From 5d12d516ae03ef69447387e34e918af8fe0b8fcd Mon Sep 17 00:00:00 2001
From: Bastian de Byl <bastian@bdebyl.net>
Date: Thu, 6 Oct 2022 20:50:05 -0400
Subject: [PATCH] fixed subnets, drone proto & host, cleaned up vault

---
 ansible/inventories/home/hosts.yml            |   2 +-
 ansible/roles/podman/defaults/main.yml        |   8 ++++----
 .../roles/podman/tasks/container-drone.yml    |   6 +++++-
 .../nginx/sites/assistant.bdebyl.net.conf.j2  |   4 ++--
 .../nginx/sites/ci.bdebyl.net.https.conf.j2   |   2 +-
 .../nginx/sites/home.bdebyl.net.conf.j2       |   4 ++--
 .../nginx/sites/logs.bdebyl.net.conf.j2       |   6 +++---
 .../nginx/sites/parts.bdebyl.net.conf.j2      |   4 ++--
 .../sites/parts.bdebyl.net.https.conf.j2      |   4 ++--
 .../nginx/sites/pi.bdebyl.net.conf.j2         |   6 +++---
 .../nginx/sites/video.bdebyl.net.conf.j2      |   4 ++--
 ansible/vars/vault.yml                        | Bin 9643 -> 9189 bytes
 12 files changed, 27 insertions(+), 23 deletions(-)

diff --git a/ansible/inventories/home/hosts.yml b/ansible/inventories/home/hosts.yml
index 51a3845..2f68427 100644
--- a/ansible/inventories/home/hosts.yml
+++ b/ansible/inventories/home/hosts.yml
@@ -1,5 +1,5 @@
 ---
 all:
   hosts:
-    home.bdebyl.net:
+    galactica.lan:
       ansible_user: fedora
diff --git a/ansible/roles/podman/defaults/main.yml b/ansible/roles/podman/defaults/main.yml
index 3ab90a0..478d6ad 100644
--- a/ansible/roles/podman/defaults/main.yml
+++ b/ansible/roles/podman/defaults/main.yml
@@ -9,8 +9,8 @@ partkeepr_path: "{{ podman_volumes }}/partkeepr"
 photos_path: "{{ podman_volumes }}/photos"
 pihole_path: "{{ podman_volumes }}/pihole"
 
-drone_server_proto: "https"
-drone_runner_capacity: "4"
+drone_server_proto: "http"
+drone_runner_capacity: "8"
 
 # nginx and modsec configuration
 assistant_server_name: assistant.bdebyl.net
@@ -36,10 +36,10 @@ crs_path: "{{ install_path }}/coreruleset"
 crs_rules_path: "{{ crs_path }}/rules"
 
 modsec_whitelist_local_re: >-
-  ^SecRule.*REMOTE_ADDR.*192\.168\.1\.1/24.*$
+  ^SecRule.*REMOTE_ADDR.*192\.168\.0\.0/16.*$
 
 modsec_whitelist_local: >-
-  SecRule REMOTE_ADDR "@ipMatch 192.168.1.1/24"
+  SecRule REMOTE_ADDR "@ipMatch 192.168.0.0/16"
   "id:1,phase:1,nolog,allow,ctl:ruleEngine=Off"
 
 modsec_git_urls:
diff --git a/ansible/roles/podman/tasks/container-drone.yml b/ansible/roles/podman/tasks/container-drone.yml
index 5aa306d..04300f4 100644
--- a/ansible/roles/podman/tasks/container-drone.yml
+++ b/ansible/roles/podman/tasks/container-drone.yml
@@ -26,6 +26,8 @@
     restart: true
     restart_policy: on-failure
     log_driver: journald
+    network:
+      - shared
     env:
       DRONE_LOGS_DEBUG: "false"
       DRONE_RPC_DEBUG: "false"
@@ -57,9 +59,11 @@
     restart: true
     restart_policy: on-failure
     log_driver: journald
+    network:
+      - shared
     env:
       DRONE_RPC_SECRET: "{{ drone_rpc_secret }}"
-      DRONE_RPC_HOST: "{{ ci_server_name }}"
+      DRONE_RPC_HOST: "drone"
       DRONE_RPC_PROTO: "{{ drone_server_proto }}"
       DRONE_RUNNER_CAPACITY: "{{ drone_runner_capacity }}"
     volumes:
diff --git a/ansible/roles/podman/templates/nginx/sites/assistant.bdebyl.net.conf.j2 b/ansible/roles/podman/templates/nginx/sites/assistant.bdebyl.net.conf.j2
index 61269ef..83cfb1c 100644
--- a/ansible/roles/podman/templates/nginx/sites/assistant.bdebyl.net.conf.j2
+++ b/ansible/roles/podman/templates/nginx/sites/assistant.bdebyl.net.conf.j2
@@ -2,7 +2,7 @@ upstream hass {
   server 127.0.0.1:8123;
 }
 server {
-  resolver 192.168.1.12 ipv6=off;
+  resolver 192.168.2.10 ipv6=off;
   modsecurity on;
   modsecurity_rules_file /etc/nginx/modsec_includes.conf;
 
@@ -10,7 +10,7 @@ server {
   server_name {{ assistant_server_name }};
 
   location / {
-    allow 192.168.1.0/24;
+    allow 192.168.0.0/16;
     allow 127.0.0.1;
     deny all;
 
diff --git a/ansible/roles/podman/templates/nginx/sites/ci.bdebyl.net.https.conf.j2 b/ansible/roles/podman/templates/nginx/sites/ci.bdebyl.net.https.conf.j2
index 6dd30d5..968f070 100644
--- a/ansible/roles/podman/templates/nginx/sites/ci.bdebyl.net.https.conf.j2
+++ b/ansible/roles/podman/templates/nginx/sites/ci.bdebyl.net.https.conf.j2
@@ -4,7 +4,7 @@ upstream drone {
 
 geo $local_access {
   default 0;
-  192.168.1.1 1;
+  192.168.2.1 1;
 }
 
 server {
diff --git a/ansible/roles/podman/templates/nginx/sites/home.bdebyl.net.conf.j2 b/ansible/roles/podman/templates/nginx/sites/home.bdebyl.net.conf.j2
index 3c431a2..faefeaf 100644
--- a/ansible/roles/podman/templates/nginx/sites/home.bdebyl.net.conf.j2
+++ b/ansible/roles/podman/templates/nginx/sites/home.bdebyl.net.conf.j2
@@ -1,6 +1,6 @@
 geo $whitelisted {
   default 0;
-  192.168.1.0/24 1;
+  192.168.0.0/16 1;
 }
 
 server {
@@ -16,4 +16,4 @@ server {
   if ($whitelisted = 0) {
     return 302 $scheme://bdebyl.net$request_uri;
   }
-}
\ No newline at end of file
+}
diff --git a/ansible/roles/podman/templates/nginx/sites/logs.bdebyl.net.conf.j2 b/ansible/roles/podman/templates/nginx/sites/logs.bdebyl.net.conf.j2
index 508a3fa..a65077e 100644
--- a/ansible/roles/podman/templates/nginx/sites/logs.bdebyl.net.conf.j2
+++ b/ansible/roles/podman/templates/nginx/sites/logs.bdebyl.net.conf.j2
@@ -4,7 +4,7 @@ upstream graylog {
 
 geo $local_access {
   default 0;
-  192.168.1.0/24 1;
+  192.168.0.0/16 1;
 }
 
 server {
@@ -18,7 +18,7 @@ server {
     if ($local_access = 1) {
       access_log off;
     }
-    allow 192.168.1.0/24;
+    allow 192.168.0.0/16;
     allow 127.0.0.1;
     deny all;
 
