From 5776dbe1bf2f0e493901dd72f2853472e065d68a Mon Sep 17 00:00:00 2001 From: Bastian de Byl Date: Thu, 30 Jul 2026 13:00:51 -0400 Subject: [PATCH] UPS monitoring, Nextcloud cron, container image bumps ups role: NUT server on home.debyl.io for the CyberPower PR1500RT2U that backs both it and truenas.localdomain, with staged shutdown (TrueNAS sheds at t+2min, host at 10% charge) and best-effort IPMI power-on when mains returns. The 10% threshold leans on ignorelb + override.battery.charge.low rather than a custom poller, because CyberPower asserts its own low-battery flag far too early. Credentials come from vault vars; nothing sensitive is templated in the clear. Nextcloud background jobs: both instances have backgroundjobs_mode "cron", which expects an external caller every ~5 minutes, and nothing was calling. The personal instance had not run a background job since 2026-05-14 and skudak since 2024-11-20. Consequently trash and file versions never expired, stale chunked uploads accumulated, calendar reminders never fired, and nextcloud.log was never rotated -- which quietly made the existing log_rotate_size cap inert. Added a systemd timer per instance, skipping cleanly when the container is down or in maintenance so deploy windows don't show up as failed units. Trash retention on the personal instance: the default "auto" only expires when disk space demands it, so 66 GB of >30-day deletions sat on a host with 1.3 TB free -- effectively unbounded. "auto, 30" makes the 30-day expiry unconditional while still purging early under pressure. Image bumps: nextcloud 33.0.0 -> 34.0.2 (both cloud and skudak-cloud) greg-time-bot 3.9.25 -> 3.10.0 fulfillr 20260723.2044 -> 20260728.2155 (prod and dev) The fulfillr bump records what is already deployed: both containers were rolled to that image on 2026-07-29 for SCRUM-156 (digital product releases + customer update campaign). Committing it keeps the repo from claiming an older tag than the host is actually running, which would otherwise roll fulfillr backwards on the next clean-checkout deploy. Co-Authored-By: Claude Opus 5 (1M context) --- ansible/deploy_home.yml | 2 + .../podman/tasks/containers/cloud-cron.yml | 40 ++++++ .../podman/tasks/containers/home/cloud.yml | 20 +++ .../podman/tasks/containers/skudak/cloud.yml | 6 + ansible/roles/podman/tasks/main.yml | 10 +- .../templates/nextcloud/cloud-cron.service.j2 | 13 ++ .../templates/nextcloud/cloud-cron.sh.j2 | 51 +++++++ .../templates/nextcloud/cloud-cron.timer.j2 | 13 ++ ansible/roles/ups/README.md | 114 ++++++++++++++++ ansible/roles/ups/defaults/main.yml | 36 +++++ ansible/roles/ups/handlers/main.yml | 35 +++++ ansible/roles/ups/tasks/deps.yml | 7 + ansible/roles/ups/tasks/firewall.yml | 12 ++ ansible/roles/ups/tasks/ipmi.yml | 68 +++++++++ ansible/roles/ups/tasks/main.yml | 5 + ansible/roles/ups/tasks/nut.yml | 129 ++++++++++++++++++ ansible/roles/ups/templates/nut.conf.j2 | 3 + .../roles/ups/templates/truenas-power.sh.j2 | 34 +++++ .../ups/templates/ups-restore.service.j2 | 13 ++ ansible/roles/ups/templates/ups-restore.sh.j2 | 63 +++++++++ .../roles/ups/templates/ups-sched-cmd.sh.j2 | 14 ++ ansible/roles/ups/templates/ups.conf.j2 | 18 +++ ansible/roles/ups/templates/upsd.conf.j2 | 3 + ansible/roles/ups/templates/upsd.users.j2 | 11 ++ ansible/roles/ups/templates/upsmon.conf.j2 | 40 ++++++ ansible/roles/ups/templates/upssched.conf.j2 | 13 ++ ansible/vars/vault.yml | Bin 28629 -> 28629 bytes 27 files changed, 768 insertions(+), 5 deletions(-) create mode 100644 ansible/roles/podman/tasks/containers/cloud-cron.yml create mode 100644 ansible/roles/podman/templates/nextcloud/cloud-cron.service.j2 create mode 100644 ansible/roles/podman/templates/nextcloud/cloud-cron.sh.j2 create mode 100644 ansible/roles/podman/templates/nextcloud/cloud-cron.timer.j2 create mode 100644 ansible/roles/ups/README.md create mode 100644 ansible/roles/ups/defaults/main.yml create mode 100644 ansible/roles/ups/handlers/main.yml create mode 100644 ansible/roles/ups/tasks/deps.yml create mode 100644 ansible/roles/ups/tasks/firewall.yml create mode 100644 ansible/roles/ups/tasks/ipmi.yml create mode 100644 ansible/roles/ups/tasks/main.yml create mode 100644 ansible/roles/ups/tasks/nut.yml create mode 100644 ansible/roles/ups/templates/nut.conf.j2 create mode 100644 ansible/roles/ups/templates/truenas-power.sh.j2 create mode 100644 ansible/roles/ups/templates/ups-restore.service.j2 create mode 100644 ansible/roles/ups/templates/ups-restore.sh.j2 create mode 100644 ansible/roles/ups/templates/ups-sched-cmd.sh.j2 create mode 100644 ansible/roles/ups/templates/ups.conf.j2 create mode 100644 ansible/roles/ups/templates/upsd.conf.j2 create mode 100644 ansible/roles/ups/templates/upsd.users.j2 create mode 100644 ansible/roles/ups/templates/upsmon.conf.j2 create mode 100644 ansible/roles/ups/templates/upssched.conf.j2 diff --git a/ansible/deploy_home.yml b/ansible/deploy_home.yml index a40b77e..cc2064d 100644 --- a/ansible/deploy_home.yml +++ b/ansible/deploy_home.yml @@ -11,3 +11,5 @@ - role: github-actions - role: graylog-config tags: graylog-config + - role: ups + tags: ups diff --git a/ansible/roles/podman/tasks/containers/cloud-cron.yml b/ansible/roles/podman/tasks/containers/cloud-cron.yml new file mode 100644 index 0000000..1502453 --- /dev/null +++ b/ansible/roles/podman/tasks/containers/cloud-cron.yml @@ -0,0 +1,40 @@ +--- +- name: template {{ cron_name }} cron script + become: true + ansible.builtin.template: + src: nextcloud/cloud-cron.sh.j2 + dest: "{{ cron_script_path }}" + owner: root + group: root + mode: 0755 + setype: bin_t + +- name: template {{ cron_name }} cron systemd service + become: true + ansible.builtin.template: + src: nextcloud/cloud-cron.service.j2 + dest: "/etc/systemd/system/{{ cron_name }}-cron.service" + owner: root + group: root + mode: 0644 + vars: + instance_name: "{{ cron_name }}" + +- name: template {{ cron_name }} cron systemd timer + become: true + ansible.builtin.template: + src: nextcloud/cloud-cron.timer.j2 + dest: "/etc/systemd/system/{{ cron_name }}-cron.timer" + owner: root + group: root + mode: 0644 + vars: + instance_name: "{{ cron_name }}" + +- name: enable and start {{ cron_name }} cron timer + become: true + ansible.builtin.systemd: + name: "{{ cron_name }}-cron.timer" + enabled: true + state: started + daemon_reload: true diff --git a/ansible/roles/podman/tasks/containers/home/cloud.yml b/ansible/roles/podman/tasks/containers/home/cloud.yml index 23a2824..f67062e 100644 --- a/ansible/roles/podman/tasks/containers/home/cloud.yml +++ b/ansible/roles/podman/tasks/containers/home/cloud.yml @@ -96,6 +96,26 @@ changed_when: "'System config value log_rotate_size' in cloud_log_rotate.stdout" failed_when: false +# Nextcloud's default ('auto') only expires trash when disk space is needed, +# so 66 GB of >30-day deletions sat untouched on a host with 1.3 TB free -- +# the retention was effectively unbounded. 'auto, 30' makes the 30-day +# expiry unconditional while still purging early under space pressure. +- name: set nextcloud trashbin retention for cloud + become: true + become_user: "{{ podman_user }}" + ansible.builtin.command: > + podman exec -u www-data cloud + php occ config:system:set trashbin_retention_obligation --value "auto, 30" + register: cloud_trashbin_retention + changed_when: "'System config value trashbin_retention_obligation' in cloud_trashbin_retention.stdout" + failed_when: false + +- include_tasks: containers/cloud-cron.yml + vars: + cron_name: cloud + cron_container: cloud + cron_script_path: /usr/local/bin/cloud-cron.sh + - include_tasks: containers/cloud-backup.yml vars: backup_name: cloud diff --git a/ansible/roles/podman/tasks/containers/skudak/cloud.yml b/ansible/roles/podman/tasks/containers/skudak/cloud.yml index 1175948..9fe2d2f 100644 --- a/ansible/roles/podman/tasks/containers/skudak/cloud.yml +++ b/ansible/roles/podman/tasks/containers/skudak/cloud.yml @@ -155,6 +155,12 @@ changed_when: "'System config value log_rotate_size' in skudak_log_rotate.stdout" failed_when: false +- include_tasks: containers/cloud-cron.yml + vars: + cron_name: skudak-cloud + cron_container: skudak-cloud + cron_script_path: /usr/local/bin/skudak-cloud-cron.sh + - include_tasks: containers/cloud-backup.yml vars: backup_name: skudak-cloud diff --git a/ansible/roles/podman/tasks/main.yml b/ansible/roles/podman/tasks/main.yml index a981a85..cca4d9b 100644 --- a/ansible/roles/podman/tasks/main.yml +++ b/ansible/roles/podman/tasks/main.yml @@ -67,24 +67,24 @@ - import_tasks: containers/home/cloud.yml vars: db_image: docker.io/library/mariadb:10.6 - image: docker.io/library/nextcloud:33.0.0-apache + image: docker.io/library/nextcloud:34.0.2-apache tags: cloud - import_tasks: containers/skudak/cloud.yml vars: db_image: docker.io/library/mariadb:10.6 - image: docker.io/library/nextcloud:33.0.0-apache + image: docker.io/library/nextcloud:34.0.2-apache tags: skudak, skudak-cloud - import_tasks: containers/debyltech/fulfillr.yml vars: - image: git.debyl.io/debyltech/fulfillr:20260723.2044 + image: git.debyl.io/debyltech/fulfillr:20260728.2155 tags: debyltech, fulfillr # Staging back-office (fulfillr-dev.debyltech.com) — same image, staging Turso config. - import_tasks: containers/debyltech/fulfillr-dev.yml vars: - image: git.debyl.io/debyltech/fulfillr:20260723.2044 + image: git.debyl.io/debyltech/fulfillr:20260728.2155 tags: debyltech, fulfillr-dev - import_tasks: containers/debyltech/uptime-kuma.yml @@ -109,7 +109,7 @@ - import_tasks: containers/home/gregtime.yml vars: - image: localhost/greg-time-bot:3.9.25 + image: localhost/greg-time-bot:3.10.0 tags: gregtime - import_tasks: containers/home/zomboid.yml diff --git a/ansible/roles/podman/templates/nextcloud/cloud-cron.service.j2 b/ansible/roles/podman/templates/nextcloud/cloud-cron.service.j2 new file mode 100644 index 0000000..27bb1f0 --- /dev/null +++ b/ansible/roles/podman/templates/nextcloud/cloud-cron.service.j2 @@ -0,0 +1,13 @@ +[Unit] +Description=Nextcloud {{ instance_name }} background jobs +After=network-online.target +Wants=network-online.target + +[Service] +Type=oneshot +ExecStart={{ cron_script_path }} +# Type=oneshot disables the start timeout by default, so a wedged cron.php +# would leave the unit "activating" forever and every subsequent 5-minute +# trigger would be silently skipped. Bound it. +TimeoutStartSec={{ cron_timeout | default('30m') }} +Nice=10 diff --git a/ansible/roles/podman/templates/nextcloud/cloud-cron.sh.j2 b/ansible/roles/podman/templates/nextcloud/cloud-cron.sh.j2 new file mode 100644 index 0000000..672dbd1 --- /dev/null +++ b/ansible/roles/podman/templates/nextcloud/cloud-cron.sh.j2 @@ -0,0 +1,51 @@ +#!