From 41710c109b1d502756e2034d1597e92469068ddb Mon Sep 17 00:00:00 2001 From: Patrick Date: Tue, 26 Nov 2024 18:14:27 +0100 Subject: [PATCH] feat: new hetzner server --- README.md | 19 ++-- hosts/desktopnix/default.nix | 8 +- hosts/elisabeth/guests.nix | 3 +- hosts/mailnix/default.nix | 25 ++++++ hosts/mailnix/fs.nix | 32 +++++++ hosts/mailnix/net.nix | 73 +++++++++++++++ .../mailnix/secrets/cloudflare_api_token.age | 15 ++++ .../generated/initrd_host_ed25519_key.age | 18 ++++ hosts/mailnix/secrets/host.pub | 1 + hosts/mailnix/secrets/secrets.nix.age | Bin 0 -> 1021 bytes hosts/testienix/default.nix | 26 ------ hosts/testienix/fs.nix | 83 ------------------ hosts/testienix/net.nix | 18 ---- .../generated/initrd_host_ed25519_key.age | Bin 1211 -> 0 bytes hosts/testienix/secrets/host.pub | 1 - hosts/testienix/secrets/secrets.nix.age | Bin 901 -> 0 bytes modules/smb-mounts.nix | 81 +++++++++-------- secrets/secrets.nix.age | Bin 7851 -> 7968 bytes users/patrick/ssh.nix | 4 + users/root/default.nix | 6 +- 20 files changed, 230 insertions(+), 183 deletions(-) create mode 100644 hosts/mailnix/default.nix create mode 100644 hosts/mailnix/fs.nix create mode 100644 hosts/mailnix/net.nix create mode 100644 hosts/mailnix/secrets/cloudflare_api_token.age create mode 100644 hosts/mailnix/secrets/generated/initrd_host_ed25519_key.age create mode 100644 hosts/mailnix/secrets/host.pub create mode 100644 hosts/mailnix/secrets/secrets.nix.age delete mode 100644 hosts/testienix/default.nix delete mode 100644 hosts/testienix/fs.nix delete mode 100644 hosts/testienix/net.nix delete mode 100644 hosts/testienix/secrets/generated/initrd_host_ed25519_key.age delete mode 100644 hosts/testienix/secrets/host.pub delete mode 100644 hosts/testienix/secrets/secrets.nix.age diff --git a/README.md b/README.md index 41ddb84..550653f 100644 --- a/README.md +++ b/README.md @@ -17,15 +17,14 @@ This showcases my end user setup, which I dailydrive on all my hosts. | | Programm | Description ---|---|--- 🐚 Shell | [ZSH](./users/common/shells/zsh/default.nix) & [Starship](./users/common/shells/starfish.nix) | ZSH with FZF autocomplete, starship prompt, sqlite history and histdb-skim for fancy reverse search -🪟 WM | [Sway](./users/common/graphical/wayland/sway.nix) & [i3](./users/common/graphical/Xorg/i3.nix) | Tiling window managers with similar behaviour for wayland and xorg -🖼️ Styling | [Stylix](./modules/graphical/default.nix) | globally consistent styling -📝 Editor | [NeoVim](./users/common/programs/nvim/default.nix) | Extensively configured neovim -🎮 Gaming | [Bottles](./users/common/programs/bottles.nix) & [Steam](./modules/optional/steam.nix) | Pew, Pew and such +🪟 WM | [Hyprland](./users/patrick/wayland/hyprland.nix) | Tiling window manager +🖼️ Styling | [Stylix](./users/patrick/theme.nix) | globally consistent styling +📝 Editor | [NeoVim](./users/patrick/programs/nvim/default.nix) | Extensively configured neovim +🎮 Gaming | [Bottles](./users/patrick/programs/bottles.nix) & [Steam](./users/patrick/programs/steam.nix) | Pew, Pew and such 🌐 Browser | [Firefox](./users/patrick/firefox.nix) | Heavily configured Firefox to still my privacy and security needs -💻 Terminal | [Kitty](./users/common/programs/kitty.nix) | fast terminal -🎵 Music | [Spotify](./users/common/programs/spicetify.nix) | Fancy looking spotify using spicetify +💻 Terminal | [Kitty](./users/patrick/programs/kitty.nix) | fast terminal +🎵 Music | [Spotify](./users/patrick/programs/spicetify.nix) | Fancy looking spotify using spicetify 📫 Mail | [Thunderbird](./users/common/programs/thunderbird.nix) | Best email client there is -🎛️ StreamDeck | [StreamDeck](./users/patrick/streamdeck.nix) | More hotkeys = more better ## Service Configuration These are