From e98da9b6370eea60210fb146987c85cb01fdbcd7 Mon Sep 17 00:00:00 2001 From: bunkerity Date: Wed, 11 Aug 2021 15:13:44 +0200 Subject: [PATCH] docs polishing and fix install.sh gpg --verify --- README.md | 2 +- docs/img/autoconf-docker.png | Bin 46697 -> 51926 bytes docs/integrations.md | 61 +++++++++-------------- docs/introduction.md | 2 +- docs/quickstart_guide.md | 18 +++---- docs/security_tuning.md | 75 +++++++++------------------- docs/special_folders.md | 24 ++++----- docs/volumes.md | 93 ----------------------------------- docs/web_ui.md | 9 ++-- helpers/install.sh | 7 +-- 10 files changed, 75 insertions(+), 216 deletions(-) delete mode 100644 docs/volumes.md diff --git a/README.md b/README.md index 84070e8..099e71c 100644 --- a/README.md +++ b/README.md @@ -48,7 +48,7 @@ Fooling automated tools/scanners : -You can find a live demo at https://demo-nginx.bunkerity.com, feel free to do some security tests. +You can find a live demo at [https://demo-nginx.bunkerity.com](https://demo-nginx.bunkerity.com), feel free to do some security tests. # Table of contents
diff --git a/docs/img/autoconf-docker.png b/docs/img/autoconf-docker.png index 64d87945f4fcaad63e2784591b9dba71188abf83..6306e60c901cae4240f61e3ad22da7a1e3e22a86 100644 GIT binary patch literal 51926 zcmeAS@N?(olHy`uVBq!ia0y~yVE)U%!1RcNiGhKEWtHMt1_lPk;vjb?hIQv;UV_BZ z9eo`c7&i8E|4C$JU|`@Z@Q5sCVBk9p!i>lBSEMj7oXYleaSW-5dvlk)COGsk+Xp75 zqmdy?G!{2_I3C>Oee;pV2@Q@QmnB+@6`VwmG%eOhNZoekS5rh=fa?;!Mf>uu?EAGh zO8sf+)!3tgDXnk6-fQOXXU{5tIExCVOr5G)T<_x2vPKy!@S$l-{IuVOsu0fMJN_;%E-oVf zX8i8#=;-J;BwuU~Hth%8v@?G}DqJ4+@0<@(q4CG?yD&&etNpV&h#|+34RH!eOnfMv zzbA3?%_n=5O+-aRPDm;#DLt!GS|lJUEZkft{WI>|YY}nr#hrVt1O;Dq7B=pj-=T4Y z#o+t$B})<>&zw24XkJH$Q=^19$W2Z@2a4<6+}h@-D=i98IK~P#C-~`|_<(>3>CcN| z8KWJvC)tW=Yids1y7X&jXXg!zOZKM%LPAt#cXnuWz)TNO{GOhc=H}+srKYH*rDbj& zZZ_S^*LUjKr4#g92O8?a99# zJ9g}QdgS==#h&+9tE;Len%UaMo_l@d*s(k^vk%6Jf!$)b4rnY34Jl z3f8MP?c1etU{_#Z;EIDLy1HkdmY2=^-Pz%UP+GJ<;zrWO6P2=pkAj1PpZ>A`KV{04 zgs>&`9zH%>qSkIY+Xspgk%h0XEnDT{;-a{a>;3oX`%C#d_`kf~e{1!Vr%yZg9yxye zw3am}Is#N+(X#T6zTKJ0Q>Lgq_ntasN{4l|n25*;E%&V8U)%q1Gd%R+|O z?Pj5>N=jUuQ&0U}P}jRU|Ng$0FJEeEY9?`S+_>?T+PtvUqNXd3GjV*+%*?!a@#2cY zU4j#KXloofdNgtK$&)8HHFk6~N&L#qUFGHCA|iC;uX*ghv}r%S@SXS>B-YKkFrNEO z*~gC`IllOPe|_fUNx^tFfeqqUPMFF5_5W}5U0AS{<;#s*AyYw_phM%20p46dm8?Wl zL-_7hzu)`3V_x;Ue*1qDp0fxF{yZz4zejO*tdaTZt6JwdKdC>fWB>o_`u;k#%ZDw# z-2eYCe4en2%M){%GS0GhcYf~w|JQ$>@Du+tfB7yjo)nrX;bdQIFF29W;*HRrkH@6X z{5_WNuKWOBN5jtf9VaAY$~b5I<~@ApzkgU*nA=LnX10?;GjF(9TTY%B7!jdyUQ|hG zmE7#J(`L@p+#SxhJHu9qC7oQJIKK%wY5c5if6}{jc9(e{codaBDVD8zB3ZmY-thZo zW+nfMHUYt(0@k6QdUoDlKjZgJ#);}S&K(^!9dorRkKK76e&+9+h7-c`6kS~Gj`&Tr zNq+ZT`&nI?!xPT)0!m8qNz1+F8GipQT5NBv@TmpvvKhbsc42eY`}=$x=e5oySUy(1 zdVks3w9_X}XlQ6m_3i|g`GR^uPmPsq)ZF}V-rm#Gv$eIg=-K@GOP4Nfn4z(F<>^`Uz{AHs62w zH^27X`BSGZ?YB9iRpByo=FG6wp&?ys7b-jKwPMgw`=&RK(KYwx(`7Al=E&p-|JK#e z_%Px3#^4;r*N+rFeh3Z@?(XVJxo!VH;r$9hYtaoh9g9UzFL;p0z2bOc$ELGs&cb{V zXMTybYbYtnbA9y_Z5BV4ZNt)2`^!;Ad8@<~frH*&UMXv93yw#0GIIOQSQN?|$JAzQ zqpp$Q`M03osH}0TLCtF3UAMW}+<96x48BhWrIqu4J&t|+__0FvkX&TDuG=CD+Pk{Cgia?*u6gwCYv=Q@H&XnJrx!Q0y4ttSUDTudpkjlgj@mARja@Go zZSxuZ7e@*CTBy|Wzi__M8V^cO!JIGsu4ZjbdT`jG)4eg#qc%p2mB%?UGP1I=va_@E zmm(*#2AjT*VMwBfsPkH>Aj76)9pU)x!lyf`L^ep2wJ^Ck@SIxlWrH|tbg(pMV8yf< zzyGqQcbJ8$ZvI%#-jXi5Gwj@r`&I7K6;EXxI;nfAL41$h_hj9R`Uzdvw{<*jiV)P# zxw88Gvqw?#UzOOM3kx^ivg3MD5~8oXBFyzkMTwG}nd+=7)~{zAHLN)I_r{tTN2gsa zEBLT+`Uca2>xU<|r8CT3JpbMsb{S?+sj zue8VS`8@uAV*99P8n;)&+Vmmo`tyH(smUz-XWDS>$Bzo1P&>Abse5jTsuW#Rw#fA@ zSS7+4{pWIHyYI{X_<;7_I+$;cXj#4z~*<%{OIvJ+3uQ(VL zArbt$N$SiZQPzoH3oRSlm+5I8$Q0#|W{@%a)+Yt7oCROa)oP3Fna6QQqShrvynNB= z)29zR2X}ex?`eJt-IO|~OuXpB7o+dL`61!k zJiT{+@&13J9Sz;$+ccElzf#so+k5_RhUol_ffK{OaQOZIp<$8hdm&s+RrTnxW2?M5 z_-704o%(B2vghEqT9N@rfpAlDSU{V6z5w+V=gx4Sob)tzha&`@ddT|R5x zygoqz){lPEb|O_w0|F!bHXrgk1 z*B8wjvaj}5?vGzmqtg@WaHO_;w$NVDSpl74BCDqTJ{sJ3TvbkLo4(!e7a&JIc<`~O zQ(GX1(S50%?aSyJ)_g(dKot)tx!&l#xO~M54rM;JLY}5Ya;ZzodX|T+7CoHd=hs)& zyr$+|`<5*xJkb&tzvORxIsM4Aqii2b76$!Uy`z0^LeH^D4Y^4^E(`zIv$k;A9DY~C z8Y&MB>FaIr)(SZ?KP@aRB^5=(ziEA8j+TTC58yL2@k$qU@c<=U{`<##U21_M56_GR{FwqM*M z+`f7>L>6vr482hKkm19h$Cd|;8zN&uEY?2CAxWz){Z}DsAe|F9t9X_f{ ztV4U;CGrdwC~r;PA@aV1(QWCMFC{&x5+;Uo7J44dn{xEP^7b$r&ZGmOU%a~lB_8X$ zMfa2^$$Z%$-qUbnf!w6#3@*zvf9q5)*%jMMa?M?4x2(Iq_`_xCZ�?*UB0Uj~+i> z{C0lcmI$30i{?z3qH?>5=R8_Xx`1Ir)Y^)~<;#~pKI#7M{Pn**g&PK8WsaqdQLn6~ zrq+Cd_lq64Hf=quS2=CUlp}ZE+ozrXYc^Zg*f@Azwxnb;8}B4lqm7+qMQX~-i>KJc zc66+$vUn3z`S@7xY^%~$b55Sn(9xN)ocrgjo5lMl*Z+MTzsW`ITfDWUvx`gJ;l$|= zdd=_sxc~p3disg^Gk(i%U{*?ar> zrS`r-R)DeCUT~tJ#Ty}m@6v5M?=xB}Fo8OK$ptr56W*Eg6z^v)b6^4WS&lu};C7cUNh@?YA4-a&H$E6{-2n={VF|f6eLz8E;B~zOzYO) zSMlr1OXKu&FvS{rS0Lm8PcVMC}$eaH^3oe)I0uR_?>^-fq8d zmwc>esrPih83u}$mOJD3*KL}~)C);2J!k%w-z~j9$Fg{uZgktcj3XU_%V@{eG`_ z*MAX6GFL9Pcl!V4=4Qh=zH_Zg&&)8a{rzp~S&@u0f7={AE-zb^Qgp1uA%Fj0GphyG z?{++XxBGqErj(OUPEKy;mzTTo{rBX_lizm6N*N>^=oD5DsQ>W5Q6};6vEEeYr&}{G zvxQsy|9QUtNS_lEIKT8rmT_})M{mtCt^M^Sa&ua0dbEhNv)!F~dYX3lx|qFHrFnUJ zzZOL2?R>gw^}0!~rQiL2zkhw;;x^l*(*+NHZ|1j~@cHVsmBGtfxy9>#KAoPl{9q5b z(`6@FcEA4r-}L#lVLUsUB+6VRo8LF{+eruuZ%#VO#j{)5Jnzh@Q@h@7yDcOn^yJq) z%hFd-QhISNq~Hzx|)z@Ap6TF$I?uht+rPPdzi+%$ z#lX{3QzxtY@B8&?^;0#irt5BVtx7+9@9ORS`*QjGlw8w2-|tmNsg!?t)UCfL^ZY#9 z<#Wqst@*UFTW^G}IA-!5&xUuRwP#3Se1+wJ$Kg)SC2dX8OE?3wmaWYKPhUda?ND&z~B1Dxc5YTlIC)>+mPX zFB&Fc00CT)FUedcf5!OS(jp(mfzO!|G1F*PN{XO6|kYti|0O|!** z&2?;M>y@{UJ9BQfxxTLM+gsV|U9ZizELO8p)9L(o;`jOQ_v?PY{gKRBSXg-V|3Urf z^3N*Y?RQ=G@ZhaaHGSzrVS)mD_)=#XPT{U$4hM zKQ}jee_d^kmYUkL1C7j^7D|E3`-hY7++Q2L{pRNM<;#{OtvGsMSJ~TJiq36ImMrPG zdFIR+N#isgSu2snx?JAVbY>bP9$FE&c+dZu|9ijR(`M7jxVq}qpo`8amUryBnLaG3vo>GfETpC121cg#P(GI;r| z?fLodYgE1@ZCbm^?#~D3ow{@X{HZai{rmNL>FaA#LqjjW_|kE5qhSBno*P%RlY-xO zeEBAryEtX?VsE{jEOS3i_P6_a*8F}4^XCI;oA>_xb~|{vU+#qkjWPC0j~dzKCY-%` z7+lcLfAVi#?CzwBxpuX`a<|`YYy7(LxSaF5;|)q_f?qCQz8u(maa-2+&z>G06At&t z>Z!v##02qBi9_tJ62~3;ANN@=^PSzMva9g%u_a4XrX1C2vfH(Ap>zAWIhMxC%E?z( zg+>%zSrHiFw(kAKMrQUep5hZu*Z=#Oeltc@zW&d~JJZeu``flI%isTZTio8NO{+G& znk#0wC-TUvcTtbdzm(f}>|cD|`i`%*%E#h`E?#(>_OYWNck-M$HUIy9fBx**z8{ae z*YEvy>-GBm|1Np!=ic1Jdj8>wiOSJiG8CulwQjBZ^U?id$Er?PDKhc2p~;yUhRhe` znYG=z9v*J@pK0WJW?jU_NBe%ibLMr6=Fzsaw9L%RG{0LidHVLt7Il9re0+LjGT&rf zTO%p-eFcXiDA96)6YZ)CjJChuY~~izap*Tb&sTe@^7-8I^S0j?2yNyT*Apq<=YICj z&(DV1MfO>8RWB6Jq@|`VG$?y>W0~)4yB`mlldLr!oJzdDF1ASCDs1)FJH_X>ez!># z=)3p@6aXdj|I;=&hAzIH&sD+ z|1W)Y$Lh!RsWnF?s0mKo`sCA9v$Qi39}8B2hPqEkgi4g@ig6$FHGQ+F;NQ>Zpai!< z0$p-!(iE5FMV-?%aS$YR?$!u$X2-^zI_^q})xrCsp~;cMnKH8CLv#QGhNxBxvx%8WxQZ>%cwJ!hp>8W+u8;AGB|NnmP zzWMd__4Kr~Ma7jb7PfENw88z&CAoy&MMj(RH2aZ>*@6P3+qp=;xg^HVt1f<$Nq)Wi%*q* zzyC|_mgu1~rMbfToiRq2aMpr%jtScdl*fsVP^kgp}C6 zPfbo;554tJvj zoo8ps-@SRo`q9Lej;kMU)%ywV|5Kl37^A-Cwcx~}!XuTTfA|d7?LLzHkrUj`3rV~o zTK+6@XVFrL2*K}$4M{ex1@63D9-p1tcpTS=Z|)Y;on@LWmX){r?Y7bGHfe5Z~J}8k|ha0ru{DXa>n@liG#-$Z_U1bN_54f8NYd(g+oDYr%>JR z_Y059a@>3oFyVo?UW`VOy_Lcjoflpke4o@!IhvD}_Uz0|*M>U^c#kp(Tm$7Q7CUJk-IUXtjz3K_Qc=M&(3a-lQ( z{eR1L^3V0R|0{BP=Z8bwZ~yjW*Z%(Y_wV=nPr2fLJe!?=>i&{=8`1hdACLchK3{)z z%qwBpiPyt-yY_Q@(Y7|P__FGF*Sz}ePcDbf&&}UeSm07t{kD5gYUllb_do5ZJMUNf zdio*t{dHRp{#yO^;{CY&+uVT1L8#PXY)Qg?V9IHCQ0;pXb^c|F&CXPZrR?$iGG@uS^ON#Dz$VDt+I1>GhH~Hw0N7&dx2r*J-yp_x84La>usrDt(=FJ@ke1 z{=eUDf7)4pc9vgHH-ck+(Np^WCcy6n(n4dST?|w01sOq1m4xVOC+Bw)ev!?r)0W z&4r&qy`=>!+hTiW+g5$?@bz`oPTR;Z>(Qe}6MkQ{=w8sD`28Tee8}NX=e_^-P)QR{_l6b*IcVotI}6nl8$oS|2KOxC#bjZ ze63li>g3PMm|xx8y!`K1IgzX@D>jzBy_G({_S@R+_kO+G{r-t!SWsc1;X27DV%}@x z_DcEw{`PjY!gv0xMYYS~*?#@#cv|@W->;cB)->F_eEo>~nl~ZS-h`K0{=TUF-$v=Z z`LCRhdT)gtSCuBO@8Fz%qPLoH?v5LM{E)u$?8Nd12O2jW=jY@2B~f<2=JVP7{eQ#c zltTGIZAnPeE8l8C+}^62@jo0D4Gjb3!c0L;p@|bG7IiPZuzumo_xu0n-Po{jP0`Aj zclD2-_a8}{x_n=ya?;JEf~$9(IvQ4LnH~H8KHvY)TfeHN7S}I!>-|&sI0c+MD~#V% zRf=0DtEi})IIMI(5tJVjp$X~9m+HHXUqM;r@TxZXx*rQ`-km>p&h2s|Gy8$vm&r}YuJqW|mL|KF+J@#gH0i~sl8CuL^m z8p=QY$Hpu5=i_ntB;|ca!L8c-wz~_R+fUWmU)WXhQmMbQrVCUV_kt?pIp(q#zFv>d zum8z@&s~0JMfzT@x_>{P8=tdq&f9Y3(o*k>B`+>4?AF`m5w`P*-S_$(<^Jnsg}=*B zj^AZl_Q~bY<;Tj?j=8OQ_iFN;{TUaPHnPqKtt>EVGe7)p?e=?GzyCT^zh1ljiQz#%6{d>#^k4rkX~;3 zCa86{b`~$+%g(W6nr^h5O+|oQz}Bf#rp&4RcC+a6QkQqzZ{~!a`y2oE_eM8Arz4NT zzVD0wCfxRad%6EwQQ2(!OTo1)E3$Up{~fQq4l+JgVf<#_=X2JZUh~g!>y`TZ^ZEQw z4JWRHYOl$WpxUeQGUMC(`~UCxd~Wl1X3^Dwi;rCmkFPzcdao|Zt5yI1et&xL z$D#cFf5k*aRkz1!85;}xp7=Yje$A2Mck5?fR!(wV-tp#JW&B<(t%sfK<5%xo_S>KR zseX5;;`i-YS5KihMb5HlNz=p=7e&Kk3STareo9il^6S-2fju>Spje&>jb#C!xmH*2 z@rSG_e}C`s@&5Zei_=-(&k8@btMv7g!XGE@?X5m<`#omo*C0^C{qn`d?z7GF^;XBM zGWfp!mDI*X$!kMn|L-pEU(x<_e$MZ2@8ex|a_y`?+{T*}Yo7=jd~BP3c-{B;8{XdA zTkYl5bu=mS>Z+-0R+)WlHUA|4tnToGnron8n7A?rQ2xzaJ~!<>uhxVqQ$%ECZA)HU z`1bbp=~b_G{{Q#;spF4x^7VfL|HT_TJ3qf)?a4ne-KY~<)AyYGn=Pa?ExztzGV_)E zFNZXL{`Yzg>Oao0D0Eu)Mjkv&`Jw2>->1{#Pu(v+x74wj%{2E`$$StnOz&9Ew6b;tInFsQ@|19ukRTQ6v4=kGE)#P@u7BTtH~Dy9XT9b6*xlPC1g99ExB2|2 zTYulXU9Yu%u)p#WdaNJ`8p5^M2u>p3Wd;5`xBtH~di%RqS66?3bMv#~%0-J7fkqRa zoSYnyaC(~Vw{?qmowNOZXZifPs5e*SzrDX7|4;4j_dCV>vpzT^B`2p&_4eCo|NGPS z`kxUw-=;g)Upez~<>|ja^zD)&XII}Vub4Fd_q(|rYrIcS`#9rw`I{Sx;h)vPg=|RH zjlXX;pZBx>`=ymzTuJ%g{r`XGOO%zrzxVg``u$z!>-T*)#9g#ygX6Z>I2o zhNI`)12>$5WCe2W?)tjt^SSDuPp3bvvAiBr+`E^5<*p+~j;!DRFDmbxJ)fLS#J@1k zN5-xv{)*laO^n#wv1ecEO54|)KIYq~nEhU_|0#RTiv_VfE5iP4-<9oBwtK03zHMF5 z>&5Cj2KMhiIz(lE+ZNycFg?wE z&8tOAYeZjMtzW&%O=tg}uh*Uwu0Nao|H+Mxr?M%veSgpX+sY}pch3Ht1>1|BdKD)8 z0}pWYXz}ds_*eS+nyhu%oA~;Z_v^3R-d|te&L{h%A<$Diwj|KcukVh4WCy6|I1fq} zF``xqKVB^E*W3AI5*x47nz+5U(l(#G6=eVKM{?@#1=Dn+LCxB^)9h{K`_A`4 zulU$R<^M!(Rd(CnQK91K{npas|3|@_Z@2cpS^q9<+Sj@N4?lHm??}y6o_74?tm9Q# z|9v}qGeZ3HuJsz9vq(NaZ&P&BFYvUn;VQE?@9ymd4Fm=T26|7^(fqGHt@`^rUk{H7 z$!+Dc%yO;j|JD363SVIGU79U@H>k8<9mUR~?l-66#lrRr>~rh?{k*))S6f4);8&vN zkr%s4U*Fm-z8#dz8kyOjJ$))`R}--=tz)r!|Fr$*Kfc|5UoXnK{GHBfo9rsLBU`o! zN>^om+^ciH`s4jwa<|M`-t~9yIP-J+;X9rE{q}W#c39ZdgGb=qrnbjMY|D{6cIVgE z*UOhJdv|N=>l1?QzmJ}sX}tVUbiJFKTU_netJ3CqCU1Jpiokv0x8Tq%wNh|6zOm}- zE4|oVb1I+B?3FUz^{7j`fOkXD(^Kj5YsF$O-7UW#`)^xP>8mT9y}f&1E}MPf{htqq z`HP&79dh-aZFWw6<$RmUO&M>mt)0E*lUw^|CAk+1p8nWsJLhxl&;S3XE~s_L$h_X6 zE#-P;jpFtPvNjtZefZM|9{RZ|Q^qfAwI%QFu6K8LC*R1uu_5vPzS`w}b9dGJ{PgF~ zpYnT^&;R{?@4jjJVYijHwr0l{om4fyQ*ij#*Vp_1ev96z$fW@)+Eo{T()g;IjGFfU z|9tL~wZ3%u^7`HHcD1y$?AWp6+uPgUUtV5b|NkE|JD-eo*_$t`AeyJ zd%uQVytO)9KQdJF>uZ-gH-f6K*E{P!zwkfee8-)*TkTD=<|vAh=4Cj=yvUdn)0bI%pPd(_~PxHqK=)`T2DE?dFo1hRMe| zmi_zt`}8WU*EMxV{`3h(|IU#AxAT?L+h&J-mzVj@zF+s-S7z0EaJRI1=X_8h&*2C5 z;}+R~pR-H*e{7ur|RQa%S~3zS{J+f-Ru$ICctkk9 z{_od|i``vU-+Oqty}P?RzUJf6o}M1i;Mtwx+Ruu0`lavh-3^!jkqByfuoc^bCLSkD zhlRLa?5-P!i)SVtZtGljZ*TSXoSUB}y34J6!!N1Snty*^?VTNk;;|(Y@2r@=HUIv< z)B5|T>|W0Xu7?c13xkT1L{CsNZss;-t^bc>JUu;E*q6S#0vdn(e!sr^=qk3=pa$#7 zlP90gDek+o>;9dZ&u5F)Lni~EUettn@$T;O?Z=-PHM8?i%iZ_+^LhKnlJ71r_wSXO z`nxpleeUgTzVFsRhS(3@@dwpvDypEyN%}3m6@U6a@kyC@Z2NiexP1MbdGq9?rM1hS zDQ`|YJIQ*591aIB-g7;!dTq|<*~!QI_I|nK{rFgK_LUVA?_`ITzPj>qYIxkl+iT5` z^-hF&_SN0p+imTqd;0iH$^DnUHLCp0jYjTaEk?`uHagIRV*@A$hsu|InBXk=t$XJ_Y&^Y8b5kBjtH1C68Z zc>#&o;{Q{_<5sd}&0W2IU(`0%6Bie|@BjI1cI@u5+`GF(>!;6|Gsj)7^2x{J^6qE( z?f)oD2b}L#e;Mzt_KgrX7@n)xEsD zii(RTPoBJZ(V{0W7EPWy^(Z7__Pm3*!&>3v`?Xc!F@>!;#`0hrJUl%oHhWo4oH%iZ z7RSHD>uH;1`3l|pWG3>fMS%J}`nHfLyHie2rn{rzfZNcCRVy*!^Nr_bjvATZ`TMk9Ld8Ta|d&?NK; z{Pu6b%(%T(C(S;Ca>6Ik*=NK4&7Y!ZZ!f?0pyivqySui=?XCLcaQMX2>GA*me!qX3 zUD5~CPr2*>_P*J7(D3CqyM;dea<(b6e}c08&kMJri6(_jh+6 zDcs(Yxw+=&r|0vk-~9~uc8FX5fza!9yWg#f-mWJX(#|K_^dZ?E6tb4!+Q4V_@Adot zRjr+T`Q^R6yP@F}fAZu>!NXq7Y`iXvmo8m$$rj)Pk39&My}FY5|KHzDS~?2R?rv_6 z7Osuo9~Z{T3#wgME`T}?%g+8??B0KjbHVkc-r_gY>_8=?-NcC#6_1ICtO?7GiJ3D) zS4T&Lo8{pK?Yx5LhwnG=%Wc0?#4UI0!NKOIH5Wi7sUHJ07V01Onm=N>@cPQi$q<(< zdgblwE6VKU=hwGFQ%|q2v(xdH_-28Y!+H1j)n;E?^Yd}P{i&Y@o2tHM{jqHNP-~0g zu*b)GFaJuDt=*qv26EQb#LYL4>PZ84<>lpmS!=Z{o@QrR%c7M1b${1gIQXVRPxsW}t;?rvxwg_$p)q!SZZZ3cR{eHjbn8EGs`Qp3v@^5d; zEmGVax;kv(r1#%vOTxpq{q<4U(fWM_WydeE?sfT@52nm_75RR;@O$M z$NS~=|69(VrW*}P+(n#|LAhX+&d0g2Jn}OZ>11mkx|6T+tnLseI87e1{{H^{{{NfL z+nqjt{v?a*BgYvpI#;Y<@nO{Pca5*dkCdv?pa_gv$$mAD@z6Vk^y?jK6m?p4-fC_rpQw{>otW zNKqvugJ0gs2UiY;RbO7T@k-x{zvX8Ad`>YNuhf>p$Hyj35~}oB2%cM%{`vFg#EBDM z{GU8&(kg*piWbH7y;7!ae6n31ugtY9ekNm65unqrJ>M|-*on3W*LD`C|JjIS&&50c z-|c?yH`8dT=VY}X%3;B0XPI8Se{$w3tN(vKAMcaxUiab0$H$)poVkka1p`})ii=(6 z&!03&X|jps0c+A(@tiuRvPyS<|@d41g8Ep^we zA6@==cX#>zf4^S8-}QRkn>RT*4|hJFSN-{{IX4%VK$-o|CzJW@{|G$Ye!uSbQSo@t za+p(7wV$7vX`FUu#=X7Opr!0V_XS>DSa|r;)6@U|eD<$AqSyqgNj9%pqjT~6^5x4< zuhQbYb?5x=pAz7fKREBktawtl`f8Wm_T1asqLxPsvi#Lvwb+o1T_-YSpTwcjiLy zym4^;Z+;nz33KP(-IVIR_IN3OZP@j7u@k?>SG`;cY8|e7lfC0l#p|`(pPid~dw2Q! z%l`JU?{4?9@k%|&QdF_~bskh5`+0eFy|@Z0#6nGH7<{k)^>X>^Yinm)mA*RA$Sip9 z_SWq3pHHW&tEj}3-z_bEcBb;z%jJK+n@Pf5;W+QNeEpw~*Vaa7-(6dMcUS3b^Za}1 z^J~?v8=krzU%xl!rcufC(pOg|wmFMS_*XD!D(5E+Zwmo^0^5x0Ii4!X; zD>rScIy3pVq1U;&*4t};e@im?@}S4~+>T$bR-5PCSg_CPjW)deV9kA3|NUPCD(VAzCPH@zPRAs&gXqHmYe?6Zl7(Qzpv(Jk^DWy z=AH8km_Q5ZcPhMT`1kMk`^e2{S6794zh;iv`Q?)LMg2E-cZaVNkl~ZD*iiWR*t@&C zPcJTcx@>mdub{DxT}ph7 z+Lp8OpJ&avIhO8yGL`T5ehVOB6(Wd`Q?wj zSsA?Ctyijb)~~Ox?Y~|LmXws-ntlD+wf+uJ2mFZE)q{8ZA$3*EhZ2Y5eX_HS)BAQu zzuca8x9V^kZ-kqk?3a19-y%Q8P4wP=r^vhXozW9;m(HoM(D0F+RhCcSw5|Ju*X{iO zdj0;s-d@pUnMZa>e?jyA$4dVCPKc}d=z3+v9e#DcIRb~DrcRG-yV-C5Z-;xo+^sMr zrDOf_`qNe#!7G5KCCtA*oz}1Z{%-BwQ>Rykua{fL{_XvJeQ{pd7pFIE+9YL?p&;M6 z*ev%Js7qIL(E&7;-E`>Cp%*VQN-h=_7J|y)Um+3C{=MJ#dtKz_w2FJ6p@iJq+d93T zR9yM;`nvxauBXNJHD9lWKid3{-|mM(nqigSTr1Jd24!y|Hu_vO_$~~oQN?