From 5c38b0631aa758f5dd80838a761d66cc7472054c Mon Sep 17 00:00:00 2001 From: Timothy Kim Date: Mon, 16 Mar 2026 00:55:13 -0400 Subject: [PATCH] replace NPM with vanilla nginx + certbot - nginx:alpine replaces nginx-proxy-manager - certbot on host with standalone issuance and auto-renewal - per-site nginx configs in conf.d/ (HTTP->HTTPS, bare->www) - container names use underscores (timothykim_net) - setup.sh: automated cert issuance, dynamic app startup - deploy.sh: nginx -t guard, graceful image-not-found - new-app.sh: Gitea API repo creation, nginx conf generation - add ARCHITECTURE.md, USECASES.md, CLAUDE.md - remove old NPM data/certs from tracking --- .gitattributes | 3 - .gitignore | 4 +- ARCHITECTURE.md | 121 +++++++++++++++ CLAUDE.md | 72 +++++++++ README.md | 136 ++++++++++------- USECASES.md | 141 ++++++++++++++++++ .../meta.json | Bin 94 -> 0 bytes .../private_key.json | Bin 1654 -> 0 bytes .../regr.json | Bin 102 -> 0 bytes docker/nginx/certs/archive/npm-1/cert1.pem | Bin 1376 -> 0 bytes docker/nginx/certs/archive/npm-1/chain1.pem | Bin 1588 -> 0 bytes .../nginx/certs/archive/npm-1/fullchain1.pem | Bin 2942 -> 0 bytes docker/nginx/certs/archive/npm-1/privkey1.pem | Bin 328 -> 0 bytes docker/nginx/certs/archive/npm-2/cert1.pem | Bin 1344 -> 0 bytes docker/nginx/certs/archive/npm-2/chain1.pem | Bin 1588 -> 0 bytes .../nginx/certs/archive/npm-2/fullchain1.pem | Bin 2910 -> 0 bytes docker/nginx/certs/archive/npm-2/privkey1.pem | Bin 328 -> 0 bytes docker/nginx/certs/archive/npm-3/cert1.pem | Bin 1356 -> 0 bytes docker/nginx/certs/archive/npm-3/chain1.pem | Bin 1588 -> 0 bytes .../nginx/certs/archive/npm-3/fullchain1.pem | Bin 2922 -> 0 bytes docker/nginx/certs/archive/npm-3/privkey1.pem | Bin 328 -> 0 bytes docker/nginx/certs/live/README | Bin 762 -> 0 bytes docker/nginx/certs/live/npm-1/README | Bin 714 -> 0 bytes docker/nginx/certs/live/npm-1/cert.pem | 1 - docker/nginx/certs/live/npm-1/chain.pem | 1 - docker/nginx/certs/live/npm-1/fullchain.pem | 1 - docker/nginx/certs/live/npm-1/privkey.pem | 1 - docker/nginx/certs/live/npm-2/README | Bin 714 -> 0 bytes docker/nginx/certs/live/npm-2/cert.pem | 1 - docker/nginx/certs/live/npm-2/chain.pem | 1 - docker/nginx/certs/live/npm-2/fullchain.pem | 1 - docker/nginx/certs/live/npm-2/privkey.pem | 1 - docker/nginx/certs/live/npm-3/README | Bin 714 -> 0 bytes docker/nginx/certs/live/npm-3/cert.pem | 1 - docker/nginx/certs/live/npm-3/chain.pem | 1 - docker/nginx/certs/live/npm-3/fullchain.pem | 1 - docker/nginx/certs/live/npm-3/privkey.pem | 1 - docker/nginx/certs/renewal/npm-1.conf | Bin 767 -> 0 bytes docker/nginx/certs/renewal/npm-2.conf | Bin 663 -> 0 bytes docker/nginx/certs/renewal/npm-3.conf | Bin 663 -> 0 bytes docker/nginx/compose.yml | 13 +- docker/nginx/conf.d/timothykim.net.conf | 48 ++++++ docker/nginx/data/database.sqlite | Bin 106518 -> 0 bytes docker/nginx/data/keys.json | Bin 2212 -> 0 bytes .../nginx/data/nginx/default_host/site.conf | 20 --- docker/nginx/data/nginx/proxy_host/1.conf | 97 ------------ docker/nginx/data/nginx/proxy_host/2.conf | 98 ------------ docker/nginx/nginx.conf | 20 +++ docker/timothykim.net/compose.yml | 2 +- scripts/deploy.sh | 15 +- scripts/new-app.sh | 128 +++++++++++++++- setup.sh | 58 ++++++- 52 files changed, 681 insertions(+), 307 deletions(-) create mode 100644 ARCHITECTURE.md create mode 100644 CLAUDE.md create mode 100644 USECASES.md delete mode 100644 docker/nginx/certs/accounts/acme-v02.api.letsencrypt.org/directory/ba6ee99ad413477b2770a56352d98492/meta.json delete mode 100644 docker/nginx/certs/accounts/acme-v02.api.letsencrypt.org/directory/ba6ee99ad413477b2770a56352d98492/private_key.json delete mode 100644 docker/nginx/certs/accounts/acme-v02.api.letsencrypt.org/directory/ba6ee99ad413477b2770a56352d98492/regr.json delete mode 100644 docker/nginx/certs/archive/npm-1/cert1.pem delete mode 100644 docker/nginx/certs/archive/npm-1/chain1.pem delete mode 100644 docker/nginx/certs/archive/npm-1/fullchain1.pem delete mode 100644 docker/nginx/certs/archive/npm-1/privkey1.pem delete mode 100644 docker/nginx/certs/archive/npm-2/cert1.pem delete mode 100644 docker/nginx/certs/archive/npm-2/chain1.pem delete mode 100644 docker/nginx/certs/archive/npm-2/fullchain1.pem delete mode 100644 docker/nginx/certs/archive/npm-2/privkey1.pem delete mode 100644 docker/nginx/certs/archive/npm-3/cert1.pem delete mode 100644 docker/nginx/certs/archive/npm-3/chain1.pem delete mode 100644 docker/nginx/certs/archive/npm-3/fullchain1.pem delete mode 100644 docker/nginx/certs/archive/npm-3/privkey1.pem delete mode 100644 docker/nginx/certs/live/README delete mode 100644 docker/nginx/certs/live/npm-1/README delete mode 120000 docker/nginx/certs/live/npm-1/cert.pem delete mode 120000 docker/nginx/certs/live/npm-1/chain.pem delete mode 120000 docker/nginx/certs/live/npm-1/fullchain.pem delete mode 120000 docker/nginx/certs/live/npm-1/privkey.pem delete mode 100644 docker/nginx/certs/live/npm-2/README delete mode 120000 docker/nginx/certs/live/npm-2/cert.pem delete mode 120000 docker/nginx/certs/live/npm-2/chain.pem delete mode 120000 docker/nginx/certs/live/npm-2/fullchain.pem delete mode 120000 docker/nginx/certs/live/npm-2/privkey.pem delete mode 100644 docker/nginx/certs/live/npm-3/README delete mode 120000 docker/nginx/certs/live/npm-3/cert.pem delete mode 120000 docker/nginx/certs/live/npm-3/chain.pem delete mode 120000 docker/nginx/certs/live/npm-3/fullchain.pem delete mode 120000 docker/nginx/certs/live/npm-3/privkey.pem delete mode 100644 docker/nginx/certs/renewal/npm-1.conf delete mode 100644 docker/nginx/certs/renewal/npm-2.conf delete mode 100644 docker/nginx/certs/renewal/npm-3.conf create mode 100644 docker/nginx/conf.d/timothykim.net.conf delete mode 100644 docker/nginx/data/database.sqlite delete mode 100644 docker/nginx/data/keys.json delete mode 100644 docker/nginx/data/nginx/default_host/site.conf delete mode 100644 docker/nginx/data/nginx/proxy_host/1.conf delete mode 100644 docker/nginx/data/nginx/proxy_host/2.conf create mode 100644 docker/nginx/nginx.conf diff --git a/.gitattributes b/.gitattributes index 69319bd..8b13789 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,4 +1 @@ -docker/nginx/certs/** filter=git-crypt diff=git-crypt -docker/nginx/data/keys.json filter=git-crypt diff=git-crypt -docker/nginx/data/database.sqlite filter=git-crypt diff=git-crypt diff --git a/.gitignore b/.gitignore index f0dac19..3996f56 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,5 @@ containerd/ vultr/ -docker/nginx/data/logs/ +docker/nginx/data/ +docker/nginx/certs/ +docker/nginx/certbot/ diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md new file mode 100644 index 0000000..4c9a94c --- /dev/null +++ b/ARCHITECTURE.md @@ -0,0 +1,121 @@ +# Architecture + +## Servers + +### Hantim server (hantim) + +The production application server. Runs Rocky Linux 9 on Vultr. + +- Hosts all app containers and the nginx reverse proxy via Docker Compose +- Provisioned by `setup.sh` in this repo +- This repo is cloned to `/opt/hantim` +- The `deploy` user receives SSH commands from CI to trigger deploys +- Certbot runs on the host (not in Docker) and manages Let's Encrypt certs + +### Gitea server (git.timothykim.net) + +A separate server running the Gitea instance. Provides: + +- Git hosting for all repos +- Docker container registry (`git.timothykim.net/hantim/`) +- Gitea Actions CI/CD (runner registered at site level) +- Organization-level secrets and variables shared across repos + +### Bitwarden (cloud) + +Bitwarden free tier is used as the secret store. Stores: + +- `hantim-git-crypt-key` -- git-crypt symmetric key (Secure Note, base64) +- `hantim-ci-registry-push` -- Gitea API token for registry access (Secure Note) +- `hantim-server-deploy` -- deploy user SSH key pair (SSH Key) +- `hantim-new-app-script` -- Gitea API token for creating repos (Secure Note) + +The Bitwarden CLI (`bw`) is used in `setup.sh` (on the server) and +`new-app.sh` (on dev machines) to fetch secrets at runtime. + +## Repos + +All repos live under the `hantim` organization on Gitea. + +### hantim-server + +This repo. Contains server provisioning, Docker Compose configs, nginx +configs, deploy scripts, and Gitea Actions workflows. + +``` +setup.sh # Server provisioning (idempotent) +scripts/deploy.sh # Receives deploy commands via SSH +scripts/new-app.sh # Scaffolds a new app (Gitea repo + local files) +docker/nginx/ # nginx reverse proxy + compose.yml # nginx:alpine container + nginx.conf # Main nginx config + conf.d/.conf # Per-app server blocks +docker//compose.yml # Per-app compose files +.gitea/workflows/deploy-.yml # Per-app deploy workflows +``` + +### static-site-template + +A Gitea template repo used by `new-app.sh` to scaffold new static sites. +Contains a Dockerfile, nginx config, placeholder HTML, and a `build.yml` +workflow that builds/pushes a Docker image and triggers a deploy. + +Uses Gitea template variables (`${REPO_NAME}`) so the image tag and deploy +command are automatically set to the repo name. + +### App repos (e.g., timothykim.net) + +Each app is its own repo created from `static-site-template`. Contains the +app source code and a `build.yml` workflow. + +## Network topology + +``` + Internet + | + [Hantim Server] + | + nginx (port 80/443) + | | + timothykim_net hcsuzuki_net ... + (shared Docker network) +``` + +- nginx is the only container with host port bindings (80, 443) +- All app containers are on the `shared` Docker network +- nginx proxies `https://www.` to the app's container by name +- The `shared` network is created by the nginx compose file and referenced + as `external: true` by app compose files + +## Deploy flow + +### App code change (push to app repo) + +``` +Developer pushes to app repo (e.g., timothykim.net) + -> build.yml workflow runs on Gitea runner + -> docker build + push to git.timothykim.net registry + -> SSH to deploy@hantim as deploy- + -> deploy.sh: git pull, docker compose pull, docker compose up -d + -> (if image not yet in registry, skips gracefully) +``` + +### Infrastructure change (push to hantim-server) + +``` +Developer pushes to hantim-server + -> deploy-.yml triggers (based on changed paths under docker//) + -> SSH to deploy@hantim as deploy- + -> deploy.sh: git pull, docker compose pull, docker compose up -d + -> (nginx only): test config with nginx -t before applying +``` + +## Conventions + +- **App name = domain** (e.g., `hcsuzuki.net`) +- **Container name** = domain with dots replaced by underscores (e.g., + `hcsuzuki_net`) +- **Cert name** = domain (stored at `/etc/letsencrypt/live//`) +- **Image name** = `git.timothykim.net/hantim/:latest` +- All HTTP traffic redirects to `https://www.` +- Bare domain HTTPS redirects to `https://www.` diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 0000000..0faf761 --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1,72 @@ +# CLAUDE.md + +## Project overview + +Server provisioning and app management for the hantim webserver. This repo +lives at `/opt/hantim` on the production server (Rocky Linux 9 on Vultr) and +manages Docker Compose configs, deploy scripts, nginx configs, and Gitea +Actions workflows. + +## Key files + +- `setup.sh` -- Server provisioning (idempotent, run as root) +- `scripts/deploy.sh` -- SSH-triggered deploy (validates command, pulls, restarts) +- `scripts/new-app.sh` -- Scaffolds a new static site (Gitea repo + compose + workflow + nginx conf) +- `docker/nginx/` -- Reverse proxy (nginx:alpine + certbot on host) +- `docker//compose.yml` -- Per-app compose files +- `.gitea/workflows/deploy-.yml` -- Per-app deploy workflows + +## Conventions + +- **App name = domain** (e.g., `hcsuzuki.net`) +- **Container name** = domain with dots replaced by underscores (e.g., `hcsuzuki_net`) +- **Image** = `git.timothykim.net/hantim/:latest` +- **Cert name** = domain (at `/etc/letsencrypt/live//`) +- All HTTP redirects to HTTPS; bare domain redirects to `www.` +- The `shared` Docker network is created by nginx compose and used by all apps + +## Secrets + +Stored in Bitwarden (free tier), fetched via `bw` CLI: +- `hantim-git-crypt-key` -- Secure Note (base64) +- `hantim-ci-registry-push` -- Secure Note (Gitea registry token) +- `hantim-server-deploy` -- SSH Key (deploy user key pair) +- `hantim-new-app-script` -- Secure Note (Gitea API token for creating repos) + +Gitea org-level (`hantim`) secrets/variables: +- `DEPLOY_HOST` -- Variable (server IP) +- `DEPLOY_SSH_KEY` -- Secret (deploy SSH private key) +- `CI_REGISTRY_TOKEN` -- Secret (registry token) + +## Working with this repo + +### Adding a new app + +Run `./scripts/new-app.sh ` from dev machine, then issue SSL cert on +server **before** pushing. See USECASES.md for full steps. + +### Editing scripts + +All shell scripts use `set -euo pipefail`. Keep all steps idempotent. +`setup.sh` must be safe to re-run on an existing server. + +### Deploy flow + +App repo push -> `build.yml` builds image, pushes to registry, SSHes to server +-> `deploy.sh` pulls repo, pulls image, restarts container. + +Infrastructure push (this repo) -> `deploy-.yml` triggers on path match +-> same `deploy.sh` flow. nginx deploys test config with `nginx -t` first. + +## Build and test + +No build step. No tests. Verify changes by: +1. Reading scripts and checking idempotency +2. Walking through each use case in USECASES.md +3. Cross-checking documentation (README.md, ARCHITECTURE.md, USECASES.md) against scripts + +## Commit style + +- Short, lowercase commit messages (e.g., "add hcsuzuki.net", "fix deploy command") +- Do NOT include "Co-Authored-By" lines +- Commit only when explicitly asked diff --git a/README.md b/README.md index 2dfd8e1..1da162f 100644 --- a/README.md +++ b/README.md @@ -2,24 +2,28 @@ Server provisioning and app management for the hantim webserver. This repo lives at `/opt/hantim` on the server and contains Docker Compose configs, deploy -scripts, and Gitea Actions workflows for each app. +scripts, nginx configs, and Gitea Actions workflows for each app. ## Repo structure ``` -docker/ # One directory per app, each with a compose.yml - nginx/ # Nginx Proxy Manager (reverse proxy + TLS) - timothykim.net/ # timothykim.net static site +docker/ + nginx/ # Reverse proxy (nginx:alpine) + SSL config + nginx.conf # Main nginx config + conf.d/ # Per-app server blocks (e.g. timothykim.net.conf) + compose.yml + timothykim.net/ # timothykim.net static site + compose.yml scripts/ - deploy.sh # Deploy script (validates command, git pull, docker compose up) - new-app.sh # Scaffolding script to add a new app -setup.sh # One-time server provisioning script -.gitea/workflows/ # Per-app deploy workflows triggered by path changes + deploy.sh # Deploy script (validates command, git pull, docker compose up) + new-app.sh # Scaffolding script to add a new app +setup.sh # Server provisioning script (idempotent) +.gitea/workflows/ # Per-app deploy workflows triggered by path changes ``` -## Initial server setup +## Provisioning a new server -On a fresh Rocky Linux 9 (or compatible) install: +On a fresh Rocky Linux 9 install: ```bash dnf install -y git @@ -27,69 +31,87 @@ git clone https://git.timothykim.net/hantim/hantim-server.git /opt/hantim bash /opt/hantim/setup.sh ``` -`setup.sh` handles everything else: installs git-crypt and the Bitwarden CLI, -fetches the git-crypt key from your Bitwarden vault (stored as a base64-encoded -secure note named `hantim-git-crypt-key`), unlocks the repo, installs Docker, -creates the `deploy` user, and starts all services. +`setup.sh` is fully automated and idempotent. It: -To save the git-crypt key to Bitwarden (one-time, from your dev machine): +1. Installs system dependencies (git-crypt, jq, certbot, Node.js 20, Docker) +2. Installs and authenticates the Bitwarden CLI +3. Unlocks git-crypt using a key stored in Bitwarden +4. Fetches the Docker registry token and deploy SSH public key from Bitwarden +5. Logs into the Gitea Docker registry +6. Creates the `deploy` user with restricted SSH access and sudo +7. Issues SSL certificates via certbot for all configured domains +8. Starts all services (nginx first, then all apps) -```bash -base64 /path/to/git-crypt-key -# Save the output as a Bitwarden secure note named "hantim-git-crypt-key" -``` - -## How deploys work - -Each app has two components: - -1. **Gitea Actions workflow** (`.gitea/workflows/deploy-.yml`) -- triggers - on pushes to `main` when files under `docker//` change. SSHes into the - server as the `deploy` user to trigger the deploy. -2. **Deploy script** (`scripts/deploy.sh`) -- the `deploy` user's - `authorized_keys` is locked to this script via a `command=` directive. It - validates the command, pulls the latest repo changes, and runs - `docker compose pull && up -d` for that app. - -This means: - -- Pushing a change to `docker/nginx/compose.yml` only deploys nginx. -- Pushing a change to `scripts/` or `setup.sh` does not trigger any deploy. -- Each app deploys independently. +**Prerequisites**: DNS for all configured domains must point to the server +before running setup. ## Adding a new app -Run the scaffolding script: - ```bash -./scripts/new-app.sh +./scripts/new-app.sh ``` +Example: `./scripts/new-app.sh hcsuzuki.net` + This creates: -- `docker//compose.yml` -- a starter compose file on the `shared` - network -- `.gitea/workflows/deploy-.yml` -- the Gitea Actions workflow +- A Gitea repo (`hantim/`) from the `static-site-template` +- `docker//compose.yml` -- app compose file +- `.gitea/workflows/deploy-.yml` -- deploy workflow +- `docker/nginx/conf.d/.conf` -- nginx proxy config (HTTP->HTTPS, + bare domain->www) After running the script: -1. Edit `docker//compose.yml` to fit your app (image, ports, - volumes, environment variables, etc.). -2. Commit and push to `main`. -3. Configure the proxy host in Nginx Proxy Manager to route traffic to the new - service. +1. Issue the SSL cert on the server (**before** pushing): + ```bash + docker stop nginx + certbot certonly --standalone --non-interactive --agree-tos \ + --register-unsafely-without-email --cert-name \ + -d -d www. + docker start nginx + ``` +2. Commit and push this repo to deploy +3. Clone the new app repo, customize it, and push to build/deploy + +## Deploying changes + +**App code change** (push to an app repo like `timothykim.net`): +- The app's `build.yml` builds the Docker image, pushes to the registry, and + SSHes into the server to trigger a deploy + +**Compose or nginx config change** (push to this repo): +- Gitea Actions workflows trigger based on which `docker//` paths changed +- `deploy.sh` pulls