diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c1a53b6
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,48 @@
+name: CI Tests
+
+on:
+
+  #NOTE: All jobs gated by auth job
+
+  #Regular dev
+  push:
+  pull_request:
+
+  #Enable UI-driven branch testing
+  workflow_dispatch:
+
+  #Test main bidaily @ 1a
+  schedule:
+    - cron: '0 1 1-31/2 * *'
+
+jobs:
+
+  test-docs:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Test building docs
+      run: |
+        ./bin/ci.sh
+  
+  test-readme:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Set up Python 3.8
+      uses: actions/setup-python@v4
+      with:
+        python-version: 3.8
+
+    - name: Test building docs
+      continue-on-error: true
+      run: |
+        docker run --rm -v "$(pwd)/README.md:/workdir/README.md:ro" -v "$(pwd)/.markdownlint.yaml:/workdir/.markdownlint.yaml:ro" ghcr.io/igorshubovych/markdownlint-cli:v0.37.0 README.md
+
+  
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..b92ce54
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+_build/
+doctrees/
diff --git a/.markdownlint.yml b/.markdownlint.yml
new file mode 100644
index 0000000..0279472
--- /dev/null
+++ b/.markdownlint.yml
@@ -0,0 +1,267 @@
+# ------------------------------------------------------------------------------
+# Based on markdownlint/schema/.markdownlint.yml
+# ------------------------------------------------------------------------------
+
+
+# Example markdownlint configuration with all properties set to their default value
+
+# Default state for all rules
+default: true
+
+# Path to configuration file to extend
+extends: null
+
+# MD001/heading-increment : Heading levels should only increment by one level at a time : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md001.md
+MD001: true
+
+# MD003/heading-style : Heading style : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md003.md
+MD003:
+  # Heading style
+  style: "consistent"
+
+# MD004/ul-style : Unordered list style : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md004.md
+MD004:
+  # List style
+  style: "consistent"
+
+# MD005/list-indent : Inconsistent indentation for list items at the same level : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md005.md
+MD005: true
+
+# MD007/ul-indent : Unordered list indentation : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md007.md
+MD007:
+  # Spaces for indent
+  indent: 2
+  # Whether to indent the first level of the list
+  start_indented: false
+  # Spaces for first level indent (when start_indented is set)
+  start_indent: 2
+
+# MD009/no-trailing-spaces : Trailing spaces : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md009.md
+MD009:
+  # Spaces for line break
+  br_spaces: 2
+  # Allow spaces for empty lines in list items
+  list_item_empty_lines: false
+  # Include unnecessary breaks
+  strict: false
+
+# MD010/no-hard-tabs : Hard tabs : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md010.md
+MD010:
+  # Include code blocks
+  code_blocks: true
+  # Fenced code languages to ignore
+  ignore_code_languages: []
+  # Number of spaces for each hard tab
+  spaces_per_tab: 1
+
+# MD011/no-reversed-links : Reversed link syntax : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md011.md
+MD011: true
+
+# MD012/no-multiple-blanks : Multiple consecutive blank lines : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md012.md
+MD012:
+  # Consecutive blank lines
+  maximum: 1
+
+# MD013/line-length : Line length : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md013.md
+MD013:
+  # Number of characters
+  line_length: 2000
+  # Number of characters for headings
+  heading_line_length: 2000
+  # Number of characters for code blocks
+  code_block_line_length: 2000
+  # Include code blocks
+  code_blocks: true
+  # Include tables
+  tables: false
+  # Include headings
+  headings: true
+  # Strict length checking
+  strict: false
+  # Stern length checking
+  stern: false
+
+# MD014/commands-show-output : Dollar signs used before commands without showing output : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md014.md
+MD014: true
+
+# MD018/no-missing-space-atx : No space after hash on atx style heading : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md018.md
+MD018: true
+
+# MD019/no-multiple-space-atx : Multiple spaces after hash on atx style heading : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md019.md
+MD019: true
+
+# MD020/no-missing-space-closed-atx : No space inside hashes on closed atx style heading : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md020.md
+MD020: true
+
+# MD021/no-multiple-space-closed-atx : Multiple spaces inside hashes on closed atx style heading : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md021.md
+MD021: true
+
+# MD022/blanks-around-headings : Headings should be surrounded by blank lines : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md022.md
+MD022:
+  # Blank lines above heading
+  lines_above: 1
+  # Blank lines below heading
+  lines_below: 1
+
+# MD023/heading-start-left : Headings must start at the beginning of the line : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md023.md
+MD023: true
+
+# MD024/no-duplicate-heading : Multiple headings with the same content : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md024.md
+MD024:
+  # Only check sibling headings
+  allow_different_nesting: false
+  # Only check sibling headings
+  siblings_only: false
+
+# MD025/single-title/single-h1 : Multiple top-level headings in the same document : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md025.md
+MD025:
+  # Heading level
+  level: 1
+  # RegExp for matching title in front matter
+  front_matter_title: "^\\s*title\\s*[:=]"
+
+# MD026/no-trailing-punctuation : Trailing punctuation in heading : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md026.md
+MD026:
+  # Punctuation characters
+  punctuation: ".,;:!。，；：！"
+
+# MD027/no-multiple-space-blockquote : Multiple spaces after blockquote symbol : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md027.md
+MD027: true
+
+# MD028/no-blanks-blockquote : Blank line inside blockquote : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md028.md
+MD028: true
+
+# MD029/ol-prefix : Ordered list item prefix : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md029.md
+MD029:
+  # List style
+  style: "one_or_ordered"
+
+# MD030/list-marker-space : Spaces after list markers : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md030.md
+MD030:
+  # Spaces for single-line unordered list items
+  ul_single: 1
+  # Spaces for single-line ordered list items
+  ol_single: 1
+  # Spaces for multi-line unordered list items
+  ul_multi: 1
+  # Spaces for multi-line ordered list items
+  ol_multi: 1
+
+# MD031/blanks-around-fences : Fenced code blocks should be surrounded by blank lines : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md031.md
+MD031:
+  # Include list items
+  list_items: true
+
+# MD032/blanks-around-lists : Lists should be surrounded by blank lines : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md032.md
+MD032: true
+
+# MD033/no-inline-html : Inline HTML : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md033.md
+MD033:
+  # Allowed elements
+  allowed_elements: [table, tr, td, img, em,br, a]
+
+# MD034/no-bare-urls : Bare URL used : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md034.md
+MD034: true
+
+# MD035/hr-style : Horizontal rule style : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md035.md
+MD035:
+  # Horizontal rule style
+  style: "consistent"
+
+# MD036/no-emphasis-as-heading : Emphasis used instead of a heading : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md036.md
+MD036:
+  # Punctuation characters
+  punctuation: ".,;:!?。，；：！？"
+
+# MD037/no-space-in-emphasis : Spaces inside emphasis markers : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md037.md
+MD037: true
+
+# MD038/no-space-in-code : Spaces inside code span elements : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md038.md
+MD038: true
+
+# MD039/no-space-in-links : Spaces inside link text : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md039.md
+MD039: true
+
+# MD040/fenced-code-language : Fenced code blocks should have a language specified : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md040.md
+MD040:
+  # List of languages
+  allowed_languages: []
+  # Require language only
+  language_only: false
+
+# MD041/first-line-heading/first-line-h1 : First line in a file should be a top-level heading : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md041.md
+MD041:
+  # Heading level
+  level: 1
+  # RegExp for matching title in front matter
+  front_matter_title: "^\\s*title\\s*[:=]"
+
+# MD042/no-empty-links : No empty links : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md042.md
+MD042: true
+
+# MD043/required-headings : Required heading structure : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md043.md
+MD043: false
+
+# MD044/proper-names : Proper names should have the correct capitalization : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md044.md
+MD044:
+  # List of proper names
+  names: []
+  # Include code blocks
+  code_blocks: true
+  # Include HTML elements
+  html_elements: true
+
+# MD045/no-alt-text : Images should have alternate text (alt text) : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md045.md
+MD045: true
+
+# MD046/code-block-style : Code block style : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md046.md
+MD046:
+  # Block style
+  style: "consistent"
+
+# MD047/single-trailing-newline : Files should end with a single newline character : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md047.md
+MD047: true
+
+# MD048/code-fence-style : Code fence style : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md048.md
+MD048:
+  # Code fence style
+  style: "consistent"
+
+# MD049/emphasis-style : Emphasis style : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md049.md
+MD049:
+  # Emphasis style
+  style: "consistent"
+
+# MD050/strong-style : Strong style : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md050.md
+MD050:
+  # Strong style
+  style: "consistent"
+
+# MD051/link-fragments : Link fragments should be valid : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md051.md
+MD051: true
+
+# MD052/reference-links-images : Reference links and images should use a label that is defined : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md052.md
+MD052:
+  # Include shortcut syntax
+  shortcut_syntax: false
+
+# MD053/link-image-reference-definitions : Link and image reference definitions should be needed : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md053.md
+MD053:
+  # Ignored definitions
+  ignored_definitions:
+    - "//"
+
+# MD054/link-image-style : Link and image style : https://github.com/DavidAnson/markdownlint/blob/v0.32.1/doc/md054.md
+MD054:
+  # Allow autolinks
+  autolink: true
+  # Allow inline links and images
+  inline: true
+  # Allow full reference links and images
+  full: true
+  # Allow collapsed reference links and images
+  collapsed: true
+  # Allow shortcut reference links and images
+  shortcut: true
+  # Allow URLs as inline links
+  url_inline: true
\ No newline at end of file
diff --git a/.readthedocs.yml b/.readthedocs.yml
new file mode 100644
index 0000000..33fc5cc
--- /dev/null
+++ b/.readthedocs.yml
@@ -0,0 +1,59 @@
+# .readthedocs.yml
+# Read the Docs configuration file
+# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
+
+# Required
+version: 2
+
+build:
+  os: ubuntu-22.04
+  tools:
+    python: "3.12"
+  apt_packages:
+    # More closely mirror https://github.com/sphinx-doc/sphinx-docker-images
+    - graphviz
+    - imagemagick
+    - make
+    - pandoc
+    - texlive-latex-base
+    - texlive-latex-recommended
+    - texlive-latex-extra
+    - texlive-fonts-recommended
+  commands:
+
+    # setup
+    - pip install "graphistry[docs]"
+    - pip install -r infra/requirements-python.txt
+    #- cp -r demos docs/source/demos
+    - cp README.md docs/README.md
+
+    # build html
+    - sphinx-build -b html -d doctrees docs $READTHEDOCS_OUTPUT/html/
+
+    # build epub
+    - sphinx-build -b epub -d doctrees docs _build/latexpdf
+    - mkdir -p $READTHEDOCS_OUTPUT/epub
+    - ls _build/latexpdf
+    - ls $READTHEDOCS_OUTPUT/epub
+    - cp _build/latexpdf/GraphistryCLI.epub $READTHEDOCS_OUTPUT/epub/GraphistryCLI.epub
+
+    # build pdf
+    - sphinx-build -b latex -d doctrees docs _build/latexpdf
+    - ls _build/latexpdf
+    - cd _build/latexpdf && (pdflatex -file-line-error -interaction=nonstopmode Graphistry.tex || test -f _build/latexpdf/Graphistry.pdf) && (pdflatex -file-line-error  -interaction=nonstopmode Graphistry.tex || test -f _build/latexpdf/Graphistry.pdf) && echo ok || { echo fail && exit 1 ; }
+    - mkdir -p $READTHEDOCS_OUTPUT/pdf 
+    - cp _build/latexpdf/Graphistry.pdf $READTHEDOCS_OUTPUT/pdf/Graphistry.pdf
+
+
+#for nav links?
+formats:
+  - pdf
+  - epub
+  - htmlzip
+
+python:
+  install:
+    - method: pip
+      path: .
+      extra_requirements:
+        - docs
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..5184fac
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,21 @@
+# Changelog
+
+All notable changes to this repo are documented in this file. The Graphistry server is tracked in the main [Graphistry major release history documentation](https://graphistry.zendesk.com/hc/en-us/articles/360033184174-Enterprise-Release-List-Downloads).
+
+The changelog format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
+This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html) and all PyGraphistry-specific breaking changes are explictly noted here.
+
+## [Development]
+
+### Added
+
+* ReadTheDocs site: [https://graphistry-admin-docs.readthedocs.io/](https://graphistry-admin-docs.readthedocs.io/)
+
+### Changed
+
+* Reorganized documentation into thematic areas
+
+### Infra
+
+* Sphinx port
+* CI
diff --git a/README.md b/README.md
index 02a4790..d1e221e 100644
--- a/README.md
+++ b/README.md
@@ -2,122 +2,33 @@
 
 Graphistry is the most scalable graph-based visual analysis and investigation automation platform. It supports both cloud and on-prem deployment options. Big graphs are tons of fun!
 
-The documentation here covers system administration
 
-See bottom of page for table of contents and additional resources.
+## Quick administration links
 
-#### Get
+* [Top commands](https://graphistry-admin-docs.readthedocs.io/en/latest/commands.html)
+* [Plan deployments](https://graphistry-admin-docs.readthedocs.io/en/latest/planning/hardware-software.html)
+* Install: [Cloud](https://graphistry-admin-docs.readthedocs.io/en/latest/install/cloud/index.html) & [On-prem](https://graphistry-admin-docs.readthedocs.io/en/latest/install/on-prem/index.html)
+* [Configure](https://graphistry-admin-docs.readthedocs.io/en/latest/app-config/index.html)
+* [Debugging & performance](https://graphistry-admin-docs.readthedocs.io/en/latest/debugging/index.html)
+* [Security](https://graphistry-admin-docs.readthedocs.io/en/latest/security/index.html)
+* [Operations & tools](https://graphistry-admin-docs.readthedocs.io/en/latest/tools/index.html)
+* [FAQ](https://graphistry-admin-docs.readthedocs.io/en/latest/faq/index.html) & [support options](https://graphistry-admin-docs.readthedocs.io/en/latest/support.html)
 
-Pick an [appropriate hardware/software configuration](hardware-software.md):
-* Graphistry Hub: Graphistry manages Hub for its users
-* AWS/Azure Marketplace: See below instructions
-* Docker (self-hosted): See [enterprise release portal](https://graphistry.zendesk.com/hc/en-us/articles/360033184174)
-* Experimental - Kubernetes Helm chart: See [graphistry/graphistry-helm repository](https://github.com/graphistry/graphistry-helm)  
-
-#### Support
-
-Email, Zoom, Slack, phone, tickets -- we encourage using the [Graphistry support channel](https://www.graphistry.com/support) that works best for you. We want you and your users to succeed! 
-
-#### Learn
-
-See also [release guides](https://github.com/graphistry/graphistry-community) and [user and developer documentation](https://hub.graphistry.com/docs)
-
----
-
-## Quick launch: Managed
-
-[AWS and Azure marketplaces](https://www.graphistry.com/get-started): The fastest way to start using Graphistry is to quick launch a preconfigured private Graphistry instance on [AWS and Azure marketplaces](https://www.graphistry.com/get-started)
-
-It runs in your private cloud provider account and is configured to autostart. See [AWS launch walkthrough tutorial & videos](https://www.graphistry.com/blog/marketplace-tutorial) and linked guides for optional post-launch configuration and maintenance.
-
-Out-of-the-box configurations include GPU drivers, Docker with Nvidia runtime, multi-GPU support, Graphistry installation, auto-start on instance stop/restart, and more
-
----
-
-## Quick launch: Manual
-
-Requirements: [Download Graphistry](https://graphistry.zendesk.com/hc/en-us/articles/360033184174) and [verify docker-compose is setup for Nvidia runtimes](docs/testing-an-install.md#6-quick-testing-and-test-gpu)
-
-**1. Install** if not already available from the folder with `containers.tar.gz`, and likely using `sudo`:
-
-```bash
-docker load -i containers.tar.gz
-```
-
-Note: In previous versions (< `v2.35`), the file was `containers.tar`
-
-
-**2. Launch** from the folder with `docker-compose.yml` if not already up, and likely using `sudo`:
-
-```bash
-docker-compose up -d
-```
-
-Note: Takes 1-3 min, and around 5 min, `docker ps` should report all services as `healthy`
-
-**3. Test:**  Go to 
-
-```
-http://localhost
-```
-
-* Create an account, and then try running a prebuilt Jupyter Notebook from the dashboard!
-  * The first account gets an admin role, upon which account self-registration closes. Admins can then invite users or open self-registration. See [User Creation](docs/user-creation.md) for more information.
-
-* Try a visualization like http://localhost/graph/graph.html?dataset=Facebook&play=5000&splashAfter=false 
-  * **Warning**: First viz load may be slow (1 min) as RAPIDS generates **just-in-time** code for each GPU worker upon first encounter, and/or require a page refresh
-
----
-
-
-## Top commands
-
-Graphistry supports advanced command-line administration via standard `docker-compose`, `.yml` / `.env` files, and `caddy` reverse-proxy configuration.
-
-### Login to server
-
-| Image | Command |
-|--: |:-- |
-| **AWS** | `ssh -i [your_key].pem ubuntu@[your_public_ip]` |
-| **Azure** | `ssh -i [your_key].pem [your_user]@[your_public_ip]` <br> `ssh [your_user]@[your_public_ip]` (pwd-based) |
-| **Google** | `gcloud compute [your_instance] ssh` |
-| **On-prem / BYOL** | Contact your admin |
-
-### CLI commands
-
-All likely require `sudo`. Run from where your `docker-compose.yml` file is located:  `/home/ubuntu/graphistry` (AWS), `/var/graphistry` (Azure), or `/var/graphistry/<releases>/<version>` (recommended on-prem).
-
-|  TASK	| COMMAND 	| NOTES 	|
-|--: |:---	|:---	|
-| **Install** 	| `docker load -i containers.tar.gz` 	| Install the `containers.tar.gz` Graphistry release from the current folder. You may need to first run `tar -xvvf my-graphistry-release.tar.gz`.	|
-| **Start <br>interactive** 	| `docker-compose up` 	| Starts Graphistry, close with ctrl-c 	|
-| **Start <br>daemon** 	| `docker-compose up -d` 	| Starts Graphistry as background process 	|
-| **Start <br>namespaced (concurrent)** 	| `docker-compose -p my_unique_namespace up` 	| Starts Graphistry in a specific namespace. Enables running multiple independent instances of Graphistry. NOTE: Must modify Caddy service in `docker-compose.yml` to use non-conflicting public ports, and likewise change global volumes to be independent. 	|
-| **Stop** 	| `docker-compose stop` 	| Stops Graphistry 	|
-| **Restart (soft)** 	| `docker restart <CONTAINER>` 	| Soft restart. May also need to restart service `nginx`. 	|
-| **Restart (hard)** 	| `docker up -d --force-recreate --no-deps <CONTAINER>` 	|  Restart with fresh state. May also need to restart service `nginx`.	|
-| **Reset**     | `docker-compose down -v && docker-compose up -d` | Stop Graphistry, remove all internal state (including the user account database!), and start fresh .  |
-| **Status** 	 | `docker-compose ps`, `docker ps`, and `docker status` 	|  Status: Uptime, healthchecks, ...	|
-| **GPU Status** | `nvidia-smi` | See GPU processes, compute/memory consumption, and driver.  Ex: `watch -n 1.5 nvidia-smi`. Also, `docker run --rm -it nvidia/cuda:11.5.0-base-ubuntu20.04 nvidia-smi` for in-container test. |
-| **1.0 API Key** | docker-compose exec streamgl-vgraph-etl curl "http://0.0.0.0:8080/api/internal/provision?text=MYUSERNAME" 	|  Generates API key for a developer or notebook user	(1.0 API is deprecated)|
-| **Logs** 	|  `docker-compose logs <CONTAINER>` 	|  Ex: Watch all logs, starting with the 20 most recent lines:  `docker-compose logs -f -t --tail=20 forge-etl-python`	. You likely need to switch Docker to use the local json logging driver by  deleting the two default managed Splunk log driver options in `/etc/docker/daemon.json` and then restarting the `docker` daemon (see below). |
-| **Create Users** | Use Admin Panel (see [Create Users](docs/user-creation.md)) or `etc/scripts/rest` |
-| **Restart Docker Daemon** | `sudo service docker restart` | Use when changing `/etc/docker/daemon.json`, ... |
-| **Jupyter shell**| `docker exec -it -u root graphistry_notebook_1 bash` then `source activate rapids` | Use for admin tasks like global package installs |
-
-
-## Manual enterprise install
-
-NOTE: Managed Graphistry instances do not require any of these steps.
+## Further reading
 
-The Graphistry environnment depends soley on [Nvidia RAPIDS](https://rapids.ai) and [Nvidia Docker](https://github.com/NVIDIA/nvidia-docker) via `Docker Compose 3`, and ships with all other dependencies built in.
+* [Main Graphistry documentation](https://hub.graphistry.com/docs) and same path on your local server
+* [Release portal](https://graphistry.zendesk.com/hc/en-us/articles/360033184174) for enterprise admins to download the latest
+* [Release notes](https://graphistry.zendesk.com/hc/en-us/articles/360033184174)
+* [Graphistry Hub](https://hub.graphistry.com): Graphistry-managed GPU servers, including free and team tiers
+* Docker (self-hosted): See [enterprise release portal](https://graphistry.zendesk.com/hc/en-us/articles/360033184174)
+* [Kubernetes Helm charts](https://github.com/graphistry/graphistry-helm) - Experimental
 
-### Test your environment setup
 
+## Quick GPU Docker environment test
 
 You can test your GPU environment via Graphistry's [base RAPIDS Docker image on DockerHub](https://hub.docker.com/r/graphistry/graphistry-forge-base):
 
