set container name \<name\> health check timeout \<timeout\>
+```{cfgcmd} set container name \<name\> health-check timeout \<timeout\>
 
 Override the default health-check timeout. For example: `10`
 ```
 
-```{cfgcmd} set container name \<name\> health check retries \<retries\>
+```{cfgcmd} set container name \<name\> health-check retries \<retries\>
 
 Number of health check retries before container is considered unhealthy. For example: `1`
 ```
@@ -314,7 +314,7 @@ is the size (in bytes) of the largest ethernet frame sent on this link.
 Disable Domain Name System (DNS) plugin for this network.
 ```
 
-```{cfgcmd} set container network \<name\> vrf \<nme\>
+```{cfgcmd} set container network \<name\> vrf \<name\>
 
 Bind container network to a given VRF instance.
 ```
diff --git a/docs/configuration/firewall/md-bridge.md b/docs/configuration/firewall/md-bridge.md
index 8062e226..3ed30f78 100644
--- a/docs/configuration/firewall/md-bridge.md
+++ b/docs/configuration/firewall/md-bridge.md
@@ -152,11 +152,11 @@ In firewall bridge rules, the action can be:
 ```{eval-rst}
 .. cfgcmd:: set firewall bridge name <name> rule <1-999999>
    jump-target <text>
-
-   If action is set to ``queue``, use next command to specify the queue
-   target. Range is also supported:
 ```
 
+If action is set to ``queue``, use next command to specify the queue
+target. Range is also supported:
+
 ```{eval-rst}
 .. cfgcmd:: set firewall bridge forward filter rule <1-999999>
    queue <0-65535>
@@ -640,7 +640,7 @@ described in this section:
 ### Packet Modifications
 
 Starting from **VyOS-1.5-rolling-202410060007**, the firewall can modify
-packets before they are sent out. This feaure provides more flexibility in
+packets before they are sent out. This feature provides more flexibility in
 packet handling.
 
 ```{eval-rst}
diff --git a/docs/configuration/firewall/md-index.md b/docs/configuration/firewall/md-index.md
index fb7803ce..204744d5 100644
--- a/docs/configuration/firewall/md-index.md
+++ b/docs/configuration/firewall/md-index.md
@@ -91,7 +91,7 @@ packet is processed at the **IP Layer**:
 >   **input** (for example response to an ssh login attempt to the router).
 >   This includes ipv4 and ipv6 rules, and two different sections are present:
 >
->   - **Output Prerouting**: `set firewall [ipv4 | ipv6] output filter ...`.
+>   - **Output Prerouting**: `set firewall [ipv4 | ipv6] output raw ...`.
 >     As described in **Prerouting**, rules defined in this section are
 >     processed before connection tracking subsystem.
 >   - **Output Filter**: `set firewall [ipv4 | ipv6] output filter ...`.
@@ -100,7 +100,7 @@ packet is processed at the **IP Layer**:
 >   different parts of VyOS configuration are performed in this
 >   stage. This includes:
 >
->   - **Source NAT**: rules defined under `set [nat | nat66] destination...`.
+>   - **Source NAT**: rules defined under `set [nat | nat66] source...`.
 
 If the interface where the packet was received is part of a bridge, then
 the packet is processed at the **Bridge Layer**:
diff --git a/docs/configuration/firewall/md-ipv4.md b/docs/configuration/firewall/md-ipv4.md
index 1db832b9..cf6e2231 100644
--- a/docs/configuration/firewall/md-ipv4.md
+++ b/docs/configuration/firewall/md-ipv4.md
@@ -601,7 +601,7 @@ There are a lot of matching criteria against which the packet can be tested.
 
       set firewall ipv4 name FOO rule 50 source address 192.0.2.10-192.0.2.11
       # with a '!' the rule match everything except the specified subnet
-      set firewall ipv4 input filter FOO rule 51 source address !203.0.113.0/24
+      set firewall ipv4 name FOO rule 51 source address !203.0.113.0/24
 ```
 