services I've set up @@ -64,7 +63,7 @@ These are notable external flakes which this config depend upon [impermanence](https://github.com/nix-community/impermanence) | stateless filesystem [lanzaboote](https://github.com/nix-community/lanzaboote) | Secure Boot [stylix](https://github.com/danth/stylix) | theming -[spicetify](https://github.com/the-argus/spicetify-nix) | spotify looking fancy +[spicetify](https://github.com/Gerg-l/spicetify-nix) | spotify looking fancy @@ -82,9 +81,9 @@ These are notable external flakes which this config depend upon - This might take multiple minutes(~10) - Alternatively boot an official nixos image connect with password 3. Copy ISO to usb using dd -3. After booting copy the installer to the live system using `nix copy --to .#nodes..config.system.build.installFromLive` +3. After booting copy the installer to the live system using `nix copy --to .#minimalConfigurations..config.system.build.installFromLive` 4. Run the installer script from the nix store of the live system - - you can get the path using `nix path-info .#nodes..config.system.build.installFromLive` + - you can get the path using `nix path-info .#minimalConfigurations..config.system.build.installFromLive` 4. Export all zpools and reboot into system 6. Retrieve hostkeys using `ssh-keyscan | grep -o 'ssh-ed25519.*' > host//secrets/host.pub` 5. Deploy system diff --git a/hosts/desktopnix/default.nix b/hosts/desktopnix/default.nix index b62f95c..5942e73 100644 --- a/hosts/desktopnix/default.nix +++ b/hosts/desktopnix/default.nix @@ -37,10 +37,10 @@ services.xserver.xkb = { layout = "de"; }; - services.logkeys = { - enable = true; - device = "/dev/input/event15"; - }; + # services.logkeys = { + # enable = true; + # device = "/dev/input/event15"; + # }; boot.binfmt.emulatedSystems = [ "aarch64-linux" diff --git a/hosts/elisabeth/guests.nix b/hosts/elisabeth/guests.nix index 8437783..2d2a794 100644 --- a/hosts/elisabeth/guests.nix +++ b/hosts/elisabeth/guests.nix @@ -38,7 +38,8 @@ let ipOf = hostName: if hostName == "octoprint" then - nodes.testienix.config.wireguard.elisabeth.ipv4 + #nodes.testienix.config.wireguard.elisabeth.ipv4 + "0.0.0.0" else nodes."elisabeth-${hostName}".config.wireguard.elisabeth.ipv4; in diff --git a/hosts/mailnix/default.nix b/hosts/mailnix/default.nix new file mode 100644 index 0000000..427303d --- /dev/null +++ b/hosts/mailnix/default.nix @@ -0,0 +1,25 @@ +{ + imports = [ + ../../config/basic + ../../config/support/initrd-ssh.nix + ../../config/support/zfs.nix + + ./net.nix + ./fs.nix + ]; + boot = { + initrd.availableKernelModules = [ + "virtio_pci" + "virtio_net" + "virtio_scsi" + "virtio_blk" + "virtio_gpu" + ]; + kernelParams = [ "console=tty" ]; + loader = { + systemd-boot.enable = true; + efi.canTouchEfiVariables = true; + }; + }; + nixpkgs.hostPlatform = "aarch64-linux"; +} diff --git a/hosts/mailnix/fs.nix b/hosts/mailnix/fs.nix new file mode 100644 index 0000000..081ed51 --- /dev/null +++ b/hosts/mailnix/fs.nix @@ -0,0 +1,32 @@ +{ config, lib, ... }: +{ + disko.devices = { + disk = { + drive = rec { + type = "disk"; + device = "/dev/disk/by-id/${config.secrets.secrets.local.disko.drive}"; + content = with lib.disko.gpt; { + type = "gpt"; + partitions = { + boot = (partEfi "256M") // { + device = "${device}-part1"; + }; + rpool = (partLuksZfs "drive" "rpool" "100%") // { + device = "${device}-part2"; + }; + }; + }; + }; + }; + + zpool = with lib.disko.zfs; { + rpool = mkZpool { datasets = impermanenceZfsDatasets; }; + }; + }; + + fileSystems."/state".neededForBoot = true; + fileSystems."