@@ -29,4 +29,4 @@ server {
     proxy_buffering off;
     proxy_pass http://graylog;
   }
-}
\ No newline at end of file
+}
diff --git a/ansible/roles/podman/templates/nginx/sites/parts.bdebyl.net.conf.j2 b/ansible/roles/podman/templates/nginx/sites/parts.bdebyl.net.conf.j2
index c610646..8a93c5e 100644
--- a/ansible/roles/podman/templates/nginx/sites/parts.bdebyl.net.conf.j2
+++ b/ansible/roles/podman/templates/nginx/sites/parts.bdebyl.net.conf.j2
@@ -1,6 +1,6 @@
 geo $whitelisted {
   default 0;
-  192.168.1.0/24 1;
+  192.168.0.0/16 1;
 }
 
 server {
@@ -18,4 +18,4 @@ server {
   location / {
    return 302 https://$host$request_uri;
   }
-}
\ No newline at end of file
+}
diff --git a/ansible/roles/podman/templates/nginx/sites/parts.bdebyl.net.https.conf.j2 b/ansible/roles/podman/templates/nginx/sites/parts.bdebyl.net.https.conf.j2
index 93684d2..9acc75d 100644
--- a/ansible/roles/podman/templates/nginx/sites/parts.bdebyl.net.https.conf.j2
+++ b/ansible/roles/podman/templates/nginx/sites/parts.bdebyl.net.https.conf.j2
@@ -1,6 +1,6 @@
 geo $whitelisted {
   default 0;
-  192.168.1.0/24 1;
+  192.168.0.0/16 1;
 }
 
 upstream partkeepr {
@@ -54,4 +54,4 @@ server {
 
     chunked_transfer_encoding off;
   }
-}
\ No newline at end of file
+}
diff --git a/ansible/roles/podman/templates/nginx/sites/pi.bdebyl.net.conf.j2 b/ansible/roles/podman/templates/nginx/sites/pi.bdebyl.net.conf.j2
index 045f4a9..156e11a 100644
--- a/ansible/roles/podman/templates/nginx/sites/pi.bdebyl.net.conf.j2
+++ b/ansible/roles/podman/templates/nginx/sites/pi.bdebyl.net.conf.j2
@@ -4,7 +4,7 @@ upstream pihole {
 
 geo $local_access {
   default 0;
-  192.168.1.0/24 1;
+  192.168.0.0/16 1;
 }
 
 server {
@@ -18,7 +18,7 @@ server {
     if ($local_access = 1) {
       access_log off;
     }
-    allow 192.168.1.0/24;
+    allow 192.168.0.0/16;
     allow 127.0.0.1;
     deny all;
 
@@ -29,4 +29,4 @@ server {
     proxy_buffering off;
     proxy_pass http://pihole;
   }
-}
\ No newline at end of file
+}
diff --git a/ansible/roles/podman/templates/nginx/sites/video.bdebyl.net.conf.j2 b/ansible/roles/podman/templates/nginx/sites/video.bdebyl.net.conf.j2
index 36c1db0..e8d4e76 100644
--- a/ansible/roles/podman/templates/nginx/sites/video.bdebyl.net.conf.j2
+++ b/ansible/roles/podman/templates/nginx/sites/video.bdebyl.net.conf.j2
@@ -10,7 +10,7 @@ server {
   server_name {{ video_server_name }};
 
   location / {
-    allow 192.168.1.0/24;
+    allow 192.168.0.0/16;
     allow 127.0.0.1;
     deny all;
 
