Add TODO markers, fill placeholders, mark stub pages (#1802) (#1814)

* chore: add TODO markers for 12 files needing cfgcmd/opcmd conversion



* fix: fill TBD placeholder in flow-accounting, remove TBD in static routes



* docs: add stub admonitions to 3 minimal pages



* fix: replace non-RFC IP addresses and suppress false positives in linter

Replace public IPs with RFC 5737 documentation addresses and add
stop/start_vyoslinter markers for false positives (MAC addresses,
OIDs, NAT64 well-known prefix).



* fix: replace remaining non-RFC IPs and suppress MAC address false positive

- Replace 8.8.8.8 (Google DNS) with 192.0.2.1 (RFC 5737) in:
  - docs/configexamples/ansible.rst (3 occurrences)
  - docs/configexamples/nmp.rst (1 occurrence)
  - docs/automation/terraform/terraformvSphere.rst (1 occurrence)
- Wrap SHA-256 certificate fingerprint in openvpn-examples.rst with
  stop_vyoslinter/start_vyoslinter to suppress false-positive IPv6 flag



* fix: wrap long lines to comply with 80-char line length limit

Wrapped prose content exceeding 80 characters in 9 documentation files.
Only RST prose and directive content was modified; code block contents
were left untouched as they are exempt from the linter.



* fix: wrap 2 remaining long lines for linter compliance



* fix: suppress linter for long URL reference in terraformvSphere.rst

* fix: address Copilot review suggestions — broken links, typos, YAML indentation

- Fix broken inline RST links split across lines in sysctl.rst, eve-ng.rst,
  oracle.rst (stub notes with VyOS documentation repository link)
- Fix YAML indentation in both playbook code blocks in ansible.rst
- Fix typo "VyoS" -> "VyOS" in ansible.rst
- Fix typo "desition" -> "decision" in terraformvSphere.rst
- Fix 4 occurrences of "Terrafom" -> "Terraform" in terraformvSphere.rst
- Fix :doc: role split across two lines in openvpn-examples.rst
- Wrap long paragraph in openconnect.rst to <=80 chars and remove
  unnecessary stop/start_vyoslinter markers



* fix: resolve remaining linter failures — long lines and OID false positive



* fix: revert 8.8.8.8 replacements, use stop_vyoslinter instead

---------


(cherry picked from commit a01c2c4ed50470141e7d7bbd31a3ab17418e9936)

Co-authored-by: Yuriy Andamasov <yuriy@vyos.io>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

20 files changed, 309 insertions, 188 deletions

diff --git a/docs/automation/terraform/terraformvSphere.rst b/docs/automation/terraform/terraformvSphere.rst
index 5d39261b..5a9aa8f5 100644
--- a/docs/automation/terraform/terraformvSphere.rst
+++ b/docs/automation/terraform/terraformvSphere.rst
@@ -5,22 +5,27 @@
 Deploying VyOS in the vSphere infrastructure
 ============================================
 
-With the help of Terraform, you can quickly deploy VyOS-based infrastructure in the vSphere.
+With the help of Terraform, you can quickly deploy VyOS-based
+infrastructure in the vSphere.
 Also we will make provisioning using Ansible.
 
-In this case, we'll create the necessary files for Terraform and Ansible next using Terraform we'll create a single instance on the vSphere cloud and make provisioning using Ansible.
+In this case, we'll create the necessary files for Terraform and
+Ansible next using Terraform we'll create a single instance on the
+vSphere cloud and make provisioning using Ansible.
 
 Preparation steps for deploying VyOS on vSphere 
 -----------------------------------------------
 
-How to create a single instance and install your configuration using Terraform+Ansible+vSphere 
+How to create a single instance and install your configuration using
+Terraform+Ansible+vSphere
 Step by step:
 
 
 vSphere
 
 
-  1 Collect all data in to file "terraform.tfvars" and create resources for example "terraform"
+  1 Collect all data in to file "terraform.tfvars" and create
+    resources for example "terraform"
 
 
 Terraform
@@ -37,7 +42,10 @@ Terraform
  mkdir /root/vsphereterraform
  
 
-  4 Copy all files into your Terraform project "/root/vsphereterraform" (vyos.tf, var.tf, terraform.tfvars,version.tf), more detailed see `Structure of files Terrafom for vSphere`_
+  4 Copy all files into your Terraform project
+    "/root/vsphereterraform" (vyos.tf, var.tf, terraform.tfvars,
+    version.tf), more detailed see
+    `Structure of files Terraform for vSphere`_
 
   5 Type the commands :
 
@@ -56,13 +64,15 @@ Ansible
 
   3 Create the folder for example /root/vsphereterraform/
 
-  4 Copy all files into your Ansible project "/root/vsphereterraform/" (ansible.cfg, instance.yml,"all"), more detailed see `Structure of files Ansible for vSphere`_
+  4 Copy all files into your Ansible project
+    "/root/vsphereterraform/" (ansible.cfg, instance.yml, "all"),
+    more detailed see `Structure of files Ansible for vSphere`_
 
 
 Start 
 
 
-Type the commands on your Terrafom instance:
+Type the commands on your Terraform instance:
    