*=FBG4* zRsVJK6C1D8my7Q5C!ab67Z!fpQTX`Dl@LaFu4H`QAf_9&Wbc~Oj>|V>URK)~@WR>u`MbEZ%gcPND?crX(Q}ybyYs{o z9kK2m|9z5@7M)F-ytPiCZfE_G4#A3hdV4+`vaSAhVpaXWmseH_Yvu3%TV@&mYHs;G z$J)!we4p;=`%!UqlB)NUKlcB1Vt0kq*goh~pEn_N>JfNSV6a{wtnPQG>~`)C?J4FJ zA07z&+8C|>_V)JtKR-Tx610-CDp~RWUi2rnVtc`vk#TYJIR0vCYS!`o73kXe|E&4_ zn4LvWjlw6qIqFdMbZYpcg`KBvZcgt$b>+&HHEVPNHGO6nFn$dT4CEHqn-W@fqi%cN z-3u+=Oo5Z<&h7OooGh;cnyCnUpYrw9RaREkPY$OO->E|@hXC0N3!U2q%08+WG-+3V z{J5`RYu?>mo6lK!+eOKKDYyUoWpd1kf-`?zQlfV5+_^~J&0}ilKar@N|Ige17qL$g zc;eP8_4La@#YT9!&`{zKw)*QS?e$mUR`w+&CB;>}RNWcy(f6IS~)H*a^;rEs;k?#M(ZdnQO!w|70^50 z&M)8h{ElZ;)vlOBYr@vY#codX{aG^Q)vc|s@7Mp=o&Eu|tJR2e^;Ipq&2plmt#4Gb zc}1Ld*1x^AwPKM~*&B`L%~vljc0X$CFu(GdWMpU;EFLWnTP=8bdHG|`a-;fxH8QPkZ=udi=3tp-u6dQck8$k6l)G&{$RV z=_&2?;3b!94&3pVdjM%DA1iS)=)e`Y!Wr^Xh(Op3#fn7o($4_aytqhC~g1NuwkC);v3B z{odv5)9LYjMtY*JuCMRES@`%^;iV(Q)^_^$+n?5|&#Q2HcSc-HCqiNSYjZvO*ZcGCTHSo(f99`?$UT8yN23pU ztkyVv%Ymc$PXEV4b`GvJ-|v>Qva&AfX{dX3W#!M$&llg>mK*)|`Zs~sfivgK=_&gD z?(W-ecb({MZ;o^dKVr|_mUmZcT1)x;T5;1IAsU*Rm0z!hzdh|1Q*e+qW7qe4)q%&3 z&c1Blmb_n6Q*&+9R;~JQo@cP`#h<&33xjujIK=%iX*K{w)XeE>h~wp_9wnmUt|y#5g{Qe+A1eH(Qt!(A7A2x-wSJhf6Iv4 zQ}MA!(s;|pQ+dC?y|u0W=5p}maRGtXft>~)zTM7GcK?>Dyl&sGtiXP5w!hzRPIy_E z+xAOTJIrUM(b0Wtp3O|3=UC&eXlxv;_v%FIx&&AOcW%9`fZo%KvmaDmb6%csM%TKy zsOX7a?ZbDw-%q>!bu(yXQtY&>ySujTXV-dGr^FS`5ux-&T}_S6=8JR1le&-mS3q+F z&1}3`S5_4MdbvE=OigWB-rZd@N`J}l&HGk-&XS$G!y$fsob8);J;vuUZf(&_JKiU& zJzZPX&i%>~&&i+9+sE(!XjS^^%Bs-Uppm!JmGH9Ca(|h_qx-+V=C}3d3O1lhW0kwuGngR{;adJO#R|Lii&=GNc_kdV*Bx;+ka5VZ%Ek~p`@&Qv0Ld& z_xq`AF%?h#-Q8Wj+WMm6zV#6sou(X2Jt1eBH6^F7W5@r0zpKB$(@j@WDtmWFQ(P-F zB0}S~l2X*xtfl|E63)-Fed_dd$DiLuup;jHe!drbzu#LOyL;O=qpOu4kBX;m);``R zD{WP>B4*2~u=R1e+n!DNy?)0duE6(8qx1KMuFGt{qW9{fz^f}Om9tkbDSm!#-s1nu z=htc3eOj@-@^jkFH|(H9UI*&qyzuw*oEYk;U{hq@;eYo)ulc=-KR-SepSKM^qZhf! zMW^7?latEseI1|rWUXDYd!u?3=LHWg@toWzXIu4b zW_nlTlZu@!=T-(U&)e~^E$!^A+OJo`k#l0*tA-CoVfs-|=T*O(cs6g(-*2~zE@oxi z+w=3`;r5ND%kSLZU7o*DT)$V=I&59$@}m9!V!O0fe|WBVeSN&XxNhk|R`DrQrkqHN zPX?v=#cd5+wwOeU${bSrt{=67?N;3PDA@N!q>J4*_jkvgGcGUd zU9*bqOGc8uT#vkcoL=mzKkW*&tvly;9P)H?YkOffcVB`O&mpz%pzg)jS67`kiQm5o znsD6s;le^^*VhjZx6d}q?K<6%zyEL86`$E=yxc3IzkYvladFt%DEXQXjWh12mV7pU>yJuig=wQ5oTOXHDn#_sc&)`V^M+B@VmG-;3Qp z6j-1bx6fJgyn6XPoA-M@*Zut(o^#fJ=l@No^(Kd2eQ=h4nyf{^gG=7}Q?;jj`s27# z3lz*7CeE6rWp#$@f2yg%A+_&^&F|MN{@?yWf8UQs4-Phiw(x#?cX#!FH_%p+FZaK1 zjavIi?4MU);6#s~hpxxh_v)UI{C(`G{j=%E5mm{*7Y%H@QZ3KJ_yuFORX&;W`}Otp z_GxD%p1ha7D{Y>4r-70A30E20^M7%BtClWVa$<4e<7Kn+vMw#@j5&Djw7k~8@B9Dj zhHJF$UES~fOQ6_Zu$8^!#0xEDW#wk$FU}{P{_~q_b@FFIt9IA3v$G!ueE$47HB=K` z!q(hl?5yv(?Cs&P;)AeVQ}Da*ALN?j0s|+;96a~nPXBT3Y2STnJ_LR=`hJ+#{EotP z&8btTs@|>v4eL71J)7q3UoM~jq2ozb8Lzb2pU3_7DVzHZz6%F>Y>ryXvHpeP;zf(NxVTbs1GpC6*|2egExt{`A~9jrqUl)^*=r`v3R- z|C7Ns&#(F9xp7Z==()cW=FZg(*A9I+7c`YMzr#t~Y5$L#lV7}eap;g!r1TmmjqjkL zrJCMk32%gf70=QiyseI54iFe|*#_j3dDrkgo__nlq+KmLBd z|8$zZ!S~%IZ*FV^MT_a%3&;O{I<3FyCg|u64Hr>y@$UB}Nm}m|B%e5Ge0O$qbZlnh zJ#s<#OhN6VFS?0{a$Ua6LE0?mLR^iN_jJ9fx%U#^l`sFZU9IN#G|-s>t&3ozXn($Q ztM3zy+9_Z6<6-;ncf0dHJUH0d*~u)!D`T<2xt%X5B<`! zLL%VZot?(7l$Dj&@B5V%nQfkNVS$)#)Pk2^F8fapWoGMm0~v+?RI9XdK(#38(+gyP30XTkh>g>o06fb}tq8>$&?#uMD)%-SiZw%UZSNRHf`h zB~Zia`CId?){lFP17^;fr?*W<9_B-l?hDsk5)o_-$M9a_RIZrG>1b&QnS#P5B}GN+_t)3YeI*J|EO&0_JNkKLOvS_2 zS4ZF5KC9#Z5MuGSo2&21jg85hc2>>!-N}^v{76Sfr}a~xr8QIM1{^g#%;2=&qvhnu zlM6+EDgG(4-}B)Rw`tau1My3o+xZ@`SFH`xZcD!6Gt*0-!$r1%`UuPOFm}R~Z(JE4xy>Mq|@mBGSl~rF~J@j(e z7Rpw};zY&OPQE*y)m8lcdR>3d2d9th zha^CKu|63~p{K>?ZNFdkw--G<<^12%({!DE@9ru!&%5*ET6BKmi|g0=J0vU$629&~ zb_~{giTP^1K-s--OWxh6>fUKi$EM~^J#r@=)N9+xx%=1G*WK*VzGwcrG#)2aX7r#wi)x5g$W|-%hzoMX#groLLw4}}RrsRU= zG*e`BH*#~{y!q=+{I!60NecFt_~P%Dq9}rup~woVvd$>D~9X%e=N1T~D=T{a8PDj-rzN zrsElsCtUZ48UL!fxFBeE@#MWLLbF(_7dyYuj}4kVk@uIZWntE(^Ier~Y z%d@Ng&MntIt@-`<(W58X`oSBJn&uwd`G4i|c|xbF&1!xW>}-lHE!zL9Vs*p5qWAaq zZd$wQU$%OB$BFuq#F)iPGppByv3i=n-_o_@s^6Jw&;NY#PEt;~R{7e>&zEoWyY!xB z@Cf8SJuR(MpdrWru{k^UhpmkQjW^8szEXeRkEEZUo`PCPZs$P_y}y%9*FBOl%@UE9 zx6iz^M16kECH47{y8bGS;4bolgP>gn;Nk9dvt$K~%FoU+-5Or7GCaOEbX#cL)uR9I z^0g}A8;mW!=ilEKtMh&)f3bZPS0S_Y(bL)d`~trm&k0QYzoYx+xs_4o@2v{5CGY!* ze+ix2cY5t>3scK8yXG5qT+I@dXLWp`4;rvk)UznIpO^CWYV`k~pU>Ox|M^ThhV#w6 zy}#S#>nsW$G~|4k4ce~Bzczky@*unp6F5XA$e}S5N9*+}peR&V;)^K0Z!$ z4!xOdUu-||f9AzIuRjOOJe%6Eye`o#H z-}@yfGL-k~p5TMb{5A^aDdN)7tLtR|JGNx5jeDAP*C`?1?|O=U z*3_rhN+N>XqmQ_5J+|^>;V;#QzDKyr$h7LEmFD} zrs`MzY$a%NyTg3{--*8+YYwlOwPz3a1nc_$f6EuU^*-75#w_=i%I#H8_Lmj4b!Zd_ z{93$d(S@~N-`+O=<7Cg0{;vJ$>FJdXD+YMFP ziOa(Wpf#=Q_Z5Bgo&Ern^}eWsW}4Pn$xis8Hlb;Oj`XVZ>+51)UteGU<)XXc*L%B4 zUz_FM`vY33y7q_e_rvGy|Nl86?4QtIbpPH#hE^^(ZXz@e;J9{%| zsixe_*vH3uzrVk)e_IQ*_l-&0+&uhC+RBwHH);78LRP%&?E=jit}bH#a$LUN#ohgO zb>_>T&*x9iJ*c>+_<#ER+GTZrS+cIK3Y{CRZ~R?2kRdfKt!tf*va)knt3G7O%YtOk zi5*3u?;0jpf8Bp0bbH=i+v;y8wmlHIx3m8LzrVh-OeV6YhtHkAKK-5gA_q@@fAP5z zR=JU)*Jk|Y1SOVzuAoH;p*xv3Md*C%i*jPSyFGt?4maP!xxXF%^eo+!bd>96KqaUj zETE~WxrqJr*|SqaAND~OIK7Ai&4|ZLwO+6_`}(clSu2B=`)yLpXsLZCZ&$O!#$vbi zyB*GEA#%m`f|6&_Hmj;-QAwUA(c4)_j3RF zdi>||j&ulaTKEYxO6$S#_fguBz`#HbhfUXHpxWzT+Gp8RZW1%|_MK(oX~xpK;rw6F zNHlx;_5Jnr5D%nCtiCEGF5Vu;y>S1A4FT6?L6N)P>+kL={q*3CRr$M`S64K_HML7h&!b04g1?fJk^-h}O*?eQAGCVtiy1gEoRYl& zS}fCgHVD+@=55F;#3wCG>9)`uBkdV-p z4Ut)Qca=iIu>R@P@Fxdv#+F=k4gL30?^&JFr|po&a7h@XF+7VOvI^_MbC?%mca>Z` zl(w>0+Wb`8f{!PZ`%g4)=H7qj|F!7+lg*n!!-G@XgFq&&ZfarzH*U|${Az^8W*ICt z`(&-N5;tElK5wHe-PHE$YWc%1?R67)@9lg#E&9o zt|nqzs8F%J;LrY}Nu51CF6L9GObL0~uiVB9_2qN0FYlE&6hA))T2Gm$VVZVk#>K_% z-Q{^x=Gj*FNt^rW39=LzfEJFkr%(U@Jo0YwZ*x3>b+8AH;>*Qqhr}r=Mf;>0*&Yc*+U!a!i)Sb}0Hn$&?*FG;} zF8ZZm-#SgrcNSDKUjyDey>IW8({){Ca1;^I`%n@}6~P5{}M{EolcceYvT zJ9Q=HrAwA9_}tmkbLRBv$)O=#&`|FNh58(GS%GOMPn_7%?i5f}_3PABZS6m@@gTo& z&OWP_XW0PmLF>MRtd&EY8?wr7_0?P3^W%Hg1_lPUwzh7XCR2C=^&pWDUyi?pg@qCk zix)4J{AK$9?NpH!R$blQ$;ruvtBxHxvOp*Mq$nTS`6a8?tXRQODDRvV6BFa<*||p5 z+yd?Nl2x+~9di2k`R&J#A3?Kqld54y)4>ir32i)@B)HJt(C}i~=95vMI?zrnS#-+j zMSoAv5sz7O=A60k-WJ^jTB_#e;>j9ImMl4;^@$I1;!4Ms^LO+&GJ{WHd7qk^degYx z#m%j4jnaBZ0Q7kLKJ!-ya=OYVp-ua2Kf5dZJ*~A0dOV9@=KP)UNsuF3?s@q7ZcYE! zapz797_*=ds|H5D2g85!Bz$6pJ23b6xmTFVngr~0HM zCAPCGR%mn|RmxuJg&syl$H6ns-525`A~dpBuELP#TxhSS$9Fi@$HylyaN?S!Sr{?3 z=h362BegwKH*VahaXM<19C|R#5fKyXx*#tup1w6IRX0=`5>SYvX{tE>1_lO7sQ&); z_Vk7K(ddz+Db}rOWF+LA0-b(*q6}A|U~Vp6JK!zTI{-cW74Khuz{*xph@N5{v@Ym%{xi&~pU*F?cfmoBA<3I=KjXU^X_U!|pP z4(A?CQ^A=rX=%&Eekv;&85x13JDle)^9}7h!&7+Q?u_dP-FhXX&7cW1$!AZVoX}EQ zbfG=ZclIiwnKLUk$3KYv=aS;5sj2ybSsAk8OH?p0!r?i{03YwYH}%2VrDva=HfK%` zp8$A?L6p*>g2sPfBc}a3Ti2NXQ+Q&f0%)9l(d+K6E-ej>30qxU5?NyBn1!kusV_JG z&ARWYzl&Pp)~Lsi9$k2^_~o-MzYF&wYE879TE98|!4G$r#PvINM6~>yF+<{> z%bbow5>{5ZtGrU2^zOeA|1r&8u+^NU_DF3>dB;B<(0s{->zTo!O2S3o)Ak?O{-;wT zW?_AIU!R+M`-OZ^lnDmTa4KK!8`|mff>-uq|J}&Q$fAF}=0DgZ1Y4IjH8rhRq4A}n zv$NA|w(m6|K~Ni@=)(5=_&J;%zl-K|XvjqBOgnMHqomx^)05|~ON!8$zfV9%MIHk6 z+`-eio4Ptqu*~><5_AYrt9eV^m!b)vagmOWGmNqGLH@P`O+X||N=imO>F+oJ>hQX_ zENi^y4+?o1(9q%PEn7@I zF@o9O10DwyfyRRpXx$`uXx(p3*lKW^{3Gh5WMuiQt_XCtM4MrmezK%uP>j|!2$C_bDd?cyS5_DWJ7s9UUt^!CX7_&YhSNuL;wpsjcqlSmAYHdRB0# z(qz!s`GbiwXRdVp*U{0_!xQQ1;u6~WE(8{6teh#eNMW{$?F(rC{)s0ues^j}ELpN- zfqqv{Ps$5*CD2}7a4Kp{-F$P>#02{C-g*@VAgr zA-l8V#B!)tCD&}&U|?kx)l#?msuoD%I!t2af&~g%T3mPipe3z~%M*5}H9X0X8M5ap z>gvW{gav;>)3Z`C=!oD8;H7pQ9iSt~z?oPQR5Hi%rlh2t&{9(RWc+2;T&}(rDSOGQ&L*A z;RqyzK!@%ML6QsTFl}$BzK#wJogt=JV^7W0xdMiT%jYO6DH$ifQ)gc|<9E5=5k+mz zoAD>B7F~E+5#~H~@$U7-`z>rlX69%mqi#+0~P|x8BL;m;SXv{(`x= zWZ{YMIp>xZsqgw;^Jmh5i9T~)JaV}%zhT?yON*a&H+5)K7<`}HeBspJs3jcBzJCWP zKQ-Sw)b@7mtlv+M#pGQ6*l_yUk3|YfTykgrK2cawRNvZp=-;-*OT{{D>E#W_8?pmN*vz}uH{ zLyBx3Y_b&RZ|Ue@Vwnrt-et5i;MCu!F9m|WUN@6{Gap>g&0eoR_o7qhzI#VM-BRj1 z>6#t#`B%haiNZU%6ILXxd$eg)vBlOm>MLdxt_$bRX01+sY58Kq60^tOa;|INouXqk z=fW@MYqFD^Z3P8c#j4Ul6=u=GDZjTmES%JSLc46yIm_t@jhosw$t()$y#4g5(7Kn` zizBYQW$V;>_G*jv+TuLzx#f0GS$=cQ@9oT+yK3&+Z@N>>cHL<4yJ=>VH?gCGr~?WU(fM)*oUfc-eg6ARW|6ntf<+V8J#op_ zIIXBPbw}*Jn7obe!>+!7IWx>oFWdA{OA*MSwWl(-W^A3mZRy%P|8t*qhn_OE%sX;- zmfSWE7Z)~A3R0Z<+x3&ice`bCwr=0aArn;_SsJNTxP8y*9gDNJgq1Sf^0|3%$8Ckc zqjUVM+duo9dFk&M{@mu(+oPL=NI6f(_I{IoTTV z?)nYko<6-~3)9YNnW$V;hHn*%Q_4?$db$1tf zhOf8g^geI%n{(xU4-I9p!oqFbdeU!ZPuTkITFGu#B_$)7UDe>|QUtAE?&w&NME$(X zG4)RTuh%Z;_NS#N{jpV1Qc_yQqoNMBb>YO{Tjz6%cEzEOPHNw!e=yEh;JpD_;p!41dFJnv1Lt?%|L3SZQH8d{d1L<^0a~o&-HIMJET@?M>8&Mc{4XjbZhPM=E6HkFT+Z#OQYfh ztwY&gzcX6;=apQzPPC1pb@cxeogEz=S`7>fLG6Nb^LO5tiz>Z%Gp=OamE-YKtF~6v zG90UUx#pTm_;uZ-YuAQdNb~x>Al^}X>f7kY8H)3~T2m8J5%-^UiUGX~a%Xyln?tw15BcN37=ExxYoPGIGY{O!mnC`RQrwu9BUfPHC^-;Jh$+x!-KF z+(~C$Ttwc@_??KC^w6c4pf7zuy+EDeE}#&g|)yKvPnU z78SIw0SAg+%l-G;#YOL40vkE=P-w5!y`s}ouUVMCcy24V|3OvxyYLWpl^u7~CRUf< zt5h%gza{gsm`=op2hIG;mM$%Qc`5bZpP!p%c61z)Wts$TD;>7KzkX?WZEEJGQu%tu z%}ue;Qlm%DaFwB!DZpV(Ja@4sJodTI8p=@-`rY@2cXv3Sh;bBDWj+1|Kby3tqZ zyURP!abcjNu#WtdG)@C;tC-2Ps2OZ@{j<6a%cBn(-u8+E1&7|s{E3M>rab0aTAC_d zc58*(cGlm##Yf^oa$jEBWqNhmS9X56{{2%{->r<w?#jQc`SbC3 ze9gz!IX_=4K6L2NlP6EI*Y7n`S5N=^?Cfl_++WxC|GT<6d_8CZMqU#rK#J`xIo{q` zUw!=UPooBnHMJiOvX{QTmV13&?3~!&-`+-V$te7GGd;fU=hGyyR&M=08+>P*ncpqB z%v+{ml6&jR!*=;;vp*ax8k}{CUt*)MCb1n&8++P=O;58kB7JS;Wv9KKR-J+ z*E;jkk|j%)oSdv4{`T|VxmKl@g7(KQ{WrCtqoaw%ssNlL&ir**$gy*O?C!G2$jI$? z%WhB63^p=0malrD_~c*Y=CnjH!`g#QtR8<3xA7jH>LB{=d2mcj%<3>*-A~hh?f?JV z{-&FYiz3rr&>aY%&c~tvP-tw+zc07b-qf`8(h^UPZzq0%hMdpLG&bx$&G4i;hJi=k z?$5W|`NvHU?5X_xZpUN3C;yguPe0{b@#WX+_1TH>>V}4a+XMvzI~?Ax1r-Q=JLhZs zkhQJ4lC&}B?yl0)({yJXdUJDg^tPOxb$@@UdQa1d+f(uO)>e*Re}8?A-k8Li_CM9U z^3xMV=eCse^zQczI`RAVxcAF>dU|GA&v^Fy`Tu{v-xrx%S(m@Na%i95+gn@LhH1|# zFi;RvR$7$Mb}t%K@yQh12Y&ed^?JOrva)r_iwkR`w}VdDyS20Uc^j{EpNyr^P7$a2 z$H#iz`{jB+eZ3yv?=)R67PQ+ObmZg|SuXMTn!=o%oSK?FH~6?rv#wM;o0@=}z_gz5jpT|Nn%`#YLp%0{AM5$=n<7#P6N`<@X!0 z|NH)~W%&1rA@s@f`Sosb_qXNVPVTpzHgo3B4~O|dYgYs1Hh+G8e!h9W9M|fwwNgeY z9${hAX4HPU=>C4!YrQ4^UAx5=?kRhF>u9(5W2=Yze!n}t^>CNJ-A|QE_REUQt@i)_ z_ggZ3&cfE({#RF4K7K0B*3ogI;>C)sE43z`H2faUT5K=Ly>q|sY%}ffb#p*RX6|N} zt9bD1_4@i33)|IvXSGDOyl3SW3UaL)Su5uH=~c0Urbva*7LE?rp}T&UXcbh+H#)$>fuR)s9@uFw` zrsz!k9lk!Um!q8B`Pu|EUZ&!0ObvkG=@8TlY%Wpwz@6ODfJGVEY|7L1g zGdusj@As+=yB+qYoD>pSxBp*N45v=)E|JsAmoM*^Fl2fupStBylcKu%^62e(*5$h_ ze*gQv|Nq&!*4K;Q?SHrHb)T%YTDStp+I?Va=hPSPpO)dRno_?s^kscYcx&w1qDOvP zx5R{KMJp>>-%fQo*2Q_#`e;&8?DXnFt{dy77e>c_Ol&w^dRl&7``XIAtX$>#`~PhE zd(Jlc^QTW?>*H!4wu&c#j<0-rdiwf^jZ7!^rJtWS!&TC>-|p87W`3IstHbpR@6RiJ zeQjadr6r!tY`j9*2WOdPuiN!XD~4x*=;j@1C(fSDy}eC0Yg_K^Z%-!s=iS)Ac%3a}Mb^M>TLxA(r7 zR(!87?_Or<^n$-nVSjg!qZx1Ji{x&MQpW0nv$0L4wi@5CcvhAkj?s0Y8BLA#P zUoDv{)p%`zBlGI3TK%0J9Zp=k3c4NB-Tth7B;ikd+O7>n_^y1DLQ>^#*WK{ z2ZNp_Z#=!%LU*~f-OPigyG-Af-wN~4(PJXA(<@f*J z_x)R6yq#-R`U-R`lUuJ;(LHe~vz#BGvuYMADlHOdITr&fbqlPDo_IVy*1MGKkKHo0))|SoZ?V_)Roj=wq{nSxFFz|#^Jvg*MRZ51eRmqCX%gds8)_dIEmMi#I zfA2K=Mq@o(<$m*FcbMd!^iZBm#qil(u`gxFj;( z-3?CB&*~OEDF5{2WFs@XS-ecN(wE^7U*m3ej5)oW{`pSE>$X!IxJ^Z-Tp2qW{{4RhRqzS(pMK2I`5FMD0pz7Q&>GkS5R=K z1g%F?7QOQD_4W1f(b3bJ2D)I%1TqK|7@(=8b?Ve9FE6i6QENA8?Kpb;_+tLfuC63= zCl`?%s3L<65ulsBHg4QlVe3>>v?+(9YKNVtkIxZ9cQ?0ZPoA8JQc~h#dNBu{c)UD4 zJ@fMNf`WvEjN{s>cJNH#ZsmyC(xL3{>$?>)vdF}B7j&=~sGX+tIC5>+$Bz=z7cE}= zv`A4^U*A9Gz=MSkC%Ih{5)6E>z#m!x`-=$t{Q0xu<<2Sd=IM!ZnYOmJ8X6i_aDX-` zcXntvTu_8(@+o)j#O(QXN?S{7l6T93Nt1*=`b$E0K~C%FU}D@0IztU)_acT}KcCJ1 z$aKXyV_L4_>9oyDmo4jRpFC}v8fbv8;6*#!PhGzp_Qc(|BgD?{Vgou9DPX6%reNR< zNA)$J5)+h%6|S_`1O)|M+5MQ~)I*Vp7dN`Nx;`vCdhA%+m-gu$9Zn)u39zhr?DUy4 zM_%(885z0oUb0VfezEOuoR*$mUw8Lm=fkWHpj|ntpkchk!k3T623r>t*_!zEGYsk3dknbXepk*+CR-%4LTXRpx{6%$*vyyL%wlM85XBWN1rgnY=N-tKPh|%wP5=#zub6a2c0vK;g!%LJvzzan>l73eE!+6W!mex~!Aj=4E1`v^()@sh z_O`aMVS!U`us>-@v;RI;m z#}jK;S65KJt}0{{h`Bpu+KtwhH#xQM^s_a}4Hslj(%p3@Ki}uXzg6g~6qnrAv51-0 zp|cZIQV56>)MM8J>Pm|Cw@}r%C0yF%hRiv zTIvMd7B5;P@r!rDv}tYW(m}z&%>N7PVn^7YA(Pt|?b6n0? z<;Nahd2(N*>FWzG7ItPn%YmSgqQ{RPe>?B+NRe7$nBIy88oBjoQvE5FyzR4QltDw}pF z+|#r3$MI>VpbO>cImYQ}6|c6gH2EhW8GrssTj zRsL=}Ej9CZ=NZ=Z^)P?MIb9IXH#>gxDC>`6wP$IYZw3Vie{2VD70EV`{GRy8uU$vC zXxrS+yT9#H+qt98_qUj=zM5C3t4+(7Prh04e(lc<9%oK=5fQt<4fEqCx5UJSyQc5C znl*K+h=rx4<)g>{Iy*c6bPEXXgiZ-)g#-jBIN2+w1vnm8{inBa<3?9kSI`WS7u3J! zb;P=>;w?XvPf&3`di3a{>}xw1PMkkKeXEO0%5liFf=$5pJ|EDw9FdeO{3{&Y+}c28 z(zCjvLwEe2_~qrTo2L49zo_bJjfm9L)J}V`b&NmG8@aeJRk^}EueVa>14vxPIVR=&h)x8fpckbNO z<PDX)!+a8y|(Z~OK6Y;EVS3sTD4$-!?mCeZ5^GS z&d!7LO|7h?QX{{bY zZe(PnukU{?=z+p#&=rG0$N&HPZg1)Q4-zvcpLltBxxDD_?0k4u{_v!;X~Fle`gwa# z-YTMS<}c_JAIJUR3F^L`^Uv@&#@Fzvn3+vmXus#_lP4YhzZYNL9JO}SG#=3K?vytgMgP_ZG|y4+&ApK6(Dg+)%@79B*%JovdoK@!VYN^7r>*&wY7& zI$HAwf3dygf!Dn|=lgIhjCXO^!y@tP?BX3eB5J2MZ_hGiJ0@=Pe1;IHW}i1{l9Ipp zCsT-BYOo_Uo}9gVmaYEdlP4*EzA7p!J71f0KcVKJgK~Pusgq~VroQ_wUs3`s;ZEiV z{5tx4kKrYQFSEnK!o2;)`)dp*yjR%US%2E;#dGQH zA(}gqe0+V6o@CC<%-l3>RTsn*?Jvo%J3L`0~oiO3AW?|IVs{@1s=bQnLA9yKcvh zh&vNy7tXgo=5jSKAV8t+26wuMzQXFBo%iQ1S+Ydyewf5x=?9&n^4^D+r8sjWz5Bj; z!HK^TJx5)&?o>XX3p%*a*hTGe$-nkrx6K&a_pv4`T5aF4!{Xkg)>ZuJQ+{k$j$wH6 z{Q2pqRXoq?>MzXim9Q@8YJ0a-vv_|ztLwYt_a$ssa#*>jELpl#aq}s0&d|8T#Dx{* zVt2XiXE^Rl0?