@@ -21,4 +21,4 @@ server {
     proxy_buffering off;
     proxy_pass http://shinobi;
   }
-}
\ No newline at end of file
+}
diff --git a/ansible/vars/vault.yml b/ansible/vars/vault.yml
index 874e52d68048f2047377ea71899e01c64fbc7186..cd95136f790eca1024ca4890c6d7322340c04f69 100644
GIT binary patch
literal 9189
zcmV<BBO2TQM@dveQdv+`0Pn7`ml&0f$o1S;^P}QiMJgFCiJwrAHbE-b#B$x{?Po}M
zLO-)=W+U5ndSq-2Y#@Q%;Hng}3TUPPmwC<G{mEcTM_GHgZmG=p9AVc~Lz0G)zY=y8
z*1I4*dS`mus$WCCkhfR5mKF=q9bAp<`=s(zdDgLZ`-d;vp9gE4`9!z~+$|WAd;T%|
z<ZqV}O`T%ax`M91@X$F4pZ7pKlkmA`6jFhBHWKjZ2_BW$*Q^Ev$$K;(G%O#{iU^f0
zMt79eZ_y{XlhNCQfj^G3#S1jhT5j_n6pR$ha9tzcVx=ldEZ8jC<rM>Y(kCH$>AWQW
zuvD2|Af9sD@Sb|VG8;x^G*)F60Tsnlh!pCE<qKM0B>(}D5htT=_L7@(jO!C=nhN2`
zZ&ia(@YYd9x^Oj_B4!J`0k^f%Zn2YcA@N)+bGCkSo!Oo<xbi~CwV%d584{hhITJ7*
zVS|M9fbJAgU3@f((h<XLmQz5r1F~;_+fJt@X`|dG{a{dg!lMzPP~fe*yZP0ar%Tir
zy3of<z@oZ*uiC0q4w-;$d=Cn(lKx;#d`YGZUC6pA-M#*tKJJ=o*N4*bduk81MRE9!
z)BWh3l>{3tm*2_<%lW?_GCRL|SJKT|_qW@5L*+#zHZ31^=!+4AxNU*SlDvj^F6(Dc
zzCAa+sch&u+xgk;bsjpJFk<%QqDdl+-#TIb*Fdc>9esGSGL=p|&Ex#MQi;;8k!AbN
zkOLV1bzccrTVCfN!eGIOs{_%uKy0eU(^Gec$8_q3p1LgncLG@V#7rB)7Xh8HuTveJ
zi~S#?oCR}oZ`ipdlzfyk?G{QY>PBp{RV44}9(Z10{ce$gRk47FHyWR~ac&1<ls{0`
zSC2c3<r$7#EHEo6^uLHUl@rQdn+4xSA@plGv;iPK{(};ixP=e*eTSpt+j|Nx7b*7!
zMr@>}1`}S}srIW<Dc(XI7Lh$e2*LRBM}w!T+?e?FyHcHlIVMmO7FnXrRINwNGH(3v
zg_Tw^tw}mgo|JoI30eCKrRdsH_Ss5dW?!LboC1E|bd+Ys-q0mn@O7J=gGLL)0$aIF
zn4e@<vN4v6DGLHRj{6X!D-!S}4&Ork#rDR0pC`zZPi^2Jca~bJ%g(8yAs`E3kkI|n
zDNYUPIn|ly1o5`ds3r?b9FO82JFY&@WBvzCSRehAQh3y*+V@oNQzvT|vm<<Hze{Lo
zNT;M$83{OwBTp8}3DU`f!q^XpBg)aw`Idi_h6Fj4`S-{)nc9GEjjEyjswfWrpao7+
z!(vxT)g-}jEq-oBz;F+|A$sK@D^wY_7Z5<C?_EtJpxo>9=dr0-tUyI*1Swfa+jOLx
zvoKqpSg!aly)nFwt;V!0{Da^EFcxzj^D&D3U0bE1os306;=P+7$)01=*m3K=c|Nf#
zg?dRopZ!BdVQMi8<2?LGAf-IKMD;NtVva5sVd)|3*r<a7JS9QC%U`jE6sJwGuA`f~
zRH^pHpTd$(FMO8E2hF_$qSNiwh+LWFyW(H;5BSuDSX$I5j%8~<2gX!4!Ak*rCFw<t
zVtR&My9_&UVH?H22Is6=i>4dG!Ch<xIJh><Ib5I(T?o{xdr)|*Xz2$7UEI?jh>YC_
zvXOy=fz$vA39`cs+r1I`2uc#5*{zqLL0e`Pz-6?Ii$z<Y&bJPQCT&Briv<fuO#`eF
zqd*#x^|nv=N^s!dNDu0vW4-bqN2*kKZb%oVtXqgkzP}l+g2knM<W!LOdBVsMxWImk
zF3xWf<mI}4Ujle|hEP5ksxE&T<8r3|vdU{uw34uk-dRIupi^xtC>lz{9NYm3A)X>w
z><iWG47fs7)enCBxd5ZazU9B7?VkOq-=Uc*B_CZUxl<<z{aJ0{`)dFb<|oz{>w~IP
zn*aPMks-SW`osI0u&zh|>La-dhtDwfvM~ZO#+Lj;>OIrH<5Tzh<$=o6^JW3Q_O)<q
zxmp_+lhdm!B+xs$Ha^?{N#SuWcCxVr<+o(ygkvXts@;LEa*kglvVD>YZnSeWCAIV0
zR)opm@3sAaOPbGN&_{oj_zg#bd-sr-XCW|WGBYx-dKTz=@8OERyi7R&IPh`u_ym#A
zjlk?{s1j%2v=#2-M<=XvE<AYD0XRt=wrCmWP`FxV@#vIVc(oX75v<OZ?|8xZF2DU0
z<1%+>iGhYNEIX2*Rn&Bq&q=Tc3PvE9!k8qq)(s1N5YVr;_tr^qFjR>n@C(|Wv=v1D
z!U(2sWY?{cU>}f*fr+h?@-U}PCnGyuTx8C*>#d}{2udm7E58ZvzDL~uW&$e5MOpOt
zjK}_w8@O=oqqlaOnXN$xpCc89BBi4MRFIav-^`@&T_q7&(1~%|564)rGQu5bsDSp@
zLLJE$QM+99`&Q5<$M!@+TO+amN-Qt7LhO*NK8Ryy2!saP^48{0qR{ZsEw=o*MJ3?a
zX~dBxU-wZMSc88wN^|}E*L@OfEQ@5ggxnK6TB8}POB+u7@}Y3PZYVd{65*csTdgx2
zq4<9$0netj>T|h*qm$W;UwH8_o5C~7h>0Iq90*nE<(SqL#Z%R?*2OJG(t=Y5q|O3y
ztxA61+4i7Rq8MMUl?>Rzwxc-3)9qo9m-P>T7RWiv0`XFbg0cF(MqiltG_pmA>2EKJ
zv`C5b^Ib!%uLFptMASfK;JdyDW8srHofIjUM^$L9#w3zf(7Dx59Y3~FaG(c)TbXtn
z`p;rfL@M~IB2X6R@%OX3sRXiI{r|Z3Z{S+m6kA#Lp6)?~@j_e0eTzfY82s~-oj%8l
zeKmirp`}-=7z^*Tc33P<d;SSPy$6zpzI5v?jQ0^|NGsgJiGhv%Om(LM|G^l3$=~Ea
z8ZHa=m1o9VHzvobxp~!=nsqwS!LjsBmcRdBGIZkc%gCfWW6qK~-ssbSFWCWd)rlf0
zn1Md~43aK|%bf<MUTzIeuEgI(aU92#yC049&g+f&;HEce6W1*ScHpkikn0WN;FVmp
zK`XY_xoQiayKrBaHZz@xiac%7ryLW!uy6LfMI5gGN5fhtvCa9f7JFrXc(kEjWzfqP
zfOEg9ecpnW9)!>Ysm!Z4NKQ*F7gN}8fC06B_hwrjQQlIV-0&Sp+`BnB6F6g8E}{*g
z6j&W(nEFwzH4f5Ereg7GcF%|9fC8BH!WOmuLJcL45BfF-X;)7V#V?!~P+Nn&-*c}s
zIBxN4I8*f3#TDvwevHlYrOTR3?0a&M>tPb}7EC{&l983+fcX++{R0&67~hsKRamtA
zgaxIi$w{hcL*6okp-D<TRy}R;>Je_qEK(2WM*N@*CmZZxW<<d*08JYaw*%4F{ktV&
zb^y2#e<C8cTj3*@)4my@ri;~1Tx6d~q%FEU`xT4r`^!|+R8D7(M<bMm;oy53pZ_tF
zmUs&gIcaW|OH3bEA9;hAtIF<!k@_M}oP+5^szczPM>+ekbRSp=+8q%@BLRuZ95>4y
z|M%cL5!=yTjE5tN5<~13C9fEvQl`1?>mOg9{1Xi(rxYrVHx&W;MdXqvWsl>9Nly+G
zDOoWzE0OCz`)N4o$#!|EFgrR4Qr%YrEqX@Rym#cp-LSuw+@A<H`;A}cz;{;;M}4rQ
zKXgF}eH{hG=Pm<r@>}A<T?_B4O>lQ<nooT)(zrQd<~?i}H)jZ)X$WaHZxFvFOyYPM
zPpI(~0peqv6re=tY0<O%pp{X6oab^eZd)hD$wikj{s>V#<9`PQNIek3cGdpp%a}W;
zO{KG14=cjdB%#Gs@BVjz@#DZ+3vG<YDAsuHGHMp$eJ8R5ZE<HY1=8u=et;rV?_`QL