 .. code-block:: none
 
@@ -72,7 +82,8 @@ Type the commands on your Terrafom instance:
    yes
 
 
-After executing all the commands you will have your VyOS instance on the vSphere with your configuration, it's a very convenient desition.
+After executing all the commands you will have your VyOS instance on
+the vSphere with your configuration, it's a very convenient decision.
 If you need to delete the instance please type the command:
 
 .. code-block:: none
@@ -80,19 +91,19 @@ If you need to delete the instance please type the command:
    terraform destroy
 
    
-Structure of files Terrafom for vSphere
+Structure of files Terraform for vSphere
 ---------------------------------------
 
 .. code-block:: none
 
  .
- ├── vyos.tf				# The main script
- ├── versions.tf			# File for the changing version of Terraform.
- ├── var.tf					# File for the changing version of Terraform.
- └── terraform.tfvars		# The value of all variables (passwords, login, ip adresses and so on)
+ ├── vyos.tf           # The main script
+ ├── versions.tf       # File for the changing version of Terraform.
+ ├── var.tf            # File for the changing version of Terraform.
+ └── terraform.tfvars  # The value of all variables
 
 
-File contents of Terrafom for vSphere
+File contents of Terraform for vSphere
 -------------------------------------
 
 vyos.tf
@@ -373,7 +384,7 @@ instance.yml
       - name: "Configure general settings for the VyOS hosts group"
         vyos_config:
           lines:
-            - set system name-server 8.8.8.8
+            - set system name-server 192.0.2.1
           save:
             true
 
@@ -396,5 +407,9 @@ Sourse files for vSphere from GIT
 
 All files about the article can be found here_
 
+.. stop_vyoslinter
+
 .. _here: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/Vsphere_terraform_ansible_single_vyos_instance-main
 
+.. start_vyoslinter
+
diff --git a/docs/configexamples/ansible.rst b/docs/configexamples/ansible.rst
index 0f4dbbda..4241c706 100644
--- a/docs/configexamples/ansible.rst
+++ b/docs/configexamples/ansible.rst
@@ -9,7 +9,8 @@ Ansible example
 Setting up Ansible on a server running the Debian operating system.
 ===================================================================
 
-In this example, we will set up a simple use of Ansible to configure multiple VyoS routers.
+In this example, we will set up a simple use of Ansible to configure
+multiple VyOS routers.
 We have four pre-configured routers with this configuration:
 
 Using the general schema for example:
@@ -23,10 +24,10 @@ We have four pre-configured routers with this configuration:
 
 .. code-block:: none
 
-	set interfaces ethernet eth0 address dhcp
-	set service ssh
-	commit
-	save
+    set interfaces ethernet eth0 address dhcp
+    set service ssh
+    commit
+    save
 
 * vyos7 - 192.0.2.105
 * vyos8 - 192.0.2.106
@@ -37,180 +38,189 @@ Install Ansible:
 ====================
 .. code-block:: none
 
-	# apt-get install ansible
-	Do you want to continue? [Y/n] y
+    # apt-get install ansible
+    Do you want to continue? [Y/n] y
 
 Install Paramiko:
 =====================
 
 .. code-block:: none
 
-	#apt-get install -y python3-paramiko
+    #apt-get install -y python3-paramiko
 
 Check the version:
 ==================
 
 .. code-block:: none
 
-	# ansible --version
-	ansible 2.10.8
-	config file = None
-	configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
-	ansible python module location = /usr/lib/python3/dist-packages/ansible
-	executable location = /usr/bin/ansible
-	python version = 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110]
+    # ansible --version
+    ansible 2.10.8
+    config file = None
+    configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
+    ansible python module location = /usr/lib/python3/dist-packages/ansible
+    executable location = /usr/bin/ansible
+    python version = 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110]
 
 Basic configuration of ansible.cfg:
 =======================================
 
 .. code-block:: none
 
-	# nano /root/ansible.cfg
-	[defaults]
-	host_key_checking = no
+    # nano /root/ansible.cfg
+    [defaults]
+    host_key_checking = no
 
 Add all the VyOS hosts:
 =======================
 
 .. code-block:: none
 
-	# nano /root/hosts
-	[vyos_hosts]
-	vyos7 ansible_ssh_host=192.0.2.105
-	vyos8 ansible_ssh_host=192.0.2.106
-	vyos9 ansible_ssh_host=192.0.2.107
-	vyos10 ansible_ssh_host=192.0.2.108
+    # nano /root/hosts
+    [vyos_hosts]
+    vyos7 ansible_ssh_host=192.0.2.105
+    vyos8 ansible_ssh_host=192.0.2.106
+    vyos9 ansible_ssh_host=192.0.2.107
+    vyos10 ansible_ssh_host=192.0.2.108
 
