From aaa4c98dd33e0bc14bee178008eaa2a4b9648a48 Mon Sep 17 00:00:00 2001 From: Westly Wright Date: Thu, 5 Jul 2018 16:39:41 -0700 Subject: [PATCH 01/35] Only prevent search on pageload, otherwise claer wont be called --- src/js/app.js | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/src/js/app.js b/src/js/app.js index 3d84b04eec6..20d939de907 100644 --- a/src/js/app.js +++ b/src/js/app.js @@ -4,21 +4,31 @@ import instantsearch from 'instantsearch.js'; // This is for any custom JS that may need to be added to individual apps. // Main JS is located in Rancher Website Theme const bootstrapDocsSearch = function() { + + var firstSearchRender = true; + const search = instantsearch({ appId: '30NEY6C9UY', apiKey: 'b7f43c16886fec97b87981e9e62ef1a5', indexName: window.location.host === 'rancher.com' ? 'prod_docs' : 'dev_docs', routing: true, - searchFunction: function(helper) { - if (helper.state.query === "") { + searchFunction: (helper) => { + + if (helper.state.query === "" && firstSearchRender) { + + firstSearchRender = false; + return; } + helper.search(); } }); search.addWidget( instantsearch.widgets.searchBox({ + autofocus: true, + loadingIndicator: true, container: '#search-box', placeholder: 'Search Docs...', magnifier: false, From 9f8edc3179edc0a80d3c54783dcaeef520f5b69e Mon Sep 17 00:00:00 2001 From: Arno Gaboury Date: Mon, 9 Jul 2018 11:21:40 +0200 Subject: [PATCH 02/35] update download rke link to `Download RKE Config File template` is broken because of `rke` missing --- .../rancher/v2.x/en/installation/ha-server-install/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/installation/ha-server-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/_index.md index b0356a915d3..2b6441b344f 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/_index.md @@ -194,7 +194,7 @@ RKE is a fast, versatile Kubernetes installer that you can use to install Kubern 2. Make the RKE binary that you just downloaded executable. Open Terminal, change directory to the location of the RKE binary, and then run one of the commands below. >**Using Windows?** - >The file is already an executable. Skip to [Download Config File Template](#5-download-config-file-template). + >The file is already an executable. Skip to [Download Config File Template](#5-download-rke-config-file-template). ``` # MacOS From c03b7941f6de2ba70baf2f7937da2d467cc21ded Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Wed, 27 Jun 2018 16:03:01 -0700 Subject: [PATCH 03/35] updating storage docs --- .../users-permissions-roles/_index.md | 22 +++++++++++++++++++ .../tasks/clusters/adding-storage/_index.md | 2 -- 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/_index.md b/content/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/_index.md index 22847e402a1..c8dafa4605d 100644 --- a/content/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/_index.md +++ b/content/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/_index.md @@ -2,6 +2,28 @@ title: Users, Global Permissions, and Roles weight: 15 --- +In This Document: + + + +- [Users and Roles](#users-and-roles) + - [Global Permissions](#global-permissions) + - [Global Permission Assignment](#global-permission-assignment) + - [Custom Global Permissions](#custom-global-permissions) + - [Global Permissions Reference](#global-permissions-reference) + - [Cluster and Project Roles](#cluster-and-project-roles) + - [Membership and Role Assignment](#membership-and-role-assignment) + - [Cluster Roles](#cluster-roles) + - [Custom Cluster Roles](#custom-cluster-roles) + - [Cluster Role Reference](#cluster-role-reference) + - [Project Roles](#project-roles) + - [Custom Project Roles](#custom-project-roles) + - [Project Role Reference](#project-role-reference) + - [Defining Custom Roles](#defining-custom-roles) + - [Locked Roles](#locked-roles) + + + Within Rancher, each user authenticates as a _user_, which is a login that grants you access to Rancher. As mentioned in [Authentication]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication), users can either be local or external. diff --git a/content/rancher/v2.x/en/tasks/clusters/adding-storage/_index.md b/content/rancher/v2.x/en/tasks/clusters/adding-storage/_index.md index c539e017cb4..a119c68f354 100644 --- a/content/rancher/v2.x/en/tasks/clusters/adding-storage/_index.md +++ b/content/rancher/v2.x/en/tasks/clusters/adding-storage/_index.md @@ -44,7 +44,6 @@ Persistent volumes can either be a disk or file system that you host on premise, - [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes): This options sets how many nodes can access the volume, along with the node read/write permissions. The [Kubernetes Documentation](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes) includes a table that lists which access modes are supported by the plugins available. - - [Mount Options](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#mount-options): Each volume plugin allows you to specify additional command line options during the mounting process. You can enter these options in the **Mount Option** fields. Consult each plugin's vendor documentation for the mount options available. @@ -52,7 +51,6 @@ Persistent volumes can either be a disk or file system that you host on premise, - **Assign to Storage Class:** If you later want to automatically provision persistent volumes identical to the volume that you've specified here, assign it a storage class. Later, when you create a workload, you can assign it a persistent volume claim that references the storage class, which will provision a persistent volume identical to the volume you've specified here. - >**Note:** You must [add a storage class](#adding-storage-classes) before you can assign it to a persistent volume. 1. Click **Save**. From 217943bd0d9e0893ba901715833bb00828c955c5 Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Thu, 28 Jun 2018 14:07:54 -0700 Subject: [PATCH 04/35] adding freeIPA and openLDAP --- .../authentication/_index.md | 5 ++ .../authentication/_index.md | 28 ++++++---- .../authentication/active-directory/_index.md | 3 +- .../authentication/azure-ad/_index.md | 2 + .../authentication/freeipa/_index.md | 55 +++++++++++++++++++ .../authentication/openLDAP/_index.md | 55 +++++++++++++++++++ 6 files changed, 135 insertions(+), 13 deletions(-) create mode 100644 content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md create mode 100644 content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md diff --git a/content/rancher/v2.x/en/concepts/global-configuration/authentication/_index.md b/content/rancher/v2.x/en/concepts/global-configuration/authentication/_index.md index 06dbfa7591c..94840b7de1f 100644 --- a/content/rancher/v2.x/en/concepts/global-configuration/authentication/_index.md +++ b/content/rancher/v2.x/en/concepts/global-configuration/authentication/_index.md @@ -13,12 +13,17 @@ This centralized user authentication is accomplished using the Rancher authentic The Rancher authentication proxy integrates with the following external authentication services. - Microsoft Active Directory +- Microsoft Azure AD - GitHub +- FreeIPA +- OpenLDAP However, Rancher also provides local authentication. In most cases, you should use an external authentication service over local, as external authentication allows user management from a central location. However, you may want a few local authentication users for managing Rancher under rare circumstances, such as if Active Directory is down. +For more information on how to configure external authentication or local authentication, see [Authentication](../../../tasks/global-configuration/authentication/). + ### External Authentication Configuration and Principal Users Configuration of external authentication requires: diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md index 2d27198d556..cef5b6b381e 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md @@ -2,25 +2,29 @@ title: Authentication weight: 50 --- -You have three options for user authentication in Rancher: -- [Active Directory]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/) - - Enterprises can use Active Directory (AD) for authentication, allowing users to sign in using their corporate credentials. +You have multiple options for user authentication in Rancher: -- [GitHub]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication/github/) +- [Active Directory](./active-directory/) - Open source projects or organizations that use GitHub for source control may prefer that users sign in using their GitHub accounts. + Enterprises can use Active Directory (AD) for authentication, allowing users to sign in using their corporate credentials. - + If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher. +- [GitHub](./github/) -- [Azure AD]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/) + Open source projects or organizations that use GitHub for source control may prefer that users sign in using their GitHub accounts. - If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher. +- [FreeIPA](./freeipa/) -- [Local Authentication]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication/local-authentication/) + Organizations can use FreeIPA for authentication, allowing users to sign in using their corporate credentials. - If you don't want to use external authentication, you can always add users directly to Rancher. We recommend using external authentication over local authentication. +- [OpenLDAP](./openlap/) + + Organizations can use OpenLDAP for authentication, allowing users to sign in using their corporate credentials. + +- [Local Authentication](./local-authentication/) + + If you don't want to use external authentication, you can always add users directly to Rancher. We recommend using external authentication over local authentication. diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md index 9105b6fb27a..989cb067d98 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md @@ -7,7 +7,8 @@ In environments using Microsoft Active Directory (AD), you can configure Rancher >**Prerequisites:** > ->- Create a service account in Active Directory with `read-only` access. {{< product >}} uses this account to verify group membership when a user makes a request using an API key. +>- Have an Active Directory server configured. +>- Create a service account in Active Directory with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key. >- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/#external-authentication-configuration-and-principal-users). 1. Sign into Rancher using a local user assigned `administrator` global permissions (i.e., the _local principal_). diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md index 587c9522b3d..ec2047f5b5e 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md @@ -5,6 +5,8 @@ weight: 3075 If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher. +>**Prerequisite:** Have an instance of Azure AD configured. + >**Note:** Most of this procedure, with the exception of [Configure Azure AD in Rancher](#configure-azure-ad-in-rancher), takes place from the [Microsoft Azure Portal](https://portal.azure.com/). ## Azure Active Directory Configuration Outline diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md new file mode 100644 index 00000000000..51e72d3aad5 --- /dev/null +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md @@ -0,0 +1,55 @@ +--- +title: Configuring FreeIPA +weight: 5000 +--- + +If your organization uses FreeIPA for user authentication, you can configure Rancher to allow your users to login using their FreeIPA credentials. + +>**Prerequisites:** +> +>- You must have a [FreeIPA Server](https://www.freeipa.org/) configured. +>- Create a service account in FreeIPA with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key. +>- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/#external-authentication-configuration-and-principal-users). + +1. Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_). + +2. From the **Global** view, select **Security > Authentication** from the main menu. + +3. Select **FreeIPA**. + +4. Complete the **Configure an FreeIPA server** form. + + You may need to log in to your domain controller to find the information requested in the form. + + >**Using TLS?** + >Make sure you have an LDAP certificate installed. +
+
+ >**User Search Base vs. Group Search Base** + > + >When configuring FreeIPA authentication, you must enter a search base for your users. This search base allows Rancher to search for users that are in your FreeIPA. +
+
+ > **Note:** This field is only for search bases and not for search filters. + > + >- If your users and groups are in the search base, complete only the User Search Base. + >- If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required. + +5. If your FreeIPA deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step. + + >**Search Attribute** As of Rancher v2.0.1, the Search Attribute field defaults with three specific values by default: `sAMAccountName|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. + > + >The default field value `sAMAccountName|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields. + > + > * `sAMAccountName`: Username + > * `sn`: Last Name + > * `givenName`: First Name + > + > With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field. + +6. Enter your FreeIPA username and password in **Test and enable authentication** to confirm that Rancher is configured to use FreeIPA authentication. + +**Result:** + +- FreeIPA authentication is configured. +- You are signed into Rancher with your FreeIPA account (i.e., the _external principal_). \ No newline at end of file diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md new file mode 100644 index 00000000000..eaad856c84e --- /dev/null +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md @@ -0,0 +1,55 @@ +--- +title: Configuring OpenLDAP +weight: 5000 +--- + +If your organization uses OpenLDAP for user authentication, you can configure Rancher to allow your users to login using their OpenLDAP credentials. + +>**Prerequisites:** +> +>- You must have an [OpenLDAP Server](https://www.openldap.org/) configured. +>- Create a service account in OpenLDAP with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key. +>- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/#external-authentication-configuration-and-principal-users). + +1. Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_). + +2. From the **Global** view, select **Security > Authentication** from the main menu. + +3. Select **OpenLDAP**. + +4. Complete the **Configure an OpenLDAP server** form. + + You may need to log in to your domain controller to find the information requested in the form. + + >**Using TLS?** + >Make sure you have an LDAP certificate installed. +
+
+ >**User Search Base vs. Group Search Base** + > + >When configuring OpenLDAP authentication, you must enter a search base for your users. This search base allows Rancher to search for users that are in your OpenLDAP. +
+
+ > **Note:** This field is only for search bases and not for search filters. + > + >- If your users and groups are in the search base, complete only the User Search Base. + >- If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required. + +5. If your OpenLDAP deviates from the standard OpenLDAP schema, complete the **Customize Schema** form to match it. Otherwise, skip this step. + + >**Search Attribute** As of Rancher v2.0.1, the Search Attribute field defaults with three specific values by default: `sAMAccountName|sn|givenName`. After OpenLDAP is configured, when a user enters text to add users or groups, Rancher automatically queries the OpenLDAP server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. + > + >The default field value `sAMAccountName|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields. + > + > * `sAMAccountName`: Username + > * `sn`: Last Name + > * `givenName`: First Name + > + > With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field. + +6. Enter your OpenLDAP username and password in **Test and enable authentication** to confirm that Rancher is configured to use OpenLDAP authentication. + +**Result:** + +- OpenLDAP authentication is configured. +- You are signed into Rancher with your OpenLDAP account (i.e., the _external principal_). \ No newline at end of file From f29f2e11bfc5780ecd5532c8ce9fae22ff5d08e4 Mon Sep 17 00:00:00 2001 From: Denise Schannon Date: Mon, 9 Jul 2018 18:42:12 -0700 Subject: [PATCH 05/35] cleaning up unnecessary changes --- .../users-permissions-roles/_index.md | 22 ------------------- .../tasks/clusters/adding-storage/_index.md | 2 ++ 2 files changed, 2 insertions(+), 22 deletions(-) diff --git a/content/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/_index.md b/content/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/_index.md index c8dafa4605d..22847e402a1 100644 --- a/content/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/_index.md +++ b/content/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/_index.md @@ -2,28 +2,6 @@ title: Users, Global Permissions, and Roles weight: 15 --- -In This Document: - - - -- [Users and Roles](#users-and-roles) - - [Global Permissions](#global-permissions) - - [Global Permission Assignment](#global-permission-assignment) - - [Custom Global Permissions](#custom-global-permissions) - - [Global Permissions Reference](#global-permissions-reference) - - [Cluster and Project Roles](#cluster-and-project-roles) - - [Membership and Role Assignment](#membership-and-role-assignment) - - [Cluster Roles](#cluster-roles) - - [Custom Cluster Roles](#custom-cluster-roles) - - [Cluster Role Reference](#cluster-role-reference) - - [Project Roles](#project-roles) - - [Custom Project Roles](#custom-project-roles) - - [Project Role Reference](#project-role-reference) - - [Defining Custom Roles](#defining-custom-roles) - - [Locked Roles](#locked-roles) - - - Within Rancher, each user authenticates as a _user_, which is a login that grants you access to Rancher. As mentioned in [Authentication]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication), users can either be local or external. diff --git a/content/rancher/v2.x/en/tasks/clusters/adding-storage/_index.md b/content/rancher/v2.x/en/tasks/clusters/adding-storage/_index.md index a119c68f354..c539e017cb4 100644 --- a/content/rancher/v2.x/en/tasks/clusters/adding-storage/_index.md +++ b/content/rancher/v2.x/en/tasks/clusters/adding-storage/_index.md @@ -44,6 +44,7 @@ Persistent volumes can either be a disk or file system that you host on premise, - [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes): This options sets how many nodes can access the volume, along with the node read/write permissions. The [Kubernetes Documentation](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes) includes a table that lists which access modes are supported by the plugins available. + - [Mount Options](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#mount-options): Each volume plugin allows you to specify additional command line options during the mounting process. You can enter these options in the **Mount Option** fields. Consult each plugin's vendor documentation for the mount options available. @@ -51,6 +52,7 @@ Persistent volumes can either be a disk or file system that you host on premise, - **Assign to Storage Class:** If you later want to automatically provision persistent volumes identical to the volume that you've specified here, assign it a storage class. Later, when you create a workload, you can assign it a persistent volume claim that references the storage class, which will provision a persistent volume identical to the volume you've specified here. + >**Note:** You must [add a storage class](#adding-storage-classes) before you can assign it to a persistent volume. 1. Click **Save**. From b18f4977ba23b4dc132af04aa39a1c795800a81f Mon Sep 17 00:00:00 2001 From: Denise Schannon Date: Mon, 9 Jul 2018 19:02:58 -0700 Subject: [PATCH 06/35] fixing auth ordering/links --- .../authentication/_index.md | 9 +++---- .../authentication/active-directory/_index.md | 6 ++--- .../authentication/azure-ad/_index.md | 24 +++++++++---------- .../authentication/freeipa/_index.md | 6 ++--- .../authentication/github/_index.md | 6 ++--- .../local-authentication/_index.md | 6 ++--- .../authentication/openLDAP/_index.md | 6 ++--- 7 files changed, 32 insertions(+), 31 deletions(-) diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md index cef5b6b381e..a683f88f053 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md @@ -17,13 +17,14 @@ You have multiple options for user authentication in Rancher: Open source projects or organizations that use GitHub for source control may prefer that users sign in using their GitHub accounts. -- [FreeIPA](./freeipa/) +- [OpenLDAP](./openlap/) + + Organizations can use OpenLDAP for authentication, allowing users to sign in using their corporate credentials. + +- [FreeIPA](./freeipa/) Organizations can use FreeIPA for authentication, allowing users to sign in using their corporate credentials. -- [OpenLDAP](./openlap/) - - Organizations can use OpenLDAP for authentication, allowing users to sign in using their corporate credentials. - [Local Authentication](./local-authentication/) diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md index 989cb067d98..3cada243ea6 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md @@ -1,6 +1,6 @@ --- -title: Configuring Active Directory Authentication -weight: 3075 +title: Configuring Active Directory (AD) +weight: 51 --- In environments using Microsoft Active Directory (AD), you can configure Rancher to allow sign on using AD credentials. @@ -20,7 +20,7 @@ In environments using Microsoft Active Directory (AD), you can configure Rancher 4. Complete the **Configure an Active Directory server** form. You may need to log in to your domain controller to find the information requested in the form. - + >**Using TLS?** >Make sure you have an LDAP certificate installed.
diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md index ec2047f5b5e..5f78de50333 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md @@ -1,6 +1,6 @@ --- -title: Configuring Azure Active Directory -weight: 3075 +title: Configuring Azure Active Directory (Azure AD) +weight: 52 --- If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher. @@ -15,7 +15,7 @@ Configuring Rancher to allow your users to authenticate with their Azure AD acco ->**Tip:** Before you start, we recommend creating an empty text file. You can use this file to copy values from Azure that you'll paste into Rancher later. +>**Tip:** Before you start, we recommend creating an empty text file. You can use this file to copy values from Azure that you'll paste into Rancher later. 1. [Register Rancher with Azure](#1-register-rancher-with-azure) @@ -56,7 +56,7 @@ Before enabling Azure AD within Rancher, you must register Rancher with Azure. 1. From **Application type**, make sure that **Web app / API** is selected. 1. In the **Sign-on URL** field, enter the URL of your Rancher Server. - + 1. Click **Create**. ### 2. Create an Azure API Key @@ -124,29 +124,29 @@ As your final step in Azure, copy the data that you'll use to configure Rancher 1. Use search to open the **Azure Active Directory** service. ![Open Azure Active Directory]({{< baseurl >}}/img/rancher/search-azure-ad.png) - + 1. From the **Azure Active Directory** menu, open **Properties**. - + 2. Copy the **Directory ID** and paste it into your [text file](#tip). - + You'll paste this value into Rancher as your **Tenant ID**. 1. Obtain your Rancher **Application ID**. - + 1. Use search to open **App registrations**. ![Open App Registrations]({{< baseurl >}}/img/rancher/search-app-registrations.png) - + 1. Find the entry you created for Rancher. - + 1. Copy the **Application ID** and paste it to your [text file](#tip). 1. Obtain your Rancher **Graph Endpoint**, **Token Endpoint**, and **Auth Endpoint**. - + 1. From **App registrations**, click **Endpoints**. ![Click Endpoints]({{< baseurl >}}/img/rancher/click-endpoints.png) - + 2. Copy the following endpoints to your clipboard and paste them into your [text file](#tip) (these values will be your Rancher endpoint values). - **Microsoft Azure AD Graph API Endpoint** (Graph Endpoint) diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md index 51e72d3aad5..844242110a6 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md @@ -1,6 +1,6 @@ --- title: Configuring FreeIPA -weight: 5000 +weight: 55 --- If your organization uses FreeIPA for user authentication, you can configure Rancher to allow your users to login using their FreeIPA credentials. @@ -20,7 +20,7 @@ If your organization uses FreeIPA for user authentication, you can configure Ran 4. Complete the **Configure an FreeIPA server** form. You may need to log in to your domain controller to find the information requested in the form. - + >**Using TLS?** >Make sure you have an LDAP certificate installed.
@@ -52,4 +52,4 @@ If your organization uses FreeIPA for user authentication, you can configure Ran **Result:** - FreeIPA authentication is configured. -- You are signed into Rancher with your FreeIPA account (i.e., the _external principal_). \ No newline at end of file +- You are signed into Rancher with your FreeIPA account (i.e., the _external principal_). diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/github/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/github/_index.md index 9e7876bd3e4..603bb20847f 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/github/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/github/_index.md @@ -1,6 +1,6 @@ --- -title: Configuring GitHub Authentication -weight: 3075 +title: Configuring GitHub +weight: 53 --- In environments using GitHub, you can configure Rancher to allow sign on using GitHub credentials. @@ -48,4 +48,4 @@ In environments using GitHub, you can configure Rancher to allow sign on using G **Result:** - GitHub authentication is configured. -- You are signed into Rancher with your GitHub account (i.e., the _external principal_). \ No newline at end of file +- You are signed into Rancher with your GitHub account (i.e., the _external principal_). diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/local-authentication/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/local-authentication/_index.md index 2356fdf5785..189371f7084 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/local-authentication/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/local-authentication/_index.md @@ -1,10 +1,10 @@ --- title: Configuring Local Authentication -weight: 3075 +weight: 56 --- -Regardless of whether you use external authentication, you should create a few local authentication users so that you can continue using Rancher if you your external authentication service encounters issues. +Regardless of whether you use external authentication, you should create a few local authentication users so that you can continue using Rancher if you your external authentication service encounters issues. 1. From the **Global** view, select **Users** from the main menu. -2. Click **Add User**. Then complete the **Add User** form. Click **Create** when you're done. \ No newline at end of file +2. Click **Add User**. Then complete the **Add User** form. Click **Create** when you're done. diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md index eaad856c84e..56724437e2f 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md @@ -1,6 +1,6 @@ --- title: Configuring OpenLDAP -weight: 5000 +weight: 54 --- If your organization uses OpenLDAP for user authentication, you can configure Rancher to allow your users to login using their OpenLDAP credentials. @@ -20,7 +20,7 @@ If your organization uses OpenLDAP for user authentication, you can configure Ra 4. Complete the **Configure an OpenLDAP server** form. You may need to log in to your domain controller to find the information requested in the form. - + >**Using TLS?** >Make sure you have an LDAP certificate installed.