z|B4BU|CUR;gpX*rj(V^Yh<;n>H#a@QS2d+)vv`Glbav6+YI>sVg7hs2Z3GCO&yuUZ
zUJC2M6*@ATJ8uv5m`+#ud4y>lROuxbJ>5|UXy-T~DLH*rggH|^uW&W{k-|H?oI5ns
z=o}mvquZ?zjb$i=P<^d&r;N4ua8Po^z4zLJ?C`O||NM=xyp1gr2``w%GYO>g0BUor
zaV@JhH}LBL^w`(Z?3PWKU4u$$XN~9n%5;`mM=A0egu=k+z%F!bnKJpgB=JTK`&l8C
zTnrIRM8w<467`Wyl@2G@C~UPcE;do*UUxY-Vd?O!ivYv{dfJF#_7FMXdMpv?e$qRO
zbW62Z=%$UCd&I}1=SXW@-A7>DmQCZy!ZxvwCQL(~`ZX6f&5BmFJDk8DC(l;FE}amK
zofbK#R-TR<lKf6QZXoV2(1|@XS!DPp>T7ctCnMQmYA|`Y6UJi`bGzRC?-sZ-6447`
ztx^Ynj7tO=45YkUHC_pjAp29Ti<>ZGy}WWD%p}cnJ$}1xuc+ii|Cm*6B_01Auo(&7
z4gP>+>72&7|J@c9zjv_Zv-ZGdX93FsV04d#)26b%U7cc(3BVWZsJY91)#2N8&IFN$
zv{h$R$Y-_;_nlsr*Bkz3FWGZ7y`|wYpRpWo!s3Zn+#U?<sL6N(7F)MouX{S)XjHJ(
zo6z|)_dx|e>rv?ot|Or4MP44%cd-bE3-3()OKvKiAYgZfoS=FMByX|cDM@hPk9R#5
z_weuwa3A&B?`v6{@7DKnX2>PU`uKzgt-Xw@TtzJC_z^@O55Nk=eYu1X`lyBbNf<?}
zrf|yatJQ%Hujsg;@vpM{9M-rZtE)?PT_XU3#d09q4Jv&6_JM^0JQnmcqXYGKJ<xmu
z%`Dw*ec$FdJQPz-+I622B%mHv&K?J>+-i%yKQe5giuqj^BNfhS3O{>MC-wt+sq_nv
zMkU$|AME<KTn-l2Z6#u0>{2fg9NUV^9Abf8E!-UwTd!IZ1$Y1FXb3EyhxMhlk~Q@b
zEHPI24*eNQLs?So@G5+wM(r;0iwY6UuOtBN*H+}yQW@b~A!nF+FoJ4FJo6o?J(!^q
zvP&CO>j_0ER3!aYrjtDk0j}Hi7rLR0juR)QdVjK<hL;jBGi@w$@w}M6<tYiD&9AyJ
zKasuwc%+u)&Tyko3v7k*BI*W}nm#wFdkU?BowZVV>tc6e*df+f1}%>J!qbuKD~~Te
zw*2?uO5qewiTb8VOi~~4EA)XJWua0JJ51zM^XY9nsgrMG8%NhxSyN=AuT}l>Ytm_;
zYs9r~HI8_{&QiqAH_q>rympC%wT7ONNAM*N{PG8r!}z0iR$koQ9Ra>^Ue3GMj;oZs
zVME_PO1f81)Z@-xW0u#<+>RK2L6UG$z4-c`JgC}^L8q8%7-<^6@x=$REVcSx66^U<
zDW%A2e;9Tle%o${anBH9E<D_q{O>TN?~Pyr_0V9l!OwlV6^}3gtqDlo@LgSQG88Go
z7d1mwej+fkjC34hM(Gz~kF6$$AiOm)kM)(aKEQ>WWXLsr7pwnPg2(SEk@9-iD0f82
zmPKg15juxQlbv4*4IuZ$pLNOD4BgYUfV3`n<x&;HQX5~W$}qn9yEiJJ(>^*SUJjTd
zh|<C=HT6Ge#pH7~p)M5b5)eW=_ac}THaZL{*Dvv@gP8eI!FZhJq~K4*KzeU%#0ZSM
zX@T@)8V!+$6v|aX*Z#rT?hy$}jH<`#2%UrnIy*ZGA0DiX`^tDb*Zp)KsLm$%0RLSh
zHLALn0|>>(TVM*v!F3yE0#iljL&KhMcS4}(q5JlFcH$>SeNCP&Bt5;tSImnTt;L!%
z_(PP5_ySfdOo?f2bWhf42uIVOQ`6ItZay*`pXueB3-=FPDwSUCwdD2mfQIPx75b6;
z1#?}4CUyK^czeYNKqGsJ|3d&S3BC*~i*N3Ky@@5njJFhX;<ygh^P+z~KmDIrPOXq!
z@5L<}(#&8$lA>sZaS2$Kk$aOvm!Pv~X-+U;myhISZ2f_vHu6ljGc4GgSJ?ppuHKrO
z!90iSeNK7$uY3Ot!!J4PtPh!`)?3|{dSHvq0ofWN;nZ+$MHc56f{T?8EP_bY+#ae%
z`$9xT0Bg|^TD0^N*#-R4_2y%dsyoedq~B1ct5i7>uIC2*1kINpN)qt$Ool4tS{74P
z{o1r!%6ZnRK$5(-+5~vpDFKI&A60cZYQcqu>|2bY71?Q5I|MF=Lj^)UbRU9?Elet<
zqoSQ^0)|3FRXNYFn_=<L5jVaTv_w;cwlg(8^F%U+aw%xGdQ6HJ+3XWNO7$W+i2R`9
zYg-i`wuIUnDG>jJ5#DV9=U+a$Z&?yzxA>o9L;XDljq6$qWo_S;_jZbr>{m%`>xK#9
z<*|4|cP?smgG83i*Vf=o>FZxrOir?*N6c;v%-&yl0P6`<ZTN9xmKVH90chJy_K)YN
z+2RdT#*n<1FbtcftpmK;MRP)c=+WQL7RMjy{=78z@NhbZ*@fy!_l3;Wv?)k3`Z~Wh
zD%F)+PGM&!p|y>NoesknO`3F5sD!$k)4ItsaZXj>c{l8}`A2Npe$77qphg$n7awe@
z^?!OoshZHeFA!%f9UN=a3kNuM2cpgQ2!scAeNCL}v>Y&qCrp8=49NiiR2;3tj*7CU
z>pJCY=f`H=h@K)D-koDC4L#mO)}nkgGDqF=U9%TJk?0zg?{HF^_%8AH&7@ioIh2Hl
zA8rJb1C+Klca~HAc~m;ZJ@kRzUG*bABF8ZzGKJYB`yYhM%tYy+qdNm`Ttj%ak;x^y
z!_RSS2nT-)hzNmnqIW0_8C{YhWuk|2l*2Q=B98}x^E7Co`H)gN7i8D+Id|eapr?U}
zKMY~ZiFYT^I;{USF<0y=q5?E1CDU_hBj)`$;Z%HJL92RNKIGx2vjkOWnH=OWFGkmA
zHZ{YdjiBDLQM;By6@*GrM!tMcP%tL*5cgcCc_WJSFIk{DD*V*@{6ZcPgC70MCojxK
zclVbfUqir%Y0gYE=6BQ|A~p=ijkHMa{n(EN8jMHr0@GpEZ*Qfa`m+{az(y|Z_xxAh
z>OOAI_b974Q{)?!eO!xkhUc9Gt#aPM<U7<jy{OugfWe}~&BVhz#C}J0J5G)DOeM<3
zttWzyfbePMa-kAs#IE<<Z{;?OEhbk8MSJXw!CW}HH+KP0V;SA~b_+826xS={Df^fj
zn370`41Gr4q_G4-<GjQsG%fr1p>j@y=t}zZMU0|dbYF+*KTM~E^ziqA%8P(+azqev
z8P7r8>KBfh9atlhv`R4QVUyD=S^7FhdZD`?K>vB<8!`F?)VSiU132A@yguei!3hdx
z#9!VHZB4WGmFVNk%C8nAI{DQ$U!fP#319s*5eb-wCar1s<i_zS%$lV9X<Rt=>}5*>
z6RDpS_<Ei3isyS5V)pW%t?@Q?M`lU)yrm5dk3HL-uReuBAbAUzAtiUcr4f5ueWwa8
zK5Pa+T{4KDEhNgy9uFl@?g7UuXbwG4Fk1$~v4#41*uAm-Bkod!99!~0*2~aG1$lz{
z^gj2Lvcm1-MdpP4BR+Xs`L;-m$QoZC97VZ_*dn9;3U?YkY_BG43zx2Aqfn-#n0CM3
z@<r$p-%+Ifz(DP}yyN|}Jl3#b_5Hi3Evn)SP>HBfiKT8g<-pb_u)|?1UwODjSb^1o
zrDmkBOb+v3N=-;=$bI*eTN7)(kL5d2M@b0^pm16xP^Fzm0SERBb4D|Y)eG&X+*$MC
zQE-~1?DIW;jI=xUqdn^%>-9oqO@cahO-UHSUIt@TmI)b~vepLrz>V6$T3{G{!{Bi?
z)e{b%Xq=maBI}E3G4oy-Zy==9#&fvPMj7CvOLR0i8J}q7!S;(JU2hBfxKz8kq{`$&
zJj2#x535W7>WyWG6o^IP80A@077UaSgn0Bvx&H4z#SU*TqY*uNy5TFlfVJwYGwT?u
z8y`SJdvy0iO=M6Bz%P=tknvIkndX`0U|((wnzM+70`+&l_5{aj7~uE{*g@s|s?IeS
zSBFP)@=rlz#n!^17L2M?p2$jglavu2_rz0B94^s$4b72v%%My{GnWMy!tQqw6IDv2
