diff --git a/hack/update-docs.sh b/hack/update-docs.sh
new file mode 100755
index 00000000..8a8ca2b0
--- /dev/null
+++ b/hack/update-docs.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+set -e
+
+# Update terraform docs
+for d in `find . -name '*.tf' -exec dirname {} \; | sort | uniq`; do
+    echo "###############################################"
+    echo "# Generating $d"
+    terraform-docs markdown table \
+        --output-file README.md \
+        --output-mode inject \
+        $d
+done
diff --git a/modules/cloudevent-broker/README.md b/modules/cloudevent-broker/README.md
index 03c8f5b5..a25c6af5 100644
--- a/modules/cloudevent-broker/README.md
+++ b/modules/cloudevent-broker/README.md
@@ -1,14 +1,14 @@
 # `cloudevent-broker`
 
 This module provisions a regionalizied Broker abstraction akin to the Knative
-"Broker" concept.  The dual "Trigger" concept is captured by the sibling
-`cloudevent-trigger` module.  The intended usage of this module for publishing
+"Broker" concept. The dual "Trigger" concept is captured by the sibling
+`cloudevent-trigger` module. The intended usage of this module for publishing
 events is something like this:
 
 ```hcl
 // Create a network with several regional subnets
 module "networking" {
-  source = "chainguard-dev/common/infra//networking"
+  source = "chainguard-dev/common/infra//modules/networking"
 
   name       = "my-networking"
   project_id = var.project_id
@@ -17,7 +17,7 @@ module "networking" {
 
 // Create the Broker abstraction.
 module "cloudevent-broker" {
-  source = "chainguard-dev/common/infra//cloudevent-broker"
+  source = "chainguard-dev/common/infra//modules/cloudevent-broker"
 
   name       = "my-broker"
   project_id = var.project_id
@@ -28,7 +28,7 @@ module "cloudevent-broker" {
 module "foo-emits-events" {
   for_each = module.networking.regional-networks
 
-  source = "chainguard-dev/common/infra//authorize-private-service"
+  source = "chainguard-dev/common/infra//modules/authorize-private-service"
 
   project_id = var.project_id
   region     = each.key
@@ -40,7 +40,7 @@ module "foo-emits-events" {
 // Run a cloud run service as the "foo" service account, and pass in the address
 // of the regional ingress endpoint.
 module "foo-service" {
-  source = "chainguard-dev/common/infra//regional-go-service"
+  source = "chainguard-dev/common/infra//modules/regional-go-service"
 
   project_id = var.project_id
   name       = "foo"
diff --git a/modules/cloudevent-recorder/README.md b/modules/cloudevent-recorder/README.md
index 5cfd422d..ad87d775 100644
--- a/modules/cloudevent-recorder/README.md
+++ b/modules/cloudevent-recorder/README.md
@@ -9,7 +9,7 @@ intended usage of this module for publishing events is something like this:
 ```hcl
 // Create a network with several regional subnets
 module "networking" {
-  source = "chainguard-dev/common/infra//networking"
+  source = "chainguard-dev/common/infra//modules/networking"
 
   name       = "my-networking"
   project_id = var.project_id
@@ -18,7 +18,7 @@ module "networking" {
 
 // Create the Broker abstraction.
 module "cloudevent-broker" {
-  source = "chainguard-dev/common/infra//cloudevent-broker"
+  source = "chainguard-dev/common/infra//modules/cloudevent-broker"
 
   name       = "my-broker"
   project_id = var.project_id
@@ -27,7 +27,7 @@ module "cloudevent-broker" {
 
 // Record cloudevents of type com.example.foo and com.example.bar
 module "foo-emits-events" {
-  source = "chainguard-dev/common/infra//cloudevent-recorder"
+  source = "chainguard-dev/common/infra//modules/cloudevent-recorder"
 
   name       = "my-recorder"
   project_id = var.project_id
diff --git a/modules/cloudevent-trigger/README.md b/modules/cloudevent-trigger/README.md
index d94a55a6..c96f10e4 100644
--- a/modules/cloudevent-trigger/README.md
+++ b/modules/cloudevent-trigger/README.md
@@ -1,14 +1,14 @@
 # `cloudevent-trigger`
 