the latest code and runs `docker compose up -d` +- For nginx deploys, the config is tested before applying to prevent downtime + +## Restoring from backup + +Run the same three commands as provisioning. `setup.sh` is idempotent: +- Existing packages are skipped +- Existing certs are skipped (or re-issued if the server is new) +- All services are started ## Secrets -Nginx Proxy Manager certs and Let's Encrypt account keys are encrypted with -git-crypt (see `.gitattributes`). You need the git-crypt key to unlock them. +The following are stored in Bitwarden and fetched automatically by `setup.sh`: -The following must be configured in the `hantim` Gitea org settings and are -shared across all repos: +| Bitwarden item | Type | Purpose | +|---|---|---| +| `hantim-git-crypt-key` | Secure Note | git-crypt symmetric key (base64) | +| `hantim-ci-registry-push` | Secure Note | Gitea token for Docker registry | +| `hantim-server-deploy` | SSH Key | Deploy user's SSH key | -Variables (Settings > Actions > Variables): -- `DEPLOY_HOST` -- the server's IP or hostname +The following are configured in the `hantim` Gitea org settings: -Secrets (Settings > Actions > Secrets): -- `DEPLOY_SSH_KEY` -- the SSH private key for the `deploy` user -- `CI_REGISTRY_TOKEN` -- Gitea personal access token for Docker registry login +| Name | Type | Purpose | +|---|---|---| +| `DEPLOY_HOST` | Variable | Server IP or hostname | +| `DEPLOY_SSH_KEY` | Secret | SSH private key for the deploy user | +| `CI_REGISTRY_TOKEN` | Secret | Gitea token for Docker registry login | + +The following is stored in Bitwarden and used by `new-app.sh`: + +| Bitwarden item | Type | Purpose | +|---|---|---| +| `hantim-new-app-script` | Secure Note | Gitea API token for creating repos | diff --git a/USECASES.md b/USECASES.md new file mode 100644 index 0000000..f00152b --- /dev/null +++ b/USECASES.md @@ -0,0 +1,141 @@ +# Use Cases + +## 1. Provision a new server + +Set up a fresh Rocky Linux 9 server from scratch. + +```bash +dnf install -y git +git clone https://git.timothykim.net/hantim/hantim-server.git /opt/hantim +bash /opt/hantim/setup.sh +``` + +**What happens:** +- Installs all dependencies (git-crypt, jq, certbot, Node.js 20, Docker, bw CLI) +- Fetches secrets from Bitwarden (git-crypt key, registry token, deploy SSH key) +- Unlocks git-crypt, logs into Docker registry +- Creates deploy user with restricted SSH + sudo +- Issues SSL certs for all domains in `docker/nginx/conf.d/` +- Starts nginx and all app containers + +**Prerequisites:** +- DNS for all configured domains must point to the server +- Bitwarden vault must contain: `hantim-git-crypt-key`, `hantim-ci-registry-push`, + `hantim-server-deploy` +- Docker images must exist in the Gitea registry (or apps will start on next push) + +## 2. Restore from backup + +Identical to provisioning a new server. Run the same three commands on a +fresh server. + +- `setup.sh` is idempotent -- safe to re-run +- SSL certs are re-issued automatically (Let's Encrypt) +- Docker images are pulled from the Gitea registry +- No data migration needed for stateless static sites + +## 3. Add a new static site + +From your dev machine: + +```bash +./scripts/new-app.sh hcsuzuki.net +``` + +Then on the server, issue the SSL cert **before** pushing: + +```bash +docker stop nginx +certbot certonly --standalone --non-interactive --agree-tos \ + --register-unsafely-without-email --cert-name hcsuzuki.net \ + -d hcsuzuki.net -d www.hcsuzuki.net +docker start nginx +``` + +Then commit and push this repo: + +```bash +git add docker/hcsuzuki.net/ .gitea/workflows/deploy-hcsuzuki.net.yml docker/nginx/conf.d/hcsuzuki.net.conf +git commit -m "add hcsuzuki.net" +git push +``` + +Finally, clone the new app repo, customize it, and push: + +```bash +git clone git@git.timothykim.net:hantim/hcsuzuki.net.git +cd hcsuzuki.net +# edit static/index.html, etc. +git add . && git commit -m "initial content" && git push +``` + +**What the script creates:** +- Gitea repo `hantim/hcsuzuki.net` (from `static-site-template`) +- `docker/hcsuzuki.net/compose.yml` (container name: `hcsuzuki_net`) +- `.gitea/workflows/deploy-hcsuzuki.net.yml` +- `docker/nginx/conf.d/hcsuzuki.net.conf` (HTTP->HTTPS, bare->www, proxy) + +## 4. Update app code + +Push a change to the app repo (e.g., `timothykim.net`): + +```bash +cd timothykim.net +# make changes +git add . && git commit -m "update content" && git push +``` + +**What happens:** +1. Gitea Actions runs `build.yml`: builds Docker image, pushes to registry +2. SSHes into server, runs `deploy-timothykim.net` +3. `deploy.sh` pulls latest hantim-server, pulls new image, restarts container + +No manual steps needed. + +## 5. Update Docker Compose config + +Edit a compose file in this repo and push: + +```bash +vim docker/timothykim.net/compose.yml +git add docker/timothykim.net/compose.yml +git commit -m "update timothykim.net config" +git push +``` + +**What happens:** +1. `deploy-timothykim.yml` workflow triggers (path match) +2. `deploy.sh` pulls latest code, pulls image, runs `docker compose up -d` + +## 6. Update nginx config + +Edit an nginx config in this repo and push: + +```bash +vim docker/nginx/conf.d/timothykim.net.conf +git add docker/nginx/conf.d/timothykim.net.conf +git commit -m "update nginx config" +git push +``` + +**What happens:** +1. `deploy-nginx.yml` workflow triggers (path match) +2. `deploy.sh` pulls latest code +3. Tests nginx config with `nginx -t` -- if it fails, deploy aborts and the + running nginx is untouched +4. Runs `docker compose up -d` and reloads nginx + +## 7. Re-run setup on existing server + +Safe to do at any time: + +```bash +cd /opt/hantim +git pull +bash setup.sh +``` + +- All steps are idempotent +- Existing certs are skipped +- Brief nginx downtime (seconds) while certbot checks run +- Services are restarted diff --git a/docker/nginx/certs/accounts/acme-v02.api.letsencrypt.org/directory/ba6ee99ad413477b2770a56352d98492/meta.json b/docker/nginx/certs/accounts/acme-v02.api.letsencrypt.org/directory/ba6ee99ad413477b2770a56352d98492/meta.json deleted file mode 100644 index 8fc35ffe4e5b7e03bfc440a25807bf1d51342093..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 94 zcmV-k0HOZ?M@dveQdv+`0Nlf>OArx~S(<_Dx*&G%QBtA0Gind=QOp3SW|8+pBkghM z;x4$tr)87JM=y+ AMgRZ+ diff --git a/docker/nginx/certs/accounts/acme-v02.api.letsencrypt.org/directory/ba6ee99ad413477b2770a56352d98492/private_key.json b/docker/nginx/certs/accounts/acme-v02.api.letsencrypt.org/directory/ba6ee99ad413477b2770a56352d98492/private_key.json deleted file mode 100644 index ba7ac577ec56441acbdec1e9adac4fcbb23d3f1a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1654 zcmV-+28sCqM@dveQdv+`0DO`cOq@ytuMzZ0dP$>+q*wa=;1Ve)(l4&PwRVb|!+a|d znYV`#JYs%VEU_82pKxZ&A8^EsBQg~V0Sp?yuhGxrG&&j)uM@lJk6?5wr(6H#wwRVzqx`%`OiA-U(wQSVR(7nT;R@~|Rq?F+%^~|cbHLJV=LwmM^$w^*i93;*q za{1G^<{VRyOeIrA2ONZ;uHWB{qw<#!xG$Nn9~8b2=i zdWi{-HCkx1MYb?b^*7Hh0|jZX2JF5^QMObyTBWY(mckEaO?z-yFb?lOeqZk)nT+Z8 z;HjUm8cOkZT0Q4m5wY6m{@eT>_fRm)sKZBT2serPlf}&(F zC@yL(y&#Ub`ninckEJ>420Z$KzCId`$Lyo4X8hSnnfN+(0MG^r6Zu-Jh<%vd-~cbv zBW*_VcVc^JvEOyXQ|pAp!om6Rk}pu~;83<`luV&TWMv!lNKN0ty3{Op_lc|4`b4Su znaH?mBw|p}Sax1%<`0_;=ov#O7trU`c($-~yRQ0$aI+bHsAU~bvEKE+HK6wbwR$;w zq=NMcdioY`$h;c$c})+)5(##r%IrpfQ}2#IH^o!lOuNOP#2|{{fVbp-5bs|0_BkdQ zB&T^NHxww{TTu6hkjD)-cuA38`OnGwp#e8Shf4bYJP$|t4IoD)Jb0}^Od9Vg>kQW0 zT#O{zSn|mQB46L-?d@&EQ)u`(=6cMF1oVR6;C@>d4uOjX_r3--pq5UBYzVNKf#*ZP zQa^oh_r&g|d1h*=-(+%hDwu>m3086g+2y^ny3h!h4L>Bqk2rcb4^KLR!SL7(sgdY? z`8S5iAik*eMW5W`<7*t%{)?nGTfVZj#N)M+5Gsv{FZ0P$Wwg`3`FGB4g1#s<}vvnX9wb^JJ_vaIP*Fk$qa>f^>3C&DaY?#d9Fl?KQhrr%Nvn z*2*om_2U=Cz?}Szg~jrF(8jsT7&$M^mizHx_-P~GiVPf6stoD)!`g#4wQI2*STR+N zV%gWdibA#&uK5;s)(SqA1{qVeXieEek_g1p2q&u!H#KN@(V4!+R$`a;tSAzT;fH;5 z|9G@8a%;2YU7c+iMYUPy-$@2!vETxNT<{UiPmp+z)p^9h)(@xw3w(|6qc!`?jeOgd z=+9o({`a(^j-Th3wpqA`dN##gUG!mtS36)$Wn=YZ$&&Aj)&*4@Y$BQcVd1c$5oo9f+^Cj)sT5In{^6tjf4wxbRZM?%LKGJe60&C$2ThL=ENnogGWtpfQxneG&H?P_a zCsJ2jv=OcNadvC*Q?BqtWx9Fq@FjdfrugbF=lDBp*x+CCYgRIypda$}%VM#q9mL(n zHgVu8+H^J40exmspv58Yum4Lf!jLQYqZw~(skO}ru)NUccl$~u2as=Dy`nF8IZADo znvHjJ9w80-6%eeFvaTXKjZg~fUh(0bA>6>bICghpoEF2=5+P2s?)%A&oT zlm;i|BCel3fk%CxX|F=q4$v|8jsk~pN{uZsKMdywSrHEEoaM$ss+5I9s32iahB8On zj8Y-t1+Bw!E^I@BiC#<)??i~$sUKk-k6WO={Ki64OfCzz0MyYFoDQX?W;?$|))I+nEeLV8laMZ_@&EoBvEVi=& I(cf#%hQ=B+bpQYW diff --git a/docker/nginx/certs/archive/npm-1/cert1.pem b/docker/nginx/certs/archive/npm-1/cert1.pem deleted file mode 100644 index 87291d6d7508757b8d8c46fc1c47a7b632a88ffe..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1376 zcmV-m1)ur=M@dveQdv+`0PP4J@O`POgv7hcbcBO0WY}*o?z*__inxH=#J!}ljH4*1 zp?vpWK}r~Ut?ra=mKL)T=H!U6BmF*h{dykOoOdu2+UN0=pjuEGw<(M8CyW%s}yP7dCCNaez zGJg@Z_DuM7qD9yXv z`^SFOZcN&h&qRtZ1e%IE7+QGn5E&jFeF`9Y$fIvb=b|=@4Amn}mKHMjQvceQM@?1~tQE%bSQH zWp|P7kURE0Yn=i>w0%nl1+CMji!Yd`)evG@<8^WjqVq!SywWpEX!k3Ku;gqd_NyhU z1A8dalbsaLg-!{$B_<5Nq=`P9Jqc}>d0)Z)4r1Ey)OJo=6GxlpE-z>MY&S`cKK#H8 z8YJDima2Qq|6om`?aqU}-^sopUk5BPDe~|KOE-mHl{QjRkjyO25WtjD?+GJhHj!H0I;`bHC-vuK28U3`3 zXGjE@J-WiV*iF&blp>HNYS2;&BSqv{I7O%u6N0{e2N1}heVhj&0WFePMdwqo$8@iC zd$HHoIa{4S+7yH_X2Mex|FGVygCki{N5tE(2E1jYdKt`!23!Aj2(27Kw|rwE*Z%LJ zPzv`OjEcQ=1NLbOsDqXEo8*Hp=uR2?mh&M{)k-c=z*sGAhvE1Kg9auVbex`vgt`xff!m z3Tq9g_(mR!BGMobQAr&05c|XsBK-*BH~92kB#X+^md0{4NX*b4)1T)u(Q%s|qE)wM z`0AGO>xz;3koLHa7-Vz%@hV0L>!PFEDcW}Jcn1%zvyfZ7Ha+(wzXz;ycS?ezNg z=zj2x^HV#Zq_G{`0OcGbSfOJKmJ;s zA5M=<*vvJAUUlqg2Wq?st)=-V3-<@PP>3z1hK|zTNO^BJI`))`sJ5RGAgioIw%|HA7hK3$F5p^1PJ0 zw~6w&9Jk(V<7+uf7Esjw2}K$4kw@QC39ZfG+uL0rh@r>;YP6X1xe6BsNmWER>|$&Z zBo9^4)AUJCJd$b8!Y1pm1iTyP_46>NB2MWT%e^0*2jrk3a|91j6BWx~AYZ!d5n!OS z4|?d?#+cm%cYPJ%k$Sj>N!5FEoKh0d0-lNQ$-7?fN79=BlX4jbeZpAV@CVqw<2ai=xzc5yj!{lIvG1Ud&_&^h;bK$t|0$HLm=vIRG+OM z2ETSo`^InyMCN+zJkZi%-Ib5%2>+m!KW$qdpP}a;=b=Z`2ep(3fTssIHrd$uZfK)* zIaKmzJhV8!&uj6J*7D$GR54`}johb&j!nEx#Nih1QIJZtYqe=>V)+hb;(|F7 z&xO#;2}_Yv@TA(WmjL+s`%2TZBK$`Rm`uz$w~x*KDP>Fc^{PdS78pP8j~I3|fJ@F0Cm$b;$vxQ)))H z_%1Kev1(=42f>i{a|wEOON}-7wyyeoFnQ5sx~S8|DMl)x{KhlVw{usn2hr>M}&rp5V5k&R}&^I mJg1BWT@mK~RdiwLF`p1e(C?tSb%t>YWYlC#Ft`4Xy)}1hyBbRX diff --git a/docker/nginx/certs/archive/npm-1/fullchain1.pem b/docker/nginx/certs/archive/npm-1/fullchain1.pem deleted file mode 100644 index 1bcb336df7679e2a0f1cfcc127416d3bd56f025c..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2942 zcmV-^3xV_iM@dveQdv+`05zYIRSljc)(G?+%z&(^Q(p1wkn5$`fbM=b1HlN=x&@IG z{bMlemO=??3*d1otu$J%K#hNKws>A?dUh-cSJZ5Pc=g}+jG(_l-iFggE?V9j3|ef0 zvFF&x`z&2UzbGYM0(hd4^*=Xh>@1+W`Yg3w5b=tSb{G;YaXaw3jRz3egu_R6-)$;LCYQ(OK5vSf$U3F0nQP0^ai6#T`LjLTVpz3FM zcy_NzQ~URFRLweJ*ByUzRF@zh@66j0RitQ|I4`p<`*#m6LKAgv_wp}K7c{K%#gTV` z1P*CpL1!cmZsdX%nZpt1HG$~Kgx&c=k$oktAFLqyxax<6@APYCi~t3O`StKE{II~t zwk)?^JO1S7!mPpna@=a{C#`d+NUlM}y53>d?8z7JXEV#bYH*NIjPQ>6o0k6M6KF@? z>VHs<8ZROQ3Z9OyGtN^EL}-#)SuXB%{x4d~^#fXq7)@2SRBeqA$ANvJH;GW|pjMVy z*EosF*4;As0E9tpi+-=%+yCSv@StlGOkP>tnoP{5OU|;lko@k8@N$gG>R(**(38}zfe}lCMbKCm zPdNe1iULAkR>c%57qZnZF$S@^%S4IhAnT8tWHGdVEs&jN^=f(}{U=-rASiT>sG#LD zG6ofw*>QV|?8kKs5+p4)d@hDOi{NNHsKOI7%`|_eh3&Pc31w65H;oWR^l$iIc=Fd9 z2|Da-JKBbQ>WfFu6vS1PTf%3SxdhSn{GXjA!-If4o9% zt;XJ-LJ$}FsOjf;seuAbw(@7gTn2uH#BigRY2OD(7sLCC0Aqd@N|*`iPQrF7aZi1zSASv_j&9uUxw zlW^vL{k>;Dz{NG@cFLsRYe<9PuFL)#>NO!+qM5pq0~L~6BA4k}&=dxQ3r*=j@#9BJ z;o*o2yrjnmJheQCD!NP2UHaG5AeSYe1@f}rt>Xw6>N+pq0oX2$_}T}GUzw)s^}-r! zrWM6y#B~u%O=P(iB*EHjXIv0k<=h1%F+Y`d^KbsaZkqXw(I#>yd_$sp$apgF2fbDt z$aQU6*c_OrJKL}8q>C2pN_3S)%Jh4c9J;K|PemdqH@gBau^2ZTB2HKn>6BIU@pOlmh1# z(8f}ane+U^WPEPxXyI4O^Jg%lBK1N4wC++nV4plcD(n7}*QL?g&N>_kucM@SsC>8`%qaV9NTjLhS42jGBbhC$RuIwl;9Jr+J z8AXb83%Y{51Q4*UHEhwTr%Rj9@23mQV>j*dY#%(ip54R;I^1@MuIGt@Sv8irsAu@o zR;HF#bzb6QNz*egg@7*uyC4&~BC85DHkI2qECc_bCl)%4hIGs8v(=Vx@ys!(XTNCR z4NR!a@a0h2-k`w2iY+4%_&{oO@KT|8HQFmh%Op$>{g;VgX%TW*)bVL&JO%rp6R@k} zTwAN|DNfV3){yZm+i^E7!HueCu;HC9spckslPZg)r`j@-z3zX7Wq0Q{%?oIAa$~1< z45(_ML{pABjo14_Ehuv)QvL=&_l-4wx~nE&s+G&@b!-*c(wn2r8kIiU{4)Q%ZP;yd z8nc3~+Uws@KMep>WAL`$U|5(|pSlbYLr|R?j1E11iEs7JZ0E%6H*p&>!O=OR#E`%9DiVzG?Bn<^EJm&K2ibKijyJs91I+rj`7O*LC{j#Yz0sWUmvYe4lwB1lv%3OTq^%?8XMUxxmAmDtEK8mKmbX` zZgDnKq(>hHKL~C zC}?B71E-gdLsg!%^s+|COHRDt=ke(rI z9jo|B(ka677MzK>%BCSuwrx~ml7dG!!EFbKE*tLsdQ4^vZgM*=z6m>w*l>;=Hz6)n zq7P5%5uYe9HB{(oOkz~x`FO!BjJk%T{fF6=VrKj zP>AgAT=(=P4*D(=&1v)pRev81R8Uk=Iy41EP* o`bZhDBkP?Rv!hcqj_iVRY-t9mvS57l*&Ul$sj>j`8lO1lJqM4beEzCTJ~d)3>wj3Q6E>l#(ct`Jjip#7!Mj zFj$ib_&gbq!l~!j%6d#K#PgMlmN9)o<8suA%EAVzmyY9wft-~k1jj=s3y_=hK5_C9 zO3nu00fnmE*@|drK@cQA*H2@o9VBx~?>N1wH40itswDFuDA}DSJgr(nPb}VT;{BaLj>DcMZw=L-4)T%4rwpA+?9h9CN zP?Xr7SBmq*h9kKR@v4WBa&(qjqwOCKaNn!m0K-$rc*=d{^^IS-ZR>|~FR3Z-B<>gT z$*4D@P$EwrQCvf5}F`t&}RApwgRQYmeu^>Hb~J+o@OB8#@tQam1+ z{~TNeE_yJ@g2cY2wd^w}d-U%}~_tkz7r{g@+rId}Oa=?_PTv2?RfN(~fT>mKB2=GZ(#Sar@ z#cZSz3q6Up;}W5-qo?p$+!@fSnB6tXZq1?1JvwXE3{Z>yK8~Hi!=94cvNl44ZT;R!%07<{ zHzVSs&e>c-K+2*55u$bZrLtGhQy_lVmzk977pzUcYE+4BC{RzfA4fje!C}7e4v1ud zR)D3Vr7JC>e+QzP5UVL5ENwr6SwR(_e-(-#z8|{J&i5U3(E1;PEkUSQB@qVp3v+K8 zS)OY34Q*R2Nd2u4@>rv!cPdup)6yD5&N~bI#wviU7D@CIg(Am-6FCa;#!-IzOyUxR&|zDy3%>l4M{tU% z6dYoJ9jUBcGzzR{m*QIL0gv6Y*8iilg#m5H=U?=)YT!1XNK@J3=$bw6ECq6Wc0z!* z4zyO-X$a5VH0(Qw2%Vq-v%P-Tt6X5TaFd7ZsvKr-(?gnRtXM6^>H9g4E-(o-&BC49 zO)oN9GCPwTD7=jZNaxTeD>u44=w=DuU$Mn{R_$kaq&zig+|VZ0A8&0yjPYWvMHO-0 zT=8$SGKmyIx*=~gkjd_#x2JQhn$Z#gdQU-kF7W-P+Yz%h+`df6*t%CVSjLCP&8&OqypYQ=aND|wo+}`~H z3eR9{lA&Dw;&OCfjw!L?<+QO)82{kqU#UM;zGRpHgH6)+s{7n}Z;;`})GLGJ?1!{2 z-tlXiLA1iEq-qM~=}byW(|bxQu!he3x&hbF^sr#=Hz3iL*nnq?W)a1GgPdYnhM$c# z)u$IO>I#??V@I4uiC^wtGmy~`;pAj)ZNP_6Vdim=1oA0=>EU5MLUVRAD^9rq=jPPL zeit>cFw%-_t z5@xYb_)6$lmTsa?fq;GReUfl zE@A`iG&@Z29BBiMEZ|;^OQOtYD*xx+_E7k1>A<=z{&?ZE_45AE5cT`#HF-?|qx}Gu z<7U))Sy{*-8=n-!&s?(ps<^3ZiyZPLzJAnqXKW^AePmSF`^TjjCK5CPm!~X1^mhpi z!X4*O_H)2n7K3vkmm=W$va#tBIK=r~LM#qga zR~P2pSHYMfNJ)B|G~*d0+~waFl+BZ9wv%qYlGDjS6A<=){75-<|9Z%N9@8iIQ_siS z#k!F57L=#}Gs+Rv@qG@7No?mY_!JomT-}xUR(+b6=w&pxWkE_L{K+2N zO!_($3QeEPGrXc@Rzg{4kb)K>JMe*N_X&uSZxz({)4W}a<4wOFr8dYIUm%Qdj0NFV z*u5Lp?0|913hRwrM|8QEOxMIut%Y$?lw2s7sS~S~=^Y zB=@WYB5L%|a|?|#z8p^{7UWsyM`itjf>&r;p@nA>MVO7PgxVUZMC=in^v8<%bxnEDAHbr4v zIQsu+4Aszb7v{VqTRYd63}2_=AOobjHoiuce_Qc57X`}|Bl!VN+XwAvaSCENB)b-V z6TfPn1K6Wuk9mpI=1`E6V#UVq%z(Ac5bB;uA%ag8!l=<4gw(Pqhcg%I(%HDo*I*@Q zNP$bmFjbZSGiwLqKa{#lw+82^oxb8Xj>I$v@M9~jI+&wiqT*U+rZN->LE-&~0F!9K zEdEi3xw~UTAQX|3U@$!wJ{{n|hlHp9BnB*8f!14S;n<5H&aB`m)Ak+Vl7e*JeXXKB z+m~r!e$I7YwPp*$hFUb=e@Ev*b2(z5B#~78$fV0sI_#k!nv1b zy0TEzynQmvmiINySp0WbFt=dG1gRWS*F1GIbt4xshc!U@&a!m(8uWjjnxuxSnpE+a z>8JP`!r&$#lj5M9DlxPv93ml{tD0?q$Me1FyoR)|#Z2uUu;B7A`Zet0QpC{>ep(6? zGm+X^xen$|?!>FSzkS-}nhKd~rF>m0T&XDoD(KS2aGr@d)0u6@tc`C1x~UF&?oTua znfKV#SixY%L|FaSYbS|jT>}hE)wu7c8e>2qa4>~vz)<9?RRURCN%NX4x5Y<4c-XL_ zO*dLA|JZ((ARi``Fw0=@gp@SOv(!p@0tAfggs!%aFG{&N&I*|7?#5-MFZzjsu|hc9 zjd!+7#3LKAox{+y@+PivI~o$$CC+`HC%Q{@<0*;In=K_+;{!{{GheT%xOb|~wsI1Y z-Vsf|3`q4N*hSTU>^>85+Shu(yNePsF?1D@NeY2&VWgeQduAn^yaDf?w&^&n?LNMu zokg%+YWEzYZP6j-DE>3FR)VDBA#zrH*Dh)i{HI@LB41};8PN&B38BVJlBF;y#P^dZ z9Ys$wG2m4{{EzTqLT-0Q;%ilT!_r$C=gm$#l%<3&y+CES5bZs_GGZXI>@uDZS`5)S zYtHlw)p0TEK#X@j&7(X7K6d|X-?E=tCh?dVsw>D#Oc5K&Aw;0#K@iO`dUqXT$(xMp(trqWbKo}YVH2p zkgyye{{_95UF3Rc4p08#u3+(X_$mdY6T!{Hd*<7Up?qDwSBMdq*k(0KC+0t<6oA)$ m+1F>QQGR!Nj=h~3HC9O&hKaQH5AGM|JvWfwTF|KbBO7)A1|M?( diff --git a/docker/nginx/certs/archive/npm-2/fullchain1.pem b/docker/nginx/certs/archive/npm-2/fullchain1.pem deleted file mode 100644 index 2e7c9cf15389549cdbee6d49b5974d583c801489..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2910 zcmV-k3!(G?M@dveQdv+`0BW75f{mt54e5Pv*%LS-FmO;es=Ig@<@OyEg73z>kz9QA zp2IN5{PCZ+%W-p9UW;_nTd|`l7tISb(*=dm#EhV#H}%+T5I zT!Wgwx!AO*L;*T4)e9^SWP^x#qOFk@E>9^zoH|079e$Hhhew&@WU@_WI`tCr9dL4w zG67KR&XcC8g+9iiT3bbeX=>rHo2hK02!ykPbhpU@W$5o_2OMw;RWod3uiV{>2gMMF z;#h3bK4UQ#@pEf;Z;(Pc(8goNdj>p}6> z!bs9$h=u_4itZEJLsw=yC;Ubn5ufCS1}i^jq*LxcGP65hmi0?>oiNiy0A-yVo?P+^ zdk~4HNxGj&UTvp&m`cI@U8jEJ?WFNb5I7$%TT2R(2rX zVuv|S)i9>0==dcHS*V{zFRKc$|M$GAKVV;MZo~Z^NRS!3;BS-kyEcQ&ZYF-D-qc-{ ze+fnsm;4OsCqH4#73)-efAq`qMK7i4h9gDH8?uA%L;W)1G>1g#uRV=5+=ZZaC9zRrbfKKt2<;Ea)m6Id zJH`JDo+)09$nxQ1gK#PAz4yF|;tfK6Jw0m6qxU>t9z8*~IJyN!_vgZ|1Xv4x?E0ol z?eyR_DftFz;gOBV6;txY>tp9jrnuGT3FjnIS6r*ugXBYx$daR_$bhfzrx=dInXU9> z9qWEsO9|oCj=b4<{0_tc8^ntlDwitZ521ow!W3oodtz8(wB$=gc)Ddbulry>_GouP z+?6{*$6TQ=-cBnOFFi>y*Qg7oLUPaQzd!1ul14AGq&3_Ywg@&FHqO(-C zWLR4}2{*Fik`;W{{UgWsl<&DnE7yp`i5kd}6N! zC1c}}@jiYwWDWt9tChaddzlw7ibs$~E{v(vb$eb6I@jY9v7239`-ajG#49_|F1h)J zwsT~63)DK2-5)C()tN+DAXuX}$md*Y@U$MabIPHaYk=L78$Vlq>Nt}$SwEj(y`ymK zny<3XV8|~=!D(gW#Ozr!|4T)ZsB)^X9Mx?92w!%`^*U;h+Y7+HF?_3OVsGCTur~Fzs2tm?7Z!b+r`tr_nCV_+Bdqh^! z8Um|-%@(@@?_*aQ3Ms{T4FYb%RU+N&M z*~41uuY1edi-(V>ul8cdz6!|4p~&zOk%ek;cI^SO{6~W;M|Z?G(rzBc$9mON<+qiX zQj8-SB1|7uCA<5tAKBFEZ0wMR(2hZxDMAEi(~Vm{JORyG+%ktnum-%iquRC(kpl&> zCMf@tQ||d#*LJAd^|8G(jOlh7qYw3~P$4d;G*YZ!X$*{?1M z04PqEkUR~vouf2CMt>|wlfVO+jUmK0Q^G~P82He&eD#m};9}bh^}x%o2SM2^KM@l6 zh@{AY2EmCt+1e*_w}{Im-?`1cBLas7gr@7#uD-=;$_7{qAGr642fgkzGxg(+e%*1h z-?E|>be4>vY-4Bv5B%1sp)_oG(0=5o`ZnzF%=^x9wx9&-dkOnF3c5}i7YIe}`g z7N)8f$y?N?GsZLf2iU02;FVLt`yKxLl$=aPUmcr}!oZ3wtSPA-DwJ0f-;8bR&$;41 zk$kHhQhy(hrA%}%lqU;BNR8KnFBzi5vjl7fh^tA*M0#$9HnVZ>fL|PEbyCS^2ckk> z0MDCvrHQ-R0Ve+Q=rLzm$ujT1KpCwq+Cu={#@G+xqV-11J3~~14^*lGESaOZ zuulp$cKoyS1tB(3hC=>WKfRmSUiOFu-SkP0+ZK zmG*=G3yoq~JW&~3E*9s1r}!1%H8zmf`+*hG$FVqdyD&MQc4=$VzdeXA<#osFRP3oE zO2fa-%7kv+XIuWy%f*OHzQIulmV03S3B%jPpHgN5A*nDmJAJQE(r$hd@)a$?tk7`9FLoQDdZGv%wzan*!L?Am{b4iYXgl9 z#vTr%MlxMU?EdF;gutA&=x^?=e;Y}?l9%D^wj=dSZqPVhAG?crRYHlK+9q?y%f`E+NT9e3onbM(M?4tR z90gPxI)GYax=MrADb|jA>qsRsQA%qpa2w^vxsIXX%QYg5tWeWM4IEt-qbOa7x(eaPRG~= I!9Feoquf8K>i_@% diff --git a/docker/nginx/certs/archive/npm-2/privkey1.pem b/docker/nginx/certs/archive/npm-2/privkey1.pem deleted file mode 100644 index 9032d66eb94bf17cc440a465dddfb1ac2b2e078e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 328 zcmV-O0k{4DM@dveQdv+`0R2lAbotjpb$KU!6y(b-%sQ0Z4OfBPhy&b@Yy5y98)N!U zuCtn5#9Rx6&|7Q{?GKC}Oss+5p3xO9kqYszqq6a_~G8}2xM-@x*2@`#C54#ONp zy~=xoGke#n_G5BX^kMuieulm4&E4-Kt^@Xoa|?$l*RCY&4$elo$6<7Uja9V-=_)NmK7!xIoa80;9=_>Q}>t#bFg>X3;4}{{u*r? z>=Ha_fPyqDpyc)jVIOCa(@Xl7yw0R0 a!{_ia8GAmuNB%))jY#6Y^X-@i8suut{OKtEpBDT(1(4MtB4@lQrnM`1sU z{11R6Or~pb_*kdsQF;*Bi(mM0Mm4vrddRJ;oKY8~H2450$4L`&JF8KD27QA;lKV8= zBJBv;al#%{CZ2r*u`_U_EuJ>xPDOMpJrD`+fJ=kGORt+L7=v$01HU2cx^z95SsV0f zO$h(_EF@xjzLc;!0N9c&J4bX9waSG(Wo<4Azckc?OHO36zXRM0ZRLV;FfqUY&oSa3 za;RL#1ECT&uW(JC?z&_(EsR!Q@Ex~0*36?5@(0RKIA0a7wD%Ee)#`|&tP+qNHj1H< z{$%gQQ4_peQy(&kWfG_feM{B8ktFexvp<^e$L<3{XgMUh(Q?F>f;M6A)G6Wg_eK4P zBI<%Y0pUH^C-dDfmbQr~pEkZo5xNROA+FqA}3ff+mf>5AJDxwXQm z>65)x-keDv5)5L8{#LfHbHlt0fy?}jwQMQ|Ap*q*#VUn&PHprru+)n;`cy5b+7Y4Z zYfS>D3{6}Rem$wa0CVymH)}O`j_k{0@+-}$>bE0aRM)WRDlBaFu$=g}9S=jXcvz7^ z&R~yXG|9R}^1TTJEg8{lD1oqoX{Ac;N%MHK#dk_`V1;G`?Iqh&tcRbC4z94YF~bPo zm9Hp#&=isOxM;s&hg0Yn5875!SR_oGf&4M%x7qm~)-IpBt4H2T*RjLH7;VYVmH+OJ zicAN|fuLa%kcpQc^3dCAu7p3(c!4W`6nobfmXoncHOqEV;66ezfS*i)Bp%9N7v7Tf z;>M6uW!j!79tJ%=A)h;APSm4fS48uQ^PFLrC}&pGvpKhj-)#`;hz5@lPzR+HUh-W~ z7~+IkOSX~vn)SJ*-w+VhnE|K&+s4x07A<}wi0-T+1Q?Rc!