%6)#xce%-!yHH*sGoLoYKeTB_$>0<=6Y)o;h>oivGSnKOY|*(2AA+ zf0{QRP1@KI-*SL+@~l~_{!i=JalhdP-?WhTUl+)6CyU<*3<{d`D{Rv4y)Pb09@}Ry z_4C3u&`p$i8Ns1k9RGSdPYJ&dJuSIPMf8`URT9h8tuA(xrcQ0$%st_1MN_Dk$Mb)a zCJC_={`tB#O#9HTQ-3`^zgTA&9TL)F(=6<)T6%?9&PdKeOd!4Q*Yo3h_Sl^1`u=R= zj9rtCxCy*7?B06hDwCG&8(03*$#*Z<>dxf+%eB1MEOcqZgZnd9*gX5EwK+oPk@gHv zPtP+cPt-f&U&&ATkTrE{$ixZf{+_t`quYA#)V}?8T3_usn{Mb%vRWYB-`^iDJ8@T$ zz~;`*&Q~`BcE;xf#4>Zt`@ZPGB!=7J|MLX8W^n%HN}q^i$tp)F;f3?}a{ZJxn)c(G zg&xD4O$s}OFYS~+vV4z$Yq)Y&fCKL#Te;~CpBWqDwyZK)ucE5@FiMa$hB?9Y>u!N8 z&y9}DjZb}!V=>HXsk(mL=S8>$XvrQc%l~68PYu6^Gg=9kq#pRaX0qX$Fzuu{7Oz*; z2)hMye!auLkitt-Yo?YNtfvGK&aSM6CXp4Kft z|Doa@cZ>TA_B5ycha#8whH5JOFjv#+-?@L&758;>-6EChh40^DVR5Y6a>jVc)qwMV znSMzwDHFL6{@8!L-LA(=YTmJjEL*<(__1TJ?k^1Ro_1eBPv7=Et2pPyix(dXF2x8G zuY(nxemp`PmAzRKzeZ5Et_G z`24E*hhDLL){&cw>VxC=rxX=!x}k7Rdy1=D(RT4U`76YIyMFx$IFYFKMSD&uD8n|@ zColRm)?{<#M};2j|N>{Vly)dLOr+Ipgz}w`t<$ z$&)6z2q$gd_04&Yru@N+vu4a#QNLM!&NPwjZ&-AeZF^RvZ^2W2rCeawTt(xB@e7+T zEn6ib@JCvB>hU}8Rlmr+*r%kdd{sKfrLl=cEdT$(kU0|;{%%_x-&*oco!LP6muRtl z;Dn@ipvJv${K}LU%O5me4*JVH<+AiH7EqxJGBX}*=CS|1-CbP*tDf}q|45!4+SaIE z!KXGyL_|d5+YzJh)oqh)3=IWk!$U$u?1LQ-s;R5H*EC2=hX2nLfYutPmh6BB zAjh1ZnUj+<@h^KMC#W=jY`k!#!S~-i{@Z3|si&_xxP52*o{g{GeM@xn^7cNh|97QG z^FtBQ{acbGp4F9uYwzQq57%E`l+gA$c+Tn_3>+c%ML}J2$eq03CF^rGpQ`y+S3luE z^C9QS#>Wml$o&v`>dyN~6;T)BAL<{v;D7LZ+UCyqidKixc*j;~Azb1Dic_V4o%fSA zb})TgXIDRS+BDGJ!lxRNou})b$~dHR&CAE6fd`uy2ddxih$ zj@pihT#22-xdWo-Ox9NAdfpTGSbu2^VP{Ci7VQdwLj-w-BIfJ*V`#EQ8Df7e}%rtj|Lx8 z7Rg9Tb{=nSvP%3i`_N`k`|=gzdBuNji#QLj{gJ#gTF%;)H|*e~MWMEPALTd3y1TnC zPPnnZ+Ti>2cKgX(fB&2@X%+Y)9rdBV!{PZ#c?+M8o%3y+ZzR0?F8{>|8_8VG( z?)JTLBSIzojqKAOKPs*+v6uKO{XFB47Kcm(s{qT_g<@+Pm}Y%QNz!^1c;K6%YkK?I zg`O;4Iz76{%@X`q4rM7zNNm{CAoWIM>N_*mqyR@%J)Q}BT)iQD~=y~o1Ohex?m%#ONz|G3Z}xG71!AdS#KYI(5^1eTKMFV zl5J`x23&li`2F>DC%bFMjkYk!aeq=uTDs=%bNP}l z9>+lYohMjNj0!k#sAG~+q*ju0(J{aJoOfodH>UhkV(Gl&oZ=!ZHo^GY+m6ULtiOYp zh0NB?<684*%J0}b#t%0(3i=d!{0g->prNtvs=^`jWsBqtw2SsXD3N&d$mPGxD)oSv zUW?Qc{?pyD-K)h97|po)|C4qZI5Dqpx1YfEcZbmAtuBhJwm~^LI)2G>&iv{-7xLkN z>w51eLdE;z7yiEpDn1xb{{2|K{s%b})x`I{1!e8Dzyv${?o&4*5UQ5q)3IAodvo0+0KVPvY!-?@cbJE7D_wn*~ z=7tq+XLa1u-`CAJ@%)kH{L#4g3jStQoi9hndo^j&&h1tHF{=Z;(aX-?4|5+XQ z^6U$rLDhJN!pXlszs=TN5cl8DY|{Kwaemn^XFF_B`l7sG#Saak%Ct1KERm0rq8s-_ z_!O>kiCmh_KU?Vdd%f@CA|fZ2-mh@Z;qv|E(ybo=XccaaA4$qAmtFE)ZH!Y@TZwMYs=ajmbQA!|L!{T@rFLvjRnEN z6%lgQy8E-2x95Ng7X1e-2``o#OrAEaEm-P;=FGSE*IzjM>NvNO`kB9Vt$FUVR|Pq+ zsC-urT``QLrXFYU2%v%YkS`R}{2@<#z5*N!;_QeAUE5ph89(Zk0Z zHfnx-w@-NapWbZgLZ%LGiLaWPGHhvIcgknK^cVdo(z%+Ok-KB=qYrateR%$DgH3UL zfzW#2<@;F!B^=z_-*G%QvvR0iF7oZd*`%Hg{iU3qA*`;vdRjY(p2 zk=yiJt`Y2o5;yv~9{8=UxWUBdEHm{--1=Kha(%+S70*6u2<#3FQ)ifGl_Qg#C@FH~ z8jFrj)X}t$a}vZ>Cy4EK)}AK*pRK7d#HR7*&!0D%eneMC$hkKiJ`i%dS2k^~+@^!+ zn#K0>>i>u`s5h@s;!=K5^FivkWM5o(iHq7o-h`!TXJ#mRrzCZl&oYpykVaTP0$ zL^ej6Sgw7P$8GT=-R(Rze{*AkzG#0r1uX&|k&2YTAT{E30@zb64PW%7)D03OV znE2@N6+vR4nHd&cjRj)8%JX=%$&{C&jcE~24!<}b%z z(3!p6ixw?9vUYyQ8Rq9U=W6Es-?(w(uYR32bI7(EgYUwunwy{2K{km9{__1Q>#oGQ z{@0Ej79X_?PFm|j`t*tK)VYF|o%+l1SLxjY#m9}Oqm({xyqRb@BhO!#rXSlxA4oae>DGyX?S1J2HNX?zscW5A*%@!+ z^Ti(2R~E9IIBEWTeYQE`HjK5;M#W1*YKFB_+4B~%+1|>@#lwg7k7XL;)VW; zv~e@AC`U@iLAH7wzT+>lb*A=C8}s z*1~t^LHilz>(?mhKYjYNGaNKY1KRJxTMG##&S`h#Wo7SPUswMAo^90^fmEf<7w7+% zxO>>>`{S>D_t-97zMLv5Sh;Y+27y|pIBN;R!_Un1AZ~Bwa{(op8#!iwPPV?iy^ z`u_R6z5Vw)#YJr=QV#w8<9_Wrd>!v1uT3{|R<2z6Xz7$`)6}w^#UN?tLOv+vSv;#V z+H7F=|EjpK6u-B@5aeeKtnu zZ0hP*wS2(>hdZ3+W@ct3_QEG1$>CYuA_bwk=ljp5375;eJ0!kP|Frheqeq~$_3IR9 zs7|pJvc(BBx2SUFTz$*GBS%~Wy$(J5rtIR#x_;A>Cn`0d!rr&F)T6#LG%tIgZ{H4J>maJ~fC19H#z|5%zh(f-iO zcGu3Pn83imoE)9FsvQgt6DDmvcyf5m~?82X7aI~m)F_wR3SwP$Ny znDLvpInQzSs-Odg-zU#({qnQF@AmzL@uw%J3T@gy>1*hN9hxhO{8HcPx9_y)04*<< z|JK#t&;P9dw&djB_CFplKdC!X>+)aKdz#M-gTyN<0&Adm?bbHIL;vn)P=8>;M9^$T z%^A5XUjy%V?|G|OZ)H05_O9=s<(Jcs_1+e)42p=*uqzRlm5mJuP{?lX@h`Hk@>_E3 zt`%q-?>yUT7s*!N*=CC0?LVDR1}zEs_V#x8+Njd!bIZTIxf#69zY%mO`NVHCe|I)H zbKH+hGmQ0dUw5CHv89?mzTF@hwt1c zey{5FTF|`giHXWZ^J+kMH-S^J$oc*@TCcv`_I3(*qwi8oom6*D@#0uZ5nN>zunoM zKYxuX_!2F@WOyPgdS0KFwrrZ3k`ic-%2fM|nU`FRbW{81EVT^YpA+e!cRY0Rs^S|9 zY@c*VKCjxkA#8*Bw0AcXJ#*d6ZkR8VlGzdI8trUb7Wy{t_qVFQ=dP?u3VR#5y-z!8 zb5z*&MZ4eLe*M%aYHOaqh{%M7qxPpj+sIesZFvg0(blr~na@0%%0E9o8mFI&*`9az z!a`@zxO~5H0RaNCvc1=R zp}X;TO(3__g3d>|yxf2P+ikZC7(d)d?&p;>N_ljoGpX$4B-NKMU#{5s_uK8&W%l#6 z*X?jBv23#cpL=-;C?5((!1LjSpYtb8YVuPy0&gY^``It1J-0a}^2(O&R)XBsC+6$T zx*|6Bw%7C6e80DG;x%{WCjC|}`mb@NaAni))~#)u-dev~duQKPF6+A!wf%Na=-zR2 z-{obe-*z^+6c%p$q4;*i3JvABopB#L-}!rZIJ|Q|HQyu?bfHP_9s8Uc8=~{~hMv)j z+LCc?P2`H1HkC$PH*eltxpL)V_x^pKPH8{=B{$cia8c^%X^%=3uB;A!KRv!~;#trR znYM$VyJj^X%=mrsjMJk(+i&J*eTmi)i+mmbP2klGzpbk_3B1wTS#@Uq)7e|3HcEnn z+rjfVm-A9&4v(pO^oZ4>idqX#?8xBtE-C9{25?y{W7yZ7$o+<#ed$KH#}Vo%-V z$&^XPd1JT^$w?p2HrTQ~dqi-6DA__dc1-J3BU39Gmj>_4V$s zx@X7LK@qb#92POG|9|#hm@s2T$2%o0tyQ2c;!+3ZxqQ8ONwa6ynVC)Ya`Yj^cpyy5uzZBdx!tCH0_tyOXb#ji?j?`PT&b?8Xvt`l$b9&T#BXz|W>cJa@g z3~fs@i=2D^Hk6!iSpD|(w%qvZZqblfVZck%`a4xo~# z?Cq_a>%6Cf4%TtJzpplb$3wQ5O9xI&RF*c&vB9H#v+-_dxYK?PbbIrbOyzlcOP$;KB7ST-t+)HfqwYe6;AK9QpU;{<*?B)}E1TLEZ=*o1T^TR0gxp%R>h#ip>KRuH`Ht)= zYgdciduN#)*X{4mXViOlx}KV}Njp!Dwd1bUnwLe1e-BQ%Jv)lIbk}i4KIv_jbMMyG z&*LiEU)S1cEjxYDgOrUCNBG|!J$h7BT>Ny@;ZViz$`?R6-QK?b;h|Q3`#&F^ot>S( z@8`32xhf9OO~w%$la6jaZ`Zw`{=Dt?j+?%-&2(dTfmUEer2YK#G z|NpY` zyW%s?MzR%@Bq7(;o8PN=d}n8|p>^G#AE0}^mn>Nj^zQJ*^p#FCXU;5QU8MrL z>A>YGs4>>|bY6VjPgN@`sr8paSBKgD`|(&ieBF`P`#mSC{r>)by0?I&UPkf$Usei1 zOwRU!Hx7KQ2@0Ad7WKE*JkEU8wBLev!q>;u-p<{w_&Qm}{hfQk`Zs@TCj5SWetv&s z4F8?-`?coxYc}t`!ymh=MDYA1>*w?9|IM%er-^(CDr0)eJNKr8t7T;w~b><5}CA~+LcV;+Ln8}twLd*(saE&9}a;I%3tR&^*HF*opqpw`NfktM~39Kp=XV%5;E_;1#t!?!; z(A~+euCCr#s{=aeeX)E0RPFGjvd71Iv#+h$`F7iFHh#G|vuE$lysUNwbYhA5-I8D@ zr$e91tjpejj>Ru9EVx^G9dxEcMbsV3|9?IgZfsc>EvFsI2|7mQQdV#%m&M_t^ZROl zCnYDV`^~XPJv9XsQl-{)e=7Ff_iq%<*(rZ`?T=^iNl8lke>sWV`%oqRe^a~n-=-#} z$k*xjp45HyRM{(KnssH<>d4K@Rus;1bv%>gDZt%v?XsV>@0E_ozft!Nm>zcKw{1Dy z6CPLjwBP>U1b5G?po1*t8~_Jo_|E6c=hyuL-K2cs=ab3)pu?8}|AE%iiO1J$jNF{& zJx%9e>HlrHx5L)Q?M*n?WR`o&02I)n@3u$iJo>wT$`p~dIwj)`QEO{|e>=KbZvEdq zdu$?K``>%=&#{^9;e;lZq9z+1(7K(&4`i-^68gSVww|7z;&By;F)=aie6j|)*Vo;> znLZzMmcC*2&byK6b4%}*UhkE)HnX(+xombGXqouqW4-*cRx0L!6ZQB1`E)CL{oil5 z^Pk!TZe{g#@@2d1p?ZJbCtP?boZ}g72Q6nfdvIa=*>D8_DPGe!sc4Hd^q@(dYlS z<=@|zb#;~3-uv~SgL&W9#b|-d-D%|ES~3*V#71{(W(3Q3>zo+8ko12^4d8MaKnq-uEYRXdY>0#eK|J_lvp`1y|rCxbIt81c; zM3Mcm>cXVYaaRtW`OM#7`TxMQa;;lxGrb)h8-MuKLt8XoP4kQX?g0j*vXbN!u^B0lI66_sPVwX}{m?e*f?D{QrBt-O8?*%MB{h)#uj~eR|@#b3!Mp&G*Np ziheIaE6!Y}Cj7q`<-Ewa*k01%Z-IMANC;>l+gHu}qW{hOb{fBy9(Z+s|9%^VPo^r2 z&+3vN_`p&M=x$=8RIjQkt4V)*B#q5-Z<$=tZ+c-l={v(fyqL|3910+x_-&*Nxipz*b3d z!%ll$UEcJfloS=``pSE$NzdxI%*|%&T3SZ(6#x72V7~dz|4*mKi?IthfHH~s{TgNd zj+$Ojt90hpm0GMZSBpSHg7YdKb@ob|E8XXw9#^GVWW)4#k!$y+&6`1&Gc+=@cgg=a zaq3jnmy7PBS!q(vX@+C_i@Hbunowh0Zk|kO#?VY-E z;vJFN(x9M8`S0I7^?i4LfBpZ;=X2Hh4oGj@xbYF&5xXPh&VNAt8w;50{iC98Sw5fB ztRt6yeX)Cg+Sys9@9z9;lg^W{ttu%hGFrCc<@NRQSq9oJ?(Y0@HWI#z-FlsD^?0Pr zaym+dg@iT;`b2Nbxw)^ldMCfTa~sdba@N#YCYeS#H#UHd6cgv45m$b%+tU zHFs;}`w>E~ps^8*-nn%o4P^sXDV zWrDx2WiuPERpFzSn2_f`K0f|2``yjW?&sP~9~av@?cd=p=k^7(vtQco4dZr`n@VSI zb)TF1Yt5RXbz$qf_oU8@P!8HU=c4)4X|_4165rqI$ZW@HO;xPq4>OQ`H>Dm+o~@ULa!Q^ya=cicw!DJ z88z2}O2$=x>i$1C*ev+HFwidXP|NRkyZM7%{_lRbi@VkO-Hyi_kIU_T*e0E~=i@QY z$!dv-F`Rd*-|zMG^xS^0>h;_0_vcNWT6#NoJLu?}9~)wB@hyyxNixm8#v`7;$*e|l z&hNG00kU~<`|qt+o)F^}5u36t`17qxsl0vNmg|>1R+3a+7oOVK`XM>Y~8;Sbc1B|=R990r$fhjr6)Rm ze{*wl=H+E}wZBfZb#&}1eGOV0t=p!lTx@?Vzi>HUOP&0`)wKnMGyCRhU)}S2LtLF| zZsgocGh%kl`0Z=CHX}X1_+Imhjm3h8WT%xC8uYO*h`;le@rC%OE!m5{d?_icTe56f z*yqRp?mhnp@>}3yx1{|~UESQa<=@{|_xD%PJ@HACC-=+S>y`WeI|3^EZ-C1Fby+*v zYcG6wczAxrqfSuEmQzkp_-Ea{od}}+uI5sAM2I32bH*cp3keka4{t< ztxv|X=+%{#5#@Jxl}1Q}b1Zi6cLPUw@=;J{_?`3f1C7kLx998szZz$I9u)Zp)`?FT6_ij6h zRpws0tFE2}M1Z{tc-7V&OcX#>u z6DJPnRB`zTeyRTYYHQkAsVzx{Yg)Tors+oKfog(lYj0dUHC0~IhOF52mZ2Y!JEbZ&m zr6;c$YFjT$XlHn{=jx_qm!{g}oJvfUJ^uG)X0}E9`%Oz@<$Lyq{Xd{(#}MxRAnUq| zQ)1%67oLk2FXjfFova$F^_`jRwU};H&CjRPi|$=KIays;XiM;Zs}Bp}Dju@#bTwiD zwOre>K`mGP;{NIJt4)2pytvj07Zn#5zWev_xcny#-^cCpbs6{e?5xq_`S|ns{L{7V z;><<%ZCM{9bz-!Bf2*rGcuKCdbyL9V)jHi zGo>!KH=`)Vqr723eB=fFx33ZcmcQdmSzmtQogV*!lG&nfXL)Rdv^Xn;Bqe7~pRS&* zy?E13c`^Ms(6-O=|KEP!Ex+G6Uvgd3Wk2iOTU#>gLHCM@Nw$J2Z_sWW);ZI6rawC~ z^P6~Pz>4_&|0XKCKbbi5{KLcT?Yz=z^SPbR%(XU;*`M+B{hfHw0@nTK^AGvDJZqWf zayP|TSJ(Gi)mpBd^7HEdRhFc_y}iBu<0wNpaI8kCH~vnRO8G%+i1CInzlcmO#akqa0GObUff*9*!sN-yyQc4}{T=q|a&zeEzaM_T-+#a6^VzLgS9ksSbb90W_`092W;a0RO**&p zZRM8|&A7Sg>D}`Cd#k_a?NnoB0@-{HYV-Luk(=M>-#B3X`_1O>@9t{zpPo|p`|Wnn zy#&h-pU=9sM)IEg?l1B0!s8FEJ|tb_;v%Z0p&=l@p>yS#+Q!v$ezUe5T^YPQX@B~> zO3=Ln`Mck4bC<9E^7VTB|5vNm@B9Dn_wV=n|9`pczrA0M@72}S*LM~_w|>9p^Zoz- zw$J>()2_ncyENPL{h%S`&qm*MqPCp)_lS2-yL?@Q+~iJK`?@wk)+w<D4t0jj-!GS= zx;VGoxDoMhQTvC#-|w4eTyU_{ue-d&Q+Rp(8D8UmC;rZyIrGs??%(nD3X2*x-^@9A z^5mlPg+JYzFE4MXne=<^9Gl8d2O62{Z^&AeaBSYx*d$uKKk>t%E1>>P+_QO)9zDA3 zXMOhGMwUyv-|y4r@A&sK{l|xgpDI6|o0&eZ)4LUP19eM-+zUn3ey-NvqukDSAd!e zd(PYT+kE2ayD2RmU-MCS`<+jpPU{~(e*E;REN?HbNyi*EDKA%4= zD)aaI{{L@pY+M|3Zt>60&rg>g>fI& zMj10Wv8H|c@ueX`o&D^7s+-(6Xu82;I5bK2P_vlgzOwNrj!{2dp4 zH8r=I1=Bh-HgIuq9qDhk5X|>608hiR>4UCIWemT0=kwk2`*TaLMXp@Aa{c~)zl_h@ zOwRxQ>9l_RkB9A#+WJAaD(r3l*tjxy`KPjkLygSrX=i2>p4Q#|z-a~O-c!z^^=W5k zz2EzNUd&FV{r~?}KR(v`bXJ_j|39Cf&RV$MYG?di%jnwfz7CBI7sPk|c3JmhmJDQ~ z^24RepqvqU!q(#tue4c+yqJ#vovTZ%HvC;1z5UeLi}wFPRnXR~tCP<6iRKvs-4I6Ie%*$UM7!-5}GRe3H zbfGM`lXhBvKWOTq@bR&oe+14=RCX5<5_&V&ClqwP?!&*)fuR8*Ay1y>nzt@=Za-zZ zH+ZG@Rw>i06IY$$ub!(f^v4vx%I@5_}s&bX85w!<ti_?By_0-hU z6N|j;4O$Ui^rRzZr;@tgoE2~Mbx)W&$ETjJ|9aYDN6@5D7ng+$k3Hhz;yV5@sX2k} zcsj~Z^6TYt{fG?;)&kS?TA@N48x))C)(wzGJb!1D_`^B;P(4YP`%X3>T!?pu9BBV$;W!? z|Np*!Pd()FueaOp@A>nQWntLbDA3hTF*}vwYd*66lPU6j4|3+xbM-BCh0}XLQ-`iD zB0)|ci|x+a{a*9W_Q>aR*8XNJhqTx4X-al@2fA1yB@`TGQ0M)l{o>-{t2^%oEWKu1 z^TS}>nk{_iv(4|8Ope*91iF?;w!eU3$D-U1Qly|1R`26qB`Lkz5&pW$;&aqVD zGF6=ZJM=~Vg$0d23_%yyeFu%yom~g&M!42(PB|$g!(0Tq`Bi829gb(e_kb=vPVWZS zUy1L^iyj^6bZ+O9wW-+fXZe3;DXS@hDm{`JEt#ndjVS*wlWff8*Br|NrjYd3%eY^wpJv4xpC6sb+39 zP``5K0#HTqXZr8MJo8rQMsMShwfeHCTW{0;MW)5i&rLl$bxXy^q@A4|9m{-YCvBc> zmU~FFHK*+9{{MgVf4yF_W{q_Io{e>Xe-)+npR;cNnJv}@hZ6IeAF1jG%v{QcWX0E@W9o>P-_p-~U|MvFs()!vMk$h!c ztTjjdskxwrAUmjRmnp6X9dP~jcHZu_o|DzSP2bRLmU~OaqQF5fT=MVl@6%^r$h@)P zVGF15hb)`YS5son_1@iGUR}BTij-;AnOUZ3-R0t&=huF_ z8J)j(>*O6DZ#^+RP0fj+R$;3}vk(6J``d7L`TKjH zX1A8#t6ctPt}W;STjwO$y|heyJMW*Y|Mz)*;^DT3>mTo3y>8d3r|-q4mp?fnc+s$O zef|G`psUbg?q38IFuO`$pL+UdnPW5Cy!{mdmtyAq2d}`Yc*F76@yAXdrA1oYpYE*Z z|NHc~UH-lI@2{<$J>%`g#q4RZhjy5ypOg8z?G|X~%wjj*E4%-&{{daCv8FYf`Apuu zJ&|Xoh3_uQeF8ena-&j@q%qsq*j*(PKO=6PW|b-4U-ak4N6_d?ZSS{FYnN!R-}CA9 z`u)?Siyr@ezkmH3(bk548HZXpL1PVf0yInXrtW=TclAN$#N9mBPtSuE)6^Z+QBzZ! z@&1sTO9<=1IlnJTcc1^Vo9A!9$~*B7eLtxA&Qh6n#6cmCaZB1+sldhGU#(u>_4Mfe zzj-$|xt`f|c|+o1`T9SBYfeM2&j35=(UHzZX7;T0x3qRXXyU%0y7NuXx3{;qXI)(d zy20L6`~9MBy68^GHg4Pqszd9V%)T$y z{`SFdf56H+^+!d+6U-D9AFkbguWGZ%sq^;#_v|t}R{#HZyiRAM!=3Y1>gw)mRzIKe zdwbs9E+e-17={(Pi$DB&z5e`6d@zrWWM+xbcv=lpYpHI z;E@M@v5WHJ42vdpXv|?re-|$QKJ&_oi6 zfnwU~3BM=4-zd1T;ogeC#TU93y3}-ZAh}6hSk33ae6&9E+ zP-?rxt1CbIFUSiEH@8d5%b&mC@A6QKqxgUI`@QOR_n0TE``5i(I(=SQ@|_)p5zB&h z+G}cho_Qr}RidG##kH1OOy|IwQ-5DyUoX!6;_a=i+`bQ{{Eq$i?AhAw_qwiyt&KAL zKDhx_epnxzy7yH>(-F{Q>A|U5T3SXwzH?lCu5h@=;y*Vx_fd%nGiHF!N|hE2yuo?s z&iha7xi%Kh=M?Wb|M$iZ^FF(uPlUg&f11DdtJt)Vo%Q$jR2C`9eszsoe&_$M*XvKK zzS;Nd)#|O;*Si)<7T&MpIP>?&9r-Wc-rv8!Db@Q=X%mZ{6R7s9ELh4XXJb+Kr($Qz z|AqJ0+&Vv*)qc+ZZgG9Fh4z+~GZ)V9I20}L?BBlH-(4Gzd4GL<{kz@w>nj4855LG< z`sMv=UP&VtaMDl#okaDkm2vZ{`PaVgly}Mgc~nVRdH;_`+#6G$)g9sl*F7_SpBA3$ zI>ABZ?&kD<8>6|(?tL-!f4>$f#%J8wQMf*C?<~`7wddZYZ*B;xcizdq0UFDmYgPKe z0Cc3ds9@j^u3LBZ7d`bl@|3Ig-_Pf+uC99Z*Ds~MD_@y*b{1%c_h2*o(Mek0tDjBz z9h-G~o37H<8#=ISXc>>+iH{2kn)K}xFW>XI<@d_(*Q)oQnRqr$SibB^cX#(}!(_L# zv}Z>;g^#jd)4sCEwfney{h#gk>#WP(+<3qL|GfG0@9!*5zj$S#b35qTvv>M3ys}mz z{KmGnvFC&ZTemJa`&WPOmq~NhYfay|KlykcX!uz|9kg=d_qVsZ%ioKg=HPI8RBQ*D z`K?Pl@aE0U%@hzyACE zKKa{8_4!9~{{H&9|K~I5-<#$ce6Q{YH9Qz04UhiGCnu{v_7@I0XaB!u`ghK6_d>&C zRkuG~QT_cLsAa>AFxS0bPIsfQ{FLoCbN2uFbb9^%f3H4u@9~@QdoOre9CRBEQ{PT^ z&{gAKpLzd1w))xI&+NQXD&|i#?Ckda(Qlf`1#{xnhf{uAm%eJbd2erZcO-w^pO5aj zE#U~6;p@H4yiT%9M3$V$~yAlKY`SDUggb(gDjk;`~`cBV1= zU%z%f*<0K5<;BH8vq;(NcB)xgR-T@wTg18f(NBMuWkOGO{-2${Z)WcIzu)h7hrRE- zBQGznp9Y#A`}z6#?%#Z~?=>>Bi|NI5wA%mq;2gO$I3}h?P2m5Be?OnkU%V&bAXC1b zYW3q@^G6e4_t!6NNPZ_M@ayPn;|y0fx4au09Od#zJyxc7zv}y& zKI?Y}%FfyS&WW-4BamVL??*CdHdgZtBQx6xXC5g~yBJb79kTxZ=j-+ON849hmA(0K zBe{R-|FSpg^J|RK&&^@ul}eZyaB)}Z>!aP`^?yDdZ|9d6>wolq|NpxGf4__CL|j-G zYpoNozwYmce;ak>lisN-1#^A^-A3cdlN-?beqLh47XC@IPB^R%Uq8=gN=L_^KQ)yd zNX?9xis$osdU$?!`(@qQ^73kU{NMj??^fo7gx)_;=s0bYNLFNYWYEHkN_wVUPF#Dm zx@R>sG!!0YUF&vWL54v|E)*;^pzbwp?Bryc|>w3ak5_Idy7NU8}v^ z$!xE*v}Jo@y7txnHp{%^Qm>?9Z5?gTxnF?t7TbP~Y1qAd#flZl$NLs~pSSq*e&+lA|KschIr`tRCrn8w-+yCs z`uSC%tK+(RQ%_GzO;104(=78+%DX!|y{GG4oxkGjsj1rBTwGr=fAZXYFLhHlYfJh( z?tkcXxJfwmEqW)NAG9=KgxQ(cncLgWJc-@6)GE%e%X)boTiZnw^_A8Cf1?`+HaK z{-WQp%DY{Aznv*|d^-#nP)KRYus zdG4j_@%6gt9^V%`rfgqvabBg~guBLde=16QcfD)k)~opOu>I-L*Pzz<+wJ$ey1G7n z{%rsAiE!oIz3+CtuKMy~VgB<)pm8pH%@w?$IQ)3&@4rg#UB0u;BA2^-Un~eUwBl~@ ziwg^F>7JtvJU2M&5SO?~5GJVA=C7a(~_4T@H6A&6~Hc>TA~D8-g0Tx^qpl!@9+Ezx+)G zjXV6>7|0BA598~9Q?+$3L=jYr1-~0XEW%(^HxR1?VKb*T=rr zJqJzMUDMs3e_v02-_K{WueI0y`m*wS?E4pW7K)Ih#rS%j?