zitxGz3V)~Ek|in+)-{PcdE!xRl@*gXiN{mcD8I8CdLwV@QwhP>;ca6!*QEnd#&+F|
zkfFkE>wc$d&kdMtKoDc1VF?vW5N}VHv}x~fx|wzE(g3W+5a*-bRj~$5778MNK8r_;
zL!Ht$I$-FDsiS?jAS#6=#-Lbl{vYIqq?unsBLo2NUr0d1`-6MvNO_Pj!D;r+Cv7c*
z$r@G)P(2Zn#uyfyhe5t^Q^;8(%=jZKez8eB`U9hy^_X&wz(h3Ms55)p*cvIyg`7!L
zKQCt67`}OZ%e&hd*QBAp*n-Lvq=*m*HiyPOAL|nl{U-lsY}S+Scgnmmk9OZ4PQxun
zEq8^vo+~Q9J_FkGW)THn*NV#P(bXS4>8QOq#=Usr68n}@{92Gb(GFQV1{NAnj$nBK
zC#&W`m#TGSxN|~b_b5$x8q&_bqRV#BHH3%tX3OS#7}%!aF(Q+dlP!Eg>01%XPt^<c
z6c(Z!Z+G<@m9wUHFUqJ%RmEhOBX+~fEu9s=1we98{^Z;O{Qd>4tnaC@Y#GAObPAPl
zMzPmcr@EtK{!3T}E_P|CQ7k6;1Bp4IuWY+t%_7j->R-Z2ThVkZDm5Pvtgfkp*(iP1
zOj5ht)Pqy|<`*y$&ru9NN>ebK@bfq7D}>O#xDLr;Z#s8_vOL~v%Jniw;uFAvEZ{c4
z!PbVI4gOO<L#I9`bi6cC^9KXQ<AHcS)==v9KK!#Q!%B>sL5ic?Y=2VE1?GR?&l3On
zxBoz(%CZrh3qh`wQG#7xv$p82eGxTj1{Dq6Z^1&lXGN|MK|s^;SP33sLFd0Gz;ar|
z3JKCiGjZa+2&08FS_NBNk$Z%^8fTsIU|p1|xiNr7g=Gg(MVyc41U^HwBC8W~#d^h|
zxW)pAf{OGv=I($%-1ym@DPcWNKV_Ruf<%47y@^>8*foS{($KVMR`yA_7|E0Db6uNj
z=q!KTK6}51kgm^+N(=@hzwcoE(uje$D-!IY;F&MAu(8q`amR;UVh1FUYXb3<k}XN>
zp$8?SKrwX-xarZ>vC>^o&^ybWXPOjZ&$N8l>q&MeY8HNXNO$SA#)$;sJFLM+iT#o+
z>Ep9UiPX6Is}HR*R=sL;JOo!@^L#8YI1TFmb`fP8tmZZIjY@)F8WqqzJ9G&A{t%4D
zzlJ1LGw(Pm>894Wfz5|lg;m5Y@=?iLN09rt^7?ee8iGIx1(dI3OrfW4L0cRi#NSQt
z>vSdN^;|_E^f%b6D%1#0<IW?yE%xw5$V;@7mi1~dTl`<S<~0T>K_Y2Swlj@5D9x(g
zeU%pl@sNA(RK__(fsIyX1loC{+OZVhk31wJwlcWyfnX2wzBzbg1?!vsdN*S#jqJF?
z-==9+FQ!FV0tnO+fO@&pC})xD3*fblKm$927ED%PW;35HJPFMr9}fQ0eGX>jpHPzM
z+lwc%nS3KH=Vi0_c9JG$WoZv|PkxORF8k&BG%z$@4!M+49zDJ7XwM-=7@bR2sF$k4
zGnq|Ixb`+&ENwCR^!O5KfbV+Cc!uK3bBF0fMwARZCQ|pXgX-9$8xCCfilhVhAQ>zE
zLyOPshr4MG|NAaF(J^>9Y=i8un?pM+5J`UOp7ic6E>b1<UuMww5G;R|Q8b_Dy*_`7
zw*JGmonZzd?gFuIb|#g?@+=Bbed_`DtcHB$O>pG(6XOd@p;}pf#g8g(FK5)8H1@FK
zWn#6K??%la#BB7~dWYLRO(B8r&Sivm;GwIVqOYConc#SZ@6xgN-yW@X_1(kZnwA;2
z3QYwAq~z|U*)j|2BrnVt@Y-p^c@*d*IY-y4>4PQZqjk=`O%o8SoP=*u7LXou<O{sT
z%C&l>KP`&*8w!)>om9m^kvEo?ROUdT$~W(saaXFB17^?1*ca|uwbJ&!xJnkz{$q|b
zCrywEhA#jpAF>-o+~{{M(ceNuWtM*E9K}=GuHGRfsbNPoItLeXBq%PO8#A7S&;$Hr
zU+4JdT#}}|h83;Sks&1H#LG<e#J95k^Wyq)mXlm>>_OW+C@ZiLGqvcZZBzRQHrBU9
zq;b9U0_3FX-%Ia<E8NU{eV)|rDqjJ<EwIY~6d@%g|DrrmteAX*oenwFKIpRHxtikN
z-feGTOZn_K7^O?g=LP<Owuw+3uo?BZi8=9Jv4AjUmiFb9C4d+4j}1AiJ2nR!7?}>W
zE!DeOOHvFcBKzu3&x8s&3je&O@Q$8sMEz^F>GDnC_$XjlK|N8l<ZXN$<@mgdLl)S5
zbMP)GF6oy(JOUvwbvkz*aQOilg&M*-;0p#PmZ9S^>3(KZJwBFV*VtMLT$q)6#+sd=
zB1?FiWp}&f^M5x3&q)RRp1>&Y@}jCrcO@QGzlyysJ-Aec>cAVqP~`E2;xZq3NJ_K*
zE==WehEu`!ont!lhSaE0C#s1%lM@<<1=}p^@$v-1mNkYy&r^r+)#!jHhO>TDn)M^*
zlX^*iEr?aItiX%)M%aCguXaG5ifK6IXux|2pQSOro*=SiQj?c-Jh%F0jRH$%C34W9
zhSqf?BD7wJkEl{kt@Zt9s@JW=l@DACcx=~A+JM(n@{>U2sjt%x3nm*}OQ%!)kgoE`
zb~E&}12o(%$HK%`*}fa)O4$tQsKtmY&g`{;xTCVk8@uSTR?^^hpV@tsTj{iETgEb}
zUXe42AAxcOAyNDJGiv5HaJ@s1s%teAR7b4(;@Xa+2%{q3zbGJT%fEZ{Q%E4Uvn3R%
z8jjW2iXyiXu9|IAB$TF5XVQ=1Zz|uZg44r#JVRJ1m;5?o$PV5|G%@GXHAnrPl8kdi
zjtVl3v*k9{L4ht0)%}NXQQ5oK9S?ln>_#6pEZM<=u$s&|G!oR)?b~I(SO3};-JI$b
znwei&Ve~~oFfy`Wxx{2%90obVpfFqx-Z%}QUBoeSU65SzkpZ*E5!S2Jv=N?_@Uch*
z6;W4lI&_y!1d(C6Bm&@!WtNQ7**{a3raNvYa+SYPf4MGg1?)@6F<A>-z=EHWv<4DB
zdNGEqBUozr`>155KXO#N9N3WlD;5`{NvW*)l9WwiUl3kXF9OHT4bkH3wo*Du48=yU
zsCv1dbIYB51&!k2dCRQD{+=8-V-MBcimR^0B#v>Ec3`vH3rKJ<SRL>{61oupjb1{=
zxxQ;A`%ZM4n{qxC`)RDYt3-35=@d|{OJ>vFqFbpjmI>>`>e{8<sql<#43^xyd!~lm
zg409Y__Do=$|ew(zKg;4@Rs|{OjvH)7aO{5wwg>=nnRRR(dOT)NCb3&h4NSXzqWy4
z#@y4=&PP_c2c{L%StAZzL>_1)+%*fRQ+OHAzVRVCaB7tyse@WcqFQh7l|@aqJM^%{
zqSt+m*IPSt_r8DgXYL4zPGgu3@KmzWWyjN1W$y9-@k*M8E4z46gY__Mzz9MAcWEJo
zW`9G$((=1s624r-D(nq_+erC@nwmzELKKP&lEE5={{@!JJJP-22G+f~0uP;LcfN2U
zX23j1VlUM{a#lUz{~tN*F8=KR7%^Zu?(1Psm$f)+yoB5@rfBlPhe|Z5@BkcYm)!V_
zlR%Cu6z#nD`Ew}*A_;;H;=zNg>4UtV5^r%(NFqd4k1cU*16K?BM<4^zsJEsip5FJR
zKoEGNKQ%~@M(yC;#LSpR+F<8Qg#SLx$%3h*&mJ<)Ef&>fw$(6jT_vfdOZP}M53Tss
zsUDq7wW)W@{rtTfW{A=LtIpUENfUbfj~V~MG<4h&N|XY8K<0%Ynb716Mo21mQDLo)
zbsnrt%?-vff*aeJFP6B0ID~nL<tqh&z)M3Kc<=oVYqP}^%4ByeT1ar~JkF^M&UYb#
zP6tHTb^aSp;akN%Gp+j=6UBF6CL6&%3IaKaHS7}#4+Bhr%#;LoB3M`<rUV<O{|5%^
zh+w@3H;te*^M^qJU_sTiH6GRZ=Jipwjc=?RYjc-Zh`2f#iHMKKjXU!6$*=Q0W%emU
z;t`A8FH|EJj6x7~<>(*3(jy2DiWAD{Dn0sRYopD?yyi&`<F=Y&fEm)&F;;^MJOq4>
z?}->`t)f$yQ)xhtTcCq+f;I+LQzsuPqaPh<W>@&I-fpZ?0`Lx{)upIs|0`C+WEEir
v=9l6NeWVU$=M3UEh-d^7`X>R%+13dO2S>MXOubFP-e{GEcH~_}X7(jo5=7H0