 Add general variables:
 ======================
 
 .. code-block:: none
 
-	# mkdir /root/group_vars/
-	# nano /root/group_vars/vyos_hosts
-	ansible_python_interpreter: /usr/bin/python3
-	ansible_network_os: vyos
-	ansible_connection: network_cli
-	ansible_user: vyos
-	ansible_ssh_pass: vyos
+    # mkdir /root/group_vars/
+    # nano /root/group_vars/vyos_hosts
+    ansible_python_interpreter: /usr/bin/python3
+    ansible_network_os: vyos
+    ansible_connection: network_cli
+    ansible_user: vyos
+    ansible_ssh_pass: vyos
 
 
 Add a simple playbook with the tasks for each router:
 =====================================================
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
-	# nano /root/main.yml
-	
-	---
-	- hosts: vyos_hosts
-	gather_facts: 'no'
-	tasks:
-		- name: Configure general settings for the vyos hosts group
-		vyos_config:
-			lines:
-			- set system name-server 8.8.8.8
-			- set interfaces ethernet eth0 description '#WAN#'
-			- set interfaces ethernet eth1 description '#LAN#'
-			- set interfaces ethernet eth2 disable
-			- set interfaces ethernet eth3 disable
-			- set system host-name {{ inventory_hostname }}
-			save:
-			true
-	
+    # nano /root/main.yml
+
+    ---
+    - hosts: vyos_hosts
+      gather_facts: 'no'
+      tasks:
+        - name: Configure general settings for the vyos hosts group
+          vyos_config:
+            lines:
+              - set system name-server 8.8.8.8
+              - set interfaces ethernet eth0 description '#WAN#'
+              - set interfaces ethernet eth1 description '#LAN#'
+              - set interfaces ethernet eth2 disable
+              - set interfaces ethernet eth3 disable
+              - set system host-name {{ inventory_hostname }}
+            save: true
+
+.. start_vyoslinter
+
 Start the playbook:
 ===================
 
 .. code-block:: none
 
-	ansible-playbook -i hosts main.yml
-	PLAY [vyos_hosts] **************************************************************
-	
-	TASK [Configure general settings for the vyos hosts group] *********************
-	ok: [vyos9]
-	ok: [vyos10]
-	ok: [vyos7]
-	ok: [vyos8]
-	
-	PLAY RECAP *********************************************************************
-	vyos10                     : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
-	vyos7                      : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
-	vyos8                      : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
-	vyos9                      : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+    ansible-playbook -i hosts main.yml
+    PLAY [vyos_hosts] **************************************************************
+    
+    TASK [Configure general settings for the vyos hosts group] *********************
+    ok: [vyos9]
+    ok: [vyos10]
+    ok: [vyos7]
+    ok: [vyos8]
+    
+    PLAY RECAP *********************************************************************
+    vyos10                     : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+    vyos7                      : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+    vyos8                      : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+    vyos9                      : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
 
 Check the result on the vyos10 router:
 ======================================
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
-	vyos@vyos10:~$ show interfaces
-	Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-	Interface        IP Address                        S/L  Description
-	---------        ----------                        ---  -----------
-	eth0             192.0.2.108/24                    u/u  WAN
-	eth1             -                                 u/u  LAN
-	eth2             -                                 A/D
-	eth3             -                                 A/D
-	lo               127.0.0.1/8                       u/u
-					::1/128
-	
-	vyos@vyos10:~$ sh configuration commands | grep 8.8.8.8
-	set system name-server '8.8.8.8'
+    vyos@vyos10:~$ show interfaces
+    Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+    Interface        IP Address                        S/L  Description
+    ---------        ----------                        ---  -----------
+    eth0             192.0.2.108/24                    u/u  WAN
+    eth1             -                                 u/u  LAN
+    eth2             -                                 A/D
+    eth3             -                                 A/D
+    lo               127.0.0.1/8                       u/u
+                    ::1/128
+
+    vyos@vyos10:~$ sh configuration commands | grep 8.8.8.8
+    set system name-server '8.8.8.8'
+
+.. start_vyoslinter
 