 This module provisions regionalizied event-triggered services using a Trigger
-abstraction akin to the Knative "Trigger" concept.  The dual "Broker" concept
-is captured by the sibling `cloudevent-broker` module.  The intended usage of
-this module for consuming events is something like this:
+abstraction akin to the Knative "Trigger" concept. The dual "Broker" concept is
+captured by the sibling `cloudevent-broker` module. The intended usage of this
+module for consuming events is something like this:
 
 ```hcl
 // Create a network with several regional subnets
 module "networking" {
-  source = "chainguard-dev/common/infra//networking"
+  source = "chainguard-dev/common/infra//modules/networking"
 
   name       = "my-networking"
   project_id = var.project_id
@@ -17,7 +17,7 @@ module "networking" {
 
 // Create the Broker abstraction.
 module "cloudevent-broker" {
-  source = "chainguard-dev/common/infra//cloudevent-broker"
+  source = "chainguard-dev/common/infra//modules/cloudevent-broker"
 
   name       = "my-broker"
   project_id = var.project_id
@@ -25,7 +25,7 @@ module "cloudevent-broker" {
 }
 
 module "bar-service" {
-  source = "chainguard-dev/common/infra//regional-go-service"
+  source = "chainguard-dev/common/infra//modules/regional-go-service"
 
   project_id = var.project_id
   name       = "bar"
@@ -48,7 +48,7 @@ module "bar-service" {
 module "cloudevent-trigger" {
   for_each = module.networking.regional-networks
 
-  source = "chainguard-dev/common/infra//cloudevent-trigger"
+  source = "chainguard-dev/common/infra//modules/cloudevent-trigger"
 
   name       = "bar"
   project_id = var.project_id
diff --git a/modules/dashboard/cloudevent-receiver/README.md b/modules/dashboard/cloudevent-receiver/README.md
index 9e33388e..52acb657 100644
--- a/modules/dashboard/cloudevent-receiver/README.md
+++ b/modules/dashboard/cloudevent-receiver/README.md
@@ -1,13 +1,15 @@
 # `dashboard/cloudevent-receiver`
 
-This module provisions a Google Cloud Monitoring dashboard for a regionalized Cloud Run service that receives Cloud Events from one or more `cloudevent-trigger`.
+This module provisions a Google Cloud Monitoring dashboard for a regionalized
+Cloud Run service that receives Cloud Events from one or more
+`cloudevent-trigger`.
 
 It assumes the service has the same name in all regions.
 
 ```hcl
 // Create a network with several regional subnets
 module "networking" {
-  source = "chainguard-dev/common/infra//networking"
+  source = "chainguard-dev/common/infra//modules/networking"
 
   name       = "my-networking"
   project_id = var.project_id
@@ -16,7 +18,7 @@ module "networking" {
 
 // Run a regionalized cloud run service "receiver" to handle events.
 module "receiver" {
-  source = "chainguard-dev/common/infra//regional-go-service"
+  source = "chainguard-dev/common/infra//modules/regional-go-service"
 
   project_id = var.project_id
   name       = "receiver"
@@ -37,7 +39,7 @@ module "receiver" {
 module "cloudevent-trigger" {
   for_each = module.networking.regional-networks
 
-  source = "chainguard-dev/common/infra//cloudevent-trigger"
+  source = "chainguard-dev/common/infra//modules/cloudevent-trigger"
 
   name       = "my-trigger"
   project_id = var.project_id
@@ -53,7 +55,7 @@ module "cloudevent-trigger" {
 