/bin/bash +# {{ ansible_managed }} +# Nextcloud "{{ cron_name }}" background jobs (cron.php). +# +# backgroundjobs_mode is "cron" on both instances, which means Nextcloud +# expects an external caller to run cron.php every ~5 minutes. Nothing was: +# the personal instance had not run a background job since 2026-05-14 and +# skudak since 2024-11-20. Without it Nextcloud never expires trash or file +# versions, never cleans stale chunked uploads, never sends calendar +# reminders, and -- easy to miss -- never rotates nextcloud.log, which makes +# the log_rotate_size cap set in containers/*/cloud.yml inert. +set -euo pipefail + +TAG=nextcloud-cron +INSTANCE={{ cron_name }} + +log() { logger -t "$TAG" -p daemon.info -- "instance=$INSTANCE $*"; } +fail() { logger -t "$TAG" -p daemon.err -- "instance=$INSTANCE status=failed $*" + echo "$TAG: FAILED: $*" >&2; exit 1; } + +# The Nextcloud containers are ROOTLESS podman owned by "{{ podman_user }}", +# but this script runs as root under systemd. Same sudo/cd/XDG_RUNTIME_DIR +# preamble as cloud-backup.sh -- see CLAUDE.md for why `cd;` is required. +pexec() { + sudo -H -u {{ podman_user }} bash -c \ + 'cd; d=/run/user/$(id -u); [ -d "$d" ] && export XDG_RUNTIME_DIR="$d" + exec podman "$@"' _ "$@" +} + +# A container that is down (deploy, image bump, host reboot) is not a failure +# worth flagging -- the next tick picks it up five minutes later. +if ! pexec container exists {{ cron_container }} 2>/dev/null; then + log "status=skipped reason=container-absent" + exit 0 +fi + +# occ and cron.php both refuse to do anything useful mid-upgrade. Skipping +# keeps a deploy window from parading as a run of failed units. +if pexec exec -u www-data {{ cron_container }} php occ status 2>/dev/null \ + | grep -q 'maintenance: true'; then + log "status=skipped reason=maintenance" + exit 0 +fi + +set +e +pexec exec -u www-data {{ cron_container }} php -f /var/www/html/cron.php +rc=$? +set -e +[ "$rc" -eq 0 ] || fail "cron.php exited $rc" + +log "status=ok" diff --git a/ansible/roles/podman/templates/nextcloud/cloud-cron.timer.j2 b/ansible/roles/podman/templates/nextcloud/cloud-cron.timer.j2 new file mode 100644 index 0000000..cf1d9a5 --- /dev/null +++ b/ansible/roles/podman/templates/nextcloud/cloud-cron.timer.j2 @@ -0,0 +1,13 @@ +[Unit] +Description=Nextcloud {{ instance_name }} background jobs every 5 minutes + +[Timer] +OnBootSec={{ cron_onbootsec | default('5m') }} +OnUnitActiveSec={{ cron_interval | default('5m') }} +RandomizedDelaySec={{ cron_randomized_delay | default('30s') }} +# Deliberately NOT Persistent: this runs every 5 minutes, so replaying runs +# missed while the host was off buys nothing and just stampedes at boot. +Persistent=false + +[Install] +WantedBy=timers.target diff --git a/ansible/roles/ups/README.md b/ansible/roles/ups/README.md new file mode 100644 index 0000000..0b402ad --- /dev/null +++ b/ansible/roles/ups/README.md @@ -0,0 +1,114 @@ +# ups + +UPS monitoring and staged shutdown for the home rack. + +A CyberPower PR1500RT2U (`0764:0601`) is cabled by USB to `home.debyl.io` and +backs both that host and `truenas.localdomain` (Dell PowerEdge R415). This role +makes `home.debyl.io` the NUT server and gives it the ability to power TrueNAS +back on over IPMI. + +## Outage sequence + +| When | What happens | Driven by | +| --- | --- | --- | +| t+0 | UPS goes on battery, `ONBATT` logged to journald → Graylog | `upsmon` | +| t+2min | TrueNAS shuts itself down cleanly, shedding ~200 W | TrueNAS UPS service, Slave mode, `Shutdown Timer 120` | +| 10% charge | `home.debyl.io` shuts itself down and tells the UPS to cut its output | `upsmon` `SHUTDOWNCMD` + `/lib/systemd/system-shutdown/nutshutdown` | +| mains returns | UPS re-energizes; both machines power themselves back up | R415 `always-on` restore policy; `home.debyl.io` BIOS *After Power Loss → Power On* | +| mains back +5min | Best-effort IPMI power-on, if a dedicated iDRAC is ever fitted | `upssched` → `ups-restore.sh` | +| host boot | Same restore check, for the deep-drain case | `ups-restore.service` | + +The 10% threshold is not a custom poller. CyberPower asserts its own low-battery +flag around 20–35%, so `ups.conf` sets `ignorelb` plus +`override.battery.charge.low`, and stock `upsmon` fires at exactly the +configured percentage. + +Likewise, the 2-minute TrueNAS shed is TrueNAS's own native "shutdown timer" +setting — no SSH key and no shutdown script from this side. + +## Powering TrueNAS back on + +Neither Wake-on-LAN nor IPMI works on this box today, so restore is done with +the chassis power restore policy instead. + +**Wake-on-LAN is out.** `bce0` advertises no WOL capability (`ifconfig -m bce0` +has no `WOL_MAGIC`) and both NICs are bonded into an LACP `lagg0`. + +**IPMI is out too, for now.** The iDRAC is in `shared / LOM1` mode and the +Enterprise card that would provide a dedicated management port is not fitted: + +``` +$ ipmitool sdr elist | grep -i idrac +iDRAC6 Ent Pres | 70h | ok | 7.1 | Absent +``` + +A shared-LOM iDRAC6 Express has no standby power. Measured directly: with the +chassis powered off the BMC does not even answer ARP, and it only reappears +~200s into POST, at the moment the host brings the NIC link up. That is a +hardware limitation, not a switch or BIOS problem. + +**So restore works like this instead.** `ipmitool chassis policy always-on` is +set on the R415. On a deep outage `home.debyl.io` halts at 10% and NUT's +shutdown hook tells the UPS to cut its output; when mains returns the UPS +re-energizes, the R415 sees AC and boots itself. + +The gap is the medium outage — mains returns after TrueNAS has shed but before +the battery reaches 10%. The UPS never cuts power, so TrueNAS stays off and +needs a manual power button press. Fitting a used iDRAC6 Enterprise card and +running `ipmitool delloem lan set dedicated` (plus a cable to the dedicated +port) closes that gap, and `ups-restore.sh` starts working with no code +changes — it is already deployed and simply logs and exits while the BMC is +unreachable. + +## One-time setup outside Ansible + +These are not managed by this role. + +**iDRAC (already done, via `ipmitool` on TrueNAS):** + +``` +ipmitool lan set 1 ipsrc static +ipmitool lan set 1 ipaddr 192.168.1.12 +ipmitool lan set 1 netmask 255.255.255.0 +ipmitool lan set 1 defgw ipaddr 192.168.1.1 +ipmitool lan set 1 access on # was disabled - nothing answers without this +ipmitool channel setaccess 1 2 callin=on ipmi=on link=on privilege=4 +ipmitool user set password 2 '' +ipmitool chassis policy always-on # this is what restores power after an outage +``` + +`idrac_password` is also the iDRAC web UI password for `root` - they share a +user database. + +**TrueNAS UI → Services → UPS** (enable + start automatically): + +| Field | Value | +| --- | --- | +| UPS Mode | Slave | +| Remote Host | `192.168.1.10` | +| Remote Port | `3493` | +| Identifier | `cyberpower` | +| Monitor User | `truenas` | +| Monitor Password | vault `nut_truenas_password` | +| Shutdown Mode | UPS goes on battery | +| Shutdown Timer | `120` | +| Shutdown Command | `/sbin/shutdown -p now` | +| Power Off UPS | unchecked | + +**BIOS on `home.debyl.io`** (Lenovo 10MR0004US): Power → *After Power Loss* → +**Power On**. On a full drain the NUT shutdown hook +(`/lib/systemd/system-shutdown/nutshutdown`) tells the UPS to cut its own +output; this BIOS setting is what brings the host back when mains returns. + +## Vault keys + +`nut_upsmon_password`, `nut_truenas_password`, `idrac_password` + +## Operating + +``` +upsc cyberpower # full UPS status +upsc cyberpower battery.charge +sudo /usr/local/bin/truenas-power.sh status|on|soft|off +journalctl -t ups-restore -t ups-sched +``` diff --git a/ansible/roles/ups/defaults/main.yml b/ansible/roles/ups/defaults/main.yml new file mode 100644 index 0000000..b8d8408 --- /dev/null +++ b/ansible/roles/ups/defaults/main.yml @@ -0,0 +1,36 @@ +--- +# CyberPower PR1500LCDRT2U cabled by USB to this host (0764:0601). +# This host is the NUT server; truenas.localdomain is a NUT slave. +ups_name: cyberpower +# lsusb reports the product string as PR1500LCDRT2U, but the device itself +# reports device.model CP1500PFCRM2U. The latter is what it actually is. +ups_desc: CyberPower CP1500PFCRM2U +ups_vendorid: "0764" +ups_productid: "0601" + +ups_listen_addr: 192.168.1.10 +ups_listen_port: 3493 + +# truenas.localdomain - the only host allowed to reach upsd +ups_slave_ip: 192.168.1.11 + +# Battery charge at which THIS host shuts itself down. TrueNAS sheds much +# earlier via its own "shutdown timer" setting (see roles/ups/README.md). +ups_low_charge_pct: 10 + +# Seconds of stable mains after ONLINE before TrueNAS is powered back on. +ups_restore_stable_secs: 300 + +# R415 iDRAC6. Shares LOM1 with bce0. +idrac_host: 192.168.1.12 +idrac_user: root + +ups_deps: + [ + ipmitool, + nut, + nut-client, + ] + +# Secrets live in ansible/vars/vault.yml (no vault_ prefix, per repo +# convention): nut_upsmon_password, nut_truenas_password, idrac_password diff --git a/ansible/roles/ups/handlers/main.yml b/ansible/roles/ups/handlers/main.yml new file mode 100644 index 0000000..e2af69c --- /dev/null +++ b/ansible/roles/ups/handlers/main.yml @@ -0,0 +1,35 @@ +--- +# Regenerates the nut-driver@ unit instances from ups.conf. Oneshot, +# so "restarted" just means "run it again". +- name: reload nut driver units + become: true + ansible.builtin.systemd: + name: nut-driver-enumerator.service + state: restarted + daemon_reload: true + +# The enumerator only writes unit definitions; it will not pick up changed +# driver options in an already-running driver. Restart the instance itself. +- name: restart nut driver + become: true + ansible.builtin.systemd: + name: "nut-driver@{{ ups_name }}.service" + state: restarted + +- name: restart nut server + become: true + ansible.builtin.systemd: + name: nut-server.service + state: restarted + +- name: restart nut monitor + become: true + ansible.builtin.systemd: + name: nut-monitor.service + state: restarted + +- name: restart firewalld + become: true + ansible.builtin.systemd: + name: firewalld + state: restarted diff --git a/ansible/roles/ups/tasks/deps.yml b/ansible/roles/ups/tasks/deps.yml new file mode 100644 index 0000000..2c640ce --- /dev/null +++ b/ansible/roles/ups/tasks/deps.yml @@ -0,0 +1,7 @@ +--- +- name: install NUT and ipmitool + become: true + ansible.builtin.dnf: + name: "{{ ups_deps }}" + state: present + tags: ups diff --git a/ansible/roles/ups/tasks/firewall.yml b/ansible/roles/ups/tasks/firewall.yml new file mode 100644 index 0000000..1004ef0 --- /dev/null +++ b/ansible/roles/ups/tasks/firewall.yml @@ -0,0 +1,12 @@ +--- +- name: allow NUT from the truenas slave only + become: true + ansible.posix.firewalld: + rich_rule: >- + rule family="ipv4" source address="{{ ups_slave_ip }}/32" + port port="{{ ups_listen_port }}" protocol="tcp" accept + permanent: true + immediate: true + state: enabled + notify: restart firewalld + tags: [ups, firewall] diff --git a/ansible/roles/ups/tasks/ipmi.yml b/ansible/roles/ups/tasks/ipmi.yml new file mode 100644 index 0000000..0a1518b --- /dev/null +++ b/ansible/roles/ups/tasks/ipmi.yml @@ -0,0 +1,68 @@ +--- +# IPMI power control for truenas.localdomain (Dell R415, iDRAC6). +# WOL is not an option there: bce0 advertises no WOL capability and is an +# LACP lagg member, so IPMI is the only remote power-on path. + +- name: deploy iDRAC credential + become: true + ansible.builtin.copy: + content: "{{ idrac_password }}\n" + dest: /etc/ups/idrac.pw + owner: root + group: nut + mode: '0640' + no_log: true + tags: ups + +- name: deploy truenas power helper + become: true + ansible.builtin.template: + src: truenas-power.sh.j2 + dest: /usr/local/bin/truenas-power.sh + owner: root + group: root + mode: '0755' + setype: bin_t + tags: ups + +- name: deploy truenas restore script + become: true + ansible.builtin.template: + src: ups-restore.sh.j2 + dest: /usr/local/bin/ups-restore.sh + owner: root + group: root + mode: '0755' + setype: bin_t + tags: ups + +- name: deploy upssched command dispatcher + become: true + ansible.builtin.template: + src: ups-sched-cmd.sh.j2 + dest: /usr/local/bin/ups-sched-cmd.sh + owner: root + group: root + mode: '0755' + setype: bin_t + tags: ups + +# Covers the deep-drain case: if the battery ran out, this host was itself +# powered off when mains returned, so nothing was running to restore TrueNAS. +- name: deploy boot-time truenas restore unit + become: true + ansible.builtin.template: + src: ups-restore.service.j2 + dest: /etc/systemd/system/ups-restore.service + owner: root + group: root + mode: '0644' + tags: ups + +- name: enable boot-time truenas restore unit + become: true + ansible.builtin.systemd: + name: ups-restore.service + enabled: true + daemon_reload: true + tags: ups diff --git a/ansible/roles/ups/tasks/main.yml b/ansible/roles/ups/tasks/main.yml new file mode 100644 index 0000000..bf19bd2 --- /dev/null +++ b/ansible/roles/ups/tasks/main.yml @@ -0,0 +1,5 @@ +--- +- import_tasks: deps.yml +- import_tasks: nut.yml +- import_tasks: ipmi.yml +- import_tasks: firewall.yml diff --git a/ansible/roles/ups/tasks/nut.yml b/ansible/roles/ups/tasks/nut.yml new file mode 100644 index 0000000..3f86819 --- /dev/null +++ b/ansible/roles/ups/tasks/nut.yml @@ -0,0 +1,129 @@ +--- +# NUT server. The UPS is on USB here, so this host drives it and serves +# status to truenas.localdomain over the network. + +- name: set NUT run mode to netserver + become: true + ansible.builtin.template: + src: nut.conf.j2 + dest: /etc/ups/nut.conf + owner: root + group: nut + mode: '0640' + notify: + - reload nut driver units + - restart nut driver + - restart nut server + - restart nut monitor + tags: ups + +- name: deploy NUT driver configuration + become: true + ansible.builtin.template: + src: ups.conf.j2 + dest: /etc/ups/ups.conf + owner: root + group: nut + mode: '0640' + notify: + - reload nut driver units + - restart nut driver + - restart nut server + tags: ups + +- name: deploy upsd listener configuration + become: true + ansible.builtin.template: + src: upsd.conf.j2 + dest: /etc/ups/upsd.conf + owner: root + group: nut + mode: '0640' + notify: restart nut server + tags: ups + +- name: deploy upsd users + become: true + ansible.builtin.template: + src: upsd.users.j2 + dest: /etc/ups/upsd.users + owner: root + group: nut + mode: '0640' + notify: + - restart nut server + - restart nut monitor + tags: ups + +- name: deploy upsmon configuration + become: true + ansible.builtin.template: + src: upsmon.conf.j2 + dest: /etc/ups/upsmon.conf + owner: root + group: nut + mode: '0640' + notify: restart nut monitor + tags: ups + +- name: deploy upssched configuration + become: true + ansible.builtin.template: + src: upssched.conf.j2 + dest: /etc/ups/upssched.conf + owner: root + group: nut + mode: '0640' + notify: restart nut monitor + tags: ups + +# The nut package ships /usr/lib/udev/rules.d/62-nut-usbups.rules, which +# hands the UPS USB device to the nut user. Reload and retrigger so the +# driver can claim it without physically replugging the UPS. +- name: reload udev rules for NUT USB access + become: true + ansible.builtin.command: + cmd: udevadm control --reload-rules + changed_when: false + tags: ups + +- name: retrigger UPS USB device + become: true + ansible.builtin.command: + cmd: >- + udevadm trigger --subsystem-match=usb + --attr-match=idVendor={{ ups_vendorid }} + changed_when: false + tags: ups + +# nut-driver-enumerator reads ups.conf and generates nut-driver@{{ ups_name }}. +# The .service is oneshot (so never "started" for long) and is triggered by +# the .path unit watching ups.conf - enable both, but only start the .path. +- name: enable NUT driver enumerator + become: true + ansible.builtin.systemd: + name: nut-driver-enumerator.service + enabled: true + daemon_reload: true + tags: ups + +- name: enable and start NUT driver enumerator path trigger + become: true + ansible.builtin.systemd: + name: nut-driver-enumerator.path + enabled: true + state: started + tags: ups + +- name: enable and start NUT services + become: true + ansible.builtin.systemd: + name: "{{ item }}" + enabled: true + state: started + loop: + - "nut-driver@{{ ups_name }}.service" + - nut-server.service + - nut-monitor.service + - nut.target + tags: ups diff --git a/ansible/roles/ups/templates/nut.conf.j2 b/ansible/roles/ups/templates/nut.conf.j2 new file mode 100644 index 0000000..d916a4c --- /dev/null +++ b/ansible/roles/ups/templates/nut.conf.j2 @@ -0,0 +1,3 @@ +# {{ ansible_managed }} +# netserver: run the driver + upsd locally and serve slaves over the network. +MODE=netserver diff --git a/ansible/roles/ups/templates/truenas-power.sh.j2 b/ansible/roles/ups/templates/truenas-power.sh.j2 new file mode 100644 index 0000000..310a189 --- /dev/null +++ b/ansible/roles/ups/templates/truenas-power.sh.j2 @@ -0,0 +1,34 @@ +#!/bin/bash +# {{ ansible_managed }} +# Remote power control for truenas.localdomain via the R415 iDRAC6. +# Usage: truenas-power.sh {status|on|soft|off|cycle} +set -euo pipefail + +PW_FILE=/etc/ups/idrac.pw + +if [ ! -r "$PW_FILE" ]; then + echo "cannot read $PW_FILE" >&2 + exit 1 +fi + +# -f keeps the password out of the process argument list. +ipmi() { + ipmitool -I lanplus -H {{ idrac_host }} -U {{ idrac_user }} \ + -f "$PW_FILE" "$@" +} + +case "${1:-status}" in + status) ipmi chassis power status ;; + on) ipmi chassis power on ;; + # ACPI soft-off. FreeBSD has hw.acpi.power_button_state=S5, so this is + # a clean TrueNAS shutdown. Normally unused: TrueNAS shuts itself down + # as a NUT slave. This is the manual escape hatch. + soft) ipmi chassis power soft ;; + # Hard cut, last resort only. + off) ipmi chassis power off ;; + cycle) ipmi chassis power cycle ;; + *) + echo "usage: $0 {status|on|soft|off|cycle}" >&2 + exit 2 + ;; +esac diff --git a/ansible/roles/ups/templates/ups-restore.service.j2 b/ansible/roles/ups/templates/ups-restore.service.j2 new file mode 100644 index 0000000..f8aeffd --- /dev/null +++ b/ansible/roles/ups/templates/ups-restore.service.j2 @@ -0,0 +1,13 @@ +# {{ ansible_managed }} +[Unit] +Description=Restore TrueNAS power after an outage +After=network-online.target nut-server.service nut-monitor.service +Wants=network-online.target +Requires=nut-server.service + +[Service] +Type=oneshot +ExecStart=/usr/local/bin/ups-restore.sh + +[Install] +WantedBy=multi-user.target diff --git a/ansible/roles/ups/templates/ups-restore.sh.j2 b/ansible/roles/ups/templates/ups-restore.sh.j2 new file mode 100644 index 0000000..666550a --- /dev/null +++ b/ansible/roles/ups/templates/ups-restore.sh.j2 @@ -0,0 +1,63 @@ +#!/bin/bash +# {{ ansible_managed }} +# Power truenas.localdomain back on after an outage, but only when it is +# genuinely safe to do so. Called by upssched once mains has been stable, +# and once at boot by ups-restore.service (deep-drain recovery). +# +# Deliberately stateless: we ask the iDRAC whether the chassis is off +# rather than tracking whether we were the ones who shut it down. A NAS +# powered off by hand while on mains is safe, because no ONLINE event +# fires in that case and the boot path checks UPS status first. +# +# NOTE: as of now this is a best-effort secondary path. The R415 has no +# iDRAC6 Enterprise card ("iDRAC6 Ent Pres ... Absent"), so its shared-LOM +# BMC has no standby power and goes unreachable whenever the chassis is +# off - exactly when we would want it. An unreachable iDRAC is therefore +# the EXPECTED case here, and we exit quietly rather than alarming. +# +# The primary restore path needs no IPMI: the R415 power restore policy is +# set to always-on, so when the UPS cuts and then restores its output the +# server powers itself back up. Fit an iDRAC6 Enterprise card and switch it +# to dedicated mode and this script starts working with no changes. +set -uo pipefail + +TAG=ups-restore +UPS={{ ups_name }}@localhost + +log() { logger -t "$TAG" -- "$*"; echo "$TAG: $*"; } + +# At boot, upsd may not be serving yet. Wait a bounded amount of time. +for _ in $(seq 1 30); do + if upsc "$UPS" ups.status >/dev/null 2>&1; then + break + fi + sleep 2 +done + +status=$(upsc "$UPS" ups.status 2>/dev/null || echo UNKNOWN) +if [[ "$status" != *OL* ]]; then + log "UPS status is '$status', not on line - refusing to power TrueNAS on" + exit 0 +fi + +power=$(/usr/local/bin/truenas-power.sh status 2>&1 || true) +case "$power" in + *"is off"*) + log "mains stable and chassis off - powering TrueNAS on" + if /usr/local/bin/truenas-power.sh on; then + log "power-on command accepted" + else + log "power-on command FAILED - check iDRAC at {{ idrac_host }}" + exit 1 + fi + ;; + *"is on"*) + log "TrueNAS already on, nothing to do" + ;; + *) + # Expected while the box has no iDRAC6 Enterprise card: the BMC is + # simply not on the network with the chassis powered down. + log "iDRAC at {{ idrac_host }} unreachable - relying on the" \ + "always-on power restore policy instead ($power)" + ;; +esac diff --git a/ansible/roles/ups/templates/ups-sched-cmd.sh.j2 b/ansible/roles/ups/templates/ups-sched-cmd.sh.j2 new file mode 100644 index 0000000..bf0cb90 --- /dev/null +++ b/ansible/roles/ups/templates/ups-sched-cmd.sh.j2 @@ -0,0 +1,14 @@ +#!