*0A&*hd1&(b90On)jl` z2l{g_4R*ODO)i7_8iFrj$sFZ;DxgSikh6#4zLiKgi@%=Tr^`~!%`V=)}I6it?VbuA-am=}9nyW1>e0GhFe92E9-FG#udV6h>zI zOjL~e@flL(Qq7<10*v4A*dE=o82#O7+ZFv=c}BVd0;Z3O4k{>9`^ zh-6bU{H;Xr%>VNcZ)486^Q>oDR3kvh{EuJs#xEMStc!_O5xwzVNa+Ui{Y+WHm?)xT zZbTpa+8!ON?~Qu(J*u|~^4P5>s02Oa@o=Vu&G^grjK~J);=61N^~jzy*&7H4qh_B+ OBcX~(|7fpM>z?6P7oX<< diff --git a/docker/nginx/certs/archive/npm-3/chain1.pem b/docker/nginx/certs/archive/npm-3/chain1.pem deleted file mode 100644 index 3045de312fc9a14ddcf588b75c50fb79e9dd22e8..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1588 zcmV-42Fv*XM@dveQdv+`0H_clFMi0{9arb};8@WO@-R7nP&%0`kGo_+ko$E*Hp=uR2?mh&M{)k-c=z*sGAhvE1Kg9auVbex`vgt`xff!m z3Tq9g_(mR!BGMobQAr&05c|XsBK-*BH~92kB#X+^md0{4NX*b4)1T)u(Q%s|qE)wM z`0AGO>xz;3koLHa7-Vz%@hV0L>!PFEDcW}Jcn1%zvyfZ7Ha+(wzXz;ycS?ezNg z=zj2x^HV#Zq_G{`0OcGbSfOJKmJ;s zA5M=<*vvJAUUlqg2Wq?st)=-V3-<@PP>3z1hK|zTNO^BJI`))`sJ5RGAgioIw%|HA7hK3$F5p^1PJ0 zw~6w&9Jk(V<7+uf7Esjw2}K$4kw@QC39ZfG+uL0rh@r>;YP6X1xe6BsNmWER>|$&Z zBo9^4)AUJCJd$b8!Y1pm1iTyP_46>NB2MWT%e^0*2jrk3a|91j6BWx~AYZ!d5n!OS z4|?d?#+cm%cYPJ%k$Sj>N!5FEoKh0d0-lNQ$-7?fN79=BlX4jbeZpAV@CVqw<2ai=xzc5yj!{lIvG1Ud&_&^h;bK$t|0$HLm=vIRG+OM z2ETSo`^InyMCN+zJkZi%-Ib5%2>+m!KW$qdpP}a;=b=Z`2ep(3fTssIHrd$uZfK)* zIaKmzJhV8!&uj6J*7D$GR54`}johb&j!nEx#Nih1QIJZtYqe=>V)+hb;(|F7 z&xO#;2}_Yv@TA(WmjL+s`%2TZBK$`Rm`uz$w~x*KDP>Fc^{PdS78pP8j~I3|fJ@F0Cm$b;$vxQ)))H z_%1Kev1(=42f>i{a|wEOON}-7wyyeoFnQ5sx~S8|DMl)x{KhlVw{usn2hr>M}&rp5V5k&R}&^I mJg1BWT@mK~RdiwLF`p1e(C?tSb%t>YWYlC#Ft`4Xy)}1hyBbRX diff --git a/docker/nginx/certs/archive/npm-3/fullchain1.pem b/docker/nginx/certs/archive/npm-3/fullchain1.pem deleted file mode 100644 index 74c0ee3ebb1e3c2e840066a351240161dde2205c..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2922 zcmV-w3zhT$M@dveQdv+`01>XcK}XE^m2`dum?Na3DXGQnO%l%2C1s%`#}J2tR;%QP zov%4q84r*-BEKWv6q^7{;umY!1v;{2fl`owt3lHF7gjfSsemwY% z;1l=^MU(L$fJ%m%Ps$>|nb7;%8RF29gf3E=n(}%4x_O8aL1Z1d@pHbl$JW9)fed^(2!$1TRA8*{&;v)|d$$MEo zhq+r3IL}syF?AuS--`3dEm~)dn~xPsji4gn5WVjK>!bwDR5i8|$S9*nefZ1^ZPjo^ zcEXtl9Ru^+lUprIQD37TJwk5hG||F9TJi|NMPRcFRMFT!OD_5;q(ihYw3Rk$wTjYPjS1_WI)s6v2i3@Bz{b1?rBS>8o|h!Qk=f?dVcV&k{|4AQ^xknQ7r%7F$l)MIOmgVfuU4rHOT3(%-}v(esS z)mrxjs{uIYfu%}ijBJNkY~VOZpXLJ^0xK2DXpM1M3f_i$w^J)uT7)s36r*wundlOn z1N`}05n+CKmTCS8bY~Ewn7L*11Kw2KV((=rrGR?4B_{}-%vZT2fMIPcMrHDRjtb*^ z^HTDUP?v6AQcddz$st_I2#e%mNa+7q-Oto4SEw0JlzU{AHdT-4SNS4S{-0fbv8Oy3 zp}$I1apum|G7?vp2 zdtT0SizpK7`EKSYwn=TNE9L4$y7Azvt6NT%voMm$L~0t*D7AJJ6_!`(E?P~ zpi#GCFRQ5VA53ujx(xCEVBC&_CQhYLoeU~0l3fqBuOVwkB$##491<(D0XoL5KXh#u zwA3rayP(F1u~&gY?rW$g@wM7C0pZNGpSvC&9{=q(+&Yu{M)dZjA6uKV`Q;(+2?Z7t zF0o#7X?`Et>wE)3X$a8azg1T7o^qF5r))WE(dAAtJ(6VC*ZnUo5@>3g@2ayh#+aUy zl(V1c*LV-JRM%DOm8Rr{3N_OD}>#gf;$@FG_VwkY-`89z{-#)E{bK7f5Z z8bYu{T2n^xwxv`^1>d_(5qqQI8I-JQbyJY1Wq0wecO>khtB<`H90&Vf^y%^C_M)RW#_a#)p5=04kI;C5>`Wv2P1bC zN{M%3i4;$rPhONyvg%&T_`PKl+SB`*q`qADvs<3YYH>m#!g^GJN!4(m&K~rIwuEx0 znQbk+%Jv)DwV;qKNE{ibhkR0N#y5-?PXP=z;@r$pG6??;VMo5uD#M}8?4n4sMvq#- zP3ic~st6h;^Q$=W^r*4|l;1<+y9WMR-WFwip0MLc+Ag=n)bKoe#m=GdJmCk;MML>5 zYW56^cCBQA5h09a%wQhjoT&Hy_6>GXR@C$NkiJ^ex*VZc&Q9P}Wi)s;giLa;cX*W( z&-nMA+BeN2fWyRgNiIKo)p;&J7oSM%E}K*faW@30&v*zP+m-}iGP2*N=~WVvZCu)e z#-^`*h%GHU2}ju{OgNm1Kksp){pKj8roM=0q=LwwUuXP@j!h&_l8WI5aQEYzn^CN-#OZWHo zcARm3GBQ*GLtIoZBFn;mG!C@2A&~vd^1kW)fXkH!W)d~HJJRxS2smx-p9`EYy&w zS_62qLS8$~sw*2TCTvs4#-5<~M#A%or`T0t)#Jk>)q)!mRPR+$P9&V(Pwp)ckTU5=AZhXLPgS9HwYF*%M;7BZVQW zv&}7vpec{lhoxJaiOu(V=-gBCxnHSQc?ajI#pA-k4bp~1qSrzYQ7~8;6)JDaqhx|` z9v~`NETsth;L*}Zto z5jnbUuVU}{n@bpz(ns_}sm`v!s|4R)124qt$7$x)vy0hj2G!9qZ+)AbA^MmNC7qN@ z-dIy^v4lHDS5W;Idm?zBb~~sZYzcGRp$TcWT@;?s73L7aQaL%+Z9$qR%#E^g?m0cq zv$&x#7rGj|=OT*Rznb*dw>dFL9grhtA~j>pNq+|?-ui1uD%J$L?kK25rzfhZfW8vp z2dV(7>U7|DtDf(QxxcinCO9fYkfoemsKmB1DnQ^Xp5aKc^}WY9oIsvDWNixwP2a0T zi){x?xTC-kY?OlF3=_eA4QS9YmvOIO+1863#Sf;^>MddOvT3}}R ze89i~ad=i1kzDn)MpF=TG8uV6E6uY)#8?6m--3dG27nv7*lN(zY08jfUv)Wt^WO=! z|MxQ#qjj-_%B5+&)o6%IhgVPj^TKZ;Tn)AEZ-bX`D#f@%43x&#Jvt7n>jOlx=oUu4 z0Wap)MC6Cp2`CA8Hyc*;-{^1{=I>!{hqUW=pl{1j{8Q@F_7$m6weAn50K;9JDJB{6 zS25MDgNeUcizWVtiS$3IqC|i$kIOlSoUwHPM>{o346&%3Pu66JxqzZv*yw>_(QyQq z7lmlu&rImcXA7df)q$En<1QL)`+n#3`Gt@p>1PIznt`_8A^Hm^5VXvIv6+=hM^F=Y zIuIPK!s)aEtaLxj;>;WM?rBB(c9(nnsBbw@HEp@F%r|}Mn+OZxhv6TD#<8w&!u?XirNq|k4Ohr12XhRG#n zh%?ZD_il?n+oR0E6B@=_6<9RS)=&aDN7ufOUa;_~~_wAWjjTXD3s6Um~r z$<^SYmq{;B@U(9*9#3gKR->7q+2L#Zh?ae>XY-xDNIhJ(232T~$aoFxzi zVE6`=_$LC! z-0_9)oXsG*NtIsVT_)r%h+G(yAaUGRi7K9#3Y@=A2Cyg=rPDF@Yr&%8_xl3+#d|Qo Uqs}dVsiFEc`(5qfv36ey#7S?l@&Et; diff --git a/docker/nginx/certs/archive/npm-3/privkey1.pem b/docker/nginx/certs/archive/npm-3/privkey1.pem deleted file mode 100644 index 6473fb82b2d362a2c5f141bc6ce3a1e9ea08e8c8..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 328 zcmV-O0k{4DM@dveQdv+`0ANzrz?<$}qVBF8@%d4G`cv6-s6G0abfaJqjzFE1J%Fvj z+fvO4C_{qb#OZfZfM(vPPDBbWJqqGLb=JsL$)b9LxbXk~D*SYUgKBm#q&9gG*r2Ub z#D(9AYo{`5$vE95aROvKKa8RJv=msM8npL%J&7D!w`4H-9g>*|=sUgW=|0QuUy~K* zd^L+^rBXLTs@k?uCsiu+DVxM?%Yt7cVWgy7`32;Uc^71?(_8F#oWS7zk&WQ1XRq)g z0u`tKD+a4$b-kFHqq?PpGcED!)Vyl|ZOx?d>qCWNNn7p#>4 diff --git a/docker/nginx/certs/live/README b/docker/nginx/certs/live/README deleted file mode 100644 index 8bdfa31566e3eb236abfe381692a36af131115e1..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 762 zcmVe?Go zg+m2~!oxV!9Da60pReYiOC$HPx`Xcxz0RSZ1Xgv|EQH~hYXbKa1AE{<22m)}E{x?Y7mKe_bG> zaM?teK8S5B{T5;yA_Y~YxiPDt#f$L?I7z8irRYv4)*l!udG zS{jd8f-Mf#=lI}abqyob6nM?(ZBfFyqK}bzlJUWx~6<-9KEUYYNzOUjL&eIcm2D+MidKwFvo< z8NOXe23zON@2e{Y>_VD{XxX8Az-e+UBF?|T5p%fD-1coOQ6@a*5?3r@dwTiDhU>A_w@l1ds;-kgf~hR~6Jp8x;= diff --git a/docker/nginx/certs/live/npm-1/README b/docker/nginx/certs/live/npm-1/README deleted file mode 100644 index 63f542b4e6241af9ff6aeac65955d52bde78c1ee..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 714 zcmV;*0yX^rM@dveQdv+`0L;JYf$nEBZIb=7in-hP97Nto=>OqzbFz^EA9MRjZ-&EP zl0H5Qw6}j1FIVaz-y(yBI&){gnAn72|NpqRls1cMQzk#{67_nXIM)1p|yO5;U z)258->M!O=q*@T=&;szLqDH3jUVFs(ZGL{tAZ(W~ArJ#ltZ@S;#ZE|qc_xJ*04 zb6RZ!Z~``vd^jw1r8T634qq!`DQl)?NcRkiI24#4pzLK;F^Oh@4Vnx?{x;S{*_*gR z`uw#QO`*aLC(_+j+f}5TpYAE7t|(6|oFx85cmnopRz23mMFqzf*(FG~Nofzi1Ur0F z^1*S$fZ^I>+0nqw+NbKu)D8Dl#jt~wesNJKHn|5km1=%iMZA4I@^+(h0R&OZ5I>$o zWB<*njUeD#z%Q8K4L9L8C2l6M>=tB)1|9v!Id#}kX2wtvc@_f&Q(-dH9>_rpCO%-W zx=9gnI}FFrlfjk_-Fcs$aw*Y~mS}jdC@W{&T)-{X02(MaT$CP*VF+fyGW{|)(CD5x0?4;@z^^sQlPwC8h~3cobKDNWivUwMSz+aD^4M wn>%XjBZV}RO6=|2q@?}5T=nq);K0^HqIgZJR9`82pP?5lJ-^px{o=s>@9kV%P5=M^ diff --git a/docker/nginx/certs/live/npm-1/cert.pem b/docker/nginx/certs/live/npm-1/cert.pem deleted file mode 120000 index d7e65ed..0000000 --- a/docker/nginx/certs/live/npm-1/cert.pem +++ /dev/null @@ -1 +0,0 @@ -../../archive/npm-1/cert1.pem \ No newline at end of file diff --git a/docker/nginx/certs/live/npm-1/chain.pem b/docker/nginx/certs/live/npm-1/chain.pem deleted file mode 120000 index 8133afd..0000000 --- a/docker/nginx/certs/live/npm-1/chain.pem +++ /dev/null @@ -1 +0,0 @@ -../../archive/npm-1/chain1.pem \ No newline at end of file diff --git a/docker/nginx/certs/live/npm-1/fullchain.pem b/docker/nginx/certs/live/npm-1/fullchain.pem deleted file mode 120000 index 8f20152..0000000 --- a/docker/nginx/certs/live/npm-1/fullchain.pem +++ /dev/null @@ -1 +0,0 @@ -../../archive/npm-1/fullchain1.pem \ No newline at end of file diff --git a/docker/nginx/certs/live/npm-1/privkey.pem b/docker/nginx/certs/live/npm-1/privkey.pem deleted file mode 120000 index 916bbaf..0000000 --- a/docker/nginx/certs/live/npm-1/privkey.pem +++ /dev/null @@ -1 +0,0 @@ -../../archive/npm-1/privkey1.pem \ No newline at end of file diff --git a/docker/nginx/certs/live/npm-2/README b/docker/nginx/certs/live/npm-2/README deleted file mode 100644 index 63f542b4e6241af9ff6aeac65955d52bde78c1ee..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 714 zcmV;*0yX^rM@dveQdv+`0L;JYf$nEBZIb=7in-hP97Nto=>OqzbFz^EA9MRjZ-&EP zl0H5Qw6}j1FIVaz-y(yBI&){gnAn72|NpqRls1cMQzk#{67_nXIM)1p|yO5;U z)258->M!O=q*@T=&;szLqDH3jUVFs(ZGL{tAZ(W~ArJ#ltZ@S;#ZE|qc_xJ*04 zb6RZ!Z~``vd^jw1r8T634qq!`DQl)?NcRkiI24#4pzLK;F^Oh@4Vnx?{x;S{*_*gR z`uw#QO`*aLC(_+j+f}5TpYAE7t|(6|oFx85cmnopRz23mMFqzf*(FG~Nofzi1Ur0F z^1*S$fZ^I>+0nqw+NbKu)D8Dl#jt~wesNJKHn|5km1=%iMZA4I@^+(h0R&OZ5I>$o zWB<*njUeD#z%Q8K4L9L8C2l6M>=tB)1|9v!Id#}kX2wtvc@_f&Q(-dH9>_rpCO%-W zx=9gnI}FFrlfjk_-Fcs$aw*Y~mS}jdC@W{&T)-{X02(MaT$CP*VF+fyGW{|)(CD5x0?4;@z^^sQlPwC8h~3cobKDNWivUwMSz+aD^4M wn>%XjBZV}RO6=|2q@?}5T=nq);K0^HqIgZJR9`82pP?5lJ-^px{o=s>@9kV%P5=M^ diff --git a/docker/nginx/certs/live/npm-2/cert.pem b/docker/nginx/certs/live/npm-2/cert.pem deleted file mode 120000 index 711bc75..0000000 --- a/docker/nginx/certs/live/npm-2/cert.pem +++ /dev/null @@ -1 +0,0 @@ -../../archive/npm-2/cert1.pem \ No newline at end of file diff --git a/docker/nginx/certs/live/npm-2/chain.pem b/docker/nginx/certs/live/npm-2/chain.pem deleted file mode 120000 index 689045b..0000000 --- a/docker/nginx/certs/live/npm-2/chain.pem +++ /dev/null @@ -1 +0,0 @@ -../../archive/npm-2/chain1.pem \ No newline at end of file diff --git a/docker/nginx/certs/live/npm-2/fullchain.pem b/docker/nginx/certs/live/npm-2/fullchain.pem deleted file mode 120000 index 742cc5e..0000000 --- a/docker/nginx/certs/live/npm-2/fullchain.pem +++ /dev/null @@ -1 +0,0 @@ -../../archive/npm-2/fullchain1.pem \ No newline at end of file diff --git a/docker/nginx/certs/live/npm-2/privkey.pem b/docker/nginx/certs/live/npm-2/privkey.pem deleted file mode 120000 index 0c8edcc..0000000 --- a/docker/nginx/certs/live/npm-2/privkey.pem +++ /dev/null @@ -1 +0,0 @@ -../../archive/npm-2/privkey1.pem \ No newline at end of file diff --git a/docker/nginx/certs/live/npm-3/README b/docker/nginx/certs/live/npm-3/README deleted file mode 100644 index 63f542b4e6241af9ff6aeac65955d52bde78c1ee..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 714 zcmV;*0yX^rM@dveQdv+`0L;JYf$nEBZIb=7in-hP97Nto=>OqzbFz^EA9MRjZ-&EP zl0H5Qw6}j1FIVaz-y(yBI&){gnAn72|NpqRls1cMQzk#{67_nXIM)1p|yO5;U z)258->M!O=q*@T=&;szLqDH3jUVFs(ZGL{tAZ(W~ArJ#ltZ@S;#ZE|qc_xJ*04 zb6RZ!Z~``vd^jw1r8T634qq!`DQl)?NcRkiI24#4pzLK;F^Oh@4Vnx?{x;S{*_*gR z`uw#QO`*aLC(_+j+f}5TpYAE7t|(6|oFx85cmnopRz23mMFqzf*(FG~Nofzi1Ur0F z^1*S$fZ^I>+0nqw+NbKu)D8Dl#jt~wesNJKHn|5km1=%iMZA4I@^+(h0R&OZ5I>$o zWB<*njUeD#z%Q8K4L9L8C2l6M>=tB)1|9v!Id#}kX2wtvc@_f&Q(-dH9>_rpCO%-W zx=9gnI}FFrlfjk_-Fcs$aw*Y~mS}jdC@W{&T)-{X02(MaT$CP*VF+fyGW{|)(CD5x0?4;@z^^sQlPwC8h~3cobKDNWivUwMSz+aD^4M wn>%XjBZV}RO6=|2q@?}5T=nq);K0^HqIgZJR9`82pP?5lJ-^px{o=s>@9kV%P5=M^ diff --git a/docker/nginx/certs/live/npm-3/cert.pem b/docker/nginx/certs/live/npm-3/cert.pem deleted file mode 120000 index 70976c4..0000000 --- a/docker/nginx/certs/live/npm-3/cert.pem +++ /dev/null @@ -1 +0,0 @@ -../../archive/npm-3/cert1.pem \ No newline at end of file diff --git a/docker/nginx/certs/live/npm-3/chain.pem b/docker/nginx/certs/live/npm-3/chain.pem deleted file mode 120000 index 6f845d5..0000000 --- a/docker/nginx/certs/live/npm-3/chain.pem +++ /dev/null @@ -1 +0,0 @@ -../../archive/npm-3/chain1.pem \ No newline at end of file diff --git a/docker/nginx/certs/live/npm-3/fullchain.pem b/docker/nginx/certs/live/npm-3/fullchain.pem deleted file mode 120000 index 6a89319..0000000 --- a/docker/nginx/certs/live/npm-3/fullchain.pem +++ /dev/null @@ -1 +0,0 @@ -../../archive/npm-3/fullchain1.pem \ No newline at end of file diff --git a/docker/nginx/certs/live/npm-3/privkey.pem b/docker/nginx/certs/live/npm-3/privkey.pem deleted file mode 120000 index 0738548..0000000 --- a/docker/nginx/certs/live/npm-3/privkey.pem +++ /dev/null @@ -1 +0,0 @@ -../../archive/npm-3/privkey1.pem \ No newline at end of file diff --git a/docker/nginx/certs/renewal/npm-1.conf b/docker/nginx/certs/renewal/npm-1.conf deleted file mode 100644 index 28a66320f825ffc22a892c0dfcb37b80d6d55a18..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 767 zcmV1 ze4LvX{zvqU7QQhpp54XRF+f-G)4-j1*M5%X=4$c#Lp24GXSWJY4axeuOaOQzX1x7X zJ!i*m#&pu}?qdW*ik89N=Qv-?=B`BaHGnhd`4j`j&^M(WH|iWwj3JuwYxhgpcfZ~ z+1)hqYi}Ijr@D;%^|`CcwFzqh9ts3_X%cky<2>ZEI2bE&7w;d-am*Nro1#1P%b4xb zK6Go_EF%74Dw zWr*oF!S3q?n2m}CU}cza2yee&Srz4!+X1~L$hN#M9>n!F)YH!BL5BMAdWrP5gT6IV z;iVM1;$Mxq?nCuw;#Z~3s|v{j3?rFZA0)Aix+1JXpYf+V5tH!lD4ZovKT>E()ZxVq zQYKe3?$(T3%Rh+<>|MR1LNi!RCL1%1T|p=|Y6;_XopDitwD#L^j7uCeu<1LjkP+n~ zmk3TOoG)0pHFSCs7@r#LBVun{?~SmGe*eT)YXHp1+eGKLT;z&IrUmH(4)Uu(!c2*d ztUR$yWy3@^6Ku;PN)^v%>C;0kOcW=+Ztf;fbInnU426%aW}T~6FD&&@hCfZ=oh?l| zor(ea7WYe6f%);6218zkR^VF2q)NApoAJ^TGRB80^(2_XMGhJR@u7?o{!%Y6%D;`%kQ(j;Wd! xTU{uoXXrSuSUALvT78duv<==}g`e}|zoP6_R#Y$~eG}gqr3iRAy9NFiFobnQd6EDC diff --git a/docker/nginx/certs/renewal/npm-2.conf b/docker/nginx/certs/renewal/npm-2.conf deleted file mode 100644 index 1a510139b6f7c1baaa78240e4976c6913fd8adac..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 663 zcmV;I0%-jJM@dveQdv+`08R37vYi^oel-$_0ks;%>N~(^UZKt%v#U1IK6OgEZ+u$m zo|V=-)9VK+oi6Qe0~VYUk5dVuD8?q797Ykc4DF9GcTo+BjEg=xaBQNGxVG*eyJ0b= zx|b&}8I%1c>+qk1mnz9ylEjhKk5M=ir*1&s&7hDN%Ha^$8GQV&f{8F!Q+- zIp(p(4Msni3gGbr7L)Iq$LaD*tr<>Z+`X67*H7n|43XX*iAx%d^9IHN3;c_&t*XaV zZy#Rlfr1C(bt~X&IoJ*qLMdUR@0-19_<{+%89_dRNO( z<9Q)^pfBT+MU`dvENdA59w4sfL}sE?GTqrfqBB3b>xA{Cg_er73~#)NS0B54<dmWYkE zhK=Xf?bXcN@t|)44KM-7Fo5h%*W>I;JU`dF0xM(v69l;qBFaOP-AIo}D8y-fg%@QK9Hh^TjqE3(Di ztESp&DVGt8yAE&_HRDOsFqP|IzOSsYPLawMivUtxrdvXmo zktu(%Ff2Vjc1F|O9OqZmEpizB{J)o8we)glkhg+;n(!14dk$Mu%q}S$D$!0j95LiU zq5@OAT^o1l{(Ni$k}>)9-`qT#eayM|!wFFRy`UMZzP;J%gCQy-5|D$%_s^Fo-_iw9I}K~Q~kkd(AGc(GKCjlK3%(q>;{Ryg19V!<=Js@SgOm< z#!5w;>C~@ZGu;eXe->g(xy)&>6+8^6R-(409TRXUn-&G9#mi%{{L|bzjAvKiVoe)H z5A>9(h#4y2ksp0}`fb_@bZN_GWIC+iL@j3_GS4w}9t)3w?M7&tBUj(AX-B{EjxT=+ xjypXZ8`LG5seot0K}3&GNwQ}Xn^2D277~F*c+nKCw+XJaP6ndRoZHS%nGhXBNizTd diff --git a/docker/nginx/compose.yml b/docker/nginx/compose.yml index 23b5f42..28ab511 100644 --- a/docker/nginx/compose.yml +++ b/docker/nginx/compose.yml @@ -1,17 +1,18 @@ services: - app: - image: 'jc21/nginx-proxy-manager:latest' + nginx: + image: nginx:alpine restart: unless-stopped - container_name: npm + container_name: nginx networks: - shared ports: - '80:80' - '443:443' - - '81:81' volumes: - - ./data:/data - - ./certs:/etc/letsencrypt + - ./nginx.conf:/etc/nginx/nginx.conf:ro + - ./conf.d:/etc/nginx/conf.d:ro + - /etc/letsencrypt:/etc/letsencrypt:ro + - ./certbot/www:/var/www/certbot:ro networks: shared: diff --git a/docker/nginx/conf.d/timothykim.net.conf b/docker/nginx/conf.d/timothykim.net.conf new file mode 100644 index 0000000..5c0d211 --- /dev/null +++ b/docker/nginx/conf.d/timothykim.net.conf @@ -0,0 +1,48 @@ +# Redirect HTTP to HTTPS, bare domain to www +server { + listen 80; + listen [::]:80; + server_name timothykim.net www.timothykim.net; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + location / { + return 301 https://www.timothykim.net$request_uri; + } +} + +# Redirect bare HTTPS domain to www +server { + listen 443 ssl; + listen [::]:443 ssl; + http2 on; + server_name timothykim.net; + + ssl_certificate /etc/letsencrypt/live/timothykim.net/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/timothykim.net/privkey.pem; + + return 301 https://www.timothykim.net$request_uri; +} + +# Main site +server { + listen 443 ssl; + listen [::]:443 ssl; + http2 on; + server_name www.timothykim.net; + + ssl_certificate /etc/letsencrypt/live/timothykim.net/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/timothykim.net/privkey.pem; + + add_header Strict-Transport-Security "max-age=63072000; preload" always; + + location / { + proxy_pass http://timothykim_net:80; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} diff --git a/docker/nginx/data/database.sqlite b/docker/nginx/data/database.sqlite deleted file mode 100644 index 4f81acb0027c83e8c8e6e920bb9ce4a7b288fa16..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 106518 zcmV(jK=!`?M@dveQdv+`06oX?`e*XaAJO=@_$RMuJ}!~CiH_d8T95;*?#*##m$}0u zBy|pGiy?jYGP&VqO{-86aO$s)e`k@g)^qHBpg-<@G&FEs`yOH^$VtkEL5=cYpJY2Y zfkR+1fvE@57Ux6Kn? z2%{n$1i3KlWz?f6q4={H+gZRHMg~^x8*n(5iq#10w9XYsSy6y!rW2UUW(-07YniUS z?d**YV7{+Y-9aR<>%h@S1;==VyOwY38e8>|KhL#BI&86oqTbKBA&rxwPSkp+yzM-N%#h#uhA^{!JQPQ8Ug8 zAk{Y5dZ%Jq;FuG&3bK8VgbiZsVVU65+MP`D)48u*0Q&k=u7|ve2IT)QIPDf^q)N}3> zlBt$)9e5go>r;YadT;7ap^Q`ciri#!))mH1KGqXNt>n&vab=UzYQ4?fOGw=Mt+i&C zO}Bk|08xa|9@eNvw#WMzi@85!PyRJIN%VoVAcG(7#2 z7z%`pGn(Wo`&3_NrI8&f@J|$H&r07fz+8up!vK$3g>7Yg5Rcj&n2&<9HSZ8i4y$?{ zTmpKQtWh_8nj>)H^w0Xqb<9>&Ntvg;cWop^Fr^5lVC-Yqmm1pM4I!JCqM}atYm6Ic z&B&)7h;R$w1m&aCv`?jK0H+Qn;xw4p@vA&nX{YdooO-+PbG|ok!o)MFu0L-LdFZ+k z(MXk-9YrJgf`a`6j#eKmMy9I{IE(U~l!0Ns2?YZ* z&k3pc*6az_<)M18xD@1sqC}%4>xfdn;JX<6_<~3%IBP?^IRduG($CKaSI&Yi+e?+t zoj=ms9aKp64W2&Xz_?ixs;<04`cy=rj!Nr#fZs?LgFT|~iXhr=7%P?o@rVUT=ybxw z=;*2ErJD0BUtbE!gx~G4>&-8lZ^oZEpoo^LDmrPLI--pwb8TWE5v2oyt z#A$wc8UG6(t{{LRhRC+1ipxqR(}k33DKKHcmEcX&6mxr}Zl+BN-&?YJXHgyFugS8* zu6@CG!hR@0f$a(!)*lMoKuNpVvmn}CY0C=pc}^P?;P)l2nXlXn$-~OH%v#>1Vr1my zW)upq&C$jIZT5FSc=Mj>8Q{Yyb3$~$?+Afpo|TK|oyi*aOd-~HUrG_n<|O>S3N1u! z6ghh@-BzQUSHrBXl3E^M-ML~^;L#pMxJC%kgOo{fo6D{ORU{6O;~8S|3#G3g^yOtl zG0UmHPpSnp8`EQy%GOp_J4#ZLf2SKRmt7NJS9L9vrly`Uk^{3>12WoXEgg=2R=O(G zw?Nx#bdqD8u`75cbh#oa0=k6VMYzooI}4@yyhijhS|Hn|fb^9$eq(&bwR5{6OQwmW z{-D(H<5!6rvW@&@@c|byA>G4fiAb3pTGC}L%lhA%KE>KzUeGj&FU+F$7USGp*yxXr zmvv6-c$V##-t*pS76b!*?gwC>D!f?^jXE%?41hC@VOl8#rHv=_Ib9};%ND5yz;2G5 z?R~j4e&3Ep_B$|^EXBDr9pWk`zNGlF0#5N(KlVEr#A;qS zhaC*&(qvGHN8RD62gUh$fAAb_!WKQ6z>>_%a%AiVg3<}>NWD5MD0P`APkS_|3c^=C zl{8e)Rn`TyzJ>?HU%vH0k$H1)FcKo)*5sM01pY{ZD!8v$WovMhlM9LyaWH9Wy?qgA_I zCXy1?jLbM8l%|iDuQFp+d)`B2=6e)1ys2ck6=&SxDZesX>WeBL0EJmdu=;4*Gf=C` z(&F$lL~6s{u$gr*SEb+P-|c;vN$~Mb_KVArZFt{Mip+cI_3Z4`mO6ofbfOd~U)45d z_VNVVED8WlPK`|#uqyX3&UfJ9VF|wYSX0J}`y6{Z%Y!pUwR5?sET|Dfl#poRTb`xr zzt>-fk_Wd>Gi}HO0w$-)s>0><5?gM&5~0Jp7<#o!N}8o$P?xtB5(<{E8lsiV@1dao zd86QwCGniW6u-$ep{d1CkJpZBCC z(W+L~lJc}nHnQnl#m3fE^*p3Yjg2q@hDGd=gq?uI=*h$1`Mkj<*$24FlyY;<-#%V* zcDHhV;J|ONwN6clrE*#%s{5t^)5lezMu1axih)g18ON^x1<8$|JTi=Ohmr?uq$4{{ z^aYW!Cm525DhXK~_ELbM#o|aA@gDHlBu>C)csCVn5)&txMjENJPc+xY@={HxFb0-m zaYT`8PiPw6X#xlLOCEOL8QoQ|=lUs`qiw7=8Xnng(2HrTy=dDz{I%MtgXVpSpJ_*^a)PRXpLvdEgHst;3>D+Hv;sheQt&-&|#*;i=qco5G+7|oebA)4IDt4j#C`;f!)oQt-Z3={a`iL zwd;f)aeHN(3cXSB=LN24y8S$9GPHSqpV|#K^wB#`;K5M@8nV&l{}&6c&L*w43ej{q zT9Pu-i_LZ_ro59H2g_t`u5Fd*;Lk>{7Jjt9U4%y2wC(&~;_W1=cRTP;ZIKcrMHMK? z7R>OA?UYVaKJlG>5e=V4PGuU~;W#aHokT6Gg*lEPC3w~h*mqj-Z?Z}b&NK=(!$msS zIw_x@YOd6RSVjTxE|U?