/persist".neededForBoot = true; + boot.initrd.systemd.services."zfs-import-panzer".after = [ "cryptsetup.target" ]; + boot.initrd.systemd.services."zfs-import-rpool".after = [ "cryptsetup.target" ]; + +} diff --git a/hosts/mailnix/net.nix b/hosts/mailnix/net.nix new file mode 100644 index 0000000..9fd06dd --- /dev/null +++ b/hosts/mailnix/net.nix @@ -0,0 +1,73 @@ +{ config, lib, ... }: +{ + networking.hostId = config.secrets.secrets.local.networking.hostId; + networking.domain = config.secrets.secrets.global.domains.mail_public; + + boot.initrd.systemd.network = { + enable = true; + networks = { + inherit (config.systemd.network.networks) "lan01"; + }; + }; + + systemd.network.networks = { + "lan01" = + let + icfg = config.secrets.secrets.local.networking.interfaces.lan01; + in + { + address = [ + icfg.hostCidrv4 + (lib.net.cidr.hostCidr 1 icfg.hostCidrv6) + ]; + gateway = [ "fe80::1" ]; + routes = [ + { Destination = "172.31.1.1"; } + { + Gateway = "172.31.1.1"; + GatewayOnLink = true; + } + ]; + matchConfig.MACAddress = icfg.mac; + networkConfig.IPv6PrivacyExtensions = "yes"; + linkConfig.RequiredForOnline = "routable"; + }; + }; + age.secrets.cloudflare_token_acme = { + rekeyFile = ./secrets/cloudflare_api_token.age; + mode = "440"; + group = "acme"; + }; + security.acme = { + acceptTerms = true; + defaults = { + email = config.secrets.secrets.global.devEmail; + dnsProvider = "cloudflare"; + dnsPropagationCheck = true; + reloadServices = [ "nginx" ]; + credentialFiles = { + "CF_DNS_API_TOKEN_FILE" = config.age.secrets.cloudflare_token_acme.path; + "CF_ZONE_API_TOKEN_FILE" = config.age.secrets.cloudflare_token_acme.path; + }; + }; + }; + networking.nftables.firewall.zones.untrusted.interfaces = [ "lan01" ]; + security.acme.certs = { + # mail_public = { + # domain = config.secrets.secrets.global.domains.mail_public; + # extraDomainNames = [ "*.${config.secrets.secrets.global.domains.mail_public}" ]; + # }; + # mail_private = { + # domain = config.secrets.secrets.global.domains.mail_private; + # extraDomainNames = [ "*.${config.secrets.secrets.global.domains.mail_private}" ]; + # }; + }; + environment.persistence."/state".directories = [ + { + directory = "/var/lib/acme"; + user = "acme"; + group = "acme"; + mode = "0755"; + } + ]; +} diff --git a/hosts/mailnix/secrets/cloudflare_api_token.age b/hosts/mailnix/secrets/cloudflare_api_token.age new file mode 100644 index 0000000..5306a75 --- /dev/null +++ b/hosts/mailnix/secrets/cloudflare_api_token.age @@ -0,0 +1,15 @@ +age-encryption.org/v1 +-> X25519 uhnRibm92XSz2UcJWT43CrsZfOrSzUyqVFU8nWiYEXs +QNxh6YGDCgSSoCWLthZlou7F7i9OJpunB+/6J4ogk2k +-> piv-p256 XTQkUA AzTDTMXLU5jTp54ysvnVIDo5lIb5ED1zkP8659tTH2JJ +VLO6rtfY5poFGVH/eeD+T/xrlNdPGnlLQ6mK1HytT8A +-> piv-p256 ZFgiIw AnwL/t0GNZI3/y7KlatHLebToW1pJLfOasODGQ7ogriz +Wl7xm6+a1qmqLeTZszpO0XG96BcDRO5l8wvpc0atW0Y +-> piv-p256 5vmPtQ AzC3t9sPdKF/IPkJSqhldnx3Mnkc84DCD13l8tYqZIWd +GaNzRxPoSOy/kEuLzbXpiRDo5F2hZT8KriXpgqZkQ5Y +-> piv-p256 ZFgiIw ApFdJVoW4zoWq38fE27TR/OFEDs4Wub1g3q6RiF+fDTR +IypnQqeluntk31gez5I6eYtlKiY/8sy+dXNkpWhdwPs +-> wX-grease +neAQttCOcpQWsfSpI38jdOjODJYK8uOhqjWsZOLWlHZaRUQtoyXI +--- r44AgWizs6H92oY6hKMs67ARXqr8Je0Z0cIJr9xidBg +Ѩ␟̪Ph\dv _]Ӛ܊ژEʃewIt.W6ZFi \ No newline at end of file diff --git a/hosts/mailnix/secrets/generated/initrd_host_ed25519_key.age b/hosts/mailnix/secrets/generated/initrd_host_ed25519_key.age new file mode 100644 index 0000000..6575020 --- /dev/null +++ b/hosts/mailnix/secrets/generated/initrd_host_ed25519_key.age @@ -0,0 +1,18 @@ +age-encryption.org/v1 +-> X25519 ddFv+EKlJUwePVA7CiwFOA/mECyJ9pC328u5r9Bjhz4 +5c05Nlc1ADOpUq5MugDuHJqSz4OW4Yupl0UBl9DxyDk +-> piv-p256 ZFgiIw AgiBCvmbqRaShnyh+NuDFFESQ9Q5sZZ/YjYXelOzCYyV +/6/igWsiKPwTlydwiAR1ZECyURFkBiJWCppdXP5GDRk +-> piv-p256 XTQkUA An4etg/KtGFdnw74QM+QW9vRkrAxEZmMjhexLKENVnV3 +m8UleuJcvy/OZhlZrOEguL+0hWo5n2Ykgboq8BqFrdU +-> piv-p256 ZFgiIw A1vxQkA8CeZGrXNcvBZo57iL82PiTPm0hP3KODzWnU/z +USt8rTNK7l9VUUyAiSnDiLVQgLZiFZQgcy04lWdk+nM +-> piv-p256 5vmPtQ AnAB3M/AWePGjmIUdoH0rSHg+gDnxg62RPy9qgHAgIIN +7PPd5p4sXrbDvZBITS3zMnG7qNmlj61hdHPlVo5cJDQ +-> qtLMz'K-grease ?Rtv +~4H. vh +ZBK1Zs8LKTiGvOSxH/dacE3yc1ouqSylHM5Ahv+HmR89RQX/JR4y3Gtec+G2W0Ty +Dh9z2wVbCDlJTTt+N+9sLvV/b5+wETpwhPmiSWbh92yvNYH1yLQ +--- jynsWcgTRZR51+fu9nqHP5yTxxz1BovM1s2YY+0uL2I +Sӿ4}NT (+ e9_q2O)=w//D|v`6XI/ˆw^+h6nrq@f2 l/ݓz7,rFP6Ӏe1N4FSҩ8̷g]i}n)MDH%^28(8\`ACн/<%8\e=(*6a V\GuI |gݗ#v&@х HIhXY9M5%e6?2" +YM#L*6*!JM& G%C34sقmA?9|MȺOSr+3QeRLKue?