 // Set up a dashboard for a regionalized event handler named "receiver".
 module "receiver-dashboard" {
-  source       = "chainguard-dev/common/infra//dashboard/cloudevent-receiver"
+  source       = "chainguard-dev/common/infra//modules/dashboard/cloudevent-receiver"
   service_name = "receiver"
 
   triggers = {
@@ -62,7 +64,9 @@ module "receiver-dashboard" {
 }
 ```
 
-The dashboard it creates includes widgets for service logs, request count, latency (p50,p95,p99), instance count grouped by revision, CPU and memory utilization, startup latency, and sent/received bytes.
+The dashboard it creates includes widgets for service logs, request count,
+latency (p50,p95,p99), instance count grouped by revision, CPU and memory
+utilization, startup latency, and sent/received bytes.
 
 <!-- BEGIN_TF_DOCS -->
 ## Requirements
diff --git a/modules/dashboard/job/README.md b/modules/dashboard/job/README.md
index a4e1c6f4..02b62f09 100644
--- a/modules/dashboard/job/README.md
+++ b/modules/dashboard/job/README.md
@@ -20,12 +20,13 @@ resource "google_cloud_run_v2_job" "sync" {
 
 // Set up a dashboard for a regionalized job named "sync".
 module "job-dashboard" {
-  source       = "chainguard-dev/common/infra//dashboard/job"
+  source       = "chainguard-dev/common/infra//modules/dashboard/job"
   service_name = google_cloud_run_v2_job.name
 }
 ```
 
-The dashboard it creates includes widgets for job logs, CPU and memory utilization, startup latency, and sent/received bytes.
+The dashboard it creates includes widgets for job logs, CPU and memory
+utilization, startup latency, and sent/received bytes.
 