 The simple way without configuration of the hostname (one task for all routers):
 ================================================================================
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
-	# nano /root/hosts_v2
-	[vyos_hosts_group]
-	vyos7 ansible_ssh_host=192.0.2.105
-	vyos8 ansible_ssh_host=192.0.2.106
-	vyos9 ansible_ssh_host=192.0.2.107
-	vyos10 ansible_ssh_host=192.0.2.108
-	[vyos_hosts_group:vars]
-	ansible_python_interpreter=/usr/bin/python3
-	ansible_user=vyos
-	ansible_ssh_pass=vyos
-	ansible_network_os=vyos
-	ansible_connection=network_cli
-
-	# nano /root/main_v2.yml
-	---
-	- hosts: vyos_hosts_group
-	
-	connection: network_cli
-	gather_facts: 'no'
-	
-	tasks:
-		- name: Configure remote vyos_hosts_group
-		vyos_config:
-			lines:
-			- set system name-server 8.8.8.8
-			- set interfaces ethernet eth0 description WAN
-			- set interfaces ethernet eth1 description LAN
-			- set interfaces ethernet eth2 disable
-			- set interfaces ethernet eth3 disable
-			save:
-			true
-		  
+    # nano /root/hosts_v2
+    [vyos_hosts_group]
+    vyos7 ansible_ssh_host=192.0.2.105
+    vyos8 ansible_ssh_host=192.0.2.106
+    vyos9 ansible_ssh_host=192.0.2.107
+    vyos10 ansible_ssh_host=192.0.2.108
+    [vyos_hosts_group:vars]
+    ansible_python_interpreter=/usr/bin/python3
+    ansible_user=vyos
+    ansible_ssh_pass=vyos
+    ansible_network_os=vyos
+    ansible_connection=network_cli
+
+    # nano /root/main_v2.yml
+    ---
+    - hosts: vyos_hosts_group
+      connection: network_cli
+      gather_facts: 'no'
+      tasks:
+        - name: Configure remote vyos_hosts_group
+          vyos_config:
+            lines:
+              - set system name-server 8.8.8.8
+              - set interfaces ethernet eth0 description WAN
+              - set interfaces ethernet eth1 description LAN
+              - set interfaces ethernet eth2 disable
+              - set interfaces ethernet eth3 disable
+            save: true
+
+.. start_vyoslinter
+
 .. code-block:: none
-		  
-	# ansible-playbook -i hosts_v2 main_v2.yml
-	
-	PLAY [vyos_hosts_group] ********************************************************
-	
-	TASK [Configure remote vyos_hosts_group] ***************************************
-	ok: [vyos8]
-	ok: [vyos7]
-	ok: [vyos9]
-	ok: [vyos10]
-	
-	PLAY RECAP *********************************************************************
-	vyos10                     : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
-	vyos7                      : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
-	vyos8                      : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
-	vyos9                      : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
-	
-
-In the next chapter of the example, we'll use Ansible with jinja2 templates and variables.
+          
+    # ansible-playbook -i hosts_v2 main_v2.yml
+    
+    PLAY [vyos_hosts_group] ********************************************************
+    
+    TASK [Configure remote vyos_hosts_group] ***************************************
+    ok: [vyos8]
+    ok: [vyos7]
+    ok: [vyos9]
+    ok: [vyos10]
+    
+    PLAY RECAP *********************************************************************
+    vyos10                     : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+    vyos7                      : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+    vyos8                      : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+    vyos9                      : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+    
+
+In the next chapter of the example, we'll use Ansible with jinja2
+templates and variables.
diff --git a/docs/configexamples/fwall-and-bridge.rst b/docs/configexamples/fwall-and-bridge.rst
index 32c53fa5..34744a5d 100644
--- a/docs/configexamples/fwall-and-bridge.rst
+++ b/docs/configexamples/fwall-and-bridge.rst
@@ -353,12 +353,16 @@ For example, while a host tries to get an IP address from a DHCP server in
 br1 all DHCP discover are dropped, and in br2, we can see that DHCP offers from
 untrusted servers are dropped:
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
-  vyos@bridge:~$ show log firewall bridge 
-  Sep 17 14:22:35 kernel: [bri-NAM-br2-fwd-22-D]IN=eth7 OUT=eth5 MAC=50:00:00:09:00:00:50:00:00:04:00:00:08:00 SRC=10.2.2.199 DST=10.2.2.92 LEN=322 TOS=0x10 PREC=0x00 TTL=128 ID=0 DF PROTO=UDP SPT=67 DPT=68 LEN=302 
-  Sep 17 14:28:18 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372 
-  Sep 17 14:28:19 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372 
+  vyos@bridge:~$ show log firewall bridge
+  Sep 17 14:22:35 kernel: [bri-NAM-br2-fwd-22-D]IN=eth7 OUT=eth5 MAC=50:00:00:09:00:00:50:00:00:04:00:00:08:00 SRC=10.2.2.199 DST=10.2.2.92 LEN=322 TOS=0x10 PREC=0x00 TTL=128 ID=0 DF PROTO=UDP SPT=67 DPT=68 LEN=302
+  Sep 17 14:28:18 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372
+  Sep 17 14:28:19 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372
+
+.. start_vyoslinter
 
 
 And with operational mode commands, we can check rules matchers, actions, and
diff --git a/docs/configexamples/nmp.rst b/docs/configexamples/nmp.rst
index 913e7107..318e9a91 100644
--- a/docs/configexamples/nmp.rst
+++ b/docs/configexamples/nmp.rst
@@ -7,19 +7,25 @@ NMP example
 ###########
 
 Consider how to quickly set up NMP and VyOS for monitoring.
-NMP is multi-vendor network monitoring from 'SolarWinds' built to scale and expand with the needs of your network. 
+NMP is multi-vendor network monitoring from 'SolarWinds' built to
+scale and expand with the needs of your network.
 