-```
+```bash
 docker run --rm -it --entrypoint=/bin/bash graphistry/graphistry-forge-base:latest -c "source activate rapids && python3 -c \"import cudf; print(cudf.DataFrame({'x': [0,1,2]})['x'].sum())\""
 ```
 
@@ -126,122 +37,6 @@ docker run --rm -it --entrypoint=/bin/bash graphistry/graphistry-forge-base:late
 3
 ```
 
-See [GPU testing](docs/testing-an-install.md#6-quick-testing-and-test-gpu) to identify individual issues.
-
-### Manual environment setup
-
-See sample [Ubuntu 18.04 TLS](./docs/ubuntu_18_04_lts_setup.md) and [RHEL 7.6](./docs/rhel_7_6_setup.md) environment setup scripts for Nvidia drivers, Docker, nvidia-docker runtime, and docker-compose. See [Testing an Install](docs/testing-an-install.md) for environment testing.
-
-Please contact Graphistry staff for environment automation options. 
-
-### Manual Graphistry container download
-
-Download the latest enterprise distribution from the [enterprise release list](https://graphistry.zendesk.com/hc/en-us/articles/360033184174-Enterprise-Releases) on the support site.  Please contact your Graphistry support staff for access if not available.
-
-### Manual Graphistry container installation
-
-If `nvidia` is already your `docker info | grep Default` runtime:
-
-```bash
-############ Install & Launch
-wget -O release.tar.gz "https://..."
-tar -xvvf release.tar.gz
-docker load -i containers.tar.gz
-docker-compose up -d
-```
-
-
-## FAQ
-
-* Where are the docs? See this [GitHub repository](https://github.com/graphistry/graphistry-cli) for admin docs and [Graphistry Hub docs](http://hub.graphistry.com/docs) (or http://your_graphistry/docs) for analyst and developer docs
-
-* Where do I get help? Whether community chat, email, tickets, a call, or even a training, [pick the most convienent option](https://www.graphistry.com/support)
-
-* Can Graphistry run in the cloud? Yes - privately both via a [preconfigured AWS/Azure marketplace](https://www.graphistry.com/get-started) and as a self-managed docker binary. Contact our team for upcoming managed Graphistry Hub cloud tiers.
-
-* Can Graphistry run privately? 
-  * On-prem, including air-gapped, as a team backend server or a Linux-based analyst workstation, via docker image
-  * Cloud, via prebuilt marketplace instance
-  * Cloud, via docker image
-  
-* Can Graphistry run in ...
-  * A VM: [Yes, including VMWare vSphere, Nutanix AHV, and anywhere else Nvidia RAPIDS.ai runs](docs/vGPU.md). Just set `RMM_ALLOCATOR=default` in your `data/config/custom.env` to avoid relying on CUDA Unified Memory, which vGPUs do not support.
-  * Ubuntu / Red Hat / ... : Yes, just ensure the Nvidia Docker runtime is set as the default for docker-compose. We can assist with reference environment bootstrap scripts.
-  * Podman: Maybe! We have confirmed our core containers run on RHEL 8.3 with Podman, Nvidia container runtime, and docker-compose cli. Please contact our staff for the possibility of an alternate podman-compatible tarball. 
-  
-* How do I do license management? 
-  * Graphistry does not require software-managed license registration, we can work with your procurement team on self-reported use
-
-* Do I need a GPU on the client? No, clients do not need a GPU. They do need WebGL enabled, such as Chrome's non-GPU software emulation mode. If some of your users are on extremely limited environments, e.g., worse than a modern phone, or you have extremely powerful GPUs you would like to share, users report great experiences with GPU VDI technologies.
-
-* Do I need a GPU on the server? Yes, the server requires an Nvidia GPU that is Pascal or later (T4, P100, V100, A100, RTX, ...). 
-
-* Can Graphistry use multiple GPUs and multiple servers? 
-  * Graphistry visualizations take advantage of multiple GPUs & CPUs on the same server to handle more users
-  * Graphistry-managed Jupyter notebooks enable users to run custom GPU code, where each user may run multi-GPU tasks (e.g., via dask-cudf and dask-sql)
-  * For high availability configuration and operation, contact staff for additional guidance
-  * For many-node deployment and multi-GPU visualization acceleration, contact staff for roadmap
-
-* Can I run multiple instances of Graphistry? Yes, see the command section for running in an isolated namespace. This is primarily for testing and in-place upgrading. If your goal is for Graphistry to use multiple CPUs and GPUs, it already does so automatically, so you can launch as usual.
-
-* Can I use Graphistry from OS X / Windows? Yes, analysts can use any modern browser on any modern OS such as Chrome on Windows and Firefox on OS X, and even on small devices like Android phones and Apple tablets. The server requires Linux (Ubuntu, RHEL, ...) with a GPU. A self-contained analyst workstation would be Linux based.
-
-* How do I try it out?
-  * Notebook/API users can get a free account on [Graphistry Hub](https://www.graphistry.com/get-started)
-  * Interact with pregenerated live visualizations on the [PyGraphistry gallery](https://github.com/graphistry/pygraphistry)
-  * If you have a private sample CSV/XLS/etc., you can [spin up a private server in your AWS/Azure account](https://www.graphistry.com/get-started) and turn it off when done, and [our team is happy to help](https://www.graphistry.com/support)
-
-* How can I test if my GPU supports Graphistry and my GPU environment is setup properly? Graphistry only requires a [RAPIDS-compatible](https://www.rapids.ai) Docker environment, so you can use the community resources for that. In addition, see [Testing an Install](docs/testing-an-install.md).
-
-* The server is slow to start, is it broken?
-  * The server may take 1-3min to start; check the health status of each service with `sudo docker ps`
-  * By default, Graphistry has 4 RAPIDS workers (service `etl-server-python`) that perform just-in-time GPU compilation, meaning the first load on each is slow.
-  * ... System start and the first visualization load per process might be sped up by ensuring Docker is using a native diff driver (see [performance tuning](docs/performance-tuning.md))
-  * ... Subsequent use of those workers are fast for new datasets (code is already compiled), and subsequent reloads of recent datasets are extra fast (cached)
-
-* Can I add extra security layers? Yes -- see the hardening section for configuring areas like TLS, and contact the team for assistance with more custom/experimental layers like SSO
-
-* Can I run on another port? Yes -- modify `docker-compose.yml`'s service `caddy:`, such as for 80 to instead be 8888:
-```yml
-    ports:
-      - 8888:80
-    expose:
-      - "8888"
-```
-
-
-## Further reading
+See the installation and debugging sections for additional scenarios such as ensuring Docker Compose is correctly defaulting to a GPU runtime.
 
-* Plan a deployment
-  * Architecture: [Deployment architecture planning guide](docs/deployment-planning.md)
-  * Capacity: [Hardware/software requirements](hardware-software.md)
-  * Security: [Recommended hardening](docs/configure-security.md), [threat model](docs/threatmodel.md), [authentication](docs/authentication.md)
-* Install
-  * [Release portal](https://graphistry.zendesk.com/hc/en-us/articles/360033184174) for enterprise admins to download the latest Docker images
-  * [Manual Graphistry Installation](docs/manual.md) for non-marketplace / non-hosted: 
-  <br>AWS BYOL, Azure BYOL, On-Prem (RHEL/Ubuntu), & Air-Gapped
-  * [Nvidia vGPU virtualization support](docs/vGPU.md)
-* Configure
-  * [System settings](docs/configure.md): 
-    <br/>TLS/SSL/HTTPS, performance, logging, backups to disk, multiple proxy layers, and more
-      * [Security: Enable auto-TLS and restrict network access](docs/configure-security.md)
-      * [Add users](docs/user-creation.md)
-      * [AWS Marketplace quickstart](docs/aws_marketplace.md)
-      * [Azure Marketplace quickstart](docs/azure_marketplace.md) - also [private BYOL plans](docs/azure_marketplace_private_offer.md) and [manual VM setup](docs/azure.md) (deprecated)
-      * [Dashboards](docs/configure-dashboards.md)
-  * Content: 
-      * [Investigations connectors](docs/configure-investigation.md): Splunk, Neo4j, and more
-      * [Investigation templates](docs/templates.md): Save, reuse, link, and embed workflows
-      * [Custom pivots](docs/configure-custom-pivots.md): Streamline common investigation steps with simplified UIs
-      * [Ontology](docs/configure-ontology.md): Add new types and customize colors, icons, sizes, and more 
-      * The [Graphistry Data Bridge](docs/bridge.md): Go between cloud <> on-prem
-  * [PyGraphistry and notebooks](docs/configure-pygraphistry.md)
 
-* Maintain
-  * [Roadmap](https://github.com/graphistry/graphistry-community/projects/1) and [release notes](https://graphistry.zendesk.com/hc/en-us/articles/360033184174)
-  * On unconfigured instance reboots, you may need to first run `sudo systemctl start docker`
-  * [Update, backup, and migrate](docs/update-backup-migrate.md)
-* Use and develop
-  * [Main documentation](https://hub.graphistry.com/docs) or the same URL adjusted for your local server's address
-* Test:
-  * [Testing an install](docs/testing-an-install.md)
diff --git a/bin/ci.sh b/bin/ci.sh
new file mode 100755
index 0000000..1597ebc
--- /dev/null
+++ b/bin/ci.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+set -ex
+
+DOCS_FORMAT=${DOCS_FORMAT:-all}  # Default to building all formats if not specified
+
+(
+    cd infra \
+    && docker compose build \
+    && docker compose run --rm -e DOCS_FORMAT=$DOCS_FORMAT sphinx
+)
diff --git a/bin/clean.sh b/bin/clean.sh
new file mode 100755
index 0000000..e43ad4d
--- /dev/null
+++ b/bin/clean.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+set -ex
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# check if _build/ and doctrees exist
+if [ ! -d "${SCRIPT_DIR}/../_build/" ]; then
+    echo "Directory _build/ does not exist, nothing to clean"
+else
+    rm -rf "${SCRIPT_DIR}/../_build/"
+fi
+
+if [ ! -d "${SCRIPT_DIR}/../doctrees/" ]; then
+    echo "Directory doctrees/ does not exist, nothing to clean"
+else
+    rm -rf "${SCRIPT_DIR}/../doctrees/"
+fi
+
+echo "Cleaned up build artifacts."
diff --git a/bin/html.sh b/bin/html.sh
new file mode 100755
index 0000000..5959c41
--- /dev/null
+++ b/bin/html.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+set -ex
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+ci_file="$script_dir/ci.html"
+
+DOCS_FORMAT=html "${SCRIPT_DIR}/ci.sh"
diff --git a/build/build.sh b/build/build.sh
index d5053e7..20839fa 100755
--- a/build/build.sh
+++ b/build/build.sh
@@ -4,37 +4,15 @@
 ### ~/build $ ./build.sh
 
 echo "==== BUILDING readme.pdf ===="
+DOCS=$(ls docs/*.md)
 docker run --rm -it -v $PWD/..:/source jagregory/pandoc --toc -V documentclass=report -s \
 	README.md \
-	hardware-software.md \
-	docs/aws.md \
-	docs/aws_marketplace.md \
-	docs/azure.md \
-	docs/bridge.md \
-	docs/browser.md \
-	docs/configure-investigation.md \
-	docs/configure-ontology.md \
-	docs/configure-pygraphistry.md \
-	docs/configure.md \
-	docs/debug-container-networking.md \
-	docs/debug-faq.md \
-	docs/debug-logs.md \
-        docs/deployment-planning.md \
-	docs/developer.md \
-	docs/manual.md \
-	docs/nvidia-docker-in-docker.md \
-	docs/rhel_7_6_setup.md \
-	docs/templates.md \
-	docs/testing-an-install.md \
-	docs/threatmodel.md \
-	docs/update-backup-migrate.md \
-	docs/user-creation.md \
+	$DOCS \
 	-o readme.pdf
 
-
 echo "==== BUILDING hardware-software.pdf ===="
 docker run --rm -it -v $PWD/..:/source jagregory/pandoc --toc -V documentclass=report -s \
-	hardware-software.md \
+	docs/hardware-software.md \
 	-o hardware-software.pdf
 
 ls -al ../*.pdf
diff --git a/docs/admin.rst b/docs/admin.rst
new file mode 100644
index 0000000..4546e00
--- /dev/null
+++ b/docs/admin.rst
@@ -0,0 +1,21 @@
+.. toctree::
+   :maxdepth: 2
+   :hidden:
+
+   README
+
+
+.. toctree::
+   :maxdepth: 2
+   
+   commands
+   planning/index
+   install/cloud/index
+   install/on-prem/index
+   install/testing-an-install
+   app-config/index
+   debugging/index
+   security/index
+   tools/index
+   faq
+   support
diff --git a/docs/configure-custom-pivots.md b/docs/app-config/configure-custom-pivots.md
similarity index 97%
rename from docs/configure-custom-pivots.md
rename to docs/app-config/configure-custom-pivots.md
index 6fb70d4..94b33c9 100644
--- a/docs/configure-custom-pivots.md
+++ b/docs/app-config/configure-custom-pivots.md
@@ -86,7 +86,7 @@ One of the most common use cases is creating derived pivots that simplify more g
 
 For example, consider expanding based on IP. The base Splunk expand pivot `expand-splunk-plain` could be simplified via:
 
-```
+```json
 {
 	"id": "expand-splunk-ip",
 	"name": "Splunk: Expand by IP",
@@ -136,7 +136,7 @@ Macro variables are of two types:
 
   Example:
 
-```
+```json
 {
   "id": "expand-splunk-ip",
   "name": "Splunk: Expand by IP",
@@ -144,10 +144,10 @@ Macro variables are of two types:
   "parameters": [
     {
       "name": "filterPost",
-      "defaultValue": "head { *max }
+      "defaultValue": "head { *max }"
     },
-    ...
-
+  ]
+}
 ```  
 
 
@@ -157,7 +157,7 @@ Macro variables are of two types:
   
   Expands to the current value of the corresponding named configuration parameter, or throws an error if no such parameter or it is marked as sensitive
   
-```
+```json
 {
   "id": "expand-splunk-searchhead",
   "name": "Splunk: Expand on searchhead",
@@ -167,7 +167,8 @@ Macro variables are of two types:
         "name": "filter",
         "defaultValue": "search host={ .splunk.host }"
       },
-      ...      
+  ]
+}
 ```  
 
 
@@ -175,7 +176,7 @@ Macro variables are of two types:
 
 You can add new UI parameters as well. For example, you can create a new pivot that is like `expand-splunk-plain` except also has new text parameter `myNewParam`:
 
-```
+```json
 {
   "id": "expand-splunk-custom-param",
   "name": "Splunk: Expand on searchhead",
@@ -188,7 +189,8 @@ You can add new UI parameters as well. For example, you can create a new pivot t
         "isVisible": true,
         "defaultValue": "hello",
       },
-      ...
+  ]
+}
 ``` 
 
 ## Example: Splunk - Combining new parameters with macros
@@ -198,7 +200,7 @@ The power of new parameters comes through macros. For example, an IP search pivo
 
 File `config/pivot-db/config/config.json`:
 
-```
+```json
 {
   "systemTemplates": {
     "pivots": [
@@ -220,10 +222,14 @@ File `config/pivot-db/config/config.json`:
 		        "defaultValue": "src_ip={ *ip }"
 		      },
 		      {
-		        "name": filterPost",
+		        "name": "filterPost",
 		        "isVisible": false
 		      },
-		      ...
+      ]
+    }
+    ]
+  }
+}
 ```
 
 This pivot removes the need for users to know Splunk queries when doing IP searches!
@@ -233,7 +239,7 @@ This pivot removes the need for users to know Splunk queries when doing IP searc
 
 The following example reuses the Neo4j `search-neo4j` (Cypher query) pivot, where instead of forcing users to write raw Cypher queries for a common domain name lookup, they can just use a new `Domain` text entry button. Note the creation of a new input (`domain`) and the underlying `query` is set to `"isVisible": "false"` and uses the macro `{ *domain }`.
 
-```
+```json
 {
   "systemTemplates": {
     "pivots": [
@@ -255,10 +261,12 @@ The following example reuses the Neo4j `search-neo4j` (Cypher query) pivot, wher
                         "defaultValue": "MATCH (a)-[r:DOMAIN { domain: \"{ *domain }\" }]-(b) RETURN a, r, b"
                     },
                     {
-                        name: "max",
-                        defaultValue: 2000
+                        "name": "max",
+                        "defaultValue": 2000
                     }
                 ]
             },
-	    ...
+    ]
+  }
+}
 ```	    
diff --git a/docs/configure-dashboards.md b/docs/app-config/configure-dashboards.md
similarity index 100%
rename from docs/configure-dashboards.md
rename to docs/app-config/configure-dashboards.md
diff --git a/docs/configure-investigation.md b/docs/app-config/configure-investigation.md
similarity index 99%
rename from docs/configure-investigation.md
rename to docs/app-config/configure-investigation.md
index 26cc0a7..3da9468 100644
--- a/docs/configure-investigation.md
+++ b/docs/app-config/configure-investigation.md
@@ -41,7 +41,7 @@ After setting these, restart your server:
 
 # Schema
 
-The schema specifies how to configure each setting as either an environment variable in `data/config/custom.env` (ex: `"env": "PIVOT_INTERNAL_IP_ACCEPTLIST"`) or as JSON in `data/pivot-db/config/config.json` following the schema's hierarchy + type `"format"` (ex: `{"layouts": {"network": { "ipInternalAcceptList": [ "ip1", "ip2"] } }
+The schema specifies how to configure each setting as either an environment variable in `data/config/custom.env` (ex: `"env": "PIVOT_INTERNAL_IP_ACCEPTLIST"`) or as JSON in `data/pivot-db/config/config.json` following the schema's hierarchy + type `"format"` (ex: `{"layouts": {"network": { "ipInternalAcceptList": [ "ip1", "ip2"] } }}`)
 
 See also: [main ontology docs](configure-ontology.md) and the [convict specification format](https://github.com/mozilla/node-convict/tree/master/packages/convict)
 
diff --git a/docs/configure-ontology.md b/docs/app-config/configure-ontology.md
similarity index 98%
rename from docs/configure-ontology.md
rename to docs/app-config/configure-ontology.md
index b218e1b..c171d20 100644
--- a/docs/configure-ontology.md
+++ b/docs/app-config/configure-ontology.md
@@ -55,22 +55,19 @@ For example, to create a new node type `ip`,
 
 1. Extend `data/investigations/config/config.json`:
 
-```
+```json
 {
-  ...
   "ontology": {
       "icons": {
          "ip": "device",
-         ...,
       },
       "colors": {
           "ip": "#F00",
-          ...
       },
       "sizes": {
           "ip": 100
       }
-   ...
+  }
 }   
 ```
 
@@ -90,9 +87,8 @@ Graphistry picks the displayed title for each node and edge through the first ma
 
 Ex:
 
-```
+```json
 {
-  ...
   "ontology": {
       "titles": {
           "byType": {
@@ -114,9 +110,8 @@ For example, to recognize `src_ip` and `dest_ip` columns as both generating `ip`
 
 1. Extend `data/investigations/config/config.json`:
 
-```
+```json
 {
-   ...
    "ontology": {
        "products": [
            {
@@ -141,7 +136,7 @@ The current set of built-in types is below. Upon system start, Graphistry emits
 
 We recommend using built-in types when possible. Each type comes with a built-in color, icon, size, and mappings from common data sources to it. This saves you work now, and as more connectors become supported and new features are added, you will automatically benefit from them in the future as well.
 
-```
+```json
 [
     "actor", "agent", "alert", "amazon", "amex", "arn", "asn", "availabilityzone", 
     "baidu", "bucket", 
@@ -177,11 +172,11 @@ Layouts have additional options. The most common to modify is to flag values for
 
 You can put any regular expression here:
 
-```
+```json
 
   "layouts": {
     "network": {
-        "ipInternalAcceptList": ['/10\.*/', '/127.0.0.1/']
+        "ipInternalAcceptList": ["/10\.*/", "/127.0.0.1/"]
     }
   },
 
diff --git a/docs/configure-pygraphistry.md b/docs/app-config/configure-pygraphistry.md
similarity index 98%
rename from docs/configure-pygraphistry.md
rename to docs/app-config/configure-pygraphistry.md
index b2df673..5d3f94b 100644
--- a/docs/configure-pygraphistry.md
+++ b/docs/app-config/configure-pygraphistry.md
@@ -46,8 +46,9 @@ Deprecated 1.0 API option (api=1, api=2)
 
 Override and add query parameters to the loaded visualization iframe by adding key/value strings to `url_params`. This does not control the protocol, domain, nor path, so is primarily for styling and debugging purposes.
 
-##### Example:
-```
+#### Example
+
+```python
 my_graph.settings(url_params={
     'play': '0', 
     'my_correlation_id': 'session-123'
@@ -67,9 +68,9 @@ register(api=3, username='...', password='...', server=None, protocol=None, api=
 
 See PyGraphistry docs for individual connectors such as `.bolt(...)` and `.tigergraph(...)`.
 
-##### Example: Neo4j (bolt/cypher)
+#### Example: Neo4j (bolt/cypher)
 
-```
+```python
 import graphistry
 graphistry.register(api=3, username='...', password='...', protocol='http', server='my.server.com')
 
@@ -83,6 +84,7 @@ g.cypher("MATCH (a)-[b]->(c) RETURN a,b,c LIMIT 100000").plot()
 ### Environment variables
 
 #### General
+
 | Graphistry Setting | Environment Variable | Description |
 |:---|:---|:---|
 | `api_version` | `GRAPHISTRY_API_VERSION` ||
@@ -114,7 +116,7 @@ Specify a `json` file using key/values from the Settings table.
 