@@ -52,4 +52,4 @@ If your organization uses OpenLDAP for user authentication, you can configure Ra **Result:** - OpenLDAP authentication is configured. -- You are signed into Rancher with your OpenLDAP account (i.e., the _external principal_). \ No newline at end of file +- You are signed into Rancher with your OpenLDAP account (i.e., the _external principal_). From b5037eb8eeebe4f52015bc599e4283033e77633d Mon Sep 17 00:00:00 2001 From: Denise Schannon Date: Mon, 9 Jul 2018 19:16:34 -0700 Subject: [PATCH 07/35] nginx references --- .../ha-server-install-external-lb/_index.md | 8 ++++---- .../ha-server-install-external-lb/nginx/_index.md | 10 ++++++---- .../v2.x/en/installation/ha-server-install/_index.md | 6 ++++-- .../en/installation/ha-server-install/nlb/_index.md | 2 +- .../single-node-install-external-lb/_index.md | 2 ++ .../add-ons/ingress-controllers/_index.md | 2 +- 6 files changed, 18 insertions(+), 12 deletions(-) diff --git a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md index 5ff9d80fd12..2c44d75a711 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md @@ -5,7 +5,7 @@ weight: 276 This set of instructions creates a new Kubernetes cluster that's dedicated to running Rancher in a high-availability (HA) configuration. This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on: - Layer 7 Loadbalancer with SSL termination (HTTPS) -- NGINX Ingress controller (HTTP) +- [NGINX Ingress controller (HTTP)](https://kubernetes.github.io/ingress-nginx/) ![Rancher HA]({{< baseurl >}}/img/rancher/ha/rancher2ha-l7.svg) @@ -64,15 +64,15 @@ Before you install Rancher, confirm you meet the host requirements. Provision 3 ### Requirements -#### Operating System +#### Operating System {{< requirements_os >}} -#### Hardware +#### Hardware {{< requirements_hardware >}} -#### Software +#### Software {{< requirements_software >}} diff --git a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/_index.md index 20579aa96b8..703974fec58 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/_index.md @@ -12,6 +12,8 @@ For help installing NGINX, refer to their [install documentation](https://www.ng After installing NGINX, you need to create the NGINX config file, `/etc/nginx/conf.d/rancher.conf`, with the IP addresses for your Linux nodes, chosen FQDN and location of the certificate file and certificate key file. +>**Note:** The example configuration below does not include all available Nginx options and may not be suitable for your production environment. For full configuration documentation, see [NGINX Load Balancing - HTTP Load Balancer](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/). + 1. Copy and paste the code sample below into your favorite text editor. Save it as `/etc/nginx/conf.d/rancher.conf`. **Example NGINX config:** @@ -21,18 +23,18 @@ After installing NGINX, you need to create the NGINX config file, `/etc/nginx/co server IP_NODE_2:80; server IP_NODE_3:80; } - + map $http_upgrade $connection_upgrade { default Upgrade; '' close; } - + server { listen 443 ssl http2; server_name FQDN; ssl_certificate /certs/fullchain.pem; ssl_certificate_key /certs/privkey.pem; - + location / { proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; @@ -46,7 +48,7 @@ After installing NGINX, you need to create the NGINX config file, `/etc/nginx/co proxy_read_timeout 900s; } } - + server { listen 80; server_name FQDN; diff --git a/content/rancher/v2.x/en/installation/ha-server-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/_index.md index 2b6441b344f..d4eecdcdc1d 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/_index.md @@ -5,7 +5,7 @@ weight: 275 This set of instructions creates a new Kubernetes cluster that's dedicated to running Rancher in a high-availability (HA) configuration. This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on: - Layer 4 load balancer (TCP) -- NGINX ingress controller with SSL termination (HTTPS) +- [NGINX ingress controller with SSL termination (HTTPS)](https://kubernetes.github.io/ingress-nginx/) ![Rancher HA]({{< baseurl >}}/img/rancher/ha/rancher2ha.svg) @@ -108,6 +108,8 @@ After installing NGINX, you need to update the NGINX config file, `nginx.conf`, 2. From `nginx.conf`, replace `IP_NODE_1`, `IP_NODE_2`, and `IP_NODE_3` with the IPs of your [Linux hosts](#1-provision-linux-hosts). + >**Note:** This Nginx configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - TCP and UDP Load Balancer](https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/). + **Example NGINX config:** ``` worker_processes 4; @@ -391,7 +393,7 @@ Save the `.yml` file and close it. ## 9. Back Up Your RKE Config File -After you close your `.yml` file, back it up to a secure location. You can use this file again when it's time to upgrade Rancher. +After you close your `.yml` file, back it up to a secure location. You can use this file again when it's time to upgrade Rancher. ## 10. Run RKE diff --git a/content/rancher/v2.x/en/installation/ha-server-install/nlb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/nlb/_index.md index bbdb1813d81..1bef7366ae0 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/nlb/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/nlb/_index.md @@ -21,7 +21,7 @@ Configuring an Amazon NLB is a multistage process. We've broken it down into mul ## Create Target Groups -Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but its convenient to add a listener for port 80 which will be redirected to port 443 automatically. The NGINX controller on the nodes will make sure that port 80 gets redirected to port 443. +Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but its convenient to add a listener for port 80 which will be redirected to port 443 automatically. The NGINX ingress controller on the nodes will make sure that port 80 gets redirected to port 443. Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started, make sure to select the **Region** where your EC2 instances (Linux nodes) are created. diff --git a/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md index 54eeed48a4f..2c3414f7395 100644 --- a/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md @@ -131,6 +131,8 @@ The load balancer or proxy has to be configured to support the following: This Nginx configuration is tested on Nginx version 1.13 (mainline) and 1.14 (stable). + >**Note:** This Nginx configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - TCP and UDP Load Balancer](https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/). + ``` upstream rancher { server rancher-server:80; diff --git a/content/rke/v0.1.x/en/config-options/add-ons/ingress-controllers/_index.md b/content/rke/v0.1.x/en/config-options/add-ons/ingress-controllers/_index.md index c54fe406d70..4c0abf4ec46 100644 --- a/content/rke/v0.1.x/en/config-options/add-ons/ingress-controllers/_index.md +++ b/content/rke/v0.1.x/en/config-options/add-ons/ingress-controllers/_index.md @@ -39,7 +39,7 @@ ingress: ``` ## Nginx Ingress Controller -For the configuration of nginx, there are some configuration options. There are a [list of options](https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/configmap.md) for the nginx config map and [command line extra_args](https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/cli-arguments.md). +For the configuration of nginx, there are some configuration options. There are a [list of options](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/) for the nginx config map and [command line extra_args](https://kubernetes.github.io/ingress-nginx/user-guide/cli-arguments/). ```yaml ingress: From 6319c4f6c6240c42954cc79ada282dfe11c2325f Mon Sep 17 00:00:00 2001 From: Denise Schannon Date: Mon, 9 Jul 2018 19:09:59 -0700 Subject: [PATCH 08/35] fixing up auth version availability --- .../global-configuration/authentication/azure-ad/_index.md | 2 ++ .../global-configuration/authentication/freeipa/_index.md | 4 +++- .../global-configuration/authentication/openLDAP/_index.md | 4 +++- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md index 5f78de50333..3cf607630bb 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/_index.md @@ -3,6 +3,8 @@ title: Configuring Azure Active Directory (Azure AD) weight: 52 --- +_Available as of v2.0.3_ + If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher. >**Prerequisite:** Have an instance of Azure AD configured. diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md index 844242110a6..4d157433a5a 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md @@ -3,6 +3,8 @@ title: Configuring FreeIPA weight: 55 --- +_Available as of v2.0.5_ + If your organization uses FreeIPA for user authentication, you can configure Rancher to allow your users to login using their FreeIPA credentials. >**Prerequisites:** @@ -37,7 +39,7 @@ If your organization uses FreeIPA for user authentication, you can configure Ran 5. If your FreeIPA deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step. - >**Search Attribute** As of Rancher v2.0.1, the Search Attribute field defaults with three specific values by default: `sAMAccountName|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. + >**Search Attribute** The Search Attribute field defaults with three specific values by default: `sAMAccountName|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. > >The default field value `sAMAccountName|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields. > diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md index 56724437e2f..b24da3eb12c 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md @@ -3,6 +3,8 @@ title: Configuring OpenLDAP weight: 54 --- +_Available as of v2.0.5_ + If your organization uses OpenLDAP for user authentication, you can configure Rancher to allow your users to login using their OpenLDAP credentials. >**Prerequisites:** @@ -37,7 +39,7 @@ If your organization uses OpenLDAP for user authentication, you can configure Ra 5. If your OpenLDAP deviates from the standard OpenLDAP schema, complete the **Customize Schema** form to match it. Otherwise, skip this step. - >**Search Attribute** As of Rancher v2.0.1, the Search Attribute field defaults with three specific values by default: `sAMAccountName|sn|givenName`. After OpenLDAP is configured, when a user enters text to add users or groups, Rancher automatically queries the OpenLDAP server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. + >**Search Attribute** The Search Attribute field defaults with three specific values by default: `sAMAccountName|sn|givenName`. After OpenLDAP is configured, when a user enters text to add users or groups, Rancher automatically queries the OpenLDAP server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. > >The default field value `sAMAccountName|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields. > From c127d7ec56ddada418c1c95786a1f055eace43af Mon Sep 17 00:00:00 2001 From: Denise Schannon Date: Mon, 9 Jul 2018 19:28:56 -0700 Subject: [PATCH 09/35] fix openldap spacing --- .../v2.x/en/tasks/global-configuration/authentication/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md index a683f88f053..bb81cb76f9a 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/_index.md @@ -19,7 +19,7 @@ You have multiple options for user authentication in Rancher: - [OpenLDAP](./openlap/) - Organizations can use OpenLDAP for authentication, allowing users to sign in using their corporate credentials. + Organizations can use OpenLDAP for authentication, allowing users to sign in using their corporate credentials. - [FreeIPA](./freeipa/) From 3855e5a331e442b56e0665c1ea019608340badef Mon Sep 17 00:00:00 2001 From: Denise Schannon Date: Mon, 9 Jul 2018 20:52:38 -0700 Subject: [PATCH 10/35] alerts and notifiers concepts --- .../concepts/alerts-and-notifiers/_index.md | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/content/rancher/v2.x/en/concepts/alerts-and-notifiers/_index.md b/content/rancher/v2.x/en/concepts/alerts-and-notifiers/_index.md index 1538a3ffe5b..de5c31fa308 100644 --- a/content/rancher/v2.x/en/concepts/alerts-and-notifiers/_index.md +++ b/content/rancher/v2.x/en/concepts/alerts-and-notifiers/_index.md @@ -3,3 +3,34 @@ title: Alerts and Notifiers weight: 2300 draft: true --- + +Alerts and notifications are built on top of the [Prometheus Alertmanager](https://prometheus.io/docs/alerting/alertmanager/). Leveraging these tools, Rancher is able to provide the first step in notifications for events operators and application owners need to know about. + +## Notifiers + +In Rancher 2.x, a user can configure `Notifiers` for each cluster that can receive alerts for various events. By configuring the notifiers at the cluster level, project owners do not need to know SMTP settings or have access to cloud accounts. At a project level, users can configure alerts and add recipients scoped to the relevant alerts. + +Available Notifiers: + +* Email +* Slack +* PagerDuty +* Webhooks + +## Alerts + +Rancher supports alerting on a cluster level or project level. + +On a cluster level, Rancher can monitor and alert on components that manage your Kubernetes cluster including: + +* System Services +* Resource Events +* Node conditions + +Operators of Kubernetes clusters can get alerts on the health of nodes and other system level components. + +On a project level, Rancher can monitor and alert on status on specific deployments including: + +* Deployment availability +* Workloads +* Pods From ea0209d2689ac1d235285fff795ea2b87fecbd41 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Pobo=C5=99il?= Date: Tue, 10 Jul 2018 02:39:19 +0200 Subject: [PATCH 11/35] Fixed anchors to SSL subchapters --- .../v2.x/en/installation/single-node-install/_index.