{=-[m +ە>QT71z \ No newline at end of file diff --git a/hosts/mailnix/secrets/host.pub b/hosts/mailnix/secrets/host.pub new file mode 100644 index 0000000..3489444 --- /dev/null +++ b/hosts/mailnix/secrets/host.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGFqG1mU7UX0uNATdPaodHdSm9YYDV4grqmf266D0ajO diff --git a/hosts/mailnix/secrets/secrets.nix.age b/hosts/mailnix/secrets/secrets.nix.age new file mode 100644 index 0000000000000000000000000000000000000000..c5438301e5bbf217726afda14144dcd41a08ab98 GIT binary patch literal 1021 zcmY+>`-|HI0KoBc>_oFu<~YU>!H6Pgt!Z9OGd<5VZSRu4E@{#iLu`{YX__|8vu(H& zrW2XmFAjxy`@zYH=%()2#@O8^PDMCnpw8!f&M9&_MaA758#>(&{&0W6hcDlns)Ut} zWDmM-)9l=9+A8G3K==W$jNmv-f|X*+E*T<`#Rh>D2{5Ec%ZWEY1|K3f-n3?jm>;tftf^ z(*r3uKqq1n0b^9V#yUh<5`SWEHegW6La~ zNlvn8^K8Pmq?VO6vhMYl##{8C(dF3q`0bbD3I2SyK4qTFyy3!i!|1Q@@ z(^8Xe#1NC^@akj;3B@UlWf`bc!2(KZ$^AS<>TMx}0cPHAN{9~iLlcG!)pR<|$c+fy zXF9cPCS*7cT46GwKAID;H5Tr-r(6!CNYdkF7^yQxoHWdg7C@5HM|mcn?K=jUmOGrl z7vQqk;XNSX@Kq?<44Jhw){G@cT-7Ie0&Dg~9Wm0lBTl75xjLjo`pi`;lMk!5Qgak= zEP}Fj3JjZm?O}Zyoc3$Q$Qan;i_<{EE(l)A@FIb&r!)jAx|Ee<2tQh9yD7+P>MkBd z|y|B;_&OfmlyXoE4uQwk1d&Au2A#aSbUe%y0`p~(H!TRv|XRm#E_YIHk ziq6b#{%8N@XHF=@k<`ZJpSG;yK3Tdk`Qgyg(9zRRJ`L{K5FY=%H@rFnoI3i}9Xq$! z4^0-L)@?oXt1yH8vTgpF+s}xHS3aE`om)J<@9`aMYJB4Co{>Y_=kEXVx5EdC6W@;R zT?A{Z%gH+z?&_Y29oqHl%s1Nb-08btLf0J_0Dru)GJEk)^G$X5!r=1j=!*+8vw*oV~OI Zd9U=y?$1U(`sdO_mi(6OIAsZ zmudxF$*V8sOEO@9ChKxD55X|#Hmgb`fw?rUfThqFpQ~BYYE+3w<2jZD!o^gCWl4hf zGG(0aFolQ`o=E7RjRy-LB_|CH$w*?W&Y_wSBMcdJBNS5i7w~fUflyEkYXO2C=9phr z(2CjPERndwM(09KJP9Zw6g4tBCJAa%4mn8{Bi&vxC?iqLf%nSkAohRI?)fm3BtPJ0DR3!*A-;!rRtbVv;Az|kVb#VdiR zofM>aTP1E0V>u_5&SKTpnn%pD4_UC0qx7)Z1CiB8ykzl4*etA7vQ8U?csL>B3wE)j3E;OjU#lc=c$+A(A$&t^;)dmlU@*P*Q^g#7bAMT$W?4yU!|m->yX1+^gFNYMi1_amO*3vu~F@-4R1Sl7N>pO zx%<2N$d1Qhhxf|Wfd&Fu?E4zo*tEbjqqpni#At8dME_f>-dOqCsX0HN+p{6FY)AcC z{!E129Qu8B%NlKZ?r{5k{MfrWa}Twe+r0Aj>1D;H-k zIxfwhv1`5K`d@CaY;dUVCc+qomnrGigzZvD1*$iMy4M?Ew7#-^7~VfQc4`0C4x2d0e- zj+{a+e?Q)|_Vc8Vn>yY-<()}XSMyeLdCj@`1I!0cZ=U!3t3MgPQgilRnKfSNJ9PKY z3(beRdt1&d*)Xy6!%LH1NZreOilY~f=KZs~_l>Un4gGZB%^xlfcHUjOr__TlBIjc6 P;d%NzCf{{){?vZ~MuySS diff --git a/hosts/testienix/secrets/host.pub b/hosts/testienix/secrets/host.pub deleted file mode 100644 index 705773e..0000000 --- a/hosts/testienix/secrets/host.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMTiFpqpCiJaFOcSjFrJWk7YPBiZLwoJRbyy1JgZWFmN diff --git a/hosts/testienix/secrets/secrets.nix.age b/hosts/testienix/secrets/secrets.nix.age deleted file mode 100644 index efe7e8882488d8060c49d13f35405b26b5df7974..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 901 zcmY+?ONiWb00wZ2sF1RHX;muH*jhYH$4N5(WHLy_OrDe3%uF7Wok<1F=J8J^^GGt; zWM}s_YF$)ZsM7j4^-xL+wFkAfDlB-AT12bhVQ=5<$M^Bs&?|cr zCtbu@IGsE_O<^U+k@B->pCC!Rj!Gl&ehJ$gzGFXk;j!)#n8vm~lhj}?BND8$C7&Z%( znLvdbb9Lxh4rS}a95!m%($TRbF&W`*qAl881>~$07KoGqVT~Tm zBot-Tbxz}PQU3WQGcUgTyjd~2qY_tr1D1bSQ3%wS!6IRQ@?hKO!W<(~D28vz?G%l(_bI&5{j?%}6~21>5CbxChR zz9I@U&U91>gS#v;A9phqWrhnC&nZkNU4n88fv+om!6^oAHyYDcSdw7h?8Ox|XxTV2 z0{y810?;RQqg4wga+q(VIzgF(q0%()!Ve3sM{y)0{I}t}_8fS!3{%gZd1xs`kD`sr zQ;2WRVj#p_CSv&_w#+af|dAUqc@-|Um?