 PyGraphistry automatically checks for `graphistry.config` as follows:
 
-```
+```python
 config_paths = [
     os.path.join('/etc/graphistry', '.pygraphistry'),
     os.path.join(os.path.expanduser('~'), '.pygraphistry'),
@@ -130,7 +132,7 @@ Libraries can be added using `pip` in the built-in Jupyter server. To enable new
 
 ### Speed up some uploads
 
-```
+```python
 import graphistry
 graphistry.register(api=3, username='..', password='...')
 ```
@@ -138,7 +140,8 @@ graphistry.register(api=3, username='..', password='...')
 ### Preset a 1.0 API key for all system users
 
 Create Python-readable `/etc/graphistry/.pygraphistry`:
-```
+
+```json
 {
     "api_key": "SHARED_USERS_KEY", 
     "protocol": "https",
@@ -152,7 +155,7 @@ For Jupyter notebooks, you may want to create per-user login `.pygraphistry` fil
 
 In scenarios like Graphistry running on a notebook server, you may prefer to send uploads to a local host (`http://localhost`, `http://nginx`, ...), and tell browser client viewers to use a separate, public host and subpath (`http://graphistry.site.ngo/graphistry`):
 
-```
+```python
 import os
 import graphistry
 
diff --git a/docs/configure.md b/docs/app-config/configure.md
similarity index 93%
rename from docs/configure.md
rename to docs/app-config/configure.md
index e966857..bb8583a 100644
--- a/docs/configure.md
+++ b/docs/app-config/configure.md
@@ -2,15 +2,15 @@
 
 Administrators can add users, specify passwords, TLS/SSL, persist data across sessions, connect to databases, specify ontologies, and more. 
 
-* For a list of many investigation-oriented options, see their [settings reference page](configure-investigation.md).
+* For a list of many investigation-oriented options, see their [settings reference page](configure-investigation).
 
-* See [update, backup, & migration instructions](update-backup-migrate.md) for preserving configurations and  data across installations.
+* See [update, backup, & migration instructions](../tools/update-backup-migrate.md) for preserving configurations and  data across installations.
 
 * For advanced Python notebook and application configuration, see [PyGraphistry configuration](configure-pygraphistry.md).
 
 ## Add your team and provide API keys
 
-See [user creation docs](user-creation.md)
+See [user creation docs](../tools/user-creation.md)
 
 
 ## Top configuration places: data/config/custom.env, data/pivot-db/config/config.json
@@ -41,7 +41,7 @@ Recommendations for SSO when self-hosting:
 
 ## TLS
 
-We encourage everyone to use HTTPS over HTTP, especially through the automatic TLS option, for [securing authentication](authentication.md)
+We encourage everyone to use HTTPS over HTTP, especially through the automatic TLS option, for [securing authentication](../security/authentication.md)
 
 Graphistry supports both free automatic TLS within your server (Caddy/LetsEncrypt) and offloading to an external load balancer or proxy
 
@@ -50,6 +50,7 @@ As part of TLS configuration, decide whether to allow cross-origin embedding of
 ### TLS Hardening
 
 #### Caddy
+
 If Caddy is used for TLS, several additional policies may be of interest, but only use ones that match your intended usage patterns:
 
 ```
@@ -102,6 +103,7 @@ COOKIE_SAMESITE=None
 Caddy supports [free automatic TLS](https://caddyserver.com/docs/automatic-https) as long as your site meets the listed conditions.  
 
 Sample `Caddyfile`:
+
 ```
 https://*.website.org:443 {
   tls {
@@ -119,7 +121,7 @@ Note that Graphistry is internally configured via `nginx`.
 
 ### Setup free Semi-Automatic TLS
 
-The above step may fail if your server does not allow outbound internet traffic. To work around, perform a [manual LetsEncrypt Certbot handshake for Caddy](configure-tls-caddy-manual-lets-encrypt-handshake.md).
+The above step may fail if your server does not allow outbound internet traffic. To work around, perform a [manual LetsEncrypt Certbot handshake for Caddy](../security/configure-tls-caddy-manual-lets-encrypt-handshake.md).
 
 ### Setup custom certs
 
@@ -214,7 +216,7 @@ You may externally redirect traffic, such as through an AWS Load Balancer or Clo
 
 If `80` / `443` are already taken, such as when running multiple Graphistry instances on the same box, you may want to change to another port. For example, to expose public port `8888` for Graphistry's HTTP traffic instead of `80`, configure `docker-compose.yml` to map it as follows:
 
-```yml
+```yaml
   caddy:
     ...
     expose:
@@ -236,7 +238,7 @@ Separately [configure the public and private dashboards](configure-dashboards.md
 
 ## Connectors
 
-Optionally, you can configure Graphistry to use database connectors. Graphistry will orchestrate cross-database query generation, pushing them down through the database API, and returning the combined results to the user. This means Graphistry can reuse your existing scaleout infrastructure and make its data more accessible to your users without requiring a second copy to be maintained. Some connectors further support use of the [Graphistry data bridge](bridge.md) for proxying requests between a Graphistry cloud server and an intermediate on-prem data bridge instead of directly connecting to on-prem API servers.
+Optionally, you can configure Graphistry to use database connectors. Graphistry will orchestrate cross-database query generation, pushing them down through the database API, and returning the combined results to the user. This means Graphistry can reuse your existing scaleout infrastructure and make its data more accessible to your users without requiring a second copy to be maintained. Some connectors further support use of the [Graphistry data bridge](../tools/bridge.md) for proxying requests between a Graphistry cloud server and an intermediate on-prem data bridge instead of directly connecting to on-prem API servers.
 
 ### Security Notes 
 
@@ -349,11 +351,11 @@ For faster start, or to be explicit about schema, or avoid start issues, you may
 
 ### Data bridge
 
-In scenarios such as a Graphistry cloud server accessing on-prem API servers, an intermediate on-prem data bridge may be necessary. You can mix bridged and direct (default) connectors in the same Graphistry server. Learn more about the [Graphistry data bridge](bridge.md).
+In scenarios such as a Graphistry cloud server accessing on-prem API servers, an intermediate on-prem data bridge may be necessary. You can mix bridged and direct (default) connectors in the same Graphistry server. Learn more about the [Graphistry data bridge](../tools/bridge.md).
 
 ### Variants
 
-* Give your Graphistry implementation user increased permissions so they can embed Graphistry into existing dashbboard and notification systems, such as for embedded visualizations and quicklinks into contextual [investigation templates](templates.md)* Run a [Graphistry data bridge](bridge.md), if available for your connector, which may help with cases such as firewalls preventing incoming connections from Graphistry to your database
+* Give your Graphistry implementation user increased permissions so they can embed Graphistry into existing dashbboard and notification systems, such as for embedded visualizations and quicklinks into contextual [investigation templates](templates.md)* Run a [Graphistry data bridge](../tools/bridge.md), if available for your connector, which may help with cases such as firewalls preventing incoming connections from Graphistry to your database
 * Run a bastion server between Graphistry and your database, such as a new Splunk search head
 * Create fine-grained permissions by running multiple Graphistry virtual servers, with a new Splunk role per instance
 
@@ -372,5 +374,5 @@ Every connector comes with a base set of pivots. See [custom pivots](configure-c
 
 ## Performance
 
-See [performance tuning](performance-tuning.md)
+See [performance tuning](../debugging/performance-tuning.md)
 
diff --git a/docs/connector-management.md b/docs/app-config/connector-management.md
similarity index 99%
rename from docs/connector-management.md
rename to docs/app-config/connector-management.md
index 99a4448..954297e 100644
--- a/docs/connector-management.md
+++ b/docs/app-config/connector-management.md
@@ -203,7 +203,7 @@ ACTION=update_all_pats CONNECTOR_ID="sample_connector_id" PATS_CSV='path/to/pats
 
 #### CSV File Example
 
-```csv
+```
 username,PAT
 user123,abc123pat
 user456,def456pat
diff --git a/docs/email.md b/docs/app-config/email.md
similarity index 100%
rename from docs/email.md
rename to docs/app-config/email.md
diff --git a/docs/app-config/index.rst b/docs/app-config/index.rst
new file mode 100644
index 0000000..4a5a612
--- /dev/null
+++ b/docs/app-config/index.rst
@@ -0,0 +1,37 @@
+
+App configuration
+=================
+
+
+Visual Playbooks
+----------------
+
+.. toctree::
+   :maxdepth: 1
+   :titlesonly:
+
+   configure
+   configure-custom-pivots
+   configure-investigation
+   configure-ontology
+   connector-management
+   templates
+
+Streamlit
+---------
+
+.. toctree::
+   :maxdepth: 1
+   :titlesonly:
+
+   configure-dashboards
+
+System
+------
+
+.. toctree::
+   :maxdepth: 1
+   :titlesonly:
+
+   email
+   configure-pygraphistry
diff --git a/docs/templates.md b/docs/app-config/templates.md
similarity index 97%
rename from docs/templates.md
rename to docs/app-config/templates.md
index 777e283..31ca2cd 100644
--- a/docs/templates.md
+++ b/docs/app-config/templates.md
@@ -82,22 +82,22 @@ To make a template appear as a Workflow Action on a specific kind of event:
 
 ## 6. Best practices
 
-#### Manual data for first step
+### Manual data for first step
 
 By making the first step an `Enter data` one, most of the parameters can be set on it. The URL generates an initial graph, and subsequent steps expand on them.
 
-#### Multiple entry points
+### Multiple entry points
 
 You can likely combine multiple templates into one. For example, in IT scenarios, 360 views for IP's, MAC addresses, and host names likely look the same. Make the first step create a graph for one or more of these, the next ones derive one value type from the other (or a canonical ID), and the remaining steps look the same.
 
-#### Set time range  and provide instructions
+### Set time range  and provide instructions
 
 Analysts unfamiliar with your template would strongly benefit from instructions telling them what to modify (if anything) and how to use the investigation. Many options likely have sane defaults on a per-template basis, such as the time range, so we recommend including them in your URLs.
 
-#### Naming
+### Naming
 
 Content management can become an issue. Use a custom short description name, such as `name=%5BPhone%20360%5D%20555-5555` (=> `[Phone 360] 555-5555`. The generated investigations can now be easily searched and sorted.
 
-#### Cross-linking
+### Cross-linking
 
 You can include templates as links within templates! For example, whenever a phone number node is generated, you can include attribute `link` with value `/pivot/template?investigation=...` .
diff --git a/docs/commands.md b/docs/commands.md
new file mode 100644
index 0000000..5be3509
--- /dev/null
+++ b/docs/commands.md
@@ -0,0 +1,34 @@
+# Top commands
+
+Graphistry supports advanced command-line administration via standard `docker-compose`, `.yml` / `.env` files, and `caddy` reverse-proxy configuration.
+
+## Login to server
+
+| Image | Command |
+|--: |:-- |
+| **AWS** | `ssh -i [your_key].pem ubuntu@[your_public_ip]` |
+| **Azure** | `ssh -i [your_key].pem [your_user]@[your_public_ip]` <br> `ssh [your_user]@[your_public_ip]` (pwd-based) |
+| **Google** | `gcloud compute [your_instance] ssh` |
+| **On-prem / BYOL** | Contact your admin |
+
+## CLI commands
+
+All likely require `sudo`. Run from where your `docker-compose.yml` file is located:  `/home/ubuntu/graphistry` (AWS), `/var/graphistry` (Azure), or `/var/graphistry/<releases>/<version>` (recommended on-prem).
+
+|  TASK	| COMMAND 	| NOTES 	|
+|--: |:---	|:---	|
+| **Install** 	| `docker load -i containers.tar.gz` 	| Install the `containers.tar.gz` Graphistry release from the current folder. You may need to first run `tar -xvvf my-graphistry-release.tar.gz`.	|
+| **Start <br>interactive** 	| `docker-compose up` 	| Starts Graphistry, close with ctrl-c 	|
+| **Start <br>daemon** 	| `docker-compose up -d` 	| Starts Graphistry as background process 	|
+| **Start <br>namespaced (concurrent)** 	| `docker-compose -p my_unique_namespace up` 	| Starts Graphistry in a specific namespace. Enables running multiple independent instances of Graphistry. NOTE: Must modify Caddy service in `docker-compose.yml` to use non-conflicting public ports, and likewise change global volumes to be independent. 	|
+| **Stop** 	| `docker-compose stop` 	| Stops Graphistry 	|
+| **Restart (soft)** 	| `docker restart <CONTAINER>` 	| Soft restart. May also need to restart service `nginx`. 	|
+| **Restart (hard)** 	| `docker up -d --force-recreate --no-deps <CONTAINER>` 	|  Restart with fresh state. May also need to restart service `nginx`.	|
+| **Reset**     | `docker-compose down -v && docker-compose up -d` | Stop Graphistry, remove all internal state (including the user account database!), and start fresh .  |
+| **Status** 	 | `docker-compose ps`, `docker ps`, and `docker status` 	|  Status: Uptime, healthchecks, ...	|
+| **GPU Status** | `nvidia-smi` | See GPU processes, compute/memory consumption, and driver.  Ex: `watch -n 1.5 nvidia-smi`. Also, `docker run --rm -it nvidia/cuda:11.5.0-base-ubuntu20.04 nvidia-smi` for in-container test. |
+| **1.0 API Key** | docker-compose exec streamgl-vgraph-etl curl "http://0.0.0.0:8080/api/internal/provision?text=MYUSERNAME" 	|  Generates API key for a developer or notebook user	(1.0 API is deprecated)|
+| **Logs** 	|  `docker-compose logs <CONTAINER>` 	|  Ex: Watch all logs, starting with the 20 most recent lines:  `docker-compose logs -f -t --tail=20 forge-etl-python`	. You likely need to switch Docker to use the local json logging driver by  deleting the two default managed Splunk log driver options in `/etc/docker/daemon.json` and then restarting the `docker` daemon (see below). |
+| **Create Users** | Use Admin Panel (see [Create Users](tools/user-creation.md)) or `etc/scripts/rest` |
+| **Restart Docker Daemon** | `sudo service docker restart` | Use when changing `/etc/docker/daemon.json`, ... |
+| **Jupyter shell**| `docker exec -it -u root graphistry_notebook_1 bash` then `source activate rapids` | Use for admin tasks like global package installs |
\ No newline at end of file
diff --git a/docs/conf.py b/docs/conf.py
new file mode 100644
index 0000000..6e94394
--- /dev/null
+++ b/docs/conf.py
@@ -0,0 +1,625 @@
+# Configuration file for the Sphinx documentation builder.
+#
+# This file only contains a selection of the most common options. For a full
+# list see the documentation:
+# https://www.sphinx-doc.org/en/master/usage/configuration.html
+
+# -- Path setup --------------------------------------------------------------
+
+# If extensions (or modules to document with autodoc) are in another directory,
+# add these directories to sys.path here. If the directory is relative to the
+# documentation root, use os.path.abspath to make it absolute, like shown here.
+#
+import docutils.nodes, os, logging, re, sys
+from docutils import nodes
+from docutils.parsers.rst import roles
+from packaging.version import Version
+from sphinx.application import Sphinx
+from sphinx.transforms.post_transforms import SphinxTransform
+
+
+sys.path.insert(0, os.path.abspath("../.."))
+import graphistry
+
+
+logger = logging.getLogger(__name__)
+logger.setLevel(logging.DEBUG)
+
+
+# -- Project information -----------------------------------------------------
+
+project = "Graphistry CLI"
+copyright = "2024, Graphistry, Inc."
+author = "Graphistry, Inc."
+
+html_title = "Graphistry Administration Documentation"
+html_short_title = "Graphistry Admin"
+html_logo = 'static/graphistry_banner_transparent_colored.png'
+html_favicon = 'static/favicon.ico'
+
+# The full version, including alpha/beta/rc tags
+version = str(Version(graphistry.__version__))
+release = version
+
+# -- General configuration ---------------------------------------------------
+
+# Add any Sphinx extension module names here, as strings. They can be
+# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
+# ones.
+extensions = [
+    'myst_parser',
+    'nbsphinx',
+    "sphinx.ext.autodoc",
+    #'sphinx.ext.autosummary',
+    'sphinx.ext.intersphinx',
+    "sphinx.ext.ifconfig",
+    #"sphinx_autodoc_typehints",
+    "sphinx_copybutton",
+]
+
+myst_url_schemes = ["http", "https", "mailto", "ftp", "file"]
+myst_heading_anchors = 3  # Allow md files to have links with extension .md in the path
+
+#myst_enable_extensions = ["linkify", "substitution"]
+myst_enable_extensions = ["linkify"]
+myst_commonmark_only = False  # Use CommonMark only
+myst_heading_anchors_auto_id_prefix = False  # Disable auto ID prefix for headings
+
+# TODO guarantee most notebooks are executable (=> maintained)
+# and switch to opt'ing out the few that are hard, e.g., DB deps
+nbsphinx_execute = 'never'
+nbsphinx_allow_errors = False  # Allow errors in notebooks
+
+autodoc_typehints = "description"
+always_document_param_types = True
+typehints_document_rtype = True
+
+#suppress_warnings = [
+#    'nbsphinx.localfile',  # Suppresses local file warnings in notebooks
+#]
+
+nitpick_ignore = []
+
+#set_type_checking_flag = True
+
+# typehints_fully_qualified=True
+always_document_param_types = True
+typehints_document_rtype = True
+
+# Add any paths that contain templates here, relative to this directory.
+templates_path = ["_templates"]
+
+# The suffix(es) of source filenames.
+# You can specify multiple suffix as a list of string:
+# source_suffix = ['.rst', '.md']
+# source_suffix = ['.rst', '.ipynb']
+source_suffix = {
+     '.md': 'myst',
+     '.txt': 'markdown',
+    '.rst': 'restructuredtext',
+    #'.ipynb': 'nbsphinx',
+}
+# The master toctree document.
+root_doc = "index"
+
+# List of patterns, relative to source directory, that match files and
+# directories to ignore when looking for source files.
+# This pattern also affects html_static_path and html_extra_path.
+exclude_patterns = [
+
+    '_build',
+     '**/_build/**',
+    'doctrees',
+    '**/doctrees/**',
+    '**/*.txt',
+
+]
+
+pygments_style = "sphinx"
+todo_include_todos = False
+
+# -- Options for HTML output -------------------------------------------------
+
+# The theme to use for HTML and HTML Help pages.  See the documentation for
+# a list of builtin themes.
+#
+#html_theme = "sphinx_rtd_theme"
+html_theme = "sphinx_book_theme"
+
+
+html_theme_options = {
+    "repository_url": "https://github.com/graphistry/graphistry-cli",
+    "use_repository_button": True,
+
+    # Optional top horizontal navigation bar
+    #"navbar_start": ["navbar-start.html"],
+    #"navbar_center": ["navbar-center.html"],
+    #"navbar_end": ["navbar-end.html"],
+    
+    "logo": {
+        #"link": "https://www.graphistry.com/get-started",
+        #"text": "Graphistry, Inc.",
+        "alt_text": "Graphistry, Inc."
+    }
+}
+
+
+# Add any paths that contain custom static files (such as style sheets) here,
+# relative to this directory. They are copied after the builtin static files,
+# so a file named "default.css" will overwrite the builtin "default.css".
+html_static_path = ['static']  # '_static'
+# html_css_files = ['graphistry.css']
+
+html_show_sphinx = False
+
+htmlhelp_basename = "Graphistry-admin-doc"
+
+
+# -- Options for LaTeX output ---------------------------------------------
+
+latex_elements = {
+    'preamble': r'''
+
+        \usepackage{graphicx}
+        % Command to adjust image paths for LaTeX builds
+        \makeatletter
+        \def\input@path{{./}{./_static/img/}{./static/img/}}
+        \makeatother
+
+        \usepackage{svg}   % Enables SVG handling via Inkscape
+
+        \RequirePackage{etex}         % Ensure extended TeX capacities
+        \usepackage[utf8]{inputenc}   % Enable UTF-8 support
+        \usepackage[T1]{fontenc}      % Use T1 font encoding for better character support
+        \usepackage{lmodern}          % Load Latin Modern fonts for better quality
+        \usepackage{amsmath}           % For advanced math formatting
+        \usepackage{amsfonts}          % For math fonts
+        \usepackage{amssymb}           % For additional math symbols
+        \usepackage{graphicx}          % For including images
+        \usepackage{hyperref}          % For hyperlinks
+        \usepackage{textcomp}          % For additional text symbols
+        \usepackage{breakurl}          % Allows line breaks in URLs
+        \usepackage{listings}          % For code listings
+        \usepackage{float}             % Improved control of floating objects
+        \usepackage{microtype}         % Improves text appearance with microtypography
+        \usepackage{lipsum}            % For generating dummy text (if needed)
+
+
+        % Increase capacity limits
+        \setcounter{totalnumber}{200}   % Maximum floats
+        \setcounter{dbltopnumber}{200}   % Double float maximum
+        \setcounter{secnumdepth}{3}      % Section numbering depth
+        \setcounter{tocdepth}{3}          % Table of contents depth
+        
+        % Increase dimensions and allocations
+        \usepackage{morefloats}          % Allows for more floats
+        \setlength{\emergencystretch}{3em} % Help with overfull hboxes
+        \setlength{\maxdepth}{100pt}       % Sets a high limit for max depth (if applicable)
+
+        % Allocate more memory for TeX
+        \usepackage{etex}                % Use eTeX for more memory
+        %\reserveinserts{200}             % Reserve more inserts
+        \setcounter{totalnumber}{200}    % Ensure maximum floats are increased
+
+
+        % Declare Unicode characters
+        \DeclareUnicodeCharacter{1F389}{\textbf{(party popper)}}
+        \DeclareUnicodeCharacter{1F3C6}{\textbf{(trophy)}}
+        \DeclareUnicodeCharacter{1F44D}{\textbf{(thumbs up)}}
+        \DeclareUnicodeCharacter{1F4AA}{\textbf{Strong}}  % Muscle emoji
+        \DeclareUnicodeCharacter{1F4B0}{\textbf{Money Bag}} % Money bag emoji (text representation)
+        \DeclareUnicodeCharacter{1F525}{\textbf{(fire)}}
+        \DeclareUnicodeCharacter{1F600}{\textbf{(grinning)}}
+        \DeclareUnicodeCharacter{1F609}{\textbf{(winking)}}
+        \DeclareUnicodeCharacter{1F614}{\textbf{(pensive)}}
+        \DeclareUnicodeCharacter{1F680}{\textbf{(rocket)}}
+        \DeclareUnicodeCharacter{2501}{\textbf{━}}         % Heavy horizontal line
+        \DeclareUnicodeCharacter{2588}{\textbf{█}}         % Full block character
+        \DeclareUnicodeCharacter{258A}{\textbf{▊}}         % Center right block character
+        \DeclareUnicodeCharacter{258B}{\textbf{▉}}         % Right block character
+        \DeclareUnicodeCharacter{258C}{\textbf{▌}}         % Center block character
+        \DeclareUnicodeCharacter{258D}{\textbf{▍}}         % Center left block character
+        \DeclareUnicodeCharacter{258E}{\textbf{▎}}         % Left third block character
+        \DeclareUnicodeCharacter{258F}{\textbf{▏}}         % Right block character
+        \DeclareUnicodeCharacter{2728}{\textbf{(sparkles)}}
+        \DeclareUnicodeCharacter{2764}{\textbf{(heart)}}
+        \DeclareUnicodeCharacter{2705}{\textbf{(check mark)}}
+        \DeclareUnicodeCharacter{2B50}{\textbf{(star)}}
+
+    ''',
+}
+
+# Use pdflatex as the LaTeX engine
+latex_engine = 'pdflatex'
+
+# Grouping the document tree into LaTeX files. List of tuples
+# (source start file, target name, title,
+#  author, documentclass [howto, manual, or own class]).
+latex_documents = [
+    (
+        root_doc,
+        "Graphistry.tex",
+        u"Graphistry Admin Documentation",
+        u"Graphistry, Inc.",
+        "manual",
+    ),
+]
+
+# The name of an image file (relative to this directory) to place at the top of
+# the title page.
+# latex_logo = None
+
+# For "manual" documents, if this is true, then toplevel headings are parts,
+# not chapters.
+# latex_use_parts = False
+
+# If true, show page references after internal links.
+# latex_show_pagerefs = False
+
+# If true, show URL addresses after external links.
+# latex_show_urls = False
+
+# Documents to append as an appendix to all manuals.
+# latex_appendices = []
+
+# If false, no module index is generated.
+latex_domain_indices = False
+
+
+# -- Options for manual page output ---------------------------------------
+
+# One entry per manual page. List of tuples
+# (source start file, name, description, authors, manual section).
+man_pages = [(root_doc, "graphistry-admin-docs", u"Graphistry Admin Documentation", [author], 1)]
+
+# If true, show URL addresses after external links.
+# man_show_urls = False
+
+
+# -- Options for Texinfo output -------------------------------------------
+
+# Grouping the document tree into Texinfo files. List of tuples
+# (source start file, target name, title, author,
+#  dir menu entry, description, category)
+texinfo_documents = [
+    (
+        root_doc,
+        "Graphistry",
+        u"Praphistry Admin Documentation",
+        author,
+        "Graphistry",
+        "Admin documents for Graphistry.",
+        "Miscellaneous",
+    ),
+]
+
+# Documents to append as an appendix to all manuals.
+# texinfo_appendices = []
+
+# If false, no module index is generated.
+texinfo_domain_indices = False
+
+# How to display URL addresses: 'footnote', 'no', or 'inline'.
+# texinfo_show_urls = 'footnote'
+
+# If true, do not generate a @detailmenu in the "Top" node's menu.
+# texinfo_no_detailmenu = False
+
+
+# -- Options for Epub output ----------------------------------------------
+
+# Bibliographic Dublin Core info.
+epub_title = project
+epub_author = author
+epub_publisher = author
+epub_copyright = copyright
+
+# The basename for the epub file. It defaults to the project name.
+# epub_basename = project
+
+# The HTML theme for the epub output. Since the default themes are not optimized
+# for small screen space, using the same theme for HTML and epub output is
+# usually not wise. This defaults to 'epub', a theme designed to save visual
+# space.
+# epub_theme = 'epub'
+
+# The language of the text. It defaults to the language option
+# or 'en' if the language is not set.
+# epub_language = ''
+
+# The scheme of the identifier. Typical schemes are ISBN or URL.
+# epub_scheme = ''
+
+# The unique identifier of the text. This can be a ISBN number
+# or the project homepage.
+# epub_identifier = ''
+
+# A unique identification for the text.
+# epub_uid = ''
+
+# A tuple containing the cover image and cover page html template filenames.
+# epub_cover = ()
+
+# A sequence of (type, uri, title) tuples for the guide element of content.opf.
+# epub_guide = ()
+
+# HTML files that should be inserted before the pages created by sphinx.
+# The format is a list of tuples containing the path and title.
+# epub_pre_files = []
+
+# HTML files shat should be inserted after the pages created by sphinx.
+# The format is a list of tuples containing the path and title.
+# epub_post_files = []
+
+# A list of files that should not be packed into the epub file.
+epub_exclude_files = ["search.html"]
+
+# The depth of the table of contents in toc.ncx.
+# epub_tocdepth = 3
+
+# Allow duplicate toc entries.
+# epub_tocdup = True
+
+# Choose between 'default' and 'includehidden'.
+# epub_tocscope = 'default'
+
+# Fix unsupported image types using the Pillow.
+# epub_fix_images = False
+
+# Scale large images.
+# epub_max_image_width = 0
+
+# How to display URL addresses: 'footnote', 'no', or 'inline'.
+# epub_show_urls = 'inline'
+
+# If false, no index is generated.
+# epub_use_index = True
+
+
+# Example configuration for intersphinx: refer to the Python standard library.
+# intersphinx_mapping = {'https://docs.python.org/': None}
+
+
+
+# -- Custom Preprocessor Configuration ---------------------------------------
+
+def replace_iframe_src(app, doctree, docname):
+    """
+    Replace relative iframe src paths with absolute URLs in HTML content.
+    Specifically targets iframe tags with src attributes starting with /graph/.
+    """
+    # Define a flexible regex pattern to match <iframe> tags with src="/graph/..."
+    # This pattern accounts for single or double quotes and any additional attributes
+    pattern = re.compile(
+        r'(<iframe[^>]*src\s*=\s*[\'"])(/graph/[^\'"]+)([\'"][^>]*>)', 
+        re.IGNORECASE | re.DOTALL
+    )
+
+    # Flag to check if any replacement occurred in this document
+    replacement_occurred = False
+
+    # Iterate over all nodes in the doctree
+    for node in doctree.traverse():
+        # Process only nodes that can contain text
+        if isinstance(node, (docutils.nodes.raw, docutils.nodes.literal_block, docutils.nodes.paragraph, docutils.nodes.Text)):
+            # Determine the content based on node type
+            if isinstance(node, docutils.nodes.raw):
+                node_format = getattr(node, 'format', '').lower()
+                if node_format != 'html':
+                    continue  # Skip non-HTML raw nodes
+                original_content = node.rawsource
+                # Perform the regex substitution
+                updated_content, count = pattern.subn(r'\1https://hub.graphistry.com\2\3', original_content)
+                if count > 0:
+                    node.rawsource = updated_content
+                    logger.info(f"Updated {count} iframe src in document: {docname}")
+                    replacement_occurred = True
+            elif isinstance(node, docutils.nodes.literal_block) or isinstance(node, docutils.nodes.paragraph):
+                original_content = node.astext()
+                # Perform the regex substitution
+                updated_content, count = pattern.subn(r'\1https://hub.graphistry.com\2\3', original_content)
+                if count > 0:
+                    # Replace the node's text with updated content
+                    new_nodes = docutils.nodes.inline(text=updated_content)
+                    node.parent.replace(node, new_nodes)
+                    logger.info(f"Updated {count} iframe src in document: {docname}")
+                    replacement_occurred = True
+            elif isinstance(node, docutils.nodes.Text):
+                original_text = node.astext()
+                # Perform the regex substitution
+                updated_text, count = pattern.subn(r'\1https://hub.graphistry.com\2\3', original_text)
+                if count > 0:
+                    # Replace the text node with updated text
+                    new_text_node = docutils.nodes.Text(updated_text)
+                    node.parent.replace(node, new_text_node)
+                    logger.info(f"Updated {count} iframe src in document: {docname}")
+                    replacement_occurred = True
+
+    if not replacement_occurred:
+        logger.debug(f"No iframe src replacements made in document: {docname}")
+
+
+def ignore_svg_images_for_latex(app, doctree, docname):
+    """Remove SVG images from the LaTeX build."""
+    if app.builder.name == 'latex':
+        for node in doctree.traverse(nodes.image):
+            if node['uri'].endswith('.svg'):
+                node.parent.remove(node)
+
+def remove_external_images_for_latex(app, doctree, fromdocname):
+    """Remove external images and handle external links in LaTeX and EPUB builds."""
+    if app.builder.name in ['latex', 'epub']:  # Extend to all builds if needed
+        logger.info(f"Processing doctree for output: {fromdocname}")
+        
+        # Handle problematic external images
+        for node in doctree.traverse(nodes.image):
+            image_uri = node['uri']
+            logger.debug(f"Processing image URI: {image_uri}")
+            if "://" in image_uri:  # Identify external images
+                logger.debug(f"Detected external image URI: {image_uri}")
+                try:
+                    if node.parent:
+                        # Preserve node attributes such as "classes"
+                        parent = node.parent
+                        classes = node.get('classes', [])
+                        logger.debug(f"Preserving classes attribute: {classes}")
+                        parent.remove(node)  # Remove external image node
+                        logger.info(f"Successfully removed external image: {image_uri}")
+                    else:
+                        logger.error(f"No parent found for image: {image_uri}")
+                except Exception as e:
+                    logger.error(f"Failed to remove external image: {image_uri} with error {str(e)}")
+            else:
+                logger.debug(f"Retained local image: {image_uri}")
+        
+        # Handle problematic external links
+        for node in doctree.traverse(nodes.reference):
+            if node.get('refuri', '').startswith('http'):
+                logger.debug(f"Handling external link: {node['refuri']}")
+                if node['refuri'].endswith('.com'):
+                    logger.warning(f"Found problematic URL ending in .com: {node['refuri']}")
+                    # Preserve "classes" attribute and replace link
+                    classes = node.get('classes', [])
+                    logger.debug(f"Preserving classes attribute: {classes}")
+                    inline_node = nodes.inline('', f"{node['refuri']} (external link)", classes=classes)
+                    node.replace_self(inline_node)
+                else:
+                    # Keep non-problematic URLs
+                    inline_node = nodes.inline('', node['refuri'], classes=node.get('classes', []))
+                    node.replace_self(inline_node)
+
+        logger.info("Finished processing images and links.")
+
+def assert_external_images_removed(app, doctree, fromdocname):
+    """Assert that external images have been removed."""
+    if app.builder.name in ['html']:  # Extend to all builds if needed
+        return
+
+    for node in doctree.traverse(nodes.image):
+        image_uri = node['uri']
+        if "://" in image_uri:
+            logger.error(f"Assertion failed: external image was not removed: {image_uri}")
+        assert "://" not in image_uri, f"Failed to remove external image: {image_uri}"
+
+
+
+
+
+# Step 1: Log include directives to ensure paths are correct
+def validate_includes(app, docname, source):
+    includes_not_found = []
+    content = source[0]
+    for line in content.splitlines():
+        if ".. include::" in line:
+            included_file = line.split("include::")[1].strip()
+            abs_path = os.path.join(app.confdir, included_file)
+            if not os.path.isfile(abs_path):
+                includes_not_found.append((included_file, abs_path))
+    if includes_not_found:
+        logger.warning(f"{docname}: Missing includes: {includes_not_found}")
+
+# Step 2: Log conversion of '.md' to '.html' links in documents
+
+
+
+def convert_md_links(app, docname, source):
+    content = source[0]
+    converted_links = []
+    skipped_links = []  # Track links that were skipped or didn't convert correctly
+
+    for word in content.split():
+        if ".md" in word:
+            original_link = word
+            new_link = word.replace(".md", ".html")
+            
+            # Check if the converted file exists
+            abs_path = os.path.abspath(os.path.join(app.confdir, new_link))
+            if not os.path.isfile(abs_path):
+                skipped_links.append((original_link, new_link, abs_path))
+            else:
+                # Convert the link if the target file exists
+                content = content.replace(word, new_link)
+                converted_links.append((original_link, new_link, abs_path))
+    
+    # Apply the modified content back to the source
+    source[0] = content
+
+    # Log both converted and skipped links for debugging
+    if converted_links:
+        logger.info(f"{docname}: Successfully converted .md links to .html: {converted_links}")
+    if skipped_links:
+        logger.warning(f"{docname}: Skipped links (target missing): {skipped_links}")
+
+
+
+def log_missing_references(app, env, docnames=None):
+    if not docnames:
+        docnames = env.found_docs
+
+    unresolved_refs = {}
+    for docname in docnames:
+        doctree = env.get_doctree(docname)
+        # Only traverse 'reference' nodes
+        for ref_node in doctree.traverse(nodes.reference):
+            refuri = ref_node.get("refuri")
+            if refuri and not refuri.startswith(("http:", "https:")):
+                try:
+                    resolved = env.domains["std"].resolve_xref(
+                        env, app.builder, docname, "ref", refuri, ref_node, None
+                    )
+                    if not resolved:
+                        unresolved_refs.setdefault(docname, []).append(refuri)
+                except Exception as e:
+                    logger.warning(f"{docname}: Error resolving {refuri} - {str(e)}")
+    if unresolved_refs:
+        logger.warning(f"Unresolved references: {unresolved_refs}")
+
+
+
+def log_unresolved_references(app, env, docnames=None):
+    if not docnames:
+        docnames = env.found_docs
+
+    unresolved_refs = {}
+    for docname in docnames:
+        doctree = env.get_doctree(docname)
+        for ref_node in doctree.traverse(nodes.reference):
+            refuri = ref_node.get("refuri")
+            if refuri and not refuri.startswith(("http:", "https:")):
+                resolved = env.domains["std"].resolve_xref(env, app.builder, docname, "ref", refuri, ref_node, None)
+                if not resolved:
+                    unresolved_refs.setdefault(docname, []).append(refuri)
+                    print(f"Unresolved reference in {docname}: {refuri}")
+
+    if unresolved_refs:
+        print(f"Unresolved references: {unresolved_refs}")
+
+
+def check_paths(app):
+    readme_path = os.path.join(app.confdir, 'README.md')
+    logger.info(f"Checking README.md path: {readme_path} - Exists: {os.path.isfile(readme_path)}")
+
+def check_readme_path(app):
+    readme_path = os.path.join(app.srcdir, 'README.md')
+    if not os.path.isfile(readme_path):
+        logger.error(f"README.md path not found at: {readme_path}")
+    else:
+        logger.info(f"README.md found at: {readme_path}")
+
+def setup(app: Sphinx):
+    app.connect("builder-inited", check_readme_path)
+    app.connect("builder-inited", check_paths)
+    app.connect("source-read", validate_includes)
+    app.connect("source-read", convert_md_links)
+    app.connect("env-updated", log_missing_references)
+    app.connect("env-updated", log_unresolved_references)
+
+
+    # Configure MyST to handle .md files in Sphinx
+    logger.info("Setup completed with enhanced logging and link validation.")
+
+    app.connect("doctree-resolved", ignore_svg_images_for_latex)
+    app.connect("doctree-resolved", remove_external_images_for_latex)
+    app.connect('doctree-resolved', replace_iframe_src)
+    app.connect("doctree-resolved", assert_external_images_removed)
+    app.add_css_file('graphistry.css', priority=900)
\ No newline at end of file
diff --git a/docs/debug-container-networking.md b/docs/debugging/debug-container-networking.md
similarity index 100%
rename from docs/debug-container-networking.md
rename to docs/debugging/debug-container-networking.md
diff --git a/docs/debug-faq.md b/docs/debugging/debug-faq.md
similarity index 99%
rename from docs/debug-faq.md
rename to docs/debugging/debug-faq.md
index 38b36d2..7782075 100644
--- a/docs/debug-faq.md
+++ b/docs/debugging/debug-faq.md
@@ -40,6 +40,7 @@ Visualization page never returns or Nginx "504 Gateway Time-out" due to services
 * Visualization loads and positions appear, but never starts clustering, and browser console reports a web socket disconnect
 
 ### Correlated symptoms
+
 * `node` processes in `ubuntu_viz_1` container fail to run for more than 30s (check durations through `docker exec -it ubuntu_viz_1 ps "-aux"`)
 * Upon manually starting a worker in `ubuntu_viz_1`, error message having to do with GPUs (Nvidia, OpenCL, drivers, context, ...)
   * `docker exec -it ubuntu_viz_1 bash -c "VIZ_LISTEN_PORT=7000 node /opt/graphistry/apps/core/viz/index.js"`
@@ -66,6 +67,7 @@ CLPlatform.devices('gpu')[0].isNvidiaDevice === true
 ```
 