literal 9643
zcmV;cB~;n~M@dveQdv+`0Jb=nHds=xUGbKVrDn6ZfO2ew0ZIcoy$DdyY0$eJv2!d1
zY^Wp^ltsMKG^>1sNx!z)7SXFC-_V77gob#5O%XX3dQo_4Qg=%yv^1p8PF1@B7RF_z
zi4tWX>cGn8R6ceuo%D6tnDt_iBX)l4cfUpO=>rK#_bo8Un&P_Ex}m-s+qYM6)aZA>
z?6!)xDcWx%1}%LCi^23F{5IwA@m1C`V>#E0Q{<(oF3ML0<EUi>q;M=Qv6T#gqpaE}
zsNC5|HIo*~Mr=gfj%&pQxb^2`L<k9W9~(|j$ddFv;wQ#r{DUA+WP<b5z-=NkMDy3r
zrlm=H@nI(e)iCvsXX+2I#~7<zb~EsJmn|NO|8iX?{~%c%zdBOW2J#bsD0@}=^LEZ7
zk&Jc*K0S2BNm`b7f+k22MP>}E=&iKnEs<5$+N<=6#)H|G9|NEF#!GAL&yqc4;1h<%
z`zn4x#Q-)|pLK$E7chNrCSE!G4!qx!-QQ^WUlx_f`pw(y>D93|lWb9e#OLkhY0|Nk
z$~0VCo~Ru;wF9awpPFCXylHJgZyex_dvrY*sw(wDo$JDHo)*MQRmHnYb1nN2D5R5W
z$4tE0cfhZr6Nz|X<g|@}?z1+XBhc#cvMp)A2_@LE&Ch*BE{2Ttz^WuaU~KJ?_r1jT
z*|WP0=g`g!VeRN=h%#_`yo1YTF<n+MFN0>*kx2-9T_a7&TSzZP)ux{NCZ7w`^dP*l
z*@xq90w{fKo+9M|98^!#;f?@P_UA|pSsiL-MU3jJSv#fNu2}-Agd+HIx{hmV9C?r9
z`T$-^wIoJJ7v#K|Y7B-{6s-7(2qr~?SqF)k)2PM6BITC>h`s4z#onrAYmA;!BvfIw
zHOng`(zM6JXo+*|SFT%5SmscsqIKS;$lyjS;PawX_2M&wHpO`d`wJ{rzRet6K7YB7
zRKh#7RJp<(fW0O1VuH#LWTle>7KFM9fsgDD7N{<axWtYpJ;aCFxu_>coq^Q|<j&R|
z2I+6nDf&1RxhgOR?37*^cQKruJUf&gc+F>Ci*V4o!AF122^F<fTszFqrwTw&^yXdd
z$a|nEq-fn7)<Yygkjehp_zigjpfr?rPK;VFGf;ck{KAeyL^y%6k1L(>K*f{v`wI^U
z^VIF_?{KgiPwLIzPU&gZ2nI;X+p0P6`MSg2dsbs>mAN+G<<l4QOEje(p%f1?hYK)@
z9C?3K&r24!$u&L6<o&LvM116b)~M>zSQ=@tOvLx}2)2Wx{rOy!hxSgeKuU9{qfMX0
z5ak-U(h{X4u>Wx}5m(!IOI5FKN@cLlaIVc*C$SB=JTHG4y3S6RyZGFZe5A_5^gzGc
zUKW%q2jj5U-1xZW<q-yn6T+TTkl!fAy{SYNB)9-pVZye+xXVxEtI-jhpE7C1ZR@st
z6pPZ0>jA^ugkcaG@~9iTLwT9Jm5|fk*7M6?*W>=Yo3p0X_aHoUPmHD{rf@To+g2ux
z!U>d{FI~0OAU~<h-`lZS2OQSE9U*l`om*F7Qbx@CLCTM4a+UII#YTn)A6%y-hT%IV
zx>QulG8=!!%b~qu?45fRIGW>C^3Ljq)Q9w!vpMaZk@!}-@LRq|v7nf6bbEGiX9J(@
zTQ|9ajNq1LkSDVbJQ%-=*Zty}9YiCS4lLW)s|NraNq41()K{J1l^(*X24T^W%ItOC
zqOWF0i+nR6=*~1*;C!#Nv|ZxXO@HQ$k`+AS56-*D9`@tPU<Q@OoF3FCbu6oJ)9tW_
zLRi0g0obI8k8XiXi`CvLS$}w(g3N>4Uhh=9@PtNZQ37W_GkX;e?pzR9%WzXmqcRo`
z)el##1kG^gk!!{NcMLeeD$uGnb0{&xTUUT>VFC}314``j$k^;kVi)1H`9Ny^YLqVE
z3^1G$QQy*;`-rZD;*Dad7!$e!fdQy8LD^Bzq9ihW=H1$ONO6YVu$H4(DySeKmENAH
z>~!N4MstZbLWUGxmOqqLK9|I!Sor+qKF2C>tCz~D3+m?}B@pZVXd>oHeFI{c6%EDW
zK-awGQ%;k<wE(?ZD@s&`kKYM2$etH8;uU`1#$HHp!m?WnuEfg6$B+X-9;Pd@wEkBc
z|8!0`=d6^ND!3;iSDJ%yUZCb`pj)4Rl_N(6ml}XZIM*64MsDVg6MA>US1F*rDxLv!
zB`0!BtWlB;7czxX7Ze3!-^W|a@YPou{tA5lVbwSqa=B98kTU=%M7x3vK7Y7W5FjsQ
z$L4aYnZ$PN1~uePrz~YOvl3#?=hF5RyQ!H`d_vr}MRK@|W2sC{1yh8SP4<(jOCE>@
z@_N=eOGLq6T~>w17hriH4!k!K2xUdEw4lVJz$ZA^V>z99OqXus*B$y0`CQ-<+6M$A
zF|Fjx&8!dPOW@Du1HhQsN{<U&GM(P@Th`(crbM2H$zD~uy=hF&w0m3mL^}tUXzR7x
z)yeb)4TB3Gs<@W?wn@Raem5|?BaGBbrSkongeuusq1aoXg8iR>IzF5cn{ag-A~6-C
z2orzAjLnZ^kU)C}SD+kk8^DrHZ92?q9aGjm3@5!o^aBIv^bO$+hJmaE*)}nRn{c6H
zYGL2_n(CEY@@Su5N%58J;KUb|AUmbpqIX1A4*hJI2aFfx?8?Qz&;w#!v6+V{Ez4O4
za9V#?kIsJ;n=W$W5ljGWz6@m!m}BJW+>*FD)ZI&S66fQ0!1Zn*0BWb(6OX)11>J_0
z>QDBSk7`S`fuL2DFoK}64)!L&?cZIlK-_v|(_oxy@|sN+Gb2ms${5`+!_G!3a_hAJ
ze%uM~oT``0Zr=;07cSv{wra4&WB?=;0w1&H#f+_<v{;=O3%7*G+TKpSMT+47Ga0%&
zSp1@a;Nh0!aXxrf`!de(x#+e=y!ZtHHzt2Hj{=;bff>)Hc~jcnQnEu~ZS91UtTr<F
z4F)K1?%4Uq2!hpiKkF}h(Y%NC2OcN~*w`cBWuXfcHVXI!(db@d)P_$HlGw>=m>zvl
zvYPt+^@HYWMY8y6XXwj9eBH>!T+i6S-J{Sxhkeu<QBwF57xpG+W5L;K=w%|My!86s
z@{5%R35B3GW57Ps2M2pd^xCys_EYM;PS?@qu!(+10w)6!1R6mxMS>eo`U#e%MpMx*
zhw2@$nyGa02WbwFZ>%a9m<~XW4S2J`$}HpEn<OZU8avA6duKJVgviuSu2Kq9QBQc_
z0{{c1rR9=M(s(z&{hK<Fa9r-|B8_kk&@0KO<_UA0uO}37Ny6BzUTTR2@Iz3_5d&Ue
zzgW#}a{gyo%MVF&F7*Ky?J|iU=(*(nAQZGVhk{CYq5ew?+W$P)<TPL}koH}NT4tFY
zXhW7;Hu6?y!i2i6Na~ik>lP9uuc+P^jJk6WLDZ}xwjbv<Zu%B~a?ZFDJH|!(tqK$A
zK$pbp(oMA_negLqxKYmAnl2&(0)vCxC;VI-v8QV9x#H!#KCZU(B)33bWvjf)V$BNt
z?X8v3f>+`j6k(hlt6!~T2iSA{Lnk7LxpwUcgxQHv`DI4=&?-||j%7m@O3htRiULiC
z0<hQ;UfJoh@CuCilLnm-fdgiAAKjOU$@+~CBX3XZ2f%pkKGixZ<AXILqN}WQ0Nsr#
zB=r?H>}6ToG$~H%HkSZ-d|^{aDv*=>t_SHLu3Tmr=;0yhx^?WNC%xy!j_8yh$0}9y
z%!dwZPkEF*p^_ig9cGnSFJy{L_)fL2@tFy-!%u7wih-4)Ey7~nm}HE})Vjfkg?pcW
zKNTf>$u{A#KHwG)ojS^|Qwn!nrp|*6l$&!f8u0`gun$56!_(dj*&6HAk}qS3$aw^L
z*;Ep{$gnJ*n>{DR)cO)BalYH|Ysa}g{lmC8Zl!e+kdG#<1HIZ=q+n`@NUX(N{3^DZ
zFRFZhNXay|@vSpyHdzrD!=!{cF(%VMUPTE=SA3LD68465*@FvZ^}cLk*!moPJSn(y
z6y?&y!iy6saXlvz%RM%0boMQX-aaic3`5(Ki)FO7kw4nQ7gyc(>Iy9oRaYC=S+rG;
zvS_=c2eeyj#jQu~S68(@0i0t8RvR*Y#ceip*&W*qP6=d+rka=)jK?SYxJJnwpUdf(
zZ_@u(Ey#5fZo$epy7phxmUVN$+3vs9K+NNU`Kv4g@bpn-d*=MS6Jd7UFcy2`O=Bv0
zxLj=9lg~@E-)6+rTgIgw8n&HjUrKOW5ATnQZ!}o!4isPKMz`OBXlb~r$hmtAoFQm*