`qMHnZvu6g>y%6i-$F>Z_ZGXf-FS1B@j>u5xhA)`bD@3;c zdG`E437G>$7bSmF+j}+6BI6~6jSgtWhYs^__v_eKGr1~(%sUz1a`1bzq`X=Zxke^p ze#nB2%{E718DP-(vr469mN>^idV~$GN0CvzK7eVF^wRSWtd>N#E!W^nWLK#Wj%0o| zcIT8#X!rgb7cor+TWu$w2;RlSc;qNN`epI|xDFJ(n0m69q2*WWe@QhD{AzZ2EmP~X zp`1|CA;y7>FKb>ORhPHmgQ+2^dFmn`Ucesoff%rNBS_*{nOJDCMe=o7dwAn#rA(m;U5Sx3I6H`#>{HC^*lbrrabh zQO~Jy{pO+u!r{9Em#Y^m802yL=vq;luyno1&tg+Ajf_xSksAY2S#T9Y{-f0gKXYMj zve3gY!Ow-GvvcU3EwD3S+cX&sJ&7<k+ zg$lwBP}ntjZdbjq0S#p@5S=0$qU&}{x36bNGEA3Zv94Xs!aeuDRtE3$(G$`wO{gRR zQ;s0Q(5l}+^m^`J;`STn(?1`jW|WH_AqwKg_!a30s1KfE*Ebhh+dp*C!s{i=Mxzxs z=nKS+tsTp`_eyV6+bfzRbH5&p?f{1V69vNPPz{g_*z@ll==f(p0ur&tI{AmKN!vH$ zM0uiE{M#<^E8`8RraDzJG?O2DP0bF*`$gu(XaUypm_j2;L{#PHjflsTHV7hqe3-mN(8ICBb+(;MF2BRTxCHPL=_F81DC_OH zDw|sH9>4zE)a@T^W|072-Cx>=*h*hw-3soF2B%E2%fEh(Ey2`8OV_~)BN}=h8YQVr z|CKCJaLs_GxShhen#z=1SY(9>Ny=GVcY$Vw-iJgUOxR4ba|b$@9kUresMaTUcq+Fi z^y${@3@-s%_O)rIATNK|)pDVB2jB!ztG@bqkn);>MdbIEo)?GV6PLNET?s>^c)W9d zG%zG{m_ORex>7dezmu(5N~5f&9{OjpR#vP6#auxAK^xwlo2ncC1 zGp*#dV`xK;8j>jitm3-Rx%!=3qrZ|N!7)Z3u;nY;ubM^Ho=Z}hO~9p#;n-CRl6~z` zaa2N3b$>A>EEnye->vU^=cEHLTQJ~^DJ6)^_Uk~X#ku>a5e`hf`WC^^KXsLORK$Hmlg$upeGY3~j z_5$jxsc$CBW>1`yqe^i?(N8%EFDQh-garEb{8zQH9NgMj6k_vokh}oorG-Un?q?cH5xw%?K}CWRrEUTqf_vTmcgjowR8ieH_ou{^qe`? zXMP>LGZJXS--SiPH6{eE%cF)N4NFL(<;XcUK6%GnbK?|D0JsA>`>SgG%;0+E781`{ zun&+KFrKt|O_pw?N(ZV;sc_GlL8*DCBI#2YDbA3V?=fAq3`DFiF3Acr{j-)~QYY{d z+NF*iQBaf&VyH1s@@uopiTDJVs3BhR)j;e~sB3$dIb%UPqQ`PS-h_mu`033FNOFiG z;%t_ZiC-~MSm?!1c=z8!BAf>hC^<#x(fXD?qVaaBqFiMI0tSGEz)YKI3{~^k-F7t) zJ`YLC3uIAV=nU2&O4D%k`Zj6nHl($33$kQtRMyaZ$)guH)smIZknl=&7pt;5Q3)&V z`Ufr*)n4^NlvQxd8cEb#&Biaa81R7TR0` zPdI0}kfn=K-oD>JziDXn*42EW-yh_RiN&mtYGc~(NLPMAoBcPZu1O2@D6+Cfy>6kk z**PfVSK2*H)`b|@D_Fn;lP6u?a?%BR<>wVKZiS~=kN2@R61@xA@wuF z2{FK%^|55Zsv(ZK?8B$JWCK>i=f!uJ++7?Ihk+(52=k42!$Bmng%W*q&{muCv7-9) zcGf+a=L1ks>||kDn*YSVM~Llfxb+KL1USsmK#tC%86Hv!>Z{lB7268h0zKmq>K#mkk%kmNs^4RbMEj25aGugqtAeUAM=O1*^#b-YNilX zJIsDDFKAUX9W=cPTy~XvxG*2dGk7`7_mye1A=I$5!x?1&*?WpS=s4t()ofE6sb6+x zJvyA`Xye!2xWWkmgB9$mvNYnA8Er`Tm#)Ii?pxr4F3RED>uN`<*TUVTI0T-qYN5Z5Ef#ZytBAaq5|{-?;H@}c=4HPAhkjPFeBH4Y2yP6OpRO0 zynTAc3q@U|2y(iE>By|Ae+d5G>)#;q|)@N`kB|kimu1lKG?Sg zYLckVFFI>P`S|K5*f|CRJUp(E*DK|$v)_T~>y6d2ol^j2LV?Y3sd7N;7dk1|zD6*} zGay11fIF||R#_U~`QyG)$C&Usq7wUp1tkWLh?^d?#FtAC4LMEzNHhp|>lbl2M7mLV zl^7{<&>Kr;?t(E~9#meKl3Jmalp5Rv>??JMH&!*&Zf zbHMAdtFGP0IHm|B7?))F=wK!~%8;-_Fd z6$s~jj3~a{Uq8uwks*E121V*2E3n$~uI79pwaS85ubg%;SxT|Be^e+5S;wydL2cGk z`wEd!g$AA2ja3AO2z#qehuKM#VoE+<$(a~9(CQ%k5z9O_)F=-lw_ySEf%@xk5?1By zWp<`phk9*o)wYG}OD#V?o@Xvf^DC?UU}iK!6q&6~F&`SOgIiXALpN8LY?h$352&7K zx=uV31^cx`72Xh|QaNJuA+vn}Awjd(6+uozA(DD+^!muxQ8=cLmIzJBXFG2liBkav ziWrFI>%ea;zSQX$U4X03FR8&^C3GqgZW4DY|_pDhaLUfD&~% zbKC+ZJRTG2X~I1xvKvZ>q{LP1DNxq2{yR_70+kjC6#WQB(jW>F%1Y~7pvsc8p*Okl zEgMY6dRB*2SjFY4wr*tdA`tWC?MecVW9)`U_DA{1Chca?Fao5);(O!4^qh2TgX$_E zmExEE9D)K9bRflR9a$i!~tZMrroC%41Wv;4-WGv5#nNN($w7iSIOpc(TII zU=6!Xo~e_mLPE}oVbg50K6Vs3zp(=o7nMw2vL@%*hVr$yH@PN~8h4wL&I|GfMZ|Qf zNo$UnRAxDanCv4tLbw80Qv7#vmrQ(E)e1@)@7~KnF<_~dP2+@P<(_$?Uf~*SEx$FS zu}oFY;?X5ArePC5{k0mdA*$0@TxA~J(gjC%fWJ01MRCTXC;na`1C1#bZjjQS^(8fZ z&bMZ@Jj&R})mV{_RweFV3)tVADG}5J zQ6{-aEc;F)3^Zzpr<4VqB0thcao4Vth#+1-Zk>{H=~Uwk{#TF7SRkHt2Qf}#2lE6` z*JLQNwVrVIOFyn>i>W3Y{R`GMN3X3shWt;8BaCu>he9#9?j~{YW1Z66HAM_-g zS)P$UF6j8NmWu8H+~R z8`?nuVsK7^lWO!i$^d@IC=_Rf7p>b5aqQQzN~sgjj!6l_j`}VA7X)#9Xr;2o$ljH~ z%SVWwHTem(2L>$%00{}3=4Y4ZeE6~j)Gsu1Hr3eKtUpuof*YC)8Tnk}N2q*ikb5VH zX7npG|G>?QL0nsfP*&1s^Zj&!U63>AGSL+d=+z*>VE(Au9sfYScGGU$7_aQ*tyG364j26A2`qJ}D6?|qbid>_FJYOKW{u(m z^Z)CmxF_&rgM)pKieh3L(x;5XvP+R7$MbQcUz+!4@d!(ZC32Jzx9p#JqOW1({yAoA zZ+ey|Yk9c7zd6MVD5ohfAG)#UeaIHSWdhsm^$4()wm_i$`Bf&nbKh?WT3|`L&r1Vt z;$Ub)W-QhhH2dIWL>2ppkGi|Wyl#{>E8&M6b?rsc-nbWWNs(So7ij`Iw)?2 zR;-hg#UuPy6>4-_R#-VCQATrGLr`}Pim)&!%xN88set$>Z9kETQOJU_4P$BJ#%k#I zTJ^ubStw&OsHgj{$P!E8QMl^vlnbJk?p1r+q_@fV0;}O7ahr*l3%Xu#b^)V{dZ-LE zOztR{t`|yT>a7`MKWn44p*R|jo0@_0h^EicHMx}dUIVDDA2*#d*Fcahd*`aZQr=7H z2c%Dx+Oq0>otax!nhP5O5-azlB)>n<(JwI31DpyK-H(VibedU_zahZ0Ry)1>`sQAu ze|q(xozkFH((yLK$bhS*CUGRP!@ZrtHhz$^N>wLBmD14%MeC?vI zc+1)AWGz7IC=@7{A&_Cs+4wklFLbgv-S9MvnGzz5@4mhlMjDl;T}*LS$tR9Ee=FU= zJ~dzP926E9qxD~G$59VSQ(kN-CgBEnIQxb~W=;llaDBR%ELK+s=KhD5U9He#aOON; zq;OPJx+9qaOIW-&olt^v{nU}+zsuDsEePmzi7hLJGPbACrUKu!%rzeOeAu>iNQyc| z*04g&!bq*`Df}GjjW3&<#k+6ywnLKM;v1kB1VRo*-3JAz^$EOxZ2e>J=ECQC@ZT!sJfn>=Uf4DOJ%E!-DTv{oQ*t#G@ zk*p@`SmxeUE3{G->Yj6Jk;1Y@U^mz1YW9|4p_+1-!l6|dJUf;bntqU0{{kPixzxtO z2Pue}E}ialTfn)R_aoMXe&$#!Pb>h#9^X+ZRcH1}+|( zMQ=xe$omQJEC!Lb9m9H}~AMa+`2N!MEifR!M-Tq2xMLdeRyW@WHxHf~6v@*pb@H6Ws_@ z0pt+TBT{$Av=eVYQz2?1@<1FnXvoU9=kK{(p&g4GuJ7oUSrh3gJc4X#iQ~mIe3E;;_U1g;rQsF^;)Wz14Oa~zq%1yo5S74 zrK@pp(a!>zTW1xVS^N-a;Egi$>7DYow|_^>^nK5rDgP(T!-c8s`D__UE>A+my$&B6 zwBR9aH$m1Kfv@r&L{i*TeDeHf*N>zrzM&%6YikmR$+J~i^2KT@#rUo5EfsP&z7Acj zrVL?Je)d>ZJ8#{VGM zLMuM(b4P?=FKQn(wRTtp#Exi(W?me+#s%x0sq+JODQ<=a6R_XGtqD zqBNQJi#>Q5x~kHn(ohqOruY@<68&kMpZm7>r;w$h4pkj2*-(6pEuQ7zGmz!wm%)-{ z)ychPJHDb&9v2@$nutlOv{>uPscPU?N%mrqAn0ppBC@H|Ppa^3!A@G&d08u60a2$; zJ|p`TdT2~4kMvyL1pN$nMx6!9@*lnv?@GBQ3DQM!)R<~q>+J1Q^jpzu-oywjCwqI6 zEWu{UUwmLP+_j|LEQM@Voj0!ug)cchR=i#v9p@5EQL8ZHZ9B<+Ulw8CIs>$`2^*_U zOye#8{%13~*vOQPS0VDJ!d8;+XXz=k!Eh4fgY$uouZM0F%pQM4T2{OM%9~jq3RbeR z0ypf1;^8Fxj2`81`IU{#*{Ifc9ZN@Pr&wOM^!#&2ogM*hcl8{4j$qRXXE8qU-)ZRm z+u9&_eehM}hu+X?Le2auJylmn(v%N*$|Aok71f~WO;pKi6;1$Tq3sPxH{?w)8~1r` z?pH_mkwBVc=`kaR^e7H(#L_mewR`t%zK$rIi zwNe23eLyNSJzlxmm0V11MJ}%sT#CJF`BDN(feQ}N3nno?O-iTMEl{Q{B>&h*i2Nl% z)v_$WiPU6|RLj0VD$m4tFV0`Qe~G)m+{Vy~oi{=^R^s}h&U-T%TA^8cM?tS5**}|u zAiSU|Pq=w$WjbE+x#w0p?&t%WteLia!31w75t5g-8j6(flbk7UwYl-3K-Lh@1g2#D z4w@Zm3Lf*e-iqe=7%#jxXGLKC5Fg2cw19-veO|>%l^auBFp!INoRmF1n#bMWEKJ{o zAlP(cX(c=`mv#FyMdr|o|Hf3NTgT43)gmd?IID$4g2JB!!@5j*Rcsrtta-<&T$O5d zmC;oEX2-mx30Fe($5Uhys&FGG-mhRfk#pQYEe4QW?$07S19EVXmr{M8OCrFkWQDal z77dj1c^snsqo|4E!G7!+>YEqK2-SEebS(lB3_J>nLUD!)P?3~-)Mm1r4Zz3)3L3of zv*kNpT&1;<3+Qb_6DQC&3pe6dBF4eR*T?XHWhM-hTq_1k<%Xb%gYi;5R?C@ zEB>*r@N_x2?o#IkKS9|r8N}Fs8K?)m%`$Y@@@Z{VBaAMTTht5x_8$GNsQ`7BlbY%^ z9)ejr$DPK$heP$o-2??vwn+KJp=9sp5NP(@dF;)xwfxbT)pB*kv@*uh1;lP`0UnCV zY}u~XWqm-F@%3G1|E%%{Z^o_WLOl8=_!G&wP-(B5QSk{ht3$a$TiM01>9f+fPE3Nj zHqmi^XS6=ddU)G`k-&nE!tJr+k;1sR+ap_dkz&a{A{fnLPtgy0n@S8Ra=X|Zk zfsOd*!)#>5;PN;PJUCmY#*cpJ@=dh$QXk+Yi!s9~cS3(QIm^W_5Rqz{jH+vDBQb9N zYO^%9WM7v2s1K}+LP}H)R!m_X@a%myw*T1f5*`!hK<`Z`;cfqh>uL+)ouVBK%fHKg z^@3)RIWc&1N%`$&G*DSC3W4e4Ny56?tUP z)LqHPC>fi@iQ!Y?%!_<7t2bC2X<{yt2vjs){xk6#*GyiR-ImHWUe64kjkm*LHCPF` z$bKq;4;QP-^*XnJeI0wL8LbH5QEUg?;D}Y#svLo_C(#fr!kMVohPzfA#1mX7rSv9C zF_!RJfFuswoMM{GR-Ik3u^e_lA7bmMoF??2g83`WmxmhB_TG#chsZH7BTCE2(_tHX z!BRuDxUv5uxwc62`p1lGV>d^4aUm;>{e+ zYdhV+Hs65CI6QdlR+_~_2Erl=q>NmlvnX8kXTEKM0L;K~j(=^Z__E7u^(mZ;WTuK9e{M>785&zs%yU;lm2!g5 z#%M(??|e&K~xHO4vpAv8C>YULC$DXSpJh*_R1&5I)FQedNC?zk{>n|e*#g_1n6|H$?i zXOJi@sxK<1{HcJZRL@HC2qSZM!}{=5{vQ#KmY_h`*+?;0!@)1yF#riU+VN9zND3`tMClD7xKm9LhZfQ_Rhmt5;%aJ zH#1aoLTN(79K;Rs{v=&P1W_o4{pderInxy_qb?sbL3905Gwud%Uxt#`4H+gbXe(#P$>nONuX;H`?=nArf{cgyP$Kr7*=tdc(863Y0 ze!1A5+C@#bu{G&7YnXJ$Lka#j6!ZQfoe+ABtVv+_*h-F9-bxVqV5gvuBFf;dC<5pT zI6YByngW^lzU;j+`Tf+oR}Eu3eJk?mSnw|ox|SIljtuLC*>dTpe_ng&Ktfu0&Okzn z1&V+30-1a91F;d`QZj%EJ%%*DY%UaI$@3$NTCZwJY|X1QB&PoFJ|K2z*#8nKkb`}>Xql~}{;~->%l$VD!05K~^@^VTD6wxr!=F>)W zWa6fe_~VC7S2k4bIC^(!5!KYtkUJ68gEN=7lq193(p{bg4lyn(+72Yv7r9#ANlS}% z-xg>>V9Z-tAJGwSI69cRcg82B1^NVGHR3k~4p(?uOLY>3Y=Q{%Km>h1wOSmfpf;#e z_(H;-5t$bTsdCCI?u{(~8u9UePGfkHZ+J@EAZ8#;2Lfo8G#n#r#B4y$@rYuL>j=%4 zOPrKFiK&3G;zn)D$ExM6^1na>UM&WdT?m^iVqcNXDYz0P=AEYzu?hKX7GPPz9$=FK z?|C5d**Wn)z}9B~;48-mghDCcqlv&cZzfaCX^J)+xA`g8(No0jX-?>lfN?@?^Z>O>F;why}X`p_n01;h5|<^Kkl8KnpWHR?VU zjXJ*bMMXs_wbzjbU>3$e5f#g)gQfL?8^6$lL}Tr4ttA7RhYjRd=GtwhNgp2N^bYoK z`q~?jQ8CwL>c`5l>Ci;TU#r*_Y=m@nZDTp12s)EXLD~dMYJUt;$%3V^9%&X6Wm5f7A5S`G4$>>H<@U#>U8N z8CY1MF3GPe>X+T!J$CX;V}4-*`T>5BTN@D#x62;);iZ|@$@Bm0uA-c*iwt>BrhH@6 zIF6VB>Ah05l{q}8AE3y`l$?h5%tG(Ct;*xn{8t`h@j!$e(%|dDFIhNgn9^XByy3SG z%fB!vqIsdnl)wP7GM#S*(&QM(r0gr`sv2*EW~k5Qmuapt4Bf}bW$|2wuCE+m(jR)S z8r*`)4jBcUnUCU}0v0Y~Mg0mynnuwU2jAR9_K$mg*;*xuWo>95Vq-cL+|M52z}Q3W zh&MSaJ8XP+xo`6;PL;HgUtk@7cT`!v*#Xabe;OkJ-m1cuq38JhyAC7?bl0S}LJEc# zX8k0wOH0&&;pAB>AFDMK{mvc>RPzBU@Dr>Edkenwrb>hZ$@Sn9U|JP)KV6S+P#}^E zPqdhLaVi))tg5Y4h`sBiZ8CXlT7^A{pTbCJMz}r^y{6jLU=DK{j|nICtxnXUg9w$8 zmN}w(0#+#6$=^I}PpAf2Vq!(X_3?J_f(MK7%?Vu)Yy1{<CSw^NuLgSt zPe?)$MBF0uppH4q67|Y3qr6(F-D9E(h|(n=4pS1!gbP=i^y#^i4UZ$i;e$qb{RO!V zrkN)pu}MTDULF{#+RVwTu49Ad_%{A`eQKTWetj7*vrZC)MGd-(VVG0w5{)l#pa}^>%e3L3tCp+P+Z@iE9Yuy5b=gUiFBAWbsK}8Mm4h#%ceS2Jzr@gR+$gva^g5 z^kW>)3a550SX(aXLbsAA7X(iJji4T0bb7^6mbcI$Q)kw^mDWNEK4w{hBRkhNU7^K* zi1tU+q2#5dl4QSs*Dx>6CD{TTk*DJ3@udIsBh|(|lcGipDo-s=^Qd#|sRM8;@YYRlCwb*=m2t7ffNJBQ`pA;pqji3AClcgKL#NY|3 zCuu+PS)Q)TTYDRr;F3~N?tmd~ihFzCbs*n%pI{tv{Fwpiop7jDGH;`JtJj?YYxQTf zR*alUfPb&Q;5B-!Q?Vbd+=wIQu0&;~CRjaif}EDHGd^UJmJXVNEnqvQQ0>!Xmu>nm z944_K(m9dA_osB2pj6^$8|WU4c8bbS=MHr-c<~kO-YAZ~u8sdK9I6{a8Ps2IL7#ZY zT}aEAXUuqx(Uto9fWwRHh{kSD3NUh);t>+R5^{gPuUBc-ACGp;3Og}4Pi)%|`G~E7 zPiZ<(m{G0$xG;TSP(}1uXonsUp!>&G`bGgKro{j%*eTs-=?0mRFVGTOfS_E1u|H~n z68Psu++nuin4GlMA(h3jMf`)~eZAEZOqLyJc>W>%n=}^A5jv86>AEM^{sYtP<3pY# zp%+LYueXrJxh(8C`Aa)eOZc&M6nrx;S_MpR{~C<|QtzDTC#*n8fR0)j^�(dq5H8%VW z!;BLAY!fsKTVuyh>;-Qi^r~QZT;(Y+5V)Gkztgd6Jet!-r@|PWke~2XcQ09r6TmC{ zyi+mzT7M?faukd(C85o36@MTTFlI}*`a|J~=RGmW%q%wQu+QnGt*7?=wb%hUkm9!WZ@R3lxD`unMfo*Ek0v!83Z*#+Rf3`1tTofBEi!g*HaU!um zoL(}DrS7&PS@z;LN^_`THPIOi3REao^^SK`dh8~Y*vSL3)hF7NW{SHad0R&d1Dpc| zZ*QoMT^{1zFX_U{@-lG3KrM4+zzaq04f5x%*GmaN^p}QyWGM+Yw~v=@oAY$S$v7WD z)9a~}crBnp8W0BA_Ud0PO6y~AUmI1m1B3sV8E2m32KuC-w|#lONbsR=3x>8e!SjWT zUj_uWWZ=~;hDpqeN|3X)m_2@B|8AXELeu7tEh!cH)F3JvOYT~%Y|Q=kbJbsQvpROnSz-cTaIXY0Kp7j;IFyNEId!uuozQ zs9PTLE2pzf`=rZ|)MLY+bi{3%0)B(n7TuYeBQ`yiowcz|gQSc<0=>upt0`y2E@iu~ z#4nStAkY;klouG*0U0H->7N2)jQdT)1)7YLIWKZk_5y{U+*f1Oi4M`v2 zdz(Ah#eytwOqgFhbkLGeiEYSUUWi*JWq$;jRQlKe;+kn-eTJb*y}KKi4HR6bN_9>t z#2Voh-I>r+suy7>C52U zI^*E&9OU`b6|B(>e1L3UASeSS;Ua_+VbcGkO?tDC8{zNo&+(bL@d)mO>Ocx_`;Zai zAxLDLwWQ7M3z!rB|5~w#Qp{X}`Ma>GEen0nQ(mSFuI8j&yuS5w4PG&DqN8}>8!w_o zDm)}_FAPG+aTn6V!-cnUeH2c$@mP%@$Etw#e}dB&zSiXQh>i^-k7gBg7|$Ci?K9(o zRLL>UeyCh3d0cs1)vY7br548D5B0NR6GY1U80c%qi$MfDrVvgIVo8tA&&H$tWk^@e&V`%jAMF4=O)feW3E4l$MPwEowTV5T|0AL4=p(Y42Fl@~Wjo(sf?<_&W zoS2MrQtP*TY3h2sKUH2^L1BlfKcKh2$5MRA24=pK0!I>g!bS$6Q|5+yz46FY)Kdh| z8JVs!ZOP&Tj*q>FqymlBA|v%qUcItWU=jgO=$9L$eCWJ>N1DsFUfgZPHY!nYFVAV< z^R!WfA!%1A01f?19%a(PI#ijTfxl0l58;cE3`xUN zrPzflDpOZ$R)dgSWBrUzL2<4rIBH@u>$?yW_=}7=>@TP?9+S(5Y|iIKm>}AIYrQJz z6-w-Z9)9W55{;q;)`x*IeI{A7YX9d)|1p`&xgzAiB0A?E=fA|Y8~b~}ZVDRCX;;T) zF;k+ngHtMr8g16ZsSP5c2IM$Z3Wl^2+mc`^0-H?M<#Dq&RXBo}%WDIKaQ-eOV63xd z4Sn=Sf#-7APHnFh`cqT==XKa3Tw8ir8`fl$I2Zd(gXUJLDGdHB>F$;jv0z;MiGY&I z0Y?uX4*rwWbj(`cml{{lCJB&)YiPe=X1*TgfA&PnkGqKNDHpT6>-?jPNyXM5?!UZ7 z{av=mAS=_@B);5WRD1>G@!EPnl>Zt|gK2hX!(59P|BDNpq~(x>cENX`3>m3zmy4{} zmt$#d4eVz}Ho~ivj%8bVj>*y3#!n5fc*1~$o$&gF(2mmo)WqDscM7EZiL$Rf8dZv} z3zODBQ@0pSgT`g*#3~h@_}0y1$cT zvC=TN%u6IUhRU^F3|dcg#nPim!R0+zLK5&RQgZGXep+hwCX}LAgOVfqSU3gZX^{_a zkkp^-aEocEPjXWezI-DcqDmUb&c(MCA}MV|G`KL>gufb*c!D6D`33}gG*0&nXRC#+ zn-y6UEpblniZ)zz0jKnug?p}`qQy=jtZ8607b5ovO%{9-cF@><0{bEz_O~4O%G1&o z%O09Nt~i_`3zc_X=SX)O82SNi;gvkha3|@I-l4ZTT~t!2J1fZ{yy)(H>Kh?=J@$7b zJdM0UZ4LigBf8Yq^e;M zgRM5;!oFY1YZX#|r+GU_w!%3u|H+~nzg}rB&P{?EL%a@y8Q#gqVLNP6J7`Bw(JnK$ z5c5MN#>Jzy=OV7`T7PR{)Bt(5nd6w7U&T2MYDi!^77Oy~IqUg~hEZj{YY-V^`U^DL znr#;ZN}0xq>2AJ=nKOkF41B-C{rAwx+(f8pMHzgRUAbyU`#e;JxE%dZSJ_njp94Sq zNA|gIDmlNldDu5WTO-X{d*oDDmNQ{U0T_i1%# zq4j)>9#!D{5fOu01Be7$+deTWF?w8VFXb1cXo*i)vCY#*#O@X*?#0JpCTlcQ*T_vodVq&NUo@eR4VcPAj?u51Wu%* zj7~Et-n@Ynt<&w@;cI$eaJqNJXFFLx3W0_X95rxpTCJ{_`h2@fsl6g{Za=+Cq`CI; zr;U{eoyGUebdwlt`lBT&*8Kmq-_10aTJHQK--KjBooi;VZCiv_x(enUytj#1WaHsF zt#p%UQMqkFtFEe>!$SyL;R+sBg=GBtDypx9y((!Lv>xr|Ed1ia@XC{U+@+;NX9dz76QNl$Ncs3UV;$&HHAVc>OAsmN3vi?K# zJ-dikg1p4N)Z5ETdfb+clOW=;G_BR{Gpcn8XM0G}c$iN}}9 zPQS-Tf;h;5XA4{*a%Qmo`{9uLMrbV`(=>_Q%$nOZT~>HIeFe6_q=;<#UD+)QPBigjyStG{}FSxyYM??Vq!j zjs)mj%Ctm7soP!Usi##s(a#!7M)wM%hHNmesMcyZK(VBmnQl|$Ftwf zs{R|;#7ty>9<@&j*c72}{$86MpkR^lkqH(+xf;;d5WU@lkPaQIL>`vrSw_^yEv*?t zrI8BG9+W(ApZdw;u8(U-;RF11Wi!fqXp>Qh?84>yHM;X|oPbovtjZ^F5@sxna*rTL ze|x>zK;tonWT7UnDjsCrn|Ie>+EqeSG56DftA)g&91QmIzI2G&a)O%z{-NH_ zFI^~!XeqVf5@uZ}EI%J2fMzF!k5O@9n{Nf^){qOg2e4FUQzD0%)j3Ta2k)HI8)cr%#0DsjSck-mS;3@uQ zg8_I+Y3~ZAq=K4XtfaY^>im+pb>b8}Y9QRI;8L(mo7^*D0NFn62XWi@3mZI}OSZI!lUTQdb*IbF6g@3B}rdHBAurWpb62j4_o!yxaQ z|M$-i+=Kntp=k9yc`wBmJxrC(F$Zy=l``)z%s>DiN0FN!te02=qeERZvr z*(jN%cmzRe@|-H(VxK;3Vp|!@%D>OkYAGL2pv_pPo~_*-SKDXV@CM$R3x5OEzlB40 zzRiDbH=nt(4s#9pf8XT`?WPX-s@ln37~;`IWOA}0?oQjpAM_4zkMeEB{U^?D}!CwcF2i<0(5Ns)E9JAzt#lKG&DkO20OY;HoR;*yNd zNl*4JLX;BA=PEMMA^AbXOXoKBptv7wF4WjiW4gNK|Lpkh`5mNXymrUdOu{N+894!Z z4(prPkxFg?20pOG?b@;L0CQLV=i_3zS3BaAwthIlXYO{zT6}gi5#s}5S05d59Dad< zi_xxAN(lg7+bHJE{!yr8@SFD;Yze>L@oTtu_&NhhnmbJ_vu*r{Ka8vv*3oX!;LNF4%_&dcDf*oUSCcIzn)AtF9umB2Aq zZpz%teTQp|w5l#h|V_wBHCz?#rXiR@kulceI(F%bk?1mm@AQ#c zGS@LTjsnmDdbLHS(IO!Tv<*!FUz3}J1iQMuVM<844t`ETRGx9rXi2;c=7qRG>vMeC z=>%e;;KlYfJ(>4mqYL=SN}<1Gc8BSoPtZC*3j1?Ludf!~BnXzclAJYn>*3MKc5<#9 z!v%??3EZfU1^B)nYj0N+8!A3{`cGv1!z~So=0k`~jCj>UOYE3S(cv`#8jUH8^aVLD zj+pDwg5083x**+IrA;F8xjP$X@Bp2Wc1Nn)=7>~YAW+H&cX7x^#KrrgCe7q;E8*Wk z|1Oifk0c}q%m)6NE%4fwTX^acA4l*F8DDR8E=DY!D%Yt?36+pa;P`?QAblPn4aaRtE5VXo>wQq;tZwEkSqTzf{BA(M#`_g zK+O_PFz1#_47|2DEVm-Y9RkPn7i*}=EKvLaz^z*4$d6M)806v=8v%TeK}O5l|C~Q< zZyOQ$qM$KhJ3scRU&y1t)?ViUp;{$(y??q91j*5ekk>i9k;_<0*=&zHu&wz2(VDBbFM`&@FZmlS%W(h+#^XAbo6wl6 z;khk&Zo9ER>kC&X#g4(>joyMaEUV9(I?UtiALr&U(Tg1a1)E>iuCyi3(>EY`2GjRG zj~Tn0a*;r?O(=k`Ks5>eSeDIeW7{S+w(xTX*EkfKA2&FkIx&US)CZjCQCr(iJAsNdzjsC*P6)!c4`Fm;l&I5d85?p4UU$ z>AvS2&?33vy;um-MN7Z^aOp9;s2r>Jx*^P10^=64n~tlfoN1rTyP8@HIex&kMVsZWV*+&q1w*UYl|3rvO5O}aIx zgBC3Gwf{|dm5*%mqGvzPMML^Q`6`0#Uy>cL-B( zE^vKxGnQKgeJ8`)f&8K_*W!W@=8Dh_CM@NWKVE;0odt*7gW`G6mzPZ5w6tJnPI1mo zDrl_FlR21%{hD^)(8(kE$LYA zPmdkuO6CkXYI_Sc>?=Y>wS6TusJ1QQ890|Zu7!tt%(8A14S0iaKgvRUwh0vED{F8g zu7(>0_m94TmqcgMVnFqLjZhEjFWPqqJxWdz>ArX{n$`Q%GY2dV&e4Y7#}fYr+#8Eh z_gq*?dierpKV{6&kPb|Fr1T1eA;A4e$cVUY@*B?;JlS@L^rO-eUv;l$FkS^4)aH>g zNiONIod-B-MxX$n2K&0xZkV0*R9*r=MDEm@3WG+lwl8}(*Hm)xTwL!CYj+qU-n?A~eMNF@ zNVYRn)06(4@2NI*Gr}b*9bvb}kC(W=>sL(8vE^m+9n~n-18Mm7YU#X$ zan%8sJ9|*8tPMJo z?VEt;@zgz}udMM)i~4O62UREo`6SunlSLX;MOt1;Ceupq0uPKho}VMCk+l=|)%}=a zo5!X4iwp$}8Z4W6 zAyj4!VuPaVavq%lWR5gLd-PmZc_azoE==3ro;ab&Gii=(-CO&F17eTnShWD)yIrHA zi%r2Y?s9s37(Q$}$4T{)E5>)^oD>RDW;aI~xN_$P(T!H0VV@*XPRb;Qo@N_XUUJwG zdJGLBWP0OK{pPI{VzNO0A_W`+&OfKZUeuZK499wto-*~(Gq4-~&Ht7}$_@lQ<2raT z5<|$tnMeQf>AD)>m#sj{@>1u8C4ZpJ?R(he4hewpKh^n0q3R#NRpk14@#D7eS492h zH3KguQ^)SRC?DW0G_r=Fn`H^E%12g`@j-)pSg&05a!_lo9`Tt9ZI_Sc&A^qk)1CWHlmp*T@@BS|a>-JD)jk#xs# z_6e2QhE!L&YQJ61HYh_(M#z-;ky7Fed~e2UpFFA5yh*8WbJH&c$+CB%^ckV_KGD3g zUWm3J+csc!kTIkP*Y?DDbAMD+gQ+U!AAI>)THZON57`ksKpC}-eRj0qYDa9}$N4)r zsBDMu7<-pR9EIod>D2QC0+S_b4hxXf+e%?ibXh+`@BP5CTI&pGeT_%Hf1ELY9f+6k z0dhjhJSMGhr{i}#dlLsKax^u8MZ#+0mNbird zrK+|}v-lEC%=ovkSNEAoT&Kl0DWp&$Y_KCs7M`PmMRkkC0^dQm0k^!}VYG8G zlz7Oyo_R|1D#DB;-?ww4zvHbu(cP})ad1fqFqwXDLN)n;*;6IvUmCDGMSs3L@WG&?x1xzKs2Wc>Z z1qiOAu;OlMHNXYGx*@~-rPwua1nrA>wAHi~?lTkPv;1_e`xcb(hKLFlk(HmtJU}x6F)BRT@r;*b$0YY23gSyZG{!H#>IGEF*oOxce+EuEcz88-$R!lFg{928Cg!*sJP@+c zh+gVhw5xIm)G=kDkM0L!u;~C8Vf{I?!^)=ay2y<sjTBf z^(zMj@Jq&xdbW&0loK9xA??{h`+Q$q+%QCvC@{{Q5!RCY-{${m?7bt_@KC!ov~ ze@l(Q-G9_W23M%YE>R}jqE-=g7NNwl?;L)NS)iI@00;|?rSX?L4-0yin3PiDy{~1V z1ZBj{cIKnH0hT3tTy~*9NHkEO_vD7dZa;WF3X7CPy6~v~VHtp)dOVd&^3eBwkV9-UDT-hc?e(LcfT#uSB)M`FcL+td{VC;z_q+6gW) zxqK5$45Cj(kYA?)&#TF!^VRCXo z!`r`nZf%Pd$x6rIHL3Q4QS*twe%UBt@N_Q=p; z((d_D=aZuwe0x1NV1TZT@>{vco5}^eCk}k9uZ%q@l(hp}RdSxl5Ekf|^3eF|Srv4@ zs`sh&k?xp`xfS)JkafCU5|XaP-simm8S9U@N{7{;an5cWZ_O5S!x0N33w6T(6s?_L zf8c_jJ>g1_m4 zz{MXeGl{Wd_l0d-ENN8EI|*WWauC83_%^h}1*@xxrLRZpNsmfcioP*IDu%D|k9T7q@ci}t+w4dkTwF$4CX()+{+@}Mn-Zn zsYXxIBB%1Uhc)0g;vZW1m!hRw78s3AQcI}HJG9NnrQ9B4rU`GJjC?OVc-JHy|9gk4 zFvhW#w*&=v}16!9?is zbo-8)VFu|Jx~X1eUjDXUgsgR4mR4~6LIa-08dUAO-=)QSY7_zBTQz4nZX?wZs@=4| z^{teO?y!3Jg)D}!>E4?aFp{9h}}3*~Vy3!OPHZ zHwLNF=3!d0!9S0cG~o(oCU1%dMBEvt0+^V(&sZQNJ$j$bQ4JjX{Uale*QCG~cgrs# zaNZ(*%XPFzX61F-jJb{{%WA4dvmix3XeH$ns#~KDM)edf-%OUd*CM6iMbzC%JQ6jJ z2O^g2(-r0;wA{QpC26>y#w^Mg40_vn_w(@>{@@KcSfF7#BjHHJaqhBPoLaRR8moMSQ013LXG0XO3}aG=~!0Fb8j)6tuLJi*j9>m#w7 zB2kWBuaG_CMShcM_)cY&MtH|x6M3A=UEFC3z%OZ5Fz8xND}MWt4YUo=jJW2!e1GsD z=>FliR?cD4aCtFhc9R3J1n&%|R(t3{kYclcrwAUXWl#$xlfa{J)2?{UVvTT6u3|Aa zN(i4;$rZ3?F5dBzG4RfovYiHH%oeAH;Q0?`usJCLlvR&id8|`I8`{E25r6T`fgOWu zadhKMPync%7v_~f4wzfq-0?@K@#Rv}uq4`^FF4W%b^RoCN=!xc@wlNzGnBf0Z?N8}-pY00@La{);X@7%CZ8HUv5(g<00IIGb*+0zm z8tfS%En+;egPoKxu~ZIpihr;e7!ep| zo~VsUsu&5RvRa>sxo-_hs$(>*{vvXTn!jF)AqXhoH%~(575v?=|K>-v&7`-gDxgos z=8n>XcfukTUPTHm*_x_F9JbEnfMniTH2 z5vG%6=H-$nZ2Z)9Ie<49HNhSu0J^1*qDKLz`QOjMB3e=>F=;UgO&}Snivc%sfbKCQ zZ+?Ia#9j`^Qe0GCeuv$$?t@8v+8V}>#NK~>bHcoi&FSe#dxD-V18f0Q`#b8cGS(!n z&JCvl>VP+oL3UQRL!G|F8_HA-8r!rCL|E*3(Y+JoEK#DFVD^H^x8`lk1k4s^OwI9P zl!y|858wYs z7nPlc6+ZFH=rf^$%%lZ}g*n{HpB8(vh1IzCZ2?0%QIB#&L)X27UVR!Ax6`eS8Id(A znS!K>Yd&K4LASg$(r43dcyq~yhaj9;SN`GRQM9g<^;v5F}c^xbB#XGJ`bGeM_)LFFoR4vFtl z7k10$-@pYwWNumBujDSZxfi9xq!$Mj<2*t~+zQHz7Al?PVlW19?FT1FaR6Y40Bk}_ z?;J-~XZYx!55eTm#3dr+-DFeP)Zwy%#cift6tr|cegO})je?pjHY!ZPZ?BLB^epl6 za-VXaWQp-K;gSv66fPqXLNs2oNTWe~&62zUTxx$EB4VISEm5e&RnIDA zfaw@ak20ass{Wp&JkdJ_pKscI@P5S?^}0wwkZf!cPrh^(9f^5Fk3pCtvaFL6QNb65 z#UKiV=jqiax+J0m?%Oz-7q3fE@EkrE;r z`FjLolMWna84nMJuBjTcMQ1-SN4&|9ZE*!rt){>4zWwC4$o~qQb936swCeKQwku~o zsQO>*mUu#=%ycoI!_>C3eR<#D*=bVK*sZoVNDN1n(A|POsdt@3?K|LtR7`|$Pi&Th zc&+O}NG>{LJm=Dbf7V*&AXZ2lxZL(B`$K{E@YnV82>Y|Zr5ZDIppqXX0?(7UL_c{15X_T}FsM!Q5vKOL>8NCxIJboDCMSsc^ zs$T&-s$3R4_7;cseIT|+i@X&B=4F4&L%p1#V)CFNCcnwB$1iA8ey7m2+dV1%iQ7aL|ImxS3pk=bmQjJrUmsVE+@vi@jMVi!6YVVyr z{BBCzOJ~z&l}QezkBkp{s9~!v~<;!cf`*WCtZCXPfqtWIJB-ZxNTI`LymY0sVWN;fPQl22YmS`@(i`DNav?g zal}mDw~!3fTC()*VX)HWUI=7b|SNZMoYP^oi9!Gq`&?7g6gkf8(@x_II*tN$#1 zP-oSSn@*spLDC|*uFPd%VgzA1(# z%#ocE6ckY1Dx$phN&LR>uO0w)4b9Vv#)8Huw(bDVh0$pkDnr;`YKh8+0ugYsnmyv* zHd4ifum30;vR0z`+0vo;bxCb^_fTC(=vkKx!XLi)B22yt3b6qn`AJIeVn~AtkT(rX1_1%Vj?9}*{S}sq z#4L4y_ZrFx5@^?a!Iq;tPz30!0|t^KONXVXOBv-+=P`GaCN9*!xv4zv-UM`R@9o`1 zn}gyyha3qcQGBj)eD*=r03`Fv)ne~oS(AO^eJ^dHXUp?I#8m6E&=7XI{rDUQiA6QI z6I=Cpt^HUrLM>O14=&WHzMkxWPesdRkP(h-#Jbz_w65=`=@ z0d8wtbW{zz`?4~cF-f;@R!gooiC(}I?)K^n9%?JZ5K0^qGRPyB@nNY&JdBFfNk$MQ z@sG8IbyE(rM0Rf2RW*+Sx~qestfm(fV)_9d87xF{!x5<4*?vl>H+P+O`F#kgCaaey zUJ68zXad%J)g*?@5|~-4!EyOOCc3MVHvRTQH=2@$l%PzZzLbTWeYn9Z3x`it0*E)W z6<`D+r=u2@_8YFLFl?z3cSP{+8q;zI+baejFP$Fe`t~T)4ib~hM2Y_pJk1545Z}1+ zfu#3+R1qWNvnq1gB6|TvnsMsw-F<3f19k1r5~M-iZssG0E6MCtda7+ypyun7kF z?1Um~ejN$Nw-CwMD&$*-l+^`yxs+_t&5%b3ke)!B5&j zBLa^YoT#3zUt5*HZ0qyx-_X~4t_Z&EH5=4JMpJn8MBG~=E*ITYPE^$ z&)8FSfLwG)6(WcRyPol>aY{3_@7CmF-$%CF|+SyFtcFuJJU@# zJ-qpmuw)i|2!159pi~xC={>s(3?M%%1YQRsVi8cd$VLC{#yZ~=rd%+(&UkJ6gjzOa zP`O&S3l}KUDW(`eZ!il_yJt`QO;CYvCd?Z#U0;~81pGJ6RGiaKwA<#6@wtf40k5bv z#8c-LkwD;kIQuyS7xjZLH9udj-LX-Z!XS&?NiVw!Zagu~k@B`eNigQUa%`^Gz#f|& z|4X^Q()H=86kxDH7be-B{QBinJe zA%ElotABhE*|`rP!Bk=ICsQvBy5jHOSdu3FSabIeTQSvhjtS$YRrNa#ES z9DSC#aPVuBZ)x*z&0)UCn*{q*HVhA^ee#XN`#p|pMu`Q!q@vgTiBwafLJ&}9$;^xY zzyCov!1V(m>`5;r5z8HwxgRZHp3ghiGHUZ#m|Lbj1*?a~of6W5ihWe>RZaLC z6vb2nzcKW-lo&`U(9{DLBd4)++Ry`@n(yE!HJuh*U}4bWoU3;@33bQTF$=kPQ`O5@ zZSWu7Z!|K>rNNBzf0;VqY<>8z?d}7t73=^xk>6E>K@>-vrPS-JPfD+kiVZKBSl+jr zpevJKh4>W6&zajaO@lbsMo_KLDocn{owB5+dF!sk;40wM$fb=9JpL-L2p~0)?UYnk z0u@Pb{bG3ugN08@ZZJ+LG8+d0m{S_#JHATPXO&|>m~~Lld}qdUJu^7zYvtOM#=j5S z=4}#=>r6&kDxv2FZpA-1fXe1nsWNcHXEEi=zXhA1P48DjTyKlndVahqpiR+7tu|}o z2$vg!K%9fs1*TB$8n2u-F|X-yA@CFsibW4%4Az z9;_Y)V~Hyb))0wRH4lShJMi?MbMgwb+=|3}m)scewxTGe3N#)-C}jt{^20FfqAo;W zTocPT;Bc+(;yG$v+eF)^X4T$&PTZk9k5hVWpdu&Rrp(rI${fkZEL=hfXZ$4h^5;AD zQc}#Qyc;aM)p=^alL_aj7L&E0SASK)?i#SFA|>>8fQLr(KVd;5(?uVus#|dz(w;{t ze$!2B+ZKKvcbkN*wZoZ!j={NK5jZo$0*m^fd3bA1HgDk9hN9~&S?vZ|ne$FQvuwZr z@w)U8_RCr4=M})i$(ZWrZf5cbLnKQfckba$=DfXKi_2?