 ### Solution
+
 * Based on where the issue is according to the above tests, fix that installation layer
 * If problems persist, reimaging the full box or switching to a cloud instance may prevent heartache
 
diff --git a/docs/debug-logs.md b/docs/debugging/debug-logs.md
similarity index 100%
rename from docs/debug-logs.md
rename to docs/debugging/debug-logs.md
diff --git a/docs/debugging/index.rst b/docs/debugging/index.rst
new file mode 100644
index 0000000..c808c37
--- /dev/null
+++ b/docs/debugging/index.rst
@@ -0,0 +1,12 @@
+Debugging & Performance Tuning
+================================
+
+.. toctree::
+   :maxdepth: 1
+
+   debug-container-networking
+   debug-logs
+   performance-tuning
+   debug-faq
+
+  
\ No newline at end of file
diff --git a/docs/performance-tuning.md b/docs/debugging/performance-tuning.md
similarity index 96%
rename from docs/performance-tuning.md
rename to docs/debugging/performance-tuning.md
index 821b5aa..660dfa4 100644
--- a/docs/performance-tuning.md
+++ b/docs/debugging/performance-tuning.md
@@ -1,6 +1,6 @@
 # Performance tuning
 
-See also [deployment planning](deployment-planning.md) and [hw/sw planning](../hardware-software.md).
+See also [deployment planning](../planning/deployment-planning.md) and [hw/sw planning](../planning/hardware-software.md).
 