 ```{eval-rst}
@@ -1698,49 +1698,6 @@ If an interface is attached to a non-default vrf, when using
    'greater than', and 'lt' means 'less than'.
 ```
 
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   recent count <1-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   recent count <1-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   recent count <1-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   recent count <1-255>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
-   recent time <second | minute | hour>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
-   recent time <second | minute | hour>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
-   recent time <second | minute | hour>
-```
-
-```{eval-rst}
-.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
-   recent time <second | minute | hour>
-
-   Match when 'count' amount of connections appear within 'time'. Use these
-   matching criteria to block brute-force attempts.
-```
-
 ### Packet Modifications
 
 Starting from **VyOS-1.5-rolling-202410060007**, the firewall can modify
diff --git a/docs/configuration/firewall/md-ipv6.md b/docs/configuration/firewall/md-ipv6.md
index 969279dd..f732ec44 100644
--- a/docs/configuration/firewall/md-ipv6.md
+++ b/docs/configuration/firewall/md-ipv6.md
@@ -1800,7 +1800,7 @@ This feature provides more flexibility for packet handling.
 ```
 
 ```{eval-rst}
-.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999>
+.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999>
    set connection-mark <0-2147483647>
 
    Set connection mark value.
diff --git a/docs/vpp/configuration/md-sflow.md b/docs/vpp/configuration/md-sflow.md
index 53f6feed..042cf8a8 100644
--- a/docs/vpp/configuration/md-sflow.md
+++ b/docs/vpp/configuration/md-sflow.md
@@ -12,34 +12,51 @@ lastproofread: '2025-09-04'
 
 VPP Dataplane in VyOS supports sFlow for traffic monitoring and analysis.
 
-The VPP Dataplane integration works hand-in-hand with normal kernel sFlow agent, which is responsible for collecting and exporting sFlow samples. VPP itself is responsible for generating the samples.
+The VPP Dataplane integration works hand-in-hand with normal kernel
+sFlow agent, which is responsible for collecting and exporting sFlow
+samples. VPP itself is responsible for generating the samples.
 
-To enable sFlow in VPP, you first need to configure the service using the same steps as for normal kernel sFlow agent, as described in {doc}`/configuration/system/sflow`. Then you can enable sFlow on VPP interfaces.
+To enable sFlow in VPP, you first need to configure the service using
+the same steps as for normal kernel sFlow agent, as described in
+{doc}`/configuration/system/sflow`. Then you can enable sFlow on VPP
+interfaces.
 
-Then, you need to enable sFlow on the VPP interfaces you want to monitor. This is done using the following commands:
+Then, you need to enable sFlow on the VPP interfaces you want to
+monitor. This is done using the following commands:
 
 ```{cfgcmd} set vpp sflow interface \<interface-name\>
 ```
 
-This will enable sFlow on the specified interface. You can repeat this command for each interface you want to monitor.
+This will enable sFlow on the specified interface. You can repeat
+this command for each interface you want to monitor.
 
 :::{note}
-sFlow collects statistics only for traffic *received* on the interface. If you want to monitor traffic *sent* on the interface, you need to enable sFlow on the corresponding interface in the opposite direction.
+sFlow collects statistics only for traffic *received* on the
+interface. If you want to monitor traffic *sent* on the interface,
+you need to enable sFlow on the corresponding interface in the
+opposite direction.
 :::
 
-Optionally, you can specify the number of bytes from each packet that should be included in the sFlow sample using the following command:
+Optionally, you can specify the number of bytes from each packet
+that should be included in the sFlow sample using the following
+command:
 
 ```{cfgcmd} set vpp sflow header-bytes \<bytes\>
 ```
 
-This defines the size of the packet header (in bytes) captured for each sFlow sample.
+This defines the size of the packet header (in bytes) captured for
+each sFlow sample.
 
-The sampling rate is configured globally under the `system sflow` section and automatically applied to VPP sFlow.
-This ensures consistent sampling behavior between the system and VPP, and prevents configuration conflicts.
+The sampling rate is configured globally under the `system sflow`
+section and automatically applied to VPP sFlow. This ensures
+consistent sampling behavior between the system and VPP, and
+prevents configuration conflicts.
 
-Finally, you need to enable integration between VPP and the kernel sFlow agent using the following command:
+Finally, you need to enable integration between VPP and the kernel
+sFlow agent using the following command:
 
 ```{cfgcmd} set system sflow vpp
 ```
 
-After this, collecting and exporting sFlow samples will be handled by the kernel sFlow agent, while VPP will generate the samples.
+After this, collecting and exporting sFlow samples will be handled
+by the kernel sFlow agent, while VPP will generate the samples.