=Km+}0yT-5JF{`t0-)OU4 zV`+aCfN&+lRp(197lo&gOu0n4kXU@pC+COga-J7eh2MtN2wN)JkR>yTigB&q@bck$ zb%{*)CHN?(;DUa0pqmnj8Qcwf7Y}EwtDSA z2p9;eJRulX`lcRcK>S0*tZv4R2w02t^9E+Jp(PvuFB7L7gxcRP6iTd z6nyIV50@jnu|9BQi*H|IZ6L6sLIk~>MTV>Y6V;~`@?Tq}2SpikYc07)FeUAjjlg6? z>|6xr0NNG6ogS}k9b2f$lEbi#prM8vUkxJ1Ro+A6#|O4pn1wjPIZ0j#sRCX>791qS zj1I^NH>m%?K~LU~`7DdxN>_+?Wx5%3o%V{1p-%>02{j`U zv8nin>Lbti)--MGNZpeTxtOPy8F)m-QFDXF3_yd^zB*)1Q;A^<&dONQ8$*d(@l$+< zYxjguSls$6w1gu523Mc}UxTUok=8{>UqmX#Ba%|NzLM!DRbKPWp{T+%aJZQkhqi3$ z!F;MMQi%(B3#uiag{}Bl1m$}h*`juZa2)n%B90`)Wp^~qzFfeuD3JKiQ?DuK_Va3> zkg|h{zw|_0gk~YOEkbY`Cy6eFE(SPMnWWeZDJLv!A!@*7r~4m(-oldanpo%%ZkI=H zk1*698P9!bda)-?w@9P=p)vcWXI)qW)EaPJ=2vz&A7Wum; zixI1vRr?CN{Sc2rF5>n;sIW*FiagPX7dfZl<6&DF5!3U_Y@Qy8v}u2#CT|nD>dbgzMytb|Y^9 zF&hyM+hm0&NybRI?P!>MTwDgZzEcmHFqAv9e3V{d>RQYX<(<;k8Uq?kr^FH8ZYK-< zY=IMK7}6lTP$+-sUw{nI3dscw?P%|WiZ6nz+kb&ALsMZ-MYkE?!|^vy#EGNIixBwW zJkqNlM+WH-LzU&-_#iNFbyq;^qk-iin^M^SbBB5dToO#!dLcG3!rSCIlAQ3KY}RTi zYHwOFVsSY8;mwxpM9FVdrqavhKQF0Lv_~|Sf7k`3>UR!fL5L4P5pVsP!ocx4f`U5^ ze?@;1ac!b?X>TF$I+!U^EkAMwYC%~DU}N2MK%7vU>`xxA2G~ifo2;uSA~8E8rgzOY zC;S{KN`duo{wJ9z?EEGQ8LqhJh(Ld<6{6lgQ@VL&6j_~8O4saPvZQ}&yZWou#=FJJ zYi}IJx!P7WDc5271p@$QcIa`Rs*d@AaqV8({~C-z95V+uMKxVJtXL(H(cQ&$hVI@# zYpAl~28D<|eh9VbEA#R6X6d1VDH!q|_fmMEi5GzEDB&_djBwW7VJLmZh z)|!t9M-k&WOUycGdQ2ZlN7hh&kc-4ZJy~j#uPl5ZrjpDQRJdOtYqJIh&#!To9_T1> zd5C|z&Rhod+GKXY3kb1y!bMCHpD6O=J^E{EpJW#)1sZ=av-D7ceQfwV?C(NxZ88Y# zJeHGjD!IwiazFVXmpohYS#4Zw7u0>pbbU`3nyn~RP65nO=54q_ETDE#rwt1L>hDQ) z?nw!;I@g(D!*)if zr-dS~`AR-TLCLIADAhv}w&p%4xkn`3NhM`U8k*CJc*1Luq1qzkg@$2J4G3i2iqMHM zjjFks!5n-?&t8l;d1}beu#$S<?(&c4godwNy$>lJ9w6g$fWd(owNzQt!Mjzz66| z9cG0*-4S;4NQ7B5A$>kxvAB$Wzbw4MP$O7zaZZzyuMzzBwD&#XyYXpRp!%kWD7+1} zPNQ2mLBwv6wETf@E>o?pHH#>^of`$0@j22pSlDNzKdeD+YNVro6=*=N_|B%!s=6Nc z9$B@0jI!jU-`6{iP+-Y1z=MT=@&EhSt8WTs1)=j8;$39%Deh^&dkWlK8ch@!OAsNe zkmW)#=RR)_%6A%vYkwiSOYz1`SGQmpe(I-fudU4@mOuVd9Qg&liUoYwso)=ve6?#2 z#~D1xMjoN|w3X>=v9hCjFN+QxkH{@Tp)dvP98~(6BwyqY{r`TYcv47;18oSTW&4l^ zT4FuXzyy?WB4LQB@EN=uLF+;}RhP`1gi+Ldyj`vGJPP1E{=V!o^!*fCWl?SJfIJki z%6sw*20h@e2i%bF?21AmKL+XKrMdZUuN=T47SKYG3$C}zgG9_e9uCE29?zL@WcTGc zH9Z8FVRaemB)D3o(~L}rN|;q4K?(_RC(|dBKr*@&jR6VYuQJ`2%+Ys!oEiTvs6I?4sYh9eUcxuUlAlp*j5@Bq}BU+h{W({hfNtf(9R z-tbW}ZHC{N*_3M{`ox_-gPOJtxTT4udK7C$Z_&t->pVRGfuZh^G_F(pDS|R%0t;1- z_)z8n$Dc_}&r4Bo zQ`_{ST_%i@G@!N7qcWKt(#wko!TVz|3T-k?#*R?ovnFxoNx42CMB=;7%Sc z2%+9O#T9V+ra#WJpvdoeXS=oe3n92 znS(jtlbCb9uK%@d>4R+VOKIu<=%4{6c_#9{bwfZNxGE1q5e*Bd&M^U-WaNN zt#SqhRy($5@iN8*+ca!q9ry3?CHe`Q@WaYM7 zZpewQzQ)2NDUYPs{1TWv6lx8dvxrMO#-2EWj|Xw1 zM8G&ObK4A{CgSWNYH_&cUF3N5$dW}ScEJ^~GoP-&JcQ;AWO-j0#QktQ)+MZLIheY-P>we#)-*PYFP z@3RDvybFjlFuUUDIQqKkE&82U&$Jq;AUT78u82{sM0?b*3tI4AH)LTY`jD^N5Ri2# z9g5(Bi0<#05U;{Ch7l-1#5lUz zGnulYqTE{O<7ZJ4A{%+U{zM2;eFKLnLg3EI9a)eyK{F2TyGp7U$rDw|WA1BOuDw6R zP`3K+-o*$14=1tzZvnNCFLEh;w43Z0n>@ODdum&@uJ8=}#)B-dmy5v@$`^tyAdTd2 zm1EfFsayriM8@^~Ht6)rZkNXN-*!dtl%lRlY7aKz3hhPMS7r>ai~_E`L-150!$*gI{|zG{!w5& z1)(bA>1a>W;D{&RScUY|nq_PW9T*+6(hufvyn_>5()J+LKSHn~*Q2GVFvupiIiN(q zk0(3*yD*tRt#;_2#*`y4xuc_#O_d0fl`sw4!3|YP4@mL-FsoQd@3s9TgyT0$-LKY+ z6CCb-owdx~QJB%9x&@Y56{y7eb9;7UC=2qOckWcxLalsEN!z)LL^*P2zYX2^Pu$ed zKHl_Y_|}c5^Qvb+GRs}jojkHjFWIU&R=c_g_KLU9N*)M6&X=eulmu;wPYh^*bkv{lZY zLpdA675alKFeMb5g6lBplM=0KBO7!b3qh*XmmaYOVvk2Hs4Ug`9iL;a9i%o@3~NVd z{__s09VY};)74%mGWYufRN-Cw+e;!@sB(p4-j6UFaviL9aiS|pj{TEEkh<-TOoGe1 zyy!v zv}B2nXrKNQD@oZX#F33jF!n7t%Gpu2gvTJ{rs8}hor4ZazrLgRV>tV1L)2o8nxf`! zuHBxUppnKKj$WSo3ZXYdXuMqH4&d;-Rcw{)WFj5|nl*sEdms{5Y?C{;GPB(DTM+Z@gQW$~on!bdIvE1a2kGKZ;myY96;3K>VTcnL-hO9AY-%M-tM*#H4$8j?cMAwsLktPm`R82$I+4phnM4LqQ_fY~71j2sv`M z@~f(3{XnTaG?`9hCy^ltW46e z`hH0^Xj+G8YSX=yQ;_iknbmB=V>>8cTL@2cS;=t*O2jU~xWhs=MjS6yY@#ihT09@~ zY`R4Gg3{cSipkCIrvtG-!}hsh5q;L3A-c5}Op7!1Wc=ajR%O$ArZFKCjm6KpQdz|kR)q@ph8BN(=^8S7Ck-x=AlW?Y>OxYgEV3Zn8 z>P-e`cSz@d9D{i4PcfxybQ3HeJxpCqj{`COBTx)>GD-%b>;m^tQmAv+fYD|FSjD8C zCBjs7$1iO)-g+o-lg>CaoFXt?**ozxt{9a~$;_{dW2&(%eRO1~q76ZfqLwoA6SUH^ zXj+p1DIFXPLchn&aB_Kkxxzmw-ik)3(!Yh2KQ~r~tvVi9t8CVhYotaFr$>|~L4v5j z-gJjVAx?v$Y?MC46mpd2c^g`FM}T3Dp_lP`v$29lH+hmjBE(XFAV^?*e#fT{XcaHT zRPKE5x9>N>1y`#+zcFZ}QCzXB0nObeU~Kw3d0LIs@`@;-Wl! zEwR7A<3t}l^zwu5Qg(8&I_3jS7Wr7E4O*vK1*oR>#TEbDHMj3ptux@ z>q2TobzVGuwy-a%+j{>f2l{H3c$tk$BE0MD`qoNfq3M|W6HfWHoq+huArfHe%J!%y)HZ1Li5AuqKZOz7v-6;fm?Wy;lgK_`Wm#4`oa~|yw zWxfe3NsJjtyoOFA*( za?qV0A+tg$7P11eOpqzm>*+rrRD_0ys3kTU0mZ2#OM#O3bAaT1zz!A|EXM1JWQB2{ zC**NaRpe;vOeW+q$=j-WbIH?QEF75;S{;a2`5{gJ+=)WqOmy@+>tJQ<9uFT#TNpk} z^>qz>7(hYEx2UXNusOw$ul|%*(PndB`n=hHHQ2dEb+cZ!>=A1-fyFp6|4D_BbRKEj%V ztJ>yiYx3~8d_@0~ha!#M3bn|WQHW`o-)jpOo`MNA>-`2w8m8xEMzCG5lct&0X4a7v z!bK2Qg-9KL2Ux|HvFu8``@j=uTnaW5{YFKPgXqV#cuG`|+sSmsl1$gZE4*$ULjk{8 z%cNT3KWVR^dS|vXF72fFjvBh~Ec_orbpO}Z>_CrMHv))IZ)9b>W^~Tcp|p+6V1>v< z@0(KYQCD0lI+SU9 zwwExu=g)2KrhEy4Gb!-1OKS@4<53^j{>8YtB&s!RSO*@kt2E8 zLrbZykn;|oUckG@!ctwPOTbiyD-v=fkU6hu+U1q_>y)~`M0gyauTmW6GGkO9G8r$z zFbif%K)YIWsWj5BQgnP&CDWqkd4K;r*3Ln$3*B_1|7u3|@CN^Ez};K^@}}7=jH@|n zX_`B*iyKG8;EkNJ$*si=KZX}yZH0GaXq=hFu#>4s5BqJF8F28g6EIsDstMwfTB~z& z-E^7~@6y8aVL6=cZXTE=_v@%k`r}BI7{OZaX$^Ep2H?t-k&GhcRFd?d@%JjBd)qE3 z8wrUuBN_Pw(^>mizsS35WEaF}pW^XA@D0%IG~FVot=8ey4KZ(`Y7O~KQeJ{Sg}TdB zwdA$lxckK#K_2u_$f|@Z@Kb=`-SAJRtbr~c{(JQU$6ld%L2R;$?az2dv_1~zn~R6* zNL8w5ICM%yv*+3fuZj4d;8NNM1w872{|^$0iBusuuG(&EzMumvK%x6t5FDp3jqT#~ zC>|xOqq_m{hT1`rTpl$m5~b!d_{$ZvzJ;ofC=yk7BE-pvFimqdiY6%K!1(Jf)cYy0 z0HDwOCC(&9q&lwO>Tq@uZd6;C2pW1}{y z2QHT5S*KX_g;^2~&9jD|zgkDX?A@0+q#_M)-)(znG{YhdI5+BK#ue;cF~P7%M5glP zz_-x*Nty+M-w#1lvphs3uEHhgF`jE9KAy1- zm>MMO%eI>v5qx^PeldEV5oauXLTDcyW7$QNa1f{soQxmh2Tp zKg8jf-p)X))!;$YC&#`l&sgwtF;itx_QOB+tpF3fJs*;E`wmxHuLQQ{li%Sr1V_e`N*=1rWyv9MB!IcA#Uhj;0WhJMW9zHlMT2g4a71VEEBXPQ zKH{x0%He`HiCQaxj|@Fi1*rS^z#yR7V*FO*js9mOFT~AL%Hlv}q^loRUOz%gWaK2g z>AOM?S?gAsKnRRaJ27w47mQkkpdKhO*2fwOTSQ;~v*lh=m07qv&6Mkj+;0t3-j~(a z2gPXu>u#(vvZXhjABU~_@>o`#bgp_r{NK1SjVgHdsjj^o6uhUt>MaHWN23pG7RcPp zATqR#<{MhGv){U1d?B4;8D`d7q*aBQfb!T)&XbMaK)?~6BUV^-!U_j{liya_+u#|UUatz4 z#(00j43 z!_a3I6hGjOXG=H!HZ&ncEMb`Go-LZsgZ~OPm$g!U6*t>>*_)%L)GGhWPdkW?Y_F=Z z$xuq?q>*X!>PXYC{E#VA^GJu(-9zAUNdU?uf=2v9Gw`sETgI!slps$g_KUxFNkf9f zvxfGA7y0tjiUz802hHbTEzMEyoMhJ~eW^4-CL#!ez3OtC>3uqu=pCN(FgBd^)VCstL& zQD&{7go~FHm7LZ=e9gD&`li5`+g0};%EP8Iq9s_Z{J!s--$L&NbRmjuE2U(wCT64c zPP|8m)nCV4NeO0VJ!87NYJI0`9fJsBGyw_S>aBzE;kh`VKv0aA>c_&JL3_BIK6mm4 z7;brj=bc1jNhqDf-m%GqG1^&24<{bQWIpHjK6bn^8n`8hp_>@dO3HnXk_{YU3+PPCx&Qi}k$&%cgHvhZE!q75} z4T`9Eea-{K>0J8CXd*_bIXXqu@^|)nQrU)2X(PXZpUeole1ES3-X>ERv@TPN?aGq0 z#f>2$Z}SB*WbUUBM1S;W20W?@aqb*LxiJTg-r$=$ zvZACoKyxWq6F#^{b2z+aMl|U_v;(YJLx{vJWf@>OSFn9u;7qo0{)73Grx(mSc^w}( zb2-2I3g_}hUo@k|7Y7e4W*Qhsik-z33!8><=k}G@ha=c6$zx;EGmx0ZQv3OefV@go z_)?y%PhaBMa@FfaAc!=CQo&FOW@QXj0hUj<;xiP1qbFkbU-xCnb4luqEg|Tam>=$f z&Q-G$lRer#@_qaSK4}FFub}GEz{WA+??5bnzkUhfVG2!b=p()+y;Az|?Dx6i5krS$!J@ z-sW=xMkL>6Y?DnhB5TQ<`ea;L#(g4|!}Cdu-v=)|Zb&fHRm<>)BaSvoK@c^_5I{+O z$tlR}aOog4`^RZbm5@M8!@vV~9&5rZFG0)`&99&&Oo^%b8$w-%ZSOI}r22W~!J1(c zFARPtuN~F+!vw=03E^&1_sIV{V#2EwhJQa#kePrUCm0KUFWi(uaQ6=HwPI9sI6`V zs8=db%lk5vtQECJ&bZ#FQHQhoK2pS9Vlcx=oNm00gEQeHq1N%_Hc^=h2r#c^gf7Qm z<>^7}6r%QHgmcef9zCyT&@-Z^o{515!r8U_VT#s)cN#rph-9MdyYg=}8nJTk@1kY| zR4*YN7WnL-u*o6%2T5O{Gd5NAs?WMDm(Gs{e~y;x_Q4x&&ivS07L4!RwuH78Aufg{ zpG9NE4H(!BZr=*(=lJbOQE}dG>5KkZkT(!SucT*l>8R@sx*>iDBlKm(_Ln&hy>Ros zg$kLKjcdyhwCNiI?F@N>L(oT`M8Vm zM0sDDN1!e)#IVLAl@L_<_&s3s=+Z2O^jg2~cu6D($y>4G^<_>|7SR}9VqeXAuP^CP z&_lYNk=tFnL)3b5VMYO_FBKnR7`WrGcvF~TGQ#8VR$4SyqH8Jk2pk`X!wW0+qf>j` z8^g)hOCWDSr9~T2V@KDcXx&}}r~^K!KU zzVT2=v$Re1j5_P>LdPIK`qvdlcO4H{7}xZXU<1$D@*L6FmYPOESf%niGP7C@vRu!3 zq?}?-VmHmBV*Vv5A_QxlpX6bh4uwiwwuU5Ipfe)L_^H1*?1I2OMCjba39vrsb5Y3={bp4UMts3^-J5J+V0d0(6+g z>4@&*in!Gj@qNkVht>mA#*$)7&rz_;Uate~(oacOYmci8aEkwsVLrj-8Gz(%K>~p5 zzKl*Ei4`*(fKK+3<-0nrK)CyRw0sU%`OiWB5NHMxuTk#L07y8bkzuRv^LuUpCsU_2 z-)gfD&!9N_AhF@a+AvTo0E60c^Wiw4=Bd&v^FsA(QnB?>4RD#f!HqyHq8|->t5NyB z1iwh&oA*|NtA2YIIaVN_R(^hqcI~4AW$cE}-WZ5<0XCv-wbaSDhdz$v{PV7V@q@X| z=rgu>`m!EJaUuzL>2(7Jhq~r?M?V+%dF;$5>gLRx4k%PzEurx?gEJG(XB-INg;s)J zzoNeAlWS}(dqT|iJd=LU*(s>3o;R7lQg75#59YT6Na}%@?cj>c@#6#YlK|r3vIwkV zk$gA_jzqWPeKc4R&Ngek9v|(O;A8(Z#|S@z5+9wR$O%Ks#HXbM{6rGW(;-U=v9#>5 zz84+N4O|h1!sC9)weO{hvG^1bc+)J1QbPdh2oM# zS8F4gO?AO8J-A3nTu zNjx%D+OKEBy3U2MUzt)ZWA(vtPUGPt$u1VkoPC z@1%=okh%B?nCWXY?f0`(W_|o^K*6x32%Krxr`#ARlDg94qeG&1qK24x4ImIhnshfH)Nc3aa;&CXpRQW?PYv1g zld7L?cij=as)oRXi>{rA=smz6l`HCHq`uHkrI4{P2xDF0Z!vI9L-zVqyNp-Qibwka zV_MRb+SthOUcD8d{nR!nzB0j>@O#1evZpJCP zakONYsFzK^PvJ%5A@IJ~J?*)gA7Jxy&YLornw&+xB?$n$l9RPpfymH7U9Y@M$5XdK zp%Dz<9@B`DgE0b5e1LIrWVWN+T$-#&*{^EyO((aARe#~U-SDz!{lA@_ry|GRsC%@s z4JIcdn-8_{KhMW0M^F8g2>?i@2+f>5Lk36S@*ozNZpj~_H=O%*xcipDox-S$2cL1J z<$>)=NCd|&8ONBZn#4)?v8_UO;KV?JO)Y%R0Rf+uvK^-LO~V!{@o}Cn-IJlna8e)a zv9tI)!+JRbQAE_-RU5E{M=xdhp$HyY*Xh9kZRsAQe}6kGEWf~>8Zuy@u9+HLjaINr z5aN%(N|g59QwB}UvP811wh|2m>o`YQ=7jLdnyQb(SH=sTC4DCo2ayhGEbKfLV0rD9 z#sdAh+8(kXN~m_ZfN(EI+jGO&zvH{c!XA;@o0sf#c^a!1g%h-@OnsVBt0xis7C-(< z=-<)iM223fpe&z)Rd@bIt%0&yyId83H9>`KqfYBG`#+c;f0{3n{7e7w65hb!79`0> z#%%BbAYYt$XR~Te&;3A-F083aKkl9dJV5oMRaKa zyxM>@TY$LkR*xmLq|FdI&gIzmaJ!XwvTC>N*Y0ZW}=|I3EdLWzS3 zZb>Hn_4I9jPLAo1mMXZf&#x(DZS(UGrMrntv>hE!xf7=S0!@`?D6c6LMp*&O{eDIs z9~ZopMAXAIp+s+&n1evOlndFEE*0*a*V3Jn@dIaIYx~1?+rJ_&K!s(ct^ae`4^c(d zb_Nm&kS;(G{%#3`yrE(8O4%kjfp6V354As!EtbA_fWiN1mOjQ!V7j)8^0?Xw~@k=BgADZ-C9 zjH!_=yM(Apj~~Tx1*o%x$ag1FI}l=vFodQwp!Qb2Se@Z><*qeE>uL_Nmv(RGOq&H` zKIKM^`yN5fHK{uMIz0QnLzM~qI(F!H-jt_TKUBNA$`dE6Jrm?tiMh+-Q-W1?;Ny3h zGo+l9NDRD9+uv3^g z$5D#XSdU^Ee%kc1AY&gE1weZfA~dA$MI?Ztg$lF&HOIQ0=YDR{#lCW;1;G-A-L#^9 z#iNamX~)D$$JYd!2I7uU`JtIWHZK~Swr7@VoE?g{6Jrj*S!}sb&7WsE$~u{BkKkIf z@9Y#%U20TWK!V2a?u8XBXJU9lGO*-MngSM-%%+2j+wv*dMZZ&~9?H0`&ja@OcBlz_ zs0F0R&6h|(9qsZl*~h|jnLHMGW2wukL$Z*Bew)gHgLSzlnx;HEFgCq=?@pF9OH606H;1aNb_5woB*q3DI-HSuT|o5D@6 zMKvX#|BSy}EfHCfe&z#x0$oMz1$tS(EyYXHtY1>l-G3t;vDZwYDIZo#E-eSTE{fJ$ zQ94qQNI2=d!+-}Pc-CnJ8splkLl;;cnoq1KY~6Kw#i`Sy-BKaxM6&)L8>YI^Ac z3qo=Ki@qH41I+GEaRig;KnyW)I&=J`i6C#d2?kx+nNC_=Sg~E+f_BT76w~mKPXGO>Ay>bCVt4fvYfPn|S z1>5K99TJHwysX2)#Ydih#wjmLsWLvhHw5AvpESl zF@q+{<9ZVSMs!v<_UmH+``auztEgVwIWM1i z%1;cgW~d4iUsWpdF;?^_v-tY-Me+_|t7;;IuYU#$hGpLTrL}TmNw)UBIX3r01-^OF zOy7c(QoZ{8{%~b9(P0p+hr)~DkfrxEuG%mqO|HzHx4ksbb;Q7aU=$!S^@grI_ zJ#M?~J3wC2Urb>x{q&I2Xt$mz!tZFxEeKE7$}qmEPja&=1bUCa?Sf!yTWvj+?x`7p zI`KF7o^PtU1Jk)IV46b2&2BD0Ccw@%XqUV0!DX?n0fN$56CVc~0uTK%8N*Icnxfp> zAIdw2l*1*8=qo{lp;#^tX=|h{UaAM;bWG_9^+0E|`M`+eKqk?_kg3G%=l86^-WWRsB?6r~MV9!UA<+G5$ zRVx7HHvCAIe*{%bccKtI@#tU|14;ZmXYmPb1nT!c1k_cX^(G;=lnMRF_;(A#T?esi zzjAyr{nd&7!T=9P*}dP@O!@6WyB;&l_G@u^LH;Z3XtS*k(BKY?S;yjZ5)-J$! z4lhy4Fq7EM(RDg`spCqTNMwmUFLGH;-no^06F!#wcpe>H*>on1&%E^4Zz_es8!byk zVydRdN;`18dJuNWcg==T>&?k`fz)=`aX)Y-@pPG^ST=5UZz^H!qPQ^23h0 z2~jGsz}KQboaL`+LZd9VbzgJnr0lg@&tO<4l8B9B(h%>VzE}`Q` z`qf{%JIV2Vau(oJN7w=Xv$A}M88;h}34(W4799a}Zp|}28e#pUBD&ZM?$11)i zd|3L2;g2LjAD96=Cq|X?P#(SGQV#+-XN)Lt5fHq^Y=hNQKUUf)5uA2VuF|k(4)JD) zs1-AZDP-=4xTtBlumS}uZi8OC7{@?^x8&|OMg;FOBimNdHw5{Y{q~v={Tv3XpITm3 zpi9J5t+eq0`@^0vfyuSF7SEY1pz0#uD1thb)qby_E7o{xQklcE{qd>C5D%>@2fQB^ zKz5BGDR6NU@>{Pw%2j#~KLPUIn?=g=Q7_Z7ltAw-s&Ju^F{%&W!J>VIY2Fzo!u&c# zXMQZn23~o{!eaTiHbmojc-N8kwKj%&W-`7LF(cl?r$DZJO5|PGlNmWiX!}uJs^<0_ zkqefy!aW=aNi}- zKQ^&KH=q*+>n-eYOaJ%~T1HIoL~@+BV&XvL0el=w^*e?$^nnTS}-&rc$a8m(580KI)uOh>e>`2)MK#SMaxIr-<0V?0}YNl4U0nM)|Sd7D*Dy2sM`wp!(2!PxeL^ z&4+SD%XFtc%~_yZ01~-2>T*hkOGZM$ZBfQ&u~bH1==7o}ocECrISva3nzd9!3dVea zdDy7=erKnJF)%COP$53!#2vzpY)!@pE9b`@(fpqENeUrFY{WSj&=KWg*<9QZ%+Q)b zkkIfjahFR}$Jkw-teNS5)%Vsr_)%t%r-v?FS`MH(a`U_RmVJjbdlAfP z+O=NZJnG~fq-{ARrB23}ljw{Jt@Z?AAKB=K1wB+Xep1*`yR<(~d((GKb(M8Pwqoph z`#>u9jRgIpNPJqvuIL6X7*luBa+uIVCq^x^`nN-zkC$r=yF}8%zrKS>@YfO*qz+mo zpKKoZ>CrJfGAp(7x=5kKjVua!_gq3BpD% zH@c0b{cHlBKdni=R(b~{O!nV(;>8SdJH5>1;Er$lYE**y_P%N3FIJQhD868CxVxl1 zHmuHhByhr3^Yz!q{l;J_Bo}o;ZFaqZ>L3a6ZjAg#YfkQU@S22}T2Bf+;;=x1b1h{k zfzz#hhT9>flxM$3Ucv(VJVG<$gk_Y^Rt8absIuTGcp(1i3GQcD zkGs>d?mnMsnpuRWo2?Gxyfz3hF?I5jQP@UeBu($yne_sZ0nSG}C7pH(-Qn=OO8zYC z-s0Zks5Jxby(&CZ4hzr}rjDX-vJQ}EsbT?WPS={``}`FyY!JJPQaAzH#}#@JN7nGE zB|x?!%0^OpRPmk2X}&mhb|VR0 z=3l3nk(ouX1St~<@(z+HGD<|Yis}unQx-80)G6=si_ob*)%0?%W4)(qeSvuR9p#*P z5a+nDX5lkr(YQld(Gvu_dmC3l>#cDAE~?{fSE%pvI{Bv6!*xUFa62|v5aqaa^oNBv zjfP<7n>p9D+}TE?WVy1buq}u;l@EbTmjcBMP(>{ChHv2(B=O?nLK(x=zeqS+J<(^R zHbFC@5PgLs4|6f8iF&|#?1+YzawYd@Y&;*AaYuU*ru~AWPcVhIf@6E>>b`vdSwfNw zva4W?xJ!~0u58(1hK}X>KWZ}bq4;zy%K343-Tqj`9NfBIe||ql19%v9AjiE^_S_$4QPrAx;HmqsM_!gh<_3(8H3E9n z@7AKHS}{b$)QoI+?ybN4v0mX>^A2M)j5IjA#a^jGZOf|Gy6=!vf_V!&p$6_pd<|z< z?4quMHc{-epszF!g!c<7N_1(3*Ao>&Xr%)dg&p=di}TorJsU zpIUGQ`?Mn?4I?(HcsbV`7XVtE2Qg)~ z^AfXWjT|ub)Kt8?0h1~@n)wAYJlT*-Fa9k7Ja}V2l%p`2&&U5a%_rB=Rf~ThX_Da- z3abp)A6vd~1@bfQbVk3D3k)P6fOV;6Lw|xW<**~jbqXvm}mw2P?ZLvEL*e$(cGZ%Ml!5w7!ZadgwGgxtsh(BbxE~x32vW`~%0A zQZ2-qQ`PauR2Th|;AsR&>V`*nHr+l734=2IpvtC39lPs@H}!x9n@*@RdBlHb(3^_y zx!8l|pwO2x%Q-{*q6??N6sOmyFxjJbafL`3#YH9BhNvAI5wN{ki7d&&O9@yBK>eE)QI;ZOM8n- zh^68u$1{xyh1ZJMJA`Ndqid9Vb*B9*j0hiF@{1W2se71$Q;Ad*~BfB=fak1Q#Wg2DHpT#TLocznL`;9QW~%cJpq zcF*_7ld~bX|BY+`j^PBiUw_62(Wl825v4&IJ^_WKO-^UXC}yNYew|?&y;_!@ zXUrup$H|8sHumJFiIXbX${2W+v(W%Om!EZ z@E5~&Gi$eP0z@wiVhsqqqL}cR)=zh;VNQ&@R(I|wx=@|Nc;iTh!ro-{rdg`@hJtSt z?GXvqphHk&oiVOQ3e)6YNG4o^G}m^jb5dKp>MsU*i+nIf=1XGk#pnWE>JG>Dks)tw zB~J)Cx}o46bPUjNi1_pI1iBcKc(++BnS{jvc9+9d>PX^}!;ZiJZl)C6QT9P7Hp`;y z=|qML>KmLkXvU^l&*IWkh)H*89zN%~=8G6x!gvRtyX!C+aQ6*yU!ml+n98`JBv04_ zM-0RAW5-dQM)c-6uYZ#laKc!_O~^sT_dtDKinPJmHQGR}ggh{qAlsVJQqjm&*`zaf zY(%=<_WcUe1k=tz`h?K!VnTOVQy0?i8H6v2ni`)L<4+nTz*nPSBORw!D3by%JLzc) z@n1JIGzs`|E&>ikT1*(8Y{&f!d96(VL;Hi!JtVPZ8%R=>Cha-PQvA?K!St$=Dci9$ zGPFin(GDvm27Lh1g>x(cH}C2DT|(9|SqpHKR9lsA_0>DoYQhpF3x(o_A;=gyxm*BM zJO#iIhPPd#ks*D1pTKD2$br~w71ey2{@nJ^04DbUqJHwPo$ylfO)V&ey@RfrVm)bo zI;L*`(hGc)%U^1FJA%|(FY!T3fc4?a2LX~%K>uGA!VAEnUqi_tPkE2I_#~i(l_|aC zt*DVq7;s?jvP4tZWWwR=R3$HNJX@Um*Y}uqD>Eg_ibGsJ^x?`s387F}M?jhBsD|`o zu7zrF6!?F2-jXPg4EQ9xy02~p$iT8!we+S`}+p_7U&&0of&u2U#Fo457s?Y`o! zx4#w7Rgn>z*BIrUtTLNi5z<}#7>M(D?1a`~uA39Ll)qJ-uXvA3bsXL8BjCbavOJ8z z7gqP{(GV{4WWwL)=K1QcbZKdKWPv0FH|rlu=|`W&*RADh0=%cMH|nya^rzie7HKhP z*3ZB$ftd;#I^#T{;^#kbEB*V4h?a~a9t4haQ-huMR4P4*`bu)GIZF5(2J+W|Ck2tS_(tjZljF3A1NK}FoT z@-S$KMK8*-@R|OMxLS`N0?R#0(tGhDY?J#1<6^WOqItZQ4$U=-U#?ZHkb;Vsq?G_u zYsFz3?=aA#K1&M?>x!jxh_U@Ld9e9YGj2^G6g& zu2J{!k3ITl&lw)r)Yc(a9KdPb^*$F@FXg=@$ADiJra>(65Ec$>(@xH%&y>+!^nwQn z0k)7PpcVdG3~C@LzVtg%{s|po-QyVxiof~9{A6rx#PdN_JLCA7=`sxz21&iSBQo#G zJg{>6f#kk5tw8}_$*$1~2Tf)EKOMMk-);A@Bv%L=+k;#vXhoflU4X6Wm9*jOjA?*b zAgVO2Pv%_04IZA+#^aqYIAj>`=wIw7yCN}j^88~@n4=j)YO<#Pz)5HJDg<)MNw9YRLc{Y zlSXXKd?#^Ib}eh&`v?g5VsCVVK$zxeF7*bEwBoT=NS*iKEfEX!Q{F8@Q3sKt{gI3S z?W1b~JP>);QwI>7bDTB*yDqf~&Y^t;5Bt?gYl)IKldr-)&Ig9N|2TgFL!xd7i@!XN zywNxI{S%axus17=Mk!L+J95x258Ew)+Ut$b)TB+RmJTWuti=c|2&J=ti$6hJ!)eD%oyvoq?4ET@R?6ij;#T$DuEBj z2PbD5HG2&)Bp5?BJT=POEOQv!d^*d{*u|kNtD877%=VQI?(5y0XF974gyzcBHkoK>VS(bH?|Clnq~YC=(BqkA;Fx_o#Sl(s?&5MI zSIw7Oa$Dq-9V^*zGXE9qkZDhfb&>}t3HCHZK3$qABD#_fg}#0EZ)px)qv2;b$%L8L z+D@OsNLm_6nz7e2;HzJe`jtzITdr33vUwMN3k1%2P=+3eJ`E`)>hRHXRvrqbl4;*U z9s+?O)|Pn1o5xua!9VeK$YR#ow3vQ#h;GH7Krb_A#T<`yNl~)BF3)`~D{ulv$X{N) zKB#Ti2U`CZ9@X^0>m)z(>9jOHT|0E1)mXA8Z!B;(Fu^~EW(r3r42H|F(@PoM+h<4 zDtf!OkTN+6V$`_~1W(;?8twq#6$(LGOAvbO^(%`gU^s=rv#Ns zy1xE#Rm&N*QZhq7#H%qm4a+Xjn?Dlf8=oUO9K+2Q%+7H`y&abv@5Q3BOo}*vQ9XP{ zC0v-D0)n7IlaMDQ7Ns8+dbKd8FjDg8f0L2tutOZo%>-z{hUeNaD?!Cn1ptQ2QK7?V zP~SgYB8UXDOM9)ItDW!f$5%o@5i=J74=Ja15V-@M!vgve z%W5s}^d5{n&+CP<-pU!ERIw1Sz>f%vDV(HlfJ38g$LymJ_FcI3b4|6r=i<^Y#7OYA z5ay*;j@I%3zvQ8%BCI8}ig&hyL6PH$H5aBZzQ|LB zoGRdld^cbSyFRdo5ep?i4Ko5rTDf_Xw`%-ip2C*y9Iy<6ITnom9Xl~!p@7L;jYrG# zS$;p$#7emz8cr_N0_+3HYC9yOxtZ=(Z&TpWy*alCrqNrpl}LpC~UCfobkQn$!Zy!9R}X`9z8IhJI*xLN zSC6?Kw6vyofUajn0QW*Z2%i@ft1Tf2PGPN8NFWL>5-IMwyobMWj?%OrCvUFN`1mm6 z+?y{!4Unc!uQkTx3H5gTl!xze)KAO<<1Kr_M*yd#k1u7j;#Xs->(8PK^K642FvV+Y zAtv2a_n&m)4Kh_|fJNpYb>{+1JQ`b0`N05 zBKYE>Z>yL`dbJQDQ0odjX+y>nFXO;|O-L0VIOF2J9|YIy6gMK-3;3s)aG7pYITK`5 z_hgsxWR)B0do44b~@0Um7*z zq5$HKTSUnQFxCow1LHRgYisz7+J~E(Wy+9j03EEZ!Y_WbeQqL1^PgXt(Q%VSmseNL zGDG&PCImSaH?2MtK=1p9KeCyQM+s)u^dZkmrZ7I2~+SVoBj z6sl45GAS&%S<<=N(N4X!+50cvvGUmn07Pd$1FfDztFZz^H4s{PJfe9AHt=7a9&mM=X_kt~3p^+*g-j zVRj2pSoul`og5U8MqwsjBAu5qwR9@Awsvxq%h6J#?!~th?js^2NRj6j3$(V=xgUWr zzdpZ7oXqJxI7bQ!Bbnp%+bHK!lUq~%Lm=DD5D0pUO%BO=Z9@|N+z^uu*%)6UAnZs} zW-p-ID^oMA|CCD35ZS%O>Ho2PI<^tKT~G~&F+1~Eom^7mU>9b!hUu z8;eMh;d%Og7-gvz9p&(fHY0!1q@5mGz)}s^?Kmxjda$u5xC_79ZA-k_O9q1bZDq-N z=XhTl7qL2Ar$&fqgNXjbcwQ)lQr0JUCWTHRUz$Q(q1IZYVmbnRld zqzEcq18Hc0#rVgEHY(nH94N7YGEd{v_sDt1=0`b0| zx$znHXl>f-m_On6@q>N5Ev0?9H%B(}DlJ|?`aXwSp%K(Lp|||L_8T~1U4KT-xTQD_ zuis$vfqar8NF;GZJUdQdvWS&y4qSZ|Im$FhFr5%OXj4OasV@R(NyAk=6F*tTnSNYR z53PD>KIP_6RVULShtd$RPgJdnk7Ed8zx}gDSPu0T(cxA8M zVTB*%sH_|1E8$e?*g*Vrb>wQK+(_Uas-XA>=NA(DH_{x6VWh{X`SdXMM~iKUo&IW$ z1em0t{S6}6U_^UER#}45T@GzA?#mIwe*QsKa=GraV~#0$umEy76vo3SsA)-I!fz76 zU9mw zZ9fGqJKkoO^b{#>w3xWL(%Bv+t!Y8Jl`dgac?;o-(w(V&=YW1$C}BU5!mY5S zs6V}1W>s!S(*zi1ga86%sceF4G71XQp1JSq4QHwd#`k03rj1qPFY=9bbF>_Gn3oIR zzL02}?$uBr5Oz=53$h+%4}-$2XkE%1rDhxBe?Hr+DHXR`5I75e_p5)qB>3hSudieyL^@58F`8$q*;p|}vxnW}PuByk zVa<(B3ym1eFc0~;tj2o(P_!fpd|a-UYkpOX=XW}g#lg95d6O6qM&pU zG4HiAs>Av4VBUd5UD}EbqwPNu<-x4M)RC88i#rV($p<$Bd>h2LK$PEwxgNro)Bt_8 z{qA=;U|B0xGB;gL{My?sZS|Z?lUm+7w(G}x^w_kttY{XUe|2wXhdUYvjH_ zRAGGh8X=}sNH*%&`5zuK-`M;Pv98uTSPxWde)&Xa-B8I-!RWdkb&cH`S@^E?=W<2% zE)zCap%BlE%vT&GSzgM%upL$k-D6S+=%j3>nQF^Gpw@v8J(PcO(MwCChyo*a+PVzc zX>PrAe}P2>4B5vL`4;j_6OWN+%0Eb79D`#MJMbZL49hr$lKE6uC-xw8PN&(I0C(5Y z)X?pDv)Bs612qum572RJsmU~S+UNYoawisw^m7lpli)(ItKnI7jq7k2eK_5y6+ra= zghw|Y8egqr&!yg$6z1#^72py|sF%?#bZ1u8c-M}?ha88JN5d(Qv<%(;syV${g1^h3Y#eQ<{s)9ei?Gf z!*koz{&^C?dLq`Tg_rwXuwKn%*|hh&*!d*|lyU$RYfmaeX*(-E{C|UZD@UqVH7u@R zam0b&j2PB~^_ycbCR5*(5S8A1RnDiaJ((NHw7`lfl9rcSQu zn6@c5`WpSY!q`kw_qI&(6S+*#OPZg+901cmTxJWZvE9O-k|QaHY+hcZ{MkERKk^_W z4;UO!-wm1@>(>_CqO69iwirYcx5^O|J56mlMkKquBI{o}bCk&!r+AH%N=j`Vo&R4n z=W~CG$3V*yST*pR^aK2(41jx!Xq`!L76Zssnx(PN^>2U0z;(aJK@rWwX)oX6N;e*F zIPfh-hgtPmhl_pTA^t7Z;krkDqc&QsDDq*Dw}}21m$o?cjP7ANB+KcooDy4*KTfoH zD&%I&W6dHXxu4B4sI~|S3vE;s`I`zS7_=B{6v= z;aAU?bhop#$lQ%{-lXkpf%cVhYEd?s1Lo>HAn`H({TOua$ax-iF@F`Eb-tnglCuMT zWI%9dP*TzwG>l4&wHn`VoL0lPK3*-w!#EbSOZF`@X0h^3xi0aIwZxGN&-pYizIA=9nwQWP|LO>uLddNE&|s-7Sk_V33pqz-P2n%@k>w{hrf)nZ`y) znm7&N(Pn_pwJq3JvI7fqam{w6AkUOJJL%z5+WO49g!J?#xw*9J{ zJc+}#<{J(HL<#i=;$n)f11JY&-Q@ocP^PHg-2Ro~Q(g)pSEy(!g0!?7u%{Z^{hrsK z18^p25I*^0YSWpg?$_b%ubIA&Ia2Z^dJ^neo-5D+yIywDrHjZgVnk?kJH z?H27npE+6cnHt@6$wfFu{?7P?re8yZ{5H2kx-b#=Sg=J1cVPKytR!<|Mw55W2WN;|LH;;b z%{QPoeiZ^?d{BlGxHeILUx79m3IG;R{jO7 ztJYsD_A3^V1WY;t>@j=)Hvc;_q2Lbcjm^uHyomFHA^M)_JU}GNa7>h6*yBG}N1U2Q z6TXRfz}oa+??|LRK&}U}Ke!zgW)17x%X%#di6WH$3_Q6a9PL_SN8<~@1oSv4w}w>C4& zE&`MK3zyJpQcOi1kIcb?g)F4|Z27aG&BgYdmzGJyif3n8A2+lvSWse7qB| zA0_0%!}3r6x@Qci#O$kFZ}&W30?IpS7~CdCi&U10vO9X+c(Eff%Xp(^Yr8|Y1#LTT zn*doUF?&4UCz?)0-tMI}f5u=x2JZRfv$?S4o^l}Tli7W6&-e;6@Xj8Bs!Bu`FzW^c zn^4y}q!F4*D%G3F)^C^5hHh$|G{ZTm1ud#{{UP9<-tMW~GQ*%a7t^o>)@^@)K$El_ zJNeIu5b~b3le(!q~cEwwf{73hr<^{ z!