zo8I6Ok9NrowX@Ys*hkHYXF!;|`qCGh3}H3!kT*~R7kk~t*f_7D_wKrWjH0^+%Xqmk
z0$e($PT+@|jT?1Hxli^v$I+&xgg#%HDa3bjV64n2FcIW?#qgTL{qQF<^p-!A9VX_o
zb46IHyc`hUbE#JvkaN^!c!CWzz5Fj~WWVLgW{@xw)+8=Fubk0~SoLs&9!>X1w<AXP
zlREePg#<svXb7tt&kWeQ+7TAF_{g~M*=F+`y}EazH8C+A4$uBev8+CbeCqCLv#C$n
z-ZB(;o(aZTe1m$Tf@@-(1vH<JfvqE<bAN7=TL1M(r|luUa8VOz^Q%&F8qYP0M-aH0
zw@qvNqYL_7<k6o-%4<1lbYnwzCfP%ndclyR0ftyE00;iu8jrI)eOOu`qZUi0DBM&A
z9456G7sp8v8}_q`jHwrIUkSc2Yve&#<quGBFFq_82Cp1}w~C*8CLGn`Yh4rJ4?AY$
zRPjr3MJr7hqQQpB!pL7bZBs{RNQA?k(%cC%gD|FG2VAp{8xBsqc@XVo`f&@#(iW+C
ztE;XM5ST<=`}{ho9n6Hr0c%9>M0fI64vN@)(;749>-d)4uMcufq#ZtXk-EHP3IQj>
zreYzUVmIT`>T`h~>;3Y=c&-S0Ds!qGXxhb;I=0xH&5&<_hXAYoSg*W&QUCTFFL$7v
zpWKZ1blt#OBsoQO)^|8^L*ND#R<!1M#SE>vPgh1dkPTU2N^q*f-Kvhn<Qq+~-mSgE
zV1M)3VnJ}On?yq^#sR*|xKJWb5~qX#1Dvp3<b}|3t0;`GL>`n%#OF=zV%p7!26zfW
zN~9N5o=n^<75QiJ$)@-=jyW3Vhr!npjVklb!UP%G`u$XBF{Xrp0mdC1z_Q&cknK$D
z#}&l6=5V<Jt@29%Y&r=oUP#P5*sTYnH_D`i<ya?I;uDgx>D}W+?u4htPR2!_NBxI^
z)8!R~Zr^#u@W%{7d3LEVScL;Cl5s!@cuRgvx$R%M%!dpsM@tOc`ORPlisV*>hz_Cb
z3;nAYR#DJ$`|-d5C6B^S*O>>7YY<5?SqP0{)kobC^VL#Y$L-$0J7R47n;karJxYHG
zS-U(^6;H;@=EPW*aO?53GcClM7!=~79J}^widS*i%|P~xa%-uG*E6KMn#O9tL`W~S
z?h$Mm9grBz-r_VWyE$}mdQuZ32K9KLzyh{9!nq<%=nc<-sLRLCoghUU@%)*f2WaKf
zbcQSLvpY-ud#~5!Y37zb3v9|m2RvY>T~8}zUHiKrAjrr+W{|A+Ajp`Sm!vDudkK_w
z9*xL9l$oCij!1mTU5&$EE<6e^HWHkr2t!P#QA&$#m~>Hh)qro#zul}py-_pe@GL7*
z<9R+@p*W806BQ%r)8_2_H2IH^IrDR6L)5!2IAa^lvVgGvq>dtVb=7ss_roew5fFkL
zYYT1!zIgyvwA>>Q(loZLQ>;{u`)~H~r&ss?TdaEkwLj&yP-nWfn4UyGf<n;z_(Z0k
zjiUgLR$KA(k`=CTU94#NMF?m$Qt-m%;+;4%0<wx^d~^$ouyH;w=Z>{^CqWh9G9r~q
zly#}PaWnSt1VteZ?Z$NCJ3E@Bm0kP(i6YZVSbHG2yoqzOG6{3VcojX|P3Md=j}>@#
z6F(99zkRd?)e8l8!{TXDg>1#&;G36l5b<}2-u9cb3#X|Rh&<`wFMwk)cKz1q(abn1
zj7{a}yp6M|=nffzm`G=x{}$<ZN*a_)Q&YepW$~hQ19Ov6lAPw&y6-$mAzMYAXb%t<
z!`L8m1bWD0rXo*B0;DVH#BiS$I`mUkW1&SxR2r@j=er3V3Z{_G0|ee8OA(3cZR5Ml
z?j2>8$BRgup%^}JCfncx4r4vj%^paI5~kT|WLtJG44to&8POBaC9+IIey%DblP0jy
zEQ2-{Xn&X8F{%Am+7yMo?hbn{bEo19B3B9KFG_%cz<{)m!4Se1wlm}v=giIOJp-&H
zt$(c`-=gr@`Ii9!n=KVrjLL<_zhtU)hTa2ya{bhqza%^Eknj|)ff>^|_fp!s5+@HP
zi(SBHKwSJ?m~2_;4&@$J=KCpgnWA9jieU3ckf=kTMJ6=A`<U&Wz{M)s>pGV0VStoU
z(QxjqGfHaHSROu^a@Ck#cT<&$w8*-Ed`98N?%#GF4A8Fx0^!oyL9>Yw|7^tt)FE3Q
zs9O!?BW};+eE%}g4>%D~MV8)u;|hjZixUzB^8%tc4<`WSF(VTWx|-sB7FQ$Mho1WI
zB;(@2V~d|(T@kjW2g}!B^?8*vrw@57-(=-&O(5HOy5Gs`1swf%!6Ffu50^77V0Wy5
z!A}Z1CXvp5dyDrAREQ<8M;l_&Wp(rTqfB8>{z@Vs`pScS)x=eR+L;LpYetOaAL6Qs
zojcfiHGtg_2J{T`IxDV<7z1eOj8_}(a8K@0t5MprTAi3T^7DToP(StOh!pP8@tLx+
zOGKAARUgWfOsLi|Krz@D#j#Uw6NPCcbVRAO%JqiIgyd}qyu`^W10#=m%6wukohbZx
z;0%wxn*3h-f)kAB{!e~91AoF{Y+)zY4%6vSwQ2WCXNqJ|)}$WOd0K*ZnN2@E2nP!r
z1w^AJG}}Uks;%-#2Kl;r0bn<ciw=oquaXo>`5bpVB=U%(TDK;Kb4XAsrqErMVy@YU
zy!i(xJ)QonyZ>H{%RhQ3@e!~I!N8!p=#ZO4ZCg&F1vP!tFK9f*nf5VwD1GF<^(7-L
zM_0{6VPl{HdDNmIIInR(_M1G+7@89uJA6jfO6)#Gi5w{R@A|sS+?%!rS{JQ-`hv62
z>f!?>Iq6?noloNiTpoj$x|etT!=Nj*jm{U=Pl3=gsG(7D>>eZ9mMxdl)};+VI~dd+
z<(RHZA#y!oVK(P~(!J=lgdW=Ros6#|M2MC}YJ*#eo6f9;B(h_#i5ni)3Hn58d9Gwy
ziP1jb-)Xh8FZycM4+%sK(e7C*YS5dh7B!S5gJOl|>_!$rRB4kIG;{f54J?=h5bCN+
zTjC`MJc<<xMz{aTWK(?OJ_PfQA4j3`fRvBwB44%O!By`W_b4%TI9wdzu<Jxo{tJ<n
z4F~`FPP6dLgAR1t-o7Ww8D+nwx5zJ6gwkG(=(sxO-r4E0r$W1*19JZqDU1fDGjCG0
zA}B*$lO*%+a7Z{pS)I>Tqr96(ACB;L63xggr_MO;d8z8!r$N`0Q<!eYgEnoKpi(~e
z#1dc7b8C6<z2fQqsKYnz9uqAJfW0DWItjCt=F*XTSTd=!{XvD$re()&D_UWbF>ZU3
z%ZZ>vMe4?7W~Q8X)09#8L@poKs6l87-()HZ<7Ba|)}<1+2JyD!=NyfrxQk4jhB+cV
zbvuuWjg%td1>PtT{5RtRaF+XXbvHNW+HH-8jFh|re@SM(S^3qfvXRJXSe*$|H#1W(
z^?6LwmB7vgLv<-E=-wRwNq{*M2M(e*3eCnHbae44?VK(U)-sqd^x{TUy-z-;RP+V&
zlT}F<C^s2T*9&?#&`@46fPN#^Y|f2*=TFXjIG3!f(e@*h^t-plJpgyzsHueRN(y&5
ziVm&Ke{&CsFcoAgo()Ksoyz1OxA%8_r%VLP`Wk%v+h^yx&q`&;q|k?$e$e6fJ_?^w
zjhRBDBg`vq0%Si;B8s!~%Zvgu48oLE?t@#VOWoieJ88wtTvGo#=sC)U&-gycC82=3
zPaqv@WGGOwT-CH@u@a}&*XOh#TXMQxP@SqITH^v;V`J>+fVglrR9nail4{#mckcEN
z(Oq*O?7r`aHqOJ_ObBh|uB4+U{W@G@t0i6h6c|$tc+88>_QcW|B#q2z*vYwPlN5=2
zZmqVWZL{xpQwGL#-hwqqn5(lj-qbL3kqea9L=nBD&%Z5kw|DqXQ{AaefQaD3eHsH{
z7_p(TAOI=3D?H~4fAK-~K{7))s>wE3XK0`BV{uNDfK=#wJw*|%!)qKLq7v(fN^%j>
z_cDRgvWr@G<AWt)uc#GW{rElL;C?Zy6Nc?wrI{W7QkymeK%!`#!iVZi_8*yEz?FDD
zJI!mv1=#%YIh7@y$v|kqV#DB~DMDW#M4*^@2<XPx2f%GTB1G$+ai>NJM=LfEf1?rp
zxRV*g*3cuGUMK}s_C&ib=kia{P-baZWDM})qAONwK$pf=Gqlr8ZZ2KhLRYf0h#GQ&
znL(tLiUF<(tzj;z)m#TnZth;&rt=eE<~~}sifb4>M(L`cfV)X#sezu#&gX1?S*XBr