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/rancher/v2.x/en/installation/single-node-install/_index.md b/content/rancher/v2.x/en/installation/single-node-install/_index.md index eb24c5085a3..14ac78ebd1f 100644 --- a/content/rancher/v2.x/en/installation/single-node-install/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install/_index.md @@ -62,10 +62,10 @@ For security purposes, SSL (Secure Sockets Layer) is required when using Rancher Choose from the following options: -- [Option A—Default Self-Signed Certificate](#option-adefault-self-signed-certificate) -- [Option B—Bring Your Own Certificate: Self-Signed](#option-bbring-your-own-certificate--self-signed) -- [Option C—Bring Your Own Certificate: Signed by Recognized CA](#option-cbring-your-own-certificate--signed-by-recognized-ca) -- [Option D-Let's Encrypt Certificate](#option-d-lets-encrypt-certificate) +- [Option A—Default Self-Signed Certificate](#option-a-default-self-signed-certificate) +- [Option B—Bring Your Own Certificate: Self-Signed](#option-b-bring-your-own-certificate-self-signed) +- [Option C—Bring Your Own Certificate: Signed by Recognized CA](#option-c-bring-your-own-certificate-signed-by-recognized-ca) +- [Option D—Let's Encrypt Certificate](#option-d-let-s-encrypt-certificate) ### Option A—Default Self-Signed Certificate @@ -139,7 +139,7 @@ By default, Rancher automatically generates self-signed certificates for itself 2. Select **Settings** > **cacerts**. 3. Choose `Edit` and remove the contents. Then click `Save`. -### Option D-Let's Encrypt Certificate +### Option D—Let's Encrypt Certificate Rancher supports Let's Encrypt certificates. Let's Encrypt uses an `http-01 challenge` to verify that you have control over your domain. You can confirm that you control the domain by pointing the hostname that you want to use for Rancher access (for example, `rancher.mydomain.com`) to the IP of the machine it is running on. You can bind the hostname to the IP address by creating an A record in DNS. From f6c933dd5f4ce06cc7d4a9316abebcca13784df2 Mon Sep 17 00:00:00 2001 From: Westly Wright Date: Tue, 10 Jul 2018 10:47:46 -0700 Subject: [PATCH 12/35] Remove plumber so that gulp script dies when failure occurs --- gulpfile.babel.js | 15 ++++++--------- package.json | 1 - 2 files changed, 6 insertions(+), 10 deletions(-) diff --git a/gulpfile.babel.js b/gulpfile.babel.js index 9a6c6f15b04..fbd48081648 100644 --- a/gulpfile.babel.js +++ b/gulpfile.babel.js @@ -16,18 +16,16 @@ import watch from 'gulp-watch'; const $ = gulpLoadPlugins(); const browserSync = require('browser-sync').create(); const isProduction = process.env.NODE_ENV === 'production'; -const onError = (err) => { - console.log(err); -} -console.log('&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&') -console.log(process.env) -console.log('&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&') -process.on('SIGINT', () => { - console.log('Caught SIGINT, exiting'); +process.on('SIGINT', (err) => { + console.log('Caught SIGINT, exiting', '\r\n', err); process.exit(0); }); +process.on('uncaughtException', (err) => { + console.log('Uncaught Exception, exiting', '\r\n', err); + process.exit(1); +}); // -- gulp.task('dev', ['build-dev'], () => { gulp.start('init-watch'); @@ -103,7 +101,6 @@ gulp.task('sass', () => { return gulp.src([ 'src/sass/**/*.scss' ]) - .pipe($.plumber({ errorHandler: onError })) .pipe($.sassLint()) .pipe($.sassLint.format()) .pipe($.sass({ precision: 5, importer: tildeImporter })) diff --git a/package.json b/package.json index e914938dc52..6ef83f75291 100644 --- a/package.json +++ b/package.json @@ -26,7 +26,6 @@ "gulp-imagemin": "^4.1.0", "gulp-load-plugins": "^1.5.0", "gulp-newer": "^1.3.0", - "gulp-plumber": "^1.1.0", "gulp-sass": "^3.1.0", "gulp-sass-lint": "^1.3.2", "gulp-size": "^3.0.0", From 94882d90475b8be5a64c34918f2b0e036852a005 Mon Sep 17 00:00:00 2001 From: Westly Wright Date: Tue, 10 Jul 2018 11:59:23 -0700 Subject: [PATCH 13/35] build updates --- .drone.yml | 24 +++--------------------- Dockerfile.prod | 1 + Dockerfile.staging | 1 + gulpfile.babel.js | 30 ++++++++++++++++++++++++++++-- scripts/build-algolia.js | 12 ++---------- 5 files changed, 35 insertions(+), 33 deletions(-) diff --git a/.drone.yml b/.drone.yml index e4dd2da5704..a719452dea7 100644 --- a/.drone.yml +++ b/.drone.yml @@ -18,13 +18,7 @@ pipeline: repo: rancher/docs context: . tag: dev - secrets: [docker_username, docker_password, algolia_app_id, algolia_admin_key] - build_args: - - ALGOLIA_INDEX_NAME=dev_docs - - ALGOLIA_INDEX_FILE=public/algolia.json - build_args_from_env: - - ALGOLIA_APP_ID - - ALGOLIA_ADMIN_KEY + secrets: [docker_username, docker_password] when: branch: master event: push @@ -36,13 +30,7 @@ pipeline: repo: rancher/docs context: . tag: staging - secrets: [docker_username, docker_password, algolia_app_id, algolia_admin_key] - build_args: - - ALGOLIA_INDEX_NAME=dev_docs - - ALGOLIA_INDEX_FILE=public/algolia.json - build_args_from_env: - - ALGOLIA_APP_ID - - ALGOLIA_ADMIN_KEY + secrets: [docker_username, docker_password] when: branch: master event: push @@ -54,13 +42,7 @@ pipeline: repo: rancher/docs context: . tag: latest - secrets: [docker_username, docker_password, algolia_app_id, algolia_admin_key] - build_args: - - ALGOLIA_INDEX_NAME=prod_docs - - ALGOLIA_INDEX_FILE=public/algolia.json - build_args_from_env: - - ALGOLIA_APP_ID - - ALGOLIA_ADMIN_KEY + secrets: [docker_username, docker_password] when: branch: master event: push diff --git a/Dockerfile.prod b/Dockerfile.prod index 9869a6412e5..8be911c05fb 100644 --- a/Dockerfile.prod +++ b/Dockerfile.prod @@ -34,5 +34,6 @@ RUN gulp build RUN stat /run/public/index.html FROM nginx +VOLUME /usr/share/nginx/html/docs COPY --from=build /run/public /usr/share/nginx/html/docs/ COPY nginx.conf /etc/nginx/conf.d/default.conf diff --git a/Dockerfile.staging b/Dockerfile.staging index d400d2f4be5..2cd841f0991 100644 --- a/Dockerfile.staging +++ b/Dockerfile.staging @@ -33,5 +33,6 @@ RUN gulp build-staging RUN stat /run/public/index.html FROM nginx +VOLUME /usr/share/nginx/html/docs COPY --from=build /run/public /usr/share/nginx/html/docs/ COPY nginx.conf /etc/nginx/conf.d/default.conf diff --git a/gulpfile.babel.js b/gulpfile.babel.js index fbd48081648..01d6fd4044f 100644 --- a/gulpfile.babel.js +++ b/gulpfile.babel.js @@ -5,13 +5,15 @@ import gulp from 'gulp'; import del from 'del'; import runSequence from 'run-sequence'; import gulpLoadPlugins from 'gulp-load-plugins'; -import { spawn } from "child_process"; +import { spawn, exec } from "child_process"; import tildeImporter from 'node-sass-tilde-importer'; import browserify from 'browserify'; import source from 'vinyl-source-stream'; import buffer from 'vinyl-buffer'; import babelify from 'babelify'; import watch from 'gulp-watch'; +const atomicalgolia = require("atomic-algolia"); +const fs = require('fs'); const $ = gulpLoadPlugins(); const browserSync = require('browser-sync').create(); @@ -166,7 +168,6 @@ gulp.task('pub-delete', () => { return del(['public/**', '!public']); }); - gulp.task('build:search-index', (cb) => { const env = process.env; @@ -178,3 +179,28 @@ gulp.task('build:search-index', (cb) => { cb(); }); }); + + +gulp.task('publish:search-index', (cb) => { + const env = process.env; + + const opts = { + stdio: 'inherit', + env: env + }; + + return exec('giddyup leader check', opts).on('close', code => { + + if (code === 0) { + + const rawdata = fs.readFileSync('public/final.algolia.json'); + const merged = JSON.parse(rawdata); + atomicalgolia(process.env.ALGOLIA_INDEX_NAME, merged, (err, result) => { + console.log(result); + cb(err); + }); + + } + + }); +}); diff --git a/scripts/build-algolia.js b/scripts/build-algolia.js index 8432ac104fb..b14165ffbd9 100755 --- a/scripts/build-algolia.js +++ b/scripts/build-algolia.js @@ -11,9 +11,6 @@ const nue = []; const rawdata = fs.readFileSync('public/algolia.json'); const nodes = JSON.parse(rawdata); -console.log('&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&') -console.log(process.env) -console.log('&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&') nodes.forEach(node => { const dom = new JSDOM(node.content); const content = dom.window.document.body; //post content wrapped in a body tag @@ -83,10 +80,5 @@ nodes.forEach(node => { const merged = [...nodes, ...nue]; -// fs.writeFileSync('public/combined.algolia.json', JSON.stringify(merged)); -// process.exit(0); -atomicalgolia(process.env.ALGOLIA_INDEX_NAME, merged, (err, result) => { - if (err) throw err; - console.log(result); - process.exit(0); -}); +fs.writeFileSync('public/final.algolia.json', JSON.stringify(merged)); +process.exit(0); From bec9ff93238d00374eee95307591d5c022b170d9 Mon Sep 17 00:00:00 2001 From: Westly Wright Date: Tue, 10 Jul 2018 12:02:07 -0700 Subject: [PATCH 14/35] debugging --- gulpfile.babel.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/gulpfile.babel.js b/gulpfile.babel.js index 01d6fd4044f..f4066c85c15 100644 --- a/gulpfile.babel.js +++ b/gulpfile.babel.js @@ -28,6 +28,11 @@ process.on('uncaughtException', (err) => { console.log('Uncaught Exception, exiting', '\r\n', err); process.exit(1); }); + +console.log('&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&') +console.log(process.env) +console.log('&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&') + // -- gulp.task('dev', ['build-dev'], () => { gulp.start('init-watch'); From 455148c9ec161f8bf46237a057e6708a1cbbc106 Mon Sep 17 00:00:00 2001 From: Vincent Fiduccia Date: Mon, 9 Jul 2018 17:25:36 -0700 Subject: [PATCH 15/35] Focus search on click --- src/js/app.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/js/app.js b/src/js/app.js index 20d939de907..81ee65d8e32 100644 --- a/src/js/app.js +++ b/src/js/app.js @@ -65,7 +65,9 @@ const bootstrapDocsSearch = function() { overlay.toggleClass('open'); if (container.hasClass('open')) { - $('input#search').focus(); + console.log('hi'); + $('input#search-box').focus(); + console.log('hi2'); } overlay.css({top: 120}); From 3ad6ae52ee8a2cdb3d716ffe9ebdeb7ce874088d Mon Sep 17 00:00:00 2001 From: Vincent Fiduccia Date: Tue, 10 Jul 2018 11:54:06 -0700 Subject: [PATCH 16/35] Add anchor links to headers on hover --- src/js/app.js | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/src/js/app.js b/src/js/app.js index 81ee65d8e32..dd7b4cfbfc7 100644 --- a/src/js/app.js +++ b/src/js/app.js @@ -72,13 +72,21 @@ const bootstrapDocsSearch = function() { overlay.css({top: 120}); }); - } -const bootstrapDocsJS = function() { - bootstrapDocsSearch(); +const bootstrapIdLinks = function() { + const container = '.wrapper ARTICLE'; + const selector = 'h2[id], h3[id], h4[id], h5[id], h6[id]'; + $(container).on('mouseenter', selector, function(e) { + $(e.target).append($('').addClass('header-anchor').attr('href', '#' + e.target.id).html('')); + }); + + $(container).on('mouseleave', selector, function(e) { + $(e.target).parent().find('.header-anchor').remove(); + }); } $(document).ready(() => { - bootstrapDocsJS(); + bootstrapDocsSearch(); + bootstrapIdLinks(); }); From 583d6bb4bd52a8ee940d8d13a24dcb08e434066d Mon Sep 17 00:00:00 2001 From: Vincent Fiduccia Date: Tue, 10 Jul 2018 12:22:44 -0700 Subject: [PATCH 17/35] Copy gulpfile for algolia --- Dockerfile.prod | 1 + Dockerfile.staging | 1 + 2 files changed, 2 insertions(+) diff --git a/Dockerfile.prod b/Dockerfile.prod index 8be911c05fb..76883d6a6ea 100644 --- a/Dockerfile.prod +++ b/Dockerfile.prod @@ -36,4 +36,5 @@ RUN stat /run/public/index.html FROM nginx VOLUME /usr/share/nginx/html/docs COPY --from=build /run/public /usr/share/nginx/html/docs/ +COPY gulpfile.babel.js /usr/share/nginx/html/docs/ COPY nginx.conf /etc/nginx/conf.d/default.conf diff --git a/Dockerfile.staging b/Dockerfile.staging index 2cd841f0991..e13c6d16a1e 100644 --- a/Dockerfile.staging +++ b/Dockerfile.staging @@ -35,4 +35,5 @@ RUN stat /run/public/index.html FROM nginx VOLUME /usr/share/nginx/html/docs COPY --from=build /run/public /usr/share/nginx/html/docs/ +COPY gulpfile.babel.js /usr/share/nginx/html/docs/ COPY nginx.conf /etc/nginx/conf.d/default.conf From 17a4675a66c90524774d7933bb02f7ca7524767c Mon Sep 17 00:00:00 2001 From: Vincent Fiduccia Date: Tue, 10 Jul 2018 12:24:12 -0700 Subject: [PATCH 18/35] Remove log --- src/js/app.js | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/js/app.js b/src/js/app.js index dd7b4cfbfc7..d5780117d18 100644 --- a/src/js/app.js +++ b/src/js/app.js @@ -65,9 +65,7 @@ const bootstrapDocsSearch = function() { overlay.toggleClass('open'); if (container.hasClass('open')) { - console.log('hi'); $('input#search-box').focus(); - console.log('hi2'); } overlay.css({top: 120}); From 5027bc98cf8040009903baeb356e585bac6bf854 Mon Sep 17 00:00:00 2001 From: Vincent Fiduccia Date: Tue, 10 Jul 2018 12:35:55 -0700 Subject: [PATCH 19/35] Algolia publish image --- .drone.yml | 12 ++++++++++++ Dockerfile.algolia | 9 +++++++++ Dockerfile.dev | 9 --------- Dockerfile.prod | 1 - Dockerfile.staging | 1 - 5 files changed, 21 insertions(+), 11 deletions(-) create mode 100644 Dockerfile.algolia diff --git a/.drone.yml b/.drone.yml index a719452dea7..7ff3e3e32c8 100644 --- a/.drone.yml +++ b/.drone.yml @@ -11,6 +11,18 @@ pipeline: when: event: [pull_request] + docker-publish-algolia: + group: publish + image: plugins/docker + dockerfile: Dockerfile.algolia + repo: rancher/docs + context: . + tag: dev + secrets: [docker_username, docker_password] + when: + branch: master + event: push + docker-publish-dev: group: publish image: plugins/docker diff --git a/Dockerfile.algolia b/Dockerfile.algolia new file mode 100644 index 00000000000..70dd59f6c43 --- /dev/null +++ b/Dockerfile.algolia @@ -0,0 +1,9 @@ +FROM rancher/docs:build + +VOLUME /usr/share/nginx/html/docs +WORKDIR /run + +COPY gulpfile.babel.js /run/ + +ENTRYPOINT ["gulp"] +CMD ["publish:seach-index"] diff --git a/Dockerfile.dev b/Dockerfile.dev index 30b14aee341..26ce67c09b6 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -1,8 +1,4 @@ FROM rancher/docs:build -ARG ALGOLIA_APP_ID -ARG ALGOLIA_INDEX_NAME -ARG ALGOLIA_INDEX_FILE -ARG ALGOLIA_ADMIN_KEY VOLUME ["/site"] WORKDIR /run @@ -25,11 +21,6 @@ COPY gulpfile.babel.js /run/ ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz master.tar.gz RUN mkdir -p /run/node_modules/rancher-website-theme && tar -xzf master.tar.gz --strip 1 -C /run/node_modules/rancher-website-theme && rm master.tar.gz -ENV ALGOLIA_APP_ID=$ALGOLIA_APP_ID -ENV ALGOLIA_INDEX_NAME=$ALGOLIA_INDEX_NAME -ENV ALGOLIA_INDEX_FILE=$ALGOLIA_INDEX_FILE -ENV ALGOLIA_ADMIN_KEY=$ALGOLIA_ADMIN_KEY - # Expose default hugo port EXPOSE 9001 diff --git a/Dockerfile.prod b/Dockerfile.prod index 76883d6a6ea..8be911c05fb 