 Configuration 'VyOS'
 ====================
 
-First prepare our VyOS router for connection to NMP. We have to set up the SNMP protocol and connectivity between the router and NMP.
+First prepare our VyOS router for connection to NMP. We have to set
+up the SNMP protocol and connectivity between the router and NMP.
+
+.. stop_vyoslinter
 
 .. code-block:: none
 
-	set interfaces ethernet eth0 address 'dhcp'
-	set system name-server '8.8.8.8'
-	set service snmp community router authorization 'test'
-	set service snmp community router network '0.0.0.0/0'
+    set interfaces ethernet eth0 address 'dhcp'
+    set system name-server '8.8.8.8'
+    set service snmp community router authorization 'test'
+    set service snmp community router network '0.0.0.0/0'
+
+.. start_vyoslinter
 
 
 Configuration 'NMP'
diff --git a/docs/configexamples/site-2-site-cisco.rst b/docs/configexamples/site-2-site-cisco.rst
index 96e48d07..5b5f1fd7 100644
--- a/docs/configexamples/site-2-site-cisco.rst
+++ b/docs/configexamples/site-2-site-cisco.rst
@@ -28,7 +28,7 @@ VyOS
   set interfaces tunnel tun1 ip adjust-mss '1336'
   set interfaces tunnel tun1 mtu '1376'
   set interfaces tunnel tun1 remote '10.1.1.6'
-  set interfaces tunnel tun1 source-address '88.2.2.1'
+  set interfaces tunnel tun1 source-address '198.51.100.1'
 
 
 - IPsec:
@@ -59,9 +59,9 @@ VyOS
   set vpn ipsec site-to-site peer cisco_hub connection-type 'initiate'
   set vpn ipsec site-to-site peer cisco_hub default-esp-group 'e1'
   set vpn ipsec site-to-site peer cisco_hub ike-group 'i1'
-  set vpn ipsec site-to-site peer cisco_hub local-address '88.2.2.1'
+  set vpn ipsec site-to-site peer cisco_hub local-address '198.51.100.1'
   set vpn ipsec site-to-site peer cisco_hub remote-address '10.1.1.6'
-  set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '88.2.2.1/32'
+  set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '198.51.100.1/32'
   set vpn ipsec site-to-site peer cisco_hub tunnel 1 protocol 'gre'
   set vpn ipsec site-to-site peer cisco_hub tunnel 1 remote prefix '10.1.1.6/32'
   set vpn ipsec site-to-site peer cisco_hub virtual-address '0.0.0.0'
@@ -141,7 +141,7 @@ Verification
   ---------        ----------                        ---  -----------
   eth0             -                                 u/u
   eth1             -                                 u/u
-  eth2             88.2.2.1/24                       u/u
+  eth2             198.51.100.1/24                       u/u
   eth3             172.16.1.2/24                     u/u
   lo               127.0.0.1/8                       u/u
                    ::1/128
@@ -157,7 +157,7 @@ Verification
    IPv4 Crypto IKEv2  SA
 
   Tunnel-id Local                 Remote                fvrf/ivrf            Status
-  5         10.1.1.6/4500         88.2.2.1/4500         none/none               READY
+  5         10.1.1.6/4500         198.51.100.1/4500         none/none               READY
         Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:5, Auth sign: PSK, Auth verify: PSK
         Life/Active Time: 86400/2694 sec
         CE id: 0, Session-id: 2
diff --git a/docs/configuration/firewall/index.rst b/docs/configuration/firewall/index.rst
index a5b88839..79d59563 100644
--- a/docs/configuration/firewall/index.rst
+++ b/docs/configuration/firewall/index.rst
@@ -4,6 +4,9 @@
 Firewall
 ########
 
+.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd
+   directives for command coverage tracking.
+
 .. warning:: Due to a race condition that can lead to a failure during boot
    process, all interfaces are initialized before firewall is configured. This
    leads to a situation where the system is open to all traffic, and can be
diff --git a/docs/configuration/interfaces/openvpn-examples.rst b/docs/configuration/interfaces/openvpn-examples.rst
index 46409975..34cabddf 100644
--- a/docs/configuration/interfaces/openvpn-examples.rst
+++ b/docs/configuration/interfaces/openvpn-examples.rst
@@ -2,6 +2,9 @@
 Site-to-site
 ============
 
+.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd
+   directives for command coverage tracking.
+
 OpenVPN is popular for client-server setups, but its site-to-site mode is less 
 common and often not supported by router appliances. Despite limited support, 
 it is effective for quickly establishing tunnels between routers.
@@ -29,9 +32,9 @@ In both cases, we will use the following settings:
 * The ``persistent-tunnel`` directive allows us to configure tunnel-related 
   attributes, such as firewall policy, as we would on any standard network 
   interface.
-* If known, the remote router's IP address can be configured using the 
-  ``remote-host`` directive. If unknown, it can be omitted. We assume the remote 
-  router has a dynamic IP address.
+* If known, the remote router's IP address can be configured using
+  the ``remote-host`` directive. If unknown, it can be omitted.
+  We assume the remote router has a dynamic IP address.
 
 
 .. figure:: /_static/images/openvpn_site2site_diagram.jpg
@@ -87,11 +90,15 @@ You do **not** need to copy the certificate to the other router. Instead,
 retrieve its SHA-256 fingerprint. Since OpenVPN currently supports only SHA-256 
 fingerprints, use the following command:
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
   vyos@vyos# run show pki certificate openvpn-local fingerprint sha256
   5C:B8:09:64:8B:59:51:DC:F4:DF:2C:12:5C:B7:03:D1:68:94:D7:5B:62:C2:E1:83:79:F1:F0:68:B2:81:26:79
 
+.. start_vyoslinter
+
 .. note:: Certificate names are arbitrary. While ``openvpn-local`` and 
    ``openvpn-remote`` are used here, you may choose any names.
 
