DOCS: Standardize Reference image paths in Enterprise Docs (#3080)

* copy enterprise reference image to core reference img dir

* standardize reference image path

* link fixes

docs/enterprise/console-settings.yaml

@@ -5,22 +5,22 @@ settings:
         doc: |
           View the traffic running through Pomerium. Filter by [Route][route-concept] name, or date range.
 
-          ![The Traffic page in Pomerium Enterprise](../img/traffic-fullpage.png)
+          ![The Traffic page in Pomerium Enterprise](./img/traffic-fullpage.png)
       - name: "Runtime"
         doc: |
           Monitor how many system resources Pomerium is consuming. Filter by date range, service, and instance.
 
-          ![The Runtime Info page in Pomerium Enterprise](../img/runtime-fullpage.png)
+          ![The Runtime Info page in Pomerium Enterprise](./img/runtime-fullpage.png)
       - name: "Sessions"
         doc: |
           View active Sessions. From here you can revoke sessions, filter by session or user information, or revoke one or multiple sessions. You can also export the data.
 
-          ![The Sessions page in Pomerium Enterprise](../img/sessions-fullpage.png)
+          ![The Sessions page in Pomerium Enterprise](./img/sessions-fullpage.png)
       - name: "Events"
         doc: |
           The events page displays the log output of Envoy as it process changes from Pomerium and applies updates to the underlying services.
 
-          ![The Events page in Pomerium Enterprise](../img/events-fullpage.png)
+          ![The Events page in Pomerium Enterprise](./img/events-fullpage.png)
 
           The most common updates are to Pomerium Proxy services, which are updated every time a Route or Policy is created or updated.
 
@@ -31,7 +31,7 @@ settings:
 
           The default view shows all changes made through Pomerium Enterprise. Use the **COMPARE** button next to an entry to filter to only changes that affected that resource. Select two versions of that resource, then **DIFF** to see what changed:
 
-          ![A screenshot showing the diff of a change to a route, adding a policy](../img/deployment-diff.png)
+          ![A screenshot showing the diff of a change to a route, adding a policy](./img/deployment-diff.png)
   - name: "Manage"
     settings:
       - name: "Routes"
@@ -98,13 +98,13 @@ settings:
 
           From the **BUILDER** tab, users can add allow or deny blocks to a policy, containing and/or/not/nor logic to allow or deny sets of users and groups.
 
-          ![A policy being constructed in Pomerium Enterprise allowing a single user access](../img/example-policy-single-user.png)
+          ![A policy being constructed in Pomerium Enterprise allowing a single user access](./img/example-policy-single-user.png)
 
           ### Pomerium Policy Language
 
           From the **EDITOR** tab users can write policies in Pomerium Policy Language (**PPL**), a YAML-based notation.
 
-          ![A policy as viewed from the editor tab](../img/example-policy-editor.png)
+          ![A policy as viewed from the editor tab](./img/example-policy-editor.png)
 
           PPL documents contain one or more rules. Each rule has a corresponding action and one or more logical operators.
           Each logical operator contains criteria and each criterion has a name and corresponding data.
@@ -186,13 +186,13 @@ settings:
               Displays the currently enrolled devices for each user, along with their current approval status.
               Administrators can inspect, approve, or delete registered devices from this table.
 
-              ![List of user devices](../img/console-devices.png)
+              ![List of user devices](./img/console-devices.png)
           - name: "New Enrollment"
             doc: |
               The **New Enrollment** button allows administrators to create a custom link for a specific user to use to register a new device, which will automatically be approved.
               This scheme is known as [Trust on First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use).
 
-              ![Example device enrollment](../img/new-enrollment.png)
+              ![Example device enrollment](./img/new-enrollment.png)
             settings:
               - name: "Search Users"
                 doc: "New Enrollment URLs are only valid for the specified user."
@@ -264,7 +264,7 @@ settings:
 
           1. From the main menu, select **Service Accounts** under **CONFIGURE**. Click the **+ ADD SERVICE ACCOUNT** button:
 
-             ![An empty Service Accounts page](../img/add-service-account.png)
+             ![An empty Service Accounts page](./img/add-service-account.png)
 
           1. Service accounts can be unique and exist only for Pomerium, or impersonate directory users from your IdP.
 
@@ -272,30 +272,30 @@ settings:
              :::: tab Unique
              Give the user a unique ID. Consider referencing the Namespace you're creating it under, for easier reference later. Optionally set an expiration date:
 
-             ![Adding a unique service account](../img/create-service-account.png)
+             ![Adding a unique service account](./img/create-service-account.png)
 
              The user ID set here corresponds to the `User` criteria when editing a policy.
              ::::
              :::: tab Impersonated
              You can find your User ID by going to the special endpoint `/.pomerium`, or selecting **Logout** under your user in the upper right hand corner (this will not immediately log you out):
 
-             ![Session Details](../img/user-id.png)
+             ![Session Details](./img/user-id.png)
 
              Copy the User ID and paste it into the **User ID** field in the **Add Service Account** modal. The lookahead search should show you the user name You can also optionally set an expiration date:
 
-             ![Adding an impersonated service account](../img/create-impersonated-service-account.png)
+             ![Adding an impersonated service account](./img/create-impersonated-service-account.png)
              ::::
              :::::
 
           1. After you click **Submit**, the modal presents the JSON web token (**JWT**) for the service account. Temporarily save it somewhere secure, as you will not be able to view it again:
 
-             ![Service Account Added](../img/service-account-jwt.png)
+             ![Service Account Added](./img/service-account-jwt.png)
 
              This JWT must be added to your application configuration to enable direct communication.
 