100644 --- a/Dockerfile.prod +++ b/Dockerfile.prod @@ -36,5 +36,4 @@ RUN stat /run/public/index.html FROM nginx VOLUME /usr/share/nginx/html/docs COPY --from=build /run/public /usr/share/nginx/html/docs/ -COPY gulpfile.babel.js /usr/share/nginx/html/docs/ COPY nginx.conf /etc/nginx/conf.d/default.conf diff --git a/Dockerfile.staging b/Dockerfile.staging index e13c6d16a1e..2cd841f0991 100644 --- a/Dockerfile.staging +++ b/Dockerfile.staging @@ -35,5 +35,4 @@ RUN stat /run/public/index.html FROM nginx VOLUME /usr/share/nginx/html/docs COPY --from=build /run/public /usr/share/nginx/html/docs/ -COPY gulpfile.babel.js /usr/share/nginx/html/docs/ COPY nginx.conf /etc/nginx/conf.d/default.conf From 7f0031403a573fdca7909141d9adf8036eb1fea7 Mon Sep 17 00:00:00 2001 From: Vincent Fiduccia Date: Tue, 10 Jul 2018 12:48:31 -0700 Subject: [PATCH 20/35] More tags --- .drone.yml | 2 +- Dockerfile.algolia | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.drone.yml b/.drone.yml index 7ff3e3e32c8..c8b5aa426c8 100644 --- a/.drone.yml +++ b/.drone.yml @@ -17,7 +17,7 @@ pipeline: dockerfile: Dockerfile.algolia repo: rancher/docs context: . - tag: dev + tag: algolia secrets: [docker_username, docker_password] when: branch: master diff --git a/Dockerfile.algolia b/Dockerfile.algolia index 70dd59f6c43..3107ac79636 100644 --- a/Dockerfile.algolia +++ b/Dockerfile.algolia @@ -6,4 +6,4 @@ WORKDIR /run COPY gulpfile.babel.js /run/ ENTRYPOINT ["gulp"] -CMD ["publish:seach-index"] +CMD ["publish:search-index"] From e7f5f1a96b14484fcb50a4e2418c74ba0e8650d1 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Steenis Date: Tue, 10 Jul 2018 23:06:17 +0200 Subject: [PATCH 21/35] Fix broken backup link --- content/rancher/v2.x/en/installation/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/installation/_index.md b/content/rancher/v2.x/en/installation/_index.md index 911632a6c33..b3f63e9abbc 100644 --- a/content/rancher/v2.x/en/installation/_index.md +++ b/content/rancher/v2.x/en/installation/_index.md @@ -28,7 +28,7 @@ Choose from the following installation options: This section also includes help content for Rancher configuration and maintenance. -- [Backups and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/) +- [Backups and Rollbacks]({{< baseurl >}}/rancher/v2.x/en/backups/) This page lists the ports you must open to operate Rancher. From ce9d855c5132121958f13f13bcb3cee09642e445 Mon Sep 17 00:00:00 2001 From: Vincent Fiduccia Date: Tue, 10 Jul 2018 14:15:16 -0700 Subject: [PATCH 22/35] Giddyup --- Dockerfile.algolia | 3 +++ gulpfile.babel.js | 14 +++++++++----- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/Dockerfile.algolia b/Dockerfile.algolia index 3107ac79636..9212eafcc24 100644 --- a/Dockerfile.algolia +++ b/Dockerfile.algolia @@ -3,6 +3,9 @@ FROM rancher/docs:build VOLUME /usr/share/nginx/html/docs WORKDIR /run +ADD https://github.com/rancher/giddyup/releases/download/v0.19.0/giddyup /usr/bin/giddyup +RUN chmod +x /usr/bin/giddyup + COPY gulpfile.babel.js /run/ ENTRYPOINT ["gulp"] diff --git a/gulpfile.babel.js b/gulpfile.babel.js index f4066c85c15..c9cbc01e9b4 100644 --- a/gulpfile.babel.js +++ b/gulpfile.babel.js @@ -194,18 +194,22 @@ gulp.task('publish:search-index', (cb) => { env: env }; - return exec('giddyup leader check', opts).on('close', code => { - + return exec('giddyup leader check', opts, function(err, stdout, stderr) { + console.log('Error:', err); + console.log('Stdout:', stdout); + console.log('Stderr:', stderr); + }).on('close', code => { if (code === 0) { - + console.log('Publishing to algolia', process.env.ALGOLIA_INDEX_NAME); const rawdata = fs.readFileSync('public/final.algolia.json'); const merged = JSON.parse(rawdata); atomicalgolia(process.env.ALGOLIA_INDEX_NAME, merged, (err, result) => { console.log(result); cb(err); }); - + } else { + console.log('I am not the leader (' + code + ')'); + cb(new Error('Not the leader')); } - }); }); From bdb2bfde37ba13dfb386af113a74d0759851d453 Mon Sep 17 00:00:00 2001 From: Westly Wright Date: Tue, 10 Jul 2018 14:26:12 -0700 Subject: [PATCH 23/35] pass file path rather then data to algolia --- gulpfile.babel.js | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/gulpfile.babel.js b/gulpfile.babel.js index c9cbc01e9b4..cffac83eee8 100644 --- a/gulpfile.babel.js +++ b/gulpfile.babel.js @@ -201,9 +201,7 @@ gulp.task('publish:search-index', (cb) => { }).on('close', code => { if (code === 0) { console.log('Publishing to algolia', process.env.ALGOLIA_INDEX_NAME); - const rawdata = fs.readFileSync('public/final.algolia.json'); - const merged = JSON.parse(rawdata); - atomicalgolia(process.env.ALGOLIA_INDEX_NAME, merged, (err, result) => { + atomicalgolia(process.env.ALGOLIA_INDEX_NAME, process.env.ALGOLIA_INDEX_FILE, (err, result) => { console.log(result); cb(err); }); From 0342cf28f09179fffb554f85aa47a05ca70a7b50 Mon Sep 17 00:00:00 2001 From: Westly Wright Date: Tue, 10 Jul 2018 14:43:11 -0700 Subject: [PATCH 24/35] Debug the pipes --- gulpfile.babel.js | 38 ++++++++++++++++++++++---------------- scripts/build-algolia.js | 4 ++++ 2 files changed, 26 insertions(+), 16 deletions(-) diff --git a/gulpfile.babel.js b/gulpfile.babel.js index cffac83eee8..60e8f0b19ef 100644 --- a/gulpfile.babel.js +++ b/gulpfile.babel.js @@ -194,20 +194,26 @@ gulp.task('publish:search-index', (cb) => { env: env }; - return exec('giddyup leader check', opts, function(err, stdout, stderr) { - console.log('Error:', err); - console.log('Stdout:', stdout); - console.log('Stderr:', stderr); - }).on('close', code => { - if (code === 0) { - console.log('Publishing to algolia', process.env.ALGOLIA_INDEX_NAME); - atomicalgolia(process.env.ALGOLIA_INDEX_NAME, process.env.ALGOLIA_INDEX_FILE, (err, result) => { - console.log(result); - cb(err); - }); - } else { - console.log('I am not the leader (' + code + ')'); - cb(new Error('Not the leader')); - } - }); + + console.log('Waiting'); + setTimeout(() => { + console.log('Done'); + exec('giddyup leader check', opts, function(err, stdout, stderr) { + console.log('Error:', err); + console.log('Stdout:', stdout); + console.log('Stderr:', stderr); + }).on('close', code => { + if (code === 0) { + console.log('Publishing to algolia', process.env.ALGOLIA_INDEX_NAME); + atomicalgolia(process.env.ALGOLIA_INDEX_NAME, process.env.ALGOLIA_INDEX_FILE, (err, result) => { + console.log(result); + cb(err); + }); + } else { + console.log('I am not the leader (' + code + ')'); + cb(new Error('Not the leader')); + } + }); + }, 10000); + }); diff --git a/scripts/build-algolia.js b/scripts/build-algolia.js index b14165ffbd9..39434be1fb7 100755 --- a/scripts/build-algolia.js +++ b/scripts/build-algolia.js @@ -65,6 +65,10 @@ nodes.forEach(node => { // objectID is not quite unique yet so hash the entire object paragraphOut.objectID = md5(JSON.stringify(paragraphOut)); + if (paragraphOut.objectID === "d41d8cd98f00b204e9800998ecf8427e") { + console.log(paragraphOut) + console.log(JSON.stringify(paragraphOut)) + } nue.push(paragraphOut); } From 7db06e6168ac6d5ee870c2887cb40ff3cdb80750 Mon Sep 17 00:00:00 2001 From: Vincent Fiduccia Date: Tue, 10 Jul 2018 14:49:18 -0700 Subject: [PATCH 25/35] Remove unused variables --- Dockerfile.prod | 11 ----------- Dockerfile.staging | 10 ---------- 2 files changed, 21 deletions(-) diff --git a/Dockerfile.prod b/Dockerfile.prod index 8be911c05fb..65bc10b5b7a 100644 --- a/Dockerfile.prod +++ b/Dockerfile.prod @@ -1,11 +1,6 @@ FROM rancher/docs:build as build -ARG ALGOLIA_APP_ID -ARG ALGOLIA_INDEX_NAME -ARG ALGOLIA_INDEX_FILE -ARG ALGOLIA_ADMIN_KEY WORKDIR /run - COPY gulpfile.babel.js /run/ COPY .eslintrc.js /run/ COPY config.toml /run/ @@ -22,12 +17,6 @@ ENV HUGO_ENV production ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz master.tar.gz RUN tar -xzf master.tar.gz --strip 1 -C /run/node_modules/rancher-website-theme && rm master.tar.gz - -ENV ALGOLIA_APP_ID=$ALGOLIA_APP_ID -ENV ALGOLIA_INDEX_NAME=$ALGOLIA_INDEX_NAME -ENV ALGOLIA_INDEX_FILE=$ALGOLIA_INDEX_FILE -ENV ALGOLIA_ADMIN_KEY=$ALGOLIA_ADMIN_KEY - RUN gulp build # Make sure something got built diff --git a/Dockerfile.staging b/Dockerfile.staging index 2cd841f0991..fc2fbeee1df 100644 --- a/Dockerfile.staging +++ b/Dockerfile.staging @@ -1,11 +1,6 @@ FROM rancher/docs:build as build -ARG ALGOLIA_APP_ID -ARG ALGOLIA_INDEX_NAME -ARG ALGOLIA_INDEX_FILE -ARG ALGOLIA_ADMIN_KEY WORKDIR /run - COPY gulpfile.babel.js /run/ COPY .eslintrc.js /run/ COPY config.toml /run/ @@ -22,11 +17,6 @@ ENV HUGO_ENV production ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz master.tar.gz RUN tar -xzf master.tar.gz --strip 1 -C /run/node_modules/rancher-website-theme && rm master.tar.gz -ENV ALGOLIA_APP_ID=$ALGOLIA_APP_ID -ENV ALGOLIA_INDEX_NAME=$ALGOLIA_INDEX_NAME -ENV ALGOLIA_INDEX_FILE=$ALGOLIA_INDEX_FILE -ENV ALGOLIA_ADMIN_KEY=$ALGOLIA_ADMIN_KEY - RUN gulp build-staging # Make sure something got built From 45ea82b0adcace484fb629ecb5690a8fe26387d2 Mon Sep 17 00:00:00 2001 From: Vincent Fiduccia Date: Tue, 10 Jul 2018 14:56:46 -0700 Subject: [PATCH 26/35] Moar logging --- gulpfile.babel.js | 2 +- scripts/build-algolia.js | 9 ++++++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/gulpfile.babel.js b/gulpfile.babel.js index 60e8f0b19ef..1bad647a806 100644 --- a/gulpfile.babel.js +++ b/gulpfile.babel.js @@ -205,7 +205,7 @@ gulp.task('publish:search-index', (cb) => { }).on('close', code => { if (code === 0) { console.log('Publishing to algolia', process.env.ALGOLIA_INDEX_NAME); - atomicalgolia(process.env.ALGOLIA_INDEX_NAME, process.env.ALGOLIA_INDEX_FILE, (err, result) => { + atomicalgolia(process.env.ALGOLIA_INDEX_NAME, process.env.ALGOLIA_INDEX_FILE, {verbose: true}, (err, result) => { console.log(result); cb(err); }); diff --git a/scripts/build-algolia.js b/scripts/build-algolia.js index 39434be1fb7..5debce1487c 100755 --- a/scripts/build-algolia.js +++ b/scripts/build-algolia.js @@ -65,9 +65,12 @@ nodes.forEach(node => { // objectID is not quite unique yet so hash the entire object paragraphOut.objectID = md5(JSON.stringify(paragraphOut)); - if (paragraphOut.objectID === "d41d8cd98f00b204e9800998ecf8427e") { - console.log(paragraphOut) - console.log(JSON.stringify(paragraphOut)) + if (true || paragraphOut.objectID === "d41d8cd98f00b204e9800998ecf8427e") { + console.log('===================================='); + console.log('ID:',paragraphOut.objectID); + console.log('Paragraph:',paragraphOut) + console.log('JSON:',JSON.stringify(paragraphOut)) + console.log('===================================='); } nue.push(paragraphOut); From 5bd24ad3eabbb03b87a61e3cb9f73c27ce4ee321 Mon Sep 17 00:00:00 2001 From: Westly Wright Date: Tue, 10 Jul 2018 15:13:43 -0700 Subject: [PATCH 27/35] more debug --- scripts/build-algolia.js | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/scripts/build-algolia.js b/scripts/build-algolia.js index 5debce1487c..f98bc4fa10f 100755 --- a/scripts/build-algolia.js +++ b/scripts/build-algolia.js @@ -38,7 +38,7 @@ nodes.forEach(node => { let next = child.nextElementSibling; while(next && next.tagName !== 'H2') { - if (next) { + if (next && next.textContent) { paragraphOut.content += next.textContent; } next = next.nextElementSibling; @@ -73,7 +73,7 @@ nodes.forEach(node => { console.log('===================================='); } - nue.push(paragraphOut); + nue.push(node); } @@ -85,7 +85,6 @@ nodes.forEach(node => { }); -const merged = [...nodes, ...nue]; -fs.writeFileSync('public/final.algolia.json', JSON.stringify(merged)); +fs.writeFileSync('public/final.algoia.json', JSON.stringify(nue)); process.exit(0); From 362bba9a4715a0e0e9a13149f7e55950005a8912 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Steenis Date: Tue, 10 Jul 2018 23:29:30 +0200 Subject: [PATCH 28/35] Add RHEL/CentOS upstream/native differentiation --- .../rke/v0.1.x/en/installation/os/_index.md | 21 ++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/content/rke/v0.1.x/en/installation/os/_index.md b/content/rke/v0.1.x/en/installation/os/_index.md index 30f7f5c1b4d..1246195ae07 100644 --- a/content/rke/v0.1.x/en/installation/os/_index.md +++ b/content/rke/v0.1.x/en/installation/os/_index.md @@ -12,11 +12,30 @@ RKE runs on almost any Linux OS with Docker installed. Most of the development a ``` See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) to see how you can configure access to Docker without using the `root` user. + - Swap should be disabled on any worker nodes ### RedHat Enterprise Linux (RHEL) / CentOS -If using RedHat Enterprise Linux or CentOS, you cannot use the `root` user as [SSH user]({{< baseurl >}}/rke/v0.1.x/en/config-options/nodes/#ssh-user) due to [Bugzilla 1527565](https://bugzilla.redhat.com/show_bug.cgi?id=1527565). If you are using the Docker package supplied by RedHat / CentOS, the `dockerroot` group is automatically added to the system. You will need to edit (or create) `/etc/docker/daemon.json` to include the following: +If using RedHat Enterprise Linux or CentOS, you cannot use the `root` user as [SSH user]({{< baseurl >}}/rke/v0.1.x/en/config-options/nodes/#ssh-user) due to [Bugzilla 1527565](https://bugzilla.redhat.com/show_bug.cgi?id=1527565). Please follow the instructions below how to setup Docker correctly, based on the way you installed Docker on the node. + +#### Using upstream Docker +If you are using upstream Docker, the package name is `docker-ce` or `docker-ee`. You can check the installed package by executing: + +``` +rpm -q docker-ce +``` + +When using the upstream Docker packages, please follow [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user). + +#### Using RHEL/CentOS packaged Docker +If you are using the Docker Docker package supplied by RedHat / CentOS, the package name is `docker`. You can check the installed package by executing: + +``` +rpm -q docker +``` + +If you are using the Docker package supplied by RedHat / CentOS, the `dockerroot` group is automatically added to the system. You will need to edit (or create) `/etc/docker/daemon.json` to include the following: ``` { From c51d9b4662dd472a768751aacf9b22945f8a99ef Mon Sep 17 00:00:00 2001 From: Westly Wright Date: Tue, 10 Jul 2018 15:20:20 -0700 Subject: [PATCH 29/35] update node arrays --- scripts/build-algolia.js | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/scripts/build-algolia.js b/scripts/build-algolia.js index f98bc4fa10f..7f762f2480d 100755 --- a/scripts/build-algolia.js +++ b/scripts/build-algolia.js @@ -7,7 +7,8 @@ const { const md5 = require('md5'); const atomicalgolia = require("atomic-algolia"); const fs = require('fs'); -const nue = []; +const newNodes = []; +const newParagraphs = []; const rawdata = fs.readFileSync('public/algolia.json'); const nodes = JSON.parse(rawdata); @@ -73,7 +74,8 @@ nodes.forEach(node => { console.log('===================================='); } - nue.push(node); + newParagraphs.push(paragraphOut); + newNodes.push(node); } @@ -85,6 +87,7 @@ nodes.forEach(node => { }); +const merged = [...newParagraphs, ...newNodes]; -fs.writeFileSync('public/final.algoia.json', JSON.stringify(nue)); +fs.writeFileSync('public/final.algoia.json', JSON.stringify(merged)); process.exit(0); From 746d50ae0e7806d6988f4626798f933ad42861cc Mon Sep 17 00:00:00 2001 From: Westly Wright Date: Tue, 10 Jul 2018 15:24:49 -0700 Subject: [PATCH 30/35] algoia -> algolia --- scripts/build-algolia.