 <!-- BEGIN_TF_DOCS -->
 ## Requirements
diff --git a/modules/dashboard/sections/alerts/README.md b/modules/dashboard/sections/alerts/README.md
new file mode 100644
index 00000000..df4bcb07
--- /dev/null
+++ b/modules/dashboard/sections/alerts/README.md
@@ -0,0 +1,35 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_alert"></a> [alert](#module\_alert) | ../../widgets/alert | n/a |
+| <a name="module_collapsible"></a> [collapsible](#module\_collapsible) | ../collapsible | n/a |
+| <a name="module_width"></a> [width](#module\_width) | ../width | n/a |
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_alert"></a> [alert](#input\_alert) | n/a | `string` | n/a | yes |
+| <a name="input_collapsed"></a> [collapsed](#input\_collapsed) | n/a | `bool` | `false` | no |
+| <a name="input_title"></a> [title](#input\_title) | n/a | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_section"></a> [section](#output\_section) | n/a |
+<!-- END_TF_DOCS -->
diff --git a/modules/dashboard/sections/collapsible/README.md b/modules/dashboard/sections/collapsible/README.md
new file mode 100644
index 00000000..b36067ab
--- /dev/null
+++ b/modules/dashboard/sections/collapsible/README.md
@@ -0,0 +1,33 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_width"></a> [width](#module\_width) | ../width | n/a |
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_collapsed"></a> [collapsed](#input\_collapsed) | n/a | `bool` | `false` | no |
+| <a name="input_tiles"></a> [tiles](#input\_tiles) | n/a | `any` | n/a | yes |
+| <a name="input_title"></a> [title](#input\_title) | n/a | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_section"></a> [section](#output\_section) | n/a |
+<!-- END_TF_DOCS -->
diff --git a/modules/dashboard/sections/grpc/README.md b/modules/dashboard/sections/grpc/README.md
new file mode 100644
index 00000000..c332ce9a
--- /dev/null
+++ b/modules/dashboard/sections/grpc/README.md
@@ -0,0 +1,39 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_collapsible"></a> [collapsible](#module\_collapsible) | ../collapsible | n/a |
+| <a name="module_incoming_latency"></a> [incoming\_latency](#module\_incoming\_latency) | ../../widgets/latency | n/a |
+| <a name="module_outbound_latency"></a> [outbound\_latency](#module\_outbound\_latency) | ../../widgets/latency | n/a |
+| <a name="module_outbound_request_count"></a> [outbound\_request\_count](#module\_outbound\_request\_count) | ../../widgets/xy | n/a |
+| <a name="module_request_count"></a> [request\_count](#module\_request\_count) | ../../widgets/xy | n/a |
+| <a name="module_width"></a> [width](#module\_width) | ../width | n/a |
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_collapsed"></a> [collapsed](#input\_collapsed) | n/a | `bool` | `false` | no |
+| <a name="input_filter"></a> [filter](#input\_filter) | n/a | `list(string)` | n/a | yes |
+| <a name="input_service_name"></a> [service\_name](#input\_service\_name) | n/a | `string` | n/a | yes |
+| <a name="input_title"></a> [title](#input\_title) | n/a | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_section"></a> [section](#output\_section) | n/a |
+<!-- END_TF_DOCS -->
diff --git a/modules/dashboard/sections/http/README.md b/modules/dashboard/sections/http/README.md
new file mode 100644
index 00000000..3398dc60
--- /dev/null
+++ b/modules/dashboard/sections/http/README.md
@@ -0,0 +1,39 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_collapsible"></a> [collapsible](#module\_collapsible) | ../collapsible | n/a |
+| <a name="module_incoming_latency"></a> [incoming\_latency](#module\_incoming\_latency) | ../../widgets/latency | n/a |
+| <a name="module_outbound_request_count"></a> [outbound\_request\_count](#module\_outbound\_request\_count) | ../../widgets/xy | n/a |
+| <a name="module_outbound_request_latency"></a> [outbound\_request\_latency](#module\_outbound\_request\_latency) | ../../widgets/latency | n/a |
+| <a name="module_request_count"></a> [request\_count](#module\_request\_count) | ../../widgets/xy | n/a |
+| <a name="module_width"></a> [width](#module\_width) | ../width | n/a |
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_collapsed"></a> [collapsed](#input\_collapsed) | n/a | `bool` | `false` | no |
+| <a name="input_filter"></a> [filter](#input\_filter) | n/a | `list(string)` | n/a | yes |
+| <a name="input_service_name"></a> [service\_name](#input\_service\_name) | n/a | `string` | n/a | yes |
+| <a name="input_title"></a> [title](#input\_title) | n/a | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_section"></a> [section](#output\_section) | n/a |
+<!-- END_TF_DOCS -->
diff --git a/modules/dashboard/sections/layout/README.md b/modules/dashboard/sections/layout/README.md
new file mode 100644
index 00000000..6eb07f0a
--- /dev/null
+++ b/modules/dashboard/sections/layout/README.md
@@ -0,0 +1,31 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_width"></a> [width](#module\_width) | ../width | n/a |
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_sections"></a> [sections](#input\_sections) | n/a | `any` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_tiles"></a> [tiles](#output\_tiles) | n/a |
+<!-- END_TF_DOCS -->
diff --git a/modules/dashboard/sections/logs/README.md b/modules/dashboard/sections/logs/README.md
new file mode 100644
index 00000000..7bf40eed
--- /dev/null
+++ b/modules/dashboard/sections/logs/README.md
@@ -0,0 +1,35 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_collapsible"></a> [collapsible](#module\_collapsible) | ../collapsible | n/a |