/bin/bash +# {{ ansible_managed }} +# upssched CMDSCRIPT. Runs as the unprivileged nut user. +set -uo pipefail + +case "${1:-}" in + truenas-restore) + exec /usr/local/bin/ups-restore.sh + ;; + *) + logger -t ups-sched -- "unknown timer '${1:-}'" + exit 1 + ;; +esac diff --git a/ansible/roles/ups/templates/ups.conf.j2 b/ansible/roles/ups/templates/ups.conf.j2 new file mode 100644 index 0000000..b817d02 --- /dev/null +++ b/ansible/roles/ups/templates/ups.conf.j2 @@ -0,0 +1,18 @@ +# {{ ansible_managed }} + +[{{ ups_name }}] + driver = usbhid-ups + port = auto + vendorid = {{ ups_vendorid }} + productid = {{ ups_productid }} + desc = "{{ ups_desc }}" + # CyberPower asserts its own low-battery flag around 20-35%, far too + # early for us. Ignore it and derive LB from our own threshold so + # upsmon fires SHUTDOWNCMD at exactly {{ ups_low_charge_pct }}%. + ignorelb + override.battery.charge.low = {{ ups_low_charge_pct }} + # Unlock driver.killpower. Without this the driver refuses to cut UPS + # output at shutdown, and the R415's always-on power restore policy + # would never see AC drop and return - i.e. nothing comes back after a + # deep outage. See README.md. + allow_killpower diff --git a/ansible/roles/ups/templates/upsd.conf.j2 b/ansible/roles/ups/templates/upsd.conf.j2 new file mode 100644 index 0000000..2ce034e --- /dev/null +++ b/ansible/roles/ups/templates/upsd.conf.j2 @@ -0,0 +1,3 @@ +# {{ ansible_managed }} +LISTEN 127.0.0.1 {{ ups_listen_port }} +LISTEN {{ ups_listen_addr }} {{ ups_listen_port }} diff --git a/ansible/roles/ups/templates/upsd.users.j2 b/ansible/roles/ups/templates/upsd.users.j2 new file mode 100644 index 0000000..f070473 --- /dev/null +++ b/ansible/roles/ups/templates/upsd.users.j2 @@ -0,0 +1,11 @@ +# {{ ansible_managed }} + +# Local upsmon on this host. +[upsmon] + password = {{ nut_upsmon_password }} + upsmon master + +# truenas.localdomain, running the TrueNAS UPS service in Slave mode. +[truenas] + password = {{ nut_truenas_password }} + upsmon slave diff --git a/ansible/roles/ups/templates/upsmon.conf.j2 b/ansible/roles/ups/templates/upsmon.conf.j2 new file mode 100644 index 0000000..1fe98a7 --- /dev/null +++ b/ansible/roles/ups/templates/upsmon.conf.j2 @@ -0,0 +1,40 @@ +# {{ ansible_managed }} + +MONITOR {{ ups_name }}@localhost 1 upsmon {{ nut_upsmon_password }} master + +MINSUPPLIES 1 +SHUTDOWNCMD "/usr/bin/systemctl poweroff" +NOTIFYCMD /usr/bin/upssched + +# upsmon drops this file before halting; /lib/systemd/system-shutdown/nutshutdown +# reads it late in shutdown and, if present, tells the UPS to cut its output. +# That AC drop-and-return is what triggers the R415's always-on restore policy +# and this host's BIOS "After Power Loss: Power On". upsmon has NO compiled-in +# default for this - leave it unset and the UPS never powers down. +# Must be on tmpfs: a persistent path can go stale and make every ordinary +# reboot look like a forced shutdown. +POWERDOWNFLAG /run/nut/killpower + +POLLFREQ 5 +POLLFREQALERT 5 + +# Wait up to 30s for the truenas slave to disconnect before we halt. +HOSTSYNC 30 +DEADTIME 15 +RBWARNTIME 43200 +NOCOMMWARNTIME 300 +FINALDELAY 5 + +# SYSLOG puts every UPS event in the journal, which fluent-bit already +# forwards to Graylog (see roles/common/tasks/fluent-bit.yml). +# EXEC runs NOTIFYCMD, i.e. upssched, which drives the TrueNAS restore. +NOTIFYFLAG ONLINE SYSLOG+EXEC +NOTIFYFLAG ONBATT SYSLOG+EXEC +NOTIFYFLAG LOWBATT SYSLOG+EXEC +NOTIFYFLAG FSD SYSLOG+EXEC +NOTIFYFLAG COMMOK SYSLOG+EXEC +NOTIFYFLAG COMMBAD SYSLOG+EXEC +NOTIFYFLAG SHUTDOWN SYSLOG+EXEC +NOTIFYFLAG REPLBATT SYSLOG +NOTIFYFLAG NOCOMM SYSLOG +NOTIFYFLAG NOPARENT SYSLOG diff --git a/ansible/roles/ups/templates/upssched.conf.j2 b/ansible/roles/ups/templates/upssched.conf.j2 new file mode 100644 index 0000000..b668731 --- /dev/null +++ b/ansible/roles/ups/templates/upssched.conf.j2 @@ -0,0 +1,13 @@ +# {{ ansible_managed }} + +CMDSCRIPT /usr/local/bin/ups-sched-cmd.sh +PIPEFN /run/nut/upssched.pipe +LOCKFN /run/nut/upssched.lock + +# Mains is back: wait for it to hold for {{ ups_restore_stable_secs }}s +# before powering TrueNAS back on, so we do not flap on unstable power. +AT ONLINE * CANCEL-TIMER truenas-restore +AT ONLINE * START-TIMER truenas-restore {{ ups_restore_stable_secs }} + +# Power dropped again while the restore timer was pending - stand down. +AT ONBATT * CANCEL-TIMER truenas-restore diff --git a/ansible/vars/vault.yml b/ansible/vars/vault.yml index 371e48f8cf878eabddbece4babe961b308787ef4..9c9d8746da439a228717b78c34810be77a1a57ef 100644 GIT binary patch literal 28629 zcmV(rK<>W)M@dveQdv+`01hRVxu4c+vP;R70m^k}!M1>HHkT;l`*jl91-yY*N*5VK zDP+R<&_r(rfe-0{b&N78C&+PoNzWA>l|p-PMOAcg_1oI+ma7o4h42KKIP|Md<12`3Up= z{O9TZ@v#C*RV+&i3YBc}tyB%(*TAOz(gFrI+}o3i7ZRT5d#l_8brsXU% zKjx7J%GGq>VLMzWkslO?G{T%<=aS zG`ULS$c%NXv2|1{&Z*mtd)Jd8c|nHAcED~Sn+9oGK9)B#>95!``I*-tlRxw$ zR}8oH9}^(P?ySbNOLtqZXMb)!nzSF{&;VSkc@OFoD;VBvIX@ucrIe%no_w0k911^B zZh`i*&Y?EdRxS3kzM^1XKgKTh!(uHgtlv!wtGg5t<=VKZl+gU%MJ1hq(7$psE)9!z z_6#LIhc!pvUJwfq|LUZFT$uVItkhlm1=nrB+@SBa5CoCx+2<0 z%sM^r1-A{36YO}(ATr@Rhm@t`mm!3r3pzx)Nh5HeR3q&mB47prh}QV*U%V_Ws6F7D zpxS}5k*?AX9CaAmkl2Z#Kp}QgC%g#1qTumj@`1+b0b10K0@d$nSkx;r^;O^FadmOv z*ysH;H>(U?!H(a97T0;#(`BT}(Hr0e1bYO0Z(R!QeInRO%{AaA^m|$u5jk@Kv~XxZ zmTm=uE8zsB#srRddk+x1<8}daQb(vwJVkf@L)3G5Arc?F$t8PvZ0YSE z36~sY1IieMDrsMSj2zu-yDN4jX@4FxS(uDz0)kg6W zDI0HQW&o7F=XGNu-QBLH&2L&a#Gr#G_zz99h;Znp)*m4^=8ZF%D8bZC&J`EMg!I^2 zMiA*bp`>>3j zVZAwZ3eZ+*8D&Pkfw^_hZFHJ>6ATHtlK%|6C0Hx!HN3FzcwXsQ!SqwANn#ws*}A&x z+{E6Rt3$Jj@IZQo31@EPK#1?x1~GR z^QRx>2Vnv#CHr9Vrrg=@-rkJDf*Y9DUms=ms*+sx(L{q0lTS%iJ;?9*q3Q z6Sj>({d5mzJ%qp{Oe)~#jS9WH`mw6=g;YSGSJ65~{z8uGx5Sb+Ul^}gpZtlrdN%7# zx$f;7LM`RPoKodiSS%d_{`ic00?#!z^#=RV0pwU}8<6BZCKQCZ3Ut^=uoBjxsd5{? zf6CBCl;T1c4(veeoV5DQB4lHneNmGsJM5Ko^dnm)9{809d`Kl+QnUqW)!8J4u}930 za5bXu*H(kZMW9g!B^TfK!>Qple&$oinYg==U&dKo!AiMkq~tYX)|r*v$d96+lYiSo z&I0thK?E-Yvf76&4$ng_0N$3qTOdF#%nSc@u6J1=za~+{tHB8C^GoA6-2S6)Z+0Y3 zZ=2Qyh(8*Xhb`*OzV!ZL)bC6M>&pS@PT(>gkxLlDO(h+xlczWKVJdK48g4T}v9B11 zzIe<|L&^r2AP6lPb5Z8^Bqez4uw!+~t!+?d_C{n+=1yKB`M=$FGdHt{5BZuTMwOfx zqJ_wAWT2hL53O8dM?T+&x8@6Z0o?GnBcF=xE@XZV9O2xkm^S6%*{e1t%Y`JaMAw14 zKP!zxDVzQ#H@^G-k0bZ+=_ZDa2ay8dL4&1Vcx!v#3>bbTxqxrTj~%EGgkJ;bwp;z^ z{gp$N_LA=j?#oDY4@ScLN{;Nx7bZ9)q`#FvcP}Ys-#djtKP8C$h!O{K*3F&KMT;ku zkz}pZE_SA0n-S`SzDf=KN)#Z|U`JwTX87;%OCh`<5RSzewz{mVOb#-zwT`^ifwqH; zii%uwmoDscq{c>ms-+a{<+P}0Z8*vtyBelNQjSG?e0}Av{s>((2ld}_w^wD?3iXhY z5Bo=Xkt;{Oht+bTEnz)(TY%Wfzd~XgCI-m1L{9L*;a-+nMypTI7=;kh!A+wtDS~qi_$kOedoqi)W zBcDLc0)DZBCngKk!H)!FMXuU-zeQF{UZ6nhf9NC4u@SR`_QREXcY#B~Lej%KJ%G$8 zs%aEdx+;`utZLlSGE9J;XHX$_m)9e_l%Al#G^Umw(QuPmg%i}5>7l}bgra`1HG3$wPx;N zSF+x$-AamHrbRj3zN8sfYGt*RR?_&3Cj^`9G`ud%C%*gp4My1Hn-5&0+BLz5HFMk+ z&Z-$z5ZsZ6Y-Ll&#lRakC7g-uffcH<{uR`#bhg$Di-RHUbx~*UhiB?UO7Rj^nsu(T zyis>DGUsd!juekUxgag^I$ec1OHqSBxJ5|1Ok;}Hxt_ut>=_}BlDGM zTINDK36i)ia+z{Bq)Y@3ews|tMy(1E@%EUzA5!Gz*+u~Lvj~|FtCII-7tq)(blSQ3 zAiVc8r`4kG?|(H^CXZE&s7;FSrj2E8Wj=Zy#6LCY_dyq(VwIY=(0H$g4Z>tCFF^ zEz7v>DcmXm>UpOTFF0!QM0kp#lAl8RW_eyEkuCDy(pmd8DfH1$q}cwMX9`}zvp8z! z!Y>HN7Yj>jWILJJ!*Hqx*jkNe@Dd<8JtBe&?ps&yVOj1s$Tb=Zx{k9&fT#v(Pf29R z8rsUbP8`yF5tJI)P9<^7%s!~Av4Ix%@hQy7g`vZ?WGkBSVW8~fO82|}WDWH<>)i9yT#`QjTcbGle~c)> zexSIp9GdYz2v>ovQ~XN7~F5XHknR`o^X;Wmm2k@SfS@#VKrQtbYt1suatja(wna9p_UP&Slx{ zZSt>TS1ROlctW38Ib?H#c2FF^RLcGCgE?m%F+y<4 z;G>Sp&1QWd6{_1QQeF(nKVt3Tz5)C;$O%iKU$eKydqGF*Zbi}W?tm128|nA9dX2f$I+Ywm_i@H`oV=q+C=axW!ZP`h1S7M1vtrRM>&&8 z(}IaMb_=el{(^Q+hoGljsac>IbRK2eM#E?Q*_}Zg&`M=tzf_`%4{N47b^!X?=Sd)5 zKuR({acJ_>(Sw=7s6MQ^(p(W=v={30A&8Q89=dj_sSmA&!LyzE7O^X=kj}4DC!bE7 z@o1>In2e^!1X>_-g~W&6iv39K1i&jqPTTp@5xZGKyDFFd|W zb`o{)@LMs$z{SPXDA4uM;B*S$8W@bNM?&#L>V@A656 z-KQOoxy^ObeQN>YIz+BJG5@b|Zk?8kZXYq2Y)>b_w(-aV-9WNRaRt5AH$P_Og0bTq!eyT>^Ema2*Is^pc9m_t6fL^igE zuQFSBl^SWEH;=4^I5+7u(LvD1B1}XT6yW|EmszmXMd5R%jO)>#@5FaK%2TfdE*I_b zs>MMrY_92WDYJB(Y;6&R@-Ig_L)gB^1ggotF0^(Eu$D0K%me@Eo1uGSBwdO_3*j{u zC3eaF39ZUe!6S=^2iZK$MGOhx3Yo} zCgo}bWkbqZ3=e*rD7-I0tBYk2crsslQ0#+m zYW}Ui;q6FQq15f4NB7v(6T55FF&y;`4&nx2hiRg^8kcPD2)V2&i_0#J8lWA%Skw#> z+y`t1J7TrGB|F7B$&$UVU-&G`NnKT0Uno9Y8v{EzI`i^|fx+%=fQL*v2c}py{?cyB zn23}bZuMMuXm&F0DMM_Houa;@?pH$_1n1bd-^0MUr;;gp2cZDa1Dw?IEjrSmRffm(o$sB%*?)OZ*S31H0nvq&f0MkHQTM2 zL8@sAI@%9HxbJ*Y z#m+?BV`nfgdG1g0tzW07qn2iwI(7~BN zPSX~E@Bj-9aVTX2#rT;zz`n@OK~U`WQtS!)DzIqh^Q+sfbVXYQZT zpY_#*HmvhE8j?71pX%70zb5stUM-!bX{^(_U?Jtz#WqkW?rY-1Al0-SQQFv*J887= zZz2eXO$$m=0{8mskt?*G?_#AA<>0~Cg zo$nlaftn3UQ-$a*U>__E)wKeI&tSUXDv8y6;NT)*KWej|w;L^CY^yH~>?L+-qT}8R z*GLBTrQ|yaha5V7Q}5Qg=jOde*O(mC^UN7b){zdoU4D@EcL-h7Zp&vDgVTm6Ny&7H zcRgp~T=9_Z>0!l91#gJaDHCO?jj^3`0+0_r4UY!sBi9@3f!_)t_1v}(e|L2F&`%7Y zv;U-KMc97QC>Agl?*Lavkg2=8<(Am^^y~~!ipD& z@BgH}+1h2H2JmDy(_uSLMg(KcKeb@2{-)x#HSq0LIkn=4V{2*{z=Gng`x~x`@;R$p z!7o(&4PFSq2@@&vEbAR|#fP+S!=dl5NoGj3fyqCI$du{_k?;+< zKISX__k`oL4{ES4{F!Jpj@MD(q^XSTyS+-!fFcsRB#GRFGKjT85?yA}?SxPOSgJ3s&W)Y4t@ zLLqPrpJ$%wSe>sPi=-Wz;r89RPa-kNWSM%^#nz^3?Pp$KrO6FJP zz|^}pao{mGNKmRZfNFsIMR@dD)a@U|H3wpvL)@QXt%{D!u!(DK?9#<*xQp2`1 z)lo?uH{RqXAZc-ICSReh$zbt4Zjt!un7GSw-JP>uUQpi~M$R%ydKG+-oYPb$x_w^e zQibS}!jRV5`W~WZgxbPKiLrCIm@vLj2|A1AWj;0V=H}Wjb+DnXKAIgx!I^0O4W=(% z*LN|_rr=3HEmQ_z`vkadh{W<@r&Eug=)0Vci1qUc-SGPC^Nb{%wq|u#cTOdvN;^ke z-|ZBcO0aLC?=ixv28mBWqoT&-q|03xg&k)Wb4;3(iE$ zr#-9TLIsa$@P`EJ)0;Z473@$II4`Y-DGP_SPf>0t{I;~y&WycKdU~;dRi7tk&kEq; zIw3bz4$Ydk=!QLl77GQ@G<#BZ&*rej2`?0D`pj6?Gk*mRCq+aHoz&ywJ9Y$QJ)ksl zLa_^Fl#220zGf}AjHXiP(5JQCM(N^rQ0FZyY?