zKwriR%uzE1qaw#`_%zxDY5e9o9&87sB=Dh3hHfcUe$P6RfAO}i8`5`{CdNN_9YMHg
z<KhCSu)&W&$a9tO*&JaNHPj;cu8ctiPUg3tMfFfL{3INL%;t+iK!ig!r?@mKdI)@7
zIKQpbkx~6lXxS5WMFAl4nIsVmB1`;gvw1vaxjLGdB_VBg<gfk919q8*V_H*g<ul1B
zZImS)<;ekCV|2V=Z=lLrwR=%CS*~3qzF)>9<QEUGW8`D-nt<P?nA+by=oiQLl>S_;
zs7zB_uiL|`xxJQqy#Rzqazq}t&y=O?N`WBu!O1*?YWfp^hDVuAGTh@s6*PU0P(Xhg
z*8al9()$C$;dP?|?Cqk;^naey-lI1$%VJ@wG`DqMHs!uYO*t%GTz_7+=!(o$NJ|(p
z<9x8<#(0F+Z`<c|snvRD$jR4FA`&y<a>j)Q@{w)rpD4pOE1CwAI{;1biDuaO!Q93g
zdbS=g$gE~p6NMH^YjT4MS3p2Pb4%1~h;@*C!@&c<Biu}>;oe$4+ZP3rSExiAah1FH
z$3F93SIVZy&I8wsEe*<_zOsmEb?entMzCSn3tmCYh`<)BA@_i2a~G_w_+O_07iGku
z6w*<L-Y#E1#a?;d9CRX=lzDirdSZM!9ZQH(=<F>MNnUb7Eqt5^MGy?>bAdl}FfURt
zyTzenj-yH@P4M5hCgQjsGWv&+p#8vkx>P>Xfh#B1<}N{CeX?WDv3dZ+&A`P%|CFFo
zHBxI$eIM!|hJ5t^JfDWNccy-kv-(*BozT0*H$`Bh>51vQ`JUuVUBVa?`(}Wm*1Lmo
z>J0O0)I3{gR0D^c;nsl9w$!IfVra;ZIC6z;*K-Vn`urLIY@QlTQ6kB_OrHr4B5g-2
z6~dJr?wA|}0%PO*h#_^6NW`YKI8eT@^(G>#4G7EHzr6~|52+$;(e!rtA%C+NZ#0Gr
z@_$`XfO@l{<*R!4n0J#81nfB0cjz8Pb4)ld#2ga0Y}W4T0LgNyX1}K@&~gZRw};?L
z?$eOxL#uJ0uWj#Ju?w6WtdJQM{rZ5RPnA*=YlubYPs_lUDedV_enQ@4Khrh?g6V{g
z*7XjH^3C3Qo&=00p6fP{#1H}}h9yMZ%dk7I7<p4-DK(OGP?1Pr6)0f<nt@&oR*4-?
zfjdg`o#@RGXFHUWgX%&dKjnm@zH@b57ovO(QP8*?b2WQ^alR=wv3rHs_lCLcHS@!J
zRhy<QX<Ionj}DjNUpzZpBBT>!wo#Yup9U`j4LT;rL_Q=cj=RPaLXCUZez)k92(vZm
zZWFh+zi`NDI~|X`SYPNUMVXtCR_61hc;)8?1-Px_n*gA1qB*%1VV+5p$I=%Ii5*RT
zl+KJ&Vdfuf(L={e{xpS^tWRd8Tqq48VLf&_YIyI62dnluV$1v04ay#ST9B-`bq%@5
z%4f)2JHP?M)fW&~l8fVnqb>U+>ZTH<A)OM}l-CsgK{x1L8iiuL+FeP&5IrVd<$+K<
zD5AZ($=%h%9YAcA$(818F2X%SSev@_%9>gQbo^wU!G}wbiT<b3oPaBzo7g0*V+<9Y
zhM3n(JRd_FhSwa9XPi9vOO$>>)o&^kd{lO<^B|(1OHq;HrbjD12Z=hj!#xwJ&KTl1
z6Pw6t0G~wf2Q+c4>2h<ES#L`1sxQy)lRhc@80RnQ|8o7;h4<HY!f!tQqvSyQry$mb
z(tt<1`#}OWQ(ppNY!m{Crg-^F9#d4iE5|c<_YPcQ%+Qp^BpKQwZn^C~MlyY8=QTVm
z72E-Wc7a;4BFwMKtFyZ)Y@@GWud&Kg@}9$nCR2721RL-U<L9QGvfkrLgCQf_hZ@$3
zD6oT8D@<_zuZX?TF}Ji%<!Ase)}Na-Wb$5M(j^MHk>(Rm`yUF$sqJ7($%}|#QE;H*
z&5I12s_6a1rBch)07g*C{cg6VV+%Js+q7Op<ad`wpD@Y+IMsK&yzB>A8DK?9-vJ%$
zkH-gx7FsZVS(*4}eVe<I7L9l4qSxz}(>`Pb=^YTRxq2NmP!?~U4k|JLZ&lPd$;GCz
z=e!)CWc3dH!<*RY_g48t2?cN>I8{QxW83DH!!E)#Xjtl<7s-JuD*%^eZzxYd8)C$a
z{{4%8)5fDLG#uqgDvs-eh6IGjG!LALU!)nrPre$r17%bHL_$SA!08C;fhHl84Yc7G
z#BCkS)OgXPoUa*?BJ%P4{vTg3PAO#+_eOI^L@wF%`~UJ3XX6i$)UZWiN35d(J7>Wt
z<Z(@Pk`V`Tgu^x4lP9LuNi&#eb2kD+TdOFxHJ4C0y$GE+$M1iQy*aKw<h$p5251uO
zt+9``^NG3Na>;33^zUSi$;4-t53vt-WQf*dI<<v3j@(D>)^)V9utx5-Bl1D4Gc8NB
z?Ty=(($M)AmnY!N`)wD5KUEd(cw*dXghYDa$3HR(LkW_e#$HHcSU52?wIh!rAzZ{v
zTCWNNk+oP7RS?cpTv-k%uayi+pDNqP0b89`pr9hSc6&#e%pf7Krp4D)`1kTrd4@r-
zt$<K6bz644!S+^_Ailk+q*~THYX}qV5k>^*6gC-n7~aND2kr`5EYn=oYbpP<ylbbI
z)r#VI=hjn3K|cz<me?zK_4axjnJVRrES{v@)hOIG5D~vybj83~f&q%4q+Rh@jwfhq
zn4YC=wjfi}mmQLn6>YS3$on^Yy6u#pX~6$@j2CHtgy!{M3)L%OlWnJfX~N}W77@gW
zF>1AND*X~@ViHe#oa942|Mpc1`LRX}zD;LZD+Fxh#zG<B5N>ODeIxX0O$TsojGV3U
zB6nGNVtV5i@uf(1brI&JIFxzpHK~h*SiqCGTQ0?p{im+*#0%SQcPu&WpRE3K#%?H*
z(pO-Czw@eYm4vNrVvq1#`%7Q>D7C9RFkf%MMh0Lh0ti^|e{XUYc-<Q*cG+ijLZWy)
z4)kP4yI~tHV7*{%SuJQ$N$l{p4NJM*NVYFVtRMLJVnl>rzuK{K8@u0}+K1iF+qJT_
z&C^|4nF>EnVju*-(AIxB2O8;}JyOQ4U!WtX+K9MC0Is&x0lNqRaDk8Q$kfE5KJh&T
zdZ>qN0b9CJnDj|vo0S3GTKqKA>@oEEI-67^Xnyg><g9WGRE(pMIs$*vh3*y(NE<V?
zdE4L59xi1m08kejRmXZf#uefF-lFo+3Pj3&NKXttollOFq%$n3y7J+W`D7RO=SIw%
zZHAH!^p}+<qth0COhuhG2!5;JN!f=$$2nMfEvM$8l+d6|z8*{xfi@)QmpR6f<(-OL
zE06#U0PaJh+*HSnq%(;pa`Hd2P;;$=kHGh9ctf>nDQF?UU|F^siDD?Ut225Hv#|)1
zyBa6yDKNSHw%Vsu2L5T1!N?cOGr%*PlK@F>#C5m}6(I2t32Q^r=&Dd$aK9+(riloc
z(oDgW9o?}d0d;O+G8Pt5`!%rceS>Y|5v8PuPX(1Mr;x%u@4rN@M{oRT!GeDu#^IF}
zmN~)t;PPd;<vpYU2O?JRVFbq1I#ivk9H<L7hPCN!&YPc-8I4m}bhsf1W8SdJcSZ_@
zbECZscki(Xl{;``1ft_;P~Gj8KP)Zh&1U<iwZ1skD6C%zDSl!P#E7jMJ-u3q!*JRI
zqjVD!*sz7F*bQH7aUy<7he{)L=B&~a%B+jN^8akRoo>TAt4@#n-^WBIwHm`;dH{3k
z9z12?JRpZkuYDZ%n^iWNo-s~E11i^uHd}{UiKN}exiL<aX2xj5<0fU!7Hl?p-*NZ+
z!#gFsph2E>j@(S4Fgy+Y9GH?8vaX=K)5+i;Tu^`CUPPgW?nVetRc;bVhTprVoNTtP
zTj6@0xYgN0r&F9U5hquF&}al8RNxzR+n$!V69`Z)L2!qXwu7wb844VQjPQS$?W>s>
z?SIpZUiarxKV_&lX?RHa#SU3{cv%gU1=&|m3lePVC1?G@z`4Fio9zYP%cZM)=#cR%
z1A4rcT^eHM<H|095jFdx^*{BfJtK=I#sv+itLB>d`)cmm55Py!TN74<)7BjU2{#zU
zyh4Dl67v}=4Nfd|zhrQd9nthFX)`U5Ktx)rI7vjKW~30cR{C$=E0XiUaeUye#haU0
zPbrq`7vk9Q>R1m^8vm0Y#faHBEQ-fDjV2J<>CNQ8bDJ9&TRmwn%jwaL*wB|86nDY~
h!&aq8M?t&3;}$d56CiByE1HJGMcAWl{u$QyMVU4{vFrc<