>0 zVh5r=q|=}xlB})MEl?E~u2x-=yn>X=WfTJgX)y9_Iq7ST24_~I?!zTxxP6jKqA0Y5 zwI#EZoCyR-fnU6O%Bp;1%kL@=zxPAuBysZEANO2Y2~SzOl~ zD_dvY+;@CCI(^{V6E9Ua|J)p(QW8d7_dEvs(*ME9r&v*0l zJKGPwZQlFk@%HzR{rboQZyk*D+xKr?eyw`>8kMBaYjFQz=g#~0U7)-hFQ5AdB2z&t diff --git a/modules/smb-mounts.nix b/modules/smb-mounts.nix index 904da1a..ff936df 100644 --- a/modules/smb-mounts.nix +++ b/modules/smb-mounts.nix @@ -6,6 +6,7 @@ }: let inherit (lib) + any mkOption types flip @@ -64,42 +65,48 @@ in } ]; - imports = [ - { - environment.systemPackages = [ pkgs.cifs-utils ]; - fileSystems = mkMerge ( - flip concatMap (attrNames config.home-manager.users) ( - user: - let - parentPath = "/home/${user}/smb"; - cfg = config.home-manager.users.${user}.home.smb; - inherit (config.users.users.${user}) uid; - inherit (config.users.groups.${user}) gid; - in - flip map cfg (cfg: { - "${parentPath}/${cfg.localPath}" = - let - options = - baseOptions - ++ [ - "uid=${toString uid}" - "gid=${toString gid}" - "file_mode=0600" - "dir_mode=0700" - "credentials=${cfg.credentials}" - "x-systemd.automount" - "_netdev" - ] - ++ (optional (!cfg.automatic) "noauto"); - in - { - inherit options; - device = "//${cfg.address}/${cfg.remotePath}"; - fsType = "cifs"; - }; - }) - ) + imports = + let + existingCfg = flip any (attrNames config.home-manager.users) ( + user: (config.home-manager.users.${user}.home.smb != [ ]) ); - } - ]; + in + [ + { + environment.systemPackages = lib.optional existingCfg pkgs.cifs-utils; + fileSystems = mkMerge ( + flip concatMap (attrNames config.home-manager.users) ( + user: + let + parentPath = "/home/${user}/smb"; + cfg = config.home-manager.users.${user}.home.smb; + inherit (config.users.users.${user}) uid; + inherit (config.users.groups.${user}) gid; + in + flip map cfg (cfg: { + "${parentPath}/${cfg.localPath}" = + let + options = + baseOptions + ++ [ + "uid=${toString uid}" + "gid=${toString gid}" + "file_mode=0600" + "dir_mode=0700" + "credentials=${cfg.credentials}" + "x-systemd.automount" + "_netdev" + ] + ++ (optional (!cfg.automatic) "noauto"); + in + { + inherit options; + device = "//${cfg.address}/${cfg.remotePath}"; + fsType = "cifs"; + }; + }) + ) + ); + } + ]; } diff --git a/secrets/secrets.nix.age b/secrets/secrets.nix.age index 92a34079caef0405c769bcacbe85d9426914e929..96c9c4e5d520d73ab05b548121eb0f91fe63eedf 100644 GIT binary patch literal 7968 zcmV+*AK&0%XJsvAZewzJaCB*JZZ2SU6Pfv4AOLk^Va&m2MaWHLJXL467 zQcrAeM?o)DFKkjXG%G|*SVBisO>+t@J|J*ub}eu+H8vnxMrUbBcOXGFY(-cvWHmEc zT2WeSN^w$eM|MGWc~^QudUs+uWK{}KH#Tf*b~I~fc~d!S zG*n1JNmpbyG+0+icvVzXS$KDFc~etHNOVq8aBB)JJ|J*ub}eu+H8vnxMrUbBcOXG@ zYIS)tFl{w+Y(;KIHCRqlN-K0rWl=U)Ls~_6SU7KMdRR(rc63-wa4-rtLUwRkL1ScL zQ!{u*Zg6*UH#Jd5HeoMTcy>c)cxhU4WiMoNR8vG#NmU9hJ|J*ub}eu+H8vnMc5P5} zQ6NEYS7$*@SxtFbGDB5%b~tiDL`6YkWN=GNYh!M4S!hLJFGy>4S9fP=L}LnaVq#@E zNlb7tLUU$rPcmylRC;MPOfN`9Nq2WqP#8OD$(| zWnpt=AS*;WZy-Zc{mBQEx~}P)}KSXA0R5&1H9%f+dyDF{6b@T9Lnyxik4y6&yKq2~X)QSM~Oc zTN>e=JvwomzBx=>L?aIQl?SZ~+v0z!oSf!%fqrMaJ+f%p*={1JC7z2OAcFFR>ru{) z5CxH|7nmU-d&6bvF=e~3EkNqBLg_H`=b5=h0G6Bqm;xm4R!$>irC=_gEUFr7VxRgo zaDV;L>p#@ZaF+aU-SMA1e2-guPY}JL(grbqaZ$IIdA1K3D{J5nY|@;OyN-IlM7Wm` z9~enT6_fts_O*g5|A2A(`j^?G#iSW>>b``14r={|EaE8o#V_*HsJFpRAs1ZXIp z${`7J9RrpiE{DenD4MOZFu-agPGUhhy0Zg$=uK-caU!*NR{car(;FhQ69R!p)= z?J-oF6{89OM)NI9|afx+M0&^ zGuZT-2SeZI@7?^1y(NS}Ow)LNhTSvwofZ!6l<{5&fJB9vIL)k1U2b|U!|9*SPhdhx zYa$a5>1$dqX5CnTW4O+m1L#8kF$T4kB;6{jngA~}d{_g#2=FoKp_vpiJ?c7MzZfPP z2Bn7i6xFf-Qrm1`cSX(>3d>qY4Qjp&qlX)DBCuXS2uXT;Zkj-~3Z$rE<$rpGnIki@ z=IMMS;V+^i>e#8<;wpa`!|U8skS~^Vs)Hzs1igbvKmw4ElmP>`Rk>Uo_fjPWe57;0 zUG)b6=e-vTlJOIZf0V`_2OE1w9Pn1wB2Td)B!S|_kiA{1v}a6@4W-y` zA5KKm0Mkq!1DBw3hh%&A*FIGa4>J^B6}^(`?@(6GFz~#4M~+$-Ive|knbsMQU~j3n z-zBf5{ubHICV&+lLn{R3Qu{s6Z%?C^KYm3l>97$FFT19bSxyEyPV*zS3pk?S zz!gP=Ov~(C)6e!gjP)bIyaZ@)zv*DB7p*pdz1ntJiiwkI~z$i?x-r41(3P(IZh{To`E*ltjBjY4K%WIxGZNd>qpH6BRo1G0QLek{r z-7G`U3Yr!