+Zen@|2x!}lxG`L&k_)k`F!FwX%; zs!c8qwZq(~w@^+C74wWT1p3}s;Dq6KO--x#Q1kLkJ~I91or_WH{=UeeU?>}diL^cx)X<$PpDTERDXn z_+6VhRI~9zvmNTb**L!VC{qj7F~J!`h_U$SyFAkAuEO7=Wwyc-D~1~^x0Iow(!jxm z*|9P7IwiA8L_mV)5DO_C;WjVLF~szFOpUF0MD`s0VQMm~`APz(h@QA9ZeB5|kH_uG zB5;6T$M4RF`INy*fV|$v@OV++(!B){+DC=_?@5`@2l7yU7(A1hZ#V=F-Sj>$9rg0P zlHHtG{p%lc^SP(;EFu73gn~(jF9h*wi(*9#`jKZ!T`GQX~n<*N<9>>1q@=#YGsnE(uDRVe#c|yGYxnz>9k_gZFF#R?C3X(O*&w zWV>xDTOQF7g>4OEVNzO7<`+1Vr9^3P6MKzZq?Bs2+8s=c znEs-{-$6gM=FZYEW3hRo^#fDAAELIIb6XJq2e(%EUF0EY0Jfz$2bpa(y=JWU7bGj5y1izYqK0q@m&Gu81bca{& zvD4Kb;ucBI$a%(Nvc3TkF*EPEpB3mRDx5onjYlr7ZBqxA8C()(&g`U5>E^W85b%J@ zgc?7_3GzOTC+ITD0}2a~Lltj&_@hj|<;Q&aGo@@|@(@W=w>%r7Qo`yw?(i2V9sN+W zqo7+Eepe68Lj}r{7QV|%*73+a8&(bDx2Pm>Mwn4@7PELEgp4Z!Umtv=-WU;-R(YIj zhd5qr^Qe4k(^>YA(@{{kjv!E1WNj1BGpUa1s^k?=c=(vP7mC_az6B+a!wA!vm-qR@ z=Ogf0-^tF3&m z`IKEMe7PSK!5hff0%5K7{DhoJDCo$R$cyBkjiY+{%bJ)8)Vw84S{`%#Ni{StsHRyI z9L~7ZM|WRKi`AHE3vyE@oHw~Rd(wm}Dp)xKjjPgQi`r)NpoTY2d^w;FAdC3%mo(Ul(;0;PW~zf=3di7}O1 ztj%;BZczj9C3|plro9rk8%WZ^Tj#Rm&!}7L;{5 z{WoP7%UbEd{FbOXUu~nHx9t#@D5zPLxQRY)4PNiU0&8B0im7-s6WFdHo4FA~B?)4E zUh3IoexYN_Opn>*9)0oh+fC$+_UDp{Fv*EW_5o2gMpVul9k`9^`0+&B&&2T?SGL^1 z^(&}YfoaQQIZ{U%_(>X{K3y?LBU_XG5nM(OyeKoupWQT6-j~lA6o8L5n5 zxcP2#B_qStG+OO$|LnKY3Jm9vc>i5jFY3o9Rl9p<#UM0F2ooa#Zn)eZB++;j95Wu} zh{34&j!Ej!zdBi4I&-xfoDDhXC{yNZ&v=ULQ+?JrT@NBye5TdA68a>6eGc?=G=#W? z0@$B9y)Z(9^O_1Fg58)gS4lSdaP8^|9+Vv9;+hafSwG%`xz)8I9&+cWoGl17NU7wg zwG*_J=&^uR1@|~FY>T*tdgcX$f%g_VxO~_R*O9(#Q7+F#N{CBdBiI9F&_X#A%B{D zeI3-^{f{(m4;6}5wfI9NY%G0KedjhOJ={JJl3syAg@b);i!q%Vmc`N7E^(tOx)r-f zC!NB{^fHQwY&>=pBDRFw$)IsAsmc=vn#;a*E3|LsPP&66SyPtt|8hu9P*=-qTA_Ex{ngA2ovYUc9{YJo?Z+R8#I<(dF(e-K=S>T%?l|~=X5Ly8d0GQepFK~B@!4S32^-j|8$jAOSjM8mxhLC^{?{k!YEu2JD8A%+eS&}KlROS zGxk+wa9qav(Dp;7mRi?z>BA-FC-}HHz9`6-8ZEXxeZ8E%uFP^$1Se<@PXcfDSMOH2 zryE_WA=v7Rgl!(VJZ3w5*Ale@^Vl$WGj|4xIrzR=Vgz2f>hL^Ct_xPwy|2@1g{^$p z-1(f1J4t-`7bP%w6HpyDZ8(*%HD8p)*pa|Sv}RarUk!rbV{__%=ycfp-&6jO=>t=5vA7DD z$#pB^fqaJYapR0Mx-@&&R8&q1n}Ail*C4P#t(j3w*g-<~)#uEYxQ-#J`au7n~-*^g}UoQ0K1B8uYf5fiEs%B_&PC>`zOgq$h0pT z^o1i|^7mt4c8d-DlPfslKPFqV6Xi@W?6e2oG$t+cQ2**tAr?ds!c+=e)Oj8KsTKs} zuyni0W$H9TKcJpATKe}8uK$UrtSWH=TC2pdyq7c|5t#Q3ck}b+1qMZ&UyFJ{=y<9v z)2Hq*macC-?Id5$vp%WEM`I~!1;TQZqsR8;Doy`49`cwPe1`iqBAM z-@^{kj1u#=D(CByLFDM;L%|)Pz4s_Pd4E=j=eqofDTlIR7`VP@Uv;uA<2a_p4_r zY!v&ArBjBzr{-Vu9^@+}5?H^+%_)9?|8#FVh&Hk5#x$_OCdROIbk3xLaoB+4xMlK( zs0iJD)m;4>s;0N<@T9KFHQy!SPRH}R`o~|21~R*)um&*?uN$9iu5R{tBtWSpcI*z9 z)@0nH#@JbWA%UvXO-AHEDBit*?Fx^fjuwfDJ zPMN7*zLku5ib=Rlvx(mU|0h*|Ww3?UqK+_!(S1?A)^C(g;ab3+aJ)0S^o<_kSFBY0 zd@X6cxnq4|SFV$J`}OztE(Sg%u8L_u+2R6`Z(=WatK-znl=@BVKB$aDKd)(2ZMsZc zEnko&sZNS)%%l0Y14a0VA9KssP->LQ>Q;+(a#X@QrgU(oW(r`UQro|e#e{dE;i6C> z1%mROV>LX%Di6j0Uk<(GRL=ri9FTuzJ#J1!A1NTk_EeIO0gW=XPLE0QZFCRPf637FuA*d16+Fsj=zlhszG|PghU%c@RwQM8P(fss@1dcp zx^`F>NP|;WQ=M(bm9Z8@0R&0w+0|f>bk+=nYAKO6QOMa+^BDd4hEi**tcGoz28yT@ zuU_|!%@{36<>WWv{fHno*UC71#Mq3z;_jdDq+N>RgGZnXbLy0@&8M3XDVhKvIS`!f z8AIYdgqQepC@qr-nagUto4l`sFmn}4n(LQTBcQucO5E>^5D9!k{Pz7qYKAnn#~uU- z&{?W#|FfxRMc^Iog6w;{-o~?(H^3^C*Qq{=CJZIM$MQivrYpD6y=|l)nDf9fc2Kaz z_ft3Lzyrpb-{aCLfVb6$(SXVB{!DU-5t1!de8Yyr851+SnN4((dQJ{Z9*z{4$xSq5 zGsg-q5(B*|s04pjR|#M&bl@3{q7rM!saw#Y67WW7WSUZ}YwZ-==*?3F8IIbf{XQo+ z;l%&Mtg%&SoqA=yt(L^dz={wYAyVwO>;=Ft{@5&k>wc;RKSO!+M-}EU+3O3URx!n*3ZnZ>M2n-j3u5{A3pl-50+H6g>FnhCNIYRR25F_4IFP z!~Y0=@rP`$WLDYMBdmCqtfj&qq+?I_Gqkt*64r5l+P!my0P%f|eQ z(VH_(th!U*R8%K^L5G+oOqf^85!^gi$$^zwGoj`?-oGRKtYnfQF0fp<0o*kJ{L7 z3ukdwZ$(0&6Vpe{DNUg>!yj}iHN=}Zza)yOI8ADm1b)Sbcw0jCNiZi)h*&d0^*m8r zJb`PZxu|tQ&a-gI??Dj+WE&10Z|^Kp>rR4aKB)%ArsbDs7YZ(x-J?R+Q2{^ZkywP* zQ_N|7qQ-?F7TcN z<^gEjnY=cIEi9Gk#|wQDX-IGqL?*8$2sMmNa>kmUh8pbmQvr?&=AE#a0Vw&6{L`L- z&)K{8*7!&`fMf2@d>{t-3$A7aH?3LN9sZ@_N@G|bxh0Ze-~Zc+RZexaTSf;ERtM9Y z=+ZbsZGm!9-*M8kxT_{Kl-x({0G?lr3|TIyM&6d8Tmp?t|dX-jlZZO z1;`O5&$c+h-QCi*YLR(b0eFK`zS8UNU$|wks!Uj|{AH6wntzbky#JK(q*e&wNnRO` z>mx5|vz$F=$W4}TK(?Ky%QL}gnn&e?VI>lSa6_^ZdEzn42e4jO>D`7513|rf`27PgecX9t8zFJL28NG~=nk)i!Fd zGT*CAPavfI7>K9neV12}DqpKCtoZB(`X)&)N}C#)aw(7s@{Cwm;t&8l;rhox)-|y? z2dUk&m)TI2&tyY3W(jSI%?M*@ZTv}&mh-fmso&|F_N$_?&BrCdoj`>zEY8^wm4PSI48NWgo&aX6t0dw5v}UfK7IoN}@)QzI`~tZfq8d^)si9Fid8vMy=KH z#8`a@sPN-9s(__Z8-dQ{eCF0{TCW;wMkgHvDoiQcD^1?Fe>{67PTh? zuZD2gKWdmwycg|J#_}Q_D_yI}P_upRa^sp-a}xZZHv&xiBqS-&{IBf9b{2npbTc*_ zsK~Z@d=wsEOhEO}hN;yQ)YI7V8~27A)u-fckej}(!F4_A$~VV`u74b?;{E5`URh6` zLiospf8Q@e%<~1#*4e7c zjc;s*XU?kpY5Ny(^T5R9F9Vw2xy=_Kp|(xanh?LqLl&krJ2Xhy(&q z^z%h6X%RPNM_Kc$ilaZN_uV8a7)88x@mb$}Q4_?po)vb(Nrv>Sz+wmc+oMFm4Fku; z`8;sr=x)OgH@@&=Lzr}Mo>Pg(#M=&gB1`Xy9&b(N2;EPWv}!+wfai?W77p$@B^z?Vzd=!?&#A_4T3xLjqX ziw<;g5YMN6)Pm7GY!ePHP^4-BM^$z6kps*^Ehmm=Srt#ot>#Oy?RIl;BeBe}=IS^O z9|HNBsW&QIqI9!39dpt82f~V&zSkI7*TAXRgdh7^j-nU;A+(T5M9^04VH5qCsc~`9 z!#a62s1iYZ=6mTYu%s$PeEeueFEuud*TNf-P#-nO&0_>cejDTk79a)_B00oxjLMl` z$^D`z{&ldZC=QvOC#5Nhslh{IygJG^UtKlypB?x#6Z2dF%&nlGPI2CY!=NMdk@-ov z&_xye1N0x@KDBu{Z$LTzFDsgpy1ndwnsbY}tqG<>nmZQp+%r<;2+t(zR_MD01^he= zko?_Z>kLy>dQX@DF|o8r*tWKe`ck3UbzUQA-ElVE%)$*A6Q?NB#`j!V8A>|+G~b^u zf^@~7{~>`EdDQOk0$bun&g3gMv>XTrE)Igwi$wTDkruE1h*fYHxCsVmmA5)Zb41xf zO$ku`*_wQtrE;9QvhJo`4;>heSz=6^JdDepNU+0Y{& z6-n~;KA+A)-a-cC2p5ozq22y}jyKO)bqx5@+5ZrGb za)$0t@stEWhpa5#1=JtlK1nHohs4`rUcs9lw`B2d8t}FgqW&uZeX|uZOz$zGa4Xre zh0i%#O9sM#6}bN0ntQIqD;5(Uv8Dzpi?FP3El>-Q`_&bV&$a&+ZaB@_^KyHm)%W85 z3S0AybIMAU!Cw=ir>TE4YGlufq9PV020kd-M%V>KChlf#ft-H?*ijv7w45)SqkphX z_qfhz!e!BG5l#6N3fau<|K?xK*2)Pz?c&6gN}uh*vr@pUIQz7w)Nc#usNQ;1jTJ5E zd%#v)5K5z%GZwO$Esrq$04w;x>l%o8_{GH2=5+x+CUCHaiAZP;Qye-r3)VXKiWZi~ z60Jzk9^y~ym{Zm%nXD+zAxe^2V1j*s%ECHI$&dtW$g z8ex7JUgpW2(*mZ(YvjAaFw{&@V4}Dd3di^zavYH|o2BF(% zs`l7syHB`Z6MjU*w49KbXGMii;ij@=6Nz{~Yso5+*#O;4A(lXGr#6ge^o%{I=U?H9 zW2tm0AnDO`irM67bId&vLA`LQ8Bs*I0evhTpMQ(Vf~<7ee{xj{Na)HYBPy{M5yraX z3ytl8Ea@%y?iWU!rm1mgwBC>DuYb#iiOYv!A~f?l1@Fkhf{~7YRj(`g*LJ^qDoIt4 zEEW+KR=EN}J?T1V?Tx()En@s|D`LGc%u3N9+tH5;#}>wS-3mcgQ~|gxZlW|zp5auf zd0yF|XcJ0XDSm``RM_acKC@LQ1&ipXZ{C-YA{`D31lSy6mU zDI5lK^wm3)(Mt&j+N1WlT3OQc7>U-l!~9{k0ur}Jjf&wpCd<7Wlur=2ADmw1QUI~xg*`$ChDW*6(^k&O?w1D78 z7qmBCVFqs_{LV9$g`x6!z;ko~jxT<;LlcU(Cb-{e!o1!nXdp(KCm%IA-;-*Wc|-a} z!`Z_&Spk#XUBg{lt02&O0u5iRI%n~2W7!{Ed0uH1a5A-#(a;c1#9{!_;2c@QZ;Lv` zv@nAj*@V6$W9$adJFG*Z7UIU|-5*TYox_lBhvPGSfQ#vjIqwG-GuH( zo<5VixEky5>WXIsQH&?G{jY7(;-f1XGLQc>qBFweb`Z%ND9ufYv-XAb(u>%kny$1e+EBwV(wTQ7W4$6@eaQ=L%MJHV ziWm8Og%n$M?=zKUR}2(hm%5n0z03I(F+DWWFV&JB{z!Bs&NX6b|1r4zDMZX8^XNh1 z&06qJWkiM%grRf=y8R!3q{1|6zt#vmiTqo^jYqQ8|RA3c)yQ`=S=WZrG z<}#C(Wy8~AXCvJX!A2X}K{o}srxHr`JuBf0%k;ydvlK-~$CPeaT(8_99rs9|ds|jr z0-xU%xiG5^MDI~}#{uh7JoLdl3`{@H-y+2~tsORg$9a-+1++T<{7$lYeT{^{M7Zi~6PSUB&^y9AHvrawcWoz5=k5N<~ zvZ$PN1g%%tE`>VO`uw}1$)_`6>hmW zrK|hQfZ9|zH@m@28=_7hl8F@G?ln=BFGDnl4?S6Fb0I)`_~pu zX5KM;S6l|U_xqa=Jt<8!v`G`=tz43qAHaAxz2=mS74#i3tKn=c@;$`q)yw;Cw>B7O z@F5)n!_TXMls5oG%7DoxsAU9Gu9$Js!)y6La6r`T%4_HvYT^Z#@upRkr*=)~!Wb(~ z$xfCy94yeY)$LGdR&U?uG4r4CXwlDfNfWSjoPEZTSnA7Fq_nBTnU+oTB)N)$WFgTG zl=7jYWIkQ$rKQKkCBEyJ<2@Iu9F`i+v$q-_om#fqmSPJ2t<~v`sL^V$-3)wQ$D^2gYt!%Rp{~m8L=^d*Gx?vPz! zU6LOa31-HJLrq-5X{V((uV59$BmjYYZb%AybUcs<&JJ><+~xts%dk*_qN{lhk7w+1 z4zmh&p;Am{uW%t$RNbLP=$A}!GG8sw8_?ZKlvUtjd8bXsLxyE^cl8|5gKDMAGkjYr z7$1@hhf1@?e${Iw)s^gUBJkf9Q4=0Xv;jh!W~STaEwh$SQG%vHw&aA6%sogJZOnYV zSK9c<_tZ?%po-|!tEl>$(8exe67I-LS=~Pqo*PUpJs#YVR@Q3)>`o{u(@D&Wn}@y| zVqwVOba`9cJgHd0gi2MzGSbR3!c3YPb8FJ&NzBy>C0X13X%QK~me3ICjyxYP!t^E_ zF@J&KXXI|Z4z@`~ehrmBL_i;m6Q%p5Bfx+3JE0m|n#aPT;1rs* zm0LSgzQf=LM#;9j0x_oU%JkmA92)LB`j515&0y=vwttnCs-_Qtq4@yB(pOtjji)b2 z^zO8}dDu79am^|1G^!XtQ%PJ7VUYWJqk0xq8gfGC_Bo`Oae@+I&1=S=~J^j0(Ij)xAac&n1k2P69$;pI@ zFXY3v$Wg;`r{vsCehdoc#QDOde{})IjWsX*Q89jrjCFKY4`E6@>Ab~(lxp?yX)R0q zYD4FCBq>?i44sm=Aan@bNH#q0SCgWoR~C1yXMW@kc!I9015>Oit5*qRrjz{ zbznr;qzG)t3qx6Kdt6|UbhHdG>^JTE&%?)~8mgT(?!HMk5iP8~Y3!)hxB69+zy{@0 z>9Z5}oH709Q?7Eor5(TTUbWR%k<)6wGHqlhcN~_@C@Y-)gEiHqR#^csq|6}!_n3rT zJ3uBaCxb^5BIpVyso%-dOs~Pu~JS;=&AhJ87r!L*>+F{gyT!0uAAR<`r}rR!z<_t zpt2^~qTqTfm*|aHlvbgO@l6Fk?|3e>@mJzMpz6L)0@I0>#v;`4%pcte*)jD=$R!1H zq@)3WS5d2+G`K05zZbej1H2`-)$%2r&b^+7q2c4f`GH;R<0}3$+f*D7T|uhgdWh$+ zy2i!?Z@Tu=+n56s1lPyCw`jLEH_CoZEyJas>AGMx= zW4`tRogpcy&Gm~@=R!@G+D`b7tN0U8o^GrVqElY$g|`(@zwX@vJehIjQ^)Cjv{w*u zIVDaX;yCW{srTKX6)=z`lf9vp6F#DLdMLj#zA-9kb=eK6w|p#Q?2|M-w7z?r8ujG@ zgg%r_eku~3ueh`b9DJKRT%f*EF`fZOFIfgdMS2PGLa+!9S8}8MwK6PzAyN*LL4C$p z_EY;*mf-9jun~C`^+asM#>nKpsv5lq8VlEIxF27mLCl%=*FL%>w+HTWU&+JS_V&za zTRT^rT9o^)^SvM`OR94wJHfavk!kDp-8~yJO276=_M9`^tvepG|)?pQDF|BYckDZYAr{l)aX9)tffkwSV@ zMm}p`G6%aF=wYMva2op92B=!OD^+m6z)G=;KVud|*^pYg7Wgcp~^jjKj<&j>El#of)58{kh*;UA8 zJ`^dDf3e6LG`mnoy4=;iDV#$o<4W`Te<&r9XGXv4k~#`GkyT#b`|V|W1ioEK^Txx% zRTWk_CtdvUuH+)^5wvW^0*u~pg=8sHtV$$8bew&qaYb-hD45DPGlDZ{%kWjL%479% zhOnA4dZo|W`~JJr9iPwbPdJh_IqvzmTL$pYG^C6BV0Hix*H{}i#kU#}Af4;+GW1us-CK z+f6>J-M;xO668n&f58b{vkM@k&eJwSn;$T89Re#C#p_^o4oX(E4_UN*xkJiWW0&vq z{t0Ot6&J#tv7x;LjKgdwU{}-^;s^TUVv%H^GVB$Y%UJ47{=HXlq>3{anD75^M47Ka2U2NIHF4KVVhnu54#$CBIdE*yI zJC5XjwJo=0$=hejqB6{0aXCn{oi%vv zWmLj&xg!Uz#tZUI74QZpd~%nILR1pF)_zdgiUr_zWOyEqu#YC$5E-uEZF;079q<}q zPQ>4SgZI#i!9}^Mi)xnON8qjb<9vHOzTa6rcHkBr>Q547COi-`|DSemx~`e)4O8*PfVED_BA4Yp<7#Lz8I!auL}cXmVqaxe#zB*Y~*E=RDE z63w`Er`=B;bZ>N=l!I1OPA4A*vqaT$^@_fk0mUxt(#6WGQ?BGbY2RN_=9&pEhrjM@ zmLlAQabTSEREVL+G1|_SIkGewTrkYIb0E*ALR^eTMG`aVA3i$6w`bOWmwZXRY(A4woHZ!&D7Fa5SDL*MYT_Yk1a4nru^@j4Q3* zSWd1DJ2rSj`armR&eJ`+Fze9C`5! zxaE-vJ2jFV%dOdR|KREB4bL!*r8)o#k^fSx8mLst=@6Oktu$S1mSj6Snf1OPH2G^- znI_J{0`+H!5ud-L+bNVOZKmYv$SBU&?=@lu5>(VgHt&-7Mm|yL{$&9U;vQL>F3``V z{>_eGw$x9H?1pALT7L*Rg}~VBpw4V};mL@%azI&BbX|r4LH&gU6$TR<)20Ucq3UgM z>;7YxVFPiP$MAy_ME>GLq8hYpZ&nS!4NV21v~iA}Lr}3XQWk4;trFm&094+uM1t#O zCag^vD%f+|q4$2%p-IvWhMPGRSGf^4KU5Ub$Jgvb;KI;GE5K4lxV!%an`t>XlJ)b9 zdLqTr$5O?Byf#y!>b#FEo+v3zt{_-j>sm`s9|%t4|M5DOhIarqiKYO3cu%FgTpla? zwUzV?o{db-}e8E!EaYQrZoigvQ9>r5S7xIpgzjI3QWy3#b+9_P}_adm3mnDESG3?| zhl9w+81fcF+IT?3tzwJW2xLKkBlaGHO*%V`VElXfXU0CyH*mG)pqIH%ewz6!ho zR8?5j5r-o7UuG+kc$aVVp6U^Dga5bkF`mwvQv@Nst^3y_J==^f5ozgR@-ZCl_l3$-`*Tvn-Q|xLClCn2^mIa?=#g-y zS4ga#JfO%_f$;=Z0*C-_Jf0KTP_rN z0wk9Vv7GZIK(2aY=r)ei1Up~m?wKXD&`PAe*7UO6&`^P5sH=0Tu;P>1-@_jIfm~+Bh*FZ# zMrh*=m9OUZjNBu}s`McyXPaslZ23S|dnH%RFcbXDaq_ClsTw4EY9mLqVJUs=Y|N>I zZgUz#Hrq9^7O!kXe(n7WR(8X=*F=Id$`TT#NacA3U_D(PFa=1O>m3{UcIJU6V;~+# zG-z~M04bj?XI_O3OR?E`e%2)pt|mDU_l%NHVIn3$5Tn5tv(Iach$wiI5wk@Hmos65 zVoMuf_>LD=5f768e<$&n4g0Y;?hPy(n10Uau;RqkU6dXIYVys!smFsf(C1 zh`q=X)tjdhZilsDaRzMvSE>eUi~LY?W+hC0Jl_?`S>vPWE9p)XVh?e+PJeb|ArbEV z{QEZj_4f!1A_GYQh*Y*+sGeN8iJ%@Ba5nu%AL85r@)eCgwTrYS2`QZ%-ft6Zkq!#? zX8>E-AD;Trpt65;0vk?rk@OI|Vz&1u853}shDo(13U_1gt%R+E+6kk`nCgeW(Fm7; z7Uy_|i;)^jBL_S~1?lLaQLpk`tGZ&n-? zFBqdN%S;!