 ## Monitoring
 
@@ -19,7 +19,7 @@ See also [deployment planning](deployment-planning.md) and [hw/sw planning](../h
 
 ## Hardware provisioning
 
-See also [deployment planning](deployment-planning.md) and [hw/sw planning](hardware-software.md)
+See also [deployment planning](../planning/deployment-planning.md) and [hw/sw planning](../planning/hardware-software.md)
 
 ### System
 
diff --git a/docs/system-metrics-to-csv.sh b/docs/debugging/system-metrics-to-csv.sh
similarity index 100%
rename from docs/system-metrics-to-csv.sh
rename to docs/debugging/system-metrics-to-csv.sh
diff --git a/docs/faq.md b/docs/faq.md
new file mode 100644
index 0000000..e7f4b3d
--- /dev/null
+++ b/docs/faq.md
@@ -0,0 +1,58 @@
+
+# FAQ
+
+* Where are the docs? See this [GitHub repository](https://github.com/graphistry/graphistry-cli) for admin docs and [Graphistry Hub docs](http://hub.graphistry.com/docs) (or http://your_graphistry/docs) for analyst and developer docs
+
+* Where do I get help? Whether community chat, email, tickets, a call, or even a training, [pick the most convienent option](https://www.graphistry.com/support)
+
+* Can Graphistry run in the cloud? Yes - privately both via a [preconfigured AWS/Azure marketplace](https://www.graphistry.com/get-started) and as a self-managed docker binary. Contact our team for upcoming managed Graphistry Hub cloud tiers.
+
+* Can Graphistry run privately? 
+  * On-prem, including air-gapped, as a team backend server or a Linux-based analyst workstation, via docker image
+  * Cloud, via prebuilt marketplace instance
+  * Cloud, via docker image
+  
+* Can Graphistry run in ...
+  * A VM: [Yes, including VMWare vSphere, Nutanix AHV, and anywhere else Nvidia RAPIDS.ai runs](install/on-prem/vGPU.md). Just set `RMM_ALLOCATOR=default` in your `data/config/custom.env` to avoid relying on CUDA Unified Memory, which vGPUs do not support.
+  * Ubuntu / Red Hat / ... : Yes, just ensure the Nvidia Docker runtime is set as the default for docker-compose. We can assist with reference environment bootstrap scripts.
+  * Podman: Maybe! We have confirmed our core containers run on RHEL 8.3 with Podman, Nvidia container runtime, and docker-compose cli. Please contact our staff for the possibility of an alternate podman-compatible tarball. 
+  
+* How do I do license management? 
+  * Graphistry does not require software-managed license registration, we can work with your procurement team on self-reported use
+
+* Do I need a GPU on the client? No, clients do not need a GPU. They do need WebGL enabled, such as Chrome's non-GPU software emulation mode. If some of your users are on extremely limited environments, e.g., worse than a modern phone, or you have extremely powerful GPUs you would like to share, users report great experiences with GPU VDI technologies.
+
+* Do I need a GPU on the server? Yes, the server requires an Nvidia GPU that is Pascal or later (T4, P100, V100, A100, RTX, ...). 
+
+* Can Graphistry use multiple GPUs and multiple servers? 
+  * Graphistry visualizations take advantage of multiple GPUs & CPUs on the same server to handle more users
+  * Graphistry-managed Jupyter notebooks enable users to run custom GPU code, where each user may run multi-GPU tasks (e.g., via dask-cudf and dask-sql)
+  * For high availability configuration and operation, contact staff for additional guidance
+  * For many-node deployment and multi-GPU visualization acceleration, contact staff for roadmap
+
+* Can I run multiple instances of Graphistry? Yes, see the command section for running in an isolated namespace. This is primarily for testing and in-place upgrading. If your goal is for Graphistry to use multiple CPUs and GPUs, it already does so automatically, so you can launch as usual.
+
+* Can I use Graphistry from OS X / Windows? Yes, analysts can use any modern browser on any modern OS such as Chrome on Windows and Firefox on OS X, and even on small devices like Android phones and Apple tablets. The server requires Linux (Ubuntu, RHEL, ...) with a GPU. A self-contained analyst workstation would be Linux based.
+
+* How do I try it out?
+  * Notebook/API users can get a free account on [Graphistry Hub](https://www.graphistry.com/get-started)
+  * Interact with pregenerated live visualizations on the [PyGraphistry gallery](https://github.com/graphistry/pygraphistry)
+  * If you have a private sample CSV/XLS/etc., you can [spin up a private server in your AWS/Azure account](https://www.graphistry.com/get-started) and turn it off when done, and [our team is happy to help](https://www.graphistry.com/support)
+
+* How can I test if my GPU supports Graphistry and my GPU environment is setup properly? Graphistry only requires a [RAPIDS-compatible](https://www.rapids.ai) Docker environment, so you can use the community resources for that. In addition, see [Testing an Install](install/testing-an-install.md).
+
+* The server is slow to start, is it broken?
+  * The server may take 1-3min to start; check the health status of each service with `sudo docker ps`
+  * By default, Graphistry has 4 RAPIDS workers (service `etl-server-python`) that perform just-in-time GPU compilation, meaning the first load on each is slow.
+  * ... System start and the first visualization load per process might be sped up by ensuring Docker is using a native diff driver (see [performance tuning](debugging/performance-tuning.md))
+  * ... Subsequent use of those workers are fast for new datasets (code is already compiled), and subsequent reloads of recent datasets are extra fast (cached)
+
+* Can I add extra security layers? Yes -- see the hardening section for configuring areas like TLS, and contact the team for assistance with more custom/experimental layers like SSO
+
+* Can I run on another port? Yes -- modify `docker-compose.yml`'s service `caddy:`, such as for 80 to instead be 8888:
+```yaml
+    ports:
+      - 8888:80
+    expose:
+      - "8888"
+```
\ No newline at end of file
diff --git a/docs/index.rst b/docs/index.rst
new file mode 100644
index 0000000..9c1f385
--- /dev/null
+++ b/docs/index.rst
@@ -0,0 +1,20 @@
+.. include:: README.md
+   :parser: myst
+
+
+Indices and tables
+==================
+
+.. toctree::
+   :maxdepth: 3
+   :hidden:
+   :caption: Graphistry admin documentation
+
+   admin
+
+.. toctree::
+   :maxdepth: 3
+
+* :ref:`genindex`
+* :ref:`modindex`
+* :ref:`search`
\ No newline at end of file
diff --git a/docs/aws.md b/docs/install/cloud/aws.md
similarity index 79%
rename from docs/aws.md
rename to docs/install/cloud/aws.md
index af52137..f0d1b9c 100644
--- a/docs/aws.md
+++ b/docs/install/cloud/aws.md
@@ -23,7 +23,7 @@ Start with one of the following Linux distributions, and configure it using the
 ## Ubuntu 18.04 LTS
   * Available on official AWS launch homepage
   * Follow provisioning instructions from AWS install
-  * Hardware type: See [cloud hw/sw recommendations](https://github.com/graphistry/graphistry-cli/blob/master/hardware-software.md#cloud)
+  * Hardware type: See [cloud hw/sw recommendations](../../planning/hardware-software.md#cloud)
   * Login: ssh -i ...private_key.pem ubuntu@public.dns
 
 **RHEL, CentOS temporarily not supported by our bootstrapper while conflicting nvidia-docker<>CUDA changes get fixed in the Linux ecosystem**
@@ -31,9 +31,9 @@ Start with one of the following Linux distributions, and configure it using the
 
 # 2. Configure instance
 
-* Instance: See [cloud hw/sw recommendations](https://github.com/graphistry/graphistry-cli/blob/master/hardware-software.md#cloud)
+* Instance: See [cloud hw/sw recommendations](../../planning/hardware-software.md#cloud)
 * Security groups: ssh, http, https
 
 # 3. General installation
 
-Proceed to the instructions for [general installation](https://github.com/graphistry/graphistry-cli) and check [AWS Marketplace](https://github.com/graphistry/graphistry-cli/blob/master/docs/aws_marketplace.md) for common AWS-specific configurations
+Proceed to the instructions for [general installation](https://github.com/graphistry/graphistry-cli) and check [AWS Marketplace](aws_marketplace.md) for common AWS-specific configurations
diff --git a/docs/aws_marketplace.md b/docs/install/cloud/aws_marketplace.md
similarity index 94%
rename from docs/aws_marketplace.md
rename to docs/install/cloud/aws_marketplace.md
index 083d494..3223b7f 100644
--- a/docs/aws_marketplace.md
+++ b/docs/install/cloud/aws_marketplace.md
@@ -21,12 +21,12 @@ Launching Graphistry in AWS Marketplace? [Get started](https://www.graphistry.co
 
 ## Basic administration
 
-* [Security: Enable auto-TLS and restrict network access](configure-security.md)
-* [Create users](user-creation.md)
-* [Generate API keys](../README.md) for individuals without accounts
+* [Security: Enable auto-TLS and restrict network access](../../security/configure-security.md)
+* [Create users](../../tools/user-creation.md)
+* [Generate API keys](../../README.md) for individuals without accounts
 * Turn server on-and-off via AWS Console via **stop** and **start**
-* [Advanced configuration](configure.md)
-* [Update, backup, and migrate](update-backup-migrate.md)
+* [Advanced configuration](../../app-config/configure.md)
+* [Update, backup, and migrate](../../tools/update-backup-migrate.md)
   * To simplify administration and limit downtime, we recommend creating a new Marketplace instance, copying data snapshots to it and loading it in, and switching DNS to the new instance only when tested
 
 ## Common marketpace administration
@@ -48,8 +48,8 @@ Contents:
  
 * Use a regular AWS account as it is safer than [AWS Root account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html)
 * [Associate your AWS instance with an Elastic IP](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html#using-instance-addressing-eips-associating) or a domain 
-* [Setup TLS](configure.md), potentially through an AWS Load Balancer (ALB)
-* In restricted environments, constrain networking to a safelist, e.g., VPN, and optional, [change logging drivers](https://docs.docker.com/config/containers/logging/configure/) to stop Graphistry from recieving maintenace logs. See [recommended port restrictions](configure-security.md)
+* [Setup TLS](../../app-config/configure.md), potentially through an AWS Load Balancer (ALB)
+* In restricted environments, constrain networking to a safelist, e.g., VPN, and optional, [change logging drivers](https://docs.docker.com/config/containers/logging/configure/) to stop Graphistry from recieving maintenace logs. See [recommended port restrictions](../../security/configure-security.md)
   * You can limit instance traffic to VPC-internal, such as not associating a public IP: SSH via a bastion server, and route all public HTTP/HTTPS through an AWS Load Balancer (ALB), including aan AWS Web Application Firewall (WAF)
 * If expecting many uploads, attach a managed disk. Contact Graphistry staff for automation assistance.
 
diff --git a/docs/azure.md b/docs/install/cloud/azure.md
similarity index 100%
rename from docs/azure.md
rename to docs/install/cloud/azure.md
diff --git a/docs/azure_marketplace.md b/docs/install/cloud/azure_marketplace.md
similarity index 95%
rename from docs/azure_marketplace.md
rename to docs/install/cloud/azure_marketplace.md
index 6ae91e3..e39b88b 100644
--- a/docs/azure_marketplace.md
+++ b/docs/install/cloud/azure_marketplace.md
@@ -19,12 +19,12 @@ Please [reach out](https://www.graphistry.com/support) to our team if we can hel
 
 ## Basic administration
 
-* [Security: Enable auto-TLS, restrict network access, and manage your server internals](configure-security.md)
-* [Create users](user-creation.md)
-* [Generate API keys](../README.md) for individuals without accounts
+* [Security: Enable auto-TLS, restrict network access, and manage your server internals](../../security/configure-security.md)
+* [Create users](../../tools/user-creation.md)
+* [Generate API keys](../../README.md) for individuals without accounts
 * Turn server on-and-off in the Azure Console via **stop** and **start**
-* [Advanced configuration](configure.md)
-* [Update, backup, and migrate](update-backup-migrate.md)
+* [Advanced configuration](../../app-config/configure.md)
+* [Update, backup, and migrate](../../tools/update-backup-migrate.md)
   * To simplify administration and limit downtime, we recommend creating a new Marketplace instance, copying data snapshots to it and loading it in, and switching DNS to the new instance only when tested
 
 ## Common marketpace administration
@@ -56,7 +56,7 @@ Contents:
     * You can lock these down further at any time, e.g., only open 22 when using
   * In restricted environments, constrain networking to a a safelist, e.g., VPN, and optional, [change logging drivers](https://docs.docker.com/config/containers/logging/configure/) to stop Graphistry from recieving maintenace logs
 * Assign a static IP or DNS entry to your Graphistry instance 
-* [Setup TLS](configure.md) and [restrict ports](configure-security.md)
+* [Setup TLS](../../app-config/configure.md) and [restrict ports](../../security/configure-security.md)
 
 
 ### 3. Solve GPU availability errors
@@ -80,7 +80,7 @@ Many `ssh` clients may require you to first run `chmod 400 my_key.pem` or `chmod
 
 Graphistry leverages `docker compose` and the Azure image preconfigures the `nvidia` runtime for `docker`.  Note that Graphistry in Azure requires `sudo`.
 
-```
+```bash
 cd /var/graphistry
 docker compose ps
 ```
@@ -121,14 +121,15 @@ By default, Jupyter users do not have `sudo`, restricting them to user-level ins
 
 Note that `sudo` is unnecessary:
 
-```
+```bash
 ubuntu@ip-172-31-0-38:~/graphistry$ docker exec -it -u root graphistry_notebook_1 bash
 root@d4afa8b7ced5:/home/graphistry# apt update 
 root@d4afa8b7ced5:/home/graphistry# apt install golang
 ```
 