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/build-algolia.js b/scripts/build-algolia.js index 7f762f2480d..ebbf2fb4b5f 100755 --- a/scripts/build-algolia.js +++ b/scripts/build-algolia.js @@ -89,5 +89,5 @@ nodes.forEach(node => { const merged = [...newParagraphs, ...newNodes]; -fs.writeFileSync('public/final.algoia.json', JSON.stringify(merged)); +fs.writeFileSync('public/final.algolia.json', JSON.stringify(merged)); process.exit(0); From 08ab8312342c8ea56645d6031119d024780cd627 Mon Sep 17 00:00:00 2001 From: Denise Schannon Date: Tue, 10 Jul 2018 18:08:34 -0700 Subject: [PATCH 31/35] update rancheros to using t2.small --- .../running-rancheros/cloud/aws/_index.md | 2 +- src/img/os/Rancher_aws5.png | Bin 27824 -> 136708 bytes 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/content/os/v1.x/en/installation/running-rancheros/cloud/aws/_index.md b/content/os/v1.x/en/installation/running-rancheros/cloud/aws/_index.md index 69e691183ac..969fc387daa 100644 --- a/content/os/v1.x/en/installation/running-rancheros/cloud/aws/_index.md +++ b/content/os/v1.x/en/installation/running-rancheros/cloud/aws/_index.md @@ -14,7 +14,7 @@ Once you've installed your AWS CLI, use this command to launch an EC2 instance w > **Note:** Check the RancherOS [README](https://github.com/rancher/os/blob/master/README.md) for AMI names for each region. We support PV and HVM types of AMIs. ``` -$ aws ec2 run-instances --image-id ami-ID# --count 1 --instance-type t2.micro --key-name MySSHKeyName --security-groups sg-name +$ aws ec2 run-instances --image-id ami-ID# --count 1 --instance-type t2.small --key-name MySSHKeyName --security-groups sg-name ``` Your EC2 instance is now running RancherOS! diff --git a/src/img/os/Rancher_aws5.png b/src/img/os/Rancher_aws5.png index d3d88dcec15c77510acf69dc3a87c1ce45b0a0e5..5f12f339b21bd92775648c205d327853b22c8276 100644 GIT binary patch literal 136708 zcmb5V1ymecvo<_1guykq4W1C(b%5Z(B?%TJxHGuB26sqs2qA&sn&2870tv2z1$URP zIq$Xqp7&qtTvpGTp}Y6qy?52Fdg`g_NHrBXYz%S?5D0{=ATO-}0-@o6K**2LP=Pb? zIyVv^5Y}TWDJeAtDJiI$lY_aHtr-X;ADQwRqOI9SoUNyUhR%kE^fXUE(kq4BD-DPL zIRP{|0$s8zmYrn^Ghch`C7#SA@{fGFw-)LZli_qM{ok}J@{X7ux%lpSZ(Oer=kRP~ zUXIN1BsGGb%vK#AIjIqWoE}|vq(jBcHJmV#PDt@U=ubdm5=PF_o-Jcz%b|Or2?4 za1R^i=KkP4OQPjhy{1*^S$ta*(_>oABU{Nz@;UzYGQWxPtn}Vl=&pWsJwk4sGbHBy zQ>@s8RjkRc!ror#D4MkP#Dy}llBKAJk6^E@IojQMy4w$(uKi*o9!+9#f+UdAc4<&6 zak{YJZcXKsv(=#*hL&-%N5@httAfgcVzSgUYlWBG#((qyVNUjuUR&?^bLUdv2Z8apk9%Vd=Pz^BL)lR zybrT_x#FX9yKbA$5f38BtVNqZHTf~DBXHmtHy+;BAS&6ENr752z#+S*mzYM#R^MB9 z=oIwUbUT`gfT%0>!fmY+Iq56-OfZUyoGoYD*TByuGnyhc$gvIiE&#o&;$z?+DCU94 z6~)yu$Fw}u2u%9}Bx=Mq8STOFLJsAC4D(%E4&Gsa<-~}pa6kBw+P$mRGjH8smp_() z6Z90Kp@JlnJSo;;UE&GB>EF@NjquOyK^^W8*%~QYpFY0WcS+`8Tq<>5NmNxUeS;|+jU`)vh zR`XaFX2W{M6`VHOI;{Y(Gt+aRUgsd&=k*I$b;qP6)hJh?O zTDDqd>ye3tBHvfv{Y$U3<0>;NKbqjiHJ1c$X>WCH4*s70I9|q6T=I#c@WZF?3g^-G zt<+K@avX{d%?k?6FyC)2X)r_o=DVl2Budyt96aGV?Y1U3q?@ED6cN~NxFn`|hB^bIzY*Y+&X$A7r^~onTk_Yvl{0^&is=D;+D(Zj4%|x)nXU+AT^s z(hYtU&NAycHk&WC<*tFQUr*^N!jv17E0u$XN)CGvnmy%Y{(d(Cdd#zwv-5T5I}I$K z+nvO%s_wPal5aLO+fI|1_9z14^_TWT_BnG|^T+eJ-|yFqcN2CiM-Z1N)#y#=-+`ZhqxtcYa-8@{qDLks1OPXk|NiQ9J&n`rdYY&Ew=J&7rM}Dhrx)1Jy2eSCm zeyzk^LN3#;+);`jbwO-#JV-4`)A6+_1o2iM^NJKRrsGi(H!)qjim*pxE@U!=PB6OI zTk4VWvGUtGPazx!9F09RQONPhE7@243Ka^WRkRq=q0(QYyzuOZ#ptijBfBEU2%j;- zVk)CD2%TZ6)FNzdhCA1Stqm{X=PN^q?!&L>{pd-A)&wwyE9Nrg9ToB%UV%SORc_qk zja;G0iSbp;W{w(dh1f}6%p%I{89vVMrjt9Kl6TZpoA@U&7BKFD5;5?Skv(C${@J(GSHLK1hdPICHOp!B`F)!R} zG~6K+w|+G|FNB+s#$WE*GIrB_>`j8gR%{@zliqv~_jY!rwtJtLk=$5p%B;TmiSeC?=vmn7qVgT> zwI=IX>lN$vtq(R$lUn63-{{rUS-k1`c6B;<`f+>FF1>E~ZKKKMSxj=wO3XabGEvNj zXo0T_CuYv;>l7(|DUkY2Tb;VK&R2WC%j{sYTXoy^9J6 z`QhN`V6*Tx+QU4O){l2?$Bt9Wzv;{5wqoB?&O1f>mDW&y&Uq<58b3WcpFTI`DSF~z zlO#7@xoGFNIBPqq@A(|j^(84eDM}S5heeogDsl3szc9i@b-U)bw?*QxzQc#9-*En& zolxh%jp595G5@WgjnMU|J(4&>r{)RA=}RZy@0!<@;+c1XznACK{kzv*AYRs&C}$B0 ztGao*XSJ;R@6MgZZ>Kp(FKjlE`5&Ks?W_Oh;OrpYn&iB3Iv@01>YR9vd5*(3_bB%! zZ@BY|zxEBnsNVTJQtmEphNc(RGTHgZ^HTa`RdIjiQ_ZKfk&~QXqV@g@b0kylr`?4l z%^b%DIHzehpRYDjU$2+P-mM+KzLxkYv2U}yy(}=WXx%)2J$(3P+vsGe^Sp6C9G2`i zaix9RcRGGK5}A{OJ#_Q@O5^a?ip_X^g~NHcb9ngi)bqL%mVoxKqEFxha}H3ADQNTc z@~x!8*)AiI^jY&0nI&=K>GKS&Or+xAtkwP@YosMS+oFmwVi2^^tM?K#(QaJRCzHHq z#1SPEYRDN9*V*adiUj3DI(R84Dq7>}aj|VLe})5M<1tX}f4ED+!x8*s&X%I=nSw_poyW z?goKGJ%oXuc4jWdP!Bs>duL$}F}lC*5C(ofoaUf|{&kCsjToJ_vKmy%!O0BD$Ii>n zNe9D#LZPBgrsl#L(z5^29QaR+&eFxjQJ90n-QAttorm4Q$%2DRNJxl-lbeH^n+>>w z&Dqo5#n^+*-kJVio&0A%(q_&kPF9XCRu1;ihklLUI=H%s(a}8&^k0AfdQLMBtN$L! z-uXYK1x%3R;R**AJ156~^$j!?eK;$uX60dKt1WG1XJ+pVi~-~3O~|wOoIl1=b6OA6_Ox-y8Hd7Z?z;$o`!CDUmY)gdYEo4=s7*6idqD_}gLGq<`EfK7dIA0fHd^U&b*) z=Ec!k8nzf$2tbklr$-M`ED{0qA0NeSD8O9WvPO#j4|4&_0L5gFYyQvqr{^&2{q(yE*#OD;kOxgyX0^D-o6c*`214FS}QKCD?~ft#g^k8Lsye% zZLn{WW9D^OSRA2ed^oLI{~}Gw1cjdR$z#4tgSRF}3}sGbKIgMcn%>P~-yEd+h9eWe zjVTNQlLB2Y*%$dfHu+vT4|s`x;n;2&c}A(p!NZOFqfAVv%1-XRsj2A}{~Jdo=SD=+ zaLbv@g?Dc(Rh9d`LDuYGzOuYLUPP-wWOY+>u~w!@y4`LHULG9}&v+zifX$beB}}!} zzmC3%u9|HB{+cu~q2()P?lD=aqe(#k{q6ND6v1O!)5M8_9N0seU)APV>%5^Nwyv(# z>~&gbHC{xU+^_g=c606tKCo*~PSI_oA9gL#JBh*`q*>n4LUm;;Ee@Tk6!~-nTIdUd z5Q!ha4QhL6U0VG~{apDh{F*5geg~48QMXwH$+HhinTbk%3bmq> zt^Ll8MYv^QV*Raju|c!GRB#>WTCLg3mF>rKkJ|3n*L>2vdn7l3w7B=@Y4|$hKYyBz zWQ%$E5ci52eL&?b_^y&A>~%A3GU_*Uw{%@y*c*Ji(G~4Zh!5Vdq^>|ev-0l%5-EH3lU$3?w zsvTHq^eo`Q4x18*M-VA+C>Ot+U)F{LrC^PPN#Bpy1XfarQ!*Ts_)1tsfcO%nJe;uJw$6CqmW-5we~VZ@+jD;aa=|Lr);W;r?i5GN%fdiZ*F;9CAy!x} zN{204h_!hoJ{l%<$+e5q9tjq7bA45kI!r=`9JkoU?6jmRmOq|Z0p57jdxKr{)XQ7` zyr+t$ClH)+VgZH`+LAS~){fAz{?`$xAqm)Q zjWO&}ln15I(nnqKl*zYn&@yh0 z&8SJGzLb8c{PQ(^h3Ju_P{n!$S=pixLf1BFiioHv=Z;ni5woZJzWntb7}~v)F2=TVt8m>(hOk zI+FT#WRT2vQ8AmRqv%reTMa-LM~9z18xwsMx*hkrC~&nwG-I0^=VWU}`)5kt z6Ga(%Nrptx)9Kt-oNx^tYYrB>Ns`@O(Y+U8f!sI@Pf5CR$9J>#(i35tTy@M6*na5=K`iDp#IBimv|Vx{cbu?(VbJpHgKr z$xdYlx@TUwIO*)n(vWTwTLA94xvzEI{{6AIs1)OGrU!(M!mO4T4aP%+<4}F+e1qDn zaj_$XE2bsyqN1pnbiLndxIUbvCm6hq7IG~|?kQ`Xp{D;&+M)5*fTju-7!O~im`+|C2WQqpf z+p1aIN}s`WF4}cg|FmgVRBUnvz$vo$$CyU-GXy%ufXy?4hIh9Vqpxg#^&s&T2r`cd zbgB<^54htvZab^RgN51@H2r#zb|ll`G$kFU%w1QhEEmpWvaKVn+5LjK^f;SlNGhwFsmQ+Fs{-NK>jMkT~I*_N|zGCKz^l1PmkWy0y9g8qa(vjz(=SUIGOL zTJ)ZVv>x9Tnz@EC$o2+m4N~N2u2IuTmmIG$Q*6g715ByV zMc;Z#&(#F;*AA7aD=DuHbPDrmX=x=F{I2ajzxw*#@XkoY|Nhop8u>5)3A|c2YmYfw zj91E@kXe0QYTOyd?YcD)PbZM>J-sV_Jji3V`XgaoD|9wdCUpCVdwdC4(s?-_cA*!b zonN&H+}OoxtJc`ZtY(xyG<%S0H3A*X%Ls@LmWY1_B`Vh9_4pnwc|4)nhn&Wy_V){d z#zeW|;kkA6&_08{QgGRV-a=xe{f>wTOO1jw={TL+EOBygnq18{MDBkY3$R zhChdg9*h{5W5aXkOy0m9z8gO|Q8AEj$czeA+{4Kf9w;4lSZ*ig2Wo}v>n z32rx{Zli=8_bRbg>r0rM7hzHGD^-*RD5MX;d@dZDYXXGAwktx~0V%Aq#syrrTy2#I zuQHW&f-43%TJ?W_)w8Jj;}k2r^@QsEar61Yany5=fs3dLzil!X}!M_f!O zEk|<$b2x3HR%nU3qU76x0{}}N>Iv0Hv}Fo8yL`4sfOPtQlD!rrBVvw^lw~)4#AuyFn*@jLscYvv#{6eY-i}}>x7?~qrn;Z zF<_OhK&P`yBj+}aM+%3WYSQ+U5?x3PgFCV-*Pnb^{O^YRLUllW(v(wGW>E{cd@BKV zluH+@9;~~I+j9sid`P?{av?tIJ#bZ3@`fN7|lf6L#YDtexC9GA} zu!7+%ymU4su$Vk)=>I0CHxZmZABTn-@r2W?|FJKnI%ZEanPxGT=n@6j+mKTIMvWZr zi{4*pp)~bT$3S~L`JnrCoW%>#UPUdQZG*l?5?#o#keq}<(Iy%no?Ut# zoaFGc4~JL?iD+)MuBYHf(cs9`K)S>T@MCjK81vx9qxx>1+{REXa>%>hBt)glv2&a| zIpjsVKezUyznkO=AgVHoEXy1Hz-N;xde}vH_4DGw!wwW+WS|u^irtAs-A_l8j|Rk# zFZaG}vtRDkFS?w4%J%xAR)droknRt_6B{nlYh1CD_>rRH%uXs$wsrH2042u0JV%C@PR?7|HM@r6_A$C*Qc+be9eQbcv>h z3;FbJC5mG;!y+4=noKHSpLw#sXjq-aWfInOb2Kn4q{%)L<|N{_^90b*W|$HpAg|NT z3X1m`o-1b|O^GK}(e8W1Ns$)4A{^-<_Tq$bPWoDz@_GOL^n#8w7u5}wby=iHo(tNLvO?S_cB1*dd7GpOk!ck|(x zQWrB!3%%eSHvG~y0l~FDyyJ=dD}IA5;BI~01uXd6V}_@+96(GY>JMuZ%tgkL*IyGg z>_Qrlz>kEt`KYdFJmP(u(VEsh|9-!7DxXz)=Q)P^XJk@{AWVooN`zWbxYfJq{&dpN ztI7E@a!g?B->rB*8bFV|Gp0n7Ys2NG#tU0u^$w^w^2l9Q!8_pizQcXnhJ`FBZ99mC z$w;b6*;ZTLa`mO@_H5SUX)r2wqI!X>71A)jN-le681^{Nt@^%96mj3P@}`w^ z3;_GnCNU}hq!S(_7MOQQV#jSo#Q~sKwnx5!IY^OHDO+@UIUoW{n;OaZra2niKr)CK z!5I)fTfE)md7N2ATUKv1F1tUwD?kGM2{vD%9~7rHYB}tosPegVa@JLWU7Au|woz6T zC@qm5(SHM(AJ88mU6}w6vhGAC>QSNZ`s?NJ-CzdKS~rQI%bBX+GK$dM1>%u9Mull` z7ERbA>4G-xfHt#ZHw-n7c#_jzUjW&b&|{|`YrkJQ8sL~z$9M$X9ap(cO*aN!6y~j)R7!3hR>WoZ4;;ym$Gil$Yn-7hSt{sl~j0 zTpS{HZIO#O!K8IhDC}G*Akfmz%+X?XdgfL=qk4Mcsa-kLK}WAYAJZ^o9!o^{PvH0Q zTL6*ZKs>EfrkAG-L)$Hl?}_^5`Ui*1oAFPoX}bN%LC#FpAe9BTS-TnDJdVNpP{=8X zp-&~w;ydqI&-ostbe0M&R3%J#dl;u_?yZNB8Nrt0{q6ZcocNt3PUIiW4Ul1cnT|7t3&%8K-mKXVy1db05q2HLfTH$Z2i}YY+o-@-ciFcezbKOettNWQ15ph5o1Q{rLnFGJ+>r=K({_vBD=kT*5r8aH6~_f?~yEn zjPJOrsh`Gs#AV##)we&+yXC50WQ(3H0$sOY60?pXi^XQ3p?lcX)8qq4X{rdUAB+OW zM~wl(vOl+q6B^hNMF*X@;+A7nkX=jA72P&Tmp>_%+y27WI0KL6P;LOUiX$X)ZyM^k z&`@}ApyH%&U*#&e@uH+-;LU^d+=Ko+D#AU%B!~gqKc5p%N1@}#aj}M4W%Tp5MSx+! zAzUvU6{$G~lM(RTN6thA;s81#Ks-~>&@W@vuIk=5DfNDI;e*zbCkQ~PPm(`-N}NPv zr&<#4Gb^O(<({p8dM*0S^*ryc)f4x<&pkfD+xADe-T$3^3B<6YY_s(|rn!;0O-V`l zXyIsLr!2ApqAoUiv8Aj)%UT zeagnBEGHu|bq~1HZOyY=TO?{`+IT6;{mJqi^9VEarbIi+3K`e)S~n3p^*Pu=tjRl zm#uvNs_YfZlL*dS@&b$Z&WbqJSjCakt7aFwxR6Eor!X3>eSs@D|)> zdpLs@=@HZAYbZ@YgMEa?OYKN0esTYbHyTWt(}GVDA<&CxUqes>PB9(7kL_<^I=~RB z83UbJ;&Xv)`oiBIfPQ7C+>J`%qNA*<5r(`S{1G0InV!CxflVvA-*l|fK6Apf>=p7U z+>>_B6mz34-cU665cdt)t?nwb0T*d>N~!tE zLF9ZEBVzHNfD*I%UY(4UH~X;}w&<5NpXvJcul5S^SON3|xBs2b1FAxq+?%fM&2*}3 zj|Rtyou!{_{TgT_=E(M3Cj){7)f2ArbFLJ_KdLjfL=`MjvPqFLLN|PU1t37`WI~6A6#B zx&pOYA8{S-xw%<5zznPDAw85IW@QdQE zx1ayA_$iOP{O}&D5TJGc+}kYO6H?|-=8Tc&jIsBMEgasP6)rS;Z?pOTn`|JEK~T#B zcnr2nH4zNllAY77N?Rn9DK&y41JAXTD)S+7-%9|yF~0fc0vPUSvF8_}hv<+O;qc6Z)-|0@iI z@aJMlG$K|+Wu&IJlVnyfAUryWS@kTMz_@;#xO*4z`i*N!cJ02aDrK;T=jpH4+v7!h zBe3gIpQ}HguBNaB=AfUl+}```o({C6y?Mb2A9Swo;SbjskQ-^`4Jfr z-~{1Z2_Og|qOwZ{0<{U!CvgZ#3P`jOHIV7J6Q>D+=fc}a@S!su&;iW25*-95-2dBoQhJ>Lov(TA__^9z;S} zdLXUvSQZNbo~+;Ze4ZKLa`?jOW@g^j;dc&6#Yj9V)2mlu2hh((O-5gf+pezN6HaER zc@DgXYz8!zD+&Jm5J8~^xD|c+w5@Zk`AOyU@m0O;G#%PvMDZi>y9<-N>2neTk31|I z*xZO9Ug_O~NfI4}kE42T6Tv~Zye2(ZzB&x}5NJORz(d#;bOC%OZ8(iz1F!Xj{MKYS z2S50Z`eTF<`d__mf@#SbUU=qn2^QRzivsJ&I^y zhrtYB7fWEVPD+UFA;~q~0__|L;{jqOKanjHLb#wTQT<8#!podiWh{Yi=eqMT$Q(!`Ryj%b9>%ibZ8l_0?-4qyUN_xdeM~cOQo{SoD6zMq z;Js{PO$(azXdojY*$^G%z-Bww4eKf~h=u1$i78a4v8V}?(BmYJkgd<4<)eb@cMLx! z*`P5=`zO8=T(Y7p2Ib(obs-5r$RSO4UI$aH%57|gKLrmQ&O!U<4*x#~ z9^gw698_I7EPn4JdEv>B4*H8HG-&o}gH?9!BJz>Is6PNiSW;f!i9mq5j_Kn>HFBbQ zIP@C$--@E_NT4$zk&-C|1tRUbQeaT~-@yM&SAS|8oSqrOh*n3!RacVtox27Wmxz>L z&I-{JBis*){h)S_CtP4gDIvBak9&4I)`Cwj`=dYQ+3B((d!w`*M!J}H-5w!jO##xB z=b^BOh+Y^L86CifjDJ$PQ-xhhKNxvm+k>U{pf!RybkBBDb@UzYkhhc-+Yn9EDX$or zbJ9Y1+dSr)H%*RS1aAO5fK5q(l;h&2gZSFRKRLxT8vJHn4&0}aH;TqXbr3l|Nf_RGt&DSsbm9*C9`CYV5aP?9aT!zii6uoJJ3FlbYXYU=V zAOdK+{ylI2Tu>m&PQLH~U~}RDG_=@=^?Vmdw0yN#7J(cawi!9zo=##uKc-)9pDrnH z`O-OIa^DW2N#1Y0r{*}tavda(Gp_=`2ZA;ekryT+$=Mt2!b)Y7NJWN(J3tLEc9OFR z?9C?{jY~n8gCD&xm#=|n%Dv;L-g4|YlWKP9$h7BJ50DQa`4Y|+M3E%LOOKOFxA}}U zNA0UF-y4qO?HGZDcp%yP=gs%H13dgNQ1t|e6n1}e?3X~?WQEH5VRmx}B)7}Y<2yZj@elC6KYVpzrUl5Mge zmMCqp@{LX3e6XI?*hEXO*%r0UgxEVhKi;F@&h+sQRtS_W(vrsu=l;`ln3Frth)$zq z#ifHa8BRHSkO=d|8uH~lpcE_E8l&N?b8~Y3iN>>+?}s54!&zm|GxVv$M2iI%b3hw zr~15{H!+*;YPyw?_U7-e9}Eqb?p-+3KcHksn7*nuS9Xq=4ORm3Mpl%9Kd3rp|DMH@ zmd@=Uhe%+qus+`-Nr93tIt{S>{HRFc`;>ami1-p1X)BFLkvP+_1AXRk0NG2tj`_)S zvYQ{4;itWR8^c*2b*jz%cyt}-R6Gv6=3OThetmhl+lgd2+k>P(QD>)jyEJUtR{H*Q zdlJ+9a0*ZS}fV5m|6dEEvbEjJXuM8t__ek6Cq z?-x6tbN&d}z$@A#Ai7{S^uMi5qFDnhzTOf)jVxGo^}!Xa7{NW}>3L&>2bZN1ou zD&jnFaOUj^WRDQcO=bD<eph)EOo9!`S<6+S9%H**^j;|2wt*P?_^nCHFZQ1W%T_dUY2s zInNF6_xJtT`f_I>YB~u{AkaC_GLdO+v-OEsVxr|0k4CW{TgW`0S)s+Jwq2Igc=D&b z^)8XZzJWGbG0O%TLH``oWhe5nsK~mV64#(Z0Wo3glMdM_2DcxX6v6V5m-6D~EzJLb zkJWnEJBc@eu#^%~uO{d{G}Y@1yE%}`5QOLZDvnI>=+SsIP?xb>RL_YceSMrKh{zM%#dcXVqI?kr z2aVZtCQ;Z$Fwh=J0K_5A)paAo6^B~uonEi|-rUoRN=+cwi}KvFX2zza8sRNykoF4j zn>?=#eQT>%(}z&XxyETwk1XNvG=v#tKp+MF&p{9EYV(+-`$tT9Sn0us)bO;|_-9;h z?Ok?$?e~UyK;Z#>>ojFY^MWI;#r9u;^jQD@k3WnCdpto|UI@v;tt~hhU7ohc`NcCh z?|C2r!gbpr+upMQlHBaT^Zmr-+Hp=7LRJ^bM5)BBo{-|hk*H`n>VFpeZarNmL>}@0 z;vZP_pdsYvS(Qp)>Ivv{kZ3fKNl$dbBTV8884}JSOi_=^o8ytwQmS&8gid-)oF&M^ zGBQMzUN#z!^<#inV6Eqq0*)W|W?0BmQ~(Q=tsXb&ffo)qHIv@hU)2|tyg=ga6#W$Q zT=sEbdoaX1HEx@j!=N zs$<$C7$kcrRM-0SE2Xhvh!&I8r?X3v~Y!1)pj z84Wjv%Rco<8>>qBxw=l?GAU%{S3=EA1b7SaMvK?yG()}V)tuvtBmnQPr0Bz)uIX@G z*i0!S%y|PkXJ4N4<0R)tfcGjxDutE{{8z>OFEHnbEKH@#KW^D%XuT3Y5T{*{Ad;qZ zq=38tSQ0O`2o;5PK_CPv*8CKEhZ8hCXD(a+`6K=?-E_EB+koS{R!MCbhPk?rczCge zoCEiHN1grrH@}3scbYWG05&rr8f-NG19Fsn9s=>%=(_h+V!`3i#Ayj$V%7k3YUm=C za`!NjKi~JlpYpDi;0cx6l<_b(YWK47o<&2tZ+hS1{o|xIj3T3SM&=e=8|fOGN|f0wfgNu&CuFw0eV8tFr~E^=qtuebFxyLtmyD z;4)$w%og)LNd&J4Vhhp>Bbf&*1(HyAr9++;;l|UHDrq6v9v%$%W;McQ^ql=qh-N^` z;uGEo$!F9)bhy+Jh`=Nf;o#T4hXK|A-*e@)D(4M%NHTgZ;fd#J{Dc!1b?8zJ*sr<1 zMRp#J#8x_a3rUkH_Q;%g%eRr|WP@PR?Y!9YpHtl8h=6y3@ekppCO$+9kqOz|lF`1l zuO!)(>k7ooHdr+wHuv<^eVryXQz&1ci%vj8L60__lbS)V=VsQo;cuVx^?UMh`^!bQ zn3AhsG+_}$AAVxYx4tfU%vYc*#B_Abu~?X@)K_j8m-=gh8>dl&k4rYyUVd_tmY{77 zOreOF0XQ|cJoe+)`zaZ%MOX79$)9@V{XD;JG51A^Z52166TB9Zt#WoUL&Pdw`i(0T&-!-f?(mC$&2WjTF!K?zpq4r%@tX4!Y=99iZ$FoG?^rAV2rwe<3S%K~ zMBtujK2ACUN8A-ugyO@&)1#1`+eJ_UrI!c{mi(uZPDgt{_NXAOTAFsK4J+8 zPPL)VoF1$Wx%R4|*%)*;)_iS?KaaF11s7|8W*nWWq+hSM$jY9+Y()dD({aE!ZC6CZufTTUk_~V~&o|ZG?ICTw7N5pBfYdLN&w?ltwdn_M z!~G+crry$^ue}{y>2>UZYr=Zy7E~|pNrz2Xb8(8JCQpCZEKsbA?gbu=I$W?vp5@|1 zAct4Q58j@{*2dkRFWtt`@T`wgvuax0w?0+#bNAfyCH=POd;Z1_Z4=-i*hwahZi0yJ z?!jQB{@(jBW6CxQf~}wsuXfI$?J%J7Dh;daP<}hOiC>_i01nbh|2O11Igq^T*Nv-e zdEj2~n2-i5f`B(ePa7?=vq*ANOgE1XLG1h8vxHRu-ejX%oa#5q6M}5^|6L zf7Wb<>bHuBXWw$X3ObmYOl3(Bm&<|G+1QZ@)YKBhV3>QCEoRehD5vkIQ5heMz)D-3 zvCPD7`>Zqay5`Z-YSN@;iCFonpRwuP?U!dcy(e(lby7CZY(0%J`^LVWKK;9t{L_HV zY{fe-sD12}!