~x;0hxh~Ab8aIhH9k4G!$Y_HuEDkH#p^euL*3hu+7OMmY|tT;Cm=*y;X zvS0Oy=9%Z0NHP<93*T_Y! zuym$IHFV7>7p1X07c)VdnG^czH_x0h{u z7>FngE|3X0HNuq(-^^uP| zd|mc7FWs-1M|^Q!0bYA~%=^lICDPisv*b-sf-US(kx3(MZXWOu=3o)~xONAFuI8du-*Yb7-=N^c@)QJmLYW0scY{c|>p8 z_7bR1^}`Oi5M@aOPw6>mBq^KUUt*fk`GckrDTFnU%bKshZ z)C!`by+!i;pRVehVOW(v#?Z}O%cWR0X74v2)Ru%NREelOyng4;DvQ)Sn6=uMO$&($ zn=CRj>+iwA$ehrT)W{*w5e1p&Z>Mj9U-cGr9l0yQrHF^aA1c13I$Wq|cafk&2V|@_ z?FvVG&7kVVmARDH*5!R#yAJa#!zkFun8t>L+E6m zOf-7jJ0V+biE(Tlx)kB&S2$(SkOh^ZXGWe>`${P{bwK-chyB%)*$p~!K1;egq$(!TWhLlDFKv>DnnwpGNt3kh8y>KAz+zZTm8bc`*YJnzL9<4~`<|><=kx zUeUlH^lum@>^dzUFmaLaHz=f0y#pP}AcE&4v39BK}7QOP&?4QI2xKK== zOWo)~qN+)ys}6RIwy!YxN1HsYALuUc!~8Fn2=pWR5|vPrSd&0D^5RY@!(9jN&)3~) z`?0@pV~2Ah?4(V=OCH`$Wqh$6)@1UK@ZL9Q1o@OylprKDc*9~x0dy8E%wHSjWZ2sT z`eqfL#24%HFKbNhX{rcfq+0cFcVn`4KzSdk*}(`ql?+c_9u*|(-CbH^ni?oQ>Zx|u z)7!&s8-jx=EfZ64V^pNipyqxcAH0wNN$D-;nb3z!db)jaQn%%dI`Mk_6WgkQhZ!Z@ zs!ZBEND^5GvCj5dYZE1WfOST`A0(d;v3t8XM6GpX^kj5*{y*f1($r3;Q%fPQ%{r^f zhz8duyKe>HQ^h5FND#JExx<}^(n@smj9X2^geJ!!=;*2Yr#CBS!#~l!xfY${V}V7h zjQ;s9i79xuIb8%Ok+ulN%}=%UJknZYVYu2iRQZ|O@`i&LuR(aK!_!9PW{C*&>nL!+m}kmtxb-JiR{6E4wWQs>w&)$!)`LCjwp z1$Ohj=zN(f)0U59*C>N}d*qPG>nq;sgzH-g?AI82?C*dK9tB{Jf3L7ctZV6@EO+s z3c=M~SNskjdoswL<0m&M>u)ohkUD)nbp!4;^}8{*+pQ!liNOx%K=x{|JYs=m6_Z^u zdtxTzR0>Tb-^ctW(4xI|32Winl^jgWdjFULg>;}e?3O`3L&JL=KxuyC6t_ya+Zx`3 z#|dVfM!(t_x1j>rRbTSi5^YJ`>s;jXc@XtA$)+CQdMYdu2r!fo+ViqlhQocs#~w8E z9ki{G@W1ul6natu3#z<(RdOmPgrZSj=i(?ZTp`S#hJ@L(a)1}2Y_UQIXU_E^3KB6o zdS^Ygdw*R!TjcI9A2q6zuNr6Y-jq=Vvum9p`j!T00RWO14tw6Lm>YTT`vj8M2!r;T zXa?EJO1s|{X@Le!B*0yiQf5FDb{5a=+XT9+t!;uAwC(H&{gNUY!Qt-JAmZ;WMm^+> ztBrN|OsSm&m0|d+AU+q4f0Z(lb1GyGTL@(ECTZ|PQM^m!kU5r)C$(F%PeS$o_^Xvt zNZ6DW8-Y~ym&^U~^vD1ONlsx4Nw*%llE41(2(?=$_@m&dEXl4-+3tb8mt1PLv}+}X zz9|mwW!sd=5v>Fz-iH^YZK99H#Wdu#ce9rn=UJBmvCxI_h8o?47~sFStE;jdnXnP! z)8zbdyAUmcS%+KKupRc67q;In$An>os8$#MHQrog+l!HRl|L2QKu-V|#b8IVA>{ze zruFFY9mD}n@Zl`YA~KMw=YI1@d=q=i94UqAXolX2`F5iWqSM!~sjri!k=Nq;fh*jg zgpurJy^ov-HbajN5D(LcKJd6G1ChI6ANc*rlh9gv3j0sB{RkCEoA-tNQD*6;_m>fw)!~byz98%j?1~6DlgX z6mcyt?0X)Q%TQ-U)GSU$_cr=vh}?!kA?GQ17a*5O9@Gyzoq6JrI~XA4;6`m8SF2eV zEG3<7=x}XAVgqA0R=d^&_Lo3NZ`dJ=yb#$+J8>s7n z!Ud>_zwDWT#$csgT~q9B&oo?!KS=$Gh+>pAk}v6eu=rtmx5zqLp0lG_4U16@XFsT4!OaO?s3TJUIj^>XV9uX}qQ2<_#YE)h32@LxZ6CM9A|EHddVOn_G;~ap+Ia(j>N|k{dFNjKRNs<** z*c0j!r&bSU|EH-7q)b)C_Pl~!z~tS$eC0OoZUZO38&bTjPb_-Q_+4i;uL;pi>F^YN zk=;5MJGZ3C$L33(<{XmFcssL>n+rD`n&$scOJ4HG(bvI~p2zq4|Z3cCjY z9@vyWyPVOQQE;kSaU7G#lA@um<=1@FL$^h4Ve8gF<>NR*Bi5Q6oDYVFvSGUaWg}s# zx`P<2y-Pdo>U5W9p=8=Ey%83>A|cS|6upeaogEDK#&d1^{Uc_FPr~xX1FfJW9B0cR z!xTQ#162}0?d(P@pVJJ{C5Wn4mVl(-0MKQq0M5vVJB%e>T#8K>aG)abL>|gClORnN z5qQF$A3G=AM8;WH@u1!2A_LBtRr&zOB<58>D@R1Y&IR2sp0>8pTBmkcDy7iPU{><= z*;=&;Q=xY98&GfhC4D^<$4N)o0pcR1=@0!Kak`d-!58GD6x5ES9)_$mTp`}lM#t{33K-Vx&_5T+Je*_olZ7%7>*+TslXBb`i#Cu6&csl{Hc@b0Wo&iO zS9K4%3p5uUcfea%%Npc@sRMa1m@mY%wOR{p2nOj@^+dX%xzukjzXCO)%V#oYtb4E) zt#Bpa2iAQ)F61Vz(xdBmR`2ng4qM-|KJ;kHXyEuQfrf6z{75}W{EySjf&S5@Sds%9 zs|NmlqB18*GLdIna1j4ssqjN1!|S7<#_)86bfsxrlPWSnXs7h%XWWi=Bsl4vNfN{L z1z0_9fUi zKwKw^{v(`Nmx*ulgAcy7>4(yn3Bt<>3nNGMlpZdF)#16L_L-< z4HvQ;_91SAzyN4dZO)bj$pTZ|Kl!_I-W?rHg|!e-fo8T+13TY zuln=-Rq}dFR~k7%rs?Fm`_7fpn%=_M5A8V^5s3>Z7&vQJsf)P#lTXe`c(Mj#$VktU zo|hVZpXjMxh3{Nw0xG18Dn7A&K$qJZoMiAB%j4P(oCkkNga*BhGP5vSuO2kcL5R-7 zVa@q!K=XA%gH5>ti@xOzdA|ppJV9^H6~#TOK~OXu{tnMI0UEO$3fzFfU5Fg#JmZGJ zcMydbc9?VVhe*5qwjfrhDs-8f;_f3XZgS!o%YRVv9O?us3+q;ifyVYbY7B=wj2el| z@nc)6fR1%)3IkM(?Hmm1$eva9tU3v0k`<=7d_ne4cfdFX^FjWrPYAKM>v0^r6Re|> zVWvx|Rzg@Ud((rk=AkSyCv^)Dn;EQ!K2xU?d_B%vkmW%jv=_$OwWO-7>SjzZNtv)J zrVzCBX7zitAchXB_t~vwObnDM?kqg)Jb)J>F8C1y;Wddd1Px3@x2=+IOZ4;$q=`DM zfcSj}3;x@-n#Lz6k5?ER@Ekwi&H96?&)L5{oWP z*;b_!2YRk^KxKL8hXPB{VAQ1fAI@gN_Liw*DAcmEOZn^2TwM6sCU-C>Y-M*_Y{%us zJpjH>1{g?qK1!