 **User:**
-```
+
+```bash
 ubuntu@ip-172-31-0-38:~/graphistry$ docker exec -it  graphistry_notebook_1 bash
 graphistry@d4afa8b7ced5:~$ go version
 ```
diff --git a/docs/azure_marketplace_private_offer.md b/docs/install/cloud/azure_marketplace_private_offer.md
similarity index 94%
rename from docs/azure_marketplace_private_offer.md
rename to docs/install/cloud/azure_marketplace_private_offer.md
index fde459a..8f3a7f0 100644
--- a/docs/azure_marketplace_private_offer.md
+++ b/docs/install/cloud/azure_marketplace_private_offer.md
@@ -4,7 +4,7 @@ Graphistry enterprise users should check if they are eligible for private Azure
 
 Finding the right plan launch location can be tricky, so we provide a walkthrough below.
 
-Upon launch, proceed with regular [Azure Marketplace (public) instructions](https://github.com/graphistry/graphistry-cli/blob/master/docs/azure_marketplace.md). 
+Upon launch, proceed with regular [Azure Marketplace (public) instructions](azure_marketplace.md). 
 
 ## Check the latest official Microsoft istructions
 
@@ -22,49 +22,35 @@ The steps are based on [Microsoft's offical instructions](https://docs.microsoft
 
 ## Visual tutorial: VM Image selection
 
-
----
-
 ### 1. Sign in to [Azure Portal](https://ms.portal.azure.com/) as usual
 
----
 
 ### 2. Create a resource
 
 ![Screen Shot 2021-09-09 at 2 34 43 PM](https://user-images.githubusercontent.com/4249447/132766891-3d556154-be82-4efe-b0da-9ea76408d1d8.png)
 
----
-
 ### 3. See more in Marketplace
 
 ![Screen Shot 2021-09-09 at 2 35 07 PM](https://user-images.githubusercontent.com/4249447/132766933-98def5f7-51da-4427-8fef-ee7129d7558c.png)
 
----
-
 ### 4. Private products
 
 Go to **private products**. Take care to **AVOID** the private marketplace link.
 
 ![Screen Shot 2021-09-09 at 2 35 28 PM](https://user-images.githubusercontent.com/4249447/132768074-21d5718f-a7b1-4da9-91d6-19b0c99c07e0.png)
 
----
-
 ### 5. Graphistry Core : Bring your own license, private
 
 Ensure it is the private / BYOL one
 
 ![Screen Shot 2021-09-09 at 2 36 14 PM](https://user-images.githubusercontent.com/4249447/132768121-8f31d019-e82f-4a70-92ba-76025ce11aa3.png)
 
----
-
 ### 6. Create
 
 Ensure it is the privage one, which will be labeled
 
 ![Screen Shot 2021-09-09 at 2 36 36 PM](https://user-images.githubusercontent.com/4249447/132768188-be77ad85-8144-4c12-baf8-c6b125e160ba.png)
 
----
-
 ##  Launch
 
 The subsequent instructions are the same as regular [public Azure Marketplace configuration](azure_marketplace.md)
diff --git a/docs/install/cloud/index.rst b/docs/install/cloud/index.rst
new file mode 100644
index 0000000..3e5e246
--- /dev/null
+++ b/docs/install/cloud/index.rst
@@ -0,0 +1,24 @@
+Cloud Installation
+========================
+
+.. toctree::
+  :maxdepth: 1
+
+  aws_marketplace
+  aws
+  azure_marketplace
+  azure_marketplace_private_offer
+  azure
+
+
+
+Quick launch: Managed
+------------------------
+
+See guides main guides in the navigation area
+
+[AWS and Azure marketplaces](https://www.graphistry.com/get-started): The fastest way to start using Graphistry is to quick launch a preconfigured private Graphistry instance on [AWS and Azure marketplaces](https://www.graphistry.com/get-started)
+
+It runs in your private cloud provider account and is configured to autostart. See [AWS launch walkthrough tutorial & videos](https://www.graphistry.com/blog/marketplace-tutorial) and linked guides for optional post-launch configuration and maintenance.
+
+Out-of-the-box configurations include GPU drivers, Docker with Nvidia runtime, multi-GPU support, Graphistry installation, auto-start on instance stop/restart, and more
diff --git a/docs/install/on-prem/index.rst b/docs/install/on-prem/index.rst
new file mode 100644
index 0000000..02c830f
--- /dev/null
+++ b/docs/install/on-prem/index.rst
@@ -0,0 +1,55 @@
+On-Prem Installation
+========================
+
+.. toctree::
+  :maxdepth: 1
+
+  manual
+  rhel_7_6_setup
+  ubuntu_18_04_lts_setup
+  vGPU
+
+
+
+Quick launch: Manual
+------------------------
+
+Requirements: [Download Graphistry](https://graphistry.zendesk.com/hc/en-us/articles/360033184174) and [verify docker-compose is setup for Nvidia runtimes](testing-an-install.md#6-quick-testing-and-test-gpu)
+
+**1. Install** if not already available from the folder with `containers.tar.gz`, and likely using `sudo`:
+
+```bash
+docker load -i containers.tar.gz
+```
+
+Note: In previous versions (< `v2.35`), the file was `containers.tar`
+
+
+**2. Launch** from the folder with `docker-compose.yml` if not already up, and likely using `sudo`:
+
+```bash
+docker-compose up -d
+```
+
+Note: Takes 1-3 min, and around 5 min, `docker ps` should report all services as `healthy`
+
+**3. Test:**  Go to 
+
+```
+http://localhost
+```
+
+* Create an account, and then try running a prebuilt Jupyter Notebook from the dashboard!
+  * The first account gets an admin role, upon which account self-registration closes. Admins can then invite users or open self-registration. See [User Creation](user-creation.md) for more information.
+
+* Try a visualization like http://localhost/graph/graph.html?dataset=Facebook&play=5000&splashAfter=false 
+  * **Warning**: First viz load may be slow (1 min) as RAPIDS generates **just-in-time** code for each GPU worker upon first encounter, and/or require a page refresh
+
+---
+
+
+## Manual enterprise install
+
+NOTE: Managed Graphistry instances do not require any of these steps.
+
+The Graphistry environnment depends soley on [Nvidia RAPIDS](https://rapids.ai) and [Nvidia Docker](https://github.com/NVIDIA/nvidia-docker) via `Docker Compose 3`, and ships with all other dependencies built in.
\ No newline at end of file
diff --git a/docs/manual.md b/docs/install/on-prem/manual.md
similarity index 71%
rename from docs/manual.md
rename to docs/install/on-prem/manual.md
index a926c1b..9eee42b 100644
--- a/docs/manual.md
+++ b/docs/install/on-prem/manual.md
@@ -1,12 +1,13 @@
 # Manual Graphistry Installation
 
-We highly recommend getting started with quick launching a preconfigured [AWS Marketplace](aws_marketplace.md) or [Azure Marketplace](azure_marketplace.md) instance. When that is not an option, you may still be able to use a preconfigured GPU environment or automation script from Graphistry. 
+We highly recommend getting started with quick launching a preconfigured [AWS Marketplace](../cloud/aws_marketplace.md) or [Azure Marketplace](../cloud/azure_marketplace.md) instance. When that is not an option, you may still be able to use a preconfigured GPU environment or automation script from Graphistry. 
 
 If none of those situations apply, read on for how to go to an unconfigured Linux instance to running Graphistry.
 
 
 ## Contents
 
+0. Quick Install & Launch
 1. Prerequisites
 2. Instance Provisioning
  * AWS Marketplace & Azure Marketplace
@@ -18,6 +19,16 @@ If none of those situations apply, read on for how to go to an unconfigured Linu
 5. Start!
 
 
+## 0. Quick Install & Launch
+
+If `nvidia` is already your `docker info | grep Default` runtime:
+
+```bash
+wget -O release.tar.gz "https://..."
+tar -xvvf release.tar.gz
+docker load -i containers.tar.gz
+docker compose up -d
+```
 
 ## 1. Prerequisites
 
@@ -25,13 +36,18 @@ If none of those situations apply, read on for how to go to an unconfigured Linu
 * Linux with [Nvidia RAPIDS](https://rapids.ai) and [Nvidia Docker](https://github.com/NVIDIA/nvidia-docker) via `Docker Compose 3`
 * RAPIDS-compatible NVidia GPU: Pascal or later.
 
-For further information, see [Recommended Deployment Configurations: Client, Server Software, Server Hardware](../hardware-software.md).
+For further information, see [Recommended Deployment Configurations: Client, Server Software, Server Hardware](../../planning/hardware-software.md).
+
+### Manual Graphistry container download
+
+Download the latest enterprise distribution from the [enterprise release list](https://graphistry.zendesk.com/hc/en-us/articles/360033184174-Enterprise-Releases) on the support site.  Please contact your Graphistry support staff for access if not available.
+
 
 ## 2. Instance Provisioning
 
 ### AWS & Azure Marketplace
 
-Skip almost all of these steps by instead running through [AWS Marketplace](aws_marketplace.md) and [Azure Marketplace](azure_marketplace.md).
+Skip almost all of these steps by instead running through [AWS Marketplace](../cloud/aws_marketplace.md) and [Azure Marketplace](../cloud/azure_marketplace.md).
 
 ### AWS, Azure, & GCP BYOL
 
@@ -43,7 +59,7 @@ Skip almost all of these steps by instead running through [AWS Marketplace](aws_
 
 ### On-Prem
 
-See [Recommended Deployment Configurations: Client, Server Software, Server Hardware](../hardware-software.md).
+See [Recommended Deployment Configurations: Client, Server Software, Server Hardware](../../planning/hardware-software.md).
 
 ### Airgapped
 
diff --git a/docs/rhel8_prereqs_install.sh b/docs/install/on-prem/rhel8_prereqs_install.sh
similarity index 100%
rename from docs/rhel8_prereqs_install.sh
rename to docs/install/on-prem/rhel8_prereqs_install.sh
diff --git a/docs/rhel_7_6_setup.md b/docs/install/on-prem/rhel_7_6_setup.md
similarity index 100%
rename from docs/rhel_7_6_setup.md
rename to docs/install/on-prem/rhel_7_6_setup.md
diff --git a/docs/ubuntu_18_04_lts_setup.md b/docs/install/on-prem/ubuntu_18_04_lts_setup.md
similarity index 100%
rename from docs/ubuntu_18_04_lts_setup.md
rename to docs/install/on-prem/ubuntu_18_04_lts_setup.md
diff --git a/docs/ubuntu_20_04_setup.sh b/docs/install/on-prem/ubuntu_20_04_setup.sh
similarity index 100%
rename from docs/ubuntu_20_04_setup.sh
rename to docs/install/on-prem/ubuntu_20_04_setup.sh
diff --git a/docs/ubuntu_22_04_setup.sh b/docs/install/on-prem/ubuntu_22_04_setup.sh
similarity index 100%
rename from docs/ubuntu_22_04_setup.sh
rename to docs/install/on-prem/ubuntu_22_04_setup.sh
diff --git a/docs/vGPU.md b/docs/install/on-prem/vGPU.md
similarity index 98%
rename from docs/vGPU.md
rename to docs/install/on-prem/vGPU.md
index 1486178..c544053 100644
--- a/docs/vGPU.md
+++ b/docs/install/on-prem/vGPU.md
@@ -68,7 +68,7 @@ Supporting vGPUs means setting up a Nvidia license manager server, GPU-capable h
 
 There is also a 1 line change for making Graphistry work with vGPUs.
 
-#### Licensing server and license
+### Licensing server and license
 
 Setup an Nvidia licensing server and use it to generate and download a license. It must stay on while using your vGPU as the license gets dynamically checked.
 
@@ -77,11 +77,11 @@ Unlicensed GPUs will appear under `nvidia-smi` and be marked as unlicensed in `n
 If you have a license server but cannot use it to generate a license, you may be able to [receive a time/account-limited evaluation license at nvidia.com]( https://www.nvidia.com/object/nvidia-enterprise-account.html).
 
 
-#### Hyperviser
+### Hyperviser
 
 Install hypervisor GPU drivers from the vGPU software version
 
-#### Guest OS
+### Guest OS
 
 Install guest OS GPU drivers from the vGPU software version
 
@@ -89,7 +89,7 @@ Install guest OS GPU drivers from the vGPU software version
 
 To confirm license activation, check the license status in `nvidia-smi -q` and debug logs (`sudo grep gridd /var/log/messages`)
 
-#### Graphistry
+### Graphistry
 
 Set `RMM_ALLOCATOR=default` in your `data/config/custom.env` to avoid relying on CUDA Unified Memory for handling bigger-than-memory workloads, which Nvidia vGPUs do not currently support.
 
@@ -112,7 +112,7 @@ Helpful links and configurations:
 
 ### Script
 
-In your configured VM, after loading the Graphistry containers, go to your Graphistry release folder and run `./test-gpu.sh`. For more information on what this does, see [quick testing and test-gpu](docs/testing-an-install.md#6-quick-testing-and-test-gpu).
+In your configured VM, after loading the Graphistry containers, go to your Graphistry release folder and run `./test-gpu.sh`. For more information on what this does, see [quick testing and test-gpu](../testing-an-install.md#7-quick-testing-and-test-gpu).
 
 ### Hypevisor
 
diff --git a/docs/testing-an-install.md b/docs/install/testing-an-install.md
similarity index 98%
rename from docs/testing-an-install.md
rename to docs/install/testing-an-install.md
index 2f6f4e1..934439e 100644
--- a/docs/testing-an-install.md
+++ b/docs/install/testing-an-install.md
@@ -1,10 +1,10 @@
-# Manual inspection of all key running components
+# Testing an Install
 
 Takes about 5-10min. See `Quick Testing` below for an expedited variant.
 
 Most of the testing and inspection is standard for Docker-based web apps: `docker` commands, health check URLs, and optional manual smoke tests. GPU testing and debugging involves additional steps.
 
-* To test your base Docker environment for GPU RAPIDS (but not docker-compose), [see the main docs](../README.md#test-your-environment-setup) and the more in-depth GPU testing section below.
+* To test your base Docker environment for GPU RAPIDS, see the in-depth GPU testing section below.
 
 * For logs throughout your session, you can run `docker-compose logs -f -t --tail=1` and `docker-compose logs -f -t --tail=1 SOME_SERVICE_NAME` to see the effects of your activities. Modify `custom.env` to increase `GRAPHISTRY_LOG_LEVEL` and `LOG_LEVEL` to `DEBUG` for increased logging, and `/etc/docker/daemon.json` to use log driver `json-file` for local logs.
 
diff --git a/docs/architecture.md b/docs/planning/architecture.md
similarity index 64%
rename from docs/architecture.md
rename to docs/planning/architecture.md
index 59f9984..f8f5c6d 100644
--- a/docs/architecture.md
+++ b/docs/planning/architecture.md
@@ -1,20 +1,20 @@
-## Graphistry Architecture
+# Graphistry Architecture
 
 See all:
 
-* [Hardware and software](../hardware-software.md)
+* [Hardware and software](hardware-software.md)
 * [Deployment planning](deployment-planning.md)
-* [Threat modeling](threatmodel.md) and [authentication](https://github.com/graphistry/graphistry-cli/blob/master/docs/authentication.md)
+* [Threat modeling](../security/threatmodel.md) and [authentication](../security/authentication.md)
 
 For additional views, please contact staff
 
 
-### Deployment model
+## Deployment model
 
 Client/server model for direct users, embedding users, and admins - [Live diagram](https://drive.google.com/file/d/1h6hOM2gJYrUNpaxtdRXRO8X8ya8iusFr/view?usp=sharing)
 
 Engines and connectors - [chart](https://drive.google.com/file/d/1SDP9nEWC0KNCqcKagbO54mfspa7tX6Yu/view?usp=sharing)
 
-### Server software architecture
+## Server software architecture
 
 [Live diagram](https://drive.google.com/file/d/1KgWwYtA2YsacUPnuryJcJRHBVgvEnH9p/view?usp=sharing)
diff --git a/docs/benchmarking.md b/docs/planning/benchmarking.md
similarity index 92%
rename from docs/benchmarking.md
rename to docs/planning/benchmarking.md
index fec9c85..dc9cb3d 100644
--- a/docs/benchmarking.md
+++ b/docs/planning/benchmarking.md
@@ -11,9 +11,9 @@ Benchmarking helps identify the high-watermarks of system resources like GPU mem
 - **Manage costs:** Right-size footprint for current and upcoming workloads and  negotiate longterm hardware commitments.
 
 Additional details can be found here:
-- [Graphistry Admin Guide - Telemetry](telemetry.md)
+- [Graphistry Admin Guide - Telemetry](../tools/telemetry.md)
 - [Graphistry Admin Guide - Planning a Graphistry Deployment](deployment-planning.md)
-- [Graphistry Admin Guide - Recommended Deployment Configurations: Client, Server Software, Server Hardware](../hardware-software.md)
+- [Graphistry Admin Guide - Recommended Deployment Configurations: Client, Server Software, Server Hardware](hardware-software.md)
 
 ## Intuitions
 
@@ -44,8 +44,8 @@ Choose the different use cases to capture system metrics at scale. Examples incl
 - **Hardware Configuration:** Start with a baseline hardware setup. If possible, using the largest sized servers available will allow for consistent scaling of the workload. It is possible to scale up the size of the server as usage and data volume increases, but this might create skew in the performance tests and take longer.
 - **Software Configuration:** Deploy Graphistry Enterprise with default configurations and adjust configuration settings as needed.
 - **Benchmarking Tools:** Graphistry provides tools to help capture these metrics both as bash scripts as well as OpenTelemetry and associated dashboards. You may also find basic htop (CPU/RAM), iftop (network), and nvidia-smi (GPU) get you far.
-  - Open Telemetry Traces: Utilize telemetry traces to gain deeper insights into system behavior and performance bottlenecks. Graphistry supports [OpenTelemetry](telemetry.md), enabling comprehensive performance monitoring and analysis.
-  - Bash Script: [system-metrics-to-csv.sh](system-metrics-to-csv.sh) is also provided if open telemetry is not enabled to assist with capturing metrics for benchmarking.
+  - Open Telemetry Traces: Utilize telemetry traces to gain deeper insights into system behavior and performance bottlenecks. Graphistry supports [OpenTelemetry](../tools/telemetry.md), enabling comprehensive performance monitoring and analysis.
+  - Bash Script: [system-metrics-to-csv.sh](../debugging/system-metrics-to-csv.sh) is also provided if open telemetry is not enabled to assist with capturing metrics for benchmarking.
    
 ### Step 4: Conduct Benchmark Tests
 
diff --git a/docs/browser.md b/docs/planning/browser.md
similarity index 100%
rename from docs/browser.md
rename to docs/planning/browser.md
diff --git a/docs/deployment-planning.md b/docs/planning/deployment-planning.md
similarity index 96%
rename from docs/deployment-planning.md
rename to docs/planning/deployment-planning.md
index e5ddb21..ecb8e73 100644
--- a/docs/deployment-planning.md
+++ b/docs/planning/deployment-planning.md
@@ -7,9 +7,9 @@ The following documents describe **common Graphistry configurations**, examples
 Related:
 
 * **Capacity planning and host environment configuration**: 
-  <br>See [Recommended Deployment Configurations: Client, Server Software, Server Hardware](../hardware-software.md) 
+  <br>See [Recommended Deployment Configurations: Client, Server Software, Server Hardware](hardware-software.md) 
 * **Graphistry server configuration**:
-  <br>See [main configuration docs](configure.md)
+  <br>See [main configuration docs](../app-config/configure.md)
 
 
 
@@ -50,7 +50,7 @@ Graphistry deployments generally follow one of these patterns:
   * Graphistry will still run as a Docker container in the VM
   * Depending on the hypervisor, you can pick different vGPU sharing modes, and further partition within the VM via Docker settings
   * vGPUs do not currently support CUDA Unified Memory, so you must configure Graphistry setting `RMM_ALLOCATOR=default` in `data/config/custom.env`
-  * See our [more detailed vGPU docs](vGPU.md)
+  * See our [more detailed vGPU docs](../install/on-prem/vGPU.md)
 
 
 ## 2. Picking a Configuration
@@ -84,7 +84,7 @@ Understanding Graphistry's architecture may help you make your deployment archit
 
 * **Graphistry Core: The visualization server**
   - GPU Visualization uploads and live sessions
-  - Docker containers that require nvidia-docker and Nvidial Pascal or later (See [GPU/OS hardware requirements](../hardware-software.md))
+  - Docker containers that require nvidia-docker and Nvidial Pascal or later (See [GPU/OS hardware requirements](hardware-software.md))
   - Supports multi-GPU (single node) and GPU resource isolation
   - Configurable reverse proxy, TLS, and user/API key management
 * **Graphistry Investigation Server (Optional)**
@@ -94,7 +94,7 @@ Understanding Graphistry's architecture may help you make your deployment archit
   - Connectors: Pushdown queries over DB/API connectors
   - Deep linkable: External systems (Splunk, dashboards, emails, ...) can be configured with links into Graphistry views and workflows
 * **Graphistry Data Bridge (Optional)**
-  - Standalone docker-based server (See [Graphistry Data Bridge](bridge.md))
+  - Standalone docker-based server (See [Graphistry Data Bridge](../tools/bridge.md))
   - Enables individual Investigation Server connectors to proxy through a jump server
   - Useful for bridging Graphistry cloud with on-prem data sources when simpler alternatives do not suffice
 * **Graphistry API**
diff --git a/hardware-software.md b/docs/planning/hardware-software.md
similarity index 94%
rename from hardware-software.md
rename to docs/planning/hardware-software.md
index 236b362..7d46029 100644
--- a/hardware-software.md
+++ b/docs/planning/hardware-software.md
@@ -1,21 +1,9 @@
-<!-- Generate PDF via 
-
-1. MacDown
-
-2. Or, 
-
-docker run --rm -it -v $PWD:/source jagregory/pandoc -s hardware-software.md -o hardware-software.pdf
-
--->
-
-
-
 # Recommended Deployment Configurations: Client, Server Software, Server Hardware
 
 
-This document focused on technical requirements. See the [deployment planning article](docs/deployment-planning.md) for broader considerations such as capacity planning.
+This document focused on technical requirements. See the [deployment planning article](deployment-planning.md) for broader considerations such as capacity planning.
 
-The recommended server configuration is [AWS Marketplace](./docs/aws_marketplace.md) and [Azure Marketplace](./docs/azure_marketplace.md) with instance types noted on those screens. The one-click launcher deploys a fully preconfigured instance.
+The recommended server configuration is [AWS Marketplace](../install/cloud/aws_marketplace.md) and [Azure Marketplace](../install/cloud/azure_marketplace.md) with instance types noted on those screens. The one-click launcher deploys a fully preconfigured instance.
 
 Graphistry Enterprise also ships as a Docker container that runs in Linux Nvidia GPU environments that are compatible with [NVIDIA RAPIDS](https://rapids.ai/) and the [Nvidia Docker runtime](https://github.com/NVIDIA/nvidia-docker). It is often   run in the cloud as well.
 
@@ -114,7 +102,7 @@ See [graphistry/graphistry-helm repository](https://github.com/graphistry/graphi
 
 ### Virtualization
 
-Graphistry [works with VMWare, Nutanix, and likely other NGC/RAPIDS-capable virtualization environments](docs/vGPU.md). Please contact our team for further information. The surrounding HW/SW requirements still apply.
+Graphistry [works with VMWare, Nutanix, and likely other NGC/RAPIDS-capable virtualization environments](../install/on-prem/vGPU.md). Please contact our team for further information. The surrounding HW/SW requirements still apply.
 
 * You will need to install the same-version Nvidia driver in both the hypervisor and guest OS, and depending on virtualization approach, managed Nvidia vGPU licensing
 
@@ -245,4 +233,4 @@ Contact support staff for migration information.
 
 ### RAPIDS
 
-Graphistry RAPIDS support can be used for more than investigation visualization and automation. See the deploy planning docs for [how to think about RAPIDS and GPUs as core compute infrastructure](docs/deployment-planning.md#4-planning-for-multi-year-and-rapids-scaleout).
+Graphistry RAPIDS support can be used for more than investigation visualization and automation. See the deploy planning docs for [how to think about RAPIDS and GPUs as core compute infrastructure](deployment-planning.md#4-planning-for-multi-year-and-rapids-scaleout).
diff --git a/docs/planning/index.rst b/docs/planning/index.rst
new file mode 100644
index 0000000..a9b5634
--- /dev/null
+++ b/docs/planning/index.rst
@@ -0,0 +1,12 @@
+Architecture & Planning
+========================
+
+.. toctree::
+  :maxdepth: 1
+
+  architecture
+  browser
+  benchmarking
+  deployment-planning
+  hardware-software
+
diff --git a/docs/SSO.md b/docs/security/SSO.md
similarity index 68%
rename from docs/SSO.md
rename to docs/security/SSO.md
index cb392c1..21f2c54 100644
--- a/docs/SSO.md
+++ b/docs/security/SSO.md
@@ -1,7 +1,7 @@
 # OIDC Server Setup
 
 ## Table of contents
-1. [OKTA SETUP](#okta-setup)
+1. [OKTA SETUP](#OKTA-SETUP)
     1. [OKTA OIDC SETUP](#okta-oidc-setup)
     2. [OKTA PEOPLE SETUP](#okta-people-setup)
     3. [OKTA GROUP SETUP](#okta-group-setup)
@@ -22,64 +22,64 @@
 ### OKTA OIDC SETUP
 
 1. After logging in your OKTA account, if it show this page, click admin button. <br>
-<img src="img/OIDC_setup/oidc_setup_okta_1_1.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_1_1.png">
 
 2. Go to the application page and click “Create App Integration” to create a new application. <br>
-<img src="img/OIDC_setup/oidc_setup_okta_1_2.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_1_2.png">
 
 3. Select “OIDC - OpenID Connect” in the Sign-in method section and “Single-Page Application” at the Application Type section. <br>
-<img src="img/OIDC_setup/oidc_setup_okta_1_3.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_1_3.png">
 
 4. Change the application name as you like and you can upload a logo for this application. <br>
-<img src="img/OIDC_setup/oidc_setup_okta_1_4.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_1_4.png">
 
 5. <a name="okta_1_1_5"></a> Change the sign-in redirect url in the following format. Change the field in bracket to relative field. For example, this is one of the urls used in development `http://localhost:8000/o/{organization_id}/sso/oidc/{idp_name}/login/callback`
 If you are using an enterprise plan, this is the callback url for it. `http://localhost:8000/g/sso/oidc/{idp_name}/login/callback` <br>
-<img src="img/OIDC_setup/oidc_setup_okta_1_5.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_1_5.png">
 
 6. Choose “Skip group assignment for now” and save the changes. We will assign the user/group later. <br>
-<img src="img/OIDC_setup/oidc_setup_okta_1_6.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_1_6.png">
 
 7. Record the field named “Client ID”, and “Okta domain”. Using these fields allows you to register an Organization SSO ID Provider in Graphistry.  <a name="okta_1_1_7"></a> <br>
-<img src="img/OIDC_setup/oidc_setup_okta_1_7.png">
-<img src="img/OIDC_setup/oidc_setup_okta_1_8.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_1_7.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_1_8.png">
 
 8. Assign persons to application. <br>
-<img src="img/OIDC_setup/oidc_setup_okta_1_9.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_1_9.png">
 
 9. Click “Assign” on the line of the person you want to assign the application. <br>
-<img src="img/OIDC_setup/oidc_setup_okta_1_10.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_1_10.png">
 
 10. Click “Assign” on the line of the group you want to assign the application. If assigned by group, all people in the group can login to this application. <br>
-<img src="img/OIDC_setup/oidc_setup_okta_1_11.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_1_11.png">
 
 
 ### OKTA PEOPLE SETUP
 
 1. Add a new person. <br>
-<img src="img/OIDC_setup/oidc_setup_okta_2_1.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_2_1.png">
 
 2. Fill in the relative field. If the Activation is set to "Activate later", users will receive an email to set their password and activate the account. <br>
-<img src="img/OIDC_setup/oidc_setup_okta_2_2.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_2_2.png">
 
 3. If the Activation is set to "Activate now", it will show some options for setting the password. If the "I will set password" option is ticked, you can enter a temporary password and specify if the user changes their password after initial login. <br>
-<img src="img/OIDC_setup/oidc_setup_okta_2_3.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_2_3.png">
 
 
 ### OKTA GROUP SETUP
 
 1. Create a new Group. <br>
-<img src="img/OIDC_setup/oidc_setup_okta_3_1.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_3_1.png">
 
 2. Give a name to the group. Optionally, you can add a description. <br>
-<img src="img/OIDC_setup/oidc_setup_okta_3_2.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_3_2.png">
 
 3. Click the group name you create to manage the group. <br>
-<img src="img/OIDC_setup/oidc_setup_okta_3_3.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_3_3.png">
 
 4. Click "Assign people" to add a person to the group. You can also remove user from group by clicking "remove". <br>
-<img src="img/OIDC_setup/oidc_setup_okta_3_4.png">
-<img src="img/OIDC_setup/oidc_setup_okta_3_5.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_3_4.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_okta_3_5.png">
 
 
 <hr>
@@ -89,66 +89,66 @@ If you are using an enterprise plan, this is the callback url for it. `http://lo
 ### AUTH0 OIDC SETUP
 
 1. After signing an account for Auth0, select “Company” as the account type so you can restrict who can log in to this organization. Fill in the company's name and select size for company. <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_1_1.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_1_1.png">
 
 2. You can change the domain name and country. Changing the country will change the host url. <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_1_2.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_1_2.png">
 
 3. Click the “Application” in the Application section to go to the application page. Under the application panel, click “Create Application” to create a new application. <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_1_3.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_1_3.png">
 
 4. Name your application and select “Single Page Web Applications”. <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_1_4.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_1_4.png">
 
 5. Go to “Settings” to get “Domain”, “Client ID” and “Client Secret”.  We have to use these fields to register an Organization SSO ID Provider in Graphistry. <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_1_5.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_1_5.png">
 
 6. Change the sign-in redirect url in the following format. Change the field in bracket to relative field. For example, this is one of the urls used in development `http://localhost:8000/o/admin/sso/oidc/test_admin/login/callback/` 
 If you are using an enterprise plan, this is the callback url for it. `http://localhost:8000/g/sso/oidc/Site_wide_SSO_Provider/login/callback/` <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_1_6.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_1_6.png">
 
 7. Save changes after completing add callback urls. <br>
 
 8. Disable grants to use organization function. <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_1_7.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_1_7.png">
 
 9. Change the Organization setting to “Team members of organizations” and click “Save Changes“. <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_1_8.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_1_8.png">
 
 
 ### AUTH0 USER SETUP
 
 1. Go to ”User Management” and select the user to go to the user page. Click “Create User” to create a new user. <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_2_1.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_2_1.png">
 
 2. Fill in all of the fields and click “Create” to create a new user. <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_2_2.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_2_2.png">
 
 ### AUTH0 ORGANIZATION
 
 1. Go to “Organizations” and click “Create Organization” to create a new organization. <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_3_1.png">	
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_3_1.png">	
 
 2. Name your organization and set your displayed name. <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_3_2.png">	
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_3_2.png">	
 
 3. Record your “Organization ID” which you'll need when you create your org sso id provider. <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_3_3.png">	
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_3_3.png">	
 
 4. You can change these fields to adjust the UI of the login page. Make sure to save your changes. <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_3_4.png">	
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_3_4.png">	
 
 5. Go to the “Member” session and click “Add Members” to add members to your organization. <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_3_5.png">	
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_3_5.png">	
 
 6. After selecting the user you want to add, click “Add Member” to add them to the organization. <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_3_6.png">	
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_3_6.png">	
 
 7. Go to "Connections" session and click "Enable Connections" to add connections to organization. <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_3_7.png">	
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_3_7.png">	
 
 8. Select "Username-Password-Authentication" and click "Enable Connection". <br>
-<img src="img/OIDC_setup/oidc_setup_auth0_3_8.png">	
+<img src="../_static/img/OIDC_setup/oidc_setup_auth0_3_8.png">	
 
 
 <hr>
@@ -158,35 +158,35 @@ If you are using an enterprise plan, this is the callback url for it. `http://lo