`$*E{ChF63k;{tox4{4 zQe*7yvYnq}|9^db{dN11lb{gg^!X0DQhL|ZMXudnf+Vh9y?W_;(P_tKwwFsEAAf#! zcKY4gCnqLWY4Yrn_dAgn2+DH@c7e_-J>1Tpe|y{7U2e&4ad}$W+FzZmHm9DR*3!aK zdne=d?d|z~e&;~_ps1)-^8D(He=|y`O5C+iJtguwZL*s0CGUrx>!Z!%_Ec<)`K0ryuS8! z>GU|Ok{1)|cv>94GaGm@?D{`7JZ@uN@lnz6knr%=S3juv&(kpn4S@gq`}=EOuA|-8^Tu&yVFlk(`9Do3lYx_(T&*=VDB&`BqSuJ=Ht;{FD@25of`h{ z-|zRoUOOU#^mF#mI{lAi!Wcc>{NR6 zmW+*+pVRhM86m9Nu>1LggUyHA`NOYgPnlEu?dB(?Mg4NNr>E;*=YJ5fzwYmo{ZaDb zUl)SHY~5~9tLXiem6L0>g{}^}mjB|Kcih9Z%x%@jb5~ZrzRt9}^!2v%^KyHum=G2` z*zK!aIc4H6vAZhyHLo^WSgu&u1D4E*VP|JvGU z_aD4%Zae;dyZ!aBg+cBulUfUxHc;XF<1OfPxqH8^Jnpw&H~rP-`u}yWSO0%X`*f_npVz#c$1;x^>3PnU!B&1n!k;bZlljx%bzXm%=A+|C=&x zT3Sj<1pk(@w^4h&z8{u^)D6ZX3U$nPA`W2Sg-VQesN}2R#v`xiOg?rZvKks zkN_1ih1dUDm%YijyKC#3k~cR#Zogl*SxkB2{Q332UM@c^JHO_W=iZR{^XvcZto{A1 zNL(^CPxsQ_0w+k>>|z^6|b{(9NNTN*^qnop-6dyYbPZM|pR5y>!o-5*}Y0D$gwl z&Q1Gv#XJ39v-#X4{>hUjsf0S4_fL7U?@r*Q{f>?EX3x&9<=0bIcHZZ3g6l57I;7M+ zH{spNRjYPAndE(?^|eED-I@&x%iiC+yEQxfuSf5ul9xfXIxaon$b0qAUB33puMOAA z@2__*EiIjISNo)|nVtWdx8UwyuU4;R-&%KJK0K!$|NdLqyyQhd?GA|>JBycp6+6`X z?TqpH7s-lA;3O9QefpFs5%t$Mxps@?@BJF~;+fz?x9xqPLC(D*Gq1;0uZ`TCR&>0P znSI){X{S)!YgzEXVSU`*E3K~&{Cqw?J~DD;zeKLIdEOQN%Ms>x3YzW2ltA^F*PXvL z^?`wb)AeFgR23ByUte2$Eotu>^N-oLx4oTT|8M1Vr4LW1$46ZR&5_pr{ubF?Vn1iX z-9>KI&n%sHJ^y^(zWiUE-CXN(Jsq7Z?mgSY<7)!#eUeXVC$Fu~7ARc+%8BoG#h(Z- zcx_%%{q4=p`u}x%rS45sb`J^)dh(68%Dm71-;cw;GNV_v?%895nq)wO?WI?(zP;Q1 z{*|)Z?GqD~zb0FNwimoStY`!dpycn}s@~HgUN^JzuUob1((1%DaeHs=Dtw~tc6XmAqIWf4K3*y(<|<9+5@UHx_CZu$MS(+^2lm#w*@qpJG!#6;z)m3G_j6m^$=kTgzvvGo51 zcuHitZ=0H$Iz6^*=B|{*j{p89>|dTQa+15Zj^X&P@9*nBJaDXyxzY|!EpO`#Ykm~G z-pnnocg5TE&HerNtCY{3oUHzO=`WkFSAwr4y7x*go$lxG{V*paA90s`pE7-Vzr1~1 z?D~twg^yfnzi6C1f8O8A>ymqao1$~un_FAG;=?)^)aEGd6~?;5XJ&W#1( z{@W@(CcS10TXy~Qzl96-)&8C~b?VEj!bmQ^V|%~u_u8*nLa}FOnMQBVn_I_oeATK| zZM@RU_+@QvtH0Ge?lqVC^8L(N7f_uMQ@;Pl!*=;K`OnqW)x||bUR)LCk+BG{tA4lh zd02S(>!ly+{(L-s z70;hMdC`2#VSnAp>1w~80p^v$KO z!(RVqEIH^Z9=oOZx!>Odyz2TUzZ^EE@13_uZI^sQVAI9FkDkrW-)haDz zW#=$9ez}~rS3nmkZhtp#?%cK04=sS#5v*&fPn|x!cK^$_ea7c)HVeLg0jkFQXBxT6 zD}A#neRXAleME)`$ZV#|f7SOr{&!k`zmE3nYil>#)qK4gzV>#@=Qo?rM{Soe$q3k6 z&)WbmYsB}w+j#%cby?8r%(>%&D7OlT><%-9@U;2o!sJOd1@i1Fy5`rrU#t(^Lbb?fvrG%B7>4d1kB(-+y8FNe7GUwn3eShVtY>zCJ{aawzh zzw;Rc|9w0KT9o?uSnsc9tBdgb)O6kU>C>mSRbK+GuMj_H_xsI6Wp~g?{omf)EPi%o zre*Q77EWO{ez`mQYO8Cx%eQ7;eztsm-6enCEN~W1xceTdf>+p`{^&^OE2*QI%Xww3 zLXaEVKl?)C;^vilq4Wo`udfTeuHk2$`|{G#U!IP+;2LoHyZL6hw-&i}$9y&JicB_Tl*=`%Q}+|Xj6Gdbx~2#6Hl{iZ@1rHH=m=$ z9n^=(-~E5GzuiUo-?wL(W}>P*cXk$gd3i-e&FYzJ zReEWDhqJ78na%S##YV=))!*Og7VrHvzg@1%1J+gD_x9h8$@Ay0|IhqL0MwP#0(T|L zzROsZXxQ4u&U>|F$r8}o>Cflw?{CkK_w@A4%v{-X^ytx@J9j1@?+Xntm;+kG)50kX zx}yC5;n0wfKfmAackh?``?%j8w3af`-@{|V?UI+5T*JNuH&}tP`lG||i1~RH$NOYA-z#RAnD8Ie`Q&%}zT54WZ|}D=#U=f3ugBN>dV6!5ZhN1Sn(8X_ zH$&r_J;UM)e+5eRXRAB}^_ktj&+(Yo6_EDZJ1ObWx3{;yYAUU|@t>i`>AUlVzw0J; z1uwS!EOWQGYofAyTheWJHQ!lF{P`{(`^TOjvP-_{U3qWF98f>^#k}B}4+q(OXPfbU z-KMXiqLOoao9}#?MZJId4``Iwv)p|z#c2uZXEv5(W;UJ`t5#i7 zZ_h|ZxZcSR?0SFS$jHcrPrkKQzuW0PUo5Es(9zeLN1?s9< zZT#|bUU~5qFBZ0c$y8)R^4bKL*OHI-&8>d76J*uJ#qO_-oq0C=XOw7t*S_F)tg_;A zP`hN;a}n#ZHy%DdJgVFEOI}_|JwMO(*As!&{D_4<8P2b)+y z2N>(`{}U7t@ZqfaeVyoSZ;nal=UiUayD#u?Y|Y1`|NngMw{vw7{Vm@R_@a(u*L~BV zLQpDST%8jd8oK>nRrZQ4(#Z!J7^Tf}E*xK#`1{*izkfm>dL)f2#Q#Sir4%7ZSog18 zwCK^l-|zG9?WtU`MLO-&6wTDs)L#yXA>rYtKYo>!dhu@ed%LnXGwcKwwIkxe(*hc$ zKVGd~zi#ihTLC%lullUtT`2E6u=o4D)$he-{`>oTecaxt`;y3M1{OO}pi49kxAAhf zmfIQ`8}rNAtavZhc4|RlR(@e*d}cKa;xN$D zjy^;5#S98= zgOl~=#$WBQH8+?fUS9UMU;3Mo!9nN8y5HJbS|yB(Zdy7zSHzha7#zO*SofQefq}tA z_AWmI0|SfvClBSEMj7Z2jly;uum9_vS8pg~-vvY#$hy z7IH8y{jSEy;>^FWJHf%r!E1up%7q@{P8St)zg##xU#zP^Nk~*R$u)38;+htIZZ58- zj28=k@2xhD{H9laT(x|A__x2dc8}k@dH3etM)S}2o_ZaqcL9MX?`Qn(?C9v|_%naf zZ((8KWH9H1{L$mbPv4Oj5Ky=clI%FKU*YZjvwt-pvi}Xf3kwPg3jVZzR;L64|Bv7C z2b=aEW}1AlJxImG|H<#vK`K7gpZNCr+Co4zjDJhrPHyBt*oj zzq@<#X&09#+(-5t0BK6LnfE(6Ir*uPpx{p?Lw%5of6mBx{?ECc@2$bcUF#dRU zrEM=>WbCwJzO+9=R8mrNwuzII(~&48rB7)R8>a@X6%?H4exYmf1m-ndF+ZA$xf{jOK%#hf*Mo>nkCsgeH6USfMzn*3Q2T?aHs5X7E zlee)wut@6NR+kIm^Mw-bFIb?kWr2)!*_x~8-xz%t7W}CM3qqZzbsGzdiZ;bu6Hv6X zvWn9C|NZ{U%gZ-vT(WOzZ(qK2>B&+xP*m^ZaNZuY%2Y||6X(r}z4o8Ozc*Ak@Bg-V z?rkRGe-+$F4T2X7lrf&h06aEw^gF_5P>y z9TbXs!h#d^4_sI~C9AiiqsD1kk$uwMjEnn@+S}U3*4zvKU31{k?3$q9;Ej#}0TW`( zI(vIvlPfBA#HcAL#WyUB*1ReuDEPBQ=V@I)eedef)nSH)hJk^Bi`pMNNcie)bNSMx z3r%G?4F&dPZ*ELd^Evf{%7X_x#xh41cIR{9DEPP|?7<6(Qz4b^0CZ|}+1 zS#}B+@1Obq@B8}tNe>g{e!W_~{)wrhi%Z_&%;^d5@9q8nz5c)Ydd?#CXLZIB4Jo}m zJPYUVoZsQWKBtV+?#~D3XLYp(-)BE$Z~>*(CH#K7SG|=kpHp@+kG# z$s(Ucixx#~%~I7DS5hkCTOPYfUrC9{c>SK36IW;awoh55Y+cbRAh=V2J#>@4q2a`x z_iJbTwq%%SyT_@cBc`KS>*n!0@59dgm1#I37pLgrqIbk`>YLmPAV3Z0D1mblQ)DkFT$pQ zA2Hp*B4B@QRn^eYFft0#OOajXcjm+l=j7z%)XDit@5;4f6unkn>p3=K=l#~0*}wM+ zEY|=B&MQ7cL&F(;v0=plG9X)z<>C&a0ZWpE5n6|7|Z#aA8 z;!)cLLDk!CO`R}dLW5o59p`qwnYUU=q8Qjjx?eeJI; zIi|kvW@sBGCW?Bk302o;ye#=nIAp`pvR&@7?FZs!?7PaBE6X}rd6`qljNjlGeO{;X z_`-z%8@@u>TbWV~b}-9}BHF_GY-V z&VJ~yB7yD5k{&l}_rQhbTZQFYt2=kzuPtcRSQ=$4RnG6QBYa}^)25e8%XuUh^@Z-( z;VS!~;rg?>H>$^2r&Q#0Tj+Jjemvl|``67Fo9phoPaG`x^P_NUeTcz}6^nZotPAaw z>32Nh7oIfr*C{KpLcVXs_Pa#8UqrrTSC^NO(Ya;Vv+8Y<_}2?%RSZ2NYWlcLc36U0nE`VM%R8bH!At{o{kYsXcioof`YV?A7IHn;>=3)S{F{pF z_7z8t9!)$T^moaUB`an}zDZine!!qhT`S|F-R2@o8QJX~dIEwIi)*R^TyGsanf&UY zPfMh~N!Rr^N3%aOr5*e5p;(#(ah)rwcWje zr&7=EZH#3wKbUl5(~YBk{0(wWPEG~d7fyWtDIoZhWxr%da#E53^CG3VlbcL=Q_uaK zk$W_r$I02*aN^0Zv(v(?x73SFEt~cwaK^Q*<=i{Pkit-F-dW{$j~zaK{1_pk&)-n7 z-rmWq!+*^xaVxXSYNe}p%8PysxBpt~`hw*`haqdb^KRw!-@B*u_ip6w*pa_l+b}9o zRBEHx)HhG-3d0|ibPK$r6-Z6J^Lf^4z4R(g=izfZ_XWYm1eZ$%q$8(287fs1JoAKdB!E1(=a})cO zm6Zj9KAwr={o8O{Megv4vl+(&ngShsKP2e~vcJ{3u6S)SK&QRJjaOU+YYHx3=SWDNW9H{mofjq1zoFMki&5<8WZpMT2f5W7 ze#?L7e8;Hs$g}mR-nOa(({{YRVlABB9enBDcD*O>KviBqO;y0rnwFPr!d5}n%e+5! zNhE}Ib#@+%Y4a4mEE%?Pqjag^$IL|CcPxevS8a*zij?@QpB8)6Dt(Wy~iVF%J zyz}19?fl=DFJBfG7JiEA?tOb>Z1FyDXT9{ZI%Amz4p9H>%fZa)4Ljq_&-_iZ zU=RfL!d^CC)?+N*pEu+8*#ZV7P?3F!eR(X?v%0(38hhr489N$4jY9c3Wt=m9mma>8 z-^MJ!SZpsi(az$nkiqxYZ9~;Tzjz$B=iT-4_Wtet`2GI>`>MXKit(Ly?2f<768_p{ zcW-ackM`M}etzEGqNiP832?an;>?_bc<}rqt-ISywluo)*)M+LCv7m)~3~+v;yq zR-e2K4)%rTxBNb9et(K)u$#~Bv$M^QZ;9TXclX=d+o!KS$pkl}%@?0%`0{Lae%P9b z!n?alrOos1>?}@qayoQjp|hdH$*XpcZf(u}|L^zvo14?m&$q9Ce2n+zD{!Ct3&`+` z?($RhRu+K_m7UF`0#^>MakZ*H{lN}ocuV9K01F}>O=O{Venf4^Q@>izrM+uI8qo4uxLiR#DwX=Invh}@JiRV&n> z!S3so;LYjhk8PfHdAa{-*&1PR0{Aksj9hJGltx6`WwtaYNs`lgK{rr4qKu`6Em^YH0#O%<2mQ;e*4IrPzPrh=lPlDs;Wz) zwq_+C>zQeidFj$p?{;44YrD(y_uYGMJL7k0bHcJIS!W-_7%|lTdbxc4-fy>7uiv+; z`g`7#33KMmnKDI1EO4e#s@GJl(6BWT8?&yiI&#FN$B~(xFX#5QwRhsn_y7M_-6vz| zqxn})ux9^{N8CH#Z29%|_4)bs|8Hzeezf3T4>$wr%`CJ3|L61d`1)9%9ZfUJTxBP} zKQq%6@+0LPA2b%yO%~y@}lUM#d)4P_@{&`un@1tK{o`D1HuRN`J8K#hsm>PwVgh^M3#T zuEo1AJUra4AG1S2d=8}NIQ_{#t*HiEubz?a?CflKy``mP#pS%kZoOUN`hAw+ zbIYQ)X0^KQ+|Rr%_jcROKSw%+i)O}j?Tk0~Nb*{Fjpy7?#uvZ7zAk-rC31V7?4qBm zLRW9gySpp@zMab5A3rKK?#RBb7h+ZVs-@^~8}Iskzg~5TYPa#r-&+@Jee>wv2OB4< z`^){QW@Tsp|M9r|rmLLn{Bj{mJ9losSH-=$PtLaLe(m>@YSXoXm-&>Gn8>~QX7BlC zL45t+t?vDDFTOqQx1Z+g2QDewy^HGiR(&;?ylC~+)#3T~_WW$-x9jNWm|5E6Ryhrcee*7&@1{+`Cr3Yll;=0=-YF7~_F;JKAK zYWk#ZsjXR8XPM>RYGh_FxZe5s5OOfuBd%RAJ<8M~|GU{3d`MXud#Jd&4IhwC4| zf8W0LSBYVw`2L#h`UX&5EcSf2K6?ARGc%1Ro^$V!XgtWoEKp?s zDyi_^p33ufzjcD_F4dduJOBLLTh0!}x6}E3$-~R*(5m_M|19(G z?b)PR?e&yjLQZDG#>fNHo-sy8u^hR=xk6GUd}j5Fh3y6!`~Q48z5marZVN-}OP4R( z|NHScaIu@Hc9_pQd4Ugyxb;t5J(u`SUFi}i8W+3u8tm*m~V`_8ND==k^TYeWlKGrK|E9F`8`Po@P zLBSQ>t}L}Y&at~nW?B>`<>b6MHC20K>iW378+z~DU*|ntFLSbYke z#>V8|-`~G~a6R+Rp32QhN4tua8J?VJyxhOWy_FxFWD`J1c6u-4i?7$?=NqTJx(=Tc~yE#=m+$`$~hi=4?l&;FMV?B~H$~GE` zP1lR<;;cF`L2;?q)JuN53kwTD?E;&&V_#oiKRs1jJ$)9>3*pu0=2$jI3Vq&mW6~y2 z1-GMWYS3EA7&Ep7Y`jue)9CdZX{VZAwKAz)=eu#oCZRU?^pW*{^K)l>T9c6X zw?Xab)4p?-B`+rIusjEv0J!9Cw(PFEeC?L3tE=W(l^#lApHZ-}LsMe%vKbMJ7cDw9 zUH|^p?C{hsQ{PRt)!&Y6xxGCEw_8*zWW(3?@3*#QpPs44{EMHH zQ!`{mz`Z?{AJ;JNeb^SWyUh2UL*$V=>!oA%f{JTBY32*b{kCG#(!W2Q);~Ybw))zd z$l2!k$2vBroD{l}erCqToSU2O?k-RMQu*)a^P`X2c%>gbdStNU%v@`8JG;8q*Vf)B zIx#`fxt%X|d*0nXS?jophpcms9cW}`=ao|FPvlFUlX+ujd*b1?ld|ugzPPy9viRAQ z-Kht753UMc?w1%d+4p;hPCz9y|D%7)o=wxdf3046mezRzH9MJrs}C1PJpOUr$f5~c ztKOVZHt~nL-yBd4^3m$=v0iC*emR@`do~}pm;0=#{`RKw(@FK^J~NfX4Cm^`>=4ks zA<=z%d%k<>j}H%TWdHs3Re$dnAu~{0a7Ezas;{q9`xDodzrR7?_7UsXZxO=OuMFp-`ll$sq2AR8yZ3vo~joUwEtZH zDy?GPhIN?^Ay*sNH~o}MvUxAG{irIq@j9_LGrY$5e3z*9kt1C@`Z+~DYc^R&1vt)n ze`lw0(%y)e4G9OAcuu}xRP^M;$;s->dd6o;ew`5*kv}ln*?djwh z)o-_6f0B}X{npm(r+iaf&-~qWuyqxvv9xLW@8iAF?Gt(#Svl+e{rRc%J(=OqiKc}t zwMyR?>xn&n^hnKbPRAYlv@ffCYxAFQm_xSco zneHll+;-!-fqqO>o;#XRlYv=YD0r4FVnPZ zd=YW_3jY$9x^$bpKK=g?)3jC=o%PZi-Uy~v>pZ&2R26Z}VuAC`HTz!fck7kX`zgpE z3T||6n*Lkxd-%GTPD^p&)jxV;~2T`G3 zThj_|N;FuNylD8C^!nOb4Z+vf*G7wrif+xgsO0j0W$<#PYx_T)(!RT^^za2`vBHj< zo72nR-V%K%*BqFXq_j=OBtyVWqbCWJ$)=s2uJ5jX-sW?UP1~{Z`?c+LUeon*rP9}A zUtM+ee*J&l@`3~U`~OV(>HX_yY~i~*JK5!H0?Z<>Zb~`O7j`QAONYb$MUET4=9({i z_w&n_a_#;1L+gr{H!Llk!vE=>@1JG=r?qaWtG(jBJSgtp&%H^~w`MNdzp^&>a>LxU z%)cV)!uxBr!`29x9|?sertR+ia*vPo-riSh{Ve9A``3fb?8<+SA3L^)RX95+DCqmU zyXt;(G{lbH&c4`mv+UoWpV8ZL4%XO~ya;%+HS4ODPSUN|O(~r7R1%&|J$}KW=n2QO z*PouAKCO9t)`bfJ)Bp4=O9bVz>8nAxtT=_?*52yxb9f{&w8GX{BphI1`4y=qktAiF zXOnhDV$D&dW3yPf#cV#EP?iYW(DByrh0i=2NnMZs5l5nOZf;ILZ;^e}1NESN7~K z^ZwlM;?<^N_K+0;puW%|?Qlr*M7j9d?EHP1vx-D#n9EnaQ1qGgYD;(J=FH2>E?&GC z(e0Yk5UQxCc;fFXo9+eundQ&U%zU-w_WJn!({!V?Cg&a7a(k)w^r)>_XJ?!H`|K80 z^EnWhb$#93pP%zr*;IbIvOd24=clLZ{?6Xa2nx6BYoXzmb#2YemmlAW7Ckw!vFz=w z>+$t}7x&x!db|Dp6V0@XA0Hq8ILGnZjKr&}LL*B5{rOq_V*4@2hlW@X$Q!#sjfcW1X z0^n>VGqcRP)i$n0e8v0o3K+FPJr{Sj1<%gTo-OwyPSM6D zX5KX6y8nN_A2{G}GnuU?JEHXAp;jSPuM=vkjh_DF|NkedWOdck>HN&ou5d-%^vK(` z>EYkkx905pm4ECO|E9UWy{BqD?bG*512>D5FRyF9pR~Mx!v=%Os3%sS0?Kp^sDP4@ zY|yD&e|z({_xJVvPjjmK%{ejWH>iOSI$bZ;Y1=g4Fv|(Q6R(BOW}0?o!u@-Xcipki zzNT}rGaKCQI6N`a+{Pw`?^oP|Uh{hsmbOzP`5X_`c`1zg{f< zG-ponrza=>{QP{{&-lpfx*ma@_y47LynXU-|GIz0-(KAne_XvEG_m^XRGQwYzel@7 zt;^rdd2wVbICnif0g7yK%XigLhue6cT2Ax^Md|d7&?tR%bMx|-58qeD*XKT+`Zedr z=kxa5A{q+TXE#)QOj@(6=&9FCqtukiq1%f8Kiup-`@LM%$F@Hg-uB+!eke{>W`l)A zLa6feC;wQv#X96-`oI-tpU>`QHr`2(_bspea?$o+DH1@$1R3M|3h5euWYNp_Q*_q%_6ecgYaz)mSps!)ZcioMm} zXSp%>uL@dv>gnm}PdP2$etCJhl}mI|Y`VZsds|!E+dKa+|EylD(!#2<#_aFs-S&w; zp59!%bK3ROdza1pCAQ$r)4JpJy%y52!2Equeg27s_lv!zYJEL#|Nn%rQaET(K`#x| z=6!yGq2%MEqwI1O2Tb_xMEA*9-rAb|{ep8}UBFerokdT7{rPCGL7W*VnAH8rKY zmwfc-(FU%a_y6@zy>b4prSL2^o%Qk?ww&vme^0pg!=>}@pU2#N(trBX^rM?5{$3rr z`q_{5g6Yh#T(LfOcUk|;6L%K(+eNJo)7|+%>HXgFaxvxUC=Oy-?AB}4%l!S?BG>MN z&Ft^*?*1;fepdR?U8S#|RPH!&b8~vPn66g!d4u$GGHZ6#{jFN+H8o{&==U>!wWV2g z)=$q)UA+FBoaoyPZ*I@sA7`QZ>gI{Rv(0jae(&OhIAl(lY<+v~WHsMKixy3qJb88K zYPH#O)a*XEy#pud^WY?XknzRz_`03%_x<)+e9+d##bt_4ED_7|9la+ySO%b z`;&9;4uXf{*q7f8UhbFr@1EsqtFku{`)YoEdwbhF>xze&W%`{Rg`ZST z#qO_pQSq+7r)SFUoscm%nfYb;cXlZLE1G9ro@c1Mf=f&%Vr$k__4zfQM&W`sxRFeKR0J*?Qb))8{2YcXTB&1yST_T zzV>TqVL;KpO`}6bp`T6}lKb}sH z@5=msVxn^W->=gv{y(3czfUur`}u>;BiGhOA9eI(2Nk|g*MbV)O(qNnzrDRJU-6)^ z_V>4wPkrR-{}f)9m{j}l;Y0iXe>T54XR8;#Z_dxvLPx5*Cj5T?aV-nr=Z|GzV)Bv-~hJ=w5J?El&{F26aSpUJpu;?{r7R^GkWRy85jS@r4a#<;)vsf!y@`$O)_ zSw8q1SsM3Fe8ZY`IsOKFZ|pbIS+MhIJMWgTH4%z_XKKNP*2LaS@r(BP_xAk#_4W7n z_@BS~qr~;&)NKTyQ?xB^tdo zE3~R=SI*gjPft#+>2nNS6%x6lK#@)VX6x*Sa|&H5-|)OLm$>u$$@}xN7j_pNm}Q{4 zRbAn4JDbkh#d}igLm%&sy#LAG#&(7Dh9zkSHVNF^v~lLA`yCG&f_|oKHxtnac<|!l z?s(2ueBcR+6Zf`MKRGecs`M2LE30nQ7LCvABj(vwo9XEIoRjR+jNkX?&CSg}PshwV z1gbCJf(jSCYG#2uyGpa)-PtM8ELZd4;Kjx6@>V4$9)ZKc z%ii25{Q4?%=WM-o@%!iftnQm%`Al--HpgbRO(*w#Vr6o>&U52ROy~RZ&wH8wugzXn z&T_^KjBI_OtHVGEBjI4vQm?61UoN_T zlu0<+CAxn9KdZJSCnu|?|BKpaQ~8O7o&Ed!`|^*^bqcGexc@pdd76}|&ix?!njZxl zw-r74*~(8?uZ|s!z%m#e~Q1qyK87@=x_HkB_bli!^2~) zRcX|=oSVyhXY;ra zf4yFRJ-)v7)|Sk>yUX*ht%$!I z?%zlEQ(B<$ZaeUJcQ~)ZK30Dlxw;>T!PE9-Us&Lnl>7PF+0@`^A}56}Z14KC>i@E5 z(-zhzZ*Dm9?9}Y0Q=${3)4k`}RPxE$X!u=%G_VrSWKP!sjb(oH1jVjo8N;bROKq9i zcm!5QZOhS|y=h_6!G@1pr@Yv|F!I2vp6#FZ2beF&3*6aQ>@{8Q?`41c&d()^;1p%> zT^MA}O_(`VPbRwiIR08^SNp3YH22n)iM}_lJvi8K^DEP~?IHL6T;8_jlbgczm4S_dr z-MqXaaPjBo=eswTaw0omCCmY<;`i^|ab-4aUtfdMOEH#ZC`D%{%9VCOZa$UojE`_#(($Fte_Nl8gf z&CO2_#-v`(nZBJ6*nG_UyavEJ?X>#7el zFfR3)I?4U)x?f*k@Be(xdQ<#zaF+w>*A5?;U%SP0eSZF2_u)gq&U1e+UAk2E{$8&- z!_(8#r?;0&2>oB?J3H_0F4f;f;DxreP>&vjd-Uq6shY0$zy5gKf4bCaSIy5)%jefw z)&Ki*ZmxCsx)@9Uc{ZPN&WLIREQs4%_4s)I{}+qUHtxkr}g*CSQI4u{`U4qxu=Im#OAcK-TM1FrU|S2o#?&O zj2wUmf}sI8;gfIX|8-`$w@#EE1FhX$0<-4<%$|o2A1>Qce|>Skoz`_pesF%-Q-90X z-+%wB$LnHutL67>PkMKqmuViTsb-w>?){C8i#6Zgzq%?^d*`_daCQ1{>*aU-_Wvwu zetc+`uiLSvUpsi2&(BX!XPf2jDtLHEJAB=V+0Ro!#eKtaa2A~Xdw0ppB(LA)rup|` z))~uzQ*g!eExT)fe*+Ebzr4^78f@7A|KILC6YsU`j5puG1Bu?^|C9agGNpvyW!>7c zGA7*yTtR*~1a2cG$*l=od~8$d>3bEAdu{idZy1(7x`lrX8$FD{avlhrS08?`;}?+P}t-R1A|3bkF{+YlP2l3Th(AxK$NNl9KL8po ziz?ZieO<5c#hJ2qcQnn7B6k+4O8u&zs; ziQq@TJNwdCAx=(*=GXtz6k8v+w`+2^dbf4?yFGtCozCC$u`S|Ca8=c>UteE8e)Q;B zW&&s(K!mEfQQ|xG7zRi--Wk8AXQ8N!j1DY4*JynI&G@YD5X5IaGk@pb+cWcLtzGD< zkevk&o9-M+04L*vch;-JRsFI49>1sJ+Ml zGrnV=yfrcJ*i$R%ANXT zEWM`b+}xCUI&iUD?(J=F+vV#%9E$%}ECk7^#^0ZxnQ5%0^-A)#n10-vbG7qpKAoIl znEZt6ecMjy&lbh-ApbY<_xX9YyVK9l+n9X(+S+LI_2Tg~DxZa(O$;Z#mHlJ@-8#NEKm{wisQhWKce=?RuB`+_reqN~?yxebZ&Cg9Y z>?|#J`p>s3YAw&cuz*o5`&pgxVMy%Mn0&AQ^>VqgTaQNgx;c~f&7EwV?