@@ -456,7 +463,7 @@ Check the tunnel status:
 
   Client CN    Remote Host         Tunnel IP    Local Host        TX bytes    RX bytes    Connected Since
   -----------  ------------------  -----------  ----------------  ----------  ----------  -------------------
-  client1      172.110.12.54:33166  10.23.1.10   172.18.201.10:1194  3.4 KB      3.4 KB      2024-06-11 12:07:25
+  client1      172.16.12.54:33166  10.23.1.10   172.18.201.10:1194  3.4 KB      3.4 KB      2024-06-11 12:07:25
 
 
 
@@ -639,7 +646,11 @@ below:
        }
    }
 
-For a detailed example, refer to :doc:`OpenVPN with LDAP</configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP>`.
+.. stop_vyoslinter
+
+For a detailed example, refer to :doc:`OpenVPN with LDAP </configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP>`.
+
+.. start_vyoslinter
 
 Multi-factor authentication
 ===========================
diff --git a/docs/configuration/interfaces/vti.rst b/docs/configuration/interfaces/vti.rst
index 1704b9d1..9c2dc1eb 100644
--- a/docs/configuration/interfaces/vti.rst
+++ b/docs/configuration/interfaces/vti.rst
@@ -4,6 +4,9 @@
 VTI - Virtual Tunnel Interface
 ##############################
 
+.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd
+   directives for command coverage tracking.
+
 Set Virtual Tunnel Interface
 
 .. code-block:: none
diff --git a/docs/configuration/nat/nat64.rst b/docs/configuration/nat/nat64.rst
index e8a3a0e6..8608da9f 100644
--- a/docs/configuration/nat/nat64.rst
+++ b/docs/configuration/nat/nat64.rst
@@ -4,6 +4,9 @@
 NAT64
 #####
 
+.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd
+   directives for command coverage tracking.
+
 :abbr:`NAT64 (IPv6-to-IPv4 Prefix Translation)` is a critical component in
 modern networking, facilitating communication between IPv6 and IPv4 networks.
 This documentation outlines the setup, configuration, and usage of the NAT64
@@ -69,6 +72,8 @@ NAT64 client configuration:
 
 Test from the IPv6 only client:
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
   vyos@r1:~$ ping 64:ff9b::192.0.2.1 count 2
@@ -79,3 +84,5 @@ Test from the IPv6 only client:
   --- 64:ff9b::192.0.2.1 ping statistics ---
   2 packets transmitted, 2 received, 0% packet loss, time 1023ms
   rtt min/avg/max/mdev = 0.351/0.362/0.373/0.011 ms
+
+.. start_vyoslinter
diff --git a/docs/configuration/nat/nat66.rst b/docs/configuration/nat/nat66.rst
index 42f63fc9..d7d8e8be 100644
--- a/docs/configuration/nat/nat66.rst
+++ b/docs/configuration/nat/nat66.rst
@@ -4,6 +4,9 @@
 NAT66(NPTv6)
 ############
 
+.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd
+   directives for command coverage tracking.
+
 :abbr:`NPTv6 (IPv6-to-IPv6 Network Prefix Translation)` is an address 
 translation technology based on IPv6 networks, used to convert an IPv6 
 address prefix in an IPv6 message into another IPv6 address prefix. 
@@ -151,8 +154,9 @@ R2:
   set service router-advert interface br1 prefix ::/0
 
 
-Use the following topology to translate internal user local addresses (``fc::/7``)
-to DHCPv6-PD provided prefixes from an ISP connected to a VyOS HA pair.
+Use the following topology to translate internal user local addresses
+(``fc::/7``) to DHCPv6-PD provided prefixes from an ISP connected to
+a VyOS HA pair.
 
 .. figure:: /_static/images/vyos_1_5_nat66_dhcpv6_wdummy.png
    :alt: VyOS NAT66 DHCPv6 using a dummy interface
diff --git a/docs/configuration/policy/examples.rst b/docs/configuration/policy/examples.rst
index d822d839..11c1d625 100644
--- a/docs/configuration/policy/examples.rst
+++ b/docs/configuration/policy/examples.rst
@@ -2,6 +2,9 @@
 BGP Example
 ###########
 
+.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd
+   directives for command coverage tracking.
+
 **Policy definition:**
 
 .. code-block:: none
diff --git a/docs/configuration/protocols/static.rst b/docs/configuration/protocols/static.rst
index 3e3eb47b..e9016abc 100644
--- a/docs/configuration/protocols/static.rst
+++ b/docs/configuration/protocols/static.rst
@@ -70,10 +70,12 @@ IPv4 BFD
    Configure a static route for `<subnet>` using gateway `<address>` and use the
    gateway address as BFD peer destination address.
 