           1. Edit or create policies to give the service account access to the internal service:
 
-             ![An example policy for a service account](../img/service-account-policy.png)
+             ![An example policy for a service account](./img/service-account-policy.png)
       - name: "Namespaces"
         keys: ["namespace"]
         doc: |

docs/enterprise/reference/configure.md

@@ -180,7 +180,7 @@ Before you begin, confirm you are in the correct Namespace. A service account ca
 
 1. From the main menu, select **Service Accounts** under **CONFIGURE**. Click the **+ ADD SERVICE ACCOUNT** button:
 
-   ![An empty Service Accounts page](../img/add-service-account.png)
+   ![An empty Service Accounts page](./img/add-service-account.png)
 
 1. Service accounts can be unique and exist only for Pomerium, or impersonate directory users from your IdP.
 
@@ -188,30 +188,30 @@ Before you begin, confirm you are in the correct Namespace. A service account ca
    :::: tab Unique
    Give the user a unique ID. Consider referencing the Namespace you're creating it under, for easier reference later. Optionally set an expiration date:
 
-   ![Adding a unique service account](../img/create-service-account.png)
+   ![Adding a unique service account](./img/create-service-account.png)
 
    The user ID set here corresponds to the `User` criteria when editing a policy.
    ::::
    :::: tab Impersonated
    You can find your User ID by going to the special endpoint `/.pomerium`, or selecting **Logout** under your user in the upper right hand corner (this will not immediately log you out):
 
-   ![Session Details](../img/user-id.png)
+   ![Session Details](./img/user-id.png)
 
    Copy the User ID and paste it into the **User ID** field in the **Add Service Account** modal. The lookahead search should show you the user name You can also optionally set an expiration date:
 
-   ![Adding an impersonated service account](../img/create-impersonated-service-account.png)
+   ![Adding an impersonated service account](./img/create-impersonated-service-account.png)
    ::::
    :::::
 
 1. After you click **Submit**, the modal presents the JSON web token (**JWT**) for the service account. Temporarily save it somewhere secure, as you will not be able to view it again:
 
-   ![Service Account Added](../img/service-account-jwt.png)
+   ![Service Account Added](./img/service-account-jwt.png)
 
    This JWT must be added to your application configuration to enable direct communication.
 
 1. Edit or create policies to give the service account access to the internal service:
 
-   ![An example policy for a service account](../img/service-account-policy.png)
+   ![An example policy for a service account](./img/service-account-policy.png)
 
 
 ## Namespaces

docs/enterprise/reference/manage.md

@@ -185,13 +185,14 @@ of the connection using `timeout` value (i.e. to 1 day).
 
 #### Host Headers
 
-The `host` header can be preserved via the `preserve_host_header` setting or customized via 3 mutually exclusive options:
+The `host` header can be preserved via the `preserve_host_header` setting or customized via three mutually exclusive options:
+
+1. `preserve_host_header` will, when enabled, this option will pass the host header from the incoming request to the proxied host, instead of the destination hostname. It's an optional parameter of type `bool` that defaults to `false`.
 
-1. `preserve_host_header` when enabled, this option will pass the host header from the incoming request to the proxied host, instead of the destination hostname. It's an optional parameter of type `bool` that defaults to `false`.
     See [ProxyPreserveHost](http://httpd.apache.org/docs/2.0/mod/mod_proxy.html#proxypreservehost).
-2. `host_rewrite` which will rewrite the host to a new literal value.
-3. `host_rewrite_header` which will rewrite the host to match an incoming header value.
-4. `host_path_regex_rewrite_pattern`, `host_path_regex_rewrite_substitution` which will rewrite the host according to a regex matching the path. For example with the following config:
+2. `host_rewrite`, which will rewrite the host to a new literal value.
+3. `host_rewrite_header`, which will rewrite the host to match an incoming header value.
+4. `host_path_regex_rewrite_pattern` & `host_path_regex_rewrite_substitution`, which will rewrite the host according to a regex matching the path. For example with the following config:
 
     ```yaml
     host_path_regex_rewrite_pattern: "^/(.+)/.+$"
@@ -200,7 +201,7 @@ The `host` header can be preserved via the `preserve_host_header` setting or cus
 
     Would rewrite the host header to `example.com` given the path `/example.com/some/path`.
 