$}CY_=bZu975P=tPJ^SM0yT?jNr_;IiZkt$RIXV#aVxeN*e43JXt|{j8X9gCtvIb z!BWrxY&S?CZ`aWW#~o)_TAm=bqtP*a5+ z>4b?*8ViQU7#2wt?Cuk?X5H_qj(W5W2aZvhELzri5+uz0g2u`}0D#1j%J%w0fUhAD z!~UN?R^PQtg#5OqvR18D$N_R2; z$?~B599jzHJ}VF)lb|C@*UmL`9P~vjQUQQ$(xBsB6sBwTl<(cVH9jG1bXMn+<+2Om zX(x*O)o?;*U3^?K6d~{{NSW0`X-pg6US1$hvL4nq83}sgD4>3W^;`@_8y)&hPn3r;xMVN~V zOS*&2Oi&=q5pBC=nx)A=R-92o0)s68I@@d&bF7^7J2#RDIPNx+Ra$i?ujKnU)XbJM zr|4Tfu)?{C?(ke`xJvKi!_>QqB|^2J5VpDJqS&d=X;fF|hdP249S1OhggWvvhM*0Ktt8rRZQ)2o4UY`++htTI!ezq3H6c1`yP3 z*0)gIkQcv9<@SNp?h1r92OL6304fwc%80PTTfm?0D@js9k%kvmTw;7f789e@QMM)e zRtMq;l$xj7QM$@=6#FHr13QiM$a3u8F>b^&LH9AcRQO|c-1JL;v5!=7XPx$k`6@H= zR4in2Q$phS9~@^yW}`Rhx;g|cvBJf%N_T)`n^yxVAy?S#m6$avJm0&S{S`=SQ<;C<-%Su-86tgdcm+X#Fti3D8J zC%{fF37rl!pMIN&MF8BBUZXmTgo6W%C|7~0Sn(G};ysO7L_ z%4!p>?8qaz0A88n5kTtYB;LUaHLm_+LWfwIIsPsV!5<7Gw+h3{w0L!8jUInV@~TEkTE!&pQCX)+ETwY?S3Wuv-;7drWP~ zSeR{^Y|$3z43NSvWiKEV&sa&}kx91|#Ac+PHGawJDX8F&6*trVRZ03r%Q^mv%5fx4 z)7do}k({+I(kVpk^-td=&DU4$jPG=z&*tsg@k!X#U!zw|b!CngcYr_cDA~`F;?R6z68nJ@i=t{ z%^7Y4G?!=(lx{#KXbf373z^83!U6Vif+YjHi!YI46`A7!@hRK>arpa9SW$=^IQPl= zbmXx)CB*|2tlQZ15d<`G`t!T+AARhZ7GEDyIcrTK5yjiW0?{SGpxjF%977rMm5h?< zyQ1UmHIC;w^Xt{Hju+VY!R=V2l#3GZ=TkOQuwkal!g=Xph`Bm%e&r(O%mX#Yn?LAz zZ-Ko1oHbixC1L(l@+x?U7K~6Gjp?H*BqwE-y=22 z{iQwm*KQ;5rWG_-Asup?0LHUoRdQ5om57A85N20ol$7h7KXrb`{?f6D#^K^>ldky+ zU9Zv?d{RjOify>{B?JXuRT!hcPHnbhOTYE#n6Hi0V=T_8mLtHd6n>_iQU$D*kI0OL z0cMBm51h{y0W1~J4g>m8*~v!vJk-%iOPuE|bHsuGj_6zuv3M*fM1Nfa(vy&dx^K+qwii(r!4+`Cq9B5WKgN`*6E&#i6kxY@1LYZPJj={NxH1)(>EKdPZDb zrr?9}rK*qs;4bbbD^+ZqVNnsxi?+cKY;Pu>fbVzx8=5gvi`g3-kMwsMGHU|RL*=lXLHu)PVc$ES#11kriEdZjTw3Fh9G3Z zW+;rJmjbz<6R2nc)0oJ#qDX)AE(Rb(=U@HQyLd8-ZEZv>w|Pwu!oyFijC znRkLy63iGBU#J66q7D z2GyE##+2=-djzMTTa3V)On!3%uq|c9UOY7Ba(Ij~Qr0Mc&Y$f}Tp1kA7nx8Tnj!~< z4^|x)VeXzElE_8;e7%q zy=n-pkmn}$_uB$`Kfk+$Z{d8C2ov{CZ@wsL! zpAIP}Mlm@wTO;)?+5p-23n0UUzWqpHJh@T4=E2FC6NjKYcFdpAyq?jPA8+*EV5oyf z^|OxKZm_jrcQh%A^H&ZapPMG3sY3i!H&|T60Ib{UT5K66T*B|-n;Vt{UT=CCb{K?Y zC9H|y8gnJnvT(I47~!@CF6a3Zpjov89NPubgzNuxjZGxzPokGSj)Y=VM%=1njobTG*Q zuuWbeh*)=G#2=sk{G(u)2sKC&j9m>}D4;biSS+5Goa(BU8-p9{g!(M#)a6%gvrrr~Tc+PBGlT@wBWm4+lc5>NNz^@qH^K*UeFv7<|LJKH_u=tphDu?DBX8OTYwq}C zY8L&Mi8%2{K+B{rn_5_k-{ic#7)7~IuLrJL%NhC+6BV!5{iMFu*Tfx7nx{h=%~S~1 z!ohn$sHltXOkKZJ_JeSC@0LrCAoswOF#dQiFM4)a%qe$U`PdvO$iIjWPeIHbD&Dv@ zInc8bMx`o=2!iq;0J-V$O;TUA9UYfm+_Ate-t(oBs{zlczQp%THj$$e?~iDaeWmrO z$F~g#s^D-+v~!Zy{|(bWfkNQrYaZSY__K>LChyxU=WI3$1$P;yi^1k_|KJj|4VNk* zr{mbt=wKlPXIi*aNBwAjhAxr1Lva$--sVZ)Lg!A!s^9dJ=O)d-JJ^s-an|)h3Ph^> z&GNmo&xw?p=M1r7&+Fg)DC--dgWKRU-MLgvr#oDe*eHFkO+}?*Bz~)HDE!3MltTO1 zN7)QWJL$#Xbbvuu8Nw^i9t;}O?gA3j=k5>~qNHwHz=uQyKlbRE%tvzlkPy6_evR}* zM=>JHFUyiS$@RUQZhBMq#+J6AkLye$fzOFi)JUkFOf%U@U$yvUA7a)z!LV(;sd`CvSKxJ#x}R4%G+4+Te0*L{W&>Ig>Xv z`tnXmx`v}%Xs?<5yE76sk?X}3@T> z_n4~o^N@(XHjKOc#hxIS%jl-MB&iPb>ckL^K0O&fSsExMN-vvU9@`x@R>PPP{bfX5 z=@jwz0Q368)4;10ZG2rk#tZrk6Cy>72CF1(Bisb@Ttf{Vutu!Nvm^RJ&~*5+mK9>D z%m%-5pIMP#vk6F@4-U;BU^LCR;IwUvYUNB?ho1+^$24*iWz+Hc&z);WP_5D>5Qr6w zkNdxs2%iyxGh%U4UmxJk`7fyHprXoCymg+_Kqz043G&<^REIUqF$HH}mbV?e;(3ve(> zXBiAbt1A}Dh%w@Z#%DzF;^ir|Jk-9GhyhC!k=7gnOc{yl7LHLAf<1NB5{2=MJj9MN z{4N9qza4@2isGX_Q?++Jv;;Dc6`kZd>=(=?Pw)miks6Zub(sGHmNLofS1H(+GILq; zphK%TFUx*j=Nt0xzE>=x*|FS)=(zHg>jYN(EWJh}-~>pi5D`;Iz zSvornCM{;NsbI0PsJ=c@5ivxk3n)uTVf@REEBZ?6f=S2iR?OnTarta(F-Ru|L3tiE zAC$zxxV09sgq^Mj_Mu)IiGJGXX+qIq<%llu7f#v;wTVE>)?BMQ6~035j(%}*%x=0B zBYZ&a2p8RAWf}~8ra979h`AJzQQsgG7%2^!&;u z>)Q=kT^b$x0Evj#XuDD|li`h2K=q68>qhB>dvX3wS^GKR6{5Lol-|(xpVH_- zfN5Y(P}Tp~{tRt<%q)b0adjGP)xo_t#rYfz1SUMBtFQ&e`v+Oawpi4evBjw-2lE~u zWLXvNR|}w;T!_cS_HRhMj@_35mC3k8zr$=7h^f0Os8U&1)H*o3oY*OasfP%YX0&PT+7b72)?KL!6Th3W+)gCnzwV;C<#N5RGD zU*dX2N*l*>T(D7E+px5qDio}pYm72>>|Idz2zx>-1{ph?z4oa5uKGtMHib*UX4MiJ z4v!u;E)4{73G`3^?@Oc~s30>R!VYf;WsIcz3X)sNbjvZu0vrgY=e;^9xn*|mw*=36 z3;&66{3BL}wt%p5eIizWuB%q2;uocc&H?x$=z91IM$lta+NVjIX3J&gnat>tT?drU z-5wV__eH1hBI%2HM=tFC@a(p*kwQ3G%*N&8r<(rk5|ZArV>wTX9&H`K`ZT<~Irsu9 zd}eryvVOyGjuKrc_N9ciQL+bz(EWq|gY>9}#OZuD2Uc>bMB4yaAtWHk zygJT!>>Q;d3+i$b_?pBkKgus~AIK)u#};v)GT54q-tY1aB762HzTmdFDIF0p%*k{W zgzNL?)`kwDVl@_W1Ihz*D7jjk*q+D38S7F*REia^4R^-ItMJK)oLImCm+^q=Hu*K! z3sgW`s`ec2_}mYXQ1`-q*08D)*^yGa9gIdq1<``mxXv80uB5bbr&_dGaHPcvxL~Sh6Fh;2HL4Ai|zW# zqPuw&Y|rt3$M--ao^wzPbz!?f8RD77BVFkp$oibP7qolLD9ULPZx9Sa;j> zB_XGk@OoB+EdON-Gw#xPK{FmD39QJEjnNxJRb&KCocS51YU|f_nUG3zv z-I!~ldZTsZ2j12Lj{0hU@+k%AsDVZ1+_6SU&8AdyizpF}c9q}Z1|~6qsWuqwBc)ia zZI9PUl=JD?L!`;vE_R;qzr$b+w)-FocedmNp*N>^v(VC6_i|_glVzw!yZ?Qt1O}vI zVJ~_GPNvt3`xDbEv%N|GI^_A~57YdZ2{D zqyNCduLq>rC$;AAi7#>lN%iSI$hPdDO+wDf?f8SiqFQXgdn*P_)*lf5+Tt&J%}Z;} zkrt@YzJsn&w)t1h=#o(@R$BB28n+WW`ZH`MHvB{*#k1tm3dF9+l}sD!3l??acS_9P3e(QxJ%p zh6m!}h1Do=7Q3sTEm-itq2g~X3=yF3$#=gS?KpOM2lyG7M3c#1Eq~X+x!x#t_*R3o z^Mux5OnJR^!?Nn)e)0_e{s$rV!FN*RHElz_l2xN1E8sY|EZ!+OGzcs(ep~i4OOp8n zE?RTd$`{OL_d;pK%%T;;M!i;@hk>6+9+nkNfZM!E2fD#2Z`ZH&a5}dJgAL`C z4=6s?9#VTbDo-HA9`v2-IaX|ioqmrk!FAQNj;Rh(-=p|2E3m-G=H15xsd38WiG_24 zdX$!dFC^1ZGGdIjEgz@Cvl!vsTKm7`yLkhN9Gc%)8&Cwj@HO>nSSJZG714oCsO{&{ zV$BLJVIPYhBN3)IF@ST{VstrQP#i#PTZp_H0s<>*O+$DlOlX4|p)uCU=1Zrc7)}v? zO8$p-kzq%Jn&EEj&HEy=6kL~1$3I>H~DVEaUk1p6coMl){pF6?o7 z%lG?p={)^kF81stM!i6t6mi2RU#EaFD-n|(&1m-vpMfF&+FDUMxcX|JRF_&PDEjrub1H;eB!yN%13n>e z$=%!QN51Bw_^f(oUO{qfLG0b{jkK>)WL!dIb9LTKXe?E+t>%X&WGhU@grOif;j*>B zN|wpn<5!x|00cO32uAX6UBDvw_NRfAh;|W)1x|h192W*DLF+jl0YnHm; zm+qT=eo7emSX$Z)k%=JdDk{T-w8}?6-KCwe}($y<3o$swgDnCpKdOpEdhYm}(CmYyCHO@ER)BvJWJJvEnrNbg4ZhplP8qJlR4JDQtw*1~K^rr7~jE=y&V z7o1%ZsX#$R=gB*-e1EpV0F>#^UzQ0O?5tlV<$=IxxRwiDQpz+1{690m3FZe&$b>!b{V4u46&FhzXUrtFZS?C9G-&8P`<%)OET>G?9}SDH zd6`#C4YlNb3H!~NV~dqQ`RPWQk;N_0|658zNsJ@G>noAg3*~|)*}5QaSK4wRwEj9F z*UNfY_k_tV>?fUz*lfpP+yh^Z0{zO$``cgfiiev<33-7+9xN|D_f$&)BF!)OU348EaM=y$5$w z(i+45fWs~zA}G!I5#%U*PKj|x$I|LDAO{A{O^xP^kmMb*Sq(d8J^_}8fk~0}r8T6~ zb}4tK-?c^Rtmt?;=fFeLnuCTBElVL)nkF-t(F79W^Y}DZtjM`>w5eKRLBcwvM*0D= zB=Lspa^e`{_>O8CVj>0!jyHfyxLx;8NJw}EdOmU+{{NJI2hRz9;_{MHJ7)J)I4wMM z*NLRr#P51x!sYy|)R|$HcpCx{PdWjK}X*$}n0ADhAA-NV-T@WHXC8fH6_c z*DEoxz+g1Z^27H@coWVbgheMP1Al=iVAS4c7`Cl>@e*nW9n3KXB{`ziCeUeF4XDyI zbhV*u_Fxpa(!P?PFI`-T!g#_I`4-h6w!-Oc{YmYQ48)f$> z%{G4D_g@O(gXjqq8eeKdrYOVn32J*gNXb(Ky=lLP6CsAg{as)q zH#m~}rh`HuZR?R>mpKWP4`*&E<)Q4I#btJUq77rBB6Axv2wr9#Xl+U!HbvnaN1}yF z5$BDtL%t zN#lVih?T;Vn2<2ZjB2tsyYX?P5Lqun+X{GxrpWQkc}MH|{|Q6Rn{Ra$e>c zoYKhWTJp!u7p3lVtnab-85gd8RSo4UUp9{9Zb;8}YKzXQ=Ec11Sm(0G%7*QaA3zH~ zRE}&9ePDDcBWHnuY06yt&yjYkkKr+a1f0Jz z>OSx=VWrwYEfk5@OuQJ}g(%>KAc-Iz8OL;us2F{5A}Oz0^B{IT=c2_gK~=<4abgT$ za^xQ+)r)x-IiEmUJumjrULF3u4&jup=t^2w`3^c?dtBMS;x1|%Wf3PwWBtOK?xfRL zWz0@0o}Aa)q8qdT7{5F#b$O*ry=cSoaYDAAmN?He!`XMoex#^_ zmCc`oBfH4CGGFZ_3Mqgr2`b+JN^4Xy5hUUYO_(!I&J+j2xgc>YQh(g+ov&3mgr`y$ zc*GE!Ni(W#;EsO(m~+FMngw#ymho-Cstquvxyk|=4P~#9mM(ONOviYKD| zR}KB>Qg(^f>i%sIZwEa^F+!{r3@GXce%v3*IC*3~_f8&*Jj$M_Zpf;UC&$jnLa#A& zEq+A#V!5edz(@~DUfFm7VEU2feKVAz@t5@m4)A3KkJ4t=XCq#Mii0TFS{eHJX zQCia5uTT8Czj^xqcB7(;{6ppRdAba= zr50CyDD$lz-;B(_+M;-4!bapTodOE9Xp#*}6f@Ky%U63|T(ctPl628`k*T}Zl>)~T zV`w!TlhSoEW8W7M7oZ~hvbU3PQbGC}c&g6&EJZ<6gyVFI?ZD2ltx2+VV%9H%j|ft| zmWNvoxP#Rtgmns{cA#$ouqaB$9EB z)janM5=e7_pKcU5>p14w66%%apV>`T5UKTnwtFlxh60fL%GbY6vGk3P2*KgrnbY>n z-GQ5Da_KTPj#N(Q?m>UM0_2U;eT&R%$QNIu!j)!Px$rrB)-=OD_1en}9$JAnly_En zC7(ChGcSqXnw5ETWm`n)fM@YUcL)E_u!`gKrPRsFzIdkEX*+sdI$DlVrjp{);0I>E zOBcS_boLlNe;jxp8Fn*ZX+m%fi7wN0T$<;~SL2HCuRRKd{h455{(<2Y`8AhJo}}GBXLU$Catz3j)xq&1B;`|=M8&IE zcuKE&6$_ej;4tOb_8V;s%M`CFw1}%R-@n9SD7%c?gX&tRUR>tTX)ACXoSS}bk|9s!58|I zYtVIyAYQ9~{A}%vL2dFCSS`i9SqQQOFStft)#!8y$H{_2ib6cRblA@0`~KqQIwl90 zDJDZ|yzG(!xDlH3hD4wyeIqq;VC6?!$=+Y39ZB@CcwHBIyE$F|y(Cj@!xCN*M5qsC zy>rSq0jiwL)0@rP$;s}bCMy=59Zw|zm?@#IF1+C9t|uAItyYlp3tY$ogTQVIU$IsR z)58kDFKnkOjR?`XF4w!(h-&qI|{`$Kb!SIN-< z82)dC{QLGs_&&HJtWFjZXuP}~CkpCQ2tY)8Ndx;{_B-FWZ8r;BUD_9?ckGRc*-9gw zvR5nK^4QX`YmtFuY(``IbqoH&=6k1!l_8X59?gH+Q~(Iml_9D>5)X8F!`Zc4lMT)y zpmUcyXz)kqG@TN7D{Kn1DlajH(KdwAUNSur;=D(;pmd{=a}!45!P#mrROYc534tCk zawxFO{W}qUevL@rU&|d4MHV~wv!c{h+-eQB%{E%B8mkvFq7xQN1stZ%kYZQL&b5>aCYT2}H+UXM+4T zNJ5)$+sZ(rGdlytCmu>yd=X3eR{5N^Ec)8W16f|trydx>9SyGLB?l$UWO{I|ran{=~{>WP5-kstZb zA|*A}ONr@yI|wTqGTd3?AYn3Z_zK}-v&iMz6V7_r8vz$0;a%Y`eyn&Oy(lnzc{dAw zMAz~#-o@1rpxA&E(`wuaK==h>b2~U8!^&zP-b%9jjzClW;_4^T^Uk||x6pQk!O6g0 z+8KanLdTyRId~YIo4=ROiaIlTFdZTWpZTTA!?hXLjL`ID6S1#(6D?(WdgG{kdkWw! z@GqFnhlUpAibZgz1YT-CNp^1i-|qif@v>c2GcGV#YSFWfl7mF6U$IkUD_N}-b9WAi zh80-D&>}hg{A6RGmM@S1N@+B??hm_w)p*7rL)wIrP68Q0nQ4@&?FDD~2{!U#=A_`KWdD6xCwf!PLoEK#JPWZOo83yqm-inN zg|-2bi(0=-^9J73rPSwyyY(&^HCiK-hPQRCsNY^~_ayImx1skXc)kW3XaG^Dug9?c zmaEiv)CNtD%SBKJRHa+~CzZwzK&lO?CZrj;gPoA(Umk;E=t7v|n9(i_{IzQ-8oNr! zAt-KnASQ7&9*;~RtF0J+6l^yc9e!{D(HD|O$mgF>J-=hZ#kYX7Ss4rBA zF}E}8TMw_|;cdWejRe!ys5cxhDyc9n&yH=HKUBt^uChn?{WBYI)9#1_2vwakfJF@U zj>r7dHv>lK{WAODzf{o+UZDP$eCKp7lB-1D455k>F&$^!7zCk-!H*Ui&fu^Gdp)pQlu;Js1gOPCt9{a&yvOm4~ z*|Mgpyl-D0J|4(PVm&Ii&oD_vkU+lWK?y&MD2aqI$0eB(p+H^Fk{R$HYBCd?2bgmi zp(i#mH9|iQwSKiKJX@dy z&B_m2O|;1#S>BK0%6A6*)s2)Q4$sx>~>lqU6 zCDC@=86obM=T8ckHZyH!6WnvHS!yP!u?owD;B;?Sq2a#xI5)^Ak2(?wt(F1r)33vg zlAj-N2?Y1gl|4LO(nwp|q$e3~Qr+eHM!l(u0OJkt}vGgn=BaTet;Ki$gD zK8`1@ZUx@`+kP37o+c0bjiXlLF3GH?bUG%_{hhBisww5w|BLLO25AUX4Z_PA#X90f zvFLcjk)el7b4Owuj@S&?T@y)<#FI?0TsjB%q2g7DQYt2}*E)8))7>YPn%Qy&~! zl*_uX;EpNSh1?VFqQi^KvtuSc#>}&rChvVW%$7_g23)0RGMAFOC6IcSx`O}UJ3gS7 zx}`n(?x1d!VCQ=ceiCM%-ircTeL7I(KZ8ApXiR;(;Y@y#r`!f0$(8!JDv{= z>EvpS0fwi-E7eS5>f~vqpr*R$B&%2X@?a9C=SokJCdIFOKfX8@@#Ffgj%RaxB;+ob z7rh_0l9)j)#sGXZe98j2BSb6g-o3Knl-${LC|U^^E~G(p{wz92OssoxP?b%hX${9{sLBdzNZKp$Y;Jp zxak>?zC;1vFYSFypSoPylP1{#7HXLRRk01#`qI=%hnwx(p0f+X11Jf&XePw7>h7iv zJ*RaZ6+RC@P6%}c*4at@zTX<%>)I&&Zhby|%Moq29LPL}1pp%_gQ{6dl)CiARje}u z5}B?>x>K|B%M+Q6n2iJv4AOxA>)oq{sK|b1qa~U~UO64nT04$VYh|}NDI|K{ z+##@MhV^cfHUQ0v+d!W!(_zMypZXFN99y}HJ4U;6v|QTd3HQaG9tK(H#8y|zhLHF& zE~R50L>n29!p5Dhu9^z195(j~+?A$i+Wv^)DeO6L%mOR}@?vXWX1pE^68utiLSI(Z zM(Jz#l9xNNux&yHc|s4WCOnIIzW;yT#fT$};J$ESzXQD>&HSs5))i!uILWXO!31?nSz)`r?^2wYM4v-C zy+8((dZ0>pYzc07d)EwYw_x63tk4^%p?C}q-90)#$kK>QEC>{ZHIiWsfW`*_kvAt$ zUHLQ42#i{P7Ova=%yvQdrg0rhk$vY583!-Si>XWgZE7j;M-9lK!rK`dHes$9Y3&n% zs}X!rMCw>qH~M0f7~i0qikTlEs-k8!Ha4xJmCgNsEINQ<9GzqQ=pd!%20Q51hePsl zWj>Pxr@{2Sn#S?jlq|G(de0H!|DI!j%xCW_6NgNAphT5n(O8Cc$+E-=V|9^M=?u@98iOZ7~yUOX!QaV8mzi z4@9u%^8(xV`y!@L12b^AlD!_FjCz=KOO`N?-{*1APj%( zr42HM_Y0t`iuP99SRRG`jl6q}9`LLr!uTF~G@s{rE2P|Z(oMxI^BT3eWuI44v{{Rm zIuE6{@m;@*{p0EbGbqlkp+4>;D~eDQ(C75~V8+m-PohnpZ#rEEuR+a&QiRK^`Vocp)lF3f6`gxF2H+aa^_7HKfzO{oX z=x*+&|{;EaeZqO54}EF^7*9xEkeJ7Ns-X67%nm`I zZ<#jM+0xz3OFc-`;9pIojP@Q}>}HFljhcwQ@`U|F%ZA99Ke}84;E{BZ2lOdJ)Y70C zMU$i@$|U8;OH+#FKc0wXTNH7yhW&tipNjz8@-OpWdS%}oVJt2wl!yb7LVpFZM?~OfM zxow^!y>D(h!IG+Vj{c9>Hd@JzIKbL+TzgExCe$r{oPt>Y8O=;}0HH`V1i7yf-##$I zGQ!lr1xGc&(9(%dXyXMf?~##E8uPPk)sK}m2<0CUIT6%>CXWC{K)JuyqBR#8$u^YQ z9AfO4kOir8JBo7Ow#lx2)_5ZwZ50irTiz#sy!Ee6(TAp)aCjT(khm!%E^H8F*2=JQ zMflzzm5wTX7T6yvbfeFL=Qsu=z7-7b1|CQWYCxz~RA=QgMsDDmLh7hgwfC8FN6kyP zNG1`ahLmwl^nkX`2$Z8rzI82b)RhjYo89^{f0JGBD6#+$jJxy?dS$bl;~p81XJIb4 z8zRUN#Gd4)fY{e`c-8-3Rd}(U4K|93C0lwNQYhtABzTIBj*~Zvg(z1h+x$PsK$gv* z0BODiw}jS8m9a$|E$;HqiDr93_{<^>aNb4AiD8dHbOh*{^y?dFp;_u#LOP!~3P}>= z0X+muII$`$*y-a{e`L1EI$D!%=#}$*L?il@l6iArZsjR>1 z9&3l9akn}M=B`T3yc$rPNCji~A?nwgQO(*(bwSW2{to|<&xVFSQE3d&IZH1gee!h)^-ptQ5NvAc?yY)X~aZ67e zCB6l7+Q5XC4HS>u@Ax-|9layvRj;;X%Ehx6Z9EnccM|+^%d|Q^WK_q+ZRIMurd!O@ z20-lG>rvlVtle!bn3wUrf<`J>(qJz-JkTihM(;N5#{hG% z<||Mm)lYuUk%c&IPuSr}B}+r@D{o5wZx$5p&X=Q(XV_?GDX*aBq zuZ<(Ei95IFdry{55nrSIpQHFc4EM~)gtcJzrz)_C)I{bgnbjU!GZ4d6;-(Zgx&1s4d32${2m)iQFo~E z|1x(1w8Yp5!pUg{2*rA+uIsAc88brCaCU!bTto*NtJIXsHUD(^3`Sga5AWPu)$zJO zt>lz(Eu*(7C+k|B0VZ-Raq%;8IcH%KhviKh6%;x*6rT=-qBA7|7D(bLWWdZ((m6Hs ziaB=?_e@cW4~abO0;HK}R(hfdHGI;G zMR?^!K!(1t`;`lgvmKBesRqZ7XaF4>GoLGn;divzZib?moK>NZ0bWkRy*TA*zpKO;bM_TxZJ^o(e z=!okm`6;YAMQ?J1b;obKsmZ9AaM=u!D@>;|^rQHY6!UEge`1?Q?LbH?ME&9N1I?55 z*F-QP#!DlUPTnH=I>>Q2q{Dn^y-#pJm#>&S)ZN5`uT^k`x+7|TH2$nMQU|Mz@NcfN zz$<}QoID(wZ>vyOMzuG_=1~>!pr!(SDT2N3-^a-FR~b*UH1K+}|BF;DKMZN_J;C_% zmD~cfSpagwDm7%Xd3*EXN{6cpyxP8WSMHTIeVDAGYdsTD5Z56vGaSvn!Z>SawSAqd z2NgH?+{&z>{|ZfUB8CPbQ!t-S58Z^sDQp}TjckT#B-Ff+d2KpUC#@tA)Tr7nAYehR zGK+j{!)PFC-jTnH-R6g?q-=Vmw#`|dmhr}lcTXGo$878sX2RBV$(<`q;lna7#La@~ z&PZ>FdjT(F+7ama0o&e{Dob4Qm~vj?;G>Nm+Kr(nbL-e?XxAFVSWUw$5nZk~Jf!mc z@~`8Ua51Z!aVh-0Dpl#1h$wab%ken?af$##bmZEk^@vaW&x#g14P^NSNhP4~(*8X( zi9J43pn}ZLS}NjG*2Vi9;8gv2^mA<-h;|5*`+ItHkb8WfPtk04XtaVdyi6QU&6_Py=I>MK!1RMvZag7$qV^&` z_?cS zO;6_&1x4UlVDUA}KeR6M_1U#}q}geJfGxL7rD?L-mb%?kQ%iWeyT4_gSD83)Ivx-% z3%Gw2>-ozYPcG)0!7{&y=H_|Li;p6%dPP`ISN6RTkm=IebX-v470;kLwF3_I`c_E* zce3wf{+kg^vERtksfP)EV(O$-@7XQ?7B zY~GZ4u<03x(}cWf+D+TZT$y^F`()k8(^ORJ$y^;rt9}0%r(;V4SwQU|N{cC$K#0L* z{i0#9&DlYdUSNSRf^eb?bB7~ch(ON3w{wf_G6MIQZP0B_SsBT}(Oj*fcwsw9cXl z4&JJ^)$W8(CT@I0f)njBk^)!&95o!H(7(uFpE^-Qbd%9%f06XJtRyL#ox8R?+h{F* zZauCOtGy9_A8obwc^74@9V083th!lsyVUiBClzV#d&YgbKS`|)1}{&K`v}{Fmm!u4 zM@M}pz?83PHaDf?mH80;fbG1Br3I+$^Sq}i2k5f0b!`C62nR#*Q7yol-#LZA!v`)+ zG{{L2s*7{EdJmQ56fL$Njf|x=Z-q!H+p{vL!e+<}PRiAGG_=ZLEUM0J4P%*0B*-(3 zVdjW9=@K(`3cfC_!m|me1appHK2-FQF&gamkx7VzqTztY!xAxOlw+O0)g?Pttbh6L zQK<#woid?SK*Z>U)i9a@$7}*7IgL;UR`#SxqB_i71m2kHi~KLzO|}o*CC8|l*@bqs z5%P-_$k`6#ut+0OxjT;@eYe>FWD?O0;VGtfb}FanUmVjFvoxTwiuF=rIVH)D^GYa8 zVLs$Dp4D<)Xsf<1Ma@t`a{bGp%_@C@gQdGtmA8YOx7O!kd&Alim>(Y^6;aZW#xY%k z$B&x&<9tXkya0G9-2X@*Jv0=&cOH zrbGCc(_PM^1%-|Up3*YZf)_4s0xEELR3493-;mH;jO~1KQK$-dU$*>}n&RO~^g50c zq~vIE)Yul(L@wRf%2n{2xzs5~V}1T6nr@n{Xj_FXVkdWI_IPE5H4;RIJh78a;uO+M z^pA&>xcuH2wb;I~K2Z;c;(eV2D--!a*JiN_rCC3zv$q{r2cfd8)+UaABDGxF_b2JExxPX%hqz&*pBugjN#yn~7O z{~-&Rv>o7$rY1nRD=-W}Q{X?ifoOsyJg~#YhjzOv*31f%^;wbCQPmx@)Q^%M8{i?U zM5tAU!r3T1j;M=MU4}I--kM2Na#xo6-=8a;qh0MxcmULZN#Q>#w-nH$jTcV(tjx`; z$mQ6V)3q$jItq4v|C&aVE7qL7Ako{SVh30sWyu% zDpP9Q14oEr59$IN3}H(tn13~}ZtzP0Z|n^~qR$m{;PYu+4^Nsly<%r{hkk6u+HHA!2TLdSN^nbn6Nhyd85Whus}&<8a{zHTWfc^DuL3 zW-?CbTAB5K(~Ttl)my>z>PG^Txr%QRDK(wVPu_dn{)7*IAQ?V)vuF{MELh>Y?p+Rt z?IEN%#bLA2ue(O`K>lTjnIxYPy;Ew<^N&LbybNmAW#9f1v#FnNr3o-1pHC_rqQaFC zh(1F;vjuE}TBzn9#g~h5*y*0&q)Qcg@v`2}6-~godkwD#KNtxDnOgRj?fOfHmPfW; z|7EpnZ1i@jDG9k6lBA`RxuGzn&Ho7pCOh?{*P*V@Nreh=;|IxdH;A!9`MHW2?L9{3 zqwD`q6YW`!^z${wF*VW)h5}i)fj|`a=9p>04+`loMG)@)ZeRHl4a`A{4wd)#e{Yo& z&g=j&4~Z$wgovYI*UDCDn*!G%mA~r4cN@XtYm)!-vM0&yh84r|F8efspgaR z>4E12XD($ilZ8#E!?nZ<3S&;QS{Y5pO{xSiH046OGs_-%sjHBURFc)Kck7CY_< zB1V^f{KI4Xnt5lA3YrLsyZ>VgenPbptu0ZyS9DkRTi4Q`L7VILkQ8b`r!>F6mlhJC zEA-*ybN$siRf#6yk<{Dn32qn&WFR2v7{8T*u-NwGS0H7f4TLhy=d8ZawY%KI8Y4)Q z$_8KbSIPf30C#U*Dg$1__(RWUapb|OpSp*wR=l*v-nd#FI(;=?d6*Cr9q^AD)elgq ztHtMQ^3;lj!9Ka7%gJ2YObP_1Pl&sW(jtdq*@UY8e$LLVOQ2J03`n|MCS{`+U~#Ny zXYb^PW$ma**ccW9Cc4oQ*|EboH7WP*9W6FLMsKOzXNj`oPaGB+R%9|QFRAy(hBgRo zYQRyAx`&7rx&HKU2T?OxpK+9^6sW<+e#2q9hC{-rnjej*P8gf_nS%g-CCvcmXeqjJ z9?nt(j4C8paxs&Fvfo%E4T)*WYrpPb7&9fwxY(tcQhYWiMVe6WO*O=_II-Fhk|EHC zepXinVCenmyQ7n(>zQoae<8=iO{92^_nH}i4+iZ9o)CX^6DsRRVa(f!_00AOX_vVz zE^C{N6IW+Llrz6hoKl)XIsLH5qC;5w{W*lEFNak^4Fp}|MZs*B)=9t87j7Y*(gF$H z%et%V0@Zj~bZKX@OJ>HRxGIRxKxkbpc4hi&CKHs=qNU|v9duL>QRl5y8vYHMM|alV z2Lz&yH(`Vm)JwN`O~hipXtboiLJcJd_-2O|POY|kWfTTYs?%K0wS(O~Mq45sbYO3tXtr6fIRQ zCg)P?T!K_yw=J$~1+d|+NFq_Wrqf9MgL=vZ5F^+M?F^&6ylRvC~v4F}IvXCA#1CA7{eC2$lv#+{#pdXxvUC)a+R*YMS zM~;F zxscMeeE#FR%evR<61}cf%DHc)q-BtXdFD*$O)}i<4!XM4DBQ^uV9@#b z-wfG$Gr}p2@ejC-mR}&k?o>7oyk&V zM$XFq3E8fRKtIl0_VdC!l+h95age-9NT!FjaH)g%vKeT=G#>z?`zaQ_AIZN=DuMhu zK}M>=F|9ol5JHQ(b$rkTjAstRO^>88ypmH~AO0)_zWR&XPy~%oOadj=T=Z|3 zM?ElIR{Qb7DKAq7I$SgQH0p6o!HXkrs$iNt@I40;WLPp;yqGD%{4AG2`-@;Zb1gwL zWxF8@Aax6DPiDqQzT(j~W>;%2Q18paRzcIZ1Y$!U#k+B8He1Hpg2po=WN$UT z;zzz0Ffk(oNp+kX0N{zTsB32sBvbPLPL|=y5Z-0VJ=-a|VUat}QkBBP4e-05Ch}cA zgc0qD=3i_dTSEzXf#6baC%uf`)u5&vSMCwrQfQdBVc|I@TUwzjOIrD-603I_)NM1o zP+w$7a8;nK(J9wtn)TvaC(rMjtoUZZ5!hqK12uWfwxSwS2|zszOX7Etsginc`i0BH z=gVHd*cc~S`|7*Wjgi^MUndWYZ)1zetgkrqV0k!^c7g z@Z22qc-hr1DC{rkXr5XC+)62{QgDEM<36!Ot&8*r9bzu0g zK8RBLEI<2NdtG!H?D`7bH;G~cOI@C>-|5g0e{7cYzR3mm+e2mVI;Y%zf1@E_s*Z3U zg;b}OGh4V#WSx*Ub1tkqHYE*Ux+;uKeAc`e7|=;FpHm$jZi`oofIu0oRi_BhYmXk9 zFvs!6xy3r}7-!DjF9|_{@&e+t5B3_+9f?8*gzzt|AD}N?Y-;pgKaGc9Mm5O__?Q=) zOxzg~FfCK$)thJ<{)XkLc0uvCiKRrrb&vX#V$I7OBMKoZ0?`PQ6X4b49Mv*3queWR zyMrOWrXVm6f5=9{Myg}jzm9pfMnitAm(wFP(8%_7kt+gE(Y7VeCC0Sfs^=lKWS{%D zC2-ykXpNHTCsM_F5c5nuw)&A(+#Kqb8YuKWxaGsIM*EJJoNVCRu+o3JX~bvqE7}4y zDZ@jmnQPUD(j`^D$4Y(PoO#kDWI<6tr=JnmmvJvHYR5O2PK8J5v-{oC_Xx!4ox*y8z8Dw63fRZL3gvM1h_d@!yO>Z## zV&8_~tX@udCAqcSe%e?EN-$ZQ{01@*UpqP%6Sn z_R+cUO993{^%{Jd$zz;KOK&W>Pk5|&sDy;G%7{?@n65JbF!Lw3;{!A!dKNOjxN5!!#(Gbibqq5s(TlyGUT5Y+h zP}_bo^j8~&$705XNecCHYOEi9tP38QWmYp20$)k z!O%wU)&#Q<)rsa{aNPah8>Ik3prVjK<7_LKDe8#KvQK5S$0f&o2ZAX7jhn1&Wl=$7 zJZ4mCJ;u6~VH6fEf>n%?h5#FZz+D0hFm315rPKj?)#=*bQFMKtk%!U*qeyl);Q|pa z%4%bL#H})@WxtPZ=RhxVOfEckLFh#{c!A33qHYVL4}K8HPk%o3+e6}xDivM&uZKFy zyz{~UB@PfP1rjszHF5OgTx!(wgc@H+x%tKZJPvA?v_6;L9!70H zL}DW>eo!OJ{Wp8e$GNy>fZIuXSe_h#2Fi@tYqi*7bpXT>YVZH))eniimCeG5t-!Aq!1y~Tw^AG7+CXXQlF zcPO-;gj_My>FB?Yuhz(<{KV|ndRy=XmM=|n5hUE=NPv0Z^wa4W7LK>?u@($9_H?JZ zdST^XaN>y$pvgZXB~8Av_Y@34uEN6#!RjRw^Yk1TM4YZp2#YqCQcPljgp7|UirEUX z%tMBDW?$eb2E9Vx`-rNl2r8sNkN)fE@_CFR&4b_jn-RqC3bGcfU>U>lyL5`Iyr21k zyF9+C-iuRLU+=<55T*t_xVLjm{6`Bww~5+&t;Bd0ZDc!x1cN(PH)%Y*!`V&Au82f5 zHN0^&jMUkJEwu1Y$GaA>nR^-7*yD?=)^q{2eh$0x9&gwDJ-$xEC2+**-ee!m)vX1^ z?pLXucB&+jyvnNAT2Nd)`@5SB$h|~Sk&(N0gY<1WdaDe=*6;XEf+O4rAdpYTO0l5V zVT}V!fmZmiq|)N-2@(>;l5N{D=oxMO48AP@5x3x2c2zs92kXY;#|aH`PaUE*dOyWd zDnGQl0*_r_q?uB3o*PLT{AHt98bp>TRf~gBr4HX>T>k!xfg41&7-4C$ zjPX0Zl~)h^b{K?QC*3XLRJH=OtXEQ2nq!9A`Y<;>=2cT|QomF7G-v7L@(#i_dyH!# zDNl+P)GNRK>|@lKL%FpA>6?)lKc(q@XU`}{s;ItNW+n{<=a9xy%2520=@aTl!GXM% znw7WB14Zoq2RMgGScnp=ukmbmfbrlXc~_1olqEX@)1Q7TrSf)AwcTx*ZgmHT0yq5ePm+(^0bhagHTC#iZpAs9Pn4p_Eu;yYoa>Ki!4Aq zjn?%5Ir{MNnnH5X!pReQ_152&6IfVspNU5tbt~$Xj}O?oYIlI;GJVDFUJMg!KoMG~ zrD$JKM**kx2-s4nx(2$^v(&BFBlD zqPrzN6Wt)m4m>N9Td1`uxKWjC&j*nL-!59MMQw!AD4oA)YSNRw?}P)TZUB%!nMxGwz>DYWRh&i9ZCHqeF-z`r}Fy)^*pxwQu3g?^KN73 z+BW@eFFtGA(Ky~U%(E~v@OVR1=Tx2=>OwqR6-vojipAKaqWHTFtxmeiqrBTRc1BcH zUOsgNctF+bWj44~5{d*H7n9be^@-b!Ab*HIi-=>oT9cvoz`D^DdXC1VFOlakLhk6S zf-6rGDtKJv;dso?*-~Isp`8QK1NL@(Jt9+rHsA@=ZyokI(bPYT^=K90&7T?GpECc% zq4a{og;d297|jF)$`E<7sx~I*C(Gt!-@c z-iKjDzeXLzYPbcx+#1{f9}v)CcK7^x#HE z6lAq-KZFtWKGNB|`??7wh-hs+h4{itwf-Rlkf_9kUobq5#f2tdQxCn{$$fk+Z2~QW z1w4}``4gp&Tm|a|qDlzTlFN|~`RC2b~mEmf|Q@)sO!&p@OV1iXMFmu)Y@6-4}!I#2_vI2j;LK$b7?EAO&Su0yx?xi*Uo9 z^oNV>b8fl4#y$)T`lR`u_qy`d&ov0~Zi0b@M3I4bY`?2QI8B&@J?*!CVCFB_baKS%BUKy8i}L5Ci7p-`Mihm zt9o9U7}0+DQriS#4ZAe+8rs>ONjkwnHa&^7j{b7#?co38B4wxCe6iV=vq(s3Ri?y|!7{VkMgU0PC~$wHQB#tSfd96zENiJQE6`oEsAXU#6wgMtU%m0|jKb%nNLhKzk2i`(k@y5eUNX;ZM;jIs!U!!Aq1i(Ak z2oAaoJvg8Q{Hb2<+9KT5FqZv2kW0Yajc)`(a%eaMYdJ-9L`;mAxE@MxLt3QI5E~Bt zT$yj-^uyko*Vnodilb@~wt z1mchw51~rs`n;~zU6_6i8N!{X#WHt>=abjOMJ53DzPrvyAU!t0UA zJ{?`%!XF0pVI=jQkNg?e#MpiDAIin*Vm`~YspS1pJ%icuQ3g#r(0JF$j!i7I z)YEny>?{XeA$66^PH`I@lI=j{G4w4puhNP2aPumBw?jrVbYEBe056={Yy{JGp+~`! z)j|eLv5(X~F>Qa5a>qf^h0Pk2u85>FndtEVrMqphU<0h#$w9~Qx?c!h8>6{kFFh!` zhU9wu3}2-Q`^rqpoSUSnhnZF3d6R?>#ETsA1Ba?h(-_STNVkGJ?b;5p&~C>$X!ge9ce2NZTuu^;ccP3RK}&E>O^f8$>6h5EW-WmDiQ4*dK+Ssgqg3D(KLe zjU)@z%>Y^T;YZ*(qioA^nBLXOYyg3U!+Ug`B6)%XD9h$sETELM{Dr!|b@pc9Klp(+ zJQW+3ygv0#pDM*7xh;Mgq0T~&h~~}|{2lULd0RUf9H8+Pg(T{wf+X@Um3a}SAl>b- zmcQ|Z9i2TXtU@vu9y=f2$pkU92S?}(6eVG5Z3bHmER=Fr>Qa~mhlKKz+wb&6$@`M( zh;zT+m`T#?=mU0FSwte?s-s%@GWooAj;2VyI>hQYfgC7_ekBSs|6AP*;o%cUn3>Wf zI9BwP8~yJ^L+e|F3vYceNnGP6m4&&4B8NuIp!5%2H>=VyWvGMch!RZ*+d!J*@CSak zi7mw{``a|RHn>am7-NxiHJ6auI6kzh&-#-vxR7zPc7Hl61Ue=KUf~qrGSAijKeZ`*qKI` zzzufx;V1I*>av--7@Wa_2TR0r6TcdB@U2EJJIov|axTmaO=M=9tA%QCI{bOb&N-%- zEsZwc05Zk_2Nn}}aUw&9zCZ@xXX`iBwk50)+cF^&5Z{sUT#R-!3`AxXa*tMnmvr zDic>fNN!*T-(BR4*>&}%@DSF`1PqcuVJ}0gK3TCDjHP4Me>)x1_2?i@1D&E&A`p zLSYPl7;@0rY*_EiAD#^8=kB?WLB0z<>70;GIDD26KrScOHk^Jh|2PT*I+?emU7zR#6&V9n*HP?#mu6NV8=gHwttND?hpRoZ=cy!SDUh}4G?m3R z2TPYS?{|bEJb^SkVAp#*SuW)@8!*j*ueFVdd9^d%iR8R&) zp{P){_@kbh8+8T>PRan_0m>@)Ne*1`@+zXUCwoK*=o1FX2)c)XIt+>*|4}uamq?wz z(wE^=SRum||B;%Z@FX%q(7yhX|6qG2SS^+{8=#47pVzU27M)PUYTCLNrn$6nf_0>?8AvU zU|bKd?~o>h3Nsr*Q6?3ARrahmbzvqX3OO-e_o7+I{LSz-j3O;@?z(%&`Z}c97v0j9 zi@wzAAIUXK=6f}r-QGBM5aKW`vbF7!G%9EQq~9@K%sWf&H!(I!<;l;rJmay8oL$Qd zALcLZ_pU9u#Y?+nQ1#;I`}?bGa{#GHE}Xo1)jiptQjzD*GP~uy@lp(U*=!j8ozW