+| <a name="module_logs"></a> [logs](#module\_logs) | ../../widgets/logs | n/a |
+| <a name="module_width"></a> [width](#module\_width) | ../width | n/a |
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_collapsed"></a> [collapsed](#input\_collapsed) | n/a | `bool` | `true` | no |
+| <a name="input_filter"></a> [filter](#input\_filter) | n/a | `list(string)` | n/a | yes |
+| <a name="input_title"></a> [title](#input\_title) | n/a | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_section"></a> [section](#output\_section) | n/a |
+<!-- END_TF_DOCS -->
diff --git a/modules/dashboard/sections/resources/README.md b/modules/dashboard/sections/resources/README.md
new file mode 100644
index 00000000..9fe8252d
--- /dev/null
+++ b/modules/dashboard/sections/resources/README.md
@@ -0,0 +1,40 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_collapsible"></a> [collapsible](#module\_collapsible) | ../collapsible | n/a |
+| <a name="module_cpu_utilization"></a> [cpu\_utilization](#module\_cpu\_utilization) | ../../widgets/xy | n/a |
+| <a name="module_instance_count"></a> [instance\_count](#module\_instance\_count) | ../../widgets/xy | n/a |
+| <a name="module_memory_utilization"></a> [memory\_utilization](#module\_memory\_utilization) | ../../widgets/xy | n/a |
+| <a name="module_received_bytes"></a> [received\_bytes](#module\_received\_bytes) | ../../widgets/xy | n/a |
+| <a name="module_sent_bytes"></a> [sent\_bytes](#module\_sent\_bytes) | ../../widgets/xy | n/a |
+| <a name="module_startup_latency"></a> [startup\_latency](#module\_startup\_latency) | ../../widgets/xy | n/a |
+| <a name="module_width"></a> [width](#module\_width) | ../width | n/a |
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_collapsed"></a> [collapsed](#input\_collapsed) | n/a | `bool` | `false` | no |
+| <a name="input_filter"></a> [filter](#input\_filter) | n/a | `list(string)` | n/a | yes |
+| <a name="input_title"></a> [title](#input\_title) | n/a | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_section"></a> [section](#output\_section) | n/a |
+<!-- END_TF_DOCS -->
diff --git a/modules/dashboard/sections/subscription/README.md b/modules/dashboard/sections/subscription/README.md
new file mode 100644
index 00000000..e92c500a
--- /dev/null
+++ b/modules/dashboard/sections/subscription/README.md
@@ -0,0 +1,37 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_collapsible"></a> [collapsible](#module\_collapsible) | ../collapsible | n/a |
+| <a name="module_oldest-unacked"></a> [oldest-unacked](#module\_oldest-unacked) | ../../widgets/xy | n/a |
+| <a name="module_push-latency"></a> [push-latency](#module\_push-latency) | ../../widgets/latency | n/a |
+| <a name="module_received-events"></a> [received-events](#module\_received-events) | ../../widgets/xy | n/a |
+| <a name="module_width"></a> [width](#module\_width) | ../width | n/a |
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_collapsed"></a> [collapsed](#input\_collapsed) | n/a | `bool` | `false` | no |
+| <a name="input_subscription_prefix"></a> [subscription\_prefix](#input\_subscription\_prefix) | n/a | `string` | n/a | yes |
+| <a name="input_title"></a> [title](#input\_title) | n/a | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_section"></a> [section](#output\_section) | n/a |
+<!-- END_TF_DOCS -->
diff --git a/modules/dashboard/sections/topic/README.md b/modules/dashboard/sections/topic/README.md
new file mode 100644
index 00000000..7bf17ada
--- /dev/null
+++ b/modules/dashboard/sections/topic/README.md
@@ -0,0 +1,40 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_collapsible"></a> [collapsible](#module\_collapsible) | ../collapsible | n/a |
+| <a name="module_oldest-unacked"></a> [oldest-unacked](#module\_oldest-unacked) | ../../widgets/xy | n/a |
+| <a name="module_push-latency"></a> [push-latency](#module\_push-latency) | ../../widgets/latency | n/a |
+| <a name="module_received-events"></a> [received-events](#module\_received-events) | ../../widgets/xy | n/a |
+| <a name="module_send-latency"></a> [send-latency](#module\_send-latency) | ../../widgets/latency | n/a |
+| <a name="module_sent-events"></a> [sent-events](#module\_sent-events) | ../../widgets/xy | n/a |
+| <a name="module_topic-oldest-unacked"></a> [topic-oldest-unacked](#module\_topic-oldest-unacked) | ../../widgets/xy | n/a |
+| <a name="module_width"></a> [width](#module\_width) | ../width | n/a |
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_collapsed"></a> [collapsed](#input\_collapsed) | n/a | `bool` | `false` | no |
+| <a name="input_title"></a> [title](#input\_title) | n/a | `string` | n/a | yes |
+| <a name="input_topic_prefix"></a> [topic\_prefix](#input\_topic\_prefix) | n/a | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_section"></a> [section](#output\_section) | n/a |
+<!-- END_TF_DOCS -->
diff --git a/modules/dashboard/sections/width/README.md b/modules/dashboard/sections/width/README.md
new file mode 100644
index 00000000..2431dff4
--- /dev/null
+++ b/modules/dashboard/sections/width/README.md
@@ -0,0 +1,27 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+No modules.
+
+## Resources
+
+No resources.
+
+## Inputs
+
+No inputs.
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_size"></a> [size](#output\_size) | n/a |
+<!-- END_TF_DOCS -->
diff --git a/modules/dashboard/service/README.md b/modules/dashboard/service/README.md
index c0c17b60..34f6b4d4 100644
--- a/modules/dashboard/service/README.md
+++ b/modules/dashboard/service/README.md
@@ -1,13 +1,14 @@
 # `dashboard/service`
 
-This module provisions a Google Cloud Monitoring dashboard for a regionalized Cloud Run service.
+This module provisions a Google Cloud Monitoring dashboard for a regionalized
+Cloud Run service.
 
 It assumes the service has the same name in all regions.
 
 ```hcl
 // Create a network with several regional subnets
 module "networking" {
-  source = "chainguard-dev/common/infra//networking"
+  source = "chainguard-dev/common/infra//modules/networking"
 
   name       = "my-networking"
   project_id = var.project_id
@@ -16,7 +17,7 @@ module "networking" {
 
 // Run a regionalized cloud run service "frontend" to serve requests.
 module "frontend" {
-  source = "chainguard-dev/common/infra//regional-go-service"
+  source = "chainguard-dev/common/infra//modules/regional-go-service"
 
   project_id = var.project_id
   name       = "frontend"
@@ -36,12 +37,14 @@ module "frontend" {
 
 // Set up a dashboard for a regionalized service named "frontend".
 module "service-dashboard" {
-  source       = "chainguard-dev/common/infra//dashboard/service"
+  source       = "chainguard-dev/common/infra//modules/dashboard/service"
   service_name = "frontend"
 }
 ```
 
-The dashboard it creates includes widgets for service logs, request count, latency (p50,p95,p99), instance count grouped by revision, CPU and memory utilization, startup latency, and sent/received bytes.
+The dashboard it creates includes widgets for service logs, request count,
+latency (p50,p95,p99), instance count grouped by revision, CPU and memory
+utilization, startup latency, and sent/received bytes.
 
 <!-- BEGIN_TF_DOCS -->
 ## Requirements
diff --git a/modules/dashboard/widgets/alert/README.md b/modules/dashboard/widgets/alert/README.md
new file mode 100644
index 00000000..a3a927cd
--- /dev/null
+++ b/modules/dashboard/widgets/alert/README.md
@@ -0,0 +1,30 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+No modules.
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_alert_name"></a> [alert\_name](#input\_alert\_name) | n/a | `string` | n/a | yes |
+| <a name="input_title"></a> [title](#input\_title) | n/a | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_widget"></a> [widget](#output\_widget) | https://cloud.google.com/monitoring/api/ref_v3/rest/v1/projects.dashboards#AlertChart |
+<!-- END_TF_DOCS -->
diff --git a/modules/dashboard/widgets/latency/README.md b/modules/dashboard/widgets/latency/README.md
new file mode 100644
index 00000000..1bbc4530
--- /dev/null
+++ b/modules/dashboard/widgets/latency/README.md
@@ -0,0 +1,31 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+No modules.
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_filter"></a> [filter](#input\_filter) | n/a | `list(string)` | n/a | yes |
+| <a name="input_group_by_fields"></a> [group\_by\_fields](#input\_group\_by\_fields) | n/a | `list` | `[]` | no |
+| <a name="input_title"></a> [title](#input\_title) | n/a | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_widget"></a> [widget](#output\_widget) | https://cloud.google.com/monitoring/api/ref_v3/rest/v1/projects.dashboards#XyChart |
+<!-- END_TF_DOCS -->
diff --git a/modules/dashboard/widgets/logs/README.md b/modules/dashboard/widgets/logs/README.md
new file mode 100644
index 00000000..da204273
--- /dev/null
+++ b/modules/dashboard/widgets/logs/README.md
@@ -0,0 +1,30 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+No modules.
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_filter"></a> [filter](#input\_filter) | n/a | `list(string)` | n/a | yes |
+| <a name="input_title"></a> [title](#input\_title) | n/a | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_widget"></a> [widget](#output\_widget) | https://cloud.google.com/monitoring/api/ref_v3/rest/v1/projects.dashboards#LogsPanel |
+<!-- END_TF_DOCS -->
diff --git a/modules/dashboard/widgets/markdown/README.md b/modules/dashboard/widgets/markdown/README.md
new file mode 100644
index 00000000..23c8ab26
--- /dev/null
+++ b/modules/dashboard/widgets/markdown/README.md
@@ -0,0 +1,30 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+No modules.
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_content"></a> [content](#input\_content) | n/a | `string` | n/a | yes |
+| <a name="input_title"></a> [title](#input\_title) | n/a | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_widget"></a> [widget](#output\_widget) | https://cloud.google.com/monitoring/api/ref_v3/rest/v1/projects.dashboards#Text |
+<!-- END_TF_DOCS -->
diff --git a/modules/dashboard/widgets/xy/README.md b/modules/dashboard/widgets/xy/README.md
new file mode 100644
index 00000000..35b7360b
--- /dev/null
+++ b/modules/dashboard/widgets/xy/README.md
@@ -0,0 +1,37 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+No modules.
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_alignment_period"></a> [alignment\_period](#input\_alignment\_period) | n/a | `string` | `"60s"` | no |
+| <a name="input_filter"></a> [filter](#input\_filter) | n/a | `list(string)` | n/a | yes |
+| <a name="input_group_by_fields"></a> [group\_by\_fields](#input\_group\_by\_fields) | n/a | `list` | `[]` | no |
+| <a name="input_plot_type"></a> [plot\_type](#input\_plot\_type) | n/a | `string` | `"LINE"` | no |
+| <a name="input_primary_align"></a> [primary\_align](#input\_primary\_align) | n/a | `string` | `"ALIGN_RATE"` | no |
+| <a name="input_primary_reduce"></a> [primary\_reduce](#input\_primary\_reduce) | n/a | `string` | `"REDUCE_NONE"` | no |
+| <a name="input_secondary_align"></a> [secondary\_align](#input\_secondary\_align) | n/a | `string` | `"ALIGN_NONE"` | no |
+| <a name="input_secondary_reduce"></a> [secondary\_reduce](#input\_secondary\_reduce) | n/a | `string` | `"REDUCE_NONE"` | no |
+| <a name="input_title"></a> [title](#input\_title) | n/a | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_widget"></a> [widget](#output\_widget) | https://cloud.google.com/monitoring/api/ref_v3/rest/v1/projects.dashboards#XyChart |
+<!-- END_TF_DOCS -->
diff --git a/modules/networking/README.md b/modules/networking/README.md
index fdd189a4..5cabe8ab 100644
--- a/modules/networking/README.md
+++ b/modules/networking/README.md
@@ -1,7 +1,8 @@
 # `networking`
 