-The 2nd, 3rd and 4th options correspond to the envoy route action host related options, which can be found [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto.html#config-route-v3-routeaction).
+The 2nd, 3rd and 4th options correspond to the Envoy route action host related options, which can be found [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto.html#config-route-v3-routeaction).
 
 #### Set Request Headers
 
@@ -289,13 +290,13 @@ Policies can be constructed three ways:
 
 From the **BUILDER** tab, users can add allow or deny blocks to a policy, containing and/or/not/nor logic to allow or deny sets of users and groups.
 
-![A policy being constructed in Pomerium Enterprise allowing a single user access](../img/example-policy-single-user.png)
+![A policy being constructed in Pomerium Enterprise allowing a single user access](./img/example-policy-single-user.png)
 
 ### Pomerium Policy Language
 
 From the **EDITOR** tab users can write policies in Pomerium Policy Language (**PPL**), a YAML-based notation.
 
-![A policy as viewed from the editor tab](../img/example-policy-editor.png)
+![A policy as viewed from the editor tab](./img/example-policy-editor.png)
 
 PPL documents contain one or more rules. Each rule has a corresponding action and one or more logical operators.
 Each logical operator contains criteria and each criterion has a name and corresponding data.
@@ -407,7 +408,7 @@ Device enrollment let's you create [policies](/docs/topics/ppl.md#device-matcher
 Displays the currently enrolled devices for each user, along with their current approval status.
 Administrators can inspect, approve, or delete registered devices from this table.
 
-![List of user devices](../img/console-devices.png)
+![List of user devices](./img/console-devices.png)
 
 
 ### New Enrollment
@@ -415,7 +416,7 @@ Administrators can inspect, approve, or delete registered devices from this tabl
 The **New Enrollment** button allows administrators to create a custom link for a specific user to use to register a new device, which will automatically be approved.
 This scheme is known as [Trust on First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use).
 
-![Example device enrollment](../img/new-enrollment.png)
+![Example device enrollment](./img/new-enrollment.png)
 
 
 #### Search Users

docs/enterprise/reference/reports.md

@@ -13,28 +13,28 @@ meta:
 
 View the traffic running through Pomerium. Filter by [Route][route-concept] name, or date range.
 
-![The Traffic page in Pomerium Enterprise](../img/traffic-fullpage.png)
+![The Traffic page in Pomerium Enterprise](./img/traffic-fullpage.png)
 
 
 ## Runtime
 
 Monitor how many system resources Pomerium is consuming. Filter by date range, service, and instance.
 
-![The Runtime Info page in Pomerium Enterprise](../img/runtime-fullpage.png)
+![The Runtime Info page in Pomerium Enterprise](./img/runtime-fullpage.png)
 
 
 ## Sessions
 
 View active Sessions. From here you can revoke sessions, filter by session or user information, or revoke one or multiple sessions. You can also export the data.
 
-![The Sessions page in Pomerium Enterprise](../img/sessions-fullpage.png)
+![The Sessions page in Pomerium Enterprise](./img/sessions-fullpage.png)
 
 
 ## Events
 
 The events page displays the log output of Envoy as it process changes from Pomerium and applies updates to the underlying services.
 
-![The Events page in Pomerium Enterprise](../img/events-fullpage.png)
+![The Events page in Pomerium Enterprise](./img/events-fullpage.png)
 
 The most common updates are to Pomerium Proxy services, which are updated every time a Route or Policy is created or updated.
 
@@ -47,7 +47,7 @@ From the **Deployment History** page administrators can review changes made to t
 
 The default view shows all changes made through Pomerium Enterprise. Use the **COMPARE** button next to an entry to filter to only changes that affected that resource. Select two versions of that resource, then **DIFF** to see what changed:
 
-![A screenshot showing the diff of a change to a route, adding a policy](../img/deployment-diff.png)
+![A screenshot showing the diff of a change to a route, adding a policy](./img/deployment-diff.png)
 
 
 [route-concept]: /enterprise/concepts.md#routes

docs/guides/enroll-device.md

@@ -14,7 +14,7 @@ description: >-
 
 If a Pomerium route is configured to [require device authentication](/docs/topics/ppl.md#device-matcher), then the user must register a [trusted execution environment](/docs/topics/device-identity.md#authenticated-device-types) (**TEE**) device before accessing the route. Registration is easy, but different depending on the device being used to provide ID.
 
-This guide covers enrollment of a device by a user. This is available for both open-source Pomerium and [Pomerium Enterprise](/enterprise) installations. However, Enterprise users may also receive registration links [generated by their administrators](/guides/admin-enroll-device.md), which will mark the newly enrolled device as approved in the Pomerium Enterprise Console.
+This guide covers enrollment of a device by a user. This is available for both open-source Pomerium and [Pomerium Enterprise](/enterprise/readme.md) installations. However, Enterprise users may also receive registration links [generated by their administrators](/guides/admin-enroll-device.md), which will mark the newly enrolled device as approved in the Pomerium Enterprise Console.
 
 1. Users are prompted to register a new device when accessing a route that requires device authentication: