From 98e22fb96a16dcc182cd0bc0f940293d36d9fa41 Mon Sep 17 00:00:00 2001 From: Patrick Date: Sun, 1 Sep 2024 19:51:52 +0200 Subject: [PATCH] feat: signald is broken use signal-cli --- config/basic/users.nix | 3 +- config/services/blog.nix | 20 ++++-- config/services/homebox.nix | 1 - hosts/elisabeth/guests.nix | 4 +- modules/homebox.nix | 94 ------------------------ pkgs/default.nix | 1 - pkgs/homebox.nix | 139 ------------------------------------ secrets/secrets.nix.age | Bin 5903 -> 5958 bytes 8 files changed, 17 insertions(+), 245 deletions(-) delete mode 100644 modules/homebox.nix delete mode 100644 pkgs/homebox.nix diff --git a/config/basic/users.nix b/config/basic/users.nix index ab5a2f3..dd67e2f 100644 --- a/config/basic/users.nix +++ b/config/basic/users.nix @@ -36,6 +36,8 @@ oauth2-proxy = uidGid 224; influxdb2 = uidGid 225; firefly-iii = uidGid 226; + homebox = uidGid 227; + signal = uidGid 228; paperless = uidGid 315; systemd-oom = uidGid 300; systemd-coredump = uidGid 301; @@ -48,6 +50,5 @@ printer = uidGid 2005; pr-tracker = uidGid 2006; blog = uidGid 2007; - signald = uidGid 2008; }; } diff --git a/config/services/blog.nix b/config/services/blog.nix index 8514e0b..6bdc7aa 100644 --- a/config/services/blog.nix +++ b/config/services/blog.nix @@ -18,6 +18,10 @@ in client.via = "elisabeth"; firewallRuleForNode.elisabeth.allowedTCPPorts = [ 80 ]; }; + environment.systemPackages = [ + pkgs.signal-cli + pkgs.cargo + ]; services.nginx = { enable = true; user = "blog"; @@ -36,9 +40,9 @@ in mode = "0700"; } { - directory = "/var/lib/signald"; - user = "signald"; - group = "signald"; + directory = "/var/lib/signal"; + user = "signal"; + group = "signal"; mode = "0700"; } ]; @@ -49,6 +53,12 @@ in OnUnitActiveSec = "1m"; }; }; + users.groups.signal = { }; + users.users.signal = { + isSystemUser = true; + group = "signal"; + home = "/var/lib/signal"; + }; users.groups.blog = { }; users.users.blog = { isSystemUser = true; @@ -77,8 +87,4 @@ in }; }; - services.signald = { - enable = true; - group = "blog"; - }; } diff --git a/config/services/homebox.nix b/config/services/homebox.nix index bf1eb2d..488b7b3 100644 --- a/config/services/homebox.nix +++ b/config/services/homebox.nix @@ -1,5 +1,4 @@ { - imports = [ ../../modules/homebox.nix ]; wireguard.elisabeth = { client.via = "elisabeth"; firewallRuleForNode.elisabeth.allowedTCPPorts = [ 3000 ]; diff --git a/hosts/elisabeth/guests.nix b/hosts/elisabeth/guests.nix index 8a8160c..e90756f 100644 --- a/hosts/elisabeth/guests.nix +++ b/hosts/elisabeth/guests.nix @@ -185,7 +185,7 @@ in (proxyProtect "invidious" { } true) (blockOf "yourspotify" { port = 80; }) (blockOf "blog" { port = 80; }) - #(blockOf "homebox" {}) + (blockOf "homebox" { }) (blockOf "pr-tracker" { }) { virtualHosts.${domainOf "pr-tracker"} = { @@ -312,7 +312,7 @@ in // mkContainer "ddclient" { } // mkContainer "ollama" { } // mkContainer "murmur" { } - #// mkContainer "homebox" {} + // mkContainer "homebox" { } // mkContainer "pr-tracker" { } // mkContainer "invidious" { } // mkContainer "ttrss" { } diff --git a/modules/homebox.nix b/modules/homebox.nix deleted file mode 100644 index ec2804e..0000000 --- a/modules/homebox.nix +++ /dev/null @@ -1,94 +0,0 @@ -{ - lib, - config, - pkgs, - ... -}: -let - cfg = config.services.homebox; - inherit (lib) - mkEnableOption - mkPackageOption - mkDefault - types - mkIf - ; -in -{ - options.services.homebox = { - enable = mkEnableOption "homebox"; - package = mkPackageOption pkgs "homebox" { }; - settings = lib.mkOption { - type = types.attrsOf types.str; - defaultText = '' - HBOX_STORAGE_DATA = "/var/lib/homebox/data"; - HBOX_STORAGE_SQLITE_URL = "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1"; - HBOX_OPTIONS_ALLOW_REGISTRATION = "false"; - HBOX_MODE = "production"; - ''; - description = '' - The homebox configuration as Environment variables. For definitions and available options see the upstream documentation at: - [docs](https://hay-kot.github.io/homebox/quick-start/#env-variables-configuration). - ''; - }; - }; - config = mkIf cfg.enable { - services.homebox.settings = { - HBOX_STORAGE_DATA = mkDefault "/var/lib/homebox/data"; - HBOX_STORAGE_SQLITE_URL = mkDefault "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1"; - HBOX_OPTIONS_ALLOW_REGISTRATION = mkDefault "false"; - HBOX_MODE = mkDefault "production"; - }; - systemd.services.homebox = { - after = [ "network.target" ]; - environment = cfg.settings; - serviceConfig = { - User = "homebox"; - Group = "homebox"; - ExecStart = lib.getExe cfg.package; - DynamicUser = true; - StateDirectory = "homebox"; - WorkingDirectory = "/var/lib/homebox"; - LimitNOFILE = "1048576"; - PrivateTmp = true; - PrivateDevices = true; - StateDirectoryMode = "0700"; - Restart = "always"; - - # Hardening - CapabilityBoundingSet = ""; - LockPersonality = true; - MemoryDenyWriteExecute = true; - PrivateUsers = true; - ProtectClock = true; - ProtectControlGroups = true; - ProtectHome = true; - ProtectHostname = true; - ProtectKernelLogs = true; - ProtectKernelModules = true; - ProtectKernelTunables = true; - ProtectProc = "invisible"; - ProcSubset = "pid"; - ProtectSystem = "strict"; - RestrictAddressFamilies = [ - "AF_INET" - "AF_INET6" - "AF_NETLINK" - ]; - RestrictNamespaces = true; - RestrictRealtime = true; - SystemCallArchitectures = "native"; - SystemCallFilter = [ - "@system-service" - "@pkey" - ]; - RestrictSUIDSGID = true; - PrivateMounts = true; - # System Call Filtering - UMask = "0077"; - }; - wantedBy = [ "multi-user.target" ]; - }; - }; - meta.maintainers = with lib.maintainers; [ patrickdag ]; -} diff --git a/pkgs/default.nix b/pkgs/default.nix index 3fe047f..b3fd76d 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -5,7 +5,6 @@ _inputs: [ zsh-histdb = prev.callPackage ./zsh-histdb.nix { }; actual = prev.callPackage ./actual.nix { }; pr-tracker = prev.callPackage ./pr-tracker.nix { }; - homebox = prev.callPackage ./homebox.nix { }; deploy = prev.callPackage ./deploy.nix { }; minion = prev.callPackage ./minion.nix { }; mongodb-bin = prev.callPackage ./mongodb-bin.nix { }; diff --git a/pkgs/homebox.nix b/pkgs/homebox.nix deleted file mode 100644 index 5c7e06b..0000000 --- a/pkgs/homebox.nix +++ /dev/null @@ -1,139 +0,0 @@ -{ - stdenvNoCC, - jq, - moreutils, - nodePackages, - cacert, - lib, - buildGoModule, - fetchFromGitHub, -}: -let - pname = "homebox"; - version = "0.10.3"; - src = "${fetchFromGitHub { - owner = "hay-kot"; - repo = "homebox"; - rev = "v${version}"; - hash = "sha256-Hej/dM0BgtRWiMOpp/SDVr3H1IbYb935T1pfX8apjpE="; - # Inspired by: https://github.com/NixOS/nixpkgs/blob/f2d7a289c5a5ece8521dd082b81ac7e4a57c2c5c/pkgs/applications/graphics/pdfcpu/default.nix#L20-L32 - # The intention here is to write the information into files in the `src`'s - # `$out`, and use them later in other phases (in this case `preBuild`). - # In order to keep determinism, we also delete the `.git` directory - # afterwards, imitating the default behavior of `leaveDotGit = false`. - # More info about git log format can be found at `git-log(1)` manpage. - leaveDotGit = true; - postFetch = '' - cd "$out" - git log -1 --pretty=%H > "backend/COMMIT" - git log -1 --pretty=%cd --date=format:'%Y-%m-%dT%H:%M:%SZ' > "backend/SOURCE_DATE" - rm -rf ".git" - ''; - }}"; - - frontend = stdenvNoCC.mkDerivation { - pname = "${pname}-frontend"; - inherit version; - - src = "${src}/frontend"; - - preBuild = '' - export HOME=$(mktemp -d) - export STORE_PATH=$(mktemp -d) - - pnpm config set store-dir "${pnpm-deps}" - pnpm install --offline --frozen-lockfile --shamefully-hoist - patchShebangs node_modules/{*,.*} - ''; - - buildPhase = '' - runHook preBuild - - pnpm build - - runHook postBuild - ''; - env.NUXT_TELEMETRY_DISABLED = 1; - - nativeBuildInputs = [ - nodePackages.pnpm - #breakpointHook - ]; - installPhase = '' - runHook preInstall - - mkdir -p $out - cp -r .output/public/* $out/ - - runHook postInstall - ''; - }; - pnpm-deps = stdenvNoCC.mkDerivation { - pname = "${pname}-pnpm-deps"; - inherit version; - src = "${src}/frontend"; - - nativeBuildInputs = [ - jq - moreutils - nodePackages.pnpm - cacert - ]; - - installPhase = '' - export HOME=$(mktemp -d) - pnpm config set store-dir $out - # This version of the package has different versions of esbuild as a dependency. - # You can use the command below to get esbuild binaries for a specific platform and calculate hashes for that platforms. (linux, darwin for os, and x86, arm64, ia32 for cpu) - # cat package.json | jq '.pnpm.supportedArchitectures += { "os": ["linux"], "cpu": ["arm64"] }' | sponge package.json - pnpm install --frozen-lockfile --ignore-script - - # Remove timestamp and sort the json files. - rm -rf $out/v3/tmp - for f in $(find $out -name "*.json"); do - sed -i -E -e 's/"checkedAt":[0-9]+,//g' $f - jq --sort-keys . $f | sponge $f - done - ''; - - dontBuild = true; - dontFixup = true; - outputHashMode = "recursive"; - outputHash = "sha256-BVZSdc8e6v+paMzMYazEdnKSNw+OnCpjSzGSEKxVl24="; - }; -in -buildGoModule { - inherit pname version; - src = "${src}/backend"; - - vendorHash = "sha256-TtFz+dDpoMs3PAQjiYQm1+Q6prn4Hiaf7xqWt41oY7w="; - - CGO_ENABLED = 0; - GOOS = "linux"; - doCheck = false; - - # options used by upstream: - # https://github.com/simulot/immich-go/blob/0.13.2/.goreleaser.yaml - ldflags = [ - "-s" - "-w" - "-extldflags=-static" - "-X main.version=${version}" - ]; - - preBuild = '' - ldflags+=" -X main.commit=$(cat COMMIT)" - ldflags+=" -X main.date=$(cat SOURCE_DATE)" - mkdir -p ./app/api/static/public - cp -r ${frontend}/* ./app/api/static/public - ''; - - meta = with lib; { - mainProgram = "api"; - homepage = "https://hay-kot.github.io/homebox/"; - maintainers = with maintainers; [ patrickdag ]; - license = licenses.agpl3Only; - description = "A inventory and organization system built for the Home User"; - platforms = platforms.all; - }; -} diff --git a/secrets/secrets.nix.age b/secrets/secrets.nix.age index 2837910cd053f8c1edc77dfd304af34c95e32d44..77e20035fa1736aa232e8663c59c2bf8afb42ede 100644 GIT binary patch delta 5946 zcmV-A7scq0F2*j9AXhO(ICpJoN>)-iR!K%QZEkBgT4r`la8Y?rGgUQGaBEdaNOWm& zcQaB}Gzw@}M|nYcP-}Q*OhIN$Q(|jJZ8dLGL3w&IWJxbgaCbLZWKL^ZHbFTzYm-j_ z6@PM9R%&)xXialTR&6+QM|M+EdPXZUSwwC(Z#a1|T4ZNVdU$s>dNosVYzksnQdD76 zRBSYBYDp_ta6(u{NMbNkS4&!CF?mNyVR=DvO>;SHad}BLYYHtsAaH4REpRe5HXvA3 zQEOE}AVD)PG<7sKQB7JwcY1VoN>N2oNkmmuW=?rYGiO0XFELq9Y;aR~Su0^hZ7&LF zHD_%$MOZjFcSQFK&xF-kFGL@PsY zad~TPcX@SaGE+-XQ7|%SHe+U2PIxy-D`rVDaYYI(J|J*ub}eu+H8vnMc5P5}Q6NEU za%n|HP%MG)i(WS5HYwYd1+^Y;SFIVOBv3Ej}PSesgO*JS}H(Wnpt= zAazPgd^<`mO&}x+V=*{MV>MY?c}z2NbvaEhWLZjhM`=qjPclhnOE7kkY;7+$W=je$W>Q%SEiEk|Y-(>+ zF?dr#cXBvVVO3UdYeIiTc~5mOZ#6eqc2Hz`S1&MEd1PcuQ!z_X3N+e(!cK3PV1j4T z**gue%Mr1}eCx-IeAhM!+`IL)&`v5LIhxJNDiE)@S<2K+rbijg&G>|)c@Lx? z)!HQoZwj%H$YobW2%p8>DOtzW!>onReT#dCogW$OhIoXr_N;#;ZE79Bp~5lEmKiF> z(Zeo%+kgUHx~k67^4&suu`Otd!BV;Q5H_C6|Kju?+~X;ioJGFFvh}z{;;fZ^06)8O z&pe(xp139i5EVLdaFOr+>FH8KZd_1>?wqS~oATv7i&CXL(Anj9O1G0qmcIYvS3lKY z?s{UcS{@qWX-9t-$%b~e-v*!5$#uKm&%S0{Nl8=QSIS-c15&e|;Rz32%aS%IQbNH$0RP2MKJT(CBm($TZFDMZ~Q1yTR14=;RDx~IJC*}_-PMvtQ z8$O^!mkHaEK~Rk^wdz-i@7iOzfmub>C!YdJ#x8C#1DP(M(x6$Ta$mpR|5{&uVLWk3) z;mOsGuepS3l>a5%OK|lVBR921#S<+}Mc79Y6BcHSoJQpgN{V)0?AT2Zv{Bg?Ho9%$%khY;u0U_>mA7Dq5P^I`5o= zYxirF*&p>k?==Eey!LCasJgWg1~wRyrr8lAug4Zn?r1YTIODieBoa?0lj~67RO0u0 z$cul>*HFF&(w)fpr@X^T+4#ZiMhSs*D~+X~OV%n)y_5iJ3jfRmGEHaz<5hnw&+glM zU>Z*vUw6PTjN8i-$nU|^cJZ>DK_zbcSlzrju$(Xs-@x-|{w^d*t3?AHl zvm2i%FCYYr2SrD=6_u;U!;2%z`5XLLEFphpC{4w3kx>aT#z?6~IE4wX*Af>pDqpcP zqZ99sU`VRLZys8#w2rfs+WFHd^(5K2(*o{89(AiUSX3o7;Hvp3ed%C!<}SC-ahnnx zrP^nWcnEQckQe}AE5`h5P`NhEI@m*ktHN2yV!I~bs|y@9MKk9bt^Nd|{WO2= zHaPFM2Jo<-^hfboR<>T0qcG;vK06>-bLc~^Em2`h7Ay``V3Y<`)F3LMT2SJuQ2t2y z+15xvKoN+%(&tK9dQsJv`6kJ)9k=OWw{xW!Al`8rQtJZ&eF3#q*R&eX6a483x?ik9 zj%fw?&duK)%v#KWo|1pVO%-$GgPDI*MWp6zzCyTt78~5%kxZ!90#_TE{yRvPQ{NTB zP_)gDLSs8RYC=_eW>`7Os~&Ax3LP=k(wFXq-`#vt_{CJk4U|LbD!vf6MQc` zeEWYVt-4EOPWng3+|*NxfYd;&7);++BjvGdoVB&qk`J>ycS7>w(ru59=na zR3QKB&dc)@!XXyR)dCsG8K@fjQPS)Ay41&N*skXGgLH`@n)~XQmsS|?g&~&VjR||v zxYRL7_?GG|n&Aw0!e$JxBrZ0nEAlji$Jh+_{CZWYeXma3XYD%g0RqISu}HWttbz>x=c7W zxz!CW`PL2-0QWA`+LG9Uc`fswc{o>GFon;TS0xhhq{mGMe_iLY0W*2;-xu5ZGwE)z zNLqexzuenp*VNDni6Vb)G=rKA?3ldWqn|;_e*s+u1*1?x2$f8-+W2v63 z)7USy7(Wq^c@WHW%~t6SZ#o6RkZR6FVdt~>bFo|Tj; z76jb<{bHGF3if|+(gku{tugqL3o(ptnZsP&DjFn#aW>?=X#Jo*Q6yo`VC%V!5217A zqV2S4iE$a%gk3i%{^N z+Uzz6=yQLOhL5TAdYgFn&rbz0{{EVY1X$!sNIh}qA}yk=f-vIeKpZ@YG_S1K;sWC{ z1h0J$=L$QZ38OPOyDwLS|C;xv`C-18~3sDP~(~s` zYAb(0KP&;|K9<=}eKz60=Nh1Mbc-A)!3O{=y~pMXEWiRCMMDMcLJZ-SKMQMiw3~Xa ztmGf`buemP%}-!e7V#vs@v{NhMpx;s$paB71;?dPNV6mS6fk3CR>4)8NNR z$2J+P9*8OHQ$|NCk?gxd!PiI1PcXbzbd3!S|0+6F^#0Sm(y2Qg!l{g<2(A0Q5n)Hr zP~2m7!i|n?Ud)JWyHb>UTWvBxj8w2{BGTgrjpE+}K;zjTeYi^>8ik`{bnLCR^mR9H z5(K{Z%lqFOfBRPaX*J2)948ID)kA+;7uY?!H15y+_uD(bhaDZE(og04!8)X674srh z!+M?soLgA?@3Pn2T_}1d=C}Zo@l=`m=E2BKxdB)&a+tgEYdiaH1aZ%7Ct{Oy%555O z2m8cG`cM4Ih$p9EhxdTgcWz3+H|)~efo)Y2S)|-sXP&&ozMS(KEaq2(6zzZaX04b; z(jyyF3vT0d@-%}oGd_1*7DAvHOb1Tg1j#XP-8&IyRcj&^a4gH@xCFZ-CTBn=jMIX_ z8Lax-vcS6Qph@lhOzh#x0PMF3+z6vve*1QSv6hA7*Q~~-+f>V zBhq@M_cHSyL_tbFKO)#p%`SfsYt#@5+v8j0o_g-Ch9?0fdf@%#A^9K{u1J&ol=@`> zQw|xg)Eg11#oq7oF+-#*TLzA;x#B{9=qT%v?iz~esBKj@3sopH8S5uM&ie%?{l7k6 zbm&NYVq?2baQPEiO{%KrnFthP^WrxVjs+0nLEKxlX8S28p{Pl75xp)0@# z=Iy6Sh+9A;I$vez`dvR25ZC`25G zX0>sAq|BO6AF$%-UqC21;{aMU6G|Idfb zt6~I1&B+@K&k6m4_nr$5eYBp)zHPdJEM~h~n&Z$f9d#-Tf(tXVuG7ferK5)P8`7G3 zI}@_AhsdK>U+;ehJQe&Sbs%>034!G`XVN#}kxixETCZX!wS^$+1TnyJ+%$g0Re!zSC1lUf|9q9PmTw!vypOrdS` z%7@hfoC)&dG@Qe)N{|hHn*Y6y6&HU7XhTOMN2|a_etwLZbW(sx z(AE!<+638hFVder?vVmy`$$+ABx5%M(a?@_s9(C>klMuSIFFUGSB6IKWmL_%OgLu& z6n4K4nCh$7N^!-@^eFc)z*J$wtJr#V%p|exvL57f>b!a^`tKyMKM{-ikTl=7rJ&Y$ zqKo(bmRofe42k%9Rg z-<7@!55r(Lrh8J{=<}g#2-N^4O=F%3att{VGOBg5F2_@-laupi>znA*?pwG>$z-y? z^Bk`%9>uj#`2|7^KGg~}aeH>3dHn&wiC3R{+0La^7)Zj_Cn(|BLC9DL;#*_a5j*IgIg!Z@kwL zJNopKWDd0%7uI6>+alHP+M2v8I&od`EU$mVN4$r{?zMMBO4}39OPVzWS~^_=zMg6a zv|5*u27UV!==LkOWfR!3$|F)nh~}~Z=y!U7CiVr#K*{;FQah3a8+6Wb+C+CsLqPn5 zYNN`}s*)+GfJ0<+$|PLg;c4no&iREdAx zY_OIEJ%>d9lWQ}xAgy1G5s4aL!k6#SE_z3B5w8O-K79$_2?1JCKLINI7pfDX^y_Te zK!|w(0PyI|RLocpKoFIkv>i zQj(<*oAfCT zluI{M71ZkJTFg#tK?fc6IHHqjc8Ap5E#w_>wUM%{{VE_1uK#vZ>N^`S*r@k$LZe|k zG7`WM=g=j@Pnp!e*IE-%G#SONk8I1WKn0(}K7B>46ie^xI$s?r*@IHIY^(yW?vfg! zYU4le26y4=-QZhbVK;xIwabt7{_5#(3)NDp&P+WpVuq*cvv;9(178iR_d zs8}O=YDI;3ooC*&4fsrFy}wGVzR_ewyiuxtC^Xz=z?)UrV1R#*bq)H03tQcFT6GpM z@&tU5V}FVKd|u!wefZS>_85) zMC@#e)7K8Uk#`en?NWG2B;g>>ed3zCj>JQs9J1~OrDFtuGpsS5_0N`)>c&{28O?2ZIni@hTfVCZ2$lO delta 5890 zcmV+d7yanQE{`sdAXhj!PQFd)jLo07?Y(y|IRYh?$MlWbuF;FX2G)+TBPf1Q{ zQ%z7aSqeyFW=uC(T5fH3acoy@QhGCKN=tWlNlH#Qb2Cm^N^4GWHbiV|LS<4nO_NUn z6@PM2PIhK#RzYbnPisVRL1Q&SFKR0*Nn&PhN-ug?a79*SNp4PdICNq*V+w9^G*e?l zXizzKcSJ=rY-mA8Yjj0uRWfpCaX58&NH}tENJ~gpLQ+LBZwf6wAaH4REpRe5HXvA3 zQEOE}AVFwIaB6u|N=tcdSWiY$D@$oISVT`TZFy%P-t&QGE53b zd2TaKL@;eqGgCKsG-yI&W=D8uZFNg`L0V&ZYcerfmJFIF*gN=9x>dQwAhYfeOCY;a|AcTZ~yNq9v!bTw@^ zP-JFyLsLjhXI4mgH#cH*GgfOiQ!+(ZQ(8oFMPz7iM0!aIEj}PAaWFM8NNg=G-7N_QFtpdmK(yX5r;aobiUbvDKzDKF|3ARna=SFr=Tq z4fQ{$UZLnR+HK`}74r@J@K&u~IFfplX?-UwsAgFadl*s=&sij5i6QxQZEFFt@rAHf zQsZ{XvuY?B_@rrqh$!2GR32pwIi7LTaOPO}a9R!3D^*;nVi)AG?z0LHXR(`&@0!g& zm@YKr5*k?$Loa`MU$So^#q}hsCS=Zv?r+d1XE+(b$`X46**F z0jAU(SEOtcUT6Z$@@nU{J;So}S+-<4AGwlrs8IyD- zXX#qi-9MrE*iXC#8Ul%2L==KM>YI}+091j_h@1R38D)^yNnBE{vA|{`c}3dVr6ep< zVrS?>M+<*kWe^M0g$$1I6$2grAWJZct3;KBBW6|bAl5x1Utu3}3zHzzyK%b>B~P#f z6!OPnE5DveW6Yx9THO^UL7|& znjS$@?X=D6duk;tQl?N_4q**&YJQuJ`}BV-u6rfxhdm$``~wLC4i}|bu@0*+EMd9} zJZE{{RRyCPMb2EgJ3i8IwrNs2z4#d%WI(aQMO^Oy$=nL^F&v%JD-9d@+n72qdC5Y6 zUSC)}7c&Ugz#umPmUcENr;%+;pQ66F7{5^50W6Q9>`GDI=>XNeNhgJ{ii=ixn$v$r zuX%k1>-pWBJC5XEx~-EYV`Lud%2hS(_tAmTJwrxA^8dqng+ISP>_*2M{$W)Fe{YQe zBDMocRmZj=fF=G3*RadyEqnj5ktG59fwan$Et{s7(c1?O;roJih^f0NxBy-v>guu~ zKPGk_&8aP={*%_#M@f8?_-^p3BVvD3+^3I1c5pRhxN^wxzvsJg3uG}7G7wCmH)QI9 z8fh8`Q~9GQwnct&3OCX2kg`dYDs#_$YTTXqqQK+bz(~{%=}}6(Vvy#J`-M9PDs@$| zAb=T;A3TnLny+}tN3Sy-G$~Q$`TMX^@3$zP-mS6GnnRL*R=Xz)#r!Ar0MCCPw_25I zS2HWvU}Gn7Wpudxh+;=#F$Su16R0MhYw-$c_rdW}sCV5IQYNPNFJoI`p5wl;uy&gFESA|+KZ0?4t z6Mnaa?�j6+6ZuR}wM>EZ1b~$%P)4qvum)WGuhtyR*9U2OSyA@)hkC*I9Xpnc@4I zg05&GOkTW)l<A6MA?6bmJjJ`-*o$y6? z=htJJmV+0Rs~kgHT=j6$PM6huflWaeAM;D@w8R40;iHAq-F5OLKI7PRrlT`(XLL|} zHP=IIQ0Pr?udc(sT)2NciujHx)hUT?q%}i!H(F4hn=`;iNlt0s9+F6yd-bj5pDP+q z60N7^piE|kyIaxG>#OIK_M^>zCoA!5=VrwrDZY`|=VVgdIbE>|T}1_cLTB6VzN@NF z{`yuYs-ff#hjx^@w3MHhPfEz_Th=FG57Cb_*%sHsO<)jABU%p6)a$v(f|u!rYOnr z`&d5TwumLj1c_Bwj;VPAReW=~jKOQCNcbG#0exWJ@QitX_6MPC^JJ-nRzy+p+CP($ z1SOYuzTA|vH^6_nqKm<4&?{_s!v^Mu2(Zyu(UVe?rz=6(czf|5U}FZ$B|zNx6{vTl z1bll}8FXDxli0)a5Lt6-5nkWp$GAZC>0d8eR@F3q;hR5K90s^Junx59)wpMhk5T%7 zboM7LQiO&d)=d2+hRf9P=36E2kZ8xz~U5ft{Bcwi)@xu_EwDraQm8 zDxjNkNCvR{=?uDLA1EEqNFKc+1`e{AgYhJMz$9s5{x4(~UqsdAa$WLzT!2RCce>*s z;Bn)LuVahxAdANMafKyzdLG}}xP571nx-nTxkzGKfh~O<#yXRU7LD2O)IvPjguoMj z9uG8=VwisfO=hg_g>L;8zjpx9$lz=?I4-J*QUJldBR_eW(JVGjWZ*bP1$~#X8~ZWp z@BsH=pmme#Sj*B$#M!2x;P~#qRoOn|!PlqQ@c{bMZXX7*^c}EXK7E;J@76XvUkm<# z?B!_{fLg3EE!CnH-npRoE$}&Zp4qlIEcJnGsxg0EC-;#;6L)MD+swc-ffoD9T$_VBA8K?Jj3qt0jT2W__U0oGsd+9|f_oZ1accMt4P|zTC zL3&R@c~Tu~5Y||`sb2U(&m>$5O+P5QX6&j4m5Sh=@YWo_zPxmXYbx`hrGQ1q%ejBQ z;*(#%i^OyoPu4rllm(88hBXRRdrUDzC z4fT)Gl3+qRR(nkE=C&defQ5&6+t|cC#1QGwi_)Zk(~~Tht_IAqo`x|9v9|JNNVI># z6qT-Pc>KozPmDFgUd;{%3nv_DtABsOMwA003Niyt00?Tc(@x>J?$gbQ732}yV}1lo zXzXCaTleaQ@MKVv3RRMfR#FzxsFn=Lm92mKQ_=hGbY!u%z%F8enJz8GraSAOtw$ySz?{8t;=S^;-YEQCi9O zdET3Vbu3z9G9KVgZvI}3q4Q*Kwov?o-n&C8Q2S(KK6pOADq5p}_Tiu8qyZh#r{Sf2 z$_Xm7&=}AVs-=5kh#D||FRXvSBST|}lcz^_{+z9}od6cWcbcnS((fJr;`D6X*qw7p zU5-o(9&#b7N5i6r4(L8S;L=__VdD^_rFZRa68D5}d%5Meu8915iX!s@k^~8U(lR0| zf(R`!755?I47emZbQyoOrJwfh%XD4dQZPlQq55_M0t{HqV6xAEZxnwoC+S{IOCq&q zB3fImg$bFQ8bMQnYN2MkKo8QWgIKZFOQgi4gRL1I352^~3_zgtsppN#-1&2H6d@zT zvC!->q&yGRENLMABRf`zn+CYI40xC)iROopVN817{3SQ|;DDYTuXJV<&5_1s&NU^m z8CazS8!RY0P&I}Pn=pTTCz7paacaz-aUhs{H^Ly&Fb>l$-l`MTF}*Z^JA-PqMNG}f z#Gu^a>A5I@JhfZW@Kf=e9NYz!!!IT2Hc3a-JTBug*n4EpOjh=UQg>7+sK^U{*m<7@pMV)}n|_>n9G@$knMlPYgyh&=;ue5cs;XjvmVw^ zz;PF~&K zdq01iTS3C0Is=YGnj~pWiaVIMpVErBKCZg6)vC&Q>wuVE5%6p^*fUsDF^zoIu!&Ok zhaLiZ9YlX`D)Sp#33bYcLb#_l+Ct8iEuu8N3p8LKV%pkqi&C@h-0+#+A=zM!Kl}TlZ#|qg)9~33hC6~f5#&T zWw1j`2FS(^{0Ywej%Onycm|OsEwY@C=aB4c#q zk8ECOv))xZMS0+#pLqvO&YhhcmP{v1^wm+DQ!NgqN6lZXNGxeASfhtR6~yawqV3M@ zk6_+A5P@DYo7YXV0I_6#wW|et@YCi^{3qiNqo`D%pqLKg=0oAdBz?97`!+O-{;~hJ zZSH@4K$2VIgQJ(h36qv1-{f0fT2fT}SU^QN+&Wu7N>j`-jz(zLKy=7bR~yIXqifhU z=T*~T*0`&$lEvH7ZU_O7(s;a~qXD`Whcevy9aGVaT@{Q6fO2%!h&1R9z<9eW6UeU= zNDXP~WQ2K^kZ%zPmVsdSR1|W2IvqU4gi?P^Jr{#YNt9|B+sYS$x`2dAkqw(dMB$t} z$$ZI$kh)|H@*?R7s9GBi6u*NbIsv+WkkAWhn76E9I$vQ4n2WV>l!o1d0}&Ebrw}!* z=@C~2aN)+gC%PKI>&|WqddPn?@8UQksS9?JE8&>L?8MjNmF!LcbME;%@Ob~h0JeYQ zRcTZD6foKVL%P9K#<4%7SVBy8ih{?wusWdjhV2luo;eNe(^x;Y(u|V2` zu9lYl)&F2QS@6X+WSaY$1MzUaGM|og4CyYIPqAuyOC2vB!AtKiAh2O%LQT zjGc&e4Oj};TuO()S!#$tAoG#$~&GmYkguo|%{n2@QS4$yzIm?I)K zFs_6Rh_7S6@EaSqFa8UT|{(ce*IlR?2STOnRf>#bknyDf`-x0 zP4JlKp@Ewyz<8#K?lx2Gdr&eZIE2RO@o7$xC(tHRd&1*C|8#OYw)u-)Y&zE<@ebR? z%VU41kd3fE)2zOFf)A94g-L%Bb@*q1L6WVw7_Qp!!%c3i8o^HvhGv(vxd<;15)8{< zqUT2{AdoA?J4(61#}K2#=NIq2TD#63QZiN6YuY_wq&gx7ZzMdZvj=Ac2i^$<~e#;`+oZ5dDbU4{sbSI8e zXVdsKUkD7jK=k|gips$LfI&tZV^KW9 ztWqAnsTa4#ENQWlz5{