=2G{3lW)1o(=oLd^jt;}o0e^Qu<2AGH$LAp3_9}!i;d|BKdkaihD&Eim8vl&`I-KV?^>Bxahg*#5`nr9A93g07 z7{eId2UGxxx;ChW$%yg;etCJCzFuosY!mgZjOoB37Ur(=1;U&p6a>7@6!BUt2RAt~ zwiXfS0o2*EbP9(1f7gQ!C{?(sOx;UoD0-|RRCmdFn-{yF= z|I6U`;@LgH@$YNhBxq`1)6W>|3T5g>EIw4^sN@dl~*AIoPGy@j7i!g?RNmk`G}m7%Ex_P8e$s z)YKK*Uo~I>CalzwAC*xUeM5W`efB4PaFKw&?a-;F0t4{Q|gB(FvQEAm(*X{UI&BP?4& z{mm+0>wHLR?f@o;_Di$=>mwL%A?6HVfaQjZ%PN#C9dnGv9{^CvoOUNK5{S~IY0FA+ z%*<>j##R2S?n$XApzW3RjL=o|drT9zMRNY6I+DLDSYcYq#WhQjuh%W;Qoa!PjDyEF zrLK6Xxy}bjtGt>VR?q2UIY7IB4=>*X%Qae%cd}1t&-PoVUB^21eYe^z{7v-bCqa+k}!+ap9GO?Kjlxg|w5DnKu0fpo%!$U*(y zHUW_!84F(+xtEc7ys}Wqc2z(EuHgV(=N5w&Z&Em}GZ(P;Z>iO`z&UwX{%M5X`*Hvm zuI$i>W5o}B8-xxq?9DvZ*c;C!oIL&zM)0j3k8jEVGCwJ}xQpH!+m6-!+em2Q75?4W zCG&b!>-b2eunz$@XIQbaVz*DFi&Ek^wTpxaFG zLl@z5u0J|oybWz>^YLzmn!DZ^xl7yjMNhdwtTdB5YIIlRaWeuz2DdL3Lg9 z{SpyNDn2732p*;r?PjJ2^PTv_xnT|}$&NP>ZYq87QFN$=fkHkKU^4ORq9ovwFO{52 zzork5X6oMird~4HuEI6YOo0PKdxx+OR8wIs{9D{)ES9*R!zUzoQ1((XNwsV_K8Kk! zUAPx`oN>QFL%&J?s2Eh`=(UngeeVEc=Iv<6_1}Hfdz`X1tFqr|C+O6nWG+L$jr{P> z@fuE{Y*Z*#j|5RGl0+`}y*)>7M69v^8UirD(rFc1sx>8)UEiouRNCG32u zhUggx0p~H_PwjSf7U--lG&#k;wEn4Z|S%ov+iqM(8feYCdZ!JIf7SbHA z>pZl!`(!SP2;Lnyop_>Ckp8gGTJrQg#Cxb{1d!(RE_{2aC{-JZ1m**Jwp?PQq?Xci zD&C^K)x?ji9${v3QcW-0e;3ODhqPxQeB-$TDayn}r^T68;;YG1Zc zht-?2`U!;96$s`JAEiFEnrjNyTJol6#nXmJ=ih3;iYO0S*g?EPU<4|M72IaB z3sQVcEO&~>)Y#C-S)x&koSBeC_`t30j*)vI)Hf0eNryF|d2yczz9PtDp+3h$R2k3H z!H5m(|Dnm;X9t@-tTp1xK$`+G@EIh}eyoaY==3enq4A_eor6WgD$za6xcLRO@e1yZ zW5RegPCx}oefNCcPWiy)i+c}2ju2y&?TQmtyTX6=Nl2LVQFK}UGfB)Vt3>MRa2VhV zK-Q4dIg5(m`zBZ)=(fTsg51abjOe1R8N(s!AcqfmO|L1$lgRXWT((e79PyTG4#qk{ zrHfID7j5SIoc5(aU|o&y%$}8{HsdoYRqD=KdUd7+JhReOjGJD4xhw(?Sa+Y|K_k&Y zP@D~a$9t+bl&vgMt#BR}7wPe!O+yYq0YGfCERsr6d%o4>69mT(kqaYy$?!;ruU3%= z9_lbbjZE0q%sEljVn0HPbixZzr;=-oc;6C(0{XF&)W=n;jD7?#-S=>e$K>w*JDE(S z(aK52GYbtmPME<`ewripLg8hljo)>P4+jKIuo&o`SE#Zq7@bW%t_xA1XBX6&6h~1J zpv}-`Rs_&hwH2>KcQN!47q8T=k#{S-h4i zfU3{uQm>!}vyJN+MIIE!O7O=HNJq+BkIFwp<*6~=?U(do3D+BkZc*Ll^@50C<%nuw zi8WWsN#hAR11-x(2Yuxxl-w{xxT1LHyOEc2|6=fBV469g>U`_DUTj{Fz^FaBIt>aH z)L;MfZA6ANvP6v=8wl*}z-~!dioO#W$1B2@#>bDdII|rPTqoUqx{gQDc zHc+4p2-01-{6R$?0UsdTm=L(S-HJSEr#7fc z%a_m9;9dDEOCZ^rGhHdDXR?MCjdAsYcf7_yx_GP&T9ZJLm*DJ$FwP)ihRJLt7%ZGg zov88qBUodozFG4L)Ro`D%uW}6W^2DU<%4;fH8T=JqLy>B+<_fOmJ&oDVTjM~s@cVu zXnxB7#cLA=_Zid~tZAKy)~by7Onlz7CGxsh+ZJ_MH0@rAU)nAy~LR7ddT4tT@m{lgt6EX0?0b(0~Gh!K6zWGHA z_S(}aMQv6deojD0qz3@W)!AcNNjG3ne8~G<5|bxmmOmQG*$4;rplx<9U7*RSH!FXi zU#O)76;2QHan@^v9glbVMB#(6_C3E>BF1FtqH(R*L`IVEh}g=JcK^({Pd zp=tL5Z8d5(>DYR^hZRy&<6g zLJ{=4>+%s3y$&N@tXL~YaTY@1PI2%ab>OcF6%rhR{wCEZJDdjVJdH@5?cOWw9BAD` zjfY4#tycL82;v<;zJy)gJ7PshCk7QXvtNrRODU{&$gG?-&iUm?SP@ zLrDTJdzw`pey$ZzXQL3ywG`h^qpB!+9+<%jFZcV5!>kmxW`0}nNb}8bPfv4h7PfiZWrR;lyvgI^89@kOobk~#2`TPy(bGO0BVc^0;MQ`&_XSz5)g zqFSVDgi~5|0>Xz;eHC!s+cB*KtPW6T=c=czgO`VTbRX=+6|UCu-1h#6=&?*&g%az@ z+ID;LApYasQJei6Y0y;m5WFD#ui8Mw?^~kKhkMYJS{A}=olPrI`=@TQG>0xO-fr$~ z!JE*yi%t4T%#kpgGJdz~to7bvInx_>k{#sr3b^!|f;v$RYLAX+_bMiCZk^-9Obp6- zB<(zeCY6Yqt%DzjQU>{jhRCQ*4t>tz7?mNl5*)^l1b^Ma=}p<}MygTL$@jWoWcs)O zCwY5=Wh7|BaMJGLTze4#nJvh3ZqwU#WL)QtxaU1Qi|COE)+r;R<@7m4IH}9#eeJ9#xA3qC_WY^4!55Y5n*l-JeEPZ_*RaHC^KSsztHIrE(gTwpl|_MZZ}mfQ92k zx`q?+?8Q>HuOCCIwf=KI9`N0dPc;#8E%wYNX70}v2W{DxqnDo4neA?kiFP)IR_hfQ zgO2ZMPKW$S;I8?~!Wx1-q*`D5(daZ3pzGu@AX3x;^=bb)VzQQQ?}lr1nqcqcI9FPB zvxTfiA8C^ql=EnhqclAdEC-MDGs}c|!tFq+jhK8&YuJ%$D{61Y`&;vcIUxFU_=xG3 z+k^&r6#Kg2Mqo(D6W4oDC40ew%V8wcNGA{iX|t(%;gl8tR%ggU8W}QT6~Jy?&|t?m zQgLVvk>4?7yN!VZ?|OlH;A_)dG;Lp*{p$c%j>0?KBCgUT)c3~bo%F_?&~KDM1VSI< z#JV?4#T;3GTuf^0XznGO-?-j^I|~< zhHcIBv6wp?|KOpnpcxiCaCZNu0~&-cdG7GU-i0&+HpW?NTIrA)RP{gY2LmZZF~OZ= z4r)+RCF1Y9-har{0XeeR!9fn(+)NZrLRVEa>JEyvbJR3hR9aAX6H1`;XBFOd=tHgO z#h9{F{yity$mITepc;(NTTBR5^cSoxSg+uu!ml2L(<|_>VN+H-R)J;&@E_pkn>#kf zx3O@p;*C6_pz8zI6M6H=j*}5jBbRR3B5yLRnV}Z6ml4aWN9d;uF`_9(bLkJ%n!4i-4or*!BqXK41TGzx4UlSl#U{oM4R#7 zp}v`hOlxU#Dpe!V4&<+!e#>2_M`4_f9ivhTV5&%GQDVuHA+fIqwk_!Zu+h0RpH7^F z4;(5=dVt=>Z{-vzxZ?~-u0}Rn{I1N7KZZ1SLZRwwAyQjGBkQ1JiuPPgh8fRPZlh4N z%x=zK^IUF=yu5cw;MwU-YhzY|Tir z(fQZd8=+%@si;d=y)OCG)euNGo^EjC(Yzte&aRI5M8~ppo^&7jVzu?}5=i&Y)eu!c zqUa+v7Jp5HxNX)wTnZrgX}#k+&Uc!zr*jyEij(mG2_!V}u%@4W)^3yX72QDSP zf-5F`aN;>&RZ`CmiURnqx%tlVyt|myD90_teSa_WGUmC*ox`j0k2+5WUI}e1b&s(i zWg=DXqfswJJ>2p?9|yAw(IpX}ka{%KF$=sKRZhKCZl%a03jnkg1~p0TG^yy8-|sbR zqyF>(ePmeD?44wKaz_P4$L&IZ?r|n=Jp5jsdbI$T3hwI{j=)+sAm0<@*#R5@rjyjT zOp0P{6DNY4mwm04cXLa2;I`72h}_P@Q6nWOs4?e(;v1)SJ`c?TVmONljv2%I;6gG-RJmCn5ka*n7AsMpPel z!QW5loFq^NhoTm6h|TytN&r)9@L>4Hqz}(9!wgXfieIX2{}0mmde{FXwZ<`02MUJm zcm5sM9uQWQ^dh261~==&)<*iWrE@+vS!?#}NnC-O!*5XQ1RBy>&Yx|xz}}+^;9IEZWb_3ZK~&q z=$XY9p9+wd=F)LI?RL|M*#b`*12;95gR_Y9|MpHwctK?Yq~_>%{k*u#pom}7$YVU2@Sw11h&L3CFtt;7;aF-b>pF>_?ayalIv24S5N;gS(QN zIrrgPr6eKCn?Jv%lI3p5G!qjtoA`si16{rIL|mi%NBKiwgh#WVC0*v8`ZU>_k9rrK z{0k|ww^W2lI3gVECA9T)d}kHCQrWXp{pCXn!Jt7M4bfFMd=RQn8PORhU_e-1ATvH zh+K~S=se?l*9=_C_q?5X z4>0i;Lf=RSr;tFER8pGVWAJ{|fGFsiuczYjRYn92C=|q-5UWn8V-+VXFEc*4-9e9G zoV&E-)3hQM)GZWxaTyHy1lhSigb%1P0{G_F$Z6GAlHqkpRDca76%_sNBr2o*)Or}ntv~MCzT=kaN1X` z=ba$5yY9R9mu^s_L{ODPee_am0H&U(peTK`?GN>mF^-(eBZ2mtPX3WiGqf$k7mW3k z$BIw+S{la`XAwr4o+`(=%MS#qd(Nj#>?l#~P6j7_!c7fchG_6QX!G&Wx((K691GU< zdr-u~p`$Nj7-dPOlj^YZt_YP@l_C#r|ClYWzt# zSbQzq_Ibr6eUxquN559!v4a($kJFznQQbrGw!avysZYx(&&{A72asbVG3kAdADFKb z;=iLX4KMbklBRp0&Ql}GLUf=pJW*b{S{-^UB{&({k2Zys2dr5RLmMp~{bucTsf=`f z!3x?X8Z-Zf#o_ic3DSLdiK&m&H<0BjT`0$y%w;WW({k~!Lk#c$<8MRNTI^$V>LZ== zl@UGp{9B$U9CTh3UwUS`HjzS5A5PV{Cf(B$T_B$u<<7`Rg~S+a8rnIre~Px2D{tn3?BnprbWA z8qa;Oco%amls(>8;cJrJ9&mlXtZ;+9+?g)-GRfBA1Km){_jO{$R^Q8VjuirZjvs>O zyuij7iFfD>xm!a(4XBF?XaW61CtEq!1~#Y|Tx0^+3H>$!;~Ib-c1mo5=Wzn|ff4{6 zd;^GWJbAbX(y%e8AzFNj&G$GnR@sD;wgiVacbq)|5p&VRIUF(P3t!ViCcx{McRIHK z*QUuT#!v*bwTgoDeBnBajIn;xSOHJ(n;&s*T87ey=*QUj;8@f)445V5bA<@_x*HBb=zIpk@xk3;CbJA6!zKD zo6yeBA7gel;4Of&r`}c`?j4yXLuvcMPM`g;C+1sRDnfnTH-RxBH`Et^JmlORKeawS zy|s{9Fv+8#-J^wSs_ZRYHHti1^~E@Vmo#utXl8y;kZyw>=SXYww<0`xr;XrKBvLfW zru~K)kf^jZAHM3fTrGM#{?TE7anQ^z5lX%KJ!$wFB^cU8dnaAb2bO6rR<^vF~6tSbUR`KZw zD%H&OP!?7pRwL;GxKxj}F#`of8UJcP(d{Hp$Xi-h35KIN>1%WN+q7&AS8JdcmU5(- zt=2Vp$Zi@WM9dEk@+jc-K{6h20-LFvvfc_OOE2M*wm<-##$j#y$oI_`UP2CN3BcNj zJYvb`zI)_|X;X*$Qs!}5uQo9k<6v~;E|{jM^C@6{mf8;e zSnCq8W;+6vsCV&6WEF3c6VJ|YX@9LC%A;=CeiLSdb2`~yr`IF|qJxOu3po-<;?WIs z0?giJkXk8F?dh~QgY=)GvHWK}B=)efQgiaBE zl}71g#(|Fh%Ht=Zpet0ph=G0;3XKg~=3rF2adC6jZWs6l=KJuW^*z}wkkhLlpf)#X zCAz5LsGM>AOZ4KmYsqv9QrnP=Nx&x7iWrmfg(`T{ma!B+h(MFuXgiJ#PE2x$j=u_l z{ymgGIX||*C;mwFSS)>1oryxgR%i(Lqeruzw~}nKK?(#Zur*W-mEW6*2-}NmbkVH7YX?N~M1DV@!-M7lq--97 z-0m|<>Rd<&mTCSTk>v+%UHMhA-)xf+P@YYDQ|^P{RK!&bnHkb&)Y%U9yK=x+Lb6f_ z!?Iy4v!#w8!Cjzicj+g}bLjsQStOcqBqK~_j~Tk0_-l$1fdD`uSYw4vrW_Jnbgp?N zOO-oM;1(@s2(hvq5J0O3VVH$Pb(i)NKWNSeE~gX4pBu z>rCv~>~4gTqnn%i&C&Ok&!D20*#e+s$*BBZPEQ(^on5~=36xH04*Knjtx4>EY{(405Wf^0mhk@^~d6^Eqy0si2G5ye18zqpK5qTeFUh{u_ez^qHi-t zHU`=Fs%CHrMhC07(CXB4_q6yFiyfW$zQezEa@q(d)|cr+a5r`Uwtv1{BQ^!s??ssd>_?$79+|k~L7pKrD_$wO>A_n)2>@KzsG7OSxs8nZp>&%H51$H329RSY$ z8|WOWw;@{aOD=-hL!+Joh>8cQ_`L>vzGIK^bQ)E<;tr_e|=BpgZEP~ zT>Y5Dod7qr!Yqc=AG~jQQqXnLq7Gbr3=-|gNc#Ej%e#ktgj)Vv*-k=%+UHVhDX->f zk4F{Xo*Jp!&LLS==+Y*}-h95PhPseJUn7XFt8G6`^QLFA5}KONBwZ-OY{pCbsz1Xv z)%PWEeSqq<0A<_K?TE3Qe-yypTThsi;4&n&kfSb{#+~?1~DD^ zNYGAY1U2TQX5g1wrAO+)l)Qn8_ArvGt7Q#s(D%I$ExM;*LtPwXia9-p3!HJj{yPC; zrE_uoOwS>LGTtAy>4BMO~<0Q@R3%M_j7)+mS(U zHO|AehJKacCNejTGh}}K*QnSKBZC*mO;#IGZ61IB8eO{CW|qIJQ*)n}f3j*AUI0^reup}kMpxi`?d{m9^xo!T#1unXP@8h~*vYN1_KUwq68j%sdrBc0t`pCQ8cQo`v+3qjVi1q|nh;uA zIr+rYnO$McV4GeS6<-eH33nQ7z1%CgtgBXtClv-v5J^sDguIo|YxUsN!=s|14>?G5 zH;^c5ie&Kc=c&f3(`*; zg_(AIfZ&rZN4mGqBZC)6>Hu0rE5$R1f!a^sg}GQLkG^aaH?R=I@_%2KEamw^H*W`O znzB&}FF%wkbUD&5>M`bhf#=B#gPPtAljp_BS4MVE`tYCM&*!I?M5)T z#$LE(nMyf0w64Aj2(%xC4R$UHmyic@?_|*!C_Jkn1t~Hhpf9X3$8_fz$d07Zcoy{V z6`Sl$Lf&3-62`E87$9^m<8hJ0j1!{T076;pl8yzhE?_3)9Az}f$Dn>^6cLg=2BXRw zm2&TER?P+OR8eaP7_PftcOF+e;ekLtIjp1~%;-Ojq|^T+G3PBZ^e>jJ;X;?LJ|~3} zIx!X|c$;%4q`Z!Ehgg_|!($h4g{Crg#0$tF7Gfdg;N*cVY1H<7@;lE&NI__)@sh8J zd}|X{^B8SrC_hWHAY76_)}0s6Mm<=nIPi~yF<=8xJ*4l=afs*}q!>xoPdO*P9-OTx zG+F3soAJR!fF+zf$KCUDW@j}*JsWy-Ks;{^!$n;OqBSYJ2STzWq{-!$*X(r5*Fo!8 zqt%S>tFOd)FnH>!>lUEf ziRufUL0$fWc3C;pbbYJ-%N}gfTiOXXDGRPw`&M*?r@&H}TI{4ZAM|E5tlWh6yF453 zMR@*mMax{udCre*O(5N>ZT2kR1n^DW89ma!MIr&_{=ms~|I~%^pSz=2qM?>Cj=8DV z3_;^|QV8_O!H>)*!xLL*&d#d$3?CoIy)$gcF|r<-muRF8;e1Yru(b9JhZSis;cL;1 z{#@hPlUMNFN%aLca*5;*A$wxG`sjI|?yqHS^)Vl2vf64Bd;R%;3w2eJ1ir04P%DrG2478jLKgsIj<0{_yA!2;qde?tusc2ROdmQi zN@zl@X4h(nU}1rWRI!L}hwDYVZ^&GuKp1~4gZoM0X;-7an_{SlXT9>jv~ZamPAkA` z)VafBR;4$?H$64qHaw3SuG$y>WArv94W8&(N!U}IRDW*cQpa9^-3;o|4 zLqWar*iC>#%~Qp=>~ut`B;|Y>UoX?Li?^6s)_bkunl_$C`VWg|>VZY9clh71)-s&z zsKdxSY2_h!*Iv0A-(CbB;%6Nx#OZ*hE&@mevd8`I8R zXzR;8P`r-itf3im8GKx61$i56R+NN*!&<&F9@=|Fyu+UB*;y*rQ8=eYGDlxDhjouI zJFhyVQDRTglBcBm6z7R97e*`3HNcuT9mX}eCkTKa90t_6H8*BiF7fuQuW5;0(_vNGniq6=$Yj^&<%dVsJSgk1q|)55yZ`_I literal 28629 zcmV(vK4Qq^I}X(C&(A;L;y!AgeO;*(j#WtrSw}$b za_`n?VLgRcv5TgbAUeHu!bFcBc(sNTM*Klr>^G?GY`}_?{CmtPxw`V+ShCBA-BAr` zQTnner1Y%^#yXDKuplt_lMqee-1mwqh9c_)7q9>sgVacGFyBq?ds&}@zhpT%M=4d2 z{kS#tEIZYpvkzf1pq;3J}wLlH52Zo6!GBZjya--u4S%=BZA z)}}BA3=G?XCbnweT4teQpJZpL4e1pWvP!`rd~2)U8xDA%R6QOJof`q;Q+0m$Ba0?E zk!ICaPX3X)*j688)20$wl3vLM$>mKW3ekg_JTCbCp>Arn%NGaB`y zL#eK&Y2%nthJ7QUnE%mF1ETWk>xt1KReV5S$xvYe+lgq2uDw6cp!X-NYv0^yF?lJ} z#frKloxbK0`k%(+AVaK}%Z`ZN*#=x43Wx1fZBm+>LvLrO+u=36Blhry<{SZ~5%pj6 zpu&BeXA;Y=49Fj!ij=D6vN!pSw4JoNLsHok`MF%iOS!dv&P`{;7@e4VvqVe9X0nvV z@--X{=>{5kQ_A12V8@Q(uX;(UL-}QA*?Zl}<}zby%HVduQOJtPihk^I z13EPz!)V>Y5G`(Am2eC85WPJ1bRq-t!*KXrs^zvJt(T}l*f*X>M_mC3zn|pvV9AKN z1B4S1XvN=ELb-zW|5#jjiR+ZsS%7KB>CsF%bOmjY96LS8&YX|3^>82ipfeVuQYHViq<|7 zc@pxX+G_q_%gF<1UN?OzK^Jm=ckuv$Nyp7Pz ziG+Kfa((AST{#qGm9oPaZeQP+O;tRZi@V}tzZm|9U)HowZ}soqWq$IYo{Mq@MZ3+h z6FS`q>3@#8=|OdJW1vLev{fovK3{F*+sXI=lIBQhj!@nJGoyDEk9 zaAN@t@iiwv0~YNIE%NBQ(GpfsuDP*ZX$20)d`M5jxVViHN0wgEn5MZx6bw<`X$nC> zCFdtnEnWT}^-?!HdeYM)eTnC<>XFc3F1UP(&tpj-?xOswcRp>p`J~A0K&eJV?-;aq zT?o7hlb|xrdy!joij0^Et|dWt-OyxBLBTFg7|R!#JUkTI27Pv1|^@Pp#L_(oNK2Ld9 zL6Z)Eh2{F_?qH8a=io|)IyLC0+EHKhvSU(9|9FbZCPtefGA|T@GgI2 zrYR%ZAO{Bkt2VIuYO8v0JjXPsc0wri9nm7{(E zXl{|9A+YN-7FM13iS40c<)7?+6xtEtXGIkm zOAc_p=Y8EB-i8W?u9HhACtGUJ#f~;vkv@Yd{{`}v3S)v`uN-QIFfOFxiDH2}L`wee zcySn-2t=>SCzk5a%pZd~L{)AcL*BJ?UP_(iLDr!xyG zf;5vi-nmG+`-_~fyb(6ai!h7%; zZFH58O?d#ku#~y(K;Q$r_%!r-rK#gyG2PHNBuC5AXu-=`=H^7?MdseGh6MgitP5W0 z`7mC7N9vPTI)ZE1#SBiETS79E)N8^XOErIW;|gHAjb6V_euW=PG|>jDc%(xvpU;_{ z*77)EL6ljz_YEN8f<_u#)MB|)sr{XB3N5rMW~2;acH=M*xLq~K@XyEpSXwXUZVotH zlV<48A$Rr#Xfkj?h|A)fL9D_fj;E+OUBiDuLnF3^gd+AVw=tNx$OUZ(W9PXZxKPvS}_Gu8+R)MK!ZN3Y;5l?;w zbLev0I%#caK_B=lkaSIk0jTuF>9z=?cU#0wTyIFrTeci#1_Vg9IzA?