|P9bY1fN-PY3v~=qjKqZPx;>$5Db64*qpF-+baI3uY|%hMrokt-FwM z{ox1?cBX5K>YV-PK@MSmsYq0+IY8TR*`|6l9QR>08g`nT(ZL)xEn`9TBW1E>8am!G zYe|z@@O>gt{S$8zDxZ(K-_#-*qWaIwigv6a@tp2m+>6zTaKbc?o-$fXhup+kA1(RdeAo^vv=~=?QU#AkJsbb=uCoXBAvKeF613}EXTd|^H0I&bh6)}b?e7_L zb!Y4giBT*U2f~bYVqIl}Y8gLLYUES0hLt-!%>-z^*RSzpi#qK((5*&hNF4&QDW?=Vfy?7K>RP*Ew=bh^nPl@y*j$uF6ZEVHRM?>gHj&|hP(&fMckRLb~WWo7i`i1 z>YH5|1WzDWn2OMJd2@qF1ZgyXL<6dun-((Kg&>YpK-K~EdtR%=*l*@E0_BGWa=Z^d zIz!4UYSSLz@;*6Zop*CPH-x{YI?N83Mv?`IEI0GIZfRZKUGML9`js2A$gT3Q;*(hE z*4btNlpOO6W#G3Zu}vaR(3-alc|agl4qx$r)u*girQg!|8+t|PR{jG1`W=6Vcp&s- zFW?Q04S_#G5t#0r7GLW z5JPZ!ku;v@K`;32Y5wTlOJ@G0sN{fm<9UV3B0Os=7R1G9pvIr&%>-Q>*89u{<*%P# zjG`ak> zPLYe04|(Rl48I)FuLOKhRX^|XG^BX-qttWO^`3h6Yu%hkp|Tp+BK!G=(Al*yvil!c zW|VC^_eSWqj|zG>UP${pE4dQ|((=M_E{mQb+6r}SPCYy>XV`z{DO~u*9M-wUInAxc zEk28Lpd+E0pBkT7wueMBO*YkN|9&>ibl;F?x7x5*JD)~8)4OYM;q$fWwo|tCkaFjC z_1FDYkMN2FP^_RZ%CnmSH){0nLdtf8H#hkSB&ZH4-0V00C5Nx9xk*}|@%RBHP z7=o0x2+&r<^spNP=pe{4a;=hccAm{Z3KZIgB{|BF9E`wwq(Ehz79|Rz$WD0UeeE7S2a@`{SUe;Dj&8890M{=9ub4lw8hp z^Bn8s-ZsyhXL~z*cZoF=3*but!IhY1=r?Uez9niuCrA|v@--#s*)52Jed#S0GOye0 z1QO^!1QvZva30OQKcanaa#_!)n2ORw%xu&kae`D)9qQ{m$DiT@)RN5b;?=a>B;gHI zie}#JsP_VMiVfvvH{N;(_4p@qwMn&QR~;B5``ZB<~=Or=Wa z&aZZ{HW1rM2+r6c6gMoG)v10_YA>gb+~Aw!%TjnpG{O0vhoABn;;8i<(U6l7lTmwK?wt^kUi4)KwOrQ^Gzb>38ss_6H5q)JNd5qL<)NGw8I6U0s}@A&boJGgNt zRdjcv90O%nZt>P%VXnXP*H_ABU@FGD?RT&A2-U@Cf00#ib9r#{GRu`AGR(U1-Isn! z&CHOGjQqP=v}Y;C788#bJ)-!-S4bhzxwy-tXc5cywC3LEC)y>{D`I=gFJUNN=dAAf zQPb@W)cD|vLPfzCH4T#U7jDrTj4en4_dp|GFmjs$y zq!u&?jY`LD`%fzLjuNbh&*`rAdnA3t$SedG%gp3GftJy#JlX03gDVilq|x;_*p>VT zlpUSpAHj^+c()y^0<-r(R*>8G%0*K;K@V+jMC?4X>GZdr?g>sR(j1;7C@h1*p=qq~ zaj&sQ04Ub$1}GewiCEId>xgN6+rL$=8pYKGV(wa`D>BGB;oaW%Yf8gBC>q?&c z&F42&`SuZ{fk*QRq-{v}*ar&{rapPL5yv_IkFocFhI4J-#W5Ilv}n;gK@6frj~Yac z61@aLM2p^L^aMe4qD2=Wdheq5-h1!SyYtRo|L=Fs-uqksbJk)l%rf)7&->i>bC>J7 zZl7zb<}OeUk6SU>XcU!II?!$lydFKZsn+`oI54#NZ}4vV->D!3_~{O`A5BI$yFgX( z_Qk38o>-|EHoo@+;kO=E-aBG7M+;nUPtHH)e|^L{4 z|MF~%Y|^?y-O)Y}QNDJ)INVk7QHh-tOJbo)){4#a;E!6xv$aUd3GSmvXA~P7LIpwf>IUEGo*^^hkU~8duB6T%Lb24bp$b)Kh-VhGGl8U zM!DJ@uxXAF;<_Z2J=0vcu}(dO_DN5l#E?g+#y+ zwS1(1^67QhQ&FM?Z zxR0L=(c97jXNF0fY_lWA!J9ilyc1-?fjSvqjOJ=^7|}bHnfEMf0_Y(U=vcp`fa)vH zoTAVYHNFCYGBrAi0K2p$l3d71$OzIz6jp85CW(6g-RH8`lF!0HWY|@6j-lai(DA4_ z;#noVms@y|U8+G00>A0_ z=Qru@n``_#g7Zbj(=(u1!4+~16AMT*0ZQ9Gtzt#o9ms1GycS9s=7P#X>yM~3k*=C< zj}FJ?oz8uJ#N5H}nKE9ItUR!X1+3e6RvkqE>A6Y0<*p7`xA4&B$k%89P8 z5dBAbA1|O|GZSe-3fqD}AIUr)XeK?(m52iOHK=Q7IHx7agYpDAgcnZWViB#P2Z&-A z+4bDNDULBrh&U;G!PEc|C()vytd9#0<-hv5B}XavGZE)JM9_XA;3`!X`7CSp@X|T= zS^P=Fdq#}Gh=45=E-$E2>Vq-7ovmd9M(9*TGh!h7ZMCWLX!4}0d)|&K-e+HZtwa$^ zj?#Y7H|$4hUdLr(h~O_7;P=pOc7eS(jn3Ona!~=JDZQuSnPp`Wq==$-hRW@>p0&iM zmJgDi$8y-~`Bmde7q`!j=RP>j<3HfHC6xG%j%D+##!&~-L%i;Lt;tWu9uoJCH@sQ8 z>8S1|W$!Io_-kygkLd$nb1BaVrb|CmSj#ph<9)zd_C4B9>-l_E=S<~MQOq*hk+MZ9 zM9V8I#})rehI9I8*%k_U6mngIb$rToA19Z~6-mjLT-*5h>7RwRTvoM3flQLX#y|72 zwv=58vn;Mg6WT#3W0H&5O+#`QO~*g#@3M7IbizYrZS{IR1uo*Avn34gQphG(=5}*4 zSjevnn!i(>TzhNYQ(O#*jVZuX7D{|liX#1>nSTSseb1|oB6RQ_jee|iL9~Y<)J^Ta z-N7KC8prNCqaGSX^%PI#hD}tVLPd}z4Htd|Egios`o%>AKax}TR4(>4xkVyZs+h*k z1P7F5PumuDWilT3vFRcL)QW`p>x{I|EXF}{jZ3>7{`JxeX0jBsaF(V0V~6nN8Zw#s zuV>wJzUN(*)`_3jDKyDG3i6L=QEqCAAnXtf3`=R*VXY0-f}f?-+*j8DCEJV zRUOrKrrZIN!L>P%>k#r@frDnkam8+)ku26knc>i^`d>&e|2jumFFN2H#OFeCSaDCFVPkE2XVO!9#26npLOR{KTHN>Jo(Uax zU(u}(O0v%3+VoSM@@MEe3*Ak98L4*p`q4^D^Sbg?6zZhXUGZji&-`KGDL=$*&bM#7 z{|*Q8&I0ZrAw&7A{p~k@cat8{A57fYL2FNj3!D`y>xB+bE3#g|x5B&7p{%F7sv6WZ z3oTq9?BCXFT6yCr1PEx+g>)N}f7ZKO)mX?k*Vsu;c%HqEARsY1{wk0Ku zOmr{xO{te$YCDT|?B3nBWA`vF7CGLt;41CQOZU@=?LnV?n@2o4f*o+%o8SFlwEKGF zXnnr>hb#rE1mY(zXDVM`Eso|Yw9TNEEz|YjX>a)3dX`~Tv}m*O4aBgacKEIDUUd03 z-ROy3Im8MvjZ^TedBqS&e3CXpuZX0Rd*(c_EtXWGgs&-yrWBtrB{*I8=BG;0M1adz zYo`c9sw};*~$LzN1S?&!eEmV_<&s%Ai`5})^&z`(2R8w?}?IQYBJbp|n0I_D< zq&%?0xO87;t~nk)%r4m3C1dh>o1NSJC*?=?xTVW53ieLq&ugcZc#8F%=p@BXW=#iq zmIQXO8>@;n%`e&;!GiMx4W1)!jR%7O(%TqOuannhuSGOp)CzSvILY0e}ln!y*6h8U?XFQk#n-2pVW4*_m77##~5l!2r-hHT2a z^Hv>TNt+RntC!S>@)F zhJltK6A7FT-7INa&y$US=5g@H{h9GAk&mJ4TfGQ?QCg>{k`W@0(_NAif=ZljkIKpU zHoJ!j=&f~fClKJXfiTUGy$>p0BX{7UI&pX!6CO9+U+=2tDpTcplTFHpd^C<=C&PJK zyG3uySkl{B0knpHd`U8n*zKh8)dxsr?B6CZ4?|hfyws~M5M(h6VyA)k+&K{8J?J)o zV?8~X*Bd+**i_{YBlt~jxuqh#1-n8%tfTS0RlDH2#>7kmyJR7c2_;3L+xr&(f$)L| zXZrpky#E7zWgZBKGMH!Q>Zl-CFCmc416-gLEchyIXaV1XS+`0EgtfHt`aGJd~rJHpB*M~zCzB-{aML){OhdJ-OMI{%fw0kNW zVjhT>fUE!9@rGl5Vf%+RWb}af-N{Qn_8J$1{5Mr`URyknE$G9lZ}clqtn2m24b0=y zkOd!GK1wA~L>AlJkJ$lV9_)*+nB{5j2glxeo$J;-NSW{CWyNUOt8Qnr&njM2I-lCy zI`*gzlYS6wDEa0tjlHR#PAVkiUixgW|m&2E>94;-+8$2oM?ffklz2#4S z_Hx(?)cKalX5rG-U9`I;|b@{gD^xbV@C)S!FMmqflWd=3;XYP#B>fY-D#no%~3 z_2D9@Cql&bp$=j1AeL#~l|IFZ7lzF^Cf_7Z(TLoU4v871Ynv_c=y8qnzkF3d0H-8g zMp@MS!=!*;nO*`7&aYX$rGFI>AL0LXn)bme!$3hbgdF9~Bpr?MOYc#g<%V$74IRD0 zlo~SXp8Z@ESDbr`STvHZ)xqkg4g;1S1S4Hs+F8wn~TbU z-6~Ok;`7N%xzUQS`so0S$-(oP3;UB6(Wa!jH_5zxcf)B3C5zeSuQnqMIu`mV*7Ku+ zdzu?xoqZ)5kU=(l3)IkO7j&L9ahzdJA%}ykg)mdb?zqH@KI!wT#@caXsMb48cbC^~?M>$=L`Z727wKu`=5^?;?-}!Gb zxEhVh4Ne@NRvhF;piOtO0rVxH2Gxc`07iKX{(gC7+#w!@f@{O1P#iZN3s2wb0);#~ zVxz|`ockI71Qyl2q4(Mol)?pIW3JoG(*>tGkTKpROxt}YP4Eed3{Px?6SmujtQ?G0 zJD7=5(3sYzpkU4$X550v!L+rj-%_C1&xac7QC+2xVMFg(Le^Z~d6-ciebzDF#6Exg zg6Bn>RC+}?2r4eo?95e+ltD&c{<6!TZ#k-dh9D%jo91AGGb@f{6$#ZhVDbUT;@WJ# z@<-HPu7nNOaLz+ED z8N(=~37XwpDZm}!6q^C30+VfmNPziNIv~Bc13)ED@I;OzGCY%a_c`Mhnj38W1H8q) zPPz@kV?T+&c+hdk(it4ni(15d>1)zb0Fb#A<*)6d|0WwkhmZ}~W}Apc&{63b5%s?( z-)_XH0It$!!Sq&}O-*(BSaq=zG&zyx@iK+BsSCnyba{C0D=M1rhu6cK$}@3PdC%wB z6n|#_vegcHKUJ$zz})$=ljMGqtmXFTTtTU6%t+~?_Q7DY^6TjJ_246#Vv90gLC>;! zo>Ik(H(L>dI!|fx6AyyG?Q4lu?5i-QgXA0Ie7`?Md0_FUGfxDXO8UC-kcmY+s+6OW z#$P`|2{gEiF5a+>U2E4#BySe{#jF{)K6r>nHNEup3&5LjZ4rz#YRoV8Y)S*OVC;~J zhbLZ=J7)Ik!0(Y(>vFhU48T@w;Ad3j%<)Jg(_9O6_oF>+R1~b_dz5eZr3Q8goSriKWhyK5uG#swjQm z@rujlr0g0~+GAeqR2~a{f1KxF-0?%(mn=HOv!3DMB<-HT&bw*2+wR)N_@cH)BBLPB zht_NG-cvi{CKGw~bwkvzEUENI#iqMvg-Vxh6-K_OJ9e%QQqTy^Ia5tlRE!NxP1FM> zc5DmX)kZ4CrIQweCjJnSA#fB}Ju6CX4cUICnpcAYT}-0`ZmyMuJSrY!$9Us5Ne+@B z3>tB}P>OO++czfz^0)_GdfeJ}dmC^r*f7A04|R{)b3kB!8>RJsYQ2 zo8S`DM=6W|vYjHDIPzaIo-yX%sU$vD&02(k&bj+wE^@@MJP5(UE@c>~lJ?WJaU8D_ z3UiAf?73S7Xnh8ysoTs>O?-^_!cmSA$!_-6*e#vQ7I_w{Ji*3K|!|6CQfli?>RTun$8KBz|WJAKu3KGnr?>HwSep5o~o3 z)=dBq4roCLKL7y0pYdwV?g*c+(>8+jj+C&`b0Aez&*y5Llyha*pSlSj%@~0B0YI`( z-c9lsbTbUcNFzW4DTje&i|UO1@j68+>u5~yPlRcmT&#)>ziSbN z6F?K9r`RDqh!A@68o={}fUH-90|r+ZtENIr@2AVPpQ@IXg(`Go#+rB72Fv#sD9Bfh z>&2o185OsKNk(b-RD%{Lvaxy- zgbyo`5eMw_D*dOn;SIIn-Iiu$a;!lInjBx;V{2y5>(mBaRNn*93jIKZ{p87*P?c>~ zxeIIh3JoumPx+ez-qVf)nZEKK7Rtt}50L5xN%3+Yiyxq5Q(ZzDYdo zhhi>N^Ji6^a5h>UqeTxbMWG*QzEnO2l^P!sN~hjV&hlPQ#Lo`e{%DW#YomFnl+m43 zJmSr#R2^msn&(yA;L;|*`z)`yGZA0C_C!X1-TU!bUZE0*%rit#l@F5uJl6r=@)fJL z$z;G|ZIj?KPj4AP+kbpjWl2ttdt35bd<0e(X}SkqRn=dGaekIjmkHRBllSSnb!EZW z!*2rGa%vcbE-!SPLRMG@IXBGWe8V5}?e(77V3brEL%560d*cRl|G3=Hel*=EOR4We zmVJHke3KuN&JnVf@fZw{1GMrWF5Z1M81t-?wv;eqOyo&hv7;53%aTX2O9Fq=4Y8|D z!0V&n76#o88mo1-;hgeUQv+&&m@eUZeVu}C=hK$h4FXUf1Wig@qaR>q=f~qV6H)`x4D^s{ zshhe(^W;ayT@pqNDCjfheb3!g0BtMj1@}!V1dR#@rC}cc>^E{1MOg4efmNAz-cfjd zcc-c2_^Z;M0}$8#rR?_aOhEv$H`oJUe2%f`A!|;pAbmZ340GQ-@_zF!f>(F)cGERR zV%L0{{TrMZ7kjRf_XCR*BWoLFx-XrH)ta+j&5o=k*jUPkd4$j;$8f~160NP51S=f6 zG&;NXJ7Z)nNZb=w!4Pd(r)=nZA4-6o%8ZXyUHa9A2w zGq`KlUlamBh}Qng$lO<%!VmzUYJ7BAqn@c?ezi0qrrvK2?s2TVhpT?eRN)5P!%c!25BW>)j}AN)*kg z)lYjcp3$g8KCg|bistt@p8=sz?qy@yjEbUSE=9;al(6+zvc%&)#46I<86s=-h&{;~@z7$&@3949MF|7CDP`{))J1er?<%DN0b% z+)yceEcH!p%cU40VKTM@00ea2WM$FoV?%6niQlT;B zuij3X)fk8LSIPX!!p&@v4oCzXfEEXn+hIb$I+3wRv!KKaDr4p5O~020buO`bb`6?` zLBfp+vu6i?0Laqejnd&l!z-u%a#+#A)m4COMSW4GkQTv{dld0k4d9)o)CkXUJBGi4 zkv3j-XlIY2J)}Z9WMe)_`;6#LEv>5Y4dPvB*i#N4 zSHauzFv=^_4+T%^N-0MxzO*yQ*2UVVby{+0C=$QNd`H&GjiNHUcRQGb3><0sv&VNo>vyTMO5CZfw#EVVjMh%}Wx%^{ay-t` zLI>BgtIe(z^1m7f)J*rmuBWjixIdD6&-kSh!L)9NTCyRT&nM$1aPKTfcAtkmXjUG| zM?Z+UmGi4jp%u=2eQI=Hqggth>}Xt7J5rMWkaWIVxgYPO`8G(NXhHn>3M|<8L(gA) zph{0YPBtxLvaRvjAj4Xu%@(_&&wfat7Q>3Sk}tE2DIq{2;78pWCp8qn`k0kma+t(s z--ZA;9gw!vE&m;6ax3aDVZ}0s9R&`{!;_p#p^XDr>e8$Jz@gOA{DTTVbXay2Qta{~ z51p5c$@qyq%TX)d%qQ|meCz!HzAXp5qjMfe`ujN==a!1!#1``}tgWCBgsKd18c|b( zO4Q4~^DUobmwfLF)V}VNQ@qco9f6m2MB0M!CO437{II#|RRIWe(JKzF`XfKHBdU}IwN8?I0i@%_g$&htPQ>rx^S>vf2isFPak*DQL-?dE`3Q3&W}ZLV|E z6w~w5Vv~j#m2c_d`)ioMpm@pqeP#0NuJ`$BWwktzywV>9WXD(CA@e{n;5yg0Q#Y{v z>VfXq?=zO_>xVOqVXV~ZKHnUX1Bc~kC-amqfvug0c(ihJ zx|J&Sq@z9V{REPtlXsH?_p`bBuWeK2P7af;rjefUE1 zp10Id6T`>XDMToA`Wk9Ny8^4b_n^#cOwFKIN%&(VBNu;kh)4Fwn6O)OrJtamz4vk# zj7pij(RhBoN^>6twkVvq>P($b3QCz;5TiQf+qrBW6JHzsy*;yKb`eaTCUYkKd{~-N zo}U1$wSQj66$To<_hK#ZY0%B?iecunc`bk} z|GNmY;t7I#3OjmNOczo6NPzs0`|r=h&#@$`*G+I-0c95750a?Cv=9@BslMPDZ`l={ zE|>=*u~e>+9s+t7Jt;)w(EJp1;l!m0+rrGl>%pv|3i%AXX;wv2qd^g@4oI>e{6Zz% zQ)JM%MTzf0pev@@DoT4!!jgeEYLv2;4V9uCm*&O6gdf_cKrZ=4Z5Q% z=+HaJ6VRcn;@_TG^pPRtN1R1}J@PXU>#4a|@WkfST>7F5VUwLt-6XRogakd&TrD=uWg=XbmONnK8DSjc92F%xX&^*EfC%qhw4Pt*LS5B|zX zX5S*OBK2HaIwigCpL&|6Bq*A7p6P?=1eYD$YZ2O9E75eihV zfPS<7yUHfunBZq&QQ=~O9;VH!ZSRH|2(J}H>-K~=)w)lN8$?|7R&`%p_^@eGTraR# zB@6Umn}NHA8>BoJz0Pi)lM6e1Y3nxdVZDLsO%Z?#O!H9yuqLV)&5QimCihoR2tc~5 zMia4p*W7=sA$WtYO(#~YThT-C@|93aC4Le&1x48jLJ1%oT1{=r-)?^E1c`;TV4iXH`CaRBn0t?w?ss;#cZJj{pBLrD6;wEqu0+km2C5?=# zV=uXeR7eqV{V109U8VK7LNb>zP`I2~F}!Yh3U)@N7^QZ4`ptW;bB-#1&YK&F=+Y_N4 zIQ+gO3;iItv3lh*JC@9-1f3w*ALV+Q1KCVk(zicVv`+O|pagNt2+ljA4p2v3 zygPCSa@lJ*8{)#vDe#9Gn3!a^nvgUUS*^Mv=^Urco3i45??0`)^!3rhn&gk z|HtIH77IC58{dIeyB}TKkAs@atmr-C?2qyH%e~6)$SaQ`KDa+TOcW%JIhn6*|1`hM zPZ3iamlJ^fMjTVBv|MT^|5ZyU2OV;&H}jS>tK|n2f`h z*{H1WolPsQaGHr!oOf|KuF<)Sv16@gZ5FIBc<#*9;bCvblOZZTu*fE~$gW;8*PqIA0Io+tC!MM4ST&C)i0bP-yPz4XN*qvo%ySj4mqEK5Idj z9UnqKo+G7ex0p`myG2UmE^irXKB!VOJ%6x+07uIH9F42Dm9+NucqMHusHa*YwnQd2 zs>Z3VechrbMi^Zo!ewC}3{I9*r>dCnF#THOTckU%blYar8|z=oN^;+en|JWFbHRxI z(D%7Y&Z6(vay!FO+OyfB>2f)B*Zp`gs$JpEDA(h{@#CI&n>D_OMj!pNGjKsMuH|Vb znA%%Z|BSEt36tiztu9xvt1Ydo!Hl*ppR&V&dDB#KDie)QojSGqo$JdYJtI@1nDmf6 zh4+ez^NgA3uJPEf*WkM2*c~w`G^^(g#c{nSG#rryxQ`XX2pb|7$9TVS@(A(n6FAW3 zf4yz6j_?-V9^$!9!;6}z$~s0vNF}8Maj>p_Fe|nL)rx*Op|o~LGX6_CWptuix_U{S zz%JYqq;}_!BxcDjSpzlnJ`8xz3&W5EPQA)8Tlf`{?TZlKkoEHs4E%L9Iblg@S!zUk zgRo~BP~G-ckVBDIRz4R-&uj&hI#SH=^Gqm_%tj&7IL(XiJPq7f{5_Bz$eaPC%ES-s zWJ#z*Xfq%pG$n{jav$GRt1%K0de4ghz25=j5|OutQrtZ+N7$y4=%Rw*qWG1d$Be_1~eKaud zATz+Ph}OX6ZP<8`NZdaJ{eUE6Zz7s$gnV(B#b8$Pdb5qa$5; z6fkw(Z~ff-_R6)u>v;9aAWwk_dNmZ6-zv*S!JibH|oaV_ z{85@0e^t`ee=d62WU6XurK@6)i9@gxQ>gy^d@T{%`CNx7F7r;-T4}LXCN{<7a~v6y zy#xpU=GiB&mKhROy829xEaSUi5i5!od1nuwR?&hyPug|2Q-&RFp{Dox{>Quqg?l{q zK8ta$ly8PfIVm)?_b(EK&e`a^w|7$fe%;Cc86T^8)QglpTO~PJ@+$g~m1^B*vmBi| z_q0M~m9dM#nJT$!mk+dZ=kFNDPjJy^W8W;*)lj^>cl2E*yvWazCO>6C#d5uKFig`} zZQj@%pZrt+OaNMYLdWghD=WI8IvEYIqdT)^Qmj|sGzq)38HZTzF^}c3{n7k!6YFd2 zTf4V-@WZC*18%m_WKb<A;|>&o$O!O9-Ve^rqVJC*L*P ztZ!Fg*h}UaV%Fn;j6uf8SJ>SWT-?S9Y=3h&Vf4!9(ZtC@nUNCs!Xj-3GVhtEIU>Pf zN`?Tn?X8jBabTGvs`0?mBvGv+)>;Zd2Z=+~r?y=v`voOVW>j_r>Qu zATk-f7{;U#XTWt@v5ohwQ|J`5z+kxXs4l{uMn3|T0qMI8N-2{SG0EhMLl5q_|L>w(#8cA_~K-Z7JOa|D?eGZJI;6DL!j)2mG89nkgty zKmc}xyk$pr){q7Po*nc_?ZvCqCm{MK?K-XnS?yqq%0y2WHpv;5x64UWYfrvr^?~r2 z=@i%U>d9-v{A}#00KbPZwrw3JpoIRMjT_Wjub#}PhdG>B=WU~t?4-FP;1~vCrMc*y zDtX2EQk9mTDeoP!gTgKUX8*awj952}K=KpKLDp>Mj`}pAUlf@-u;5@P}= z)vUkGuQV@Ey<^S@d#f3=4SruXdVcMuYo54Uf(AO3`(|pq+2*Yp5tbr+tCLV)+w^*& zP_!;~I@6e>L@2`c8;{fLFX2QSEXKKS$J1hCLt^r;pZAVWYK{w$$?v%wxSsLROEKm( zR_s*Br+939WutGXK2?M zV;Q=mdoQ(x^O|HQ%#rqW=Bpe^{X-I1xSLfKk-1cL6;Y300^|?L=6=8`lr`bT*oK}n zVOJH;j1oF2DIXYO-R|r3bNah7D}~73b>i(5eJRS+N`g`!J2MBs&dAb?*GU$Kx$^V#WhzH)QIT!NFms67#xX8hu2FD~sGUxv z#8G#!$#9#83|!4fxGy^Sb%gSG4{Ru?l|;Yu6*=HtOm%V#FQ-EJVSzQi?o+jh*vqB( zxiz3jNPKkJu4dQl`$CGGuCuvEC-(rv$dZ~mx(>NJbV{-A_j#}7~}gl z21pcNGd*ft$~r0F>;N4LiM*b6-`c&!zQ!qg%7L>_JqYbEG?3y{kGydrk4zmOU6~H&xKa1`DRJf+e5C7{B0tE z(p|*W4cx5dIQb+*5Kf~3UK2PBS3M5)6ffSz1&@+wfD=sWi{$2`?tfli9gsBKWGtK` zNa5Z@NKhaIr~sYVC^9gVf}A%q9NIgm;^RYd zaY9s9tcDI?pmSjBc#%m0cGM$PiGKxDGv!v9mH^rmpIn&*qpl{|^Q`_=%i5m^inD8m5siYpcgAXGWXA!Ya{3G(UH zsK$?B30Mf~1|V>&TlJy;KLWQ)2*~ySkGicYis~Ci#2UshBQDJt&~PaQ)RE`+0JWNz z`!f}aIB3uk~yGUiwK6E2-XLrw?)a`@W z`KrT|I+3%RdC%+j&O0Kx%9<%24`&m~QbBY9pt?gI;h%->lsXOQ%gvej{ECwO_A{>2 z_TChq?B|7|wud5&eaPmo=x{bPSXAVBb6&}pSt!X@al9dp5a8;Rx{`=Xedh4OwkJpo z`S%_<(Jsp84*?)0O?+xFOvi(2>CVABlN8;(Jf5aC^05Xnhf$+QQ(B6$Cae?rB=?HT zGIgdY>iS;uKRcN<>>s3IS0qR9K1Eg<6k0ZbMYx{Dm|2&D<@zDT$5`_Z2$ z#{DYgn>96f7^|f&HYW15@TWT?dFZ;7IHZD&Vq@(7gU`1%;{cEw z6)kHuxt?Eg{~r;6@FQR~lEp#275LY(@dR)(*uLpM!~#2Nu899=01{Egd0S+U z^aTB17jBEV@Jbd7kH0QlK0Uq_Zjp*k|FVsZ((U**sS~bAG19i|kZ!Tty4q~!@pxzy zmWtkyl?y*&9P!P%%bJnD!Q76UrTJpY%H=vs9>K_Gq85V(+=$MxydV6jQ^MS)yUE7s z@zmS4g54!fEIfW zARWt8k4sAi+(_V{e^8V}=B>}}&#H|_(7<@ff9_XCs4fO8B^jqm&qoDd2XB3q;0grw zi{MI+1W5@V^$GYgEWbfoZtfZ9(_V`hlO851Ad-@;Zg5Kbi6TEO+^`Jp^7cm?ZOQn1K$5^}X>Pr=JE1;8C23x{Z zaeHA%v$Y81=4tPI_v%jugr1&Q(v-;7E8@`|&ePO;N_y^WJp)Lw zqWA0^#Q)6+Ar>Nx3V*L>dLS%qmDh4p?+tic(ax? z?$xt~X=Py>bGMfm%})T?(;|X!SQhvJ8^2oK;Fn6()c8(0?rs31V@2qj^#gi&M)8C0mxL1I*W|jgIoNN9BVGi_xh# zpILiA`3;ff+BO!o&s(W}!31jtOB)RmW3n)UZC0=~-9s@s_p$t$eBtgfZJIPxJnZu= zY?+b)_wZq?o2@?&6TC4N0IHg6e4hH&@SyUfuiSL}T5MV3)$8)*k{OKG8?q6Zvco4E zsb#qVof>I}O*!d#LKJ!AH!Kssi3GUZ1yxp$Gt5$>AonLM9VwOiJSdbVWDXxnev{ng zuwz7kVsiH)m}Yy=rVdKQbN{qva(RB}qnQ)%Lq_pK_E~i>zB*nP!n18So4~{)-A6s% zu&tVpli_rul9(bi1ox$_@;2EXTzvM@<9v9$?plvK6a)UR=?`6vj1Pp5U zI7=xPVNp*pabyLDigMxdGxiwZYAq#g*d+XCRUWW|)`rV-Hk^$OY~OO15x;Myy{!&} z`dF;au40WhE_t8$QPXTTITKF4mtehm+Ty+gt#Kw7w%2 z0kW}fMb2TPO^cW~rWN6|e<1sbkGtf6YzN}aQBmrRyKtx2dYj~jL^4XeWyGGieIu3Nw-6mk%g}`q4^uYDIl1pNd%dzu5Pk7 z9`;MLBGw=dNY6Xp(V!k{W34qB=@ZRNq@BjuNLAN>D9H$_5-ArJU@{)m`r0;DDA(hz z5m`U9?jr5-TJ&`V8MdSR>BLy%X%AVP+VEKHvU5LO*AS$oT*4bhqDIjwJ~+V``BVj8 zA~yuEW7d=4SBh|_k(=Am#c%}yyL)H`JI*qAwwtusA!sNb)M}%1Q(+@r{UF2_i>t0bM;;wAIe7B-01T$KOadG zn$j&gwV#U2LdLK9*=iMdfBJHDkMoz^n{TZeXTPoECzd2F(s&)UNWW2-`cSt|IBG-oUko6;xtb6HU0MIk zUeraEks_Ao4|&cCy!DUKQ4vGnOl`JcLHH2H#(6gEAe#a|d2Kf81f7%h1{vF;6QMHZ zY^w^jF0!&6kU5Pu-up)c(m24H!-u75lZUxeC-0dj!!|W+7!Gq^r9}GNH?iN$ca)_* zujBXbHnZBlmMe>76{g4|M#{{`>AL7K5WNR2BLzLlF@IBHEv0LCl6SPVYWN79;W37N zwi|30$|YK~PR^%{u`EG(sE)#fe2jzaFSe+!#D?!~0sRiImSv-+wIgJq=DF;zSk-l? zSH#3&f_FKsIf+=))~^Ui4mYcQ75MNsb3hn@HOi`jAdG#Y4I<1jST@Zz1qf90?bjVP zrlj(lerWMsd&-blvU3nz{t3As`JA+{*NGSl=>;!N_4DgB{$entMvK1~*f#P>) z;Hq-nzY;tmiYNA!KjtK{Q}Qp12{T2Bwk{&6oOSf@xW28~z8ah>vh;&LAw)$jPbLUw zqt6?0Xdp&zMWWjWD&qc0J0QoV*kV}6C} z{WCxd0=6D8#8~2COHMqga@ryp*+6fE?zh87Sa=7_eu?VPO|BLgN&`fr9pHCKOi+20 z2EcKxxf?rSfzdy8kN(rNfhYOD9XqgbtC^rhfgnKl!rdiJXdNJZnjec&++n4?KJ*eFWG~hsj4;lT0pQtw(hdM7Ev}saqj9o60yJjJ2oRv2 zZ8C#!VwB_MQ3pVuqCu=_AE0B60z)L?MV~%X)Ki8%0K14l5s^Cdi{JsVY{_(Uz{|g1 z-T!&Vh)4;Z19&xyS zg+D31PlrF5L5~*!IjQZ6VsG2FRY5zTVzC`+bZbgNK`UJi@CQaW#UHM$W8A#~g6K9t z5LE&QF}`hgA7WsrvQOa|_>lH_Em6Gpz#+b^@^Gp$sw}+!D7YGU_5boTmVx{GNK1Jc z@o*V&`bou$UR)g&Iqm*5_XOj9hqn=s;~g=NH;5BxI&dyl1hfj>?