$=XZq_`W@ zjII0oD^X)l<>zHKuJaFpi_Q0E{(iq(K0m&0^U-6y(uVHF-=!t>7{DVB(V)?c+Rx9< zo}FzTzG++Xk=>tXn`B@~l4V}Jesh0g5)W&8hryM4HwfAPPM z$K^qFZS?lM*o{d?udEFI{pIE5MXueOQctJ76lN-YeJyrd&Q1IOf0WPPaED~U>|*=< z=iU7g*{4SJ`|_nrj~+jMeNALA=k@PR3qXav-z<}tOQ*;E`t^GK+@EH0AA22km%p$3 z_w%`R$%_XM;w3gj=H$FNIaxhbKMvA|KJ&LK37)Wj7yn=CJ$;&9Y}8UOQPqIkZHB7@ z7rUMKmB0V*x0%N2PtL7tTP`nO`{iPfq;b@ijEVO3b(J~NpjrKNZo7}y>cJUI!r*)T z_q*k>XHSPZDY$=nB4XLNa^y|-`nP*%5=FieaIX5>&Z_k@LyNVYaUq1@p z{r~-b|NM$aoQ5|;*G8FYYG$69VfZL?&ygc88_&+p-`DBt(;B`$?&zbr*5y@SU$stC za_!pl>6G@yjT?6sKM(uH&oRTgeBF(sl8CTA&rtICSntZ<<+pxm{e5+Hb^fg_oVQP` z-Fxr#`u%cJQd;NjCO0y(TYc7b)&uR5TEbs{_AjVgQ&6yB#$$o+g0J`g{T6Mw{P@wM zCwu?>e!q76J*VzjzaL&(8=bVP=EuYKjX%zs-#5v<74lM5A>qS=gGsY`{G|b!A22hX;;3S3+89hxLp9 z=kNa;w$O>yC->*)=l6FOFVAr4bN7CIZSB!T6D+?U_P775a__Z$@iQNtq;E2&St4Q! zPenPxvJ zlY_L${-6FUt{*2NXs@B+@pn`2+uPe0tA?+OvH$a-IYV&Gv$~GnUf1e}hg#3iwN{Tx zJ3FgYY=%YQqKuPl@M^@yjzKqKgF|IRdXr<~>1nz}%J&z} zt&aas|Gm4rJ6TUVcGs7Si``Q%*Z;q|K3={TG$j>t?!!s-`3v^e{QOiDxj5-)R|IH= zYv-T)_1)t7V)FbIFPBbF2^KSiC-8%eFRrbPR(9_@vfn9fu2t!$h4Q;gFZ}%coSk1z zCx78iz1Uq#mM%T{)&|n*-ZulZhG~D&(Js|%3OBnu-)uZCci30BH+Y$kVDH6?7eULo z10{@7IBqpJH9b2&Uw^jGh5E_4ox+<(^A9l1yVgm@;kJw;Rd*n*AZgqS|3Kzu#_u z>h|yThlhv1zPdVjd*tG@v$H_sU3WaQjoEuZi`$OM%=)?27#`~-at(ShJ1*?0EPi@1b6xcIyzq4~6Qw2Fer@y6 zb@?A(_tQ0Rp*SRa2fT~lo+q2Obe3uMsnq<^=jUWUu5ADnayh3Cz{77Iv%sXiSLHX! zT9v#2tv+;PTU_TqGptw2wB+Aqc5q9eM&tYA5JOedj0+BW)!Hr{r>1H@4w*b@Qc5r) zF_uU-d??uyy*+QodEFyNj-1f#$-25K6toPW+`Y}MS1NW#fn(moI+#cIm%WWT;|>bd z)AwHe`uh5jwL^UMThp6U8sXt~mu-Pz^05be+YPF}dt0Zx@%2}Cc5cqQ|N1<*`nEsu_r#io3m3k6|4AwO`l`^^ zpU>Nich4}1-k$gO`~CWE*OpIqwZBSUTu`*NmF>=0AHV zV|%{5Rk-k8Qe^b~Y#s2d13|mr83f;Larsg|K zC44tK+w`oft4=msE-!d^$h}Wy;@@4zK{GA~P275=RKs^mg2VNX!gv4KX1s3?9z3|> z{+`Od_4~Sxrk4V+9Pi-r`vDyiQ`qps(>XPf;xN>1`OTp{PJPncsMrv;7xe)FX?F4!rJTWVmE0r z!>e2?9*6gPKKK3DYpc8Z{`RL)`g^}jvYDZMW~Q<>mLQ-`if^#(1<_{P?PumzOV=6B0`Lc)UQyTuWo7Te=X-l9 z`Q>ah!guq+0@Qh~Rq2MThlg5))qD(m!@6R3mzic?ut^*nG|bloy%I60Iy-z zG7HQ*m27hG@0wOe$NB5u_;`3sXfJ6!Ia&R5-Q6|i@9%w@Ah{}h{k&<@)WUZ|vd4HXu`#*GnjO*RxW?%5XRrV2ijR-> z|NS;QCim>u*VoPS@7biDn<GO)<;*-Ocp*a}AS^{eHh+-}=;)-`b(8Ozx-5V;0kk z>6qyEF0;w`MBV@2@4NN)9q>IYcyys`yY$wouUXyvDv>*?zGiuNbl7CEeZ1!O9a5jv zKl!KZ-nZhuOZ$&~H9w02*;gy>4qqQvRO)cx^LhLGi(I*P3J7c{e;>Cqux-i|k)3)9 z3!=7W-RkEs%f9B5H>LB(oeiw;^6ZW|gRD)3LHWBorw)faUc3F?q}6M87Cv^Ht{3}c z*-g-TgNw6W-_?J)=)d)#s9nC?-S0iymD(- z>FSubY>-l>{|^77Sn~_p^Y70#&ll5;3enMv+TxK@@cY}_?Ca|~f4#fA`{*qh%c429 z)n)hgR3>dKd3h--Zhy(kNh=yE+*LtU#|phW`uFMotbo;)G-;mHaW8RVN>EGVm6fQmT z>+$jaWWmn;k(<**wZr~=K5xIV!$*JLO!q%rH@4re%f4l*U}YuM{o$B&zKC|%o1M?+ z33r1Q_DS#ge9k&TWIoR^Pf+J0iCNdi@PJ4s?~hu$DX`AWGRBN!J(4@Bw;HUuv#Zp5 z-8RRXBgZ`@B3q;avlfwJ{iIJ zhXNmVRy<==HJ)Dc`5806&4=sp^$X3-pZ;r?uZu9VJUCHaXLrfVptVt3pYTb(*&nEN z8&Zy$@073m`BeO^{G$3lACI4&u7A4q|3B;MZ)?5@*P7?uxlnh{Tvyk(rgguTscGnv znupKl*Sql-9lWyhM{->nqNsn~$G9T-c;AlvtpW$1TJ6>;s-LLj`s>Tf=0A6@Z)0R; z+me4j?p?y7;&=J?_Ed(1OtF!c{`LKR{JI#+oz0!i_91`X?S6ks*66{DSGQGTJHX=} zcGG{qzP?_6`d-m_fg!6xIG4|wGDT&!5h8R z{FG14>UrIrxQ%;jANBTYu@~Ee5@^wUo{t|t7R`MP>BzJf{hwu;ZSeBS+URh-YQv9H z7o7PEkNR7T9Ork+S3VKEvvJiN%VMj4n}fx6%E#W_S?s=UGjC%k*e9R{@r`?SAA_H0 z9WVYbU;n2uTBY1rGjP$7oyE_eWQjvc1^%c1_EvvSx}+Jg;lV^@_ms)uLG^q(pIwf@ zn;O~d3&i7V1i!DkW_;d8`MRY-@w@Fmbn{m4`}4_rXLIMdo&TRsj~Bard-~fu{NB^` zrtVJN@!VWF6|&r`M&o<@&LY=6^~*w51_`VAR6J}IPpgoeb7_WQ@)2`Z)4V$tpJ#K! z8*{}E8K%sem-o>!q(`Lw|KIH~ZyBD|tc#FlGt>C^ zweB8xCu?UGgOh_ee_CiOm#ALc9*uD8ww?F;rs+nXn(ON|RV($sd;R7XSkijy?eD)n za z76tw%XJ?0>DLMD2a5lWjIi1G=v|Rlt{};dccCqVDb3Lp3ZB*ZsbbnuM(cEH4F*1Fp zeA(MuQ?1MMe0+{}i{IZ{Z60;S^7Y&8_r-2ET)ktTazemFOe28dyjb3y9gUpVx6Bt} zp7TeD8(!hX7%`lkVdz}hkal9azWhAS6Qz*{@8sW~svUmBfAWf7-`;9pw`>PT-oIJD zA2##bX~gc@GGm@W`#hVJJtr!;9_cNG4Eg=B z_|Ckk?)ka7M|nbb6g>R)_ICI7*CN_sK7Sg29cW~Z2(iB|EiIjW%WQ$qOry8AwhDi} zv$Od8EK~2C2P$y?&5>{T@Fu2mM%IIydt#=$p85Oz%VB=|4*Mmm%<}K)T!+ra{G0o` z_3iEL*H;8Op9_*|X6F}k++XtY(hhkiXJ^;lVbk?u_x*e(eRJYvM1rVekg~7a^U33E zz{()iZvL0neLL?9ip9U^R18{Izyxjp_DuNw@YmPZpjDS=wC&zk`@43D9Nbd<-~i*! z{oRQ2^a(=?`?jOSRd3DTr%iQz$Ir<*QTvTm&5sRt4!S(Q^Z%6g`i{46Ute20`_925 zGw;aD%j;Jg9*n5`_9k+t-fl=Tn7h+Hd|gcapO5V^Wh>?D{}kTblnPp_{U<M&MWf zYmJSKOTDIY@$$-=<=i-}zyHmo?`zW3COI^-@jlsf9kfjl(sOwJgrVikT;p`Vr-E}H z?)`pm^6O1{)jR*cUcY~u^^6yDewV+!rMhkV`PQBC%B?@VlBYJGw|xWI`cnR^&PVl? zd;Z<$^Xvcpd^$b;gU^E#6O}=0r@`At%q}nYKkl1-ch^>w!S^{b4PrVG4Z8zF_tpFa z)q4R3l2QTk~gu(@9{)aM8Zr->6T0iXCeM;76&dI+QmUs%^oOtrV z!RDu3Zy-Av#Gn29_xE?QR^_jk%b#xA@8Rt&9N+Z)PVxDZYU>YzRt-Rg&QCI~$i2O7 zhji$~i4%)lw{^^aT`VNDExNdVZPeD3$-;B~ENc>vt8gq!5t5Nv^Utd48>IH)F5drx zH&(*3NafIrR&H^@f zdJ||{w}*V(jNgf%$!VvP6P4XJCLJ}{`P<}c{u|5UXCn4W&%i62PJ`!YER7jD^B;!Z zEx%v8a^=dR*liIt#{S=~tO#`8^W$yb9sY+8A8tCy$ydicL04QaMk939lsBhSKm#?g z+aR8^F1FW+-nJ&|>Z+okkF_3u)<$gw?UH+X_OlUaxc4Z`OJe$QIaLLorrFo_6h3Z? znXbD%|Gu1Q)|5AT(OjZhUtXK#QM$e}4y!j(!TOR0Yk|D}yKR(%BR~dMb!EZHjp~ zhnbx(=f;M_zrVg}$ZpTOyK8Oqb~)=ZpKp)0-QlnQ_w%{8{@xblQ_0qB+c|cFTASPR z?oN`meE9SE{ORdwldeXmLq>w`&H3$Ve&+8kM>p^c>^UBXUTJf)RKLuFO{_(&+kjd|9*e9e!j!Hn4NQezDmWa&*|Nje@Wr@_Eh%E*=k*{WdDB-Gz6y;zHW|<<>Vzx zRCemU250Vrcl<%Sc3D(FL;cg=GHO^_-kf5lnsVXu^Yf=m?;YGc51S5Y!ZBG%0A6Y4hoC3|q?HMg`xR^6L6}{qPFj{pbJQ-BmhSJ>4kpj>S$T z?Do9a`Fx)7QeREb#_SJLb@P88?~zpYKewd%`@167Ysj<893G(QD81Xv7d|{Z?3)=Z zWtKA|=Ar2yyYJ`c+sDtF<2lLGy zs4HEpn&CP+IRx zytu#rf3W1QFE20eE`PsZfkN=DDYHzo%@PhU>}(Z3aMC2}ipRV;o*y3_Eqtc1eFN|9 z2j9Y0g?PTp4BDLLyM9-r#o-Sh3Mz}#DnC7W30cGOL`-es#EFK6hTHS+Py0X33|tUE z*9t&l_1r|p6OY#Zc@lkUs&@J7Yq~%4Ga;*qpi4~@z)MYL{Qi6IFu(m7&?!o)=rVGk z%J4fhMK(aXVo}T_rUFnk$)T070kKRx-Gb@w&xnRbO8KT-@cRrWbfZMgu zxEbBOu0X5({hmHPM2|8Qu#C!$NiVWq$LGf?Ie@wC$6cn6j?+9AP;nudac4Pbl?|&eJ>X={pX>LR$epOM=QKC8hmGMiq~S#*j!Ge@^>*A7*NM zHv^+d-R_ACmwFW$YnGk#9wGPzvaw5erwZxxh2 z@kuP08nkxe!Ai$>=1HtT8NLfgcr6C~45 zy9)?T1Qq(ma_9egd3{)R{rk+Q6Us*M6*p@$c9?uWeQwQ{%(_G6(|>R%DSeUyx#aTB z|ML_Ne(_qgBu^u#W7GQ1r}ErJD{d#B-mtX#s8s3WGtpVmSN5(g^LUaJCdYYdY5Mab zQIof`w8N@Drj;aaWnazTyZg#Mleu2c)N9I5p5j$hQsO`OU>&GWRLdN2|wxlDkuu{{E4ztrM z8hPKX+aaxcWkF(bbt(7jEx%{xW^Hy>65m|bo3cUb;5#Ta}8EQf=ZB(8-8w z&tHE3K6_ECnoq;5G80qoQ(e0+I`K-GZ9gyK>eC(?4R_~hndwu-3crF~T34&JHX?i1 zG2?5u_DnLC51X1fwNicCw=I{I1qEOB?3{n5!s>gs!NiwKJ$GhArK>t?ye*&oo{cy9 zcC@cSR`;ebTgKFf?@r!$HQ~fjopphmyMuHx*N12G3v8Las$5=n)?Jypj1_Cv1X>wd zt7li=dN;A7<4aqn1K9u1i}xQA@iH;lcra;dM6vlzjWbPcSKsEkNNDD~3_AP!+f~sb z_SLdNJ7*O2X5Fp*q?vJT_S#EZve(_{Ien$%Yu0>~JE~?IKV1-5v(BJYF*^5c=4N*# zrAxAH)k{ONQwr`){0*w4P8^-_`y>zeP}GU>N$=E+L2YOkm%7fK^Ur{qM1q1pRiD)v zftD4zxICFol;X$2JMAAY@6@S31v*f*Bge5K$ZM+`+jHif@jrV5CjQvEUu>0hzs!`5 zj*b(Npybb9^#AVtzt@$U?%U1+?U8VCu>;xv!|mPmkGys>i@-IdKgf0O&iq{#eyVl1 zXVm42?V*`6yUZWw{+Tsny_x0_u{7(K2mvJj7rWHnJURO)kN!QU@{p8)O zwNv(9m33heFMZ4B_4eIH(X{AQ(ph|psatMXRc@&M=OR}c?QA9}IMGmHF2uO-cjl)b zN$MDH-Ib%gW_E(%;^n)u&-}XnE^oDVx1a9Hzp3~9wnePFpm*E0UWq?)TTbNRHeUJa zHyho316IcG|2IuH`bn0O(x-AzsKoBPpY?64fO<>#r|;p^h}*WKM!x;kv_s_5y5P{I zH*Y<>lh5@xtGjC7%x$MLHpVQB-3IanXd~y7e-{_KpPy-*{_M=mT%xF(KdGJop(H`Bc**-h} z>V1|qy7jIs=i*AI%g#40EtPZ+j5gkO?aj(>IUnyFc=uDd^2C#qlV_XdS|uIn5Ra=+ zG&3u^vLcXI$^F4HX?p9Dzsy}|mKdr{%dv;vm z_8KXNC-3+Dc+|b8^7FNIvDQbH_|3JNsvWKuvf_erzm1Yupl0l@l3pp(U*F&VpTep2 z^z`)k=K1s99AXq!_v`8H1=TrEvS<80+0*~5?(FSCmbN-0F`KlBFXOA`-%EiH9rdGT9r=ty?F8Bc3$bWl>RmUj|ltw%&`#cu8?Y|=~rjC zyQ{SN+0670G6~n#L_R*&>-;W$PsPSJht~1i{Qxb6efaQUk*uKLPmZ2@;G{U?cjun_ zUteFJJbCi={QLWIZ<|dqNIf-0D|8iTgyiBPS8j2=nB8T%O`szart8P|9sNI(N8WBv z@$+-u)AdB>Ge&I7iM+hbS6NBvN?m}Os_Ngr-|v4ikgERvF7(how|94TUcPi`1D85; zk}>!I<-Oo~&hWc%<^KKuerX#RY{De&v`G~L^~ z%k!^Pe|yvE1tM-+1d;H*Fv)2vt z??;6FP4e&UNjlmksugk|xZ~yJ<^S*h|2zLqV@Jmx{$LNy1SEWQRXd$*kBa_#S?b`nHZ20OD8ag_@v^Pe9>LO4y zes_MiK5+4|E>Z2YGcydYJZTk=dvSB~^E*3>L2>HZ^4_xe*_QnKb$@<*jBu%ac4p?q zix&k21sA*Z9x`Ukv9J2_LN9h#kAxx9+=RCW8kxm)qpmD)WVV?*q1~|k-js}b{R%dv zas?$N{pLV~ox(foudWL9_`vb5VZr^y?)^VMKezr@YgggbaHoGc<0DU|d2&aNAHRL_ zuY14T-sj%`{B6HZxibqCUTj&2@OpK1HNX9z4{f~CVmc89$5I|1YCUnsd%B+Mn&Xdz zCi~5`@||xd+s*N%TTIt!Y5Mtj6>6Yuz&Y~5!k70}moKTmvQf-mLP$tR$~u@VU4=sWk`#oub^F{7(Io-|ug4jcbd~f0MN?TNAZ) zRmsas8rRpw?#{Wn>FMd|$~Vokukm!RSe*Lz*H`^LADlivJA3r|w>8n*`E(Dr@xH#X zaq$iAu=R0wx8+9LNFIpNd1UFFl$3OKmgz-M#7>W|tGv9-x5CaK=}3o~@2n^1=0XhDx>?}%EO{#7eQuTVE$v7|h!OMf?_iNStCw6q~ zk!CA^htf*7UMa6f-}sEv&rMnG>f*AGnRy4?kS`aU`87LlbBpLid^j`H_|uk-juYk3 z;^+7s|0i?zJpcMnGkDpFVkIS|`Avo~uvAkH+Ds#~%XV$V#-z;5%ujQ`<(34v+yZN~ zDtoiyNgilT=wus3C8bZM635_qZTZQ`>e@SRFTS-sU;lhtM@Nl-TM^v7FYlJ$4_&l9 z`O}k=!Q1oh%2*biNDbErTy!M9{;w)THCr)4^{uVhsi&ufGX2;KTDkG@xIAd(_o~p< zMbFM?M$c`o`v%(2-rCVoBYX_5D=z!tp;j-p{nKlHe){_Eu66ytKa1V_^+Hxm$SFPd z?Ck8Po&tgs&mXFQmz&wKJByaq{QTs_vw!+5(`=<*_J2McF1l&S$;tVNr=#P<^h6K1 z&(GegdaY~Yl)JZZf6B>8zO&7ya<7}99j>?UlE2FnbAt`=lvJeb)}s-$sc!)DcLtU#=+ut{S3R>sy-RZUFGlR&6=e(+XQq%qo$^vwpQq>Eg2UV zou00LTCbzy#Qua8a0fZ>`}67ah7B8Hb{1{Tzi+3h>A7creCdM&jk8R%wL0&u`~7bB zdf(Y*v(59<9;qvR%9r>IbKXxG8_+au)Q*COi(I?6Wn4@;)WXT}F~g?r&yV!^wPJ#T z3zz)%IWHTiE)zy?J+c<=)!z^7i)kpU>O>f7GoHT0mM;I=|yY2Bh^nv3^JK^K(b?^AC(Iy&YwSh~Vu-d#miRa5f*EYJ!5piwMggXQ4%FR0*~a^#4M z>a+Aovu0^+S5Q(aVtOV53w^mSUoQJ=d&Vo9n1p~@2}OL%L}7CCHYFeLJ2U@|)~(3@)Y;Y5)z>FhYQy{B`Zr<0iK`RRU_M&1f5#3B)o1K1M~)rq5?fNQ z^C|mxXUBp~HuNZvE@x^2BLI_7qUJ-tfEdOV3(w|D>cv zIj1Jfo2QrU;^MNd;iVhQvw25mS28g(m%q882ny&sZIG_fO9fk7TN|60mb!g2+dDeG z9E6O7-O<(6^=*lkDSa}61igkgIOspD zSQ)WV$=M!sj|If2Cp#V=?`LOc@4nE#3#`ElqTz%i$FGjx6?bbcw`8c28uf>ZNfrF+$0bJya*1>@&vA6Pz(R~9siWjnwmYJ z&`e5BP6dUg|3RH)(9qN{PN`M>#LlAd_q3Xll2Uwgrw=UFT3@`#07xHa2>CdV;MphYn>bLR0p?Cr?stdbzkf*$hcGf-69&?8SwJ&YPxo#N=LI z7yDoNaPrdED)NFENYrFCheo`-JXkqd}&=n^w z|GGrA4 zuv0`XMo>_2Ms^G6AT}wdGx$_O`!pvNl9H3Bo{$%4=*m%2`VKXcYx6v4&M<14F+&0rn+Z)5 zeO;DtKdal+zw`cDgO9K*x4&JIRlG7GLBZL6;=dV?1O6fTah&})AGJ*;*7U!6wU82Fk!KvDUl}yF^buV7L$jQlBq}YAw z@@3GG|JjdT&yN9J*zl}QN&nF6`%nAi?d4=-be!y8ZJOF))3Wpaw2qFBocgr}$IK7N zN=r#~J>-i$DQefT^ZwdBO5c->#QcL2|NQv4xBB}uZWp%X!oRwe-^g05$hLjL zgbAQyd&87I$vmqo_we$Xw6#ZG{o~#Jxklf2PYr)k_eVN8Ow6&pqh(|Aaiz_t*f~>U zy}Y~v0w!?$&CJXMx!~0GVtXO8bM^)X1|}vUv$s8d^yos|rj(N(K74R)=R0}r|G(~@ z9v?ryV-8~jMTN@4e8kt>PTvp8Y+Egl{d*`r)nAgrX z*)x9MJr!MK|G&3Wr{nsnr%b66rG6P&C$UXk>+&SiZtidY`F6bua`N)?r%h|yuT}TrS@WFD5St5aJ4=<-f^ zOKIlrquwtiR$pB4*Hhp~-oz`6hbuBNR#*wFJTG%3siI;>RsM>d@g*zl*ahCmyS6T8 zc@h72ccXriT8VaytJlhFHckJJxy&^Dp6(wMG>PM{OlZfR3I5OPI(mAJd}s=)-6$`* zMd8llGEPTFM~*K^YiB(R6%-UyR8(B?z>=Zt&c@{SjPUIuvQaj>H`I$bo{`#T_XXtc zbxO$YW^CqcGrF*^d0NMw_Vv%}JbZn7`}+8JctrHKcf0f*WHbqN^mom%l&C*sT|mnXIp!fI{5b4#R8xD|LXqBqgK z_H|$DnVs?%B!q>9Wn|XWwmRK4DsIor%>35hq|T}8J?%@s#!;UaVLQ5}1g))P`QO`V zl>F|z(3$BHM-*<`*EqXaeRz4N|AwrrZ13y|bLPkh2`#!O&{AQ;en3MdO!4gM{3F|E z{l2JluWv5uITPbd9AVBf4sZ7S^i+EuwbR?{BwUjZg||bsPE|RzFg;MP*mpP(h|{nW9>d>_K#}C zEXQws_)yTjT{$X8bKfT64Kr`ezPk8Qjh`pJv9a+L zcaF=Gtuy<|o2R^82ZGE~anW`R8k$exr2jY&G#OtqWFu4n1`zf9j5CgSdzB zEeq$Lcy920GU&3L)E9T=&zYm6WwGm5ZcOs=zTWO`;nD*;UESQetilont6SUKlh?m^ zk?}SCn?s4}s~bF}rc+c@RXevX*ca{gr7c-;--2~!$BrCXQ1t6d=FaBMU(t8Mb_*SG zWVCIVd!i${rMCRd4aIHO@7=p{C1j20+om5;h9-;ZH}c+irD$hor=;Yx*SJvXmG9+4 zf7@b@>|5|pRZ&%ywcCPyBS(aYxp2AKtH#F09kDA`i1%#MzT@4_CoA-};kUqlw60j^3OK}8 zy#Kd^`FD0!R#tX)<(-dStY~j*TeW(N`r_J$GOIUmGqIO3vN-0hI2z@^y1F2Jk;vN> z3+ksxytyD9*6GmMd(qg+r7y%h%-YfB=r^XQf&i0SuedI7ie2nbXY;tHB;Or6Gf_0b zIHyOTN7i+k>jWq3O-8@`Jv_G$$jhM&dmJQmCV|<3QCW8j>>ivJMT8@Sbf2M zp5=pc?yhro?qJ{0Vdb?^a>eQ+vPyOR0-_(M<(WK^_xoeLNU%1kx^RAisM)coIf@F8 z7H`>XD;9XX_t5^85v{ZPXD_xjv2t|%z2(T-8NYQq`Xe69=ln0g^Vh|WYw?O1&pOr| zT5|r*d%GFVQ-ju4w*32lOrm7MiYqS~Tsmg!3u%SjJo)$5-U*T$47&{CIEw#BYgM$OgkjOFX7&UF?i8xHxb2+I0-Ene$r|Cf@GsiD>10(zH^3 zW5?nL5wGTJUf5X`o*>?RCx0vZfn0ZWjY6+mv2PA+mioAoO>kdeSJ{C@C;m1a&FoND zzx6v{FZ0pOg55oN>D7f9AK$QU;1%1t|4*0m>zb)X-?Jaed+`3PP*aQUJaHYGR$DVe zG_THbuTc4(eO#7B=T42_wTpS`-?P78TF12JkkYSC!@Ys-0v`o;hP~nTIGm)vQNt`a z(j=+e)b{pEuQivRCBNONsD4t`=Y6sxcUb0S<2?Pag-yR1H%8RHjhDWoTek6PvqGHv z@yU!6&mY-c&ay`6_Jaru0jq;ASJo??$a;5tGwa9c0;1OznTP1io61?XZF^P5+l?1y zp9|M4-mhh8DH*Qz&$Z;Ax`NVlSQE&2C8%usFzL?xlwXS^wq(bjbo&&%dHT_~TcHZq zl)fl0Sn)AX<b3Qmpxnv79wD!+%LxEZs>HQ|xf5(cY3mH4q4PNbDQXmy^BeFbwBiH{sW!uu}zW(KR;U} zCnK}wb56F#41aKfcQ3LJ(lnCin>%4bgCU1wTwW`Xgrjt!A-v!mA6;KMqqUTf8ogVaMwW zmfsGUtyr;_^G3uP(YufA4l0!$RN`yjdL!-+FU!NYJD@Jj3&%gvw{Oa&H(hpEDRYda zTg*K2`RXY<<-gni6J-!@&QVgjzuYH5Qq5>gd*Y1^yML_=aPhyW_+VPs zg3ODv7npU)ZMo1?wmO#c(Uy-a#~y7lKCCroPmICaj>n6d_I}vIw7Z*KPO308L2xxV z{`~BsKJQMB*z!xiyIOjp-yNc5r4K?_2TM!9sf@SAlxR)>pCZ>fu@8 z7A9qaZx@uYT6FzT-?r6OE92t5`L~waHheyKb_(|{gNk?I&ilW4DJ$83-v9rv|Fshb z1T6o(|NqZlZ-RAV7&uAJxW0Co^QD;{hl>u1Oq{vP=ERAe^2|)@_BwoCe@qE{1t4hU z<+Hk7+V{T5EkAMMM1*k5xeFHpKIW-jnr~QKUsbhB>etr#SBl^zKoGS?lV{D65*Jr5 z+W(_T`I89qvpR79p~uzH(ecsh`5hfW;JcAV%( zmel&L{H496B|+qn?=jx#Yh9kahb*l-e8>OE(w@n`3%#40nGCK3uCGM2M z&iFe%J@$%**Y-nh>sk5V}3!+@< zZMDVs<;#~po*#2#Yxeaymc>t)CLWB4`M+}I%1@4u^o4|kd}i7!n3;u{2~KP@{4SiZ zFZtc|c8}k3=l({4R{cun?@<)*;5oK`eSJ!8@H2i7AD=0{E-5*XwS|J2^LNfaq5b3I zSNpOz5y8*WU#KtI4e`A)=%%8H;UBKQw%5|)QuawmNGK}Wl%u4S^iEwEeC>^JrQrYF z|1Mv?tgNJDu!jXa;xdsH))g176tv&{4?O1K3hnE=NJ5MTMU(5Fm%seIy}3C#4;~2G znB>}4r?d&`XHaY%$zNBW`@+8N&yE~bC8Op3@9e9-WPlDso@w*#MsmOXzlzh-bU}xj zhfiK^2)a#Y{)z4%$G_^=WlA`6E&BiR^72$|!9cZNPyY4W{d#ebT|Q=4$;&QLZL_>P z67ur)B`+?x%T>BS?>;HEpD6yZ`L(^NX(%tW=XOG>w&;H&GyAI0)n<8jcFdSD1G4FK zk^g+Vwb9$BfiJ8n1$(6C?