}a@Wh4Y2k!xe z#v^@hicNb~xdbLB^tp%jY?4P#B30lkcp1qmm@)3kbTqs zd$I)j*f;b-a91LYf$GG@bgdXa)wqW}Yk9rn7B280^A6fmPUrKG@ldcf{YSQw>O`uS z(@&#AYwu=$_S7gy%W})E)xKFltiPxT#eK`5r**l6{+^9wGkqxfMSe1DF7D+9LlV5- z(w~cyBw8_JcV@k23@60%T#e`HEelJGQ_qZJ zJ^-Mm3rV&|})qm?n-H=A8ou<4kus#Yv0Xaz4ZBDsH!wUmBvR zm93#d95ai?@WK54%9LQ_2rPud{uE27LDEtN;K}*FAljbW)c8lhZ0A|ps1nzzOG2rD z--P!>`GFQjRDk>tuj#l*FaJ2D+`nGttruFK_+{9VKHT1=(47(dzV68v0DxG0Im=YI zy4iCL!Z$Sy*uISct}})e__oq&1j{R>J}UVcAZ>UQS1yE9LhW`3=M)Myt#jxh8hS#bxk99#(b=m}a8s@1 zQv#K&-Ld1D_!#2wi%#sK$-r?Wa(lGGF!xg|BHFih!Y%Mwc6L`!)=zb>oGOX%HB-|V zKQhB)7zF}4GZ?m>jyW0B$swl<)HU2t=p%*a5gHYxAGA`w;kFbjzMTepzOnC1kuOwG zP-!HOV(e%A&ntA7Lujh|wJe#y*pe#ta&lf4Cm@+lv`@gz98CCucik} z*G7{K|L1e@2Lia99SxPj-2=o^;g%XW75Ec{xIq@On_?8a#Ap=yyhvRe*)3&(*)o!f zo$|6y#wy}>35?;*IWY`|aF?)Cg01=_;$f8GOumZI0y<$D;-7Przy)9B=8*PZtDE!i zOjqLiWRa|8hNWxA_WOpbELc&5yO(-9dqpk|3lCl{r@?Da?D&G>9Uu>Z;zP@J``|P6 z@;1nz>vWy`Kg6jiJ^5JC-=g0Tv+^(F5Cx^lWDT3sIaWQ9 zz11pBN|`u<)vv1v8o&P+?AKK`EZYEg+3W9(FJ!Jx$DE<6=akQ$s7Le-P53f=&QrrT zVbS`Tj9IMbmvMOfZ&5G2i^;>L@`tAQ?a`hU86~TydoZT-S-`+`8aO*Rd#BEABGtt5 z&Eu9JWLtWB#4Q?G20SArQ+o=h8CTd%%+E3Q?-M{f zkUo_ye*Z+8-f`AvEpy|eM97Qdg!8Dg!j!#Mlu^LP7dsQjIs)g9oU1Kly%X!xq#G)0 zM4Y4EeE?|u5Ud5Tf^eo#)_N1ViQUO|Bq$bzf!CxL1sc;;;+Rubl5V6 z$gXz2ETmBEZ+o|P8$rN6z@jqnI9hi9`a{mVh(&j0MS*AAoD{ z7TBvVzxGbDtQiKruPWb+Q!e!<1j@2d{Q0dgIC!q>94c*Rbw|}QjK1Ju9{Sw^0uLGD z5^g24v&`W2iBU6ysn&!>T`taz-?qSZ_Ru+(UrX3qzT227n>Xpk#CVwYQcBMY%b$oA~?gLNbg$ zP(@)AD2K?senD0PN2It(_owd6C317+t#F-qXY&)JMKWw3u>=-*_wgSkI8#J2#e~N| z<}~0-SNRg`uyGx>W*PY(n~eN3Vd48wUwwFJrwU8wh+Oc)W^6f&7`& zocVm*jv7Xk=iYm=PNtaIOGTz%j?Gb?$&Om`SA!;_7L|lqh5yT_6?3&6^{Pn+iEJskhr83U%Xek@?cX`+F6F!8XMIyJGn z0iTk4Te(ie@AfSZDuf;o-oX?uo{QcsIrvN~(zRnO2=RYa!+)=ihg?O!Yx}8Z%cfwl zq==5~9GX?9XvfJHKZ{#t{KXQZSvKv^+YWOn5^2MDV;okd{mAZ3rz4lC#y%lX$0fyJ z(-4icoK$v_`p*CP9U_jWDG&j?hsJoQb>w{bW`C`jgkzbn5>4KbUZ>^QJhGn|ME^?TIk_frvKbwnJ=}YxujnvWp>>O&Ww}FQt!+fSUWaq z8aireyWMzA8_tqh8Nnf+TbW7h4QaH$OVtI?3>cUxHV>9Pp(HOql@&zov) z<#9kJs{C=J6a49tg=*OBl2n%~$uNlq-pzgI*2$rsT{f$}0#}P|?Mb zzg@k%g&BGsjVn9NNG0^9!5ib9F@_7y2L}lIN+g1H$m9}J3wbW*8%(2=^zB1GFmEgS z@@t|EP`4|cy(VV&j`J6o!jGF29P_3J5Sa%hoX zxx7bs8d!s{PGP$91_7xhf30QFMEq7u5b`fol^)9=@Z?XpREuuPem+*rYL=y`vxrq4 zmnq%S%E$*7JvA@-4&f0CE-VxeAZ&>*=th}NQuEm8vNt8Zq3PcwH6fW&?R0%yKnC-s zdm{MSCI|6;0-zOL&4WmdMzqD0AO&yS0xoc!mU4@*4#>ZrzP-`!(w#^e6PnjAX^Axy zl}vJ&UJVw{o4%WcE1^8y7sx1snEf=cb$pdP99$?~Ze>XMIl96os^lpzQLg5kGS5k9 zA4vD9!#4EkGR+M6vL^Zb@2V%_!>WiN`QF7gd#_)kU?2n{xG@cr@l4KEQ3zDjcAc_S z_(T9PpMpq5s{Otxo(nG-#eeYhum#$)B%9kizPY*J`kfG=F3nH2lYfkF@P!lk4x4~p<@?j<0VQkqi=!7*lIm036A+|Y;H!vIKVEt^+}C&*}wv`y+5Sk zo!^XcIXz2$I9uRS&Z~EF!XeRHs;qz<)Ld&r{|RmC{$XlBOWMi16Yaq!rowR0*Kf+h zhr4|Aqet>{g_ML;CIB7ZAHiwmbcM04!7%=fDD=5Ge&VB22 zAKZBF$vJl`nJu2hZ3#{pkd+Va2?)#bEX#*2xbOxOh#}U%MK@s8|2xn=ltOYTh!GVq zus41(Z%3Uf)uf`8Yi&H$$%UE$SLP_=X3un40Ya?VQa)bsmy^yO9{{`?a+z4<^7%a;TisQ@osw)9@6%eeN4Ie z-CL`ks5%_zAUHe$O+D@dyq1nvK_}@qNHHT8eP$oF(#ME;c)qey5%f7Ql~R$Dw&^NNnP4 zym*;iEOXc=rat5roYBn`8k!WqiIA3E?&Y31Y=p?{wx6KE58JnGXuy4Rk^^y`?n2~` zqi&T!fnj!ACZ~R080TB@a4+B9Vl|8H!3P~`i68%K$eajG?^TFBzK6b9Ik$teJ z&OpD7YfIS<)#ogmHn0pIoLbwVW_`8ri8BYZ%-wmam}D-I*a@y&$Yp z>`>y|BR#cX?Ey~e0jvfQWtImzjXO5|uRcfOB5#DQ$69v)=ZRp-NnGCk+IZTxsljYx z2Wj1bTo-iQG%no@W$(GmGW#&6>{^J9N2PP~5JQa#-DB#6igQoTDnEqe!Q~nnLGyzK z1yVTKlc0rJh5+XJt@tJ^V`HAT?#+f&PvBmq{c%^i7sF73aGJ;BC3~GOoS=2bYNuXq zxDbV*DOX;j15JQbk-rwAggIZ}j}#As&7w^B8buSQZ>L+yJa8+fYDV6)Z%^C7dSNwf zOo1DvXvo3J=FTKP zDzgS^M-v-$07?oMtt2=@PqZrcTxkvxgq07wd9#6F)xSw>@n9BaF;~3b zZ6GU4RI?#y3+Je7lH#R;vAS+yb}58h?ZggT!qZ}!RiG9c*A6J^MJ7e{BDBb?7U^8f zDex#-?22y=9X48UQ}+O!NZ@K>ryEF7o~81F9sI!0-MHXyrbbQq8_WGgRim5Qi_#b= z2g9;>#HlAYuFqlU$C;VU7dS8QL^44G{H;|()l0%6#j7?B5>=%fcD!Y=lTVVCUK>B)7jEL8o1tiO>LED&nB{587B~F6R;w-X!TW9Y4!C!T)it37E`udQ`wHONngW%YOWF z^C8LDR4?c-HAgJvB@UECjFa_^5$miAqhq7ea;2WeS-}(?#_IHYX7Pi8zp`og1$Mhe z>Kl@?kUxdt2~cN}9$eD-N>xepCbV*wc8q#$d>J$m#VU(Mwn1ypU!WeMltf^lMY`aJ zL_C!QDt3H0VKfRjgrwS{2yAC6Di{n|~|0RpN7Q;t8lC${Rs%g;coW1U_Z7MFEJs zL5^(Wp={OwkKpAym`~!8ceS&oAK31-!TQ_X9u(lZsn`jyW}}MfLxLCHJ&FhR4R99P zgzG1Tp(@s_>18?u4m}68`W37DQ_4K=|-EW260a_ zk(Iia@YSfs{1kRr^5Ej0(6PuWtz}F9WXB$ub+mON9ij0cqc7B=(DI`lbV%OJBzbZV zbIe6~-3RFW`4B?uJ+|!{fe8t71{7K>XPipMAOl}JAaW6KI59q@p!)I6@co9SW!pOZ zJ(?<+Lauo3Ff~iUlN><)xxN*9&Ce(p_x8IzT1S64hdbcoc`*lj9ZBm7QxgwwrT1D? zWtq`tnJQ9Yf_Z>g0m$PK7g%iU=-+?h?F+*yCQZz6=1Q=*oecueBI)Vy9+h8;4=1A+ zGM{$_1+B6{>L%{g7L*nsQob$W*6hKpl#W-`Md9E^Heh_rznVUHN>WEhGb3B-wSr_* z5%e5je5?v4;i7Zt+!p)-CxXR~;oIxHg7&$E zu`rb-*glk%N?6(d!ks}umm5x_nTjpdKbe=$(6pHs9|JepA($V%ks}N1g?qDyG{iV3 zW;nfLD94xFRll$MAp_BxiC&cghlfhOLlQ-3j=nE`5&@~IpCsODzp(x0jUsHF(QSEm zTqP+ix7F_8IjMQgD&TW3u16@jjbx2^>rY2XPsC!^=BtR+r@_)cc=H1SY9Sy9I`Obl z`wYzwB0+al>8PU}6r*uNk*p%EZ3);@Z{{oe|%R|6K z`HQRwE}ePC{GEB8zI-vB#QfDl4(yhp5Qr}TeLTW9q~VKjRgpRr8p{THH`l2S9uZX? zY+{U}344>H{3>qMFhl^HD>!^GaiT6l1wr7xRhXNSbpO7e6>O(vb#bB0fbA=`gFMGOp~rE18~PG3ro= zz&Qs%=**BqjbZ*vVD4|ql?uC*kPoN67_-s zhoVJC?LY>(Dc*tULVhjP5$mi|65xbtZ_9Owtofra>EBd^*0oO_#Vm^egk>o+eaeWN zS;P9AfOx1V1JAGymsz?8vw>@gxP}w^Op1O&2V}W#9lkPx4&IB5Qo+Ky&h}HYBD|JI zDv%=r@Vid*%lf&=N1uA;jY2R~{5_7g>_T4V<_b=Lw{g2zqdm0rn_TghPZIFVOxpnY zkVpfhDrBs@To;Ic8H~O#B3Me?kp3RNKlu2l!!;5_*QaZFej@2s`?`s{`Ds1L*R8cl zazFFstlg#Vx+?19qI58Ry2ozhULW^mj38qEiTe;-7JP zc_8OOHWny^%p)i_e4JIC`{KfZ6n36s)*?Si&qm&P%=WsghCUG#w~jGAKVnJ(@TBn- z&@L`Gw@^^u3o}q%7k|qnYeH`&i2-mksLqUwRrGh_m6Ds|oma`pLQnI|xb8b60hs2x zlyi-D0l#JY@f9#)^;~DT+L$t>;^YAvE{QbzNZb3M2#2tX@50biA?qd785>Cjy;yzJ zZiNnKBLvT|l5#W-$70AU{8qO66^KVbN6VvQ7ek0MrL?(PgB7*<{A8M(3TX7thbnF> zT!7sg>PP<}7mN3Jd0gBh#^0dv#)~%Bg|QdbUeJ87i}}yz^;A!CA-qfM?8UTG15vtY zx)734^{tShy>62o=r^qX{KJYY()SY;O;!z}Dy`TY1M-gLV0vc^<(UcA(jo2gsB}4z zN~Xw^Jzx3{6-wrwhQ85oWdlC-Jk9pWy@!L6836x+8N7Xn;6Hw&4~G&SDct z9xrt2`Bj(@o6&6B_Unkp&&LWDjrq9WDbedooi*L4kIu?7l;shL8lFCe6+NliF?&Zd zG;Di^_$i?_$6q1t1uQjL+buKew-DC3WKmL3gxw&`H#>Rq;3TQV8nQLTL~c3Dc-&YuE$|=!SYY~o= z%H>YV7FmxR1D>uLX!-c$zg05aKCxAqfh?c=cI5%(eRSWQDp?H_{pQ~l^68nYXa>&1(8LUnp#$+bsx`gev>R3tlv z`20BnsTao9EyK9Xmrvb3YBoibC;8>H?A<8GDi&tuW0Lv9SS`weTvS4!3kCYyPwWu4 z3Qne5?!F6mH7tLG`TsivjarC@wrjU!$clg!uV`g+c+3*0hTtIK+W?kgH9}LwJ%?=P zJ3MFip`~=5Rfmm)i#fy}_9V{(hWoO_*0vMPy=K z6dIvViK*_E{hw~G&zdxKP! zU343RZDt^AKR4@akHN*WpnUk)Y~%&H|6|E1z##H>a^f1MuscDG;Y^l?B%Iqcnl%{> zc~K0fTl<7n!Px^Kfe)&xwCeljMD7=ld@=*D-kfjc0z8?Oq;h?E17oT>5`U3rWLk(U z25w4?k+><%pNgKHS~~wZ@;zDLSXjH9Kj~s4+9mcbzGq9B4$ZrSY_(6({$}*^)9(9+ zmS&bS;983zFsx%Ym?h23;w*z-<6sg&g)&ADI9Zx1MXwFiiz6UepR}}HA(&60L@z>c zU_;toy&S|s>T^B&{d2SZYN?Sv9KKl?I91+$QH-@!&cFPSZ~|ouk83Ow8>-@KO5g}s zOML$xh)?ms`k1khR2H=G%Z>_|fV6J>aB%-#!JNBosm{{^<6;e{{b&)oVFb4@ZD@Zi zDneH`WO?~)Ddq`6JdHc6im|DM1+11%6a6lG5X%)sBUNH-&$2=}NI->}-G5s+$pI!n%0 zq@|40aO{&c^b!uW>i@`rp8HV+bN1>&^O5npC$i~j0l<9jn;O*v%wtiQ3!bAG^4Hd^ z(9#T2BMxDKEj2UDAgJF%>%ip&GRhMN!y`s`g|4G1DEQ`i>KB2z&s)yRw~IJD`x%Oc z*&Ut#`=;@leKmRo`pVyRu=5FVyyL<-7^tfc1=e(^ic(Xpy}%?m+y*(Zc#)OWqq<@T zNxyc;xykUfa3XpiY$dX@pavBH2G=ijTL&qZmv#nx!)CD6+}CnGAESj^Po?hd1LzO> z0Wg9+L$>AfzCF9{lG+N1@K3n(%nwOX>hL%zDU7CD+KuCCsUHkx1EJvk~(xghaYSVnm1x&T7T0LSC%N>`GG2V5lqOV9rg_ z?z+s7s)}PAzM0=m;eGr2s#9@Iub&d}uQ}~_qktx;;evyl&4QZZG@p`DQ&hInf3-k# z+;x9_%c%Hj@|~&91dHk6PrJqufE+gX-Gp)~@r$VzYA@Pte5aSuq>`nf|3l6)4jU8x zFO94kfr)g_E8xb1Sld!QX^I+w}nA^|i zUtvM8s-899^7CbuB;UXoafD1uRunuCFFRE))5xmupJfCF?Um};Pc%EYMWfkJ#Dj@@ zO?Tik_G9vcWqix)m3iAV%CL_;XerGW#7$F~)i0}kHOLk`tIFDbLtT{)=k#6)$o~Ay zv)Gtnd4#@hF8>Nm*a?b%{Z?E#-#Hk6lOiLw)|II8&XcU!41IitZFb}8wQ{V>iaZU) z&hoxCxGupSWqG*XF3&DLCdc5>bzBOn+@p~6Vq=iwL`IY104`JWV_RDApD>G3Ye^^n zeZh@|WM6ZL4vDHTes+*8&J29S+IO@UtF-?QNFWL4(3QTE{jgHb38M@tcc&+j7m+@Z zL>|OMG*m#hfVXxnv{~K_!2pgTYAS{fM5N%O{5q=0|SzT7m52qvv zN8sd6HP=A-KK5S$<$~@ihpN0+&K56-K*_r{RTY)u2N>beHs=u$6)0@I=Y9u~-3}N> z{n3p^gq6vcOz6yKLM*vcbZ}R}9fX=8Z%lQ|lV%cAnxCbYx?$9(lOUuT#Ubmvt6-%@ zT9v^#akCMr(=Xv8Y>3S(p#tR08lp}3rIww~u&P}Pk9gF=5T^So_x_ysd1^bol zf6u^`R~iE4FZr}O;T&iT4;ggZAyjq|Q}?^665^v?8CHASS?}xwyWx*cL_*r=fDfwK zgE0g?2>DV)k0`ypr%{!?7(@zM3lHXd^5CVWxJAxQX;yzako%PLw0>FyK{J-^lY%RWwkDue zdR~QR&vDxWVaeB2wh`PJ8{a2J7OWzft#r|-*|gcrGa(W{umLSiUxN$e38U!}Fu))V zN$a4a%{+M(FT|9r9O%}9vxK?ZS+GcO9!gwwT>T-7bC6%ec!qp%a4O#-uc_*_^KyJJ z5Im?TaP%Bg6s2)vTBQ2aY>0zBjIuZ$7<8eEMP^>_h8l4uZe^zLPH0z+3Jn3>c}J+^ zB+TsB=+m>-h?dd@7Oa{$e7hJ*&2 zX4NKcFlk=rwY>S|MIpp;U*;l+B7<84VP#5r8e24ggPP9)@(gm>nY@36hyqE4W8n&m zu>T;pU6xyrl{wX#*Qc%w&nyZ+|JUxeAJmG z;%W~otb#nNw=NXjtW>tjChVz|f0RX>9suB=l@C}Rh(mm`hREasS-cE?c{oWo>g=GI zpo<+{@iS}fl%dv#P;>-dYmGZU!@e83EF>ixR`F@Oh76 zi4)gSE51b20?3H)JS5`Qi$q`q^wtoPMArmB-h|Y0uEKF zx4Aui*}6^Z=f+L5gzwC61FqUYDqVHFIUcP+{d%U0@-E`uZLY-f?3L?nV*Qzm3;pHd zo&2Nd23F0Ic91w7uBGHrTTNmfmQx|pL6$sa9OTiqwqgUDjmr8py0zlM#s1t#T_40x z>@F$bRA{d?W!39!Rzaa|L~6a^v4r9+*Iwe%14*xnt1*e4%bZVtBC2q-Q>VV#{eQv}>5Ls7o4S*zyv^5b^CC~^aNDtunlK5LvRw50>I857K8f{COt~jd zFb@GT6Jv7gI%{{ocw?MFE9tR&=&J@l(31BX`=OeHMR`iAyN^8FPQ8G1-G}}6+%>tb zXFe z&&AMp_3#|e`BJs6*f+&X1a#m*b5JaJgx*|id9|FX5Wqb!p9|3J_ZW&DIq6-fwirc4 z#bJ?HS>X@b@DJ0fDfT9kAX*UjXv79_^@VEN(Km^JX!|J4`9*Lo2HroJluhs5==Dc< zgTbDP^fl$1WwRXK@EFQzvw{f;4*omBr@{o`ra3hqmY?lL(wT}i%)E|&otlOy)JO(3 z@BIiD`}<(>DlCAT$SNW`9sYksN`EpI0S(W#HB^d=$ zn0vICzzhI@p+zQbGX1Ju0HZkaOyaJ0%{}PyV^J~BHLc^D0|pFk(d5r+IyoLQ62Y>! z)o4kguH#>o`;MB5D6@M4KDiCE-U>AiIPbXSj}y-{#Dta@kc3w43Y+OB&hC(dwcK)X zgxp;3k9bBv{IUPGu+|?@-%7e{^{ah6{((0lBk_w_+H;%$9E%?pkA>~A0_xVywJm#W z8APLVmjpedkHf0SL`-O@H@l~x3X5=I>Y_RGV`-fAb$<`h+(;bOuf z>UnZ@crs-%Q%V(ySBN2rogUR;-+Mf#;!mEiL!giA@B^_%;|5n~2D(y;DLux#-LWIT zA%;2{zHQ}ki2Oc_G41A1Sw^&seUgRrJpUGCd)=Qz`jQ^AvF@5`_Yc#)yh(9PK_O7} zd?9flLuWW&W;XhJ^4q7a<_!)J!|j6+?Fg%`Pd09S;SAJ4@9MhJo0fyjS%AZKpSk@r zfi@CCe?VPL)&a=?`i56DH(stZ!9om~CuUKAoj=2#-H$jlr+GB#(u2izvZq0(1;te6 z*JbCL5m~{pU!lH$(niAOL+PCq<9?W=a4rtgfPj4o`}mKa>^w{sOkJu9(77EZjR?@H zoz732hA-S-L+sB0R1Ykoo90T^p$6vq>o*IJZ))UEZsS0IiHd%BHv5E%aWxZL!J+wQ zd*MOR-D<}adM#FY-D(4zV7G&v&AAnc(7^WizB$mX5?-f+$CCQAIr%HJ~`l6C?hAu5>LRSB54Pcos(IVf-PdvoAJIAqZj;xCNG0 zi17~WZmgC@gu!F8Ux?OnX-`U?`eZ1J(qc_!X$V)|s6h)`%PKp)o`4>NL0^(CJr8>K z1zNAl3C>Yd2FCzR;1(-4@dJ*^)vQ+|Jsj8dC^j(FsnzT^lQqaggoD3PZesb+kbnlQ zJus-k)QBPl3N|=Q+*|NbGfTKfD~SiWc5W?zh_n#Ln8k|tx%EAIfDHPu=C68k==YvC z)k$DDI%Tp<$K;4!O9m@2cGV~I*R3GIr)$fzVI56=_x&o3Z@gHXL~ByoH0A0vb?I2- zC!s=yLb0XKK{y)XJ5806vCvmmULtNNU`(x$@)Vry|Jx=rd?A?p0P>{NwbiJ;GYHUj z3RnXUsqk3?ZRbe~J=|~zCYZlV#v4`)b&)O=|*F2&67to zo4{p-i;vXzi?5#f40Sr@8i#UdfRfL6@Xf&r1D|}R=Jr;W4AS22RM}K`H{LDfj0>1* z3F?M%88f*AJes&Bho?Bl!)nu*kW~W zP;jZ~@D1q&gv^E z5;%PiJfdeCN>-w2bCRJuEYSwR$QV{9W0*YG0)l>9Bf9Li{8Zp~TGr1L>rqECjueGm zYGj^%#jX{`WFJIs^tL|p=MHq!t;8|(UIv#<$m;sUdOb2gvP}luC!VM06f`;l)ei;h zzzdQ=d$B4yvV2j`<{ocv-63oOnl_-L?o11U4dRNi*@HkN}4fy&N1bE@E7Q4ML_XdugOD2A>6=s6&U;V4fD!Q2^o zlYXYvZU3!