8;fD<*V_7VG8L8yX2Pabgi(4^-f( z$b`Qxwpu?woEJ&N;$M_DbEAs|)DY4ajdw*^-7F@>KvZ3g5saWH60y^+s(>&Zv#Ae| zVapIZq#wgp!uw_7)QkZ48A6LOTV`-ID7FEdU1MK#8J3`~!3P0YgU3toORjgAIqnX$ zZ8*fyuO_bILp7L$^%5ta3#ud>u|sdm6OLl zk24AbD8Udk^H4KyVosD2Lxl)=99^uG;CujVR=b&i^pC02>Haa3iB;370~h(O$ssS_DkLAk!cmw|SkH4RP+}~{ zsYWGE6si3nud3xPIUrSlQ=GR;`K%Xi*LmVo6nWAN_;eBmalGzzU*4h_~8Z`lc4u&I5?f zZ2KIi4{mBN*s3MJCc1dQix&^g6(f-OeWQIdYqY2S?+YKZx7Dg9Ydy(Gth*Qd8 zI>PR);%V)p{bzK|oBInP)xO*UF}p*bBAR(#L>+zmNd4jZA@8BQnHKBy@{tkj>qc<} zrRz?1Qgv8+Lszka*!(lek+DEF(izJ;M8~ZsaK+z)zR7-%rut783sk1eLbinE)|?>k z@@oi>-6?2~AKkP|=G#+TpqO6H*%m@hiCbHT_l~+1Z7n)(6qbsU-Z9;%)hBC^E2g2S z|4{;=6>7yZ5M}QiBs~_okz|#m}*5R#?v4Y-ryBikgVS5`}E8# zfN+2ao3-wYJ8MzyD%=>fTB&9!te9~qJFUqH!>{}PdDPLHX!L+ey=KUeTyD0i0$_~N z>J#Q1KKY^h$);|ca5`cl7#t0?Gm?XgV=mYwA{WMmNj3ki>~8I`^2(R$rxQ{&6v#Mr z%_~RaA@vQKg@PyJ_r2x@5l&xX8L?RFmX)U&tq#>hGDXa_yS?_vj*37`)J~xoA*!W{ zKvpS-$WOHG_V@K^PULx1My{{yX=a+NKRTCcgKvUPmAK(A3iF>eC!1b>J(UMTDy#bA za=3C70Z$Jq-6GMG2H!!?SR$ zaGqRXB7DVk9@dz_5}N$5CDR+`gXOQk%N5i~(kI$GELWjm!b21J_Nbu}QHFfPWEePY z$vJkkh%gP*lsX@uyN(XB0nX0 z#NJ;Gy4iUeY~@d@K=Yj)*Q8Vuwle}5IuEvUsogh-PdlumD?#Z$HHq5H)n>i_O>T7S z8~{YMMFjI`@*?$?G|{bmzJb&HXQ4kAIdC2v$ZNE5M2Y{9AP+IL&yA_263j>ZCXczp z>C1(jeor`qtFiFTx>4dxhwQ46_~1Gk0H(s>;beIe8SYHc)F_4!X3KFr{a9pd`amnh z&2T3a&bq>mF!&jkOGJ4UOa!DGP@7*+Zhv*W?l4{;Fw{$)zz?~$yk1HGLJvkE=ht^g zU4dwGi@g0Fm#(D!T1@9R#zLno8$Co_J1osO6`--a4e31fJLyjf;m`(H=yt;Ig;%b# zK4wGfHRCCJ6JdiIeoV2$HOh$~z;v};x0pq6K?V^f?&Buvf<)2X7==E*y5PQnaNac- zuE%j3a|esB?_oBS^x8@`j9Q7S9Go|H{xlpwhpY0OMy0nD#hIi&Px|{bSs2XFg00to zdQWeP9Nu*pK%He#v|B~Ig-@in3`Aq7X=Ot z>+rQ%n~Pl(3v56EJj=ZQ^qY8gs!!=rc3*-9rj1a-y_$l?4`8fPpexsqm&s^BPzB-$ zu(Ts`h9%-zpLP;>rgd{Jo{6Tb7vblDrzIO~! zy-1~{kI_`CHLW&)o6_n2fU|2hhM|5%kItpUw9`7~uPsyvobqfQ8F(kXxyS~~tu`RF zRl;EK5{+d*frIq9n)qdiy@unSC^p*WZ!V~Ge4l75fTKwk*ks(5!w=I?VAxHLTVt*t}W92twPmEsrf~Y;|{QVMnw8d6Qe`j$p{bhl(BG=6GnYt z2lYlsX`m40X>;8w3IVpi-qu4upWR~yHZs%gpF0q2r>agtoc~$x1~(zCAZa_9P>UWj z+IenNyF&0QTbV{IKZ$?oQ%nvj^x|ZNF$~a4$3#c0-ZSEydq;)Ecgg)N$o;{duhFE` z8YIRq;r6q59=bFkKouznfW&B2%2}N;W_rKw@1;4}9P&GwGlj?_A|-eZtp_a4OCwQ` zGqAMEk{Yidi&PHHB##RFHQb*KDPq1ZHvivjhff{M5k}_v*iic0Skc*U31LGV#pO#5rzb+KjJ^#@`%q5=s|*kbKg8 zo%2s#Vf30-g@DVNl#N;_erIdSMKFCn){3%2o|@Ses|(WhTI5z0a-w1_$j~f%g#WVK zWs8LSjXQ^dS5l@n-Q!IR{1Tw@tOsFa3u-Lt*f_AW1E(Ybm;MQ{dsJ$mHrx@|G%EBA zb2h_>972Vhz@5U&js#4vHq?A;H-p&#?1QGFCzqaDCen^p>sLMSv@2sQT;n5C%^6s= zJ1cB?mGv&CevSgSS<)LjA``&Qe5t(?_(-WZy^_L)4_BCgW@Slj&+= z0AKZ9Pzvs3l2H_1mqw}GMzgp;vMuiLFxJqP#!&n6l-R^^^-(pl^&ib!8ppy6N(PCn zfmpQjB!{%9aVxY<&B$iY3?AqWC;2o92{&|?l^JD(2vajgJm@!q|`%2y_D35Uz#Uz$=x1gJC8!i+5RSKaY z*L&9lY2pt*N95HVuaCQWZrY!+C=j$!+4q(iwIswc3`F1WyCnK0SV>L#PU?N8^Rt zX}2jYTJm!PGrKpPN(-(b;W*HIhwCQx7DeA4AQtDB`U=#L&=s&QDC}J_y(JKhH#hVC z6tv?wiAYX2#mK04umot|*W5VHUW#N86UeM^J33dCfDXV$bA4SCsf|+!}dl+mu*LoMESQ zB|Mvehr59qYgU$SL}z&Ac5Hj?I|1*0wEjsb9~0IMR0NIPm4Bi?L1f)K%pa8NLuxbD z^21zQ1h$D8tm-S9QcNqc7R{~(eF?EKHIApdV2%7xd`gaK>K-O+KQ3zBiCkH?-TBz? zF8vgN9~mvZK9g)Ue6aq%&+8IoXB5jC8JHxFWj>FaFj~0k5A-|sw_4QDTf?>E)6n79 zEV&LRnLhK_QBbMRu@{+Zp7%gnSW7D*Gmq4@?_wlu1mkEZ?G+8hitFTHQ0~34E=us{ za{jpaP3io|#sZIpb;0CnfbG8f{{z_PwYR_g0jhGkC^83D!hcb{JY|HT6ry2v$^VUE26*szsVO@l3jTQj_v@i&CMSiD}D2wBc^o z#Yq?)&YuT*&%zxTdviysS(x$=C$?++g{OpKSH+jaQ7&q#El|Q{ zF}bmD`z!c=;~`*p>OS4(a^rH!q`(uVgeQ z>7(y-*|6Af@C+&=#%mBB@mfBT6vRGMpkcjAWgjYtgVxi!!XmT@4Llb!saEiGqKHA7 z)B;&JT6*4d$f0IowUy!7=u-N$y?ac!!_j4%>*M~rtCWxZ5(5jhCSZUcj0oZ%M7yZ# z0ND97T~ig(I3uu3m}}ze>B5(%Zt`~{LC0D6yg!VPSy-@vame%5GTb~)exv*sO|TZ2mhP6 zk@+J(%8HF4{2oj@OmEPaK|?5UbBY#l&{V#G?xYE$Gk6rZrfuJd#`Wzx-h&^@D2=1czN9xaKd1ZwJZJtn`kd(w!Bs}BqoMtfzly@jn`oYXOA7gPo|a^=SlmUT?>pm- z)9!#>9i*-ig5MHUVM{xVjqvtjm``|_xQOn@U*Vvu$Nd(2oRgvHX5kTi^^>pvjWI*z z!jUoF&So%9V}afS2_a%zvz*uqFkVHK*>a*}h0#D?4HI)o2%n*?HeRFRdo;zmd zBV^$ti~#|u=d#Xel9)M*JO`Dp&&9m!4H};cN@CpUMVnB-B6mW?c6D&ViR}Vvn52)1 zM0>$l!VH{BQ<1-U!cw`%{{r0EYaKavT`?UZJr(_S|2vT{Nunt;V0zvEjm1~q)+4Bi zEGMEIIXb7F=Ap^rpEO?u9CQ}MW8qEPFwDmTqK}7n0m!DF1t0b&*W*QGEbB&pDiYAo zs+Ae_nSX$t&)K_hm3TI$of5#r8f+og$drlczCOjQ2mF1LWbMxD&kJM101UWOoe z6!O3IEEicuoZQX#HJogAMQ-xq#TItJzOVn_9v*uc5(vh(iL$oa!@|IqikI*dF-g|z z^5_x8@8+rhtIbu^jJv3@5uuO=%+MFw#Qw{EDyVk8!lgFKz~GOxQ(@1#K-&G6I)Txg z-I|V)^5Qw#-&&%|N4CX)ck+=f4tA7Gh?w&eQ=J(ecvZtRyU3sM03A41 z>YZ|*8wjbTV>lbs0d-F8voows5w?9De>URYeXS5Wb5VBZ8!3r-F|#)~0e-;Apo{H~ zINo*~rUvtOiS}6;)c`#}!oNS}-KMXvP~Lz05e3Hxk&zQ}w8jx~zMCKz!rvHqdjP&% zQy~aWv~r?8SS}J79ICjb?WB{HHLEq<3|Y#i-A*SL3WmE}a$gT40gAlVg2^E(4=&XS zRgmwzYw)ZoAsPmEF?mE%KMIQG#YQ+BGWuXrly_Lp71MG?ru9W0$v`g7@r2w=PD-hkHQlGUfJ8#1=YFGI;MdS$mS*uSw0SL0yFBuWP* zW0&#h%^xSPGK-0Q_&`*{4VE8)qljOHx2fNJs7k}*7tohLX-tDli>79;r3~+J9oErS z!xP0zUVJPVa+ohRJ;4v35{V8wn*#o{ZE24og&XJd zeTpJsdsut_LcbYM>G?pPDRE4&2utxCU=P!NL99y^dIxYwFI(APu#$7Jj8D1AXOUB| zHfy&`;vO1tglygun-y>DSKW}}rml&8uz5@4^#z7@n(;GopZ8n2%pNl*s1}JU>a3^- zB}UNrpgAc8b+~AWD7R<4|F3{VU~N01gpaF*8vt~+g0p|!q{0s+(CRqU0xQp!pCkwOUULO zdy{RvLfb>u+`paNL(TiZH-H4FCgi_3-@ADy zSlc&7`k?(4P9WHWj2Jo~d0^D<@kYR%8K#PW>HzM^IM%hU(UxuQuBqWZ^_~%%>DmvE z#+LlB7L?pc%+E9@{t+bt^PgLgXYI#g_x5nA2N^coWk)S2_^@Bd>fwaxBVeK>%?<$U zpTP2E1?czNfC_yG(U8c{c1=KNp$orNkQ(RG#W1gsDWE2vw6PsD&d;-c|3@(GcYfi} zJs#DUFK)e&yc@OoU3%rQlwd6-9&UZYe5Ml8Z{F=sQc*%v=Ak=ssc&f>{X&4=k+@c> zR%NV*b<0y|2GKPXFHhyQs|eeh%h>fwFcB4 z6eyl>>L(OCo@fD)+Y*Z#8WX~#a?aEJiP$KR?3R4S3#vZ{m^Ax*D!D<QL z5N>}q|J3DQ@_8P3eTM}qaz2jCtJyrTTv>b}y57M1H!!dLB7@{s8U)k#aCQ=9iG(@n z`^NpS&zMsX$NsVsCcvBBIx;>Mkps5dhN~`DIdSkYA6vlS4ZGiO%9=riFwU9jQ%HUj5^1`fP<^FSr!`Z4;pu1S3f!e@ z8IFJ|=#GR6`Y5r+O}T(xbiOr)pU%X#i%pko5xKd&F|2rCPfVSw$5>ZHTQ^(RP9S*_ z|BXXFDYPqCJkYFxRI+OTP-X+tz+vbv##T`WEk#t%I5ktZ*lK*Mr^6wNA0}_%y82hz zlH`W3cQI0Q^z{%;h&B3p{(?fpnMDLtTgE{gjt)Cf(*a1}{vz%#7Wr~Jjg&=$@pv7- zzv%7AJIN5tAAh30Fa&B;E0^)gJRZ)x*bL+RmuUnE%;Ow1Zr4M;xxgj7woP|i72Tyc z*KAcOP>-K*K`r4Zr6Y{`yZ9e=)0523MHSrb(?e$-67;OOMu7I*<*!S|o!4tWzT+yE znB&PlfnhO01w-phH@{^lYzT4rup2Hv-wVIn@?7iKTQ0^3Z58J%L}DCse?>q`X-5i6 z)|XSNV@bx+$`)C&(w5!RmR>Y-)k%5S{9O#&3Z#%25DA(s6&G7VksUlv3Ty!6wq9W_ z4`6aQa;1tufQ^f7A}%)R0;WW77w0KehV(%zvrc{I<`hBQtc@7N7Iv|!d11VUuckFR zIC_dxFu9#Z9!qIalR_9}$ROcE0r}UH&QjZCxz|~9?J7tx>Hp*S#83=`WBV2BQqPEe zTy<~UI>ev;G%-NqZqBk+?T+Lr$Ej>H2mk)0yy7{fVT-IRc^#}AE?HhK9$2l>#XyXL zLcN2f{T>OXgkDEo2go>Zr5}d_Ea-lP8^AC2fJPTU=q_%<#n-Wt->`wC?j;9wUNpg<-)mo8z zjih(p49l7SN?l^B5@@}9L_AA?iL^^)7O$Bbv9UU+uAfh+0j`TsVKoA~nWWBu$b^z) z5Q5vox(9G%`WKSu~u?~dyz(^Jl|_wu5*zhZ|2)s{vmu6A zEvlzIqcaSwJ(!DLDilX^$6fei|R3B`}} zS{IZ14A*|E{eggO)M1`dp=~x?px5IA$de=$P-tREzZnAuhhjG$gmWG&1;hr(0ZAK@ zY*H--^lF%Mgr!jFF5Q(PGrRd8^Y7+iYxW)E{{vhnvAdI<2Jp@^5ipbxBRGo@N&dr( z`Ql*La?(h}y#TB$HJC&oi(nF?s2Xj*a3%y5TTuB~krP`CJE46x1Pqs7?0W<{N{aTR z2HpBpo2iB6!NILmUaB~vC=GEp)>Z=;l<{Mu;aPHuQe=Q?{eSdXHli1Ie$W$v^7_8k zUjS}~ueumyZ8gT~&SY1GVImXvw?s&4PMU9=hsBvrIj|(7KgZ7^xE-$Kj8YRE$85}u zSQ!2eHA()k&?;^IO-;K(t`f@jtlAlP z)6|5K`OwgmSw1-@wB(L48Uu1;nzoQ+{ve2&ytPFkl`!q_J7kJuH|i(qTk=XEiJGY= zeTdEo*VVI@dGcuUo1Q0{&;rk@kYVT!STAjpy4h*6Ll_ZmG!TZSS$`NtEsy}}Sy@4`|jmh$LE9aDU%AL^-QHCwT~0oqaX zlwt$K>=lY-zOV+20mZJ~ojQfBUkHVCjo1Y{!=_B_mT4|N$R#G0^^A)P38w72QE|&A zO&gSfptGJ5y9;# zD>)8nkAw#-%>@%Qs)MoHSRPgm4|td4TYSDQg^uBaA<$8Mh<9xx7)wwzxYeWkD+f@n z&y+mnCN4iDD)OMFxHk>jZrFkPC5)OfV0ZG55_=cKxeq^_f}hQJyv{sOjD+;#OZ5jg%h%iU$W0e6-KjNTB5xK@2-y8D?Z{XK^>HkAgh4gza(>@=I>X z@0n+;%J;K%k};NkMrTQ@?&}!JgV%6FD<<`Vk9I5`q!zZk^vh|Wgw!+(cd&x*De~F} z#EveNQgRAuS9>Eea+}9Is3x>CvEKgJQ1x9M(h;So6uD312sq=9M`PA05^MwLnq3|4 zs=tkiM%45f@zq(XxE$(8d~_!C$jy2R6BJ?HoFl~k~3NgCD#>O(v6&KZ@E403XA$I zUqz8_wlkoN>Hgp^jl7H5_oCE)+GjJXu5YW(>jlZ}-bP0N$Iy>_^0aP}rl~bJ4&otd zqOvxg*Dr>-DiFKEJM1|9BeWboWnLVcpV~P+5C6=vV-&gndnTqe@#}VB7M3kljp(`@ z--NxC|+ngHf0O4OhMF6DW%G$hh2QxM21vQr2)xfQnG^&8ne42aS+ zR_Gj}c5EUgeeEP~^(YTW76LBsUK)~d)@4SMq5_vaeP-eQO{~ak;3@sUts?0CNTl`6 zqA!-i7WRmSaqs3w+rB?FJhhY&`c|=Qi)F4`*-+CdEOBA{KqH}0)O;_c%z~yBjQfP< zzd&_O2e4|=IrVrYB$1H)QKdAq3<c~I^k`Xl~zh_+bQ5|8haF&+^uj)w|g(Z@&gEZ@DzZke8+MiB;SZ_xp z?wAev4s-S~i1$vt+0xOI-o=Dvl6f^JOD@G{xv*c+{6nUeu71Ew`0~#?KK|2Ch@7E; z3x@QWanWZFl1dJ&j0Q^b_e`R-5b43%7Lk@;F^zhVD#a`Yn*GTcL*XQ}0EjkVp-bb8 z9YvoH%QHpclT{MQ=2t#P3+WE&n5{iJIR9?d7i=Z^*(Pl%TcPt?i&d7;nLb@1n?vA4lmIo1(@Ec1~W`+ zC)UO6>eTAJ{){ujujw$#F?9yw>Utg&r%%c3S%jm3mU{r3s^H}8+Wo`W7Ug|>N~!-=xk>;j(4ZX-y#yCpaN`m4kkQu){;OU|$)jaKBAJq($fSyQjT ziY?{sr>))sAYo?Yg*6ST&BkvB!w!%{1^R#bEF*bhybfUP4;F~2WHO3gj7A1y5%vU* zM_iCEkeNKYixUwh4Mzte<U145)awWHc8>0jQkYm_{#u?0gAAe1E2wwYSH z{^Rib^Lz<_ec5JDc%Lv9E~OOf!omjdUNT{P@+R#F(1#Wy$3T=bTeS9x6_YsKKkKuB zLHg@1g9(W=UnL#Sy%n^?qkug#(;n{kun|4cm|%$L@9OD zo8D@4I{G`dyo#4$j;1wb>c%9|V}vIGKJWlA%rcVe-oPzH)&JxG1)EOuj+&ReFQ94I6N ziG-?TX`F0i{gR*}4OQ=gB@!@6-uQVzJpb1Jm47}XXZ;GFc87i(&I%zr#sY?MF$O$Ivljn}1SSRaP>wraBsD^97 zt^H4=@be4!T^k&91KUxB2HHRjeq!ct{9=m&z@NAodHAXWph z+dG?b^9OC2X)aO{%RZ5)UlLB91hIe~m@}x!A6Gb>{F~AQP}M#gl8_DtLNp8C0V>K= z9+RsB1vpd$&xbb=AykKuC6&)NET^yUAzl>t4BDvUA>=)x83o_eAYpe$Xpz)ZWbI<&_xQnYQJs+0+I%&V4b=^XSC{2qS$z@K?}I)gl)kl$;VPI6b2`{M zH9vFKclS<3J}eJni-Lgh#NLlTopbc_IWT$wWFx9)d(04VXzQh*dhD1X-I{uS^T*JQ zxZdL|jarMMq-Eye!YGuY24(a3FYDJ4LE}yhRk_NU)@&C=VgNYrg7Gun z>jFqs*J_)ld?kLd-WdgnG$kH#(&)09jUXLZ3!nwC*|l86_%y|*z)T2pxBwW!zMY1ZaW%4%O|UV}w38r%-)C(`p z&?w!+k#n~c-)tdFe=ClA=CZBnp2UEiDc-Y0S6DDHRmQMXTWnHxI3zek`x30cO@ z$g3kbXmN_-#R$^DHE`Pm<`V0ldiaD~OPbZ*pKeD%RdJV;I zOp1aT24m9HPb8C?sN~M5xB;K`y^3~K>A}DDf_R1MZ&G1U`!BQ^q9hzI^;dJh_;ssW zkih*aNRvK4vC5{*>j1j&)nXH*(KvLy*Jzt<4|aeMRzwe#^?m*VF`g=!NH0cH;pN9x z4mjnoDbxNY!;g$Y$`NsXa`e)0#Q^w`Flcoi66kA0$%UnsF!%p!2Yf?CEP;vEE-(^+ z!7@*c>Go6voe|mWtVRoviVTYidoxrzcLb8;zhhDv$vyg)pubN^NA7_tiTR&OUBfr~ z+jyuU{C7^{{yn;=WmdBI%Uiv12aZOfy14`+g#XV3eLm+EiUOwg?W9zbHd~#y@m^Rq2n;Aqoa%2}+h=KPk&0Vb7q z9)#V3AEs!0l!k{L>Zw!wFVC!IvtFS<7z9A|&Bg(XW(|@iKtLdIPIc|e`0mxBn8k-H z*m~!N$+K(i!!q3U2_qlv&2wH9UQs?Os&UG8tUX4z>6uh{6CI6{?8y&vn&Q@ zm<3k#q;d29nB#0ennnV!!WFIG@@%%|5VsZ5P(%9dw}PW)`NhyiRjNq5U_G>1=rr}K zVg|QI7_Jjn4Zr?t_C@>VCD35KGxRF^v+T_o2W-f~f|xiuUN~{)LDYPMga5$9p8aDm z1{!wgiwii7wqgA#f}GHyR*imQxv`(5#A#pAu3s~T;W0>J64)-wlk5?5XWrq1ZX{yb z6{*kEyaIw+6&G{2;sQ|88xh6jHgk~P7pINmv3QND3CnClNO&gL;x2kyj&`CC*-9Kp zEQwz)$6k*3y!_A+zujE?y`mD0A18~H1z*?ivQ39c?lsbkYjg%B$dmH7;5G+T^$QNy` zJ0IL69%gWz!}Tri8-a2pIEpVFXhrJw?YQ9Yaljrqn}Tu$60|v-(q$GMXKi`YOoE>0 z&n>@aNo5u_TQdx)fAC;LxX2v6a-+KFM4wDzSzTr%x$71<-MbG$m1e2+X5KZPCGzfJ)e;yX$N^v#OGr zhKqswtojW-R6OSls{k!4#gAu4ZT_EB?5rlVK{lWyFJaC6+cvji=Ac}Z@NPVO?Ue=d zme8)b@J29S(R+0LQqVvZqN$!SczFlRiW~7N;+RrX33ABrTf>-#wF!Qu3+pd}8Ql^r z=EjDl>mv4<+PY1;h_1Q^Td%DXhLBxY!Lyx1;{C*&YtcP;V@aLUFM``rQ7TPM4EDMG z3Z)TiUmF_DYpB+Z4WcVe=I@{<7i!g_00ozIITvkP?AGi4XgKqElJV?UgzfB1f6lew zW8^j7{#C*CMF7VO**ljC`i!vv2}nD33Y4A4_={X4*S$ePbcaW0>+jk^LlUPd!OV5l zT5px?~J?DIo{%&taQl6Rgf6kbB(mrdOgQeN=shCOX_oAuCuUXdQM3W#8q0tytOkun9Ow?-0LE zY6kL){(>{$_hs}TPjfj4Oeb$(!DhXQSf|S%-JQ+CFkc*zP}p$`tKGCiUNIUJGOXT7 z1qBw>=xJ-qD2UB(bzvcRaP3U@(Q_b;8PEcZ(r0L zxev!IvUR(eUc50zkchJS1a2ja#jUu!j7z0r#lx^>p1{Bn#q152tET)4kJ7AFRV;s)@k4YGh+^*+oF-B znnHG5HAks)Kg3$43>rHgJ5Y#isK5D*huqy&rgNN!R&~Wsus>&tMuHJ=(dZLzJ?*CAL^mov^D3(yHmKM-U-NV zoqno=y2U}X{RP<3cBMTDT15G5TAvHmz##8G*BhZ6=N*3D6H}e45Fax2e z1KoAQ0c6Vt0)};b)`8%M^1hztBC|Y&H$8mN)8HW_JsHl!w`3bJjy!Z!EOY>r2q+vY ziZ*rOF4Pm;PS|YeU4k;LhZc1j;A%J1{(xV?i%&`TL)qj)4X?&V6z-^>XEqj@anU1n z3b-~d$)8Tlm~&n5DzQSLhZ_go#@^Z|&Rsm~itYyEJp&Uc2InT%BY?$N)wRcI7C@a% zk5Cf<(?V;zB7?^(AFaiEOc)hG^C^_)i$4MGSZG`I1J~$hKMRaa5X^kO%SQ<5${#(( zVlGvJ@ymc`-nh61mzxfk!imTT4fvj}Q}*@p+8?Xf2YH%eLLsy_E3d0mngF|v>%FN* zg4{oy?)W!Sy5U%+vRc)`a@XJ>2icn92}nE1p`EcXD82&ChV93?>^1PvM&+RkLKRZ+ z3jnTBQfrf9C(2Nh+qa$Q6Z{X%0;oDTgwe^G5C_x{u~d%*?6QnPxovtv8AYUJ+z%k; z)ufHg5P~jlN)z@oJdqEjg_f?yH0-8z0X|q2>|Vg2xxX!Lo(j8b91_dn`r|mAK?$ku z8vbybF}|ZCx}YvI+eEc4G`m>m);1Aae)#7e_ZTA!&0YH&evIJNQ>KFZxTDiH_T2ot zP=eN1=TL@HDVz8n`+880(+ELeVP2dMu3Dd7+GBN%`7(hcIKbC%u<{phi*7X;d zh5C?L&sMaa1_5&baS`5zJS z++##;D|%LninCY=Gt}xOAQ57WGD~js;;;%%6HcQC(!yWCnl^DY-8zd3(b(_|Ao`M? z?;fE_fq!qHqRYDq)|va9k*_xYumFCJQfrZ^CoeitFQlQ9>WXc5e^)-9q@-QyE*fz5 zu&3b#H24eDAfkg2Pt%h6>uPl-@oXlHnss1{2|ecMt5O1RQe9zT0!ESKsE|o(2~;TF z5PWLph?G0^C=0wsu&Lfx{a}kGxp`e{#8l)jo5O#?XXSDRqIH^v9XykuaB(fYTy_&k z#{5AY^j$thd(T@Qj1UV9QtFp$zxC^I^1dLy+X61CP@iOX2%5VtOj4Lv`IHr+&?qA+a)_o z7_wd0zM4mJN{a2pFn-qh%Ptr75^gGUr)ZWJuk^A;(PEQSVly#$>FIY7PDrD;^Z-A} zLRy9Ja7rv$j5EvD2>Bo-Ewl6^^kT5yyU7NU>;+r!lc&oGww>SR$txa-7()jQc6rC6 z((L2Q$y>zbDN4y8_PM@VzWlp*9)Ip3T%-x*m`IFiwH%orxH%qB+-MPY6cz6<(aaC8 z(j%@{asmDAn5vVts_)__l9#-I{4e?o6H)~+P@rd#)!Us;9?VWP+?@&u*wW;!g=LN` z9gw!qdGPVTBdGJU;MskDF18+kA0%`{PaaqZzk;y@?pap@(CPs+-Pb9>1yb1=okwd? z48Z(3oeZ!qzI?9BubR3TfyrK=gQ~@3!8L8J@DVq2v*A1_$1Q#`Ag3Cx3PZMm^`44* zd22D34SaJq8Ej5Ea%F@!HjIHt`Wud^rf%j!hSd_*<;*X&)X>L~TtZLoF1`Q*tmwl^ zS=s01u=B(LzK&mO?s78Q>r0XSiJJ(Z<;(X(=JIpibfpDnwn*@yf@(wO=8RI`xv;}P zKZ9l~A*~eNuCw;;3S%?KK(%U=_2o>ox*>T5c83h~=Cw9AhMmAklYG01hUumNBSYmDRZAPi0GdH-9 zr>eb>aL#K;i6Nc=ZV#gzQAh}VS3M{Puz%`nCt-a+H57AH@x*(^t%B5hkMoiD`Oh2r z2;brY`F!Q=VC>(eYAL5JJ36mFftV_RPnPdAO?}=jV*q2yKvdX)aLVYwj0$T(djN5p z+!5Pqu_v(bfWt6y-n2ogA}CsJSrm5(GdRqV(G~r8X&}p#sHDHuqs1sc{}$`IT>$Vw z3IxD1zX2~fLer@fhp#%zdeIzV1Ncv$b*I+D zd>5!qj=~j@H!B>}wiuH*#{PaGdj;mO1Y=_(DpQ@Y7Ew6SS%g~X{+%p-f;mj63_i)? zGt8<4xv34fxXnUi{r@py*U~EO)I};TJjHPROF;qJu0j`Dn?#Ffnh)p1B>4&meW-AW z&B_C5NOXc;orWVGysPh&|IkjNfB(uBxz#R+N4pJhLm_8QnLY>Ob>C7Q1WH$^yzHyW zbptyVx6VQ(j!sg$jAvjf0IElK_e(a-Ion!3gmnf%n9^-pfa^dyBDdA_*T9DC@xaqv z6-`R28fs%}=Db-((*`2tG}UwZXZ$3Am?bwaTCG9CxM9F--`SU%Fqn#Roo7HHGUcuawEzpA0pC-pH2jHNg#YzXig|y z9{>rg_!S~_omQA#IEf_jSmoRR(A3r4H##hdV(75Rj-xLU^!7IyhtBsN4^+m8T3IH@Re-&(Mz#3eMlJ&js*rw1QrzY;_Lb0 zcfrBYsqt~;$5T6~`R%$LRXj~bQ1QJ7hjUUHa5X$|Kb$MJ=c$1!;X{X|<0Dv+gHQE6 zL_SFUfB5-u+`dJ>EfJI0z%X-Ksjl5i(fYQCg4liYDu~B5IpW(bezdc(`)%Fq12cms z97VqW&p|h3f8q?Sm+BpmJ?Ka=HXd8(kxXm5#u z*)|gYGr2ufvOm_2y5u)HbCJjg$2n;ef^rCGU*_~!F&$~?^^R1*3!YBN^G)bRT{8dF zJ>P|g0jDSR`;!U+Z5$zbdr>yP;$Y?QQkt|*DCzWYElo)nJtd5CvX8LED*{ac)2o@_ zC9Cp*m~xLnrMe^b;Nyy~&_0K3XSGQCdko?2OY<8FD!y^d=`|}^lXtCbzG$Jfzft9S z;xUiO1~h%Kg`jMSTB>p8AbL6Nft?-JvpLRZ@;7oT-^w`kg4KA4>SS=gGlY7sSWH5r zA{c~Ff9uME1|0<%Bu)WrF-g-Z9C)rM(|QyKqM7c*4Dy7!ZE%$Yfx?fB#ARuh9l1l}b- zGk6+R_vedkwUUPv*fz-x_u7lg#$LFOuVG8)x%)wAf7p)Dx@v!EZruBzx_%Qo!IVP* z-Xr)LgwSS;oR`DF=+jZ7<^K(&KTiZG8Bw@Fme?))giE@aMk&@+utpv#VdJP8PwIt`0V-b*7S2w)+N0_7BlXonSc1NUMz{C=To8 zKm6HqyH=5)<88W@6D{Zr@`0DQ&xX7_rdE{0mJ5%rhnUkc8Pa-m|a;s zs_qRI6kFu;SaLv7CjF`DHa&7U;;OD_jJp49qVOb}QRH;ku8j3=7nk~YjpN=cs1wKX z+I&yWh<9RgI_b~O;E3gD>bWw1c`2iwe7+VNyRv9SG4}K}PQO-fr6jqS(@{Z_u%*Lb zmbX#7*d<$*q;>SKB4%$m?*)g{SBEeR6-MftV5P(O|F8|Ev6R1%jNF87fz!HequHDx zWNn-3Q#? zee-$|Dd_oFA>>H$JW54Rb`dIe!^1g?{;2!;YndZ9cK3FHtq@roWKLs^ub*ilS|-!O z#lD6Qp0bO86d>4#66b1FF^4*=PZ^SRoiM&|iDd5U9^T_(*}Mr=GV4s1#A6J>E1F~~ z_?|T}Vq%%v>>-g;9bt@N{nsI7Ldi;6lqQGS*Er&f#wXWCwQ2h=*oWeHPH5pR{q+i+ zL3=N8_m<^kZbm1dK_hIFiNU232u9%an0u2;wl|ZlNe#_!5>(bqDwJ^-uIVHRaXvPJ zq*={78*xlZHnPdK8JS>dJ4tyfD1&iO7dzEQnD;0OoKJ>uh;}}Q$n0azwvNBp-7$7s(1RsqW24-`VNs75li~|s|jaP+T6Un zna-5-Y_CFR0TE2ukW2o+VK|o^K2JT>*HhPqol*I(FqB9QN+K_!Ur}I5pc9~zZuO&~ zx|gd*f2yGzJHvC#0oXsicnJaC;G0hoB=DctNoWgii&?z$Wd90V`+_lGO@0Q4V&@yh zxa)d7KkJr}i)YEki)8%MKlb0`La1??e`=z%e3yUyug+S~D9kwQVNuUE+RK5U{Llsw zsny{@kjkMQ9NFKw%NC|haqltkOu$zf#T}QyRdm;pZI|pcfTa#Q-B>^wCCwshy}=o@ z_)0)>RSio>ER5jbrR0I4&wE>T7YDcf$FphxRZM{fMDeV=YqlYPfjlBsjSPCb^)6Hu zEO7SSD{5w#lW7rCHlG?G{0Ij5dzY#OvNzIZ<&wp*U3f#hM7nU6wh-w8-YfiJq5UkX zc*u!T@qf%IXIG;j^#xupMavKg7 z+D4q5>WhG7`ZGK2kHxGUkk+jM7;V!CFNc8oF{U3)jpX(5YTB7fzZjxHxGar{PuB-uK>7Zpx=)8h|0_k!3T&Gl$v=ni{#m_335KVBD5FhC{fW&1@bJeA)Ab_|5jn zJ%#&H2;5Z|zhQ7lk~cLqE}dQyu}5I9)s#b0hS|OJXCeHl1Yq%vs=DB|_hM{)d7)-* z40{OYm&We~pvzd6cn_0^IgLHZd@ej_$NqX- z|DqoGyen7`$|cV10;qck*ny5u?#tp=*8ea}%6FdK$P?Ue_z-4OZlT`Gw3lV}4isA0 zAf5Dqd~9kEcC1Wlkhb%5M3K&_YGj!{amZyh-3xYgT5BQ}t6W`?!Ah~pLZ7x1`q;fo zNF=u0I|3pVlU>zAN#4;(xy@mXmaFoyg9LteH9H)nv;l6jx3 z3qaAA?lZd?u<$N*rRq?Y$~e~U!!FJd$P^v47aiZQiBz%uT}NIowW*&`2mEUdgtC30 z#`Wl&a?}7$b%v6@rC)W|WNSvJU)YfZlkC>aW4%*B=0khF`{V=_DUw@-aOdfyZ?rYQ|C$uTAHwcJtE8Qb46COreqd-% z5*9cmvlBDU>rVj5M2s8rJ`A9(``44AiN@ZAKn0hmIP`4*U&Mx`jHLe69#187Zd+=Z zm4n_&Lw&qHMRogu^<^>Nus*9gNTV{1H;7uxa#k;m^|*MaM7eKS-}(24Y+>rR8OQEm0~+KX4-?cmhBUvj!?UjND11N_biW_c&lV+0r`6D76Ecm)MNoP)&V%ZNA^BJTsgm{;P z-f1>$07BrXIA1g6<6W-*gP@gqQg4mzd=m_){fIrF^H(Wlia#VjUzg@Q#aq* z#u#ub=5Ndf=?RrZ3V7;cLB*F2SX}aA^~>w7W6{SS3O$=nQ)sl7IegCG$p?9tk~|}# zH8H{7!}IU}AkM58ul{EQNa1kdY&UCP0v`!1Oz%9vW5WhUlwGWb(r-J_!xelan3rZen!I#!UTqhC#P0~*fN=p$Gz2^iDi6Diq$ zzd5-u2YEj>d-F%hQ}0VFAh))RPAV{nTGf`1%raqA^ykXS=$~vH_59d;R%x|zk*^fa z`nRJ-4X;_p5h!kEg-f2%5wwU1wUX=03XNqlN7;+zQg5$~@mI3bb*cvUAt7+R8C+W| zBWN=|l2)QNn`B2`;s{}OA7>bW|8yFSp6LI41VxQ2sw?qXvsEkD!0EgEpDjGqVJ-p!vvc%X*?JL2cq?eCy;4KEVaG2hC>7&O6$h1<>@LIjDR>L{RIb z^4lXlx;-)ghe(*G)fTPMR{=Wwuj)N5`*|kZ+8rnsAF^TLFwuQ78R~IxBQPRo6Wp8- zq>z&C^@+h7$hkUWJmtbR>@hDCqP>7M+ud>)Yt{tEVJo|~uhA!x*A-uFUCgOSVl5J9 zrYG!wbK@$cDl5DRlltS|gD^nuJ_2-&dbNRoXP_i{F?rywTU z+F3d4V+yY}cZq(GU^I3dTH$-px6I<-f@5ew(Iz8a0-&=0bk6c~pcjqXShppE#GNof znNvY}X4?Bkz$mC?Ri$Bwd(kmf zB8sL!a7(M@W5eZWj~23mBd~?IotmlilaVZ~v;BSP>R-AUz{l_&pjh?<8TBV+yb=M* z5Q}pR*s?TG=x(h4^j-2RQ%{D3%-S%E`qdY9<299)QX@M+SaLgkK{o6T@5KcG7w`2E zmSKbh=#-YTVqc8|M&D?(IK61`$8^bhXhmRt*wk(2-3?Y3b5+R#tiTg;a z#6jgMir0_vEwOYF;J>?3tLaH4e?X4M6N+3-XqORZ%@Un>Yj_TMMLz})Y%ofl^0Vw&T zKJdlSl!urHq%A1!lorDi>v7c9mq^xKpNgx+PMCQK$y9f!-G4XLR>#U|wo;;R2+*jP z2Q!V$uBVcno&k~W>F{Q%Vq@M^d%`618N&sD^n7+o`T%ZXZKk5?`zfSvFC3$;!+}Ui z%7B8+GCJX?_oDt1i(Hg3@ZAJr!R&5Mtwnh7m^pH7`)U~!K9B@UxUOrZbWu7eDbu}n zM%d60)8`hc?C3FWP_R#f&Wb#D(22l9t|v*#uSG^Xf=%HKZ;t9opAk#jD>NPd27 zAJd?c_meggDr#ARJ;7ZN^;5}9Qk=>r(Oso66>ReGSxf>rSPr+I>H7T;p#U;KDLVf1 zm`(dKfvo=q-;QYL=FJ`&>&p8IX046e$A)5AL=XksI^lGg@TuDopC$aajgg6elBR*B zS4^CrtB=-LBN$o)m_C!vb;`e=Y-^mS9x12VTA-xRTF;cRhExLI+H0LAyiV++jTkZ^ zL&74UiFEJHhpMA{Gb>$_i=j2RmGos>1~)GR>{$5vb{x&Kft#mK^?>!zH;BvgnzD1; zp)BbztV5+{XFu^_z^5f_*&q1}|Zl2=9(q3IEX_W6xw|{`kKzob!3U zc7nE8e)2i?L4jyM0b{|CT=*-wH7x2bQixZ0tl;T1GGK3I0OyGL3R|Vm`zMmv5~*@3 z*{dM~NKbb__*~Q`d57bI1R$St;wQ6Hhb*3yorP>m#~_up`Bg+}E}d)2gH)pFk*l2-t#$UA( zqqh}(W{+EI+Eg%lpCtKR?$xp3FZY%ALI;B6av>`q`7 z#AjVEY*MFrhfEMChvMwulm~2${+z@@?+C8)SlSI5k*{<5gaLwr)dCJM;i__H~DugC-o~avRpdJGnTdNzRg)>agc1>%bzjNZV6K~0dFbb3Q z*xs=#3#oTYLVR$YIlP>ZU>Zw$)cD9XU^#T)_#hqE4t^a;H4-N>Q8KswpRxam z$fsL^waM9`-T7@GqX8kBuBznGQcV*AwC#q)i#UZ&j7cguJ3o2D9PPSdO5@cjP#Ch5T8FTfZ;?TB@_OcDo5A#al8* z=89)z{{{&RCSr=Idr5{({R;q;BfAR+;41eP<}Y}FXrfGlz7X23X6Pp}m=( zR8}fzLoffa4m*SO@MMdRtx&h`n&?4M;L!@K`gDi zxBiYo8nc?{j!qL@EPE;jo*2Aukl5&UOq#$=ylK-Jp3+LL`)&RK(Z)<4ZD{ekJ5Vr{ zuSqg3V0^DxxYRh%#*zR2RDmbqoII%+?KP@Sn5K-?yo|GM8wi*uB;1$F>!U#MPQ*|P z2I|pV@?