(YBsPPW+>A?Ba@ zHKiU3O=rNUzh_jQdnISK+4kv;CBGx8Hvni(WFSUAL?#b58Thku=1IfN{Gl?y#j!1u z+MOlfsK5NpRaAT<1(^O7YLL31>X`^kfFuyaAg+?|;-CKHAJ0UUP*rdUZjaRV0BE2` z$sO^2e*ofNMIgE1a?b(aM9)kvH+67Ml(3t-^kh#N9wRh+PyXz+*|Y%D*AhiRUK_k= zF9C5DC($B6J5xyX;c9SjH#`7TW;v*A=hj9sqLFqz_7O-La)3qT6umuayK=*EHM$;& z9|4dRk&VZ(#aV!GY>u7RDuopgJi0%m-A$)u&%4ZWF5e*?q5?_)iXJz!i-t|-p@yg5 zPvd>B;y+no0W*XqJ^~P_obeyp7oncOw63$&J31izevcx>Mj0ZEHwY>ezv@;|cB6*= zpYg?i-Jf9)lvORkq3%@^1(dK`vIiBR^_WwCnp@g5YKEKMYM+Oj#aw~LKjH49-(^Ba z08nsZF7D-kYh$#s_}yteRonfh*hP)VNR!9~ASm&RvTHSF77 z$%h?sKW`fTh~`GtyrhCrb+2g$qPdys9HI8yi;7@-aF|P8yxkD#N!tgWT5hQ&OkHqD z{t>=I%;bHp?{)6!w@ne2L;3~R`coxE_sqI~_vioe3^){U2X@M4!7nDh z2Xi%4ZU1BYgTfmLX2*|^3u8tfi5$8QDk92SC)~YpoV`W&1auz>A%H6X$J;-h7s&-M zx5bOb3-jR@d_^AuK^WKzC#e@%X%DxX$loPI?8h~=*H6Vyhooc* z?|d5pr!+81jkA`Y@$jYyI2e+nfo!J#<)V$^e~d7&Q^o5)S^)q3kb_650QXbxP9@G1 zwub?Zduos*caNCzGo3BI06qXbmB@NCv9^8`Fpe#0wFBRGOigY*A8YCe@8JmVN@OJ; zJqJn)Wok9_+>hNDAJJCU#5cq!*enqPf=2R1KuJHv2kv~J66%;1&KCWzr~G%bxAuhUA?t>=tt9L=AvgfNuaBjKTu8hli<<~OC`ZULrpj{s=3QQ(Mmx|QOjT=LMb zs<&u7T7CEcOrbknxM&mrF4o&!aoapYWMC19AG#RR?Tz1xk!mpg_m%sfzsh0(frJ4T z7?|N3*MI?x6y)D;ygAqw8gy5#1x~^fr@OISu~^_-ue#>#V14j?IDB{|u;6C4a1O`w zq7}WU8T@(3<$K%PbgOv1A<&d4;0@TdG7xQEM0!xt+5*ICuUcT-)F>bhJ+dBel!_Qm z%gpxB5&goAJVD&or?vM5@1HhimO3CZohk$z(tEA{#n_j}L*2IVVq_*+2E`a-Ply;x z8M0*=iYy_CEKRnOC6uublCq_&*^{+|$i9=wk~LAu&RDYV`?;s*yyu+vea?BG^O-;T z=iwQ@-+f>Ab$_>O-`wn zcy(T60W3#|VjM`15UN>AUeYH2);-R>;?x7tP-t5?;*e2x^7#XU!vnCivcOy(`LSFc zD(o&vVF?e$G1~uGfR!N27-uXu>JRCy8aY_39uCc={a0T`+6J?IlNC&IBQFR_&}j@h&hqD|2GRN@t@glo{BRcln@MF$!1q6!!F@1u#__QICFuWNW(${t z?y~L6j!f`An8+dNb!PMtb@fS<`&WH?K>d7Aq%@~TK87s zo9lxwR$oXidhg0>{&Cs3gDo9asbLd9KGfZ?mhX;3mqTvZX4X$;jLiv*a^$GIdApF}WeSz{Pq!jAF zILK9~(0$oUc}%%l;;*Z$J^(~_x!!SK@fF%hpL}xd-&< zcrNm9Q#j*HUU0x!W8G8#H5cUA3mfz{KV|Xqju{Kp8LM9|+Pw1L7gQJ{_}f~DuA5}Y z#YLNkZXx6t7(SA8j9OIV-l(rLFYEhBv(1X=mw_m6aZ$GapVv(OZz{#0cN1(UsLy2d zKf6=;r;|(*CV+X}ndI9_J~-dJxZ;6xa8s^(J&36mm-86ne6#4bx+j=G*SothU#w{r z#4myWhwsirg*e3V*lDXOhz7tPLvW{|cnLErNf@{yt>Z}PSMHU7AJS^mTS!QKPmW0#s%id z7aRtk-);*4v6pu~A?GtL%cBjspo`$t?g+_NKNePhyZ6my_X`w1{Lm@U$U%P!uGsKS@t+Gl_&GD@sO^=?nBOOt0acN%0vkE@e%BCX|d!2+cOf zaVszp`n~}F+1649$F(%Tp@P__l7-Tr-@XUk;EBDDC0YIVC#ac*qY9x>QHDcQ$&8W1 z1pD1Ch$m`h+XWv$Mgn>?{I8rj8xIC;*)USSBaUd6X8;LhZT_A0n;8GJ@kqaYT8U$bAJQTl7Hn%o>}KNO7q zdS7TEs=A|trL~XK zD(BzZgIVA1k&rQWe-HY9c(|4r7@1bb_-o7pC){~3C@WBks5S#^pb8_ov;iT1$`JFQ zDD{OhXUmoGPdl}sXWbG-#!K5@Gr!i;!VMMT85I5A6iNp7|DPvB%P|5R66EYJ&`8*> z0-dGQ6M$cVlZj2XG4W3s?u5DVqtZTz((eSCFpkx~Ox>UK<$|h6>zUgoDIlGU|I6cZ1#`J2C4Kc#?3Nc*1*|Ai9-pi-#Owu3=aR-?0} z*D>`UPcp8*D0lhq7*}@)MXZj@Zu`8VQiuFfFz)*A%Ph^6iWg~V;)w!R*_y&g%cB`K z-TRrkrQP^f3IGNoKU=gN6~8*B(5~loC6O`+vd;wI$z3K6!hdfA?=!>J6kZeH45Kci zU<5^n1R(!Y8|uzd%sjj`rktqzx#>?IY^e!zJBum@)S=g_h-D1WO=RB)|L<2$f*6eM zG-?nm@5&JOQG=vBOG_*lKy1KSqpF!^I;LFS{q&7{l{t7hc|6thGcG)z|D3vihc*7^ z$^qxg{6K*&XjFB8{79Re;6Wzld!L;WSselGbrKi2#+BH7c}0f<-L*ZaXZB>sw=+q0 z#|i9e`?vX}SI8(8ncXos{pgA#&zQ0YD#WAeW29l1F$S(?_Gg*a+wgXWJM)+=s|7%d zhqcBi!~*RM-vJClhHE=~FHO_Ja8u%-0o;BbWPnU^;R7VRNNKU_A8=b$4gbRfa_#F; zh8(*2b*PO5d z0(bi-oDVADfvFKYCq|TI;>L*IqZX zr6FGk0&Gc2^6=4wv|sQQ5tLnAJn_%|sE_9%6Ei|2nqo7+nNOF4btu1EmzYbd$M*Vy z+G9;zK(IOtI{1V{knE1np@lvKS2t0fdLJhG6G$X2?8@E4*#A~&*JCLTw&-X9fduWl z_2^d&xw6S)p6AlSSq%5Kpp|k4eEiI51*w+;e>xOj<-(K$JkF*I@|#JNA9#nlX1yv9L7zAa+?DW!9)TH744&}VJ6-xDG`!tn>{7>*B z;T>0-Km4qS44#u^FZgfU$?_djedsbc{Swt7z{;kvIH94br=vd9s?fL8Rj<5znDCmS zp`Ki=MY#sS4ZQfAW!iRQaCh4T1yTAGg)|EdT}cgVE|5{AMC|?PbSyuU_gy_^q#ca_ zHQU}_8eDPjn_&FyDB{#ZD7Q1L>bXyO7>-MDGletCpDKJKmqpnyq(OK~1W-?-^V zyE{yDqwXGH&SR%JtdPCgvT66zGj11OsWFNbI`w$Hs=`J>I?uhNKXs{_mCz%Kg6Tp) z;G3w3wQkt&K{~A*ybw^xKK$O6I4qWyjSge}h)p|t)(op~OVz(=CsJ9T0AwRte=KP@|eWW?O4HXVz^7HFcgR)s^pg$bsN_C`S|Lab?Owk zPRv*|n=5<2!!0wic&`(!#BTtSpB3)#vH$wHJ-!Ju&{E1A;cfqVBL2!Ujg)7vo?S2( zb*ekqOv(cz-23|jq-j(Z20l}8omClP`vpdDRah~#Fd~@@cL5*c!%7d<>T`1%B$u>M zywuZq7REemH6zd2(S0&>UL`&*6CPzw)9c-EjLq%jRA0(wi5pO0WrM-+k_VH5O0A?? zGDAlu4G(<|cSzX)YdbBlt5H=MC6}>RIF-x?y;A?9ZNRcn?vBo=;w-r#kXfasWeXabjh+!Da1XC6O0D&* zm6@HN=7_FU45Dg&Y&QyuMCZX_&wxcs*(X-hH-d^QPrpx~4cLINCEGq#)`jKfaj2&i z_xI+`YoUgbkST+;vOn9KPUNp%z*5HGR5t+53Ct_tY}5uofW?Jvss8%Eq*7Sr9LBf7 zmS?^4EXLC*8+L?{OmMh3kspz^;!mPPo~fZDa~W~~FuC|_RrhdGw-*HRynGLst-rVi zjz-GGsR`~Qj}*wW;1;F*CZ)-BS3P`w-A-cNWdLAVXbf;Z3)BzyT@K`arzF+Op%Rr| zZhq0_km$Fsu?rx=xW{ZxKJ%uokPpdg@;1)Y9wX?Iwe;l)HGA0k_;Z0ZUjiRS_9e z&RCt1E}E!?w6OaTOl4O26Dkqiml6+n5kNTozY$gh6BewicIC$orlVh#jZ z4y_(O;n&Yhp9eJF)jdFeIGa5jvdHK-Q6p`30b*L~6+Zk#QXzA!&cwTaA^Pgr)xg@WZG zm|1^Daj@(`SqskJ;`CHs+TDiZ>!13{bdP?J+u@-R?!L9&N0BmC5t-sihwg`kP_!Pr zfx@M4Boe_(P0<`0NA(+~?NtbLi{BL33k#6r)z=#d=07gaZN}bw1MKLE^aFoA^+8w| zc8r3acIaTD5w@i&eLDV?CEx|FRQ>*-b)EiN&xe|1KuI}=uKyf4ydYzUNySKH!NtQP zA3labZWT-OJ(NN+PMqeQ*3A}XN?w0cl|UqzBZFxwiP!hEaQ&JRXQPAPld(`RqR~9x zvB5`yPjCA1*yq%#s(~3#YtKr&Oat?hAh(Ew!e`}y1*Xp6p7=73+b+0p<%AKA8pdBL zXV-wb*HJiPc&+V1t7h(mhWJ$jvA@@DZmuRpF6hhz@t$&gM}iKkQ=^35^VyKu#O#r9 z#eG2kDggpk(y7UH`J1UzvO3K=kyo@FJf7a8!=)n|#-=eJ#EbQ07Dm#ji~pfgb;JeQ zD8R6W&(J;K$crR{nM&)9ugATyILW1;ztoEBv<$g*&fU zs2)u6BSjx=n&R&>X=?i$1%AmK+#$z9LYWR=(D+^dU=48mTu8@U|4 zc}l}cuSgYs3F)oMInLE4%yYQ7bSQSPlX`^j)8aQH^neN647dUIpcB^C(kS73m{?alx92H7`ebl$^y%~&PS2Z9>Gta2 z1KQ%)b#GJ1jr)SQ=9~X!X)OFrL1=dUE4V zbw>G+>Sb=ygZnBOTjFiE2VH9(4lmUXUN{7zTMbTk!_8QO4^zKX;)xG(AX|OfH;m1z zZg$4(ZU0)3df!qk`%P`kLCa>kx6kdww^h3J@G;OQqMJva-BYm^0mbuq&x*W6KZYB zK10lKinT8GwcI@k`w|3EwJzpjGdQ)pJj0X8^7iNQzbKi7O}DN;Y!u-PH8umV_us^Q zS3(^|Uyrx&d;m%-n#l$x;r-T5wD214%mZk0H|6(RW81{IS%1tm|z##z>}% z3x?wKk`gb9qpT*0N{24wV`N}iakl;l94f>i^fSol&Jx%G-!aTTZ``)qO$3M0dNoO* zpteH#g2XK<`gcGMP@ri0Rm5Vatz@Zo?^|TSp->mmqv0f-(r!=W+_PQ`7bOhqP1hE* zD&M(^!XhO z_}%aAo<#Mo0qkC0VefmFSjOi%iL(}-vzZm?Hy0<9>JI1Ybn5n}#9dR~P9H-y04mhP z5gtcc;pktu1m*m??AecNcVFF#t6k5$ikxui_#-a}WK=A7OgooQw+<3J1`d7<)Rwju zH^MhsWNKYla3{kg%w#-klbQ}J9<&Nngb(IAr@izN9!V@8xUs4@YCXP|dgSf!<4)^I z?#VvCy)r*7Fdg8ka{!2)N=^Qi;zHG!G*CT#e)g+@?iZS+RebEyK4?8s)HUmNzBpZ| zV3_J4Yb}(X-L_58ZO7o0+E)=nWi>z&(%y1y)jUJ*%TGkS5+L5D><#mX1~j+#^O49W ze0~qOqgA~zt5tN>;?74u>kfW;9^Uaw(5MoQ49WPP>%T;l*T**5{d%oav*^*9($P!V zm7WuEk80*`nN$Zg#BC)?W+E|*{tyODzZEt=eUkA9)$V|q6Ng5dUxt_F&fl)_9?7}r zEE|F@K&AlIir}1t90Ue}*xmooN`5aRN0x(SCP(`HrlJ+T>XMt1jpw^^Tg+GoL^Ky3 z1GD)G`Fa!tr&CYvS(KWV14ohI{M4nlZpk1wYW7jx-YwsUV-t z^@3H*?8e9^1v_rE!xU;ywV4FVxRj=s9_W&^nCsG=QfKi}V zSs9))(Cu{rLj3{63auN%;9x_GBoh1Qs=qw5F>~=s?Wg$d8hIeL%k^7 zRWoRTveLnea%i4zy-@h+yoZ&|_AN}GQwzDtrdqIX=T=QnKr<#0L0o7@eV zAIurcTzoUKsk4;n?X;_IXgc--X2xVMeFD)agj2C=d;$yBYYT%R7BCEB6xD4ccKnNb z4Vgxx@iJg1*aKzD4myId$(G%gT?0=SEY~cVDN!OHJ7PUNt@;dSs(@?05zTIviaxpX za^7!}pL>=lZSih3Qo0(jtM5Vye31`Lx!k?Pe>qQFuN2neJ6e_q^PsZ2LA`pSizdB) zHaj)tm_boN&x^|6SDic!I=33$_ZLTE@|GSsIF&eT)EY%<{N5rrzog5eL4xvFd7i5qh(;N;yCTq1gPoYw`)vr6aeKHD%${x&ALv*b3eQj@>;x+KXn zgdYqiNUE;t+4BLTM+C8&aHNFr<6~WZhiiQn2mKaPxZJ+npHSM&C!9Cv4O@7%mE||V zkORN8oVANrYGrpOU&@T3M_al626o|6C{*zB`x5?acAfWJwhnpR!W`{&DDZ4pl>o; zk6BWMpHzduSV9uzLRx56mcY$-BbaFUzM;a3dR&G+vF>QEj%3^Czbb)Mils?FclW`M zH}P!<1~Y|eq8pz#)WCDJwm_9MnPba*vZ9vMq=oldZwUMOrDRpSy; z6&AC6gQ1zVAw+!<(jnKsVn@s;iVh#Rc);=PPv@UPgUbuYE1q**R%CHvgU>KqRx_yz%-)0bV+FK?7YXx`ohO5h!yA- z@MsN=L^!7;8>;)JZP3NYtqGt%v+UGb zk(bzvUGg3=5hg*ZG0(Taus(?hH|Eb?&8kCFd$(HHR|*~6=(aBE4Nng(cQ!aFHlt5p zyFTQ-_GL#QO!_geo6xG@K#ND)=XF@MZ5O`Nb#<@a>)8!asuri_Q$bjK^uj{4hJZ|` z{njm!npe)|7l%GWt#>|wNfZL%tBj+2xg32HE)hMKc^(#i)yc*-P@zx?ga&ojf$3pA6i&*=Iu!$P-6??v_ zHP9m>-J9o#=~0Gf_`cKM>4s=(MbJ-7*NUi7tXstpmNa*XGc2Sk>Do})h{LP339`Yn zX0xQpy=Y(WUCtdv+p~e!4Nk!Yi68Fp+{mbZBuTjUiTmJ=_Y;=3Tv|-5G#1gZTh7El z{ci4szD&8ynNhJ7plk(m$14BA5O@h_>FC9~rnkh*EHtb+i4UtHqEh@l!h$JI`R*6h zymK}YbY{Rx$Ps0s{O1>ay?9aenjPFUTu5GN#gNp9-T109@l(H!oNTD?vf}LJh3O^p zgCK7b^^keD9XHAu=#vd}WHaA)%V(XTgJn3O0zD`)Bq?!x!N;k6tx(n%yI_G5U4_Yd z=dWA6YpTCSOJQdglhHpG*$}i)Ze4qHxVM&xkTspYg^aW+Z-568{o%Jtu5c_CxxBoZ z<4JGX1}$f4V@k%WE^xo5#J2Vdoddlw9}5nhE_dbC{bi+vlD@g%w`kfXDXh-}RPYS7`PQGj zi!dkVDff2Fyx=$A61gm+VX<4aYlO!kPuH=dzMt<^uTc+QQe#$4P^w_)JC8olX1^lN zvdqA5-eZUbA7nHC5Gn+2q<6rAdf#`EFHRl3|E;Vx=9ApJ zwM*eekGu;i%Na=;0(&xviMRt*I{n97@%2TX1I zVavg@Y&RdT{^Ci2C+gd1)CLQhi^6ZK&up?w8L5Rx3vpa|^yJMk0^NdGFEfo-(0T|C zX6>WP{?r)N8LH>`Bb_0=c0#cnx){F2*5n)FEVP6#Xy1+LWN0&&(}!6f{KyOA=gce& zj6#vi(EJp)3zN(g!c~X)Rg4Kf8wj-j;~s3rQh!0a&JsrX<8gzGy9ZMFb0-CQR}(?q z{7BgRc%fByY9o(mY0StsvnNZo5hSmK!}nO;&awUNx3ti4M5o}bnj6L#J#a}ih|?*& zPT6%#-cIiL?9e5qfM=(%PfFzCB7CshQOEV8x-VVHdZwJMC3NGqsp#zf=#Q|pQ3Tf1 zS#dxH@IB0kFVw(jsK`b{8gS5PT;q>~xV?MwHlsmtDUZo6 zZTpIm}-$=G5;cTpPda?2?1vTT;N?Hj0LCLvSq ziuAZxc)FD(;j-*wDtw~;sB@(9tN81I_d{&#W=d&GEaIC|1o-`SL?BzNEh(DNj&@u1 zJt)7?#?4F@k;S?WQzM8s{#P#yL5khuI9S{?4|&@UR`IH@7Q^p}1aQm2HU`>|;s)*u z*a>U!LuFP~&B|V#=~Wl%yRMLBGCZAxezo?FeD5Jet@%he?(1^8fGj!^{g70^6LV6R zWVpwD%=8NWt4!AGCF9vrh3&Ww*}RvlFq-7y6H8_?L-7n5i64Tz&aN?b(H7~2Gz~@$ zL@s%gF79^>KPta|9^IId%kx@K5++_xRh4|?9{ zkX&CTHu45AA@;#LoPm^x_(0D1CD-4T>--mvf&#pE=0+CF8LX9&Q*x)x&|dGDKD}F5H#?UrU)D=U;_Jdv}0kpd&*Vx$r0v6n8?D4jJi*aTHfAYb226x$bQHFdB5q?e5Hg z>4HRmN(4?cc{t=NtehPi@4u3v&)N6I{R%%Edjor}Z`zHMPha4e9iX>2T%9})|h8VL_?O~tvywm`#ZC8$c|gGZ#J8kLDsQAyvc-u`{>_OdGZE}mO*Bm`b}bDz zdiyN(_R@!Tu>)+djMly41w`TUk9tjOGh++CgAI4pn+Xw;KGhHj8Bca6y!McvY-Pg! z7mJMU4pY?(T;lzETjrQL?=8N3>uT^TQJCO;1or%@F@K<0@ml+QY@bQ=!1N=$FM_k; zI#}shm^y9Kjd&Y;;v)t52son(hhnuycANhRcWN=}@o9xS43!r9<7`t_Ci{I?4^J;h zsJ!yJFMU%{%#b#)F~>ym-o|@%RKIoh(htjWqwl2#vCoIW0TFDy*$^4ER|gys4}J|i z<0i(X-x+8Hol(!sqXg2GG1HB~)!K3V18uzTtWlcuL!!{m-6XK?f8{LV4#J(haX;J# zZtX1~JEW#LpKZnLqs)($E6bkO^EhdBaYJd?B}e>l8L5naY>ZlkFYzq#&3p5^ zayD;$J(1Z{`(0}4mGki)Iud_3;Nl(L#=2zITcwpN?T;~%7+&4QH-G%Us4B?!L**M? z{*JqCJ1H8Lx<_&&-v&Ka-fLJ09;B>$1!ec0b*c5*3AQ!)5!61h{qRhXoxgw&jf4^9 zg}`)}C(5n~wB=R+>iF)zKl{6Uy;o~59C68{aUJ?aQsaE@wQ6O-S%AlG&haL`lPVCN zy+=H?`j-M1IOfivk&hwT0{%U;J(Q;~^vC4-nHaifbuve;)(fqW8+cjsFl$75$V;WL zQb@Ri!`7?JqSIl43t1J?Ids=CWRyF>{U1wY4EPl+C9OgN9R-KJSQs%DYn9>v+WLQ z-r557H8E4Rh_(u@K7GUNZ@F24?&Bd_**(4~^c`(Wib_Pasw?^2(513`p< zy+6TxU1ZdrLRD!bC!ESh2*$9DU3!>D1rYAfo0dP70oh_F!F-yEi^`d$W9FLN@Ouzp zxhwwy)igtcO=g~z2t3 z2s!8YrG$!5ejc6rscbS(UT?<_^cDV+FC;&*X{k{J0q%1u!t3n9Htym;E)9|bp#)f; zZ#azg@O`@d@-uU8$OOF;%;GI}SSuXrjCq^ST$1B>e%8fr?VVdX7yFxdRL!iE$7O>k zDa|wQkydXSW!$uv=BYI)wmHA?yU7>ZW30enI5AmHP_ch^cPci?qfPquU>c{gP&mKD zYDp4D;%?Gz?JrP3lT6J;O0Dkj>5ej-Xks1afHh=D%f|#4V3cA7La}(l!_VX=F3RHp zGzb$VyDuIc>!N*=VKgd-NWanp!9SMQ!Fd6Q13!5dpR28rP+ML$=Z@qwSasMCMJAhu z*HsQL)WCJ$ZV?WwJ+CnQ78xnF=_>iYGv%J}kc!_jqyGHzi^pdx4aSrak#A?kQq=(z zQq__1?qxPdOxbUKo^PW*nddl(8vqyVveFY6o)aR~zTG+y?;8T-S@XzZO?}*><6J>H z<>?-baqBL>2yM&}B5S%kbl;(M9-GS|?S7kOwAQ{0lLwBc1o!y5qEfD>SRfU2+e+@H zgh+}Fhxh6!>fH@GN3yL>l`cQ{_n((c4M3U)8)rgoF*nWOE+ET>dogX(1~ znXEcoTEnEa`eifGokho!+qD94fOv75d!j}WyHuW)@6^BDSnL*x!8!j_ZX`T7Y6otp zp&i3d%C>M$Lu$EIvb=qN@1DipO*xQ|z3L=qpwi7MR#f^X7;_vu9$+WG!lQh*{jqb;3Q-(>{(IbhGW**`kY`>8ze-U7Any#-)W^Kw^aqBgRjO(>f4t5Ad5<{w_3Z0a@5Q>F&-Xh?wT(P2QevbH8w*5~hgcXU zOEG(_#nWBd_U(FM0h4j5YqB$`Lv8^!T@;baKZtFLVv3PQ1-jT{_!P!&zM5#)s~qMM z61Q9@`CNJfA7%{+%@u{amC$AqLaM#Bzj!qPUVEO#vh$MyBIQ+^TXfgi#eC0XEYTYj zs<&ldt{6}ByXsS{q3k8nxL82d812Jcsuk~OD#%JQ(< zNM!VB&bO3~Zf4!p1N36{0^&tkhOjg%1VR@rf+l?p0JM^PhHtyyHV69aI zUDhJdKQi>?r+oJQW+847r_5@6qx5u1W0(8K@%7?yVgJJ~%ZU0irICIQ_O#U0CC}22 zv@nL{>&o(U*PTxCF^q@Sa1pqszCrikah7Z!CPn`XqT=S&! zAYL4fGGBcW7o9ydg3=)2!#wVvLDf?ffm{66#njGUkv_k1vi!BnkHxj2C}-umgZF=y zDLwhpg+`_-t820&(|>LV`CVMW_>jl0WZ+A|H^^vbUuDIeD ztJ1K#{a+y>ds?bu_%NoFFvWAK37u%)n64lkqr!T3Ntfat`A?p5=NB)W09<=#@R^{e zz>PL~h7^PS*!yYg4D{QD=dp0h`l2YSDBNwGxn9gI#kV?iq1MCWwXdG4#;0;@O$6Dj zkdh;hI67+J>N|_)E6wqB;C9$0onrJ+J12!(tg?OnTI}*+n%#RE`CRYAwbZV}3EAb2 z@q_nS!kyyup8X{;c+obxPLZW2_m&+Eri~!u3_%}4E-ptezhHi>!nhxRmVN1fd-f{wkXsE%2tMLupDXZ13!j z1oB`?+zN2VhjO`v+qZMLazvMcof1+&*OxhKM(`%_+VC{5g;B3LX!3Ky z!cJS>q{{k6z>5@|bnz8!_wL-gV$xiq>cFTfPizcgI*4AHl1-M!sU2qmrqlQP$)DxM z#pEstu_e|tq1X(TyB{|6F%dOnm49SZi*6aOUE8U?S#(zYUh@|>dS~JGS3-4~9O+1z z+qGDgFW0B^Ewm5+o_+IX-QsA&qGIV(k%CWQ6Z>+tmLH@YTZ-#dIilcIgIH8)riq5d+RCHCn! zFNz0(-eoRhWpa+}m|>6;Xw{Q7=(VxIv;ILv@3iPx)af`{l~2N z)=Mixk*H?5%OkJr#!OcAI7E*pJ-8CIip;bU9zT3>C_VIE9A)4&4+Z3B&hz#tP0Vt>laGkZw+gI1 zNNP8d%5ccQ*;PfAp?8^_s}9Nl2f6cTf1*a+pZ$H)t54j-VpKR-Jhydi@Kt^ZR%?CjV%DS|Rs)?9);G6reKU9`^C~4!@;C5?8~PS#N=;py z@@CIlDP(lff(^Fe5)Z^iOy3)Pi$ts?DEhBH^DhteeBS*s%5THi z@6_9a*i0VLhtYjP(KI`QU0e3E*P`alog0pQ7hxeToAZ~XnMEr9(*3UW^9j7M;f2vh z)Kk|kU{LcMk`E={be073PCHhAZkBN?_TW?eTl<0bJq`#=rB)TM-R&JLcc*_DCC!Ns z4(Bt4?8i-I4rf$>MXFghFRG`uM__hvyT8CU##!WYHtm|83@tAztvEpEWSA0g(s#8$ z)aW7sT1A6JakNPM_GNF%VhPjELW{iGR0jB0- z?mG#2AQf>zf1)Gk+?8vS7?t#)#G>Uo+I3v%VnD%G!$f*C_ED@{Ygv0TwtQLF^BOBZ z+KHJ~ZSIB5#$_F4j-$W&icDSsI!$X^zkYOMjt1QWlXGd3^FxuPbl zYysF)!L&{mYq)1zL7*!oPRHD6Tf<$n$8}C0JJ0sx>zJ8LwW+iA>@(R;D|UWq9EW^j zxML&^c}|OAxdG8sOia6mtY^x4u7iw0)S}Dz--r08rQPR2&@oeB`qhS9YCh;2O(lP!iw2$oa_r;@E z^`i~GtX|+RuNaYx#G3yE5J7QB!2VUdI*;P;x$!0U!_$YW6(1P9%3bS}4p$=gYQ(K( zCd+MhB7GpoRxM<>htBZcN1MFY6K3iVd{&>gm53( z^{k8Y(>4JcE~JSvFLYsQ<{q9n+0dh)8sW^gqgtd6{?dit~&p(-7q>9OF2&W`8A_| z?bi>CX-w?9@3#+aOlTY$JcMn&pIzqEuH$$J+4Y@0D)2QX?nK4H=?mY~@dQEWE})*J z5eby?49k}BUCdie3qf#(XzURnEZyp*+8zT-#tkCkQ*}BZ%IV+ILlWo;pt|@r1LWeP zj6VpQHc!}biLxbS`*YzH5YC^Shrkct9Da$Km)*tELp3491wL^O>nrzeC!;UvKB6|q zcqWNtb~rN{Vg0=@jp-63Xf1(?Qc=`v44;PLyt1E+sMLboMm#Ui?nPfiolk6XI+24`N#5yjuyIv`}Qc=_Iw90m$ zBjr?A?)PHHSnkiJ<*_9GwB&Bl!?}uI!zcP8O4bycs|?NAtZ4eM&9$p0F~k_rHXPrV zN&4~zjFX8KQ*CB4ZS!mGrAz>^a)!+WUk;tMGMi?avKd ztk9janG+q3yE}S|*D1L0>HZIgSCMlSMLMXJVVbVq8pXY%g^|N^=WbO>r(W|6oS9}P zx|_U^S+QffAKJ@*6>qjvb+S9?h9LFvHy@MC(@!yG`75U>=?RU@zc4cKHJT9mq}lJ& z?>;Wvo-yb9m&Wjqg0xGGviDzE0N{-S;=*#DIc+3bk l?UA%JL)bl!@DJQFinT5$ zvsIQNvH4V`klKS;lI4zY`UQA{Aa_cEjj3p&S4;d?^TyrgR__Ei6{fsK0^p-LbIjwtShv`XASV*S zW$oJm8ZTT`rd$#AG*xuGjUWr;f$UWc{C-3DcH%K4bGbVaN3nGY0^y}- zxuk+PWS_kp=&$oI4CgjJVegOI;Up4kq6css))zMz+!?}OGu$CS+;bm>U`r>iy&|bvew`u9sVaL!J8`Y&ou>|;8CTzCd3+zd{KTGuX5;hlwUkkH zg10XijM%Sh)piDZybl|2xwxXQeP1s*JL$8Xtq+Ks7@4e;x4;fHC2tk>RBSXG`ntJ_ z1Fy1igmu~$Q_IyiuYOB`YRu zBF_|^iv@Z>erreSx!Q)>5hmjb(Z`VJbBNIulrep@xCcDV*O7I5bDSfzI~+|ty)t|u zkNYW`Ri}pHYLq8QP4=Toc31p%oAR$+r8#97rTL{O%GKVRohO;b`f7EOOr^7??y*9B;NEW^DEi!5k9=ZT=gII#{f-HC z8cPwo7j^&lrT1BPQSZu_K?D{CM5@dMQ_GFHxR}zH$GxM4wz;;-hk1a&bS<+m>Zegb z;DV z7CQfY#H;ni{HphuevPA9UEkDnWt>jm_ut!^O4@llx!+}1B0i)($c=k#w2Evzvntk= zQeJ_5+daR}K0tfn-OG{7THY*CwrB z%TxK94kg6%PUUw~akh7M(g-TO&sH0m+YT>PuNcTJ3o`#@TN33_V8yVP^ODAkevVG= zA*^X5h2g@Nl>e}(fUt)^ijiDzsSyx=`aJ`Euxmu{JfFF4Bz15m*pKEiS}5S~CP>EY zr}@<^b9bZqhHaZdR-pAO$}E@6t~Vw}YJ;%G;QANRaR#TH>3mofZhhl3z$|ail%jtS zA^9(w?M1^9G!2T&bqM(tq9P z0^)qR$U7mOLVYbE8;BKi^Y^ImT@Yk*(F+WT|AWlbdk82iL=+{zn>Yy{wC z&*@89-4K6|L;W3i?78CaXZZzfY%ZcM`onA;75bEsPqi2GfrV6nUyW9qE3L z%kOR#$xhr)iz!s>*czlCFF45nC+Y=(bEsDDQ78v?k0N}91g=Xy=AXjF`skkvxB1Uc z9c>*QTKKSJFl6Ak*a|yhkOU?l2^o=}Xa-(w%b>eKnyUEwk|*DLwT4;q^i_j0_P)y9 z2&31#0{kc-I2c&K(wMXN=VM;HX9I@iCTqdjY0) zVH%S%$a;zMRQ5Q(vOZCV2(PtQl6LBEP=NPp|6J0@me~C6ZsHsOw zNul&7hP#SlMVbXQD!