-.. cfgcmd:: set protocols static route <subnet> next-hop <address> bfd profile <profile>
+.. cfgcmd:: set protocols static route <subnet> next-hop <address>
+   bfd profile <profile>
 
-   Configure a static route for `<subnet>` using gateway `<address>` and use the
-   gateway address as BFD peer destination address with BFD profile `<profile>`.
+   Configure a static route for `<subnet>` using gateway `<address>`
+   and use the gateway address as BFD peer destination address with
+   BFD profile `<profile>`.
 
 .. cfgcmd:: set protocols static route <subnet> next-hop <address> bfd multi-hop
    source-address <source-address>
@@ -153,10 +155,12 @@ IPv6 Unicast Routes
    .. note:: Routes with a distance of 255 are effectively disabled and not
       installed into the kernel.
 
-.. cfgcmd:: set protocols static route6 <subnet> next-hop <address> segments <segments>
+.. cfgcmd:: set protocols static route6 <subnet> next-hop <address>
+   segments <segments>
 
-   It is possible to specify a static route for ipv6 prefixes using an SRv6 segments
-   instruction. The `/` separator can be used to specify multiple segment instructions.
+   It is possible to specify a static route for ipv6 prefixes using
+   an SRv6 segments instruction. The `/` separator can be used to
+   specify multiple segment instructions.
 
    Example:
 
@@ -202,8 +206,9 @@ IPv6 Interface Routes
 .. cfgcmd:: set protocols static route6 <subnet> interface
    <interface> segments <segments>
 
-   It is possible to specify a static route for ipv6 prefixes using an SRv6 segments
-   instruction. The `/` separator can be used to specify multiple segment instructions.
+   It is possible to specify a static route for ipv6 prefixes using
+   an SRv6 segments instruction. The `/` separator can be used to
+   specify multiple segment instructions.
 
    Example:
 
@@ -219,13 +224,15 @@ IPv6 BFD
    Configure a static route for `<subnet>` using gateway `<address>` and use the
    gateway address as BFD peer destination address.
 
-.. cfgcmd:: set protocols static route6 <subnet> next-hop <address> bfd profile <profile>
+.. cfgcmd:: set protocols static route6 <subnet> next-hop <address>
+   bfd profile <profile>
 
-   Configure a static route for `<subnet>` using gateway `<address>` and use the
-   gateway address as BFD peer destination address with BFD profile `<profile>`.
+   Configure a static route for `<subnet>` using gateway `<address>`
+   and use the gateway address as BFD peer destination address with
+   BFD profile `<profile>`.
 
-.. cfgcmd:: set protocols static route6 <subnet> next-hop <address> bfd multi-hop
-   source-address <source>
+.. cfgcmd:: set protocols static route6 <subnet> next-hop <address>
+   bfd multi-hop source-address <source>
 
    Configure a static route for `<subnet>` using gateway `<address>` and use the
    gateway address as BFD peer destination address with source address
@@ -271,7 +278,5 @@ IPv6 Blackhole Routes
 Alternate Routing Tables
 ************************
 
-TBD
-
 Alternate routing tables are used with policy based routing by utilizing
 :ref:`vrf`.
diff --git a/docs/configuration/service/snmp.rst b/docs/configuration/service/snmp.rst
index b444ab85..9e91cc50 100644
--- a/docs/configuration/service/snmp.rst
+++ b/docs/configuration/service/snmp.rst
@@ -4,6 +4,9 @@
 SNMP
 ####
 
+.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd
+   directives for command coverage tracking.
+
 :abbr:`SNMP (Simple Network Management Protocol)` is an Internet Standard
 protocol for collecting and organizing information about managed devices on
 IP networks and for modifying that information to change device behavior.
diff --git a/docs/configuration/system/flow-accounting.rst b/docs/configuration/system/flow-accounting.rst
index a339df75..cb18839a 100644
--- a/docs/configuration/system/flow-accounting.rst
+++ b/docs/configuration/system/flow-accounting.rst
@@ -84,7 +84,9 @@ CLI command. You may disable using the local in-memory table with the command:
 
 .. cfgcmd:: set system flow-accounting syslog-facility <facility>
 
-   TBD
+   Configure the syslog facility used for flow-accounting log messages.
+   Available facilities follow standard syslog conventions (e.g.,
+   ``daemon``, ``local0`` through ``local7``).
 
 Flow Export
 -----------
diff --git a/docs/configuration/system/sysctl.rst b/docs/configuration/system/sysctl.rst
index 06e15031..d1398822 100644
--- a/docs/configuration/system/sysctl.rst
+++ b/docs/configuration/system/sysctl.rst
@@ -4,6 +4,12 @@
 Sysctl
 ######
 
+.. note:: This page is a stub and needs expansion.
+   Contributions welcome via the
+   VyOS `documentation repository`_.
+
+.. _documentation repository: https://github.com/vyos/vyos-documentation
+
 This chapeter describes how to configure kernel parameters at runtime.
 