=OE(PfjkbLkU81a`WcR(~JIl2ez1K$qj3hhH_3zx9xZ0 zw`N`C6jt+@X_R_%Q|e;3UZ;2YS65Aq0bQO0x+6zP|Iy{^_H23O?RBdD_e8gSQNKBl z_gSptwqmW~dbKlupBU5@{TGj~X}r_FqyNSJjEjpDo!h>=y4t<|do};Fy1NP6g1xpr zD?IZzC1qdrUv+hLb~d&oiB8a1on9K(t6MAHJKWng*x{qAnm3E)EH68}`+4rx`a+{qZfarqe#f4@3Y+jVX4AF(WuG@J z^}ae;Wf%MOCv{JLAMF-jAG_O3Q8DrJv$LR6RUY@-+tvT8*$6u5US?_S?{A=q!KX{7 z$3<<+xjDlyd6rqO*7yC>w`|!`^z_ujM|s!Q-2D0Zd8+nK@Hxzq+DoH8TRf{XGMc~p z-{VJ*rYsQ`5RjMGpMA&iUnQXyN&YYNeEBAfd6Q4C}gKnR(GHH$3m~eAl-kJ~} zZR5V2ZA&*PgwL=F4xh1cWA~=^s@qr7qW{jmwUs@%T(tYuMAP39i`Rs0zxpO)b$#&e zJ8qfRWI9jCO@H$5Sg*AIT&vO_A09Td^Ut#=e6*|d^{$eapT1o7?><`j`I+ww14SjJ zq#GL&S3Hn(3cG*5KXyv@ttFwW!$1=j+9zB=Cr)L9PA5KY_-+kE!_tPagOAopfKhx@VKH;15CI4dSGG)P=k0#xb7ZYo{(?7*N=f(!m zx&7bE-`*+(?K}b93^iHJ*Xi_!hlc|rca>z8l$5-`w^zRUjp5GyvD@?Rt_oV(RiiND z$?56uudEC%GTq5k3_YA1nkaUFiqESTKwZP=yQf8*&R$-5sl=Qm+IwBu=k#ZxUfnN_ zftId)Wj?8qQ`TkXfAX8;&3&ShtDiKQ=q}qOdDbkU&SduSu&^25mz5NkN1wfz^CiE~ zZd<fZy5?$0QklY**{i%3XIy@h_Ik<`-!&%MIrq2@_vak8N{^jj0>(53zrRYiT++X|q+fuKoSyxsBGEWB0-s{Kh30)oL zZ~HZ5iD$o@t=ANdiyM=V-`iXL-Kevp!+~2X;`Zir|D2n9DvP(Qn7bfoO@v{NLjS_T z=jY~1nPzE-Z*{x7t90YX!~FI!TeCvv9Ow{K2F?4HFIbcO?mF+fIM7hi^5ST6f`Tsn`T6)Q#fg@dmV^Z> zA~rty`1p9Lw%|nJO%s1lJk-u7+vU&?x_xAG+Symv*WZ6~aFjmwDAgG7xVK`xBj|_jZFRji=Li} z-BS^m=eWdr{n@`9zm&ePv$Gq25uUg@MgP0s-_B!vnP;lg@zjJRoxLB5% zQSRHLYKB)=Rvy0NFZX2bPI<@uNk_XRlmz}lW_~7K-Zb&|?(+A25BBBV-38iI&*r{H z-l8BOC+AHIr|^YOe?Fhjzr78#w5-BQK@7A6DWZQ`;p1ZqCry~pkj}x(#^Z27eE-|l zdvO&HTNRz#76i&UGp|f|er|3DyVtJm3rk*Jim&Rf z*pjSpU_nD5!+FN6>+8;f9N41MgN zN{)7kM%>v``T5n=)$V;VH&+HPKXT-VZuGVVwSRwo{rmenKR5U75s{XIiZ(WLK#om6Vl1=P>Ooe!eO7bllD&*Rn$W z<9)K#k2=*sCk^lPd1CVZ0){@ z7OAJEtc%_4=IYujVVLys(b34-di!~nGuRke!EN`aTuSN{&hL%~rxqrD-o0Y)%)jys zoBuTG9>25NU+H?W%6HHam^@x`+l!z3Rr);%0yPFw!Ht2KsntjHOBC*O-+y^yOQx_> z{r`V|-TP!L3m+X>>OK9~v14v7EKzi?;n3013DBCbaL$PZ@D`sHdfkve_W`j_wvXQmzyq;3BN8z#V#@~w*SfQUiAOW zOyi?FokyWnG)ffjjH@V@`rn^|{cU%d5Y?11*v4>~!2T-yreOG~MW5GZpUi z%iGu8+?0CW{{NrJ{&torCj?afiE4-0d_H4*@#00$(VqXSD?wZN9v_Hh=aZT6`ouQV z>}xhZ9yGUdiE3r6D|&kBPoKw!oOklpWjgCX9niLaXJk$v0Zny3_IP)Hd;a_x>9!j6 z|NiX%^QqfL5j1&u_dyakmTsQ5b?=v}eYteHS^mAA8vQG)Lb)yF8tV==v3gI}10DAW zx>=;|fwG-l-QQndwZqqeR;3l6x80s{auTn!*@B+lUfs}DB26oAo!^#wJ7?+7w6n8j zwl(c`>y>K#2D$`mU(HPY*xN?Aw@fPQXC9vL>u&k|lf67=nsK}a#N?t z9$jJM@005bRKVwKHnPhJOm0Jz8DewlJc|GIql+wLdN!m0xn zZ(h5OW%ci*$Dj^~)a7rl?j>AoOm#bdC(+E$;qvmk&cZtuTh)DL zY$$&p_j~{Lsj81kZHweVzOI7B)MEGkcQ-eu7ZrV4Dvku*T?OZx>$2-OD4CN&W(-9$M;lzR`Z?J@?~?`+gsD) z>m+aML~cqsH^;IKW30)f$7`KHp@S*xb?-deNfSF9lZ$tiyj1dUy3+=#*_ME6wwP`4@84fpDg4N8-V}aGqbEC`&vWj4 z@&C={^NWn~?(FE5Hn)RZq$O*XBVl&TxbfxXe5!&thwT4vUXR+%$@6F!zoZ4=QBTa$i% zUheH}XQ%7W&na^H{q60~qjRkiK+R6jN>#b(Z|~gSS)ATd9Wp^S{mcwSyA89KzW;o% znBhqs*h|)BTc-YI+&i<4b@rzxCzZ`jd%oYR_TRHwsQkf9NSHvnM+C%h~QqJv|L{8i^<)BdAO0;W5GXm!@s8y;Hr12gkdJmVb|r_n!{4Pd1f} zHd}Ri+u^EbbEo8*8YLASOWU@4(~XNqww(LKvFPX#FAnqDw@#g$F~6a#c((e2yC?1~ z?2I|_@y`GE`~OeV3iXPcF_VRj?b^!VFSjuw0CzJ68M+OGOm&_LW=tF3{H-8Nk{1eLBaJ2u1^nAiWSskEtI68+Bog8QB0 ze>-2iKYxG8l9W3>C$H)lHSfxqH}$N!akPXg*!*mrrke^bu* zJM8W~E4-nM?HZr&6Q{oCbrsL&mK$W9onr~Q7~s)s^9NtA$J;4kEGk%at|LqY@T~-OUcVis@~I7R8&gd z-vc%ASBI@V^yt&m)1cEuZY1}EF4vUSiQbm;_SV*jt4lm5-?$N>leEO4bHV*Rm7lM! z4o}uKI~-RrDPXDB)ZE+Ka_{exWslmJ#Hy6z;?nZhpIh&?GY~%F4{rlJ!`@i$|^%Y%cZ(?%g{(ifwIwHzPX07s?an&qMCHnK4oOw-WnKq=Z zFAq6nua5Q1H_)UrKJiI`0!0u|qn`w6{EYtx(Zf^NULo1eYAV zvP@6&w|?k-#r5w}wrjt=$F=cPjq+K}rm}R$-CMU#cAWj|t;4di&2RF)vKal^bA4fF zjK=Dn@?v^1Gql6?qU(SEeY^d>*EAhX{rft*-tYVE)-U(>{r>-__Ic=o+9Rc)3r|3< z7FPE&vGv&NG*QVFbeQ`2GZpLN_TJi>9bOs#BI#I<cRQTWY-af7E9mq|nXXDXIf<29Y)$z3dnYC;Utb^p{~){k zpD&mFK~DO7-hRG)eVt)##?#Z&*E=?|JwDzKI=8s@&-1GH2SI-R5B2lrgo8|%o3DR< zc6PS<`I86o?(JE5KDyRm$9$X0Ai1mZJ2k(ntEqKa8-Pd21uGfVi}x42zP1+B=DxNj za;{Y=7boY+n4LvOyF^!qth}@$aPh0FtHW1^@oMgOZs&uXe){{{TjBVB&i6oPxO*@` zE&lv!_4-*!J?*UQ?4QMLTR^w1Mr=&_R985==;^7*KZe)O?@<1J{OHln>htgG|2A~g z^m!NUZw0lGc9p!Gb8@P7_y&#e3E;!^4>f>hl!^_$gKh)a_xqi3tEB(0FPHtFa$c+rK&4>*O^Rz(Sg`%5`m7kti7CdOMnP*>A`L4gWSF}79v_@4)>66sE6Mvr+ zgF4JMpp!`+%bd53{H3`9|;@Ne~*SNAKk^7EGw zo74X0`>#sIu3TeuCxjdM^z{PHV4DGo=)%1-G3->hVaPaWl*V6jg`qn79b}8K2mUA=c z-J9QY&i~EK%vAdFIMUGBUa-;X)s=x#l*^WWp()Zt@*F> zZ*P0s$}Rq6_b>+59eJEwP*zAk!lLb1Hqp_NPY$-I5%Pu}UjATK1; z^m|Ft(XQkD@}PyI_n=cJ9vq;QskeIP^X>QRcK`ne+EZo!<3aQFxN6;#Dfjo)w)4x2 z#sBzmR6Jhe<^@r=Ua6z&nT7RYcbOy}YH4IT_iKEDPqp z`S`jw70RDvv7V#O^5&U zf6eUtWv{QTZ5DrVW25pi{>mu3j-B!59bDj0yuH3$sq@;Z(ASOZavmNYI|?7S<(zFW zxU#3RSXISJCwyIuZPk|_kGl0!#FsQ4Pk(r*^{MUChIO&KPua>U?`yu~2s&1G_s@Mf zG5Aop@Mik_(kFpYD}$DH3ah8xn;UYxUtT=&vLmmQ$&RwO zv+n$i%e%X4>ecwD3Dv*$t%>`8^5n@!@=WKaqzDU6eE;F%o&F2+K^LGgK0QCb{@ff( zZ`;J1n^OP&{(ju@$(fm#m+!wc3)JY20{Z*R2FHgh!cii48(erDjFrH8R`}_NJ>-(o~ zY)pP?SN4$QL(jXj=HQK>Pv`AB|M9iGp<&=1{*4 zMt!-nv$$xhsk+}BkJ8z$-C_@ACj9>X_O|-$oDa|5SAqwP#lZFCp*#5xudR&^Ul+5p z=4a8f^8de0cr>ib-^m!IfG&oz`~AlF<}6oG*vu2`l`wp?^?F?K6Vqnv@^@SE?n+(n zd2A5y?#4#vclo#7SF>`X1ls-A`oBI3e z1$haHiXR^y`p!06n5X_dIWPC}vR>u;Wow&lDnBJGs(-)t`;(KE!k|Rw1rc~~EfhVqBtND60Tw?v> z$B%!1dmFvPLvZKj*zfo2|DV?1uk(HTvkMEIK^GN7-@dl5_V;Y_{8P1mx|Ofj=j5!} zArG2D5*D18|7qc!{)3Ucf8X!>trvA9`|Y+O(7f&DFKrREPtMJ~&0T+LE+{dwffA!k z@qgReKOc`PyZ3<(f_kZ#v&^kmYPw$Rq}!>kv(0i-#HCcdrbrm2aLDz7?kc%`v*5`I zLH7NcrtW<*lhu5|*Rjr%EVz|@ecjey7rD8AetvFW@Sx$&+4pxo|LX7TJUF)@^7usi zc>;o!mhmV5O3XaUUitayX>}+28|T5J#8Eb(GmKJC`T18rof=-S4RlGO-%9`acArG{ zvK517bwCB6#j`r=xazlC%ii947=Nk{bPVHK*>Cr%-*;X&$jQ9DO}DKldVAhU*)<34 zW0rbNeZu!WXj95bMrO7%GmY7sFTT3EdVb}znO3E*PLzHZl98$T`YN@BFWmHUdGdIV{rA-i<7=z?Pu0B>Z!Vjx=6mE3DAq5!%gY*k z|9D)!{^L>c|9?LB-*DSe_xIQG`E^~r{`2j0XPaEQbZLWl%$^Ft?)3BX&fd|j`E*i! z=Kh9M=Zj_&V!d}~{7_Sf=m7W05>%#oXcg0V> zf@Va!k1q3_ope#_Om^^cztH$F(4q51Pfj$Jt*$=+8Zo=UeV%v2j?&j*8)rnmyR&m5 zdr)xj(Y_1I{pGiq=iCU;tLA-HclQD4`WnzQ`>NUI`F7v$6iZ}JY0nq4{dOZ6)M%8rBQ1uC8|NzE=HyulhFe`rmiA z<<5@SveczhNZo&)$ZsR)ng4Rf@2uZd`Z}zgPj-rX?luwqI2q?jR}a4U^YgQI_&S~V zeS7YhygoHWv-s5&&6}}pcXyX}PuIA^dtUF)SKfDG*CD-GBmM`G;j z|JCTEDSubKzgT!H;>Y^s-9e`$&5FkDKuu)I_>>kNI#rKWOkcerw`^2F4p|-aGA;l$><3 zVs{p)YG`m|gN|2qHT|A{V}oPPg3<>E7}qd$-^u@KZqCjt)w1>Ks?g+j>Wtva4f>Pc zZEr~b_KM+&s+ew+ioYJHHFIvi`-*-1m(F**wpUekJ;V6$;X}|R=(2(n?|(dWC;uyZ z?i-Dm9UC6+l%M-Q>D}%8{h|M({((*z^)~$uI`uPe$-=q`*Ok84e>liq#65X_-LK5I zx3(r_x!p0J%T#P{_`P~>x43@T${^PNR&h-JPN30|$|6a<_gnaZxUldM@9Xa& zJByx*$Jcy3Gt<~S@6M0k@AprhG)c-NLm}+y+UW1sp3csRr(Im? z&Sn??zn#BdclzejS?|_|ufMk~_qM@t&gkuVceiF=pQ!A9#EhwFLdE>^m;LS6-j zk$OsG4O8yB^AnYiKRVj|)J^S1(f@ycXSlh}M{)Dr&))T4LskSRzU^;_*irlY+Y-;o zPnIzotWjT!B;esBI_JJ0^_m&rE{@WBqUeLSOD2UM9n;=O+_`O1pGPfv0{ z<@%NRGTR$Ade-EbZr+r7`rq&O`-`ldAAR+AX?yf^r+nf5go90>itG9O`o5#n|5$O&&g`$`S+$s zOA4*8S27aOKmYgo`gr?XrF$Cl=gkAnw(bA->+~!3N?n8R*5FxM21rY$|62L|+UF%a=0CR^5MINZOHx237BA zC)9eMJW1IYRKe7%j4QPJ&fxkcQIVZri$dVJl?q))%!@9*B)C%n_%#3V!q zbgaqd^z+-kN}8?pp00OxzP-G(yj@L%S*DDAoy=;7KM()5%hx&7o||LYx5s;1{{4L@ z)p<2bOWnsGU!oct8)uv4PFgcHwzt zpPrlqjlRu4lyiUIUK>}$akw_;_7|TA-QZTYdsW=tDrxh)Gk;#*$lw3B?A4W(N4rE1 zo9$av_4O6ExZa;vK-G&iD;U;P>~{ zN(W1)Jl>o>L(F&b5~T~5KRrFI?yst#psDFOZxQ0mVY%n`cdDD2UHh_N@~P?i_t(Yl z-k5y++zi9y3kw|2&N3C2fB4;1BKXy{wcQVeBmlTb<`M>Yxo}XuHaeIzs@vWb0=6*-&AFbc{ z{L0E;(3K-|b0R>;0N4H5vB&xZ+p{`I#uC?$v#I&<;d&g~a+c}(@y8_7UY76PBL-@B zZw0rz>(APLet!PAZB9X9Vd1BD3ZR?m!R5(n`@Yw$d~!A&#wqWX>m0ngXiC=E$A65z z$LuU}t=Zgr@al@d$Cs9RfAUkz2FK8h-6UDwiAqyuOeixp&u%hxE=v>>QPqtQkeDvhWlfCoWEDX!v#T0tA z^T{5PH2NMq?E$3IS~s)0>f4)@Hg2WgPbl{vIdUZ7gO{i0&$rv}`^~W^d~;(Xzugap z$8SK(CHB=+?ws3aRq{gNy~rle(TY4r!;AKRuTj05KEGDYuM^3U`|lJ#Jk%Pr)JwBJ zaPN~76BkEs&wIb`_q(&R&7XQk6u-K%vZbYE!UTbxv-O&qntn*fl^KAX{ln{>c>b!7 zY_FpGXZ+TbE`WsOfAA1Xu-t;Gm0@ddyj1 z3c6UL?NRzp(5i>i({v|uZ@as*IQ{*-z4d>;PLKKbem`VRFIw-$(L4U<4nRX*|GUo| zi@?f;SBt{e$L(N#+PL}AWq*5KKE7#tcSO3lwAg4t4ffv&x-I1NY;%3Hx_3LDr%dKO z-Y0uF&C$_O>2<%ny)5XvfGXN z-G4rl~+NRd48IZ0=k5m z=V*S>|KxsKwQVtbtG4EBdU$TG^@;B{Ho10-ZF;%?Kd3KV_WsV!%{iMIQO*AI`MiAn zpO2tRCHn)nA1o+-e2ll!<2k66-PqW;DL%aV$HVsJ{`3ExRG%NSry@|UALY7Gq#-m5+MoEFeQk~4ZJS>&7K6IiYq#}E znQ}>s>qLBbb93{ilTVKIO8d?-5sb~fyDM~C+99L}xA+e70qFikxixxQYkn40GKlZ2 z`&-q_#+&kf-Gybov+vjckNxIX28orbclY<#+Z&mifv#oQS^PX@b#D0jIMMjGclTD8 z-&|7o>dMMXOTCkG=h;-+{r^*ZGYdI}%HRF`e!m`c%=^=iuavH?4nMA-R9!w-JiaDS z?m%X*lwPfvyCU)ZbO^I?&5^!**ZCi-?_5!-TZ zg17(jKC3HYTL&4(`M#4~aYy0fW2c<2iGpJCcj?M4TehqUU41Iq;^DvF@Be?hou9h= z2?My?x_=h5Y~a=O2cS;Ormu0k%HQ|B^`5Gg`rLH)+1cjZd4~@jGOG8LFSfU2h7>o( zPVatxI;|i3$@Bi7pP#LNFgcsq{QYwIlY!q1gT$sceKMef_Szop-nl<~eO%I2&^Z3= zcTeBk+?@1H-ZX1U&ZfjqPfji>K67*v=o%@wsUGhnEsK_XT2boPD`mPaW~WkhiRstZ zEt}UCJUnD)%TvixY%eI;)&Hyxv;+8y{%n~IWpAT4PVad04YW8WXHUjOrJE^8amq8P z+MuZ;{%f(@=CrdZ<#`{TPLDrzIOV$S{+1a=pu?=4KOViaKl{4g#fa^BcfWiox%sL= zOgAcF{VdaLt4~|)#r5Mrx5Zjqh|b@u8a?y(Ny{CO5l6=&P;DE%Hp=vAyxvM+EI}Brb(#u;t528Zjx zy1!L7#Vvclwcqw4`=+|5r>1U{5D{rvk#*}%V8`zpf*0+*8EfC)+xy6Lhm>hnLX!hG zQUrRu+gba&>~I_JRQ7eko4#y2w8pCPQ_9Ins!u0wN_~8+cawgR1UR(wpZ)_~o2e7^ z_gk&?yE{9BH>df&xv?qL`{t7k-`?KtZtgPwW&C}zF|<_Pcklgqh?bY(Uq9Wfr$9EbguY9qBz=W^>}{9JN0yEg~WE!_Wz&H{!_I=r?9UR2HgYx_!#fa#j9(7yG$RP@no{U%M1PRb$4bOr@JVl zgv-w#kNfBTx10ayXt%t5UCg%^S=!<2rnH~b>*)!r&z=CjEy4NY&O7`w4jxr6(GFQr z@a;|H&8*v3SBHB~)oOja`Ae=0=pKiP?Yfr^O^>hBL`ygm6rHEIue}^s`!)3D;?>>1&tj)6;bG@9)!%&aL?S_4?6cef;mQuaD2avSQ+m z?AzONH(hN(l*^Ke-)sJUz23?t8YH*X@Adut``=tyTKD(sb#}Q52f4$XuH9mP|NVXs z&+_tT{~DCNiP)HRV?*MmlWm~u95)9o^@`nF6>4_Zdw<ID{iga#&iH*&5}N4m zKc9Dcx_*0Gn-+g$_<_&tU#)9nIhcEG8ZOT=$@~PGQLcL#Hv`mqtTF$7_;J6z-Zj1W zeKBUKMc>{;esrC)*sXVx?{}m8do~wyU0hmnE+rtM_ut&=bul|HZBF-p`tg-jGaK)u zy}M6rOg`S!)Rgjm-G>{={eOSGUcae)Q#UxlFE6f-ii*0rD)cDZ`+dLH<(O^<6$FhP zFTXF@r}^SxyZpYIpPO>7B3V#3r#dJo=t#z+sPA{n?}NIz{SUX?-k!fb`?_D*TPsnm zkQ=*7v!~UazcT~k1*`9e`R)HG#GTWR+VbMO{ePWk(^=;EeOtF?UENjuyf0_d+vD=} zd;b6Xy|H$pl55V>3Z&AvekVKsS5WKw&ySCKmB;slPSpx6y2}0P@^b&_b9Xr|cI$n1 zZtm}+;_)5&ip$PG?6dve{EMsh?X9i4aSPq2iQfNXT>UNQW=eEaRMgh2t1jW-qpZ#% zMfuOjcb0{ZT$cOIWnyNYdVGa7s9*o&pw>+ddJerIQ~^54_WlPtldy#0y4 z0^;K8X0LB;U7cez)3R7iO7O2N=hKG|A1<1ldV1PPHPFe9u*jbObl%~1{_gz@uRs^T zgEny;h-`0kD|=FxWV00F->-|-Sr@-QE+_f)qodtNr|Cv*+3|cmqXDAS`G4B>RrsG*%Hiu` zKr>|@J{G^ewl;Qm*~_12Sioxv{AWVyQr~y&lhysjbfZM1j~_ptENC0DI!rfyU(NSF zzMz8$lh$8a>TUh$_5L$|pYX&$`UwAv&hLJ|Z?%oX*RKbd`FUimM3}GHgDzBdetd4O zwf+A;pJ$n7&oa$cE5C5DOH}(wWq=yk2mhx0X8dWYsp+XV;~&R^2mRsi?(F=0+24LD zcbOrI%fr{jXvXi`^GV`s%d4xa%irCpJk-Kj{Ort3(5y=463a{jpa&U$8~lsA26`h^9Kr;?{IG2PmhtBukk-;?z9>Gb%n;G}oU za}GdTxklgje7zP8R&SPfM*~Uy{}xVR(D37_%LROk-TTFsAGzayvtc!)0h{^`G(9xe zs&q>G%8gTXqpwZm*Oin6*B8^D*M0Rhjq}*^wPWY}O)QZ1!sqLE7T0-CpXfW!Ci0$a z3h4d;$*$?oK{v06e+Zjj|IhN=1QgXE?@vxZriS?V=4KukN#XWa)!&|q>wK>_3t+pb+XXFt5zeE!t#2Jr1R&L3~xd0*To zYps^wz@PN)IYP{KRMsK zOvIJz>@6?NnQ0$4eMom+tYLPlEu*Wo_sxdoDcZAdJ87C;Oi5g*vSi~XhhVWDR!uQu zlgB&Hy)21)f9CU^^JgC0J&%cf{y8!x_UxJ3@=N_c`&b*_t@nMg{f$n3?`7Mi+w<@9 z@$fw9m7TkA;lfrI`|i~L4y#|(G2M-yJ)z)cZW5<^% zf0@@V`psEVpX+oqHN7%>&byh(|Ns51%yED6<>lq0hc9M-CM=RRFq zxGTNy;>C;m_U+rVees2tC7`=zY-IMP!L1S~f>`zJ$CsCvm-){A^rY|5g9i`JobmZs z@MRXlx)V_A@-s3t{NHKJv8mitp`(?6X^wTphlF`|0(TTVbov+(a^PQM*u}pryY`zY zKH0Q+kE!4HGuzY8&$HRNxZvHLosTxIXuz~0IV&sc^fcYdBKO3KiX9b3*lelz`6;!& zzJA`FKv46zonOAIeev}-@)@Fc{TKYs7IxCJJ{|qI_N%GV+S-@ynOj`bNYGEauWTw zM<3+o`}_NQ zas7x5>F4K_TFrf=`z&%_&Ch##tKZ+*x%fwR0zA=ND1{`xe-}SLKYxCX<>t!I&umWr zKYnhm_2GW@qt|thf#$rn|2TTASK8gp4K(ynBY1T)JkVC`h6Eb-m#?p{M{m!QwJb_G z+{RnEG#ykY*Hlf+yT31X&r$jMHSzoZU0CRRH}CuD>H0^Puk1zy-7`qgMXu?Wx9{ui zjon@L_R-Pq_xJW{+wJn0JbChT{rG)FPfzWw{(f(NeSFQ7TQ}`5XziNs@cp{mcV`!P zl3V;+Q3)P67yk+f{$`JI{Vx3C->nyQ9UXA%O6*;Zz_Y|Id8H&+SV-UH7u*Q*Sns>` z4p8c()S8!NyA}T`*8J8sbDRpcnX#b@;v5E1h#MKS7J(hk5aI&%4a15Ku-yy+f?x+R zEKmZwlEJ~1Vgr)i{L9<^TPEt|!^7>n /opt/bunkerized-nginx/www/index.html $ chown root:nginx /opt/bunkerized-nginx/www/index.html $ chmod 740 /opt/bunkerized-nginx/www/index.html ``` -Here is the example configuration file that needs to be written at /opt/bunkerized-nginx/variables.env : +Here is the example configuration file that needs to be written at `/opt/bunkerized-nginx/variables.env` : ```conf HTTP_PORT=80 HTTPS_PORT=443 diff --git a/docs/introduction.md b/docs/introduction.md index e0942c5..daa0280 100644 --- a/docs/introduction.md +++ b/docs/introduction.md @@ -27,4 +27,4 @@ Fooling automated tools/scanners : -You can find a live demo at https://demo-nginx.bunkerity.com, feel free to do some security tests. +You can find a live demo at [https://demo-nginx.bunkerity.com](https://demo-nginx.bunkerity.com), feel free to do some security tests. diff --git a/docs/quickstart_guide.md b/docs/quickstart_guide.md index d0f0870..998de74 100644 --- a/docs/quickstart_guide.md +++ b/docs/quickstart_guide.md @@ -15,7 +15,7 @@ REVERSE_PROXY_URL=/ REVERSE_PROXY_HOST=http://my-service.example.local:8080 ``` -If you have multiple web services you configure multiple reverse proxy rules by appending a number to the environment variables names : +If you have multiple web services you can configure multiple reverse proxy rules by appending a number to the environment variables names : ```conf SERVER_NAME=www.example.com USE_REVERSE_PROXY=yes @@ -27,7 +27,7 @@ REVERSE_PROXY_HOST_2=http://app2.example.local:8080 ### Docker -When using Docker, the recommended way is to create a network so bunkerized-nginx can communicate with the web service using its container name : +When using Docker, the recommended way is to create a network so bunkerized-nginx can communicate with the web service using the container name : ```shell $ docker network create services-net $ docker run -d \ @@ -289,7 +289,7 @@ LOCAL_PHP_PATH=/opt/bunkerized-nginx/www ### Docker -When using Docker, the recommended way is to create a network so bunkerized-nginx can communicate with the PHP-FPM instance using its container name : +When using Docker, the recommended way is to create a network so bunkerized-nginx can communicate with the PHP-FPM instance using the container name : ```shell $ docker network create services-net $ docker run -d \ @@ -429,7 +429,7 @@ networks: ### Kubernetes -You need to use environment variables as annotations prefixed with "bunkerized-nginx." inside the Service resource of your PHP-FPM instance : +You need to use environment variables as annotations prefixed with `bunkerized-nginx.