 This module sets up GCP networking suitable for operating Cloud Run services
-utilizing the preview [Direct VPC egress](https://cloud.google.com/run/docs/configuring/vpc-direct-vpc)
+utilizing the preview
+[Direct VPC egress](https://cloud.google.com/run/docs/configuring/vpc-direct-vpc)
 feature to talk to other "internal ingress" Cloud Run services, and access other
 GCP resources that live within or are accessible via the provisioned network.
 The intended usage of this module:
@@ -9,7 +10,7 @@ The intended usage of this module:
 ```hcl
 // Create a network with several regional subnets
 module "networking" {
-  source = "chainguard-dev/common/infra//networking"
+  source = "chainguard-dev/common/infra//modules/networking"
 
   name       = "my-networking"
   project_id = var.project_id
diff --git a/modules/otel-collector/README.md b/modules/otel-collector/README.md
index 75127e87..5ea56d30 100644
--- a/modules/otel-collector/README.md
+++ b/modules/otel-collector/README.md
@@ -6,7 +6,7 @@ to write those metrics (so it's impossible to forget):
 
 ```
 module "otel-collector" {
-  source = "chainguard-dev/common/infra//otel-collector"
+  source = "chainguard-dev/common/infra//modules/otel-collector"
 
   project_id      = var.project_id
   service_account = google_service_account.this.email
diff --git a/modules/regional-go-service/README.md b/modules/regional-go-service/README.md
index c9808163..82cd7543 100644
--- a/modules/regional-go-service/README.md
+++ b/modules/regional-go-service/README.md
@@ -1,13 +1,13 @@
 # `regional-go-service`
 
-This module provisions a regionalizied Go Cloud Run service.  The Go code is
-built and signed using the `ko` and `cosign` providers.  The simplest example
+This module provisions a regionalizied Go Cloud Run service. The Go code is
+built and signed using the `ko` and `cosign` providers. The simplest example
 service can be seen here:
 
 ```hcl
 // Create a network with several regional subnets
 module "networking" {
-  source = "chainguard-dev/common/infra//networking"
+  source = "chainguard-dev/common/infra//modules/networking"
 
   name       = "my-networking"
   project_id = var.project_id
@@ -15,7 +15,7 @@ module "networking" {
 }
 
 module "foo-service" {
-  source = "chainguard-dev/common/infra//regional-go-service"
+  source = "chainguard-dev/common/infra//modules/regional-go-service"
 
   project_id = var.project_id
   name       = "foo"
@@ -36,21 +36,25 @@ module "foo-service" {
 
 The module is intended to encapsulate Chainguard best practices around deploying
 Cloud Run services including:
+
 - More secure default for ingress
 - More secure default for egress
-- Intentionally not exposing a `uri` output (use [`authorize-private-service`](../authorize-private-service/README.md))
+- Intentionally not exposing a `uri` output (use
+  [`authorize-private-service`](../authorize-private-service/README.md))
 - Requiring a service-account name to run as (so as not to use the default
-compute service account!)
+  compute service account!)
 - Running an `otel-collector` sidecar container that can collect and publish
-telemetry data from out services (for use with the dashboard modules).
+  telemetry data from out services (for use with the dashboard modules).
 
 For the most part, we have tried to expose a roughly compatible shape to the
 cloud run v2 service itself, with two primary changes:
+
 1. Instead of an `image` string we take a `source` object to feed to `ko_build`,
 2. In addition to `env` we support `regional-env`, where the value is a map from
-region to regional value.  This can be used to pass different environment values
-to services based on the region they are running in (e.g. `cloudevent-broker`
-ingress endpoint or another regionalized service's localized URI).
+   region to regional value. This can be used to pass different environment
+   values to services based on the region they are running in (e.g.
+   `cloudevent-broker` ingress endpoint or another regionalized service's
+   localized URI).
 
 <!-- BEGIN_TF_DOCS -->
 ## Requirements