 ``sysctl`` is used to modify kernel parameters at runtime.  The parameters
diff --git a/docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst b/docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst
index fdeb347d..8494f0ea 100644
--- a/docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst
+++ b/docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst
@@ -4,6 +4,9 @@
 Troubleshooting Site-to-Site VPN IPsec
 ######################################
 
+.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd
+   directives for command coverage tracking.
+
 ************
 Introduction
 ************
@@ -286,8 +289,8 @@ The reason of this problem is showed on the responder side.
  Jun 23 08:16:12 charon-systemd[2440]: no acceptable proposal found
  Jun 23 08:16:12 charon[2440]: 01[IKE] <PEER|5> failed to establish CHILD_SA, keeping IKE_SA
 
-Encryption **AES_CBC_128** is configured in IKE policy on the responder but **AES_CBC_256**
-is configured on the initiator side.
+Encryption **AES_CBC_128** is configured in IKE policy on the
+responder but **AES_CBC_256** is configured on the initiator side.
 
 Prefixes in Policies Mismatch
 =============================
diff --git a/docs/configuration/vpn/openconnect.rst b/docs/configuration/vpn/openconnect.rst
index 11824e50..d5c76e3e 100644
--- a/docs/configuration/vpn/openconnect.rst
+++ b/docs/configuration/vpn/openconnect.rst
@@ -4,6 +4,9 @@
 OpenConnect
 ###########
 
+.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd
+   directives for command coverage tracking.
+
 OpenConnect-compatible server feature has been available since Equuleus (1.3).
 Openconnect VPN supports SSL connection and offers full network access. SSL VPN
 network extension connects the end-user system to the corporate network with
@@ -81,9 +84,22 @@ For generating an OTP key in VyOS, you can use the CLI command
 User Certificate Authentication
 ===============================
 
-You can configure users to be authenticated by certificate by setting the authentication mode to certificate, and defining what field (by OID) in the certificate will be used to identify the username. Two pre-defined shortcuts for Common Name (OID 2.5.4.3) and User ID (OID 0.9.2342.19200300.100.1.1) have been provide as cn or uid. Otherwise a specific OID value must be provided.
+You can configure users to be authenticated by certificate by setting
+the authentication mode to certificate, and defining what field (by OID)
+in the certificate will be used to identify the username. Two pre-defined
+
+.. stop_vyoslinter
+
+shortcuts for Common Name (OID 2.5.4.3) and User ID
+(OID 0.9.2342.19200300.100.1.1) have been provided as cn or uid.
 
-The user's certificate must be signed by the certificate authority defined in the configuration for it to be validated for authentication.
+.. start_vyoslinter
+
+Otherwise a specific OID value must be provided.
+
+The user's certificate must be signed by the certificate authority
+defined in the configuration for it to be validated for
+authentication.
 
 .. code-block:: none
 
diff --git a/docs/configuration/vpn/rsa-keys.rst b/docs/configuration/vpn/rsa-keys.rst
index 0508522f..ce9aa720 100644
--- a/docs/configuration/vpn/rsa-keys.rst
+++ b/docs/configuration/vpn/rsa-keys.rst
@@ -2,6 +2,10 @@
 ########
 RSA-Keys
 ########
+
+.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd
+   directives for command coverage tracking.
+
 RSA can be used for services such as key exchanges and for encryption purposes.
 To make IPSec work with dynamic address on one/both sides, we will have to use
 RSA keys for authentication. They are very fast and easy to setup.
@@ -51,10 +55,14 @@ On the RIGHT:
 
 Now you are ready to setup IPsec. The key points:
 
-1. Since both routers do not know their effective public addresses, we set the local-address of the peer to "any".
-2. On the initiator, we set the peer address to its public address, but on the responder we only set the id.
-3. On the initiator, we need to set the remote-id option so that it can identify IKE traffic from the responder correctly.
-4. On the responder, we need to set the local id so that initiator can know who's talking to it for the point #3 to work.
+1. Since both routers do not know their effective public addresses,
+   we set the local-address of the peer to "any".
+2. On the initiator, we set the peer address to its public address,
+   but on the responder we only set the id.
+3. On the initiator, we need to set the remote-id option so that it
+   can identify IKE traffic from the responder correctly.
+4. On the responder, we need to set the local id so that initiator
+   can know who's talking to it for the point #3 to work.
 
 On the LEFT (static address):
 
diff --git a/docs/installation/cloud/oracle.rst b/docs/installation/cloud/oracle.rst
index 1d02335b..f5e03329 100644
--- a/docs/installation/cloud/oracle.rst
+++ b/docs/installation/cloud/oracle.rst
@@ -4,6 +4,12 @@
 Oracle
 ######
 
+.. note:: This page is a stub and needs expansion.
+   Contributions welcome via the
+   VyOS `documentation repository`_.
+
+.. _documentation repository: https://github.com/vyos/vyos-documentation
+
 .. stop_vyoslinter
 References
 ----------
diff --git a/docs/installation/virtual/eve-ng.rst b/docs/installation/virtual/eve-ng.rst
index 855daeb0..0dd07db8 100644
--- a/docs/installation/virtual/eve-ng.rst
+++ b/docs/installation/virtual/eve-ng.rst
@@ -4,6 +4,12 @@
 EVE-NG
 ######
 
+.. note:: This page is a stub and needs expansion.
+   Contributions welcome via the
+   VyOS `documentation repository`_.
+
+.. _documentation repository: https://github.com/vyos/vyos-documentation
+
 References
 ==========