 ### KEYCLOAK OIDC SERVER SETUP
 
 1. Login to the keycloak admin console. Default username is “admin” and passwords is “graphistry”. <br>
-<img src="img/OIDC_setup/oidc_setup_keycloak_1_1.png">	
+<img src="../_static/img/OIDC_setup/oidc_setup_keycloak_1_1.png">	
 
 2. Create a new realm for OIDC server. Move your mouse cursor to “Master” and the “add realm” button will show up. <br>
-<img src="img/OIDC_setup/oidc_setup_keycloak_1_2.png">	
+<img src="../_static/img/OIDC_setup/oidc_setup_keycloak_1_2.png">	
 
 3. Add a name to this realm. We will take this realm name as idp name when you create an OrgSSO object. <br>
-<img src="img/OIDC_setup/oidc_setup_keycloak_1_3.png">	
+<img src="../_static/img/OIDC_setup/oidc_setup_keycloak_1_3.png">	
 
 4. After realm creation success, go to the “clients” section and click “create” to create a new client for OIDC. <br>
-<img src="img/OIDC_setup/oidc_setup_keycloak_1_4.png">	
+<img src="../_static/img/OIDC_setup/oidc_setup_keycloak_1_4.png">	
 
 5. Fill in “client id” for and this client id is the Client ID you have to use when create OrgSSO object. <br>
-<img src="img/OIDC_setup/oidc_setup_keycloak_1_5.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_keycloak_1_5.png">
 
 6. Change the “Access type” from public to confidential. Add valid Redirect URls to it. For example, `http://localhost/*` , the * means it will take anything after the host. <br>
-<img src="img/OIDC_setup/oidc_setup_keycloak_1_6.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_keycloak_1_6.png">
 
 7. Go to “Credentials” to get the secret key. <br>
-<img src="img/OIDC_setup/oidc_setup_keycloak_1_7.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_keycloak_1_7.png">
 
 ### KEYCLOAK USER SETUP
 1. Go to the “User” section and click “add user”. <br>
-<img src="img/OIDC_setup/oidc_setup_keycloak_2_1.png">	
+<img src="../_static/img/OIDC_setup/oidc_setup_keycloak_2_1.png">	
 
 2. Fill in the info when you create a user. Only username attribute is required. For the “Required User Actions” attribute, you can choose the action for the user to verify their email or update password for the first time they login. <br>
-<img src="img/OIDC_setup/oidc_setup_keycloak_2_2.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_keycloak_2_2.png">
 
 3. Go to the “Credentials” section, create a password for this user so they can log in to this server. If you toggle on the “Temporary”, users have to update the password for the first time they login. <br>
-<img src="img/OIDC_setup/oidc_setup_keycloak_2_3.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_keycloak_2_3.png">
 
 
 <hr>
@@ -196,26 +196,26 @@ If you are using an enterprise plan, this is the callback url for it. `http://lo
 ### ORGANIZATION CONFIGURE SSO
 
 1. After login to your graphistry account, click the "Manage organization" button. <br>
-<img src="img/OIDC_setup/oidc_setup_graphistry_1_1.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_graphistry_1_1.png">
 
 2. Click the "+" button to add a new organization. <br>
-<img src="img/OIDC_setup/oidc_setup_graphistry_1_2.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_graphistry_1_2.png">
 
 3. Fill the information for the organization and click the create button, the "Organization ID" is unique. <br>
-<img src="img/OIDC_setup/oidc_setup_graphistry_1_3.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_graphistry_1_3.png">
 
 4. Click the orange button, which is "configure SSO" button. <br>
-<img src="img/OIDC_setup/oidc_setup_graphistry_1_4.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_graphistry_1_4.png">
 
 5. Click the "+" button to add new SSO providers. <br>
-<img src="img/OIDC_setup/oidc_setup_graphistry_1_5.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_graphistry_1_5.png">
 
 6. Fill the IDP Name, Host URL, Client ID and select the SSO provider. <br>
-<img src="img/OIDC_setup/oidc_setup_graphistry_1_6.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_graphistry_1_6.png">
 
 7. Example for Okta, "Client ID" and "Host URL" can found in [“Client ID”, and “Okta domain”](#okta_1_1_7) respectively. <br>
-<img src="img/OIDC_setup/oidc_setup_graphistry_1_7.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_graphistry_1_7.png">
 
 8. The SSO Provider for the organization was shown. Remember to setup the Sign-in redirect URIs in [picture](#okta_1_1_5), fill it with 
 `http://{hostname}/o/{organization_id}/sso/oidc/{idp_name}/login/callback`. <br>
-<img src="img/OIDC_setup/oidc_setup_graphistry_1_8.png">
+<img src="../_static/img/OIDC_setup/oidc_setup_graphistry_1_8.png">
diff --git a/docs/authentication.md b/docs/security/authentication.md
similarity index 82%
rename from docs/authentication.md
rename to docs/security/authentication.md
index 19a6328..4dcc7ee 100644
--- a/docs/authentication.md
+++ b/docs/security/authentication.md
@@ -4,7 +4,7 @@ This document covers Graphistry's authentication system with respect to architec
 
 It also touches on coarse authorization decisions where relevant. However, authorization is generally beyond the scope of this document.
 
-See also [security hardening](configure-security.md), [general configuration](configure.md), [manual user account creation](user-creation.md), and [threat model](threatmodel.md).
+See also [security hardening](configure-security.md), [general configuration](../app-config/configure.md), [manual user account creation](../tools/user-creation.md), and [threat model](threatmodel.md).
 
 ## Architecture
 
@@ -16,7 +16,7 @@ Graphistry authentication uses standard web software layers:
 * Reverse proxy: Caddy (`caddy`)
   * Web and API calls are initially reverse-proxied through reverse proxy Docker service `caddy`
   * The Caddyfile and docker-compose.yml configurations (Docker virtual network definition) are the primary places for customizing networking
-  * TLS: System administrators should [configure automatic and manual TLS as a custom Caddyfile](configure.md#tls)
+  * TLS: System administrators should [configure automatic and manual TLS as a custom Caddyfile](../app-config/configure.md#tls)
 
 * Bastion: Nginx (`nginx`)
   * Caddy sends user HTTP requests to the Graphistry-configured reverse proxy Docker service `nginx`
@@ -51,16 +51,16 @@ Graphistry authentication uses standard web software layers:
 
  * Browser security headers
    * Unconfigured servers do nto have TLS
-   * [Add a TLS certificate](configure.md#tls) enables TLS
-   * Further consider adding [additional security headers](configure.md#caddy)
+   * [Add a TLS certificate](../app-config/configure.md#tls) enables TLS
+   * Further consider adding [additional security headers](../app-config/configure.md#caddy)
    * Cross-origin embedding for unauthenticated visualizations is enabled by default
-   * To enable cross-origin embedding of authenticated visualizations, [modify the cookie options](configure.md#application-servers)
+   * To enable cross-origin embedding of authenticated visualizations, [modify the cookie options](../app-config/configure.md#application-servers)
     
 ## Usage
 
 * The first user to create an account will be given an administrator role. This may vary, such as AWS Marketplace does have an initial account: `admin` / `i-theInstanceID`. 
 
-* Subsequent user registration follows a configurable policy ([see user creation](user-creation.md))
+* Subsequent user registration follows a configurable policy ([see user creation](../tools/user-creation.md))
     * By default, only the administrator can invite subsequent users
     * The administrator may want to open account creation or manually elevate the role of different users
     * Organization administrators may control whether their organization is open for joining at all, including whether SSO users can self-join or require an explicit invitation
@@ -72,10 +72,10 @@ Graphistry authentication uses standard web software layers:
   
 The most typical authentication configurations are:
 
-1. Set TLS via `Caddyfile`, with optional manual TLS credential volume mount in the `docker-compose.yml`. See TLS [docs](configure.md#tls-caddyfile).
+1. Set TLS via `Caddyfile`, with optional manual TLS credential volume mount in the `docker-compose.yml`. See TLS [docs](../app-config/configure.md#tls-caddyfile).
 
-2. Open/close account registration and invite users. See [user creation docs](user-creation.md). Contact staff for more advanced options, such as social logins and LDAP/SAML.
+2. Open/close account registration and invite users. See [user creation docs](../tools/user-creation.md). Contact staff for more advanced options, such as social logins and LDAP/SAML.
 
-3. Enable cross-origin embedding of authenticated visualizations by [editing cookie settings](configure.md#application-servers) (requires TLS)
+3. Enable cross-origin embedding of authenticated visualizations by [editing cookie settings](../app-config/configure.md#application-servers) (requires TLS)
 
 4. Enable SSO
diff --git a/docs/configure-security.md b/docs/security/configure-security.md
similarity index 91%
rename from docs/configure-security.md
rename to docs/security/configure-security.md
index 772f20f..fc0b6fa 100644
--- a/docs/configure-security.md
+++ b/docs/security/configure-security.md
@@ -15,11 +15,11 @@ Read on for:
 
 For futher information, see:
 
-* [Overall system configuration](configure.md)
+* [Overall system configuration](../app-config/configure.md)
 * [Security threat model](threatmodel.md)
 * [Authentication](authentication.md)
-* [Deployment planning](deployment-planning.md)
-* [Capacity planning](../hardware-software.md)
+* [Deployment planning](../planning/deployment-planning.md)
+* [Capacity planning](../planning/hardware-software.md)
 
 
 ## Out-of-the-box config
@@ -68,7 +68,7 @@ Upon changing, restart the web server with the fresh environment: `docker-compos
 
 We **highly** encourage using TLS and make it easy:
 
-* [Configure the Caddyfile](configure.md#tls) for auto-TLS with one line (recommended), add your own TLS certificate, or offload TLS
+* [Configure the Caddyfile](../app-config/configure.md#tls) for auto-TLS with one line (recommended), add your own TLS certificate, or offload TLS
 * TLS is required for JWT auth to be secured against MitM attacks
 * Beyond enabling TLS, check other common server settings around it in the authentication configuration docs
 
@@ -79,7 +79,7 @@ After, there are additional [Caddyfile http/https header settings](https://githu
 Enabling **cross-origin authenticated use** is often desirable:
 
 * Cross-origin embedding for unauthenticated visualizations is enabled by default
-* Cross-origin embedding for authenticated visualizations is disabled by default, enable as part of [TLS configuration](configure.md#tls)
+* Cross-origin embedding for authenticated visualizations is disabled by default, enable as part of [TLS configuration](../app-config/configure.md#tls)
 
 ### Firewalls & SSH
 
@@ -125,21 +125,21 @@ After, restart nexus with a fresh environment: `docker compose up -d --force-rec
 These are best to setup on a fresh installation with an empty database: `docker compose down -v && docker compose up -d`.
 
 
-# Connector configuration
+## Connector configuration
 
 Connectors are used by the (currently) admin-level investigator tool. Security configuration is generally relevant for enabling it to work with outside systems, and to restrict what users can do.
 
-[See the main connector docs](configure.md) for more information.
+[See the main connector docs](../app-config/configure.md) for more information.
 
 ### Connector firewall settings
 * If Graphistry is connecting to a database or API such as Splunk or Neo4j, ensure that system allows incoming/outgoing connections from Graphistry
-* Some systems have hard-to-work-with firewalls and may benefit from using a [Graphistry data bridge](bridge.md) to limit database communications to outbound-only HTTP/HTTPS.
+* Some systems have hard-to-work-with firewalls and may benefit from using a [Graphistry data bridge](../tools/bridge.md) to limit database communications to outbound-only HTTP/HTTPS.
 
 ### Restricting connectors
 
 Check if your database or API supports restricted roles. For example, when Graphistry is connected to Splunk, you may want to create a Splunk API user that only has read access to a few indexes, and configure Graphistry to use that account.
 
-# Safely using Graphistry APIs
+## Safely using Graphistry APIs
 
 
 * Safe defaults
@@ -153,7 +153,7 @@ Check if your database or API supports restricted roles. For example, when Graph
   * Prefer server<>server APIs for data uploads
   * Prefer client<>client APIs for user interactions
 
-# Air gapping
+## Air gapping
 
 Some environments require operation without access to the public internet
 
@@ -166,7 +166,7 @@ Some environments require operation without access to the public internet
   * Method 2: User -> Admin portal -> Settings -> Config -> Check IS_AIR_GAPPED and save
 
 
-# Sensitive data
+## Sensitive data
 
 As a Docker-based Linux system, most custom data is stored in Docker volumes. The remaining data, such as server accounts, are in standard Linux locations.
 
diff --git a/docs/configure-tls-caddy-manual-lets-encrypt-handshake.md b/docs/security/configure-tls-caddy-manual-lets-encrypt-handshake.md
similarity index 100%
rename from docs/configure-tls-caddy-manual-lets-encrypt-handshake.md
rename to docs/security/configure-tls-caddy-manual-lets-encrypt-handshake.md
diff --git a/docs/security/index.rst b/docs/security/index.rst
new file mode 100644
index 0000000..50a7d68
--- /dev/null
+++ b/docs/security/index.rst
@@ -0,0 +1,11 @@
+Security
+========================
+
+.. toctree::
+  :maxdepth: 1
+
+  authentication
+  configure-security
+  configure-tls-caddy-manual-lets-encrypt-handshake
+  SSO
+  threatmodel
diff --git a/docs/threatmodel.md b/docs/security/threatmodel.md
similarity index 98%
rename from docs/threatmodel.md
rename to docs/security/threatmodel.md
index d6e883f..a0b8142 100644
--- a/docs/threatmodel.md
+++ b/docs/security/threatmodel.md
@@ -23,7 +23,7 @@ The threat model excludes:
 
 The 2.0 release (2019) expands from single-admin & untrusted web users to account-based:
 
-#### 1.0 (< 2019): Publishers and Viewers
+### 1.0 (< 2019): Publishers and Viewers
 Aimed at both dedicated developer embedding scenarios and small trusted team settings where a trusted group of publishers (admins) analyzes data and publishes results to general network users.
 
 * Admins:
@@ -32,7 +32,7 @@ Aimed at both dedicated developer embedding scenarios and small trusted team set
 * Viewers (web users):
   * Visualizations: read, copy-on-write
 
-#### 2.0 (>= 2019): Admins, Users, and Viewers
+### 2.0 (>= 2019): Admins, Users, and Viewers
 The 2.0 release expands authentication and authorization options for common shared enterprise analyst tool settings:
 
 * OS System admin: Full access
diff --git a/docs/static/favicon.ico b/docs/static/favicon.ico
new file mode 100644
index 0000000..a8d22f5
Binary files /dev/null and b/docs/static/favicon.ico differ
diff --git a/docs/static/graphistry.css b/docs/static/graphistry.css
new file mode 100644
index 0000000..79671e6
--- /dev/null
+++ b/docs/static/graphistry.css
@@ -0,0 +1,26 @@
+html[data-theme="light"] {
+  --pst-color-primary: #1f8e9f;
+  --pst-color-secondary: #25ba8d;
+}
+
+html[data-theme="dark"] {
+  --pst-color-primary: #32a8bb;
+  --pst-color-secondary: #48daae;
+}
+
+
+html[data-theme="dark"] .highlight .c1 {
+  color: #32a8bb !important;
+}
+
+html[data-theme="dark"] .highlight .s1,
+html[data-theme="dark"] .highlight .s2,
+html[data-theme="dark"] .highlight .o,
+html[data-theme="dark"] .highlight .sa {
+  color: #38e3b9 !important;
+}
+
+html[data-theme="dark"] .highlight .mi,
+html[data-theme="dark"] .highlight .nb {
+  color: #ff9f54 !important;
+}
\ No newline at end of file
diff --git a/docs/static/graphistry_banner_transparent_colored.png b/docs/static/graphistry_banner_transparent_colored.png
new file mode 100644
index 0000000..d5db6ce
Binary files /dev/null and b/docs/static/graphistry_banner_transparent_colored.png differ
diff --git a/docs/img/Louie/Databricks_SSO_App_Connection.png b/docs/static/img/Louie/Databricks_SSO_App_Connection.png
similarity index 100%
rename from docs/img/Louie/Databricks_SSO_App_Connection.png
rename to docs/static/img/Louie/Databricks_SSO_App_Connection.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_1_1.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_1_1.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_1_1.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_1_1.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_1_2.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_1_2.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_1_2.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_1_2.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_1_3.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_1_3.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_1_3.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_1_3.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_1_4.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_1_4.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_1_4.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_1_4.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_1_5.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_1_5.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_1_5.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_1_5.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_1_6.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_1_6.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_1_6.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_1_6.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_1_7.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_1_7.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_1_7.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_1_7.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_1_8.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_1_8.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_1_8.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_1_8.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_2_1.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_2_1.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_2_1.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_2_1.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_2_2.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_2_2.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_2_2.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_2_2.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_3_1.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_3_1.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_3_1.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_3_1.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_3_2.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_3_2.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_3_2.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_3_2.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_3_3.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_3_3.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_3_3.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_3_3.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_3_4.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_3_4.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_3_4.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_3_4.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_3_5.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_3_5.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_3_5.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_3_5.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_3_6.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_3_6.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_3_6.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_3_6.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_3_7.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_3_7.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_3_7.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_3_7.png
diff --git a/docs/img/OIDC_setup/oidc_setup_auth0_3_8.png b/docs/static/img/OIDC_setup/oidc_setup_auth0_3_8.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_auth0_3_8.png
rename to docs/static/img/OIDC_setup/oidc_setup_auth0_3_8.png
diff --git a/docs/img/OIDC_setup/oidc_setup_graphistry_1_1.png b/docs/static/img/OIDC_setup/oidc_setup_graphistry_1_1.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_graphistry_1_1.png
rename to docs/static/img/OIDC_setup/oidc_setup_graphistry_1_1.png
diff --git a/docs/img/OIDC_setup/oidc_setup_graphistry_1_2.png b/docs/static/img/OIDC_setup/oidc_setup_graphistry_1_2.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_graphistry_1_2.png
rename to docs/static/img/OIDC_setup/oidc_setup_graphistry_1_2.png
diff --git a/docs/img/OIDC_setup/oidc_setup_graphistry_1_3.png b/docs/static/img/OIDC_setup/oidc_setup_graphistry_1_3.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_graphistry_1_3.png
rename to docs/static/img/OIDC_setup/oidc_setup_graphistry_1_3.png
diff --git a/docs/img/OIDC_setup/oidc_setup_graphistry_1_4.png b/docs/static/img/OIDC_setup/oidc_setup_graphistry_1_4.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_graphistry_1_4.png
rename to docs/static/img/OIDC_setup/oidc_setup_graphistry_1_4.png
diff --git a/docs/img/OIDC_setup/oidc_setup_graphistry_1_5.png b/docs/static/img/OIDC_setup/oidc_setup_graphistry_1_5.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_graphistry_1_5.png
rename to docs/static/img/OIDC_setup/oidc_setup_graphistry_1_5.png
diff --git a/docs/img/OIDC_setup/oidc_setup_graphistry_1_6.png b/docs/static/img/OIDC_setup/oidc_setup_graphistry_1_6.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_graphistry_1_6.png
rename to docs/static/img/OIDC_setup/oidc_setup_graphistry_1_6.png
diff --git a/docs/img/OIDC_setup/oidc_setup_graphistry_1_7.png b/docs/static/img/OIDC_setup/oidc_setup_graphistry_1_7.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_graphistry_1_7.png
rename to docs/static/img/OIDC_setup/oidc_setup_graphistry_1_7.png
diff --git a/docs/img/OIDC_setup/oidc_setup_graphistry_1_8.png b/docs/static/img/OIDC_setup/oidc_setup_graphistry_1_8.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_graphistry_1_8.png
rename to docs/static/img/OIDC_setup/oidc_setup_graphistry_1_8.png
diff --git a/docs/img/OIDC_setup/oidc_setup_keycloak_1_1.png b/docs/static/img/OIDC_setup/oidc_setup_keycloak_1_1.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_keycloak_1_1.png
rename to docs/static/img/OIDC_setup/oidc_setup_keycloak_1_1.png
diff --git a/docs/img/OIDC_setup/oidc_setup_keycloak_1_2.png b/docs/static/img/OIDC_setup/oidc_setup_keycloak_1_2.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_keycloak_1_2.png
rename to docs/static/img/OIDC_setup/oidc_setup_keycloak_1_2.png
diff --git a/docs/img/OIDC_setup/oidc_setup_keycloak_1_3.png b/docs/static/img/OIDC_setup/oidc_setup_keycloak_1_3.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_keycloak_1_3.png
rename to docs/static/img/OIDC_setup/oidc_setup_keycloak_1_3.png
diff --git a/docs/img/OIDC_setup/oidc_setup_keycloak_1_4.png b/docs/static/img/OIDC_setup/oidc_setup_keycloak_1_4.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_keycloak_1_4.png
rename to docs/static/img/OIDC_setup/oidc_setup_keycloak_1_4.png
diff --git a/docs/img/OIDC_setup/oidc_setup_keycloak_1_5.png b/docs/static/img/OIDC_setup/oidc_setup_keycloak_1_5.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_keycloak_1_5.png
rename to docs/static/img/OIDC_setup/oidc_setup_keycloak_1_5.png
diff --git a/docs/img/OIDC_setup/oidc_setup_keycloak_1_6.png b/docs/static/img/OIDC_setup/oidc_setup_keycloak_1_6.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_keycloak_1_6.png
rename to docs/static/img/OIDC_setup/oidc_setup_keycloak_1_6.png
diff --git a/docs/img/OIDC_setup/oidc_setup_keycloak_1_7.png b/docs/static/img/OIDC_setup/oidc_setup_keycloak_1_7.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_keycloak_1_7.png
rename to docs/static/img/OIDC_setup/oidc_setup_keycloak_1_7.png
diff --git a/docs/img/OIDC_setup/oidc_setup_keycloak_2_1.png b/docs/static/img/OIDC_setup/oidc_setup_keycloak_2_1.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_keycloak_2_1.png
rename to docs/static/img/OIDC_setup/oidc_setup_keycloak_2_1.png
diff --git a/docs/img/OIDC_setup/oidc_setup_keycloak_2_2.png b/docs/static/img/OIDC_setup/oidc_setup_keycloak_2_2.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_keycloak_2_2.png
rename to docs/static/img/OIDC_setup/oidc_setup_keycloak_2_2.png
diff --git a/docs/img/OIDC_setup/oidc_setup_keycloak_2_3.png b/docs/static/img/OIDC_setup/oidc_setup_keycloak_2_3.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_keycloak_2_3.png
rename to docs/static/img/OIDC_setup/oidc_setup_keycloak_2_3.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_1_1.png b/docs/static/img/OIDC_setup/oidc_setup_okta_1_1.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_1_1.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_1_1.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_1_10.png b/docs/static/img/OIDC_setup/oidc_setup_okta_1_10.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_1_10.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_1_10.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_1_11.png b/docs/static/img/OIDC_setup/oidc_setup_okta_1_11.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_1_11.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_1_11.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_1_2.png b/docs/static/img/OIDC_setup/oidc_setup_okta_1_2.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_1_2.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_1_2.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_1_3.png b/docs/static/img/OIDC_setup/oidc_setup_okta_1_3.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_1_3.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_1_3.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_1_4.png b/docs/static/img/OIDC_setup/oidc_setup_okta_1_4.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_1_4.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_1_4.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_1_5.png b/docs/static/img/OIDC_setup/oidc_setup_okta_1_5.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_1_5.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_1_5.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_1_6.png b/docs/static/img/OIDC_setup/oidc_setup_okta_1_6.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_1_6.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_1_6.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_1_7.png b/docs/static/img/OIDC_setup/oidc_setup_okta_1_7.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_1_7.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_1_7.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_1_8.png b/docs/static/img/OIDC_setup/oidc_setup_okta_1_8.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_1_8.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_1_8.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_1_9.png b/docs/static/img/OIDC_setup/oidc_setup_okta_1_9.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_1_9.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_1_9.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_2_1.png b/docs/static/img/OIDC_setup/oidc_setup_okta_2_1.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_2_1.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_2_1.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_2_2.png b/docs/static/img/OIDC_setup/oidc_setup_okta_2_2.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_2_2.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_2_2.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_2_3.png b/docs/static/img/OIDC_setup/oidc_setup_okta_2_3.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_2_3.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_2_3.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_3_1.png b/docs/static/img/OIDC_setup/oidc_setup_okta_3_1.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_3_1.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_3_1.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_3_2.png b/docs/static/img/OIDC_setup/oidc_setup_okta_3_2.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_3_2.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_3_2.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_3_3.png b/docs/static/img/OIDC_setup/oidc_setup_okta_3_3.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_3_3.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_3_3.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_3_4.png b/docs/static/img/OIDC_setup/oidc_setup_okta_3_4.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_3_4.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_3_4.png
diff --git a/docs/img/OIDC_setup/oidc_setup_okta_3_5.png b/docs/static/img/OIDC_setup/oidc_setup_okta_3_5.png
similarity index 100%
rename from docs/img/OIDC_setup/oidc_setup_okta_3_5.png
rename to docs/static/img/OIDC_setup/oidc_setup_okta_3_5.png
diff --git a/docs/img/add_user.png b/docs/static/img/add_user.png
similarity index 100%
rename from docs/img/add_user.png
rename to docs/static/img/add_user.png
diff --git a/docs/img/admin.png b/docs/static/img/admin.png
similarity index 100%
rename from docs/img/admin.png
rename to docs/static/img/admin.png
diff --git a/docs/img/cfg_users.png b/docs/static/img/cfg_users.png
similarity index 100%
rename from docs/img/cfg_users.png
rename to docs/static/img/cfg_users.png
diff --git a/docs/img/grafana-import-dcgm-dashboard-6.png b/docs/static/img/grafana-import-dcgm-dashboard-6.png
similarity index 100%
rename from docs/img/grafana-import-dcgm-dashboard-6.png
rename to docs/static/img/grafana-import-dcgm-dashboard-6.png
diff --git a/docs/img/jaeger-inspecting-trace-with-error.png b/docs/static/img/jaeger-inspecting-trace-with-error.png
similarity index 100%
rename from docs/img/jaeger-inspecting-trace-with-error.png
rename to docs/static/img/jaeger-inspecting-trace-with-error.png
diff --git a/docs/img/jaeger-trace-list-including-trace-with-error.png b/docs/static/img/jaeger-trace-list-including-trace-with-error.png
similarity index 100%
rename from docs/img/jaeger-trace-list-including-trace-with-error.png
rename to docs/static/img/jaeger-trace-list-including-trace-with-error.png
diff --git a/docs/img/prometheus-forge-etl-python-metric-example.png b/docs/static/img/prometheus-forge-etl-python-metric-example.png
similarity index 100%
rename from docs/img/prometheus-forge-etl-python-metric-example.png
rename to docs/static/img/prometheus-forge-etl-python-metric-example.png
diff --git a/docs/img/set_creds.png b/docs/static/img/set_creds.png
similarity index 100%
rename from docs/img/set_creds.png
rename to docs/static/img/set_creds.png
diff --git a/docs/img/set_roles.png b/docs/static/img/set_roles.png
similarity index 100%
rename from docs/img/set_roles.png
rename to docs/static/img/set_roles.png
diff --git a/docs/img/signup.png b/docs/static/img/signup.png
similarity index 100%
rename from docs/img/signup.png
rename to docs/static/img/signup.png
diff --git a/docs/support.rst b/docs/support.rst
new file mode 100644
index 0000000..13fcc35
--- /dev/null
+++ b/docs/support.rst
@@ -0,0 +1,14 @@
+Support
+=======
+
+Enterprise users should contact staff about access to their dedicated Slack chat channel and ZenDesk ticketing organization.
+
+Stuck or thinking about a new project? Let's chat!
+
+- `Get Started <https://www.graphistry.com/get-started>`_
+- `Blog <https://www.graphistry.com/blog>`_
+- `Slack Channel <https://join.slack.com/t/graphistry-community/shared_invite/zt-53ik36w2-fpP0Ibjbk7IJuVFIRSnr6g>`_
+- `Zendesk Support <https://graphistry.zendesk.com/hc/en-us>`_
+- `GitHub <https://github.com/graphistry/pygraphistry>`_
+- `Twitter <https://twitter.com/graphistry>`_
+- `LinkedIn <https://www.linkedin.com/company/graphistry>`_
diff --git a/docs/backup-and-restore.md b/docs/tools/backup-and-restore.md
similarity index 97%
rename from docs/backup-and-restore.md
rename to docs/tools/backup-and-restore.md
index f4d630b..053b07a 100644
--- a/docs/backup-and-restore.md
+++ b/docs/tools/backup-and-restore.md
@@ -1,6 +1,6 @@
 # Backup and Restore Instructions: 
 
-### Overview
+## Overview
 
 Backup and restore scripts are provided that will backup your graphistry environment to remote blob storage (AWS s3, Azure Blob Storage or Google Cloud Storage). Graphistry uses [restic](https://restic.net/) backup utility which provides fast and secure incremental backups to remote blob storage. More details can be found in the [restic documentation](https://restic.readthedocs.io/en/stable/index.html).
 
@@ -137,7 +137,7 @@ cd /var/graphistry/compose/etc/scripts
 FROM_PATH=/var/graphistry/ ./backup.sh 
 ```
 