{TWQ3JUW61U%VEqIV_|8Y^C)5kw0cxo}I|P4c2o&dr!Uk{zXYa93 zD>!A5c+2Wx5j{5YYCGc#!O3;$Vq%))Rhrp>wrX|k^Zn#c@0JP&GQ43@R}?G+frzl_ zjHqsjgx-R*5Sri;8F;dJ37l$jbZ}HY0n7nlYJVxJhGoc9(HGNaD&c`jCYqe;YblbmcR~!s%0ObFQGVjky=YYn7 z*g@}iJCFiTRRqRQJ(QgHSSpBk(X7;J9eD}R0L^rhWB>@nh*Qjlp|0b!xL@3Tujs3C z2XGz>%3p{|bT4kJNUg{(%2LdPZ1tG3dBDWZ;h!AALRb1<>?Ke4qh@_D48YFI6+LRa zc;W^}EHr@zE4J)N#xfgU%9;#)3rnl!P-%I&8_9KeY~xwo9Nlowu^$&3OgL6Tk@t94 zYm0O7uA^%P16=hB$&T-X0NqQ08kaU=CnITOCM@%stk&C}6g0oSBdRF0HGj1$b`dk2 zXka(U6$IZBgV}B)?g8{uxs&U=`#jRZV_`j-Pc9@%l{+Hc-Og)I-}}pW$FAQGToNv| z!l3{eJ}?sH4zJq=h~gT5u9$8HoRZ+Do;HVHEDoxCK*X4-<18NrU@vd?B_=M(D)dkL zAAY>;$vNv6zwkoL=-G%+7XXl{q~+zE1p``!So>{49iK>N1hBcr6|vg=^(oJb13qBD zLko_i)O|#d7>7iP_X8)gUdW0nDz=&*ICOH-`Rc~Yv*a^ZD5*#AzI-|&RU{L-&h6pN z306z}9avb@nh?Xt;x^J`gtMYJOTKORGw!7E>;OyR9B?~eY6e34iVQl@oRRywdR_y)()YvySaEg_SyIDdXiy|4iP*c9b z%GP*6QP*j8Z#Fhco;H4bY0tZ`vr1qp@%fOTxj5i8Fy@NGBI-j%1w_FT-)(S+c9M9d z3$0x#2t@?@Mjsu)=SlC)u}VQUtCi;|hNxS?eYlv)j7Hk}VTTGS<_ASo(kh3H@j z7L0-AkM@Z_hF!beBSyY{U9amt`Aify_q!D_lMXsBt@arx%c)u=GoRR2*uC_*?O>d! zf15>O$Uj>Y4Jr5In!cL!_aw6CY_|1d?m+V@3qR{s)r#Iq+Hr*0LI$%cWt<=SrP;Da z(uY+_WM8ZgSp3T|i~B^gcodbmMpJNm@iQHa`62e+k`;k|S++YtW@K$zpCz|X>tZNT z5blXZqmw!DPO}Lv(F#fyJ0~>8VRq6~c>-jvqCh8!mk4NK@YN}K9HYVK!bau47XpUw^j7e%uH@($v>hg}aO6np$x)J+q{GO#@H2+}c4awd69=>?0enK9 zUTuA&V%gpz*DVOTR(!<~zQ!>XA`l`7*W9!?u^D>LFSI`HzsA)xq-Iieuk(Ag2lO_~ zVM&{=9}PaTi)0L+aaksk_Y_9Fg}M4z>_e=>t+Qj!GrZn#`w?6c$4Y>&XF<&qJ4sV~ zwZ>eQ#%Nlr%9NulLy!tfzq$|VS6$SNj;tVK5CZ{5T;N;3DnCk8*BVr6%shFrN4Jc= zAgW8j?h%$589gc=Lt%_e=<_NWn*MAR#P-Kc4$*MPg62eWNu|*S8EDrT1!(eaYZ&%QDQMORC;$wNkAuXi!&hNJ&~zb6I#YOjQakJ|J*ub}eu+H8vnxMrUbBcOXGHIWur~QbT%5 zFfd0(FH~zXV{JKMNpw?MV>L~9Z*)pTFjP=ybXIe7Q9%l6Wmi^dL}Y4pNj618Yz7OlU!2b9QWOLrG6^LSkb`L|FCEaO>sz5K}%+Db}MRVRZUlTP;GWbM>q;CJ|J*ub}eu+H8vnMc5P5} zQ6NEQZZ~>*HBwDkF>Z8fXG1|@RzhJ-VOd2pIdyt@LvChpNNI31acg%kb4ChHN^?SI zLvJ=wS2ZhdSZ-ovW;1OsN_uN%cv*KzWoA%PLufQsQF%scbu zMKf1%Xl6)oFjr4xYBG3dP+3A}GgW~?^PbCxS$yu52Md z;Qs93qHh$KP_+M-T=>(ExA_^xfyQfXBcgxgI=rSr2!aMbVsK+B_Ba+e(ujPgAkmTu zj=Q+ttW4q4WDfqMJmJ|kM!=@+he5^txWm(tNOqX*&Pwdr(D{>G=oXGGu7`*R$338S zC}=#mJW}9eOYBX`yyhTc!_P0&gX-9kgX^FmrzR;9VTS+_wP8Fm;I5Nuh7~ zw&p2@S2<7k9@kYP;*? z)&|(u_J~;MqO^&AlCBaXe>36Mj#n-^T1?R^>3%W3Mkypdzhcd4pK%7wSO^ZeRBpc% zMY}o4DNQ*zjFtG6)~~0>m~l9FOJ7`pB(R;*%E^0j%RCvX5Ta;mK{t51mnAcQ?aO_E ztd^=s5iUrEPuDSTI$|Cm0A*GvRmLhnhti?-L_YOP`ikVB8=94XYYe@TL1)*6T?;`rBvi;T=WtMy+--P|MhUp67S^qfSOYKsYIbqjo zq(UsPQK)u8EdR&N5)iuAGvaGQ-5^VeMR1Nrz&eKJ%A6zHJ|6Y`H_Ih6_aq*Vs-p=l-*CpGOv_(J2s8yxL9pDy-h7o? zw=1w7>2orQGqCBc(6laSijJaek4nJ89%z(Ch%y5jwC48)p-HfCJR{(~IaOVpUQ6oYwmBrxdmejnU%47!9S~f1m@-+ue;|Vfb zGwGfmVX{rMuy^I*P*`(0u!PlaE5`)Ne#NIlIS!SL853v^)uOIi|8ccfvWI7o! zflNjCOX{zPHj(D(`>Ne-n67+&{oJ1OfMCOY1Lu)hGHbDI(r?OGS4J^U=3q}u_vLXw$@cznV;Hu!+XwUss{Aj z#?LX_(e%Qxy4zsMfkaiMmKPm6I;LDi2X6}3OM-Jv&^|oew^bBKxD-jv4D)v=Kij>wq z@bU%TqEWLwrxYJdPCrW1}^&jeg5sL8#D+$X{sZp$aNK2<7D;7|FuAHQm(* z{aK;3?|Jr?Faz&Wtb}=Mh<3weGZUa|-%Cy!Ni;e|bNlKURL;7!i zpckh^WG#qUc^^H%UNz-Hz_o%8w+#{I%lZ|PW$w2C?4h`~D$oABOJo6kIt4e<*12?u za9x`~_qGEZEJyvluMA#0`P;x-CLiKRYkE2-E@&0D_&dya;OgB1U^kBigSDJQAy22c zuNQ{)xoGSkX-?I&u_92J?!7xr(I@iIM`?@_>l!OUTA(GpR(?{7f%yR5=4B`A&Qp`e zNr2lid+|&WFV5Cr1>+d*S>j$*B(G}^a_uJy+68L|uKrbk)W94?_iHP3!`9~k#kLAl zN{qaA5rUdL?@tdy4Mpy|F6Yr;4w@!0v!`do+e1IHGsE+=gZW6BnBYFTs|~-fK?dR_ znhQT19e(6re=?Q8)~JodzWuG%PZ%1M%qSa%QfxF=og@NgyA^|vdIJjZ^TchepEJW; zII$R38J|A_@o$0jw+ba=Hik!f7=+TdA7iIERD8&@V^B#JcUPorQ~P?df)%{(t>ZOy z%3uycI0ZIHL=j||+P&t{oa?oZpGH~zg)~1Ufl=rNl0j@PkQ7&znNQ(TqI`l6 z`5oUF3yd5_kvpwh&6}a~D+Mj30Fmr7gJ-8lKE#=cU{QQwBA+7gLm9LnsDScz)c&yD z2W#&~)SamOr`C2ya;>eF7ZV~QhlA)!Raa7rw zmZfgXl45AQ1WwIJ0n9)E6h6k6-m`)J?p#sTj5yD$l1uC-=ROB+jnzcE5xIq@*7%(u zwb?tj$n3ijLbEs&!r4+cQ@|sc+l4969WtfHG!MS4|Hlb_=5^HX?0AGSQu_Cxbv0E| zCFOeHmdnAadKVMGD$gUnTmhHCu;53Erlb5iHyJc{U|an#k96*;a%x_VwIB~V?H|&K z>|)J<&>*0IldgC=ldb;|Zqy0=4c$HApu;I>{<^EJ`b&2!LLbyVFig11Eaho%VMMo- zPW2yK#nI$q*H&-!K}EA{v~u=1m7F)4k?4v_BW`=WFh{3SY2{m#Q5t_G^JLw$1ApBm zBFHtbqI27gXfF=@)=Y9f8GG~MjzT3^#5|K)2P;QJEkf(bz-8AMDD*8YkaaKLZvxRN zOJNI;cgTbRhK~KBITex&blG3~dC(gL2}=B(6MhV-45{<9|DL&U}kS z%e~uj+niK9Kgt7vLGHAOXUXJm%KEonTj+foDU!reE-&kWVT_o!N_tupIBX5nORe=< zX&|l84Tf^OFF|!