` inside the Service resource of your PHP-FPM instance : ```yaml apiVersion: apps/v1 @@ -500,7 +500,7 @@ LOCAL_PHP_PATH=/opt/bunkerized-nginx/www ## Multisite -If you have multiple services to protect, the easiest way to do it is by enabling the "multisite" mode. When using multisite, bunkerized-nginx will create one server block per server defined in the SERVER_NAME environment variable. You can configure each servers independently by adding the server name as a prefix. +If you have multiple services to protect, the easiest way to do it is by enabling the "multisite" mode. When using multisite, bunkerized-nginx will create one server block per server defined in the `SERVER_NAME` environment variable. You can configure each servers independently by adding the server name as a prefix. Here is an example : ```conf @@ -513,7 +513,7 @@ app2.example.com_REMOTE_PHP=app2.example.local app2.example.com_REMOTE_PHP_PATH=/var/www/html ``` -TODO : some words about special folders +When using the multisite mode, some [special folders](https://bunkerized-nginx.readthedocs.io/en/latest/special_folders.html) must have a specific structure with subfolders named the same as the servers defined in the `SERVER_NAME` environment variable. Let's take the **app2.example.com** as an example : if some static files need to be served by nginx, you need to place them under **www/app2.example.com**. ### Docker @@ -593,7 +593,7 @@ networks: ### Docker autoconf -**The multisite feature is implicitly activated when using the Docker autoconf integration.** +**The multisite feature must be activated when using the Docker autoconf integration.** When the Docker autoconf stack is running, you simply need to start the containers hosting your web services and add the environment variables as labels : ```shell @@ -654,7 +654,7 @@ networks: ### Docker Swarm -**The multisite feature is implicitly activated when using the Docker Swarm integration.** +**The multisite feature must be activated when using the Docker Swarm integration.** When the Docker Swarm stack is running, you simply need to start the Swarm service hosting your web services and add the environment variables as labels : ```shell @@ -721,7 +721,7 @@ networks: ### Kubernetes -**The multisite feature is implicitly activated when using the Kubernetes integration.** +**The multisite feature must be activated when using the Kubernetes integration.** ```yaml apiVersion: apps/v1 diff --git a/docs/security_tuning.md b/docs/security_tuning.md index 785094b..b7a711d 100644 --- a/docs/security_tuning.md +++ b/docs/security_tuning.md @@ -6,7 +6,7 @@ bunkerized-nginx comes with a set of predefined security settings that you can ( Here is a list of miscellaneous environment variables related more or less to security : - `MAX_CLIENT_SIZE=10m` : maximum size of client body -- `ALLOWED_METHODS=GET|POST|HEAD` : list of HTTP methos that clients are allowed to use +- `ALLOWED_METHODS=GET|POST|HEAD` : list of HTTP methods that clients are allowed to use - `DISABLE_DEFAULT_SERVER=no` : enable/disable the default server (i.e. : should your server respond to unknown Host header ?) - `SERVER_TOKENS=off` : enable/disable sending the version number of nginx @@ -26,11 +26,11 @@ Here is a list of environment variables and the corresponding default value rela Using Let's Encrypt with the `AUTO_LETS_ENCRYPT=yes` environment variable is the easiest way to add HTTPS supports to your web services if they are connected to internet and you have public DNS A record(s). -You can also set the `EMAIL_LETS_ENCRYPT` environment variable if you want to receive notifications from Let's Encrypt (e.g. : expiration). +You can also set the `EMAIL_LETS_ENCRYPT` environment variable if you want to receive notifications from Let's Encrypt like expiration alerts. ### Custom certificate(s) -If you have security constraints (e.g : local network, custom PKI, ...) you can use custom certificates of your choice and tell bunkerized-nginx to use them with the following environment variables : +If you have security constraints (e.g., local network, custom PKI, ...) you can use custom certificates of your choice and tell bunkerized-nginx to use them with the following environment variables : - `USE_CUSTOM_HTTPS=yes` - `CUSTOM_HTTPS_CERT=/path/inside/container/to/cert.pem` - `CUSTOM_HTTPS_KEY=/path/inside/container/to/key.pem` @@ -53,12 +53,23 @@ $ docker run -p 80:8080 \ Please note that if you have one or more intermediate certificate(s) in your chain of trust, you will need to provide the bundle to `CUSTOM_HTTPS_CERT` (more info [here](https://nginx.org/en/docs/http/configuring_https_servers.html#chains)). -You can reload the certificate(s) (e.g. : in case of a renewal) by sending the SIGHUP/HUP signal to the container bunkerized-nginx will catch the signal and send a reload order to nginx : +You can reload the certificate(s) (i.e., in case of a renewal) by sending a reload order to bunkerized-nginx. +Docker reload : ```shell docker kill --signal=SIGHUP my-container ``` +Swarm and Kubernetes reload (repeat for each node) : +```shell +$ curl http://node-local-ip:80/reload +``` + +Linux reload : +```shell +$ /usr/sbin/nginx -s reload +``` + ### Self-signed certificate This method is not recommended in production but can be used to quickly deploy HTTPS for testing purposes. Just use the `GENERATE_SELF_SIGNED_SSL=yes` environment variable and bunkerized-nginx will generate a self-signed certificate for you : @@ -74,17 +85,17 @@ $ docker run -p 80:8080 \ Some important HTTP headers related to client security are sent with a default value. Sometimes it can break a web application or can be tuned to provide even more security. The complete list is available [here](https://bunkerized-nginx.readthedocs.io/en/latest/environment_variables.html#security-headers). -You can also remove headers (e.g. : too verbose ones) by using the `REMOVE_HEADERS` environment variable which takes a list of header name separated with space (default value = `Server X-Powered-By X-AspNet-Version X-AspNetMvc-Version`). +You can also remove headers (e.g., too verbose ones) by using the `REMOVE_HEADERS` environment variable which takes a list of header name separated with space (default value = `Server X-Powered-By X-AspNet-Version X-AspNetMvc-Version`). ## ModSecurity ModSecurity is integrated and enabled by default alongside the OWASP Core Rule Set within bunkerized-nginx. To change this behaviour you can use the `USE_MODSECURITY=no` or `USE_MODSECURITY_CRS=no` environment variables. -We strongly recommend to keep both ModSecurity and the OWASP Core Rule Set enabled. The only downsides are the false positives that may occur. But they can be fixed easily and the CRS team maintains a list of exclusions for common application (e.g : wordpress, nextcloud, drupal, cpanel, ...). +We strongly recommend to keep both ModSecurity and the OWASP Core Rule Set enabled. The only downsides are the false positives that may occur. But they can be fixed easily and the CRS team maintains a list of exclusions for common application (e.g., wordpress, nextcloud, drupal, cpanel, ...). -Tuning the CRS with bunkerized-nginx is pretty simple : you can add configuration before (i.e. : exclusions) and after (i.e. : exceptions/tuning) the rules are loaded. You just need to mount your .conf files into the /modsec-crs-confs (before CRS is loaded) and /modsec-confs (after CRS is loaded). +Tuning the CRS with bunkerized-nginx is pretty simple : you can add configuration before and after the rules are loaded. You just need to mount your .conf files into the `/modsec-crs-confs` (before CRS is loaded) and `/modsec-confs` (after CRS is loaded) volumes. If you are using Linux integration the [special folders](https://bunkerized-nginx.readthedocs.io/en/dev/special_folders.html) are `/opt/bunkerized-nginx/modsec-confs` and `/opt/bunkerized-nginx/modsec-crs-confs`. -Here is an example to illustrate it : +Here is a Docker example to illustrate it : ```shell $ cat /data/exclusions-crs/wordpress.conf @@ -122,7 +133,7 @@ That kind of security measure is implemented and enabled by default in bunkerize ## Antibot challenge -Attackers will certainly use automated tools to exploit/find some vulnerabilities on your web service. One countermeasure is to challenge the users to detect if it looks like a bot. It might be effective against script kiddies or "lazy" attackers. +Attackers will certainly use automated tools to exploit/find some vulnerabilities on your web services. One countermeasure is to challenge the users to detect if they look like a bot. It might be effective against script kiddies or "lazy" attackers. You can use the `USE_ANTIBOT` environment variable to add that kind of checks whenever a new client is connecting. The available challenges are : `cookie`, `javascript`, `captcha` and `recaptcha`. More info [here](https://bunkerized-nginx.readthedocs.io/en/latest/environment_variables.html#antibot). @@ -132,15 +143,6 @@ You can use the `USE_ANTIBOT` environment variable to add that kind of checks wh Automatic checks on external DNS BlackLists are enabled by default with the `USE_DNSBL=yes` environment variable. The list of DNSBL zones is also configurable, you just need to edit the `DNSBL_LIST` environment variable which contains the following value by default `bl.blocklist.de problems.dnsbl.sorbs.net sbl.spamhaus.org xbl.spamhaus.org`. -### CrowdSec - -CrowdSec is not enabled by default because it's more than an external blacklists and needs some extra work to get it working. But bunkerized-nginx is fully working with CrowdSec, here are the related environment variables : -- `USE_CROWDSEC=no` : enable/disable CrowdSec checks before we authorize a client -- `CROWDSEC_HOST=` : full URL to your CrowdSec instance API -- `CROWDSEC_KEY=` : bouncer key given from **cscli bouncer add MyBouncer** - -You will also need to share the logs generated by bunkerized-nginx with your CrowdSec instance. One approach is to send the logs to a syslog server which is writing the logs to the file system and then CrowdSec can easily read the logs. If you want to give it a try, you have a concrete example on how to use CrowdSec with bunkerized-nginx [here](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/crowdsec). - ### User-Agents Sometimes script kiddies or lazy attackers don't put a "legitimate" value inside the **User-Agent** HTTP header so we can block them. This is controlled with the `BLOCK_USER_AGENT=yes` environment variable. The blacklist is composed of two files from [here](https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/master/_generator_lists/bad-user-agents.list) and [here](https://raw.githubusercontent.com/JayBizzle/Crawler-Detect/master/raw/Crawlers.txt). @@ -169,7 +171,7 @@ This list contains bad referrers domains known for spamming (downloaded from [he ### Requests -To limit bruteforce attacks we decided to use the [rate limiting feature in nginx](https://www.nginx.com/blog/rate-limiting-nginx/) so attackers will be limited to X request(s)/s for the same resource. That kind of protection might be useful against other attacks too (e.g. : blind SQL injection). +To limit bruteforce attacks we decided to use the [rate limiting feature in nginx](https://www.nginx.com/blog/rate-limiting-nginx/) so attackers will be limited to X request(s)/s for the same resource. That kind of protection might be useful against other attacks too (e.g., blind SQL injection). Here is the list of related environment variables and their default value : - `USE_LIMIT_REQ=yes` : enable/disable request limiting @@ -217,47 +219,16 @@ Here is the list of related environment variables and their default value : - `USE_BLACKLIST_REVERSE=yes` : enable/disable blacklisting by reverse DNS - `BLACKLIST_REVERSE_LIST=.shodan.io` : the list of reverse DNS suffixes to never trust -## Web UI - -Mounting the docker socket in