-#### Additional examples: 
+### Additional examples
 
 ```
 # dry-run: will only print the commands and execute restic with --dry-run option flag for testing purposes
@@ -202,7 +202,7 @@ TO_PATH=/var/graphistry/ ./restore.sh
 
 <br>
 
-## Scheduling Backups: 
+## Scheduling Backups
 
 Any scheduler can be used, but below are some examples of setting up cron to schedule nightly or weekly backups. 
 
@@ -222,7 +222,7 @@ crontab -e
 
 <br> 
 
-**AWS crontab examples:** 
+### AWS crontab examples
 ```
 # add the following line to run backup either daily: 
 
@@ -235,7 +235,7 @@ crontab -e
 
 <br> 
 
-**Azure crontab examples:** 
+### Azure crontab examples
 
 ```
 # add the following line to run backup either daily: 
@@ -247,7 +247,7 @@ crontab -e
 0 0 * * 0 TO_PATH=/var/graphistry/ /var/graphistry/compose/etc/scripts/backup.sh
 ```
 
-#### creating a script that has several variables that your crontab entry will call: 
+#### Creating a script that has several variables that your crontab entry will call
 
 ```
 #!/bin/bash
diff --git a/docs/bridge.md b/docs/tools/bridge.md
similarity index 100%
rename from docs/bridge.md
rename to docs/tools/bridge.md
diff --git a/docs/developer.md b/docs/tools/developer.md
similarity index 96%
rename from docs/developer.md
rename to docs/tools/developer.md
index f6e6fe8..5706829 100644
--- a/docs/developer.md
+++ b/docs/tools/developer.md
@@ -1,4 +1,4 @@
-# Some Additional Features for Developers and Sysadmins
+# AWS CLI tools
 
 ## Sending a compiled Graphistry distrobution to s3 to install on other systems with 4mo expiray
 ```bash
diff --git a/docs/tools/index.rst b/docs/tools/index.rst
new file mode 100644
index 0000000..6d9321a
--- /dev/null
+++ b/docs/tools/index.rst
@@ -0,0 +1,13 @@
+Operations & Tools
+========================
+
+.. toctree::
+  :maxdepth: 1
+
+  user-creation
+  developer
+  telemetry
+  backup-and-restore
+  update-backup-migrate
+  bridge
+  nvidia-docker-in-docker
diff --git a/docs/nvidia-docker-in-docker.md b/docs/tools/nvidia-docker-in-docker.md
similarity index 96%
rename from docs/nvidia-docker-in-docker.md
rename to docs/tools/nvidia-docker-in-docker.md
index 24d1dd4..3bc0202 100644
--- a/docs/nvidia-docker-in-docker.md
+++ b/docs/tools/nvidia-docker-in-docker.md
@@ -1,3 +1,4 @@
+# Nvidia docker-in-docker (DnD)
 
 ```
 docker build -t gcli .
diff --git a/docs/telemetry.md b/docs/tools/telemetry.md
similarity index 98%
rename from docs/telemetry.md
rename to docs/tools/telemetry.md
index 6a5e0a6..b8709e4 100644
--- a/docs/telemetry.md
+++ b/docs/tools/telemetry.md
@@ -187,19 +187,19 @@ To use telemetry with Graphistry, you need to:
 1. **Jaeger Dashboard:** Access the [Jaeger Dashboard URL](#jaeger-dashboard).
 2. **Key Tracing Information:**
    - List of traces generated by the system for the graph rendering flow (for instance: show the trace list including a trace with errors).
-![List of traces generated by the system for the graph rendering flow](./img/jaeger-trace-list-including-trace-with-error.png)
+![List of traces generated by the system for the graph rendering flow](../_static/img/jaeger-trace-list-including-trace-with-error.png)
    - The root span for the graph rendering flow is `streamgl-viz: handleFalcorSocketConnections`.
    - The service that generates the root span for the graph rendering flow is `streamgl-viz`.
    - ETL dataset fetch spans from the Python ETL Service service.
    - Detailed spans for actions by the visualization service and GPU workers (for instance: inspecting trace with error).
-![Detailed spans for actions by the visualization service and GPU workers](./img/jaeger-inspecting-trace-with-error.png)
+![Detailed spans for actions by the visualization service and GPU workers](../_static/img/jaeger-inspecting-trace-with-error.png)
 
 ### Accessing Metrics
 1. **Prometheus Dashboard:** Access the [Prometheus Dashboard URL](#prometheus-dashboard).
 2. **Critical Metrics to Monitor:**
    - `worker_read_crashes_total`: Monitor GPU worker crashes.
    - File upload and dataset creation metrics in the Python ETL service (all metrics with the name `forge_etl_python_upload_*`, for instance: `forge_etl_python_upload_datasets_request_total`).
-![File upload and dataset creation metrics in the Python ETL service](./img/prometheus-forge-etl-python-metric-example.png)
+![File upload and dataset creation metrics in the Python ETL service](../_static/img/prometheus-forge-etl-python-metric-example.png)
 
 ### GPU Monitoring with Grafana and NVIDIA Data Center GPU Manager
 
@@ -207,7 +207,7 @@ To provide comprehensive monitoring of GPU performance, we utilize Grafana in co
 - **NVIDIA Data Center GPU Manager (DCGM):** [DCGM](https://developer.nvidia.com/dcgm) is a suite of tools for managing and monitoring NVIDIA GPUs in data centers.  It provides detailed metrics on GPU performance, health, and utilization.
 - **Grafana:** Grafana is an open-source platform for monitoring and observability.  It allows users to query, visualize, alert on, and explore metrics from a variety of data sources, including Prometheus.  By default the Grafana instance has the metrics and GPU dashboard from the `DCGM exporter` service (see `DCGM Exporter Dashboards` in the Grafana main page).
 
-![grafana-import-dcgm-dashboard-6](./img/grafana-import-dcgm-dashboard-6.png)
+![grafana-import-dcgm-dashboard-6](../_static/img/grafana-import-dcgm-dashboard-6.png)
 
 ## Advanced configuration
 
@@ -217,7 +217,8 @@ To acces the telemetry services, you need to use the template file `$GRAPHISTRY_
 
 1. Create a backup copy of you current Caddyfile: `$GRAPHISTRY_HOME/data/config/Caddyfile`
 2. Create a new `$GRAPHISTRY_HOME/data/config/Caddyfile` using the template provided at `$GRAPHISTRY_HOME/data/config/Caddy.default`.  Update the template with your own domain or IP address.  For example, if the template uses `$GRAPHISTRY_HOST`, replace it with your actual domain or IP (e.g., `your-domain.grph.xyz`).  Remember to use your specific domain or IP address instead of the example.  The following section will show the contents of the new Caddyfile for reference.
-   ```nginx
+
+```
    your-domain.grph.xyz, :80 {
 
        log {
@@ -253,7 +254,8 @@ To acces the telemetry services, you need to use the template file `$GRAPHISTRY_
        }
 
    }
-   ```
+```
+
 3. Set the following environment variables in `$GRAPHISTRY_HOME/data/config/telemetry.env` (as shown in [this example](#example-deploying-with-the-packaged-graphistry-local-telemetry-suite-behind-caddy) as well): `GF_SERVER_ROOT_URL=http(s)://your-domain.grph.xyz/grafana/` (use https or http depending on your deployment) and `GF_SERVER_SERVE_FROM_SUB_PATH=true`.  Replace `your-domain.grph.xyz` with your actual domain or IP address, as appropriate.
 4. Restart `caddy` with:
    ```bash
diff --git a/docs/update-backup-migrate.md b/docs/tools/update-backup-migrate.md
similarity index 97%
rename from docs/update-backup-migrate.md
rename to docs/tools/update-backup-migrate.md
index 4a933ea..dea59c7 100644
--- a/docs/update-backup-migrate.md
+++ b/docs/tools/update-backup-migrate.md
@@ -1,6 +1,6 @@
 # Update, Backup, and Migrate
 
-Updates, backups, and migrations involve manipulating [configurations](configure.md), local data, the global postgres data volume, and Graphistry install itself.
+Updates, backups, and migrations involve manipulating [configurations](../app-config/configure.md), local data, the global postgres data volume, and Graphistry install itself.
 
 ## Install multiple releases
 
@@ -26,7 +26,7 @@ Each instance will include file `VERSION` and tag its images with that.
 
 Edit `docker-compose.yml`'s top "`volumes:`" section to use a unique prefix
 
-```
+```yaml
 volumes:
   ...
   postgres_data:
@@ -96,7 +96,7 @@ Example: `migrate.sh` to go from AWS Marketplace instance `old.site.ngo` to `new
 
 2. From the new server, run 
 
-```
+```bash
 ubuntu@new.site.ngo:~/graphistry$ KEY="~/.ssh/key.pem" FROM=ubuntu@old.site.ngo TO=ubuntu@new.site.ngo ./etc/scripts/migrate.sh
 ```
 
diff --git a/docs/user-creation.md b/docs/tools/user-creation.md
similarity index 93%
rename from docs/user-creation.md
rename to docs/tools/user-creation.md
index cced8cc..1742a4e 100644
--- a/docs/user-creation.md
+++ b/docs/tools/user-creation.md
@@ -1,6 +1,6 @@
 # User Creation
 
-See also [general configuration](configure.md) and [authentication](authentication.md)
+See also [general configuration](../app-config/configure.md) and [authentication](../security/authentication.md)
 
 ## Account Creation Model
 
@@ -14,7 +14,7 @@ It is easy to securely add users, and we generally recommend [giving users only
 * **staff** users also get access to the shared Jupyter notebook server, private dashboards, and the team investigation automation tool
 * **superuser** users can also turn open registration back on, and give newly self-registered users the role **staff**
 * Users can create organizations
-* [SSO can be enabled](authentication.md) site-wide or per-organization, such as when there are multiple identity providers
+* [SSO can be enabled](../security/authentication.md) site-wide or per-organization, such as when there are multiple identity providers
 * Organization administrators can invite existing site users into their organization
 * Organization administrators can choose whether SSO users can self-join the organization or require an invitation
 * Site administrators can create users from an organization page, who then get added to the organization at the same time
diff --git a/hardware-software.pdf b/hardware-software.pdf
deleted file mode 100644
index 6a82895..0000000
Binary files a/hardware-software.pdf and /dev/null differ
diff --git a/infra/Dockerfile b/infra/Dockerfile
new file mode 100644
index 0000000..2b42b46
--- /dev/null
+++ b/infra/Dockerfile
@@ -0,0 +1,27 @@
+FROM sphinxdoc/sphinx:8.0.2
+
+WORKDIR /docs
+
+COPY infra/requirements-system.txt /requirements-system.txt
+RUN --mount=type=cache,target=/var/cache/apt \
+    --mount=type=cache,target=/var/lib/apt \
+    apt-get update \
+    && apt-get install -y $(cat /requirements-system.txt) \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN --mount=type=cache,target=/root/.cache/pip \
+    python3 -m pip install graphistry[docs]
+
+COPY infra/requirements-python.txt /requirements-python.txt
+RUN --mount=type=cache,target=/root/.cache/pip \
+    python3 -m pip install -r /requirements-python.txt
+
+COPY docs /graphistry-cli
+
+COPY infra/build-docs.sh /build-docs.sh
+COPY docs/ /docs/source
+COPY README.md /docs/source/README.md
+
+WORKDIR /docs/source
+
+CMD ["/build-docs.sh"]
diff --git a/infra/build-docs.sh b/infra/build-docs.sh
new file mode 100755
index 0000000..d35c0ec
--- /dev/null
+++ b/infra/build-docs.sh
@@ -0,0 +1,45 @@
+#!/bin/sh
+set -ex
+
+build_html() {
+    sphinx-build -vv -b html -d /docs/doctrees . /docs/_build/html
+}
+
+build_epub() {
+    sphinx-build -b epub -d /docs/doctrees . /docs/_build/epub
+}
+
+build_pdf() {
+    sphinx-build -b latex -d /docs/doctrees . /docs/_build/latexpdf
+    cd /docs/_build/latexpdf
+    # Run pdflatex twice to resolve cross-references, using batchmode for non-interactive build
+    rm -f /docs/_build/latexpdf/Graphistry.pdf
+    pdflatex -file-line-error -interaction=nonstopmode Graphistry.tex || test -f /docs/_build/latexpdf/Graphistry.pdf
+    pdflatex -file-line-error -interaction=nonstopmode Graphistry.tex || test -f /docs/_build/latexpdf/Graphistry.pdf
+}
+
+echo "Building documentation: DOCS_FORMAT=${DOCS_FORMAT}"
+echo "PWD: $(pwd)"
+echo "Contents of /docs: $(ls /docs)"
+echo "Contents of /docs/source (head): $(ls /docs/source | head -n 10)"
+
+case "$DOCS_FORMAT" in
+    html)
+        build_html
+        ;;
+    epub)
+        build_epub
+        ;;
+    pdf)
+        build_pdf
+        ;;
+    all)
+        build_html
+        build_epub
+        build_pdf
+        ;;
+    *)
+        echo "Invalid DOCS_FORMAT value: $DOCS_FORMAT"
+        exit 1
+        ;;
+esac
\ No newline at end of file
diff --git a/infra/docker-compose.yml b/infra/docker-compose.yml
new file mode 100644
index 0000000..449a240
--- /dev/null
+++ b/infra/docker-compose.yml
@@ -0,0 +1,12 @@
+services:
+  sphinx:
+    build:
+      context: ../  # project root
+      dockerfile: infra/Dockerfile
+    volumes:
+      #- ../docs:/docs/source  # Mount the `docs/source` folder to allow live editing
+      - ../_build:/docs/_build  # Mount the Sphinx build output to a directory on the host
+      - ../doctrees:/docs/doctrees  # Mount doctrees to persist build state
+    environment:
+      - USER_ID=${UID}  # Pass user ID for permission handling
+      - DOCS_FORMAT=${DOCS_FORMAT:-all}  # Pass DOCS_FORMAT to enable specific format builds
diff --git a/infra/requirements-python.txt b/infra/requirements-python.txt
new file mode 100644
index 0000000..7049a0b
--- /dev/null
+++ b/infra/requirements-python.txt
@@ -0,0 +1 @@
+linkify-it-py==2.0.3
\ No newline at end of file
diff --git a/infra/requirements-system.txt b/infra/requirements-system.txt
new file mode 100644
index 0000000..5678eb8
--- /dev/null
+++ b/infra/requirements-system.txt
@@ -0,0 +1,6 @@
+inkscape
+pandoc
+texlive-latex-base
+texlive-latex-recommended
+texlive-latex-extra
+texlive-fonts-recommended
diff --git a/readme.pdf b/readme.pdf
deleted file mode 100644
index db6c6fa..0000000
Binary files a/readme.pdf and /dev/null differ