~r-<-HEqJJbktaG(7z@jDK5#6Kx139M;LP5CY{mI~Ae9{y6WID+ z_X`8JFcK6%Vd$ENwz@JaH`fI@SqZ0Uvz$@rS<}vO8o8ZfFmp{CjmJjwDs_TmG#9-b zbxHmvig&v{6=k08>giV{f5W)EH~iv+bJo}8yGK7ots7M`A7~Lz33}^n|E*y+?5Sxq z|95T~f4-^GN6~NB_*g~3AeEGc0Sy7vd$>>WH{nf%SqBy-o=aH^7*(Gb-PtiUw^|ZD z#i%2Ls>05JXCpn(hF=u0>|p1<9(Eti;7vdT4m+jfBzI>^UaAiZ93OcIthe-mGAc9! zK}{o_#JO^olj9Ja(@biqeY25B&HcAsGxe`r_(mVDH(dsiD1};-?1+j@KIN)e*$Zq( zmT>XnBXgW@89|`NQBlG$uw)@ROcc;}Z~InLT)5vIy?lJ5^amwSm+`f_ZT3abhDXao zNJQATXOjQtG1~)2xE~=E_^ZVh51LmNzA{K1P!yU22dc$76)nS7lEz^VW()409KMN< zj6(866I6)Z)<9Tdnji|w6vwMJ-TM3<4|_GQQBUBDWoP4B;l>E*KvfS`^2*K22c35|@+tk!By$>zqcf4T zBi3iNj_w?G_LF))KukQn%3yk{Xe>6CUtoIB(D>g6;jcR?DfJD!xr&fg1JxK zXd$n|PWi&v%R1G&N>N-4xz6t+SD4mkLpU@PUu^v(TnsTW;<|i3s=fCMhOcBr@br+U3ZivMk8g)GD#z0@d=5L}A%O(!Jrm#;CkZel zFHX4T;F|0eVyYTl65E1hyksi%ZCJ_a0~Ai3G5$Vl%?PigzDEH;o|i1*IgI(N%@i7; zv?y};9E7QpxxN(K*+z=?h+>~UUDcd~MuWx!#yhK=VBx;?Yfs6i^$(8*fn8vJD>zi@ zF6Xf#Hov5haR^cZWI6VQvAs8KlzfJ#B_5Ox6mJe`SUo=2FI5;;e+4^`yQB~~7V*p1mW_S3>U zm}q+mzk}OZk_SVD+lQL`X=sN`QzcDl8xd8mPU;G~v99%d@H`tKiV=H#oiGb;xbv*l z$Y6^RjgdHXV`~kmR*3rs2>Jy)3a&o{YuiZxZ&$7l;-|;r7+XmXzxLIyutxLM?Z==L zarC`GMZxD}n#}_^#9T9gL@GWTUX9XtNr(0{{>BRAPf4NBqTETjUCY4r#`WT7wz1JH zhP%SfV^CTHT+T!4kXjF;tHmu_suwMD|KJB58ajV6iw>O@?0V82T>K4fAder%QcX6Q z02)M&>pK=nA>!$$vmyffR$s;JcGguL&taNDzB6U9RoZZEzKaW644myyjJvdNElUlA zf{LHu-r_q3$9Cy!nM9(oXIO1K-tL`VoK?YBzu0+-&pm&2s!`c3JNQV{m7c-!zFXs^W~(^pgR+GnJ{Qqd)tLiuMhl?)-bzv5kY_FUwYmQC1zu6q2WAx zd4k}UvSJ)dKpCa&3sg>-nzcc^$KaT`K(lalI%98%QFhLjx*YLegGE9^w(ico4_2-( z-NEluGNt^007bGlh!?WO8Sbg|V(J?ufy zDiPqgjZkbdEx-cRt!c1f#PX}qTuBDvnuZx*&cnRp(cu*4AJ!P ziL!A9kLO0Y-0HGLVxj8w$)4n|cIU4e4+n7lG+TsK_F46TyS3CGgz}of@4+*}j1%x< zrVcVl*Hs!r;a?zS2;>nHBOHlT+Ri=Lt`o&Tw-~$}6s0My%DBMGTwU#Lh&l=qokw>w z=q#d(E;H08Swr0lFHeLPztWt!ExlN-5?I_(-E(N)cyaGS3D5!r1f)g79a4qC4T3j9 z3Yt)s%{<)kK|vGm&MR~d}7nibsur$5fBmF_Sjj&h0E zdt5Q$4vSUwZ0>Y@p|CnY=lcsBaSiFLIEY&!bkV37JX{fxbe2>$1BJ?@hR1Aqd2`|4 zs8;AW9bifelLh_%qvbI%hbRyv+l2*8&mHsHCL|kWCYg@^>vL?I?~&$@8-@zZZ;o1p^b$ zDRmj|hM07em-H*5loSeQ+W}FR_0D{JnC{FGCK3`MyWC3 zi2AbH#{Ber_UX7cgVKST0~x=O6nHnl_f+yVQ}rT@pv6tuy8I!sTsqOb5aPRWag#l| zNMXi!x;~*Gp?iqn$oO<1!9X{%jV;`Ft#JZHCCSUZ9y+cI>vzf2vL8M?ijnB&iSmhG z%!QQ0&*1^X?)zDO!-;>%{9tKMS6cc%IjrvJfg&@GRo?BR0X?N!mSdT<`$wc6rwt4= z|4jL(F4=`1ZLwCcLX@B7=|U6b3arp$of&0eK0!;Da$-imAZYs+Zp}OV>IFcFK{Jbc!#3dcQa&O*%Sb_S=ht z(jetf#S279U0(%;xn}d|YmHw8olCD#?XBsmJHEyAFV+3edY8+4P6W1KQtsG^J6%*O zyhX7E<84qnlf)a3W&-zgo~F4ZR^g*7Da(E z*^ro?J`=;r@Rd&_go3v2GORWpo7!Zq$xhiBboBy;zB>KCfw|t(IVCm zuFso61sg(vpmrJyUyGdsFgkN>1+Ml^pe>Yz7WvcZm8^;mNXI$6(hh)_Jz&iswv%f%W45TUU?8tsk9jYS16` z4+=!zc%f( zWmG@DuQGRyMB|TldLv3ef-4?q1|moM*Fdc`O`pj&=8V42yPK+R#xi#6aqwK1@pgwn z2~!w1CN!?nhhA(U(v;T2W}wTf-oD-C>r2<5L27yxnp$z(SJyBS^fYb15%BH*)nVSH zrugX#r}cMu^x(YB#^fFP(+s(5M9JZ(US1OG6{0nY8qUT@(A-}V?OJ)8c&pC3x;#^O zi~Of*#OEfND1N7R?+YO!1h56CG=N755tJvlQv~A~S0mT>zSfP^FxT->CBjg&ojuRD zs`b{hb?86(5nEWI&Ma+j8{Ot1D0C*-+hOsj(ST#y%vF3z9v%MFX51LzfdkE9{#k)EWmt8ib#2F z5`P>NeBl^!v`74XX5#&eX+)6TaMCqivUt=&VrH{vm%NlVs8x0Je(dF1f+tRdqzuC( z3vUrGPJq;0L2CCfu89S6jsZWix#5OI|BXX51422A%l7N91K6~r1cJJ>2BGM z1BI$f#lTwDo=X=}%*#_$LihQzxY51}dQQU>DE~zT28f|v_3PqOJ(S-2mxbZOpi7Kh z8cL&v7QM6VdAzmNK<_54!hL{fOwO%oe|nb{FNco`LquU4e%9-Pa&i+Zi)Q2OC`wlsH1_EjS|3dAXFM{4KIT zwn1_6={8MXOW_k$S4b2X`1t5}JMg^}vo6SS@ho)ag|#0c$}1_YX$B;7fR^R0{5?8E zrv&uI&-e@Ds>rIabrD)WK=5k)0qB*U*cv$@SZU4r`J#gc3CYXXn0ziTVDw|mHM(h%aS_dq-HA&7NqrT*iU^Bd5F--6m&Abv{X`YP9jX{`=QmE z*RW<`nB4sjBIOD~x3t%uPff{BhJ7hLmWqgUy{Meo^gmy0c6x3$RJ|Z9h`FoM2191; zD4wDh;Fx6#!~%dJ_i0#p;}@q7CPbr(7q9Y6wjY80Vmi1|sCO_Zz^W88v?#d3m