a container which is facing the network, like we do with the [web UI](https://bunkerized-nginx.readthedocs.io/en/latest/quickstart_guide.html#web-ui), is not a good security practice. In case of a vulnerability inside the application, attackers can freely use the Docker socket and the whole host can be compromised. - -A possible workaround is to use the [tecnativa/docker-socket-proxy](https://github.com/Tecnativa/docker-socket-proxy) image which acts as a reverse proxy between the application and the Docker socket. It can allow/deny the requests made to the Docker API. - -Before starting the web UI, you need to fire up the docker-socket-proxy (we also need a network because of inter-container communication) : - -```shell -docker network create mynet -``` - -```shell -docker run --name mysocketproxy \ - --network mynet \ - -v /var/run/docker.sock:/var/run/docker.sock:ro \ - -e POST=1 \ - -e CONTAINERS=1 \ - tecnativa/docker-socket-proxy -``` - -You can now start the web UI container and use the `DOCKER_HOST` environment variable to define the Docker API endpoint : - -```shell -docker run --network mynet \ - -v autoconf:/etc/nginx \ - -e ABSOLUTE_URI=https://my.webapp.com/admin/ \ - -e DOCKER_HOST=tcp://mysocketproxy:2375 \ - bunkerity/bunkerized-nginx-ui -``` - ## Plugins -Some security features can be added through the plugins system (e.g. : ClamAV). You will find more info in the [plugins section](https://bunkerized-nginx.readthedocs.io/en/latest/plugins.html). +Some security features can be added through the plugins system (e.g., ClamAV, CrowdSec, ...). You will find more info in the [plugins section](https://bunkerized-nginx.readthedocs.io/en/latest/plugins.html). ## Container hardening You will find a ready to use docker-compose.yml file focused on container hardening [here](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/hardened). ### Drop capabilities -By default, *bunkerized-nginx* runs as non-root user inside the container and should not use any of the default [capabilities](https://docs.docker.com/engine/security/#linux-kernel-capabilities) allowed by Docker. You can safely remove all capabilities to harden the container : +By default, bunkerized-nginx runs as non-root user inside the container and should not use any of the default [capabilities](https://docs.docker.com/engine/security/#linux-kernel-capabilities) allowed by Docker. You can safely remove all capabilities to harden the container : ```shell docker run ... --drop-cap=all ... bunkerity/bunkerized-nginx diff --git a/docs/special_folders.md b/docs/special_folders.md index 10c2fcd..2dfb6aa 100644 --- a/docs/special_folders.md +++ b/docs/special_folders.md @@ -1,10 +1,10 @@ # Special folders -Please note that bunkerized-nginx run as an unprivileged user (UID/GID 101 when using the Docker image) and you should set the rights on the host accordingly to the files and folders on your host. +Please note that bunkerized-nginx runs as an unprivileged user (UID/GID 101 when using the Docker image) and you should set the rights on the host accordingly to the files and folders on your host. ## Multisite -When the special folder "support" the multisite mode, you can create subfolders named as the server names used in the configuration. When doing it only the subfolder files will be "used" by the corresponding web service. +When the special folder "supports" the multisite mode, you can create subfolders named as the server names used in the configuration. When doing it only the subfolder files will be "used" by the corresponding web service. ## Web files @@ -16,8 +16,8 @@ Multisite : `yes` Read-only : `yes` Examples : -- [TODO basic single](#TODO) -- [TODO advanced multi](#TODO) +- [Basic website with PHP](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/basic-website-with-php) +- [Multisite basic](https://github.com/bunkerity/bunkerized-nginx/blob/master/examples/multisite-basic) ## http configurations @@ -29,7 +29,7 @@ Multisite : `no` Read-only : `yes` Examples : -- [TODO](#TODO) +- [Load balancer](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/load-balancer) ## server configurations @@ -41,8 +41,8 @@ Multisite : `yes` Read-only : `yes` Examples : -- [TODO basic single](#TODO) -- [TODO advanced multi](#TODO) +- [Wordpress](https://github.com/bunkerity/bunkerized-nginx/blob/master/examples/wordpress) +- [Multisite custom confs](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/multisite-custom-confs) ## ModSecurity configurations @@ -54,8 +54,8 @@ Multisite : `yes` Read-only : `yes` Examples : -- [TODO basic single](#TODO) -- [TODO advanced multi](#TODO) +- [Wordpress](https://github.com/bunkerity/bunkerized-nginx/blob/master/examples/wordpress) +- [Multisite custom confs](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/multisite-custom-confs) ## CRS configurations @@ -67,8 +67,8 @@ Multisite : `yes` Read-only : `yes` Examples : -- [TODO basic single](#TODO) -- [TODO advanced multi](#TODO) +- [Wordpress](https://github.com/bunkerity/bunkerized-nginx/blob/master/examples/wordpress) +- [Multisite custom confs](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/multisite-custom-confs) ## Cache @@ -81,7 +81,7 @@ Read-only : `no` ## Plugins -This special folder is the placeholder for the plugins loaded by bunkerized-nginx. See the [plugin section](#TODO) for more information. +This special folder is the placeholder for the plugins loaded by bunkerized-nginx. See the [plugins section](https://bunkerized-nginx.readthedocs.io/en/latest/plugins.html) for more information. Location (container) : `/plugins` Location (Linux) : `/opt/bunkerized-nginx/plugins` diff --git a/docs/volumes.md b/docs/volumes.md deleted file mode 100644 index 7f57bb9..0000000 --- a/docs/volumes.md +++ /dev/null @@ -1,93 +0,0 @@ -# Volumes list - -Please note that bunkerized-nginx run as an unprivileged user inside the container (UID/GID = 101) and you should set the rights on the host accordingly (e.g. : chmod 101:101 ...) to the files and folders on your host. - -## Web files - -Mountpoint : `/www` - -Description : -If `MULTISITE=no`, the web files are directly stored inside the `/www` folder. When `MULTISITE=yes`, you need to create subdirectories named as the servers defined in the `SERVER_NAME` environment variable. - -Examples : [basic](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/basic-website-with-php) and [multisite](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/multisite-basic) - -Read-only : yes - -## Let's Encrypt - -Mountpoint : `/etc/letsencrypt` - -Description : -When `AUTO_LETS_ENCRYPT=yes`, certbot will save configurations, certificates and keys inside the `/etc/letsencrypt` folder. It's a common practise to save it so you can remount it in case of a container restart and certbot won't generate new certificate(s). - -Examples : [here](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/basic-website-with-php) - -Read-only : no - -## Custom nginx configurations - -### http context - -Mountpoint : `/http-confs` - -Description : -If you need to add custom configurations at http context, you can create **.conf** files and mount them to the `/http-confs` folder. - -Examples : [load balancer](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/load-balancer) - -Read-only : yes - -### server context - -Mountpoint : `/server-confs` - -Description : -If `MULTISITE=no`, you can create **.conf** files and mount them to the `/server-confs` folder. When `MULTISITE=yes`, you need to create subdirectories named as the servers defined in the `SERVER_NAME` environment variable. - -Examples : [nextcloud](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/nextcloud) and [multisite](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/multisite-custom-server-confs) - -Read-only : yes - -## ModSecurity - -### Rules and before CRS - -Mountpoint : `/modsec-confs` - -Description : -Use this volume if you need to add custom ModSecurity rules and/or OWASP Core Rule Set configurations before the rules are loaded (e.g. : exclusions). -If `MULTISITE=no` you can create **.conf** files and mount them to the `/modsec-confs` folder. When `MULTISITE=yes`, you need to create subdirectories named as the servers defined in the `SERVER_NAME` environment variable. You can also apply global configuration to all servers by putting **.conf** files directly on the root folder. - -Examples : [wordpress](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/wordpress) and [multisite](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/multisite-custom-server-confs) - -Read-only : yes - -### After CRS - -Mountpoint : `/modsec-crs-confs` - -Description : -Use this volume to tweak OWASP Core Rule Set (e.g. : tweak rules to avoid false positives). Your files are loaded after the rules. -If `MULTISITE=no` you can create **.conf** files and mount them to the `/modsec-crs-confs` folder. When `MULTISITE=yes`, you need to create subdirectories named as the servers defined in the `SERVER_NAME` environment variable. You can also apply global configuration to all servers by putting **.conf** files directly on the root folder. - -Examples : [wordpress](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/wordpress) and [multisite](https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/multisite-custom-server-confs) - -Read-only : yes - -## Cache - -Mountpoint : `/cache` - -Description : -Depending of the settings you use, bunkerized-nginx may download external content (e.g. : blacklists, GeoIP DB, ...). To avoid downloading it again in case of a container restart, you can save the data on the host. - -Read-only : no - -## Plugins - -Mountpoint : `/plugins` - -Description : -This volume is used to extend bunkerized-nginx with [additional plugins](https://bunkerized-nginx.readthedocs.io/en/latest/plugins.html). Please note that you will need to have a subdirectory for each plugin you want to enable. - -Read-only : yes diff --git a/docs/web_ui.md b/docs/web_ui.md index b93caf9..fd08f5f 100644 --- a/docs/web_ui.md +++ b/docs/web_ui.md @@ -12,12 +12,11 @@ The web UI has its own set of environment variables to configure it : - `API_URI` : path of the bunkerized-nginx API (must match the corresponding `API_URI` of the bunkerized-nginx instance) - `DOCKER_HOST` : Docker API endpoint address (default = `unix:///var/run/docker.sock`) -The deployment should be very easy because the web UI is web a service itself so we can use bunkerized-nginx as a reverse proxy in front of it. +Since the web UI is ia service itself, we can use bunkerized-nginx as a reverse proxy in front of it. -** -Using the web UI in a Docker environment (containers, autoconf or Swarm) exposes a security risk because you need to mount the Docker API socket into the web UI container. It's highly recommended to use a middleware like [tecnativa/docker-socket-proxy](https://github.com/Tecnativa/docker-socket-proxy) to reduce the risk as much as possible. -Extra security steps still needs to be done like : complex admin password, hard to guess public URI, network isolation from others services, HTTPS only, ... -** +**Using the web UI in a Docker environment exposes a security risk because you need to mount the Docker API socket into the web UI container. It's highly recommended to use a middleware like [tecnativa/docker-socket-proxy](https://github.com/Tecnativa/docker-socket-proxy) to reduce the risk as much as possible.** + +**You need to apply the security best practices because the web UI contains code and that code might be vulnerable : complex admin password, hard to guess public URI, network isolation from others services, HTTPS only, ...** ### Docker diff --git a/helpers/install.sh b/helpers/install.sh index 53b3fab..a96471f 100755 --- a/helpers/install.sh +++ b/helpers/install.sh @@ -604,12 +604,7 @@ do_and_check_cmd wget -O "/tmp/bunkerized-nginx/nginx-${NGINX_VERSION}.tar.gz" " do_and_check_cmd wget -O "/tmp/bunkerized-nginx/nginx-${NGINX_VERSION}.tar.gz.asc" "https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz.asc" get_sign_source_keys > /tmp/bunkerized-nginx/nginx.key do_and_check_cmd gpg --import /tmp/bunkerized-nginx/nginx.key -check=$(gpg --verify /tmp/bunkerized-nginx/nginx-${NGINX_VERSION}.tar.gz.asc /tmp/bunkerized-nginx/nginx-${NGINX_VERSION}.tar.gz 2>&1 | grep "^gpg: Good signature from ") -if [ "$check" = "" ] ; then - echo "[!] Wrong signature from nginx source !!!" - cleanup - exit 1 -fi +do_and_check_cmd gpg --verify /tmp/bunkerized-nginx/nginx-${NGINX_VERSION}.tar.gz.asc /tmp/bunkerized-nginx/nginx-${NGINX_VERSION}.tar.gz CHANGE_DIR="/tmp/bunkerized-nginx" do_and_check_cmd tar -xvzf nginx-${NGINX_VERSION}.tar.gz # Compile dynamic modules