}sjo-NSUbf9GZhucetfWq!Z8i93<+@({5xTp;G&T47~-1@ZU-Z83@??qH8 zwo|DDO4;o7m^#)i_*_w~lgD{@`9H|l{HOrB=4`DfKGlN0k^~JDc+aQPPazaqe zBn6%F`zgomR-y_;z{cH@q~NdO4-2=aC4GSC}{xFsv%%zdkydNrZaSfuK=AcwtB!(Pf@R9hCDH;*;eQz;Gb$1BZ$r+{#wa{0l9oeb5@HOQE6y-n{o7mU@z*EhogA$sgfsQ55wH zQ~*(WY#(5H=`V7KM%{dctB>pM(8ppc&^?avDy_c&^LcJh54@XVJ6Nfcbv)MZapA%K zUY^Z@MeiYjNiXH@@qzL7P(0(RHdZX}o$my)r9F2Z%SY2!AxE~$U7;LPnv$+7W|=cM z>xVu;GkuWv&(8FIqH;IZ^(~v7AB2aR+k>P?xy_hP5re}j{i8+?Oqo+UG9FkdCAhuu zuG0#ENPgS?J~(tMF!|05@^4o-749dUJ6*3f0bGB3*lJjF1Aq4b3oObZW#{SWWp5%J zL__F>m_Ll_VH>RN`e4fYK~~*Nh{Z0^sRmaL&xxyIbL{yaOGK^s?H>mo`Ebn5V=%pw zE*&gCSp?3cpxD%FI2?m}-BO+11kE?F`sLV;Z>=^+m9El02&(8$4$;nL6)9}+%^QgQ zLEK~3mGZs?iqwXI5(VG%vti)wl(8hw%HDDo12V@0uw54!PcV|nBH;5u{EWMPma^QQ zRj6F&IsqqHXT8Kim95z`Ya!4p6|fNS0r%MJkFM*K3FvHZFUU_-o9++yJ5KAfwy3#J zQ>ZeH{n*Qj0VgjBf=y{hX0nybp$Ux^Bf!K4ZQgbdT{4a>=hP)w3oG2P(d$1Qdo{yT zB4Z7}Cy_H2EW-_tVzYG#Cq^GAgwqW|OUz&dg2YN#krXUiQfT`UD|PT{9xG$0R>X~EM{mxBlNGCc?PXfrqyvIyk`58KL0t<-PXDC%n%)h^ zZ>NxL00xX_b{A@Tik1WSj!0O&zIjZ=8B`xU#oPvMUPz{&T4=$1;|sG6RM9z8Nx`vx zRrZrLa21anTdG+qTetc=QA&xkcHm`^8gq&9Pzt2R{wQKOMk@hXdYu)M4!y%+s(`X= z%8h$m`OabQWcIdd76&TO38x#>yjU8?Na<|80Cq4|Y9b^Jx+;H`77x&(Zl1=UQcqy5 z7(={3A$tRFhK(gz2eQBTZe30Sm)^)YgnQC_1`Fdn&7rbvhJ?t9wP19VZE=_c`_mPL+( zjVPeL-}CAYtp1DKIocYnw{9a_c|@~s>r<=-9plxP*W+bon*dH^2pE9J1|DTCyrxwg zkuiIShnD_kUpq37ag8RsBZ-1)q*K2{Ol+uEb=Nl=%B)G2!yrGhE19bA4S>+hsM-x) zRG~Ixelit34Z29b({lvDx&y}>5z$rFCSdF6vp>LN^9mT@Uld^`yn$L|0{M%7UQ^puw777r!!jCbY=$$RT8 zus;QF1r|2Iy5gtsh{U@E8tg;>hN&d`!k#l}JBq05cA2CA9&dh0VfHbF2VF1k_rZk7 z*po21SimE6BqlV*jc#aNdy&s@%k&x4{+mc|HdQy?&i<>CWqD!lN!-`z{oB*R)L2EqpVfHX=xRhrzqTW z?)VOvTy9q?#Jqfb>ms_<%dLwOh821EppYp|({#i}Cuw}rATd86Bq@#(pSxxRLDXfF z3VmacFl<)nh7{QC+hBJ5bSV;9{ldaRhdxxkxx0Vj34XQq{@>ZAg`yI?Xu8N9lQxF< z1WgG`Hkl2upcqX(<-hLM_NUV`<9X#o2PO^JEbz|TT;ujeVN1>Iy>z}+CU)A(zSuJ5 z#Y#P2uck$~a;KdL0%p8ke|gljk19(+w!_Ao64}6K;&4_h*TjRY?5Pnk4HzPCSPv8s zt-Zga6X%b54ozYi>bsxWW#}+7CqA0wVv(xf5LE&4wl?Mw01o~8E16Gq->@*4Ll5fKO zg>ltr5P&J3#@1#oNob!R?p=lxZAibojgW=Y=-C}d&kU$%+Gy_hVS^sTSm5hFeOj1y zQWU(X(ld0!z{{wT+`d0T5a^p%UaSC^-0@5CsS)iu3rM~*ZY+YWpZ(!@Yru}Yc>P6o zoYA%!h;G}pk#wnCrs)%XAygP&2CW-*ziT_JtvgH_xbvr6Xj5< zNgnqv3FI#UoEBV4cf8ME$`afplPg`-s(G0Jbd}dI`t>Ypb?s{Bx3DvR(9cb`MN>5; zzU2?x$W^e$GO#k}>pOB`1dlXjs+xqqeo7agV=gz5Qzlx38pP=XFY!%wsE3<&+%_P_K)ttl=ncNP*o-OlvBf}4+E&7fZkW9LlWR_e* z3s>Ewz;1O!2*$K0RE!bkd!?$ zxP_tsZM?&TtAUA-`wRl);9BHR_y?=Vm{rXShK6Qb@#6Rf;PniuEpPS*-WIs=Hf{;9 z{}FN5IkJ5fSa$J=$=!cnYo>SP@X(Fn6IO2()~GeF2DtJ$qc7b1pgv5tS+ta6xy|d|t??)WQwv6a5HY2eS5guToqvOe)jVum8F9qJYfLu@eD0CA#Z}h$LqU}y=Dn#5>a=Dpp-TYW&*GZH%J{6$X~ohChrkHPB+YH1X`fB zY?a(rw2TKuG)vlMU02W*-2?WPTm^WRlTKpy=|1dAWp}`8-VfGVju9}u=98leI>)uG z%i_dvtdc>U^9K4KFD)iB`OQg^AL95|b|Ea0xe8E^ewSRBU0K65B_xeapa<74VgSIR zihEtD;iPhu;!S2j9(3QsQzSZ}$m}mLXG@C0QjD?zs_-V?CV15&2zy4pt95JfA7)ad z??2Jf`C;6IWB-yeV(liYl=tWCK16!yfP})!vbPk>_Ug;Ut38iG_!%CB3bWq%d08GR zdlQgt>evv=Z_W`*$WomrN8@sE+dMV#-&=b zdAAAV++J@v*GZ;nDw{F!*}B}tWyw5x8LWgYPu!6Sf^G}S7|wTUlT2;IN=q;sIG}b$ zG-0$R>>YXz$;8+XU_4%u(myl#(c1OGq3V5seJNsHR!QKdDjX6jb`ljUb(HJ&1Lb9( zu#1g3@obmK_suxkm8B{!<*M|AwScnUGPUCDdgZL>75;w1ZQx!(p)jsO>mN@x3)Qq} zO8{N>;hGNadQGioF{O1&d++waN2GyLVHPEGx~roCvKSP$=)I&C_XnYJT8a%i*Q4E2 zw(ioJf*&8WapeC3X)DMDmT&-hs1T4@_1jBexfgv5MmbWDluHBu#8|tK05w z!dFHr!9sk9Mt)Zfz*iQ76rH=@hv>ADKU@wpe|{)Dr_hn!&ixMjLN$>{v!FRar`27K z)mj;q8~--to4t~92M|~&5hxET9Pay%zR867b@llcO%9KC^oKTG6E@u}UR&~9^7Cqy*l$On z(78mmJ?f~v9>7(0Bfb#fs|pG4X62Bc<$(B7Y@JAosi`Q4W03t(Zl z7bvKc2`o+ZJz%o2RJyW17$2Y&KKng0bK=_OgcqOFGIOK0Cg)yxInyzT(p0=TzK+mV zo|L9H11P)?eK}nTdg}+6Iw?Y2P(*;&(_sBz6>-oau18kg;E7@i&vzhxSiq+2LOd`x zE#nDjx%4d9ZFD?N7ZA#xk*<8De=yI%lqLKrvwz+g`Y_Tt z%F#*V6biNj(3>^V295kTOQOePEp026XUx>Spt!zuv^_>{avU`?S z!?G#W@l>1`N@xV`>ZK0WZ4Ru2Nr(!EbdjAn19u#g&skw;Pylc7t7uZ4!&?AkCk0{W zXmuY~ozz)fOB9$iBx;cr;&ZcGE9W0BvDBd59ny}S_drP8iA2N4?oM&Np)7k+ulR!i z(HF_$O(v<=CEW5r)jPaUt76j}}z zTfM{$OII#|mF&NDx_e>~ff;_>Y}87|R7lAu(xVvy@5}~0???ef;iqwjO|JSQo4BTx z@^!zLL#yxkbhtafnJm@-I@*Z3Eb6+KQ?zHI0|+}lh{SdstTj%RNa>!<5)ij!Q34_F0c_{dUM~UO*@AS8pQvfw3J;;Fx?(p zm&DshNse2xzh^V+!6q7e6LS@aspG@Od$NYp@h^m%UNjrfzUrFv4pH= zyL-!H(ro`GUh#=Yvvucv9(PQ+_7F^xpH=&ROB6%B1}u}=SQ1c7CkM_mOb$u`yDfft zC$KS$#VQ~<(EbfEV3k?vq--xJ9ne@vpM`|rPX!n7^_7VGw_3${UXp&Z?7(jN2Ll(c z9=I6VlOZCDKkKw*j2n}*4s%YjA|`~pA02{poYb1PfC!2@&$`ucu}+y>W2HrhzQ=QA zWT5)u8*4>3P+QOI4sRgWvHk7z~X^jiYzB9se$_q`~!VBYqh$?-fW}; zy7tTlh5;R-)QDip&hvL|juvckFWr0Hw`&{;wH&cr29RZHO+Q2yAo&A4cv;JJ`VymG z5z3{`@A7rv`|=!%)Wdj9Y_k{tEi6lDKGljbM`E+Ey@jhD(5c9Z&AX1z(NvrxNpwmcZ8q(%a zMhVT6)&^}h$15$$B^0Fi=nGFbgHG_cYH2NhgbSj*%3?;I@W6IfVs7;3Z~ht+aSz%a z!#q@Dq|qF!6u2Z^h1Nsn3j0(WZ^$Z~EYvH2&9Bk5`lWx1+o^;e;EDLVmJ#_I<>*yydL)kyAzbpPbfgoA=eDXz5{&?n0(B_D== zc*(9L0Hgs}&A3mvt+zcCR&QO3t5;?H&^p!P_?mI3J-MwUI&y2{{ishN6F?CCC-*2l z{6qLTAbr3AF^ZB?p_v03*{(xXQV>U?=m^HAE1GFNsDd= zdX5xH3~}0i2VXU%aeUStO5&*Ho2t5v~4$0Ev2w}AM=|+wsAClup^jcmWqpCZU%Xpp z=#4JId>+C{Jg@)+=!Qh-asBjl_tw@q{bo3IA0;;~Ul6)hd0CaDZp<-_`I4{)A3hNL z05wO3I(N!5d7dYVroQm~8XrU=8~h*TMa7Xlf+? zB6*s^`sN{v1zUsMIH#|wZ;-PZPbIOx?J1c7?jogvT)sqY-dY4%c|;kx6SuC6lf*#@ zvei=iBJhf)nW^k4%j?S>V9(>t(#+1n+;=F<8=P(0%Y+3P{zu_XgCC`$*BEAlAnG}< zCzjBjt}SmtdEH@(#ztGRno`6r|O-q}? zJzq4M98co|p6x$L&;^st0?=)+-&W^6Fd3eJ^!9yp>C_l3cfi_&Q1+kC)p`+#urIzI z>a9yb<~d;^jvWKOKXit<07Yad#{szJpmDah2U{89BQtmEG}H(;6m!wHj5SY7>gX}LkMG^ZQA zePw>a+&{oWBn!j;hq3L5j<|XK8LrLJP#IRVXxdeePARM-Hy}t`OMV-j0~Wsr{-cP7 z$-hB874{YtNt%Yd7oeX=%St6!;!sNr225+O#4qc8DjsdHfVs}%4G2qRahj8$Yx z)G%sg=lC@FBphY!9`Z9-RvX1HDWpf zX%D?HQZb-c=pZ&!pPzG7(C2n**8#+Q_nA3-DPX??G{4ZzHafPYhhKg_6LNR*;0X{! zVZhi1P`RZzX&F^av+k3=uIh72Dod_WG5+yZ4q%e_)Um6@qx>eSz6K93BPkKYKn_JM zW>u1uZiH>OlE6y?J=>l(TlX|PaX|4GtJsr1k%UY+T8g9iJyRijwfR-5n&5i#=JqDH zK``FqHh)S`J;)7IaLK%lq0W@Wa5Vhk}%rdm-j5*m?Eq2i=+Eu`7s!GKZy)1PMg4GiLw2ab?tb zK39Im{AdFu<85lj_C2z9)cYo#ox23&rly|iMbV?I-g$QK+6@LnHcThke&3rr7M**WWH9QC zzL8@>iM&hN!R&76j?1rSEns{yB(Pxb6k+~k2md}@P9RLOdFYj`5%`dGB0r&JNw~?W z|LJ_vzDL}*07_t-&+lgWCYs`>d3$W0of+{`YWwDDwsu+pTY8-!&NZF?75cXx{41v< zL>fK?a5%ZaofC9PhPg0VTniDl&mX_mI?Dva51lz$&LsU`;6#h6htT2?#VQ6C>V*PK zvi4qy+4p$CJ}x_i?x2!y<7$wL`C#d;VaATQmt@7nOnALrTCZ;6ytlpAbdyJ_@RE(S zXWfwF12WaBM?26Ld~{%CFta600D>IufLE#Sxwvn|c#2jLxEzJ$J~r#smN6je3wytg zwsx3zCYd|}z3OO6c?+;9t1j}mEEtSH97E>Qg>z(MY4Olo#ck>?X7s9{_iid^#t-jf ziI!|fjJvtutU7pbXRfb&m8U&ARzIhty#Eltwb<{0Oa*q~ zUc>57QZnKEDd_T6ot3BN`O&C?Say)dFw5j_eHKXHnVS-YtAuJ8j;a7l%ar5nxy>yP z$@omYeHdnC76 znuORgHdT^}J;P^bx1tJ22(#1R#`o}rdE3CZ*)GV&Epd&P*tIA3oczOQntV|HmZDoG zX%a$?{!Xy-@za`p2%fc7%8}0LY0VCOP2#hohL|j-!|Km5Bm^((pH4FcVwSGv1SU2 K`vs19O~o{wh7tGx diff --git a/docker/nginx/data/keys.json b/docker/nginx/data/keys.json deleted file mode 100644 index a0d5c4269f76eab46c83cf7f7a7357819d1cfb20..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2212 zcmV;V2wV36M@dveQdv+`0HMi{QaoMM(TUD`=nj3JYP=Sga92yH&K}N(XLV76mYem` zMhcfu;$mWk`LOsuH9fk+?p;ZS+@$tr|4g#934`4E0@zYxzzgvzQW@rreDVocMABbk zAqZ`EmZ*l!1*Ro9)r6BW-6uwGVNs9Zz?`SZNDXXpl_IE!2f%a5QS7tU`X{E&IzMA2 z`}NCyMrHy1vcOhOm%RiMxg3qj<_r~doCH!9xN15IxR)|h*4WoJ_HVWL80t!W8v@dx z^h;vg_Rx3YU64LsXdY}6(!wot){pj}R08cID=}1w)y6?Km@w|36r`TwseE&zQK2TT zh9>XIyK;L3=SjP`($MLjD&3zl!ScI08GOeQXIW;$9dy1fV_`1E)~|z5*B!67OAV&1 zfF;iqodNM@mQTnr2IhDz!HgS8b%AVLqKCQJ|IYi8(gRfQ5&9=?6?6zB9MPc;YVj<%`>x0l(m;*0I##;}Y%f_LslTLqRq?P}*R*3`dCowBR>Q5u z0xqApeEeuMiRP!CrFR-t+8Te=J6@*E^4E7>MVj1|0c#kOznxQaloNK24VaGfDBUwM z9hOj#lBF}@Go3|qH1p0h`9tY7Vll$H%ScalFER6XEHD=N=C)&5go?~z$cPi4 zsriOVfocn}E>@zRJ6WKbf+`I8!db3BC)P8BG-z*0iUr?*|8KI>j5!$} zd~)X`p*0yqu3T5`O=M!RvKb~~Y!}4VbIOSxv81>D4_#Th&V~Pv263XKYs*~mWR7F3 zMBB|5&zfGilUM2rVObj>&$(Owz$`P6R>(G(5CGE3u}uUDSP9l7ouB!Fb?tmO)gaRAnzk4rRJSGfXS1n?md?fj&#z6|j1SEi zd`7-1#^OQ!&dfhOOfIt}b^9A6Lds4@L+8lGRZh=NX9#9ZceFMuYE;0F!S3E@jv$0^ zD*wgzVl(Arp!^&%fhmZ1hsH2n@z}%}4?)9M&e{@!*gx|bNWqS)ac`LsfJ*2Ka^89C zfq>RZm1&rz;#zUKG$p6DrFrOdl@6UNn26jFolFwHl>UlcGTOGUkC%bf9vWWUH@K};g!pD z0^fwwS}DZ`lGNU6!BTBDFIV=P-fEwMR*DeZChs9^*jfg>{t`>iU2G=XpNgQfuG{KC z$yeOb{8u(Uc}tgf>>*>QQTN7um756DbAD)h<)&!LU0k>SS>HJ{@}Y<@N8ssj9(>wN zTf??*rrR%?MVhB}edY&KrB>s-9INs-j2|O`vqq-Tz)Waq=2$iK8)5ubrn>)8J7ONN zh0|FS*GXA~T33OsM%05;qjUC$PXe`+$IoFcS4FX$G6|5%M?=t?yVv>ubAhTMHgN1; zyNp4g2Rk}N#P6TjONBcVE+*y-@W2b=Md3K{>J1CX#f#=Y!_ClGIhC;B6mc3M)W-B$ zEokx&X)1c+f|!)!%{8`beO6qdrZMBpy)p>t6FGNTH%W#XN3w^-@}-;@4-kKpH+l%HLGKXdA0VGh7!2$i-9O z7!9o$zV=ge2t5>LbdP#VIAtINHaCTEhr4h^RI m9w<)bF5|(6NFc?gt(Qdk@TD?@9F3HO=EN)b_l1E*KoSBS=uQOy diff --git a/docker/nginx/data/nginx/default_host/site.conf b/docker/nginx/data/nginx/default_host/site.conf deleted file mode 100644 index 6fdc1db..0000000 --- a/docker/nginx/data/nginx/default_host/site.conf +++ /dev/null @@ -1,20 +0,0 @@ -# ------------------------------------------------------------ -# Default Site -# ------------------------------------------------------------ - -server { - listen 80 default; -listen [::]:80 default; - - server_name default-host.localhost; - access_log /data/logs/default-host_access.log combined; - error_log /data/logs/default-host_error.log warn; - - - include conf.d/include/letsencrypt-acme-challenge.conf; - location / { - return 404; - } - -} - diff --git a/docker/nginx/data/nginx/proxy_host/1.conf b/docker/nginx/data/nginx/proxy_host/1.conf deleted file mode 100644 index 69499f3..0000000 --- a/docker/nginx/data/nginx/proxy_host/1.conf +++ /dev/null @@ -1,97 +0,0 @@ -# ------------------------------------------------------------ -# www.timothykim.net -# ------------------------------------------------------------ - - - -map $scheme $hsts_header { - https "max-age=63072000; preload"; -} - -server { - set $forward_scheme http; - set $server "static"; - set $port 80; - - listen 80; -listen [::]:80; - -listen 443 ssl; -listen [::]:443 ssl; - - - server_name www.timothykim.net; -http2 off; - - - # Let's Encrypt SSL - include conf.d/include/letsencrypt-acme-challenge.conf; - include conf.d/include/ssl-cache.conf; - include conf.d/include/ssl-ciphers.conf; - ssl_certificate /etc/letsencrypt/live/npm-3/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/npm-3/privkey.pem; - - - - -# Asset Caching - include conf.d/include/assets.conf; - - - # Block Exploits - include conf.d/include/block-exploits.conf; - - - - - - - - # Force SSL - - set $trust_forwarded_proto "F"; - - include conf.d/include/force-ssl.conf; - - - - -proxy_set_header Upgrade $http_upgrade; -proxy_set_header Connection $http_connection; -proxy_http_version 1.1; - - - access_log /data/logs/proxy-host-1_access.log proxy; - error_log /data/logs/proxy-host-1_error.log warn; - - - - - - - - location / { - - - - - - - - - - - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $http_connection; - proxy_http_version 1.1; - - - # Proxy! - include conf.d/include/proxy.conf; - } - - - # Custom - include /data/nginx/custom/server_proxy[.]conf; -} - diff --git a/docker/nginx/data/nginx/proxy_host/2.conf b/docker/nginx/data/nginx/proxy_host/2.conf deleted file mode 100644 index 9f72c31..0000000 --- a/docker/nginx/data/nginx/proxy_host/2.conf +++ /dev/null @@ -1,98 +0,0 @@ -# ------------------------------------------------------------ -# timothykim.net -# ------------------------------------------------------------ - - - -map $scheme $hsts_header { - https "max-age=63072000; preload"; -} - -server { - set $forward_scheme http; - set $server "static"; - set $port 80; - - listen 80; -listen [::]:80; - -listen 443 ssl; -listen [::]:443 ssl; - - - server_name timothykim.net; - - http2 on; - - - # Let's Encrypt SSL - include conf.d/include/letsencrypt-acme-challenge.conf; - include conf.d/include/ssl-cache.conf; - include conf.d/include/ssl-ciphers.conf; - ssl_certificate /etc/letsencrypt/live/npm-2/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/npm-2/privkey.pem; - - - - -# Asset Caching - include conf.d/include/assets.conf; - - - # Block Exploits - include conf.d/include/block-exploits.conf; - - - - - - - - # Force SSL - - set $trust_forwarded_proto "F"; - - include conf.d/include/force-ssl.conf; - - - - -proxy_set_header Upgrade $http_upgrade; -proxy_set_header Connection $http_connection; -proxy_http_version 1.1; - - - access_log /data/logs/proxy-host-2_access.log proxy; - error_log /data/logs/proxy-host-2_error.log warn; - -return 301 https://www.timothykim.net$request_uri; - - - - - - location / { - - - - - - - - - - - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $http_connection; - proxy_http_version 1.1; - - - # Proxy! - include conf.d/include/proxy.conf; - } - - - # Custom - include /data/nginx/custom/server_proxy[.]conf; -} - diff --git a/docker/nginx/nginx.conf b/docker/nginx/nginx.conf new file mode 100644 index 0000000..364b7fb --- /dev/null +++ b/docker/nginx/nginx.conf @@ -0,0 +1,20 @@ +worker_processes auto; + +events { + worker_connections 1024; +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + sendfile on; + keepalive_timeout 65; + + access_log /var/log/nginx/access.log; + error_log /var/log/nginx/error.log; + + add_header X-Content-Type-Options nosniff; + add_header X-Frame-Options DENY; + + include /etc/nginx/conf.d/*.conf; +} diff --git a/docker/timothykim.net/compose.yml b/docker/timothykim.net/compose.yml index c846a9e..87671e1 100644 --- a/docker/timothykim.net/compose.yml +++ b/docker/timothykim.net/compose.yml @@ -2,7 +2,7 @@ services: static: image: git.timothykim.net/hantim/static:latest restart: unless-stopped - container_name: timothykim-static + container_name: timothykim_net networks: - shared diff --git a/scripts/deploy.sh b/scripts/deploy.sh index af1de28..397081e 100755 --- a/scripts/deploy.sh +++ b/scripts/deploy.sh @@ -12,5 +12,18 @@ APP="${CMD#deploy-}" cd /opt/hantim git pull cd "docker/$APP" -docker compose pull +if ! docker compose pull; then + echo "Image not yet available for $APP — skipping. It will deploy when the app repo is first pushed." + exit 0 +fi + +if [ "$APP" = "nginx" ]; then + # Test config before applying — a bad config (e.g. missing cert) would take down all sites + docker compose run --rm -T nginx nginx -t +fi + docker compose up -d + +if [ "$APP" = "nginx" ]; then + docker exec nginx nginx -s reload +fi diff --git a/scripts/new-app.sh b/scripts/new-app.sh index e265b4e..8abab14 100755 --- a/scripts/new-app.sh +++ b/scripts/new-app.sh @@ -1,13 +1,18 @@ #!/bin/bash set -euo pipefail +GITEA_URL="https://git.timothykim.net" +GITEA_ORG="hantim" +TEMPLATE_REPO="static-site-template" + if [ -z "${1:-}" ]; then - echo "Usage: ./scripts/new-app.sh " - echo "Example: ./scripts/new-app.sh my-blog" + echo "Usage: ./scripts/new-app.sh " + echo "Example: ./scripts/new-app.sh hcsuzuki.net" exit 1 fi APP="$1" +CONTAINER_NAME="${APP//./_}" if ! [[ "$APP" =~ ^[a-zA-Z0-9][a-zA-Z0-9._-]*$ ]]; then echo "Error: app name must be alphanumeric (hyphens, dots, underscores allowed)." @@ -21,6 +26,60 @@ if [ -d "$REPO_ROOT/docker/$APP" ]; then exit 1 fi +# --- Check dependencies --- + +if ! command -v bw &>/dev/null; then + echo "Error: Bitwarden CLI (bw) is not installed." + echo " npm install -g @bitwarden/cli" + exit 1 +fi + +if ! command -v jq &>/dev/null; then + echo "Error: jq is not installed." + exit 1 +fi + +# --- Get Gitea API token from Bitwarden --- + +if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then + echo "Log in to Bitwarden:" + bw login +fi + +if bw status 2>/dev/null | grep -q '"status":"locked"'; then + BW_SESSION=$(bw unlock --raw) + export BW_SESSION +fi + +bw sync --session "${BW_SESSION:-}" +GITEA_TOKEN=$(bw get notes hantim-new-app-script --session "${BW_SESSION:-}") + +# --- Create Gitea repo from template --- + +echo "Creating Gitea repo $GITEA_ORG/$APP from template $TEMPLATE_REPO..." +HTTP_CODE=$(curl -s -o /tmp/new-app-response.json -w "%{http_code}" \ + -X POST "$GITEA_URL/api/v1/repos/$GITEA_ORG/$TEMPLATE_REPO/generate" \ + -H "Authorization: token $GITEA_TOKEN" \ + -H "Content-Type: application/json" \ + -d "{ + \"owner\": \"$GITEA_ORG\", + \"name\": \"$APP\", + \"git_content\": true, + \"labels\": false, + \"webhooks\": false + }") + +if [ "$HTTP_CODE" != "201" ]; then + echo "Error: Failed to create repo (HTTP $HTTP_CODE)" + cat /tmp/new-app-response.json + rm -f /tmp/new-app-response.json + exit 1 +fi +rm -f /tmp/new-app-response.json +echo " Created: $GITEA_URL/$GITEA_ORG/$APP" + +# --- Create local files in hantim-server --- + echo "Creating docker/$APP/compose.yml..." mkdir -p "$REPO_ROOT/docker/$APP" cat > "$REPO_ROOT/docker/$APP/compose.yml" < "$REPO_ROOT/docker/nginx/conf.d/$APP.conf" < Upgrading system packages..." dnf upgrade -y echo "==> Installing dependencies..." -dnf install -y git-crypt jq +dnf install -y git-crypt jq epel-release +dnf install -y certbot dnf module reset -y nodejs dnf module install -y nodejs:20/common @@ -104,12 +105,57 @@ chmod 440 /etc/sudoers.d/deploy echo "==> Making scripts executable..." chmod +x "$REPO_DIR/scripts/"*.sh +echo "==> Setting up certbot..." +mkdir -p "$REPO_DIR/docker/nginx/certbot/www" +mkdir -p /etc/letsencrypt/renewal-hooks/deploy +cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'HOOK' +#!/bin/bash +docker exec nginx nginx -s reload +HOOK +chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh +if systemctl list-unit-files certbot-renew.timer 2>/dev/null | grep -q certbot-renew; then + systemctl enable --now certbot-renew.timer +else + echo "0 3 * * * root certbot renew --quiet" > /etc/cron.d/certbot-renew +fi + +echo "==> Issuing SSL certificates..." +# Stop nginx if running so certbot can bind to port 80 +docker stop nginx 2>/dev/null || true +for conf in "$REPO_DIR"/docker/nginx/conf.d/*.conf; do + # Derive cert name from config filename (e.g. timothykim.net.conf -> timothykim.net) + cert_name=$(basename "$conf" .conf) + domains=$(grep -oP 'server_name\s+\K[^;]+' "$conf" | tr ' ' '\n' | sort -u) + if [ -z "$domains" ]; then + continue + fi + if [ -d "/etc/letsencrypt/live/$cert_name" ]; then + echo " Cert for $cert_name already exists, skipping." + continue + fi + domain_args="" + for d in $domains; do + domain_args="$domain_args -d $d" + done + echo " Issuing cert for: $cert_name ($domains)" + certbot certonly --standalone --non-interactive --agree-tos --register-unsafely-without-email --cert-name "$cert_name" $domain_args +done + echo "==> Starting services..." +# Start nginx first (creates the shared network) cd "$REPO_DIR/docker/nginx" docker compose up -d -cd "$REPO_DIR/docker/timothykim.net" -docker compose up -d +# Start all other apps +for app in "$REPO_DIR"/docker/*/; do + if [ "$(basename "$app")" = "nginx" ]; then + continue + fi + app_name=$(basename "$app") + echo " Starting $app_name..." + cd "$app" + if ! docker compose up -d; then + echo " WARNING: Failed to start $app_name (image may not exist yet). It will start on first deploy." + fi +done -echo "==> Done. Don't forget to:" -echo " 1. Configure Nginx Proxy Manager at http://:81" -echo " 2. Restore NPM data/certs backup if migrating" +echo "==> Done."