>;vD{g-Z>JH4eG1zKDOVrM-KE5%djrB03UDRp?^C({6a}$LAjYXRdR%)YK>=1 z^ooxlS~dceb4Y0!E)X&aRUnBwOQ^~ZIuFo?EQUVACkl`2mNwAz6|^CrZq(6v?U=s` zYI#*s_n-%mfw?)16YjR4_TLd@GG+xio*d1x+xZ3`;lN`8GhhmOI+flE2;=gYa#b$m zZ=Ckq2F7q>&|aC14BktB`DY0m|NPYLO-vPTRM7oy23fqZ*mZpHiC+&RcrTf1pTSbjw*g+!V z^!G3)O}pT$>ru$+{6L@9wwxo*1Tkg&L<+Jfm68t=QHfO-{<4)gn3viZcUQ0lPzY$| z2&5ZwedM()qa92|#M6G25KY-*x?qDC!Y4|PBa%DQ3*pVt5r~BTt0gOh@RQjanQ3OR zaHR)y#=e=sV1kcu>ax($AJRGu8cVK=Mf+9s?F)yZG9hnBSNy+QUo&Pd_7dfVuP&r( z-88Eu$w41aW=kNStR9)kTQH88C4g2Qf=?sSs(2mDZIIp17)MY#*Y#rHc$phaa!dU_T4Lkwo}tmY<0ZJ)Wy4| z{CsnD6?BnC>Q2Mxf$yOC5u}U(06H5&Fc=uDi5<>=7KV6I3Y^WGBCk4uN!>D91BYKO=mCklm6o-|9gsG0l+Um(5^oEULSv0>!4Ft0oqd{ ztCvAT)Ucp!)*E@_$8$gc6XfVdqOCI$r2-Jp3v0S;N2!3I&h~pSq71Sfbh2>ub}E;) zy8NdfmPrD`w(jQ>t_XJd(<<8Z6TD@Bo@B#F9o8Xo5XD(}6t)wlt?n_lJ4|S)QwpA% zg=2n5yod)*gP(cmP@&IQCg!;CleAwL0s|tU#N{Gpl}F5Y7&pO71L28Ryn0Qxg|Eg$ zd3*Y3A`k&GcpX9?I)V6O^InH14#?d)_>|$V%xCzD@vubJU$~md-950kTSP;FdjooU z)ltNgXV#Y`{39r^a8%@?OY5Av=XHftTHrp7AM=7|bvQk?_#aq*lG_{RJBOjmlAgq1 zouI$_5#SV*J@f54lNf7|moLfEU0x8~ue5lOhdWsEWCTWxmhR2$)nF!ww&IgVth!Q4TGS(QU!A?(gRlj@$Tge-9&k9rHD3K7SP0?bWt<2zUs-@WXG z)=}%&U3wIi1ekXh!Ea$^9-rs}zO37Nf}N=H6>q}S4D!;Gm`{QeS9h3*2F_dW$oRdi znN~%$Zkq129F0_A+wUC|XHWvBGZTmN8C#SCrL)Y0%5Y00H&Ln?(5|sff&mI_z0}B3 zRQru8*cw4FyS&74MWvJGhCas=rxGP-gI&gpBMN*))O^-o8Z&3D)UeVMT|Fzog+Utz zs|-^+fh{X-mCET_DX?IR)fDa^1U78ytvNq5&7P-K(_SWbu6SkR-NT24$zZSZeuusGy8Xkns$Zvq_4{ULCaAzw-4j*JyAzJ6x_n~4NPj!6e|gAH7f za0aV0i!;sW#OlcLY_Pp_Y}irynsb;KP(Jv0l9KK`XWVAsg+=_x(F5=FITu)@3aQgV z+!J47^gHTsW!ZIa)|3T#z7BNU2?ULH`&X&(Vpom3eidNq@!6)kNGwj9n zi05kkUdZCrC~D2sm1DR~ad?dQC_LH7WMZsfU)%<;QL_Auk`#Z&#dr8*Vuw)EkFShw zTStgV!-Y&Ez(FbM{K$R5~;>4{zBPmm@sS}BKYka#3S-EupxejW#;@t*j`KH36 z=m4mQUK(D+Op|uDdT>en(IE>bd6EO~zOudmo8J@7JRgrtx$P=(O7T;1C$Jx2NF~fA zm*>;=vAN^2KPmdwcRE-p9N=;`8XGDe$h;kZz5oL55o!%DL|pP|vz*HbA@JFB zpJWeKOSu0~ap#m}S@&ixyJ$b(UT}r22JU{I9#&FN^NPoSti(0sGUOsd)p?bjQbw`b zB}jzruoaq8Q+UgPGumMLgyuA+rqBg2zB_4^TFSC1bZA)ifq<~-a)$qP&F|VZdIlc~ z(;=@7$A7&vSo#eAzk@Xb`(HCjeMOj*7z#;9h)+&P)R7z)yx%*3vTZr>NDc3qaNyZ) z4a1xn+LV3C!C$&~nb@GkmhIKO=FGGjEz@dvbWPK>6&we}8BUf(P0LbVq_KlQT!>;x zD2lg61zt8vU(vAtZa?$XAS(@ZD#{~3R zdHtwuvAs}C9mTOXVbXcm*yME!)`J-@D{I43V9R)N=2#Vt6Q^sd<#uuKqeT)4C&mAF zle~xF7&RM&+KG7WCB${y>LAe7Pf7z;&?(A5C{EFEdwIZ8fWQ&W{h5|fOE;Vc7%J#> zoJtk|{h~>kEzvAHL~pcMUq?CA(HHXY5%;FCcFxA*5^idY1*tSs;Ge}~&ft_!X%7tY z%3yNXZQpxYk-F5=)#hJriQtrMX4}ER)*+kP~Otx3NUgwosJhQMUx_<&+GgQ|35%xHEc`Hh(f3&>V zS2B#TIcRFJ#gL|bYI>s~Gg|LZ)HA-1nr1c?>|28o-wJH>pA{VQHhuDqqat%R-0OD^ zH4!FfazkXCQ5CsLIpc;Ulu+tLj3WHoqv5d#q7D~EMr z(Q6P-f)!*+tPc;QEY~i6#SVu2Gc_P-4ht327(8%$f7R!L9%mfiaca1bo6yJ`09s}T zB*6M*7nR(rjB@P*CaiF3y;m>B$8lBf1-wg1xrPW}dW-Wz*Yyy0yr7v;hK0&yi?xo6 z=hpy`LMiY>Ie8;_3`mXECvwpQfHJr(hN5+v-&?2%B6rX^LXw7~fHW6Uu(15b$%X;| zVP02AJP5O#zb6*C+K>*nj=UMC1($1d(D|C{2(hcinXb}Q6=*2yDSNTe?$xvOGDVIqz$I%HkgLzPe41+ltQ2-!f z;j`;yyRwaA=-35xsw}ikG_w!{)|Xq%gA$6w!YQW9a7|W_J`)2$T&Q?$*oEo13-v9OsKDENZ^&Fs+u*2whYX3u7n=OxD}T4O@o6$}H`c)qmK28~M0g zxCuLw>Q&opQzEhn-N3Qtpmd=EpiBKN%G!Ja%L20!^lr%d$+_+EQssksL8FJQ6<75n zt0Ec)K?OA^N!Lu&eu%aG%s?P^4NFQ2wrD-8zO5pY6sJie;_{T}z+vqiy%v4l${|>~ zfC>0ul`HG6n(1~UKeQXI^I+rZ<)~`t-C0OY0d)VNfX!^ADqgk!X@`46(O}l+Of8wl zBj~Ld5neQ@aW?u0nO~f|SQ98O+v}8S8BZEY^#ap1ycTUE5d@Fw`Oqi?=|P4ra_nB<%ltoGj=xM z;nsalckNM95Y6l=98>2wWA|ojoY9Y)d@LddRp7y1Ty<^Tg2=r~WKn?K7m6}1Lp}@b z@Hg5?Yc&E=y=zJq_YWUNOQboF`!r?C^h=HfPV#X;Tcs=tuEdsWK&TmkgywE7cU23F z&E7*zZ0X^Y;eh-F=P7cI-dRy3e4QO%B~i0V4<{7(46uK(5($o##nn;wzPdrBdx=Gc zOEVrIK??yd&Fpf94S=vqF#l7^Wo}N7Etf{4**>?0RJsD9ReAa%19EXOtuQy2^`;?v z=a7YZljDh`5Hy;ETVi8DV|a!SPwpdOfsmQk(CPkspZVB}*0*r1G>1OrY?9VBZiqY6 zVP;K9+4odO4I{|Zwa22uaU4lq>!{evS_q-oxqZ2*!%oIyUR@VjbT~rjrSx4t{m982 z35Tnj?tTT*+pS0*3%oN`$Jf9&ZS1%rW()%$gl8P*G8QErV+r$pvKr&%1;V=FBFt_x{O8^9n_XvEC&d7Ccf_E-2&q} z)DynBnam;&pOO>S7-p<5a|R$3WM@T&AJH=BMz^uH;kGk}4p=V0Kjfc7OX+q0z9wqtvZqP=i@&wW`IY{Lyr`20;!{d8n-|P8~`jec!&Sx&GSb2l}P;e zq?|V2p!lDhIct1Y6-uVM#SueF87XO*>h|@ZDMj=YQ!2+znPD)*+O2+U=1weCoi^V` zRN-u$Jixp&8lj~~TGAMt9N+WD+v>m7JBgqgXjAWZG`f*fT+c!Za;DIyA&*dw`bsP; zbYGcexD@pMQva(GyKlmYz^Sx)R;>pK!LBHF2Mt_{?VWN8ck<6cbBUyGfX>I`=d4$ShS3oFK*IOhQ+sK_{1$mQB5H+<^f)*lap_MdWTo z4cMr}1pMSth;0qqk&2U?Q+ZchhhvrtAT}9Cq$rEQ%=2*74Bh|&x#)o)_vS@%&YATb z;h%P|(rey0sb*337FHs&ct=(2poW{8YBYJU!0FS|uN*vJw4lkl7h2Z`zM&8~<$Id) z!%`5JeH@s?P|H3W&L<1sUpZV>iM93dYOqzvB#`)EE{6hH4=3Bi_Un`q2a;fUs@7`Q zV}?=QLjRG|QSjG=gQhgcTXUbP<6XGIOgiUD$a4b`q{ zzM!avFj!>aP(L>hk1$n@d*iPx1TUHX-4|F-SBJU0!}?j2UrTB#K`bCAxrPp0QFuTK zNd|7NVY4Q|eil;&{OB!rklh(NAu(|Eak=1zw>kTtF}~#V`H9>IeNpM3i2so$K4|EiBoA>k46DfB5L9aMWZnRfG|MjnI<{YI-JFwj>fJQKCd za5|;Rm4y(BKXF>E8w|*kH)%-B&6sGQx@d9UE3PJ!$MT`Y& z*@PQ4pauPKIEjWc%;sj)j2p$co*Dcgb04s9MO_ezDd<>dQPZ7;=XyC-f156Gm5U)q~h|63s5@|c1 zbAbF@hS?5S{Hw3tAt=gLW-=_AeqXLRP-b^1aqhcHZQZ;m{Ig@wA)I9ip$?jH1Ud#= zJ1KjU(QvCB_3s|9jo@9jHpkOSAh8Q7C}H(EB60@EXW`pSqH``8n_wAQsWzf@CSt2oEWX2`VYpl<2v0=cY+qT zvE?!M@rsQO;7ANZzcO%sbB2E8JFXH{&u5f#)+ad?lnbSO5rjCE7}h$?Lihm}b+jXk zJl$6T(_+caJ*_u#L7}8R<~&xcFhs$|6gH%Vv5ah~M-V;i`%L4vSO@B`4NXC|*qd`Q zcix|VTk-6D1S4^^_$tdkPmFN9M3+ zvE58H(K;lH#M6RjEPfT56_jJBQul&u&;WSHPQdWICoI71PzjQEX(pNR1+b>F=P}f+ zLm#SW<&yGI-b|b%Xjd4iPWy@)c~M4?FGwQ-1SLj?QR-#=HFYEMS^C@v0qcv3*{xy; zd!Owv9q?^>S1+SG8;pbYw|Uf6|D)5s(2LLT9#KQ4{%zKyX>gP?-&qJgtbwgE0TL&j z@{^|uR_G-kNe*xT0LAFfr`^9&b%C78QM?E@f1M{o`2txmY=G~#3`|M{U^jSW&d8J6 z#=aB-7pZo@!jgS#nnrh)?w6>|>jZO1p;+4INbrR)W^~kx3Mt$qE(>)l;|F_Vo-DCr&$jiiI#VCl7zBg`zN)Myg3UYS}InUZi#TN-T3GF8XwfOKz*jk z!?#Z^npRPccNDI5ub^UVuU7L19AMfL^i$7x5w#*_zw-uLlRC z^*u0YyA$5Eroyk8>^JP(3)g(LtMOog2tqPZFoa#P_;`hy*3G_+-I!E|VRGnH^2~lD ztf#$G-?RueX1tmg|6xI)p=Ns>mcUnvta9`UzPEECLd^at_Lqxbn))jeJ4fmyVn}JW z@-8I~+UK9u*lsLn0kK(r7N#7pmQ&TY`Wfy=_QVJh5ah$>;h{@7RZ9XezgXQN`sJ5| zk+ibIqwjeKWV?G**T3CD6LtEhC@8&d{LZzt2jP81z^*`PgVvi{5Zwde%k=834(Z@= z7IJkmU^s6Wlql-w@Q?*Vc>`dcYwmdl%PC*aQ4>}UT{|fBppb{A$}VT(T@O{=B-dsv z*>4BpHL-_;6jA@7Tg3$T^QExD=ryLi-E#%ABadbwSSqycA-8WiA)2}f=qt76*DYk2W*NIC|_LqDQ3H7uf%l-Fv^R9tb z9%;$tlnY|Y+p1l$T#oT>e)?n?MbB%Y6-2g3NUQt$&eK1{_ffOkM%D7v!TmN}vpV0R z^@wbKqOZyzTWoWk1WB@W{^#vGf}Q`8$!6E+k zFb>}flm4VX5|xL-ETMTfn45gkEJeNlHHn$#625(OC&dsO#XK!EU!{K58t>5~xFN3b zva@1M_FTcgExLukT$KsL?@U)>1X?fEC-EN6v8=1K;v)p_2E0v;bDSgbt=ISmQf9Ade2l7 zT#s@!toylR@zb?zG9$5Z>|juA_9siTY>^K!8alu#mWEaw-x&o-rib`PaHZM)U@U1# z)S9dalUdpwga*51$ z(>uH`L9Sa1^&DWKuS~8=1d#z!Y8==rM0%$m{v|-2xH{_+WO+BacP@MYi<fGxmJ#1 zmFumRcR1zwib#{>0km8bq1cZeqV11PhUN=G&xKsS>MOK<(d<6XbaRN;2N2Aehk)X@@pE7Uv ztX5yj(`VKBLUc2jznMjsb*|wU={|ZLENEBak3)? zN&wdhDaP>k%o}?$d^?c?;P}6@!44hc9elb2XiPe|3sMF+7*-VQsbiicwJR1?Lr%i} zyxG|sehQfHG0l`!-o$zWqQqSD-=+T8N168S{n3Ejdd9DeWW(rAV?{jr-!~Fr5}p>F zrP}YC^cnncC7#f5w!#~zpZ)w!MZ|yGb6_gTZcPHzzq%-3B6ta zB6IU-z|(kUxeZUf4e2MUoFvCUrCb+{=)ozu5$hur_wKp`HpAd~GTt%KF# zE2jMPB#JLzFXLh~lTVZoGUtMvyo*-w!C=C6Zd$p+`FwtGrq9C2s4X-E zhE*P$LG>I}(!9K4mZ`cLE-cD>$bXvI^Sp;dJ@8w*%Rz zx8r}IKYuf_4%`>*z3|did!Kl-t23WZ#BtN?Iyeu5t&sb7%_Hv2naoWvSxg9E{94Ol zDSx6VD9uOyR0xqojospUGj9WXin`Jp!2+c>5nuk8uBeU(Zht%?YMR10t&Hp5$+C?I z3!eAcZdu7L2DkAa2d!(oqzW4-m6ydT)kuz0(*QY_gq^;7V^y>sQ;`$HGO!u*)E|w9 zPl4LiO*!8GPGBocZxf9$Yl?_a&RcUlQ~EML=Kgm|q?HeVH{rmMsZgfcpgpx^l0T%_CWhs(j!Ha#DWjPS>dsj=cjtI ze`-h4&HU%Zri^n6$$UTr;>&j)lGhV0oH7t@0$kn>>Gu^poZLJQzh&E2%ix94YmtmuSP`SQr4xZClF z&DDVA?^>iGW-kXh+V#XIG-neWP`hFt#8DJ$_9R`48^+8G-M{Qh{(}T5+vIs>d;Ov0 z_|7OgObz~flhII|zO9GPote067Yz3j_DToDzsPuLZbyq3tUN1Ug1zo zpGH3Jzyl?Ryw5N4Ub*ZtLo^}pR_xg?V%y1P)am4A)Y+cI9+&O4Txj4c^E$IZnxtTU zN3XpU{hp}70r&6sCb&e2LO53PDV>q;w$~iuMt6?_+4lmuo7unUDj8nEA!{gn=uk0w zrR~v@)2ZR*9yw4q>k=HaC;n`JN?8Ff)hjDYeJf(#^7SSJ=&2x2brVrT5BkBn7p{Y# zc{Bsj1KhaFV5VG5j8s&W|C(xdw-GRbv+r2ytm088qZVI!F7sq%cBWn(HZ+$-3Qk223cL=Hsn=~iP>FzrQ zf@sQPI~~9lez31~{W6jtxhY3fD+T%NxlsqW)yd+nIh0~|PRz2ZyTy$iqXgeG9*aWvZ zMg#0I$*P7(9Uv&<)szZXJzOZbQHC1{o5r9pVH*OE@IPO)-*SPw-^h8uz@7keEM{>+ z)3}BmbzC#LOePRfTXGG#LLS%{nEKk1GG|*?ronarIx3Noa#1re%Ah3h;!k&Yv8~W5 z>Ba}jdmAj1>uWvlBgh~Z+y4XCxZLrG&7UNXG%vr50oA)Xb@Hr2M3m&1>fu@X&kF_Z zKY8ByI;7*Lcf!phiIN5-%PgY#H!<-QBt>ah{+VT&)4orxGkHu(x4YHAdWzkStAC6pK}J! z3tAZ0Dp6t9(A2zrdlxxFWguH{uZ%Vk0gL%@MD9A>Que=P6@`OG32@Wa;~}Lw{{z-EhsFbQ!eXWc!J7P zM=bnn0T3Yg_z!w%E}OeUHuTc`UINT}!D<}1{{BGra29hPnjw(1GLgfe@$x;T<}gn0 z7h{!M0nS=JrfmUe@>bsruf=DrDQSHRV2~23!L`gNTE#>A5mkrmne`A!hcxaQ-4wb8#~$*U(4nAU=2qp5$Eoq`a9<|z{PN2=EztyP3zO= zLcc4&uKD3R8MG8QIM3q2+r0S9Q577~?NA%a@tx>?s+YdZc(BeNYr!Mn%-u|sJIi8O zt&0zA!s<-T%SqM5h8KJ_;~zrG(1TIi?B2eL^y-%cNDi9mZXgLfmByvW$1gQ-Z@lZo)Yr0Rb1JHcxV^C;~YE z0&=KUkU#ekka!40Imzh2Pv;4DtAmNv<=d-#CLv2b{T{%5Rt7S&3!^|IZm}+pK+br? zo$8a@52w^xle?9q@|=%ym4%o*sRMK) zueW9a>J`=(m?l>bA1OP4GIz11l`;%^tNKU^MZS&{RNz{jMBL_V1j`OR;@6l4WVETeRaDikSlH?XLPZKVzJmS%YV6ZqJRXW*}~!OE1HvsHl8S`eQ7QW&dbE+!J#>AL`? zng+1i6A~J3fF5vsjKk1JvJ6~{qRc1iCnn64C(xi$u3$;*6G2= zEpQP{0nj8zD`7D|AgE;<-pk1o#fxNktg7}N#$?^a^!6LqsZ&wSu;70Vd-e?z82S-i z8nk#_Z+Q9JFyO*AXyna*fmFX=6RCgIWY^mnF^nk5VMbg@)W*k&)QUqAbS6SY6y_0M zrS-|W@VL+v>94@Yas96Ssiwj=Gt;##CbabDs8+J@h|ctQHl-x)+9BooRh^@M&T*oZ^Jo;VbjeQ;vY`vx1Uo*9oA9`~Ok=*##(>sYRBF}sc=DUO}V z=){^Qy(C3e-FqZz>dYEm+gr<;?ko=a!jT{4sWz!2VnA{R%#emgqIwN-S7P zXFBJQHndnAWCWOe0k{+`b7vi;aJ=TZ0M+C&RuP51k$;a;%c%XJFzF2cav)Zd8jhP} zo}z2nNl&TzYkUxlX!@ijLyM=-h1u|Vuje2@;(dyMlJx|BcX^vktu?j})uLwq69}tHASU=wPPI z1t#U4y};N9?!_E&gGrH}6GLwm4u$Du@N#jNjb(z_vN&3`-HOZ-_0bF_k~^uR7~Msz zm#j$3B0WuxxYpv?C4e|;#IIZ(%?Oc=H1&qB2G99rJ>bf6AZf$~vHoMuEV(-D2kAA- zt+8ws$qiw)v&?zzT%kX*38dGIniqT_btF$vO4aDfJDcI8-F#QgV$yW;P8G_@p!baH zR+^j{$^TeoQM{O`*}%4|7HtDeofe+~@D2{GPqMY^EdGh*4??VPn%@82Z2tP3DRh1@ z`pB-VD-FsBeh>1F$e&Uk>}j&Fc=syXIuK31Dh)t+!tsU$Z9*LmV>}Nwk-=F9T*_>X zNOqxA+dInnK}rdGVVf05aM^YxcI~F@lgeVt+~l2TMoQ|z;8{0Q4_@@CKYYSi3o zjr^E8c%NayG`m23EHw zW?{&p`k+ZNooSK#g=C@Let;3tze1U&j7Jxvb_2*7)-2PpHl4wVL;;EU z`k9kvrtf;PY6pZkb^h7fKw&)(-SKDy8~A5q8~=Xj30l|Xzp{2YldW65?Lt%5;#gSO z`S00$_Le)QJ?pYA-S&BMKOi+Tt;d_CUO{7e=^C75K}Q_XU))R`lQ$>MRyb|?he}t4 zK>6>`gMI@wcosc3z5p3wrGWf>c{qO`SJP>#zq%;OcG_sb%yQ9W70&|YJ)Y2r*0-+( zHOQTd8h+wQiU*3dt{pU0k~HPClKc_3{irvalo#%?l^Hr6X6}e~2P~n~MD@5Vz5z*W z0#jB-GjBaUXX^|!0fF3j{cH<`e8;wbI7&gEIAl3Nw8z!oz^~^S#H~8eVnzP&UPVoS zZXwJ}&{>z7(nNA2rS&xd3+d==lx72lUH2uQ@Aclpy%zAQ6QpW^*Nn9lSw+0cx>&0D z&ZXNU5efn4|C(6J3@et|IGq~u+BAb{d_EX6ff)Ht{+5JC%fgg_xJn-m{Rb%lj=GS{ zmpZZ@K3TeT03O%1Z(;@>)3bjcMqvibJR%%vscey6!|&3WlJB%Ce+%LCUh9Je>>+u3 zb@M=_!^>nuc~2*0V`VLibUxvxJ|!RaV<-e@(a>g5*B%{DOTTt7bj&;cL319u{E1c$UKP)BT-ZnKEXhi{{*?x_y%u&{V}{hb+_P9@33Gc&G0G(Ehs zgul;NU)}|DbWfM$IXup<9NHNZR4DdnbN!~!fol(n`G5z1SO8cPgSW>rQ50VSx=HL` zUG5ua{-ETB)$NZthD>m4rKuNyG|&@Y;nsdDudGnmc8FI&+eaA*fnc$3K33RkgeDEu zK#=AspNqIhSjG1ZZZK2R1&Q=ga2NLJ;|J(56^7DeUAs=ZDGA1vSR4jS1nWo0hY_Yw z5>?g30#?{GiOr%;`yJCpJ&DnR&rfR7{bfup+`ZXo5e9*V#2Q*Cj2$}{8