}M;46#?VA*l@Kxb&8i){1)+xnfKUUA|c_QS;&D*NI&9%3SN$ zS8mf4Jd!k`pN<$8y&^k!D=_^t0Rh1>3-am3o5VuqkiKLSI%xEM9sLQwMBnOZlPKn zbkS8)4GdN_oRmg8*KscPnvguIyXyl5NFVZ%IgE{K6pLYY&O9n;I!4NrF(5sxefl#u z%Fd84-!=tr^RUdQm$z>0cm`dGMLF~jY_X#4?^Na5DVxn55G6!6A6I{S3e4KpCTEsC zJ16`nq6g5=3x5)b{)#lskX`90ej!E1Bh5`L|cvnGo9U#5SyG?A9V`ltkPd}$b&%G2z|CX|* zOn9FRZ={U)3yv!0!06+1o|}If#dxDD#=GF1^N+RP=JVUA#{I z0O+|LJS6D{j6njNeV4+PL-|NJ`A=(MA@mxY*a}}&3Yy3us2XAFAI&}$Od0Im7_%!E z@B4e|GzfF-iHx-Luf@xMxjka-%$;KTedKc5NGbtF$8`rjdf}(TOLd5Mb{}{9At3;G zDPir;ndbVnrzle~V%h{drlcelJ28AA% zJn7OMRqVa9>bXyL-=)w}mYvj=RmMy{SM3GW)>tW6Kif9R1zS1&>fYSXHg1m#quUCb zgBe4=oyfZ&BbaRQYqJSksJYP#=g~{KW@Ye@$o;dT)A`uk2_zp#z2vzX(g$Y%sHWoa zGPU3_e&viPZ`H$$9t|JGUI-OyHK&9-%?@2UZQfU)ie$XU#XXy(oeIi9?Q!%ove_Qr z#`}XBtcZK2+-v-gkt4a$8y+!Zru~w>Z{*qg{xVwsA7w6sK;g5to+?=$sU+Vf#VL_O zn3WPbn&CL3W}$GfvGRnpy?mh>xQhf2<5`&`E>-c4XLAF{W1t3D-&{|wFKjj{et4Rk z$vRt}l9%=is%B&9Nj05urmveRu!x6>ah?pf9ayFF*`GvQrCrrabk-I&#{fIvnjuZU z>+CYA@(x3<3aUJN@$^fh2{&?xMZG3D>}SFtgoc9iNLoAR5faapMya9@;A{yJBsytE z!;7}H{w)9h)HVHUe-LzF-Aa)P4>#ueP0;>!Jk5~x@5P)hl*DGkLhTcwY?Qx0lFiaV{ONP`m5wrRU=6e_)0Ebd-xxEQ32O=0TJf|J4QCsDbS%m zqk1R;DK644&_el!9T)if*95Q;9G*oE zIK#7Gd9pAwXCUfHe`U{H0QoEzd~T=nya%{P1re?ET(H5f1>s{1R*8Tfd6J(7d|l-RAhGl|wYbD4IXdaPwfbq6v3hb!B>g3_7v#39IUk<~z|%*Z z5=H)Obvd%F((sjG5ED(YBC`TRv(IA^0UWMQ;OEGm%4|w`c(mxa+24S zL&?b|yI1MKaM{ySJHWw)<9x;aKPWrvxG1-^@6(;4bP57W3lh>HsDNOR(t;wABF(@^ zN+S(Qm(txGLpp>4(lB%nAwv!C8uvNpea`bf&pGG)tbg|2pMB3T_gd>(*Sg~S!?a~! z0A()L!&@ZuUR2~;fR;B%;n;xjM@7`ZbxuLZEbQfiLOyX)rs>ab&)sLaHpr&g7FL2! zVu(lxJ(4)X{^gP@Jt1l(%3C##rRw_1RKg43`P&p4Q+)~Sfh-gP@nW4mxJ@!uH`fRW+4(tzoYe@@1ULPWAKF2kIEAFTXutNc$*A7_Zd zbIDSGh3cHcwDydC1Z{N_YNbAhp?TH&6T#Qb%>TMWzo4dn&<+I@pBrd^X)54f8~m5- z4OKGCZ0ec=5YWnSBGsP*92i)D4zUA`$*J6VhksZPum2tEfr1#rdH?`f>9DeI-M6+$7(EXRP~(6Nm%V1fJQPEz ze1G+C9}JQl!tKy}D#D7+CO804-R=$`r5kIa0BEQBk>WiE;mM>F$p7PR{nMpTl@|Lg z3tl`DBoW&p&D4LrDJU8NT&Dxb7M)*N1@R16oPzXe$QFu>*>tF;EVf zJx4&|_~kPEv`vAC3b095%G`_pye6`EjPI4Bo(Cf##Teq6(MchdC7N8WHnqRb_xOth^U>yMM2quKy z3WG^$wZ$;a8_pT5@Qfe*%QFU>Sd2^9qC3n#51K(iLKv7_iu}W~R8Ys6AtDUy#D^n_ z-7srYdw;>(x6Thx?EYyQ{`;;rl_b_k7Q4A%>3cI?pCZTT9`Xht;3j;l zux)Uw5d?)e#Q4{%wCE4QkAjYZcA?9@|6(Xm_Cpyp0&tUe{xVk;)N9WqO99DoFkVN9 z|G)2(|Mn`ouVaH0d8pP;PfXX9a0o_Faah_f%aZlbz5gtpZ@>C>{e$xQKhGl6_{tDMLCBgh;m@Pa8W@iX^ngzx z@5ubsKmFf#%73w*=~4hyH~6bo?ax*X#9&v=e7A1=izhG-E06+*$Dq~muWuxig+2mA zu(azX|Ljft?TYnZKC7D!d>dlZ-LnR>09BbWn7p0n#D4?k>Sn+^wFUKT`12Ga=Gy?H zsP%pW{wU}F{7(MyUsdmbXR}U`Np2V$m6ZlA4^Y6y;MYtP=BSJHJ83;`b^1?7I^nVc z`JzSE+}0AypWoK{`bN4#E5R4?dRDQut0TNzPqcH=2mXW4GZkJ2FM9aR8_^lePwFOs zf+URNaR%4>rbu6zQ-6A}VQ}%h*u2;thF1cKn&9fAjdDX4i*`9N2HEBzTjXO7%dwzx@9g zs&CBsU&MfiiJ?U4zHq!ZS!$+ixKe6c{fm1W90}F{d274r_7~6%`kfd=RrIRg>aWrv z$^OlGhT+(Ahw%V;rZ~P)vmloEv0|gCtM{{5Fb%PwD==mR@bnnBSx2W>0g=iX5iYTE zq5wSVhDwKpb`kHE+0VdSodcsuCjah#&{6v51LNTz3aH1?#^E>Jrdt?*`VGHoh!!}B zz1P)E9**W|*>9rCoQ5!vcnlohOZxA8W>{a5I~%xH5n%vU>3nq3G|rk_5=OD>ng7Xb z|Fyo-&7`!aBtcOd@J3>|H6LOM(rHGiV~NI!3=?uSl0E?jd+Hz3J;(@E+8Ia#Ozh~e z8k>;`8>KwPJ^RD+pWA37WcwT;k47OKre;A#PdE$%^HAB(G=KMJ?J%DIW9^`@B1|Ee zgUySLpYoJQk2RuXf5^+eImmbS0_Cwwc-AN&!4F2aaoxJ-HW;$MXE)z?&y5~8(w+dx zh8K{NWoy9qYI_%R1WG$rDy@JdD}z4-MD!o+JEgOc7R70uHCJ+y-vi0m|)r{AT=S6aP5ok2p7`_naeb z9>)xe-KOH|OOL;=;3|>&LJ#KJrBCW3Kqbjwb{nLS6K2uBYgR2*;Av^!Wsj%DfEa`3 zcWeYE?|gAQmv#)q-=()fF}^h*OQtaQ2Lh1s4_Ous0Fb|I25t7Efa#Th@htLG<~=$` zAL#*Bbv+_NdSg`B!32YTxV~d$2DDN1@gB3j18X}66CMKMLoQMPD`EZ(M~31&?ef59 z1UOSPPbHpp05@_3)INS0^{q7z6{x-+ERZacpSla$)r9515m}0DD1OglcF5f;B*d*D zZ0_6&GBt5{?7jDAltQ*RP2FF+OVai$A5@)q@UPfx7G)IGU}gr)&FnFBw+f7-3D1&( z?Tplx)hdmOXoDBFVS)|R6!W%N7E;)psC#rqKeQyVnhT2SZ+!t5SA8<=d&ihYe{i#Q zylA`%U@L!^!~F!9B2C$*#cL(^F|_(}#bysQz+t9f>Ttx5!djn^U}7&y^V;Mu<6F)e zTGWBD+~UUhP*Bo*_hPdJZS!b60Wbpi@BXQ=7Dm&6#_`1VMBVU&_c9{vT7lrVdrXl81DZmTF7gGbRDD7@HFp{CPw&T#5(WGm=>zFj8CU9 zpUvdLaUM!&C8Dq%o#CNT_dS*hgGBhESO>>|tx?<{#^NRKvx`yB`QIH==%AMA3sOSC zmh=5w&J%aBux1Ps$I$iC2T)XVL72ZD{bTR8!*ZPN*f_(CPb)TIHqe5~!E~YhQT6bi z!<5+`0^EZ@NkS^+B32_VCMK{B-iC`g33TJc(5}w19`r422D-|SHv;rQ=;#4+fTJA2 zC5EM9^ltFZ(Zx?|S|v$s`FSK;HsY(6_nY6vfIltGm8*r?acxOCzI}m3hM_M5z;o>H zIiJhJ)A5$(9nc7LP0wdPChhY*!s(7$wN{FeBqtk)TAs^q)^g--lK|F6OwW z{>5540xthz@^SUgF@4bBKWHJ@h{JkrocG^ctz?_;VW5nB3}jB zKwNseBvMwRh8K3kgbVETR3=nx|Jle-p^Uw&RU-Qh%O1O5u%QqG82a>6I)d5_2n$Y+ zYRMZ}U2QGC1Zebbfu_R|IYH75D-|ph;PWIKf=p_RGfKq!)cJTc4gEvjVwj}_8wlFF zlr3QGPF%=4uMG|CxC{26X;Q)@ahL1En+>w%x ze6uKtz=Q8w53m9$&#PNM%+@+0&TZdHnx)bV*t7$x;|eA@I+=$KF~cXI^#@XVb8OaB zxw|H7X;f4=O^nzK6!)Xz*!dJ`e<@u28P4o-|85M0d!^$+O2oj8BQBx~jcKj2Bt6Rj z+F6RS8fTys*LgHo^B}T2l5H2m55y-UjF4KPuK{X30ckf{q!uv<%fsWXeR=TWW`I)T z3dW8sy@mp@ho9l}BG*s2&qd7I@mxWCG2WYUG@P6eoS=9$!>UXHX{U4a+RT72h?cO- zqo6hKfC5wd-IJsA_yzKjLpQ^#TA-11de=NLogL5Lmx_owf83#UL|F03u@Mnbq+pxD zh2jM^o(g4Vki)kubUGNqJ{v+FRI;qR`))_*0k%IF8{#` zg-N%YZa@fQ=4RgK#R^98w}~B5zF9;rAhP6xhck;K%)d5XV)DjO2~OaB_WQlWw1Zy? zKqQwZg8khu?Q)8!Vi(wxRb%uzUC%?Kpg_0eM*^Q1b8w^x(dgHglD>I?AeP<1wr)B{ z#wIuI$lqaLQ?%S9HDq=T{B$auI4aDKCr~kJz%yN7XO7bPL5UeEgp0WUe!NFQN7R}| z9DD;@Tt+CFC5IZi!|AF(Q7^VD08rnE?7;V6mj*n1Oc7^7BmAIa#Pqm{f#R7#C68vr zBYIJ*Fp1mg1I!6~V6V@VHKbvfR`tNs9=d#Vmhk%`UD2;khT_?NqIR!??|G`%{sULg zJDh8|O()chJ}U7P!eg?l&FHwVq)0@B%|XSfU9ix)S<=GFlL0F8Ff&VqqXa0y*#GOl zKnbYy@+FukN;e_BHxdT?L8fWv9nTl%C;O}=xXg4^4QpE0pPiKbc%ohh=~@U`#u($1ct+3HT5*J<*&` zNAtnMYHoJ`Q1_E3Xghg2I?v&L2~JFBaMF2LF*kufHr@3)dk1v(*Uq=9fBUy%a}3E5 z9lq(ncG;~6PQA9rUkXZV&H@}4Cvc?UFtDpYJJPy5X6H=bDkxke$62fd7*zzD8CL6K z{7zE31Ei9$W#84By>?Pq+Uc2CB=!N;CRB~vY3jSPd7pmgOEptL`2Y8D8@|gnbjG5D!6fkI}Ann{)atB6*LG~%HM&6{C#-=d!Aue1)C0^wD?BW1cVATPxw43 zS!e|U6dU2}_p^O2(WGvgtx*_LQg`RY*nwJxlbkjW*JZO;`T%2MvE|J91rS2PDsW|gXKII;JdeW zCHM#14>kpbLv|0Myt^Bem~oJY&LkZ6Tgy0DS9BJT~CF|d#)EJ=V6(m`c2S_O{9C$V$5#98JYocWS9jT zpa8wba2qFzTFMbu))!oOHzch0LJ660}5}4 zH4El4vjp6l$xEPWNl5>hPt$sC%Jj)j@cZqPV-pemo!wN3Gsw=JivP05&0(>a}hM6hv&{Odf+@q{qEMq9vgE znirGM?Tgc+gW1>Z8MS**NGcDGo4DD``|%^)upy$sJ~&VDVZd%9dVK2CZ>^}HtIH%i z{dE^=Yzn15d~~hlN(&A)a`XG*_@C3jz^h27S+JP{jA3^#WoH5K@?2SsUcz2fhUw|>Ysv6F? z4C=X9T)|SR2Z~+$6NHWA4qG4MnpiuquP{nEWy{B#0#&X9RWe`$f>LBXtKoi+8bCI! zu4>Gn|7d$^ob9Xd`;8w3>iWJ$N>$lwNb49XRO%B_5>E)F5BfbGVIYoF36LWd&y=a*ifC93^&D1usrj zm1Cv!RZjN$ofF%9Mk44NBC*i#bQ_w1xWFtIBWkf|cMd$5iDr;6(z%Hj4g*+@xA2?6 z-Ra;;Bo;8O$LGbgde7>?tD27DQ0~hNwB+-oo+;J#0hYZMEIoerm~n@B5XN=}5n#vN zmP^RKfILV%5xN3neD473BIo7y>)p&Blc|sn7L{8`-OA04zUy+VhD7vlMC76(@%!`EJj1RTLryHy zwtTU1KY0nXWEO+!fzNPGnQ!R~lC;l_b4HhM>q;JKFssI(OU+ znOi?M{w5gnRcbV8w-?k#<(EpBpdmrRXkF z&Xo2;KYvBo>O#E96`CFN6AK9vO<*yjk=z0dr{a_uOuh7gocw%NLX?$m6C%LCP+y%Cw z1ApVtLv5l%Z9MR1D;J)<gfB{UA?lVQ$Iv!W zaB)Ku@iQ!rA!oegd#gwIK z@{xypIjqpVf}qt}`3nT@@z&T&Fkrj9!3sFb&4;mW5Rett>Y%Zpn!8|)BsLa3W1_2FF9)0;i-M~wI zw0YQ@uDji$nfz_^MO`%dCy7VL1hGfO5ZIYDombSk#D3mC5g2r7t9aUfun@$?4a<0} zhLSVxCvrSH4H}l0i4k#03c6jTJ5E91_rPtbL;3t$0W81e&~6Ss*+$DnTVns>e$ZLS82+lV{*-^n@B_#7vDuKcW9Km_`f?4Q8vI8}vK1IhU1 zBM35xN^tq{9H%v+In<+gZ&Ob0gCruK`hK4L#aBa60okfW z_3D;9poYzW?z|X{-QGmq*dE60&|un z+Al>@lbq_eEG1^90p5ED!<2TSJhPTTV*;l;VDjc-YLCwEGaY~qf3^mY9Ff*_LLSq< z0E(x-dZ(*`PlYMJ+?Z8e~lh_ z>Y;q(gkGTZaY%UK^dJ-d;LLofC)#dnq7349f6_CxjWSm&ZO2_}7@@*3jPtDFi<@-Kd-$%PAgm6sd-I!rdHhQ)jmdGuA${(+rD=k2%A*tCL`Iy)3~WcA^gB@?_lVZqu0<3 zzcw8y?gd^!=wW-vLCOoZ))H=w#Ce?;j$P#_ehRHrnO_)jHVEA* z=C!wrM>`Xm@D;pZnyLIy{B;M!>NZ|?G-CV7kR7xSZMkgripklG@!R_|cnFe|h5BH` zdF&3?hIPX7ag%OU@!3RcvP`GLl&bgl zK8*y%dcg3-0miY`{JIJ}j?Du;MzucpcYPVMPP0ha-wq&jZKUrFke^w%!NoLc;$>OS zZ`(?rwKG9o_x22N=CBg6m|63#l0llGXo&T=%Vz^+PO~EHZwR1kWAJSDJ#{bOYh489i;4F{>2jD)P6;jxZ{Rw8urUF zbaj8I>QVDz^SEgqrZ!v7xquO!qB!VZp!EK;-ZmkhAVK|<*oATC~ftN zH@4%zk6!uxO=U)aebe0kgY=P(azcpnAn6WUiI*5#%m`i{*D$RIJQ|=^xoP&`w-%3P1l{@Y4b7#tEnnTaUBl z)tSigTl|6#mBiGYVJc5`ruc{QXI5((hV7+|x=QMo1d#<>kkeLNO0HMU%J4l-S_;7Z zMe~`-_jv5_7LT<^sl_4QNIq2aVrMexDCn`_Te~YLMB+|cF^Xe61Gw2ryE6jlV(FbU zw?$%1xbJj-9vLnYQ%83prt_>ObfI+@ax4vtxZQVu0z^ArT%s>zo1Wihp4XF$h**4U z`uY=sS{#UCUK+`;+5A+(G1hZ@muiL8Dtd?uV1sZRBjR03E7M;r7rCP+dVHwB6(QLv z2XVdna}ta2HePl|CJI|{JWt_*d9glB-~!Jx!;RZAd&v`o~30(_+9y=apLNy0 zg|!q$sq?{XWK{H+;_|Z+wnN<#DlYZQJuU`38B14lhyrGX4DKeccPs1O>>sCvE{c9- zEUNf9>Y_jw&bgc=FbbObC@7_gRyBf&wjPoceX__HQ%gRM#J?SD%-f*NjSRYyY$R@t zP4|j6vFD1mHWb^o4%9c*#pxJ)-O|G=%r5idp`6W<;Yxc5y$v`QHgY8Ew-+qUv)SO+ApuR3rWhRNrC&TavhJ3$BMFmJ-}$vPL+Io@1Jm%yk5 zNG}tqBsFJs{mLx)Jqg%h9)s_&Y6k=XtEi0>)Wt zR~8T|l>@O9+1>J2{1gt)REjLici(Rt5e1uEh*~=!3-Cg|$vY%5?m!+Q9*a{%)5{2{ z7n2~U$K4u`XM2Wj;^)n@?nS)Kn!l2%^J98rwi*q=-HGXY?lor?+ACoeIbNvLxfSp0 zUa3ESn=wOlLt$qI%O52v8zNzI4sWX^U)c20crA*|(GG(v(Xz@fdDB*`79!Jw9O0IS zEfz^sS(;>c-|$!TDoGDje18L&fS6DaQo2(%yF+qDI5md`*6XPy2MQz`CFY4*^y{2i ze-rb3j_UDUkcI>u+}nw^=VOU9v$T8mh`Z!b5>537`%drY2MMVXJ|Eq^8C%TIn3!_{ zl1lV#pcTLjJGyRs&D$R(JjI?>A>zhGrMO=zovOyq3#qd`3oi*+-)BMxY4}kybpKj= zHxR`iF-5a$s5s7S2!$r&%S>$nSIcFyWY6XFVSdngpKkLa5Zg>co!Ay_2cjb?Yp*08 zXR0Yggut}-zh`9$*NHOIc`dfdpAvgljwI@ZqPgzhJzBMhl&x;1rlMaLekJmSi0uh$ z1S5&8{66z8d+sL1GSvpgH>|%Auh)){^!)uc^9&6y+YkvvTke%aJ5tsK?S_vr6pT7Q zDU+d%q`L~6>4o|LT}(&CqQBfRiGzxzOUg#YgNWBjog=W95a_ysVMSZ2Q3n~(8z z^zaz{u}Q0Dr?70=W4&8C7~szC^rjgphbhiY%W4Iu`-aVB3%;@?HIUy;KSjlvOOL~I z;m2jBudFBUOuK&uw=<>MoS>>xPyuf9Al8T)MU~j{yQ<^{++y6FcX>j}`Qm7t#}TC{ z2T1(+hJf-teP{dy0^@jy?M;ZO()M0DY7&Jl>W9{ zCarlQ<&XUzUXXw8=#@s=^02g6$RzO^p6#cau4l0aySlS_9}e50_7+I@gly*aJk#`| zQg<4tguSF$D3N?N3n#kBf|K(u?T_mm@ipd_tf95^VFvS_wD^H!42x{~9%cPbqF(hN z6m-6G^DMOzWCMEfm+map0iX4TbiP1yj!C$^s9f^q(#~Qe{oxEavYXd1rPCL+ZS4~nb-0cweHQr^1fS^JL?t*n#n6Ccb~Dw$T_(tia#`YL6Nm(rO^UHjNkfb zKIdqh>db1VrVmu_b%6jmuGJ5iCvE(GkMPn1{dHYy3%LeUj*sOX4MG$(7Hrf zoE>c@$W)(iD>lp+$|ipm3O+O91-3*mxy4x^IneouEpy>}^c5xw;a3*X6Q_4C7-z{M z+b0<1?kQ-MW1?Zgmm(ge1q{y};a>T)-rCbG{F)7c($j5gzo+b70X4p==~3~Xo_L)C zY+E(2Dn3tojj;(3s}IR&c_rMkTrEDsXsAhlgq67cr~_tSU;}5obY?;rlU2UkXqJP& z-^K}F8_v2w(ZjzY?4wSSVlL6gEyv!2vs2XSF7P;!D90%ri}#Yv^TX-MXgn4KxWqag z@vZUZN{HJl7>0#%e0gdwLosAeJdIeuq;4P-7m;Y1)6WP$~v6`K{whxRi)3B$h+~d_BsLr+_iULHQV;Ln?$QcNf5h< zC(F1ynKQ4m5nN78m;0=*aWC~&?sucA54^!O_}Ti&6J4xS2)NJu$s)bR$02g^2VpRx zTeS4;^z#Bg-oal6mIB#h{oCl%B9j4UvZ(CYfld2|fw*Qw-8kF9kZBOIRLHVST0c82dh#*0#0 zD;JsmNsnNtw*Sm(%?2*RkeZx08(_)a0j;lw8Nn!@7pybm-CD`v38?2I@99t+kmnQ+ z_)yOcd?J^NqSUC<Q@f(X|az^?KHYM5_do`vF(0$;KG&sv1E@kjo z+Ln)JJtDF+Ons`m5uuweDI2Dsj8;6a^fluS8cJXt?e^0UdMpl)K^GnBGVLnLS@EtW>fEKb8nKq6jxa^{$ zu+Iq83{#(VK}h;3Q%H4!d!i@l(lvQu1k_C<64B;2zZ`ZWBem_61bI`4!??4ix$g|4 zz*~dn8WZhwn~-fxJ8fqYz(_0Efh(P6=~7+Ss>JEbMl0ub%qo1|rOE_I;M+{D2jajQNaqChSkI`5w6d#7F>x=w3cfx8Z?|wmqx3j>J=nvhtiNPS%fT zKz$fw0S$qcBxtv{AyZOXY-RXIwUh?#8__%(Ct8e-^>N)RjqbVOqdk)P#tHZ7Ziv4l zrk!8hJ&9)t;!f$7T=`1*&@1eE1x|=(Sb9f5tjxBB*ylLAu>=0(D$bXSyFhP5-aTs^ z8$|=WvOs)re{v;G&v_uH*`pyxG~IV(klB? zJb?_PGno4Qy5IiZoo*f%eMFU@7Kj5iPC0atAE*qnqh6=(PAC+1U&{lm+ zshL?Ui?Dw{$YL&&n!E!Qk&TSNVNsNv4X}_u=|l*_-xe+#$)3hg;f{pj23|RA(I#Z{ zkP1fV)@$+kU%#C0Xr-|ycUR&)>)fZm>l6lT*CHpw9=eB(qo}YaaP9no z=x0|dc`<|K=KLXI=i)4qkPY&OYJXk5Hk5p!DcYexpOw|W@OrVhHSvt_ z)n~WmkNQ=mm<9LDh9h2vLCta?<@gY#25C8{N1j;0o=1dA+BnX&yBeBD`FnY4?%8m>77 zFHr3&kirxra63Hx@h1~q5PiqI&-J;=%aS}6>t5+Ss9w1MB}&V(_&MH@8YZza&_Xj- z!bRjbEhR7IDmKjhx|%jy#HwWT5-~@-+5LnltE-xm)ikO1&P{+Ki_UYOdr9G5szfb> z76+0Fb><$uPuaf51QI-e;h;EUM0k|Y%W^V#pFO8;K4>l*em&jX$zxo__lhs*M9*FF zA)eNCjWE=A`$2G4;i{U@zNHCB+4N6WqwLeV%| zU?=xvQJP1XgqLK{gh=?6D%AV*T1qWj$T6_`C2-IEcnEVmf0Sjj0b3L%xOB&{TaTu6 z%+Q)zVTjx-#hs&s>2mU}ih(S#EvTjZSOBrQDBrVg;6t9px3{{RH_ZCgAi&>kX1$3io3K2~z31P4PnH zIAr8{PvtzuJYcf>!GOsDx4?onhVq9!c9gVA&M@JRY-5_|S@Y{Kg~=K;Ss=K{z9rgE zoJ}|o8C|=Ft0*L7cYiB)v==SaH zaDgc2`*}eo{8-|>XS8kM_as~ZQrcGOX1lOt3+RSKYdk$ABr*TKdixv`MXEo5%gclR zOD0y2$hPb{Q^riJiWfW^yGF;%w9RKi2LHyZ=gFR$i+Xh^S_Ce47VW^~c;7X{k<419 zHqCr4?aAYM9bJC$5Kj86!dJI3LY8_@bB&XR%;VmMj2cXqT_ZUI85&8pOoHq7}$IW4}3>b=UgctgAOxVqR-Vop*b zelERIVyRsOv23Llq+3EV!9Sv5wpbi4-0)D0NI`aM+{J(&8q4r#0{P0W?Cx zYdDXQ-^)tbhIZTfaNdzdEMP}oU;gM|CZY2zXj$jqhN!lo$gC>+M4@dg@{0NPGd(mmrKsUiCre4a{T9=oP;D{`zD@uBRDkjwhHpN=CTf*K56O zsTk8m#>W%*c_;vX#lJJ7MDOHH-4)$^-zDr*nr^A>>y+s+W_H&$+za6_-7utnXU_T1 z11~b{cS2;O#HwmX8-CxAcOnSdd1u@Ea=Px*UJI9Vr=TQ{yx+x3hBz}=8{3F}zs*%I z{(@fKdR1c1Yjl3FvAqWQq7B5JbZsOYRJ5Q$+|JZqk-DTE3BQ$oSD@)5VyyRH57ZzW z#aQ9__hndwQnOLk>3urgCV)Npg{rEQo|V zJ7qV?IrXhD^C=y#ck5cmFp1%}N zvYv4{WVAdfSBLsW>AWoUNQOZ(9kUB7Z;;y4YD`!uk`{ay-U3|?v$CHBI#b${hz*%} z&p_?%_RM!Dmqbkheq)sF3jzm~)*5HTF;NK79MOWmUi3@rEN#-F;ExTU9MQvU^prd% zZf{z!xyulmGblka6NJ^L9gF1UPSQ}owN53}ew{u|fBR*ygi}Uj`VSb1v^_{$npv}? z;@Wt}H9zv{8oHr__f&`!d8}IUgT{i5yVV-{;0lQk_lDjpCR=JcgVx}nE-KR8#_F@Z zJ|+3eLADr8TKYvQ2wMWfvJmY$?V?9YJ66Ft%8-m!l2C|j%QQ>w@ER%7?(RsZW!g_B z1eXh&6GbV0$H>lTv9(^nTvy|*w{wzBm6fmAq}y*ql$`xmQ#jvv3lA#FF+aUyK;80& zyrtZQsKnjnI|-N)!SCk{c7GMyLPfLA)+?d<*J4e+Yd zU-MEy*@s?C9o}s7q3=?)8vK;j5N#M`yn(T|4TE4QAu(X!WcfFc3+yWvpeAj z@eFrr!y9tz0Hw^oe#f4Wn&gm0J>0tX#KP>Do`R}y8WX^*8Q5&9@kqW7CnMa@6e^M_GYu*Y z57op|jO|#UU_P5I=8nBiHkwKlv87@mpm-#HzwY96S7v=p{FUnG~^@DjWm0^)a zBaiKYzbP`bGes=U7;>8D<9|WA?47)deIVxhiM0#+f|~C=dVg_-#3PiaW(d1aw~t<{ zF{yHXgsv+X*$*VzVHw(0riXo=SLHiPXj@|*Fi3yp&(>d@vXkzJd>{w=;7>~Y+uMtr z=Lq=->z$d+T>2gqQ0k%kN#?TMe1#?6_RFNZqx@sr-eW(nl3TAcpkH*{!x|~yMX?-= zmU_Eul^%|cwCCgC3iJzw?aEU$kApIcz*o}q9KbugCV16ZqU8g(`DyU-S8ZBS1kCB$ zdis)|Ns#pLiJVw<*ok+e@cp~|(}CqlNUz3U{(*(6qjAL?m*oBSbDc*etE^hM^knHv zsstZp$@Pp~G!JAFZMPyqA)zz@Bu|zipFc_LDyL5;R3P# z9BhukCl~?qdI{prS~5=q8nbAnq*kPL#vkgY*gvUx=+?QsnkxSi2dDCbYvY>(x((&h zlhBr%7wYQr{91e{RSnM!uYwcxgkhKaK_bS$E%d(#xo3{LZK3>@Iq2~O2(U53c00Yq zV>$SnJdPB9q6`M;!sKol*@m%4#K9NG-@zrmsEo%sm?@^Y3(Q_Faw@k$XIAMS>exsu zwvP@`E^c>|$riFK+T2&$t8*Z`VKl;}C+0lP;}b?p|VQf7hblRkCv)gWuxZNrJ330qolTF9RzvV64?zA=7+E-w6 ze7#kLB*10M-S1=Qwc7Z+!@9S{sn*;O@d^W)kPA z+q;n?GS?GACkO8+X-EB*{$6k;GQ{;_@eOP9d$6nwon}4By!w>}DwNT$9T&^KyFox1 z?$M&DW$!!7)rm9^5_q0U^O&}g|QbwlSwb-Z$Q9fbr1N}<2Q2E@1#-rX$4)yWY z;-J9osX{*ECCOwCiWRgZgmo6iN|;Xh-8uqO{Idh+t65#C<0`IM_^kFQqNS>m&nPsJ z<{|5vlHR_;aUbqHd}8oCN{R_KQ8q*r8KSJ=vnSAqW43qopk6QVwF=wS(bsn%3<=WP za)Zhm28{-3?{SPobwpL?vFAZHc%J}^c{9l7L^69F&$jW~m|gb0xwAog2o2BXuC5@9 zl;UM2Rki0N{o50Rb2nyk7-VtjK^E)9$K^C&FdS$S_|7TnMc~nE8d5uNKu6Fc@koCs zJa5WK(~P_?6K)-A<v%Sx6ddKp%7(A*~{?;1$ zcbeBA=^d-GiLZgUrY>#xbdulO)k(qnRWQ$qc>fK*)a(_KJLT;n+{;qwN_{FxOL#!P zUTMT!(A*~z8MCrunaG)UBEMQcjTe4#EV`#pO-4OgcfFLak`CukBqe|7(F$17i{Hq! za4T7`b0mGL0(E$|5WPi5&o|b0)G7SVuPP5z0%u9FV=gL9X?EYxyqV3S z68E}KYALX~P##0Y2&$nn<*Qrw%PQ+4H<_Ce-k*K)g@b3FEaG$MIG3d#>~&Cj-k@Jy zGVf8i=;#$R<`sVXVQii0#b8nDuw3BH&tG(Jc3J}SLg08d)T~c4IT0>wouirVUOZGm z1?nH)lq9k$84w#jJO3tieyei=0<*mmp-2lWE-QGB;+7f0X`Cb*+R`7`wV-^`sjMIV z*2;-~y_8qP^Y>Qno-LnYlkU|Lx6TCvb<+fH3zG51w(eh6jASrD+k^OUHy37Xi(4Fa z>X*VOwMGYy%%pvl>6-94u}`li6I(z>aUEEsa``z2`?O9`_)KREq)GukymM3%xe3~G zecveOy7tXK3px@V4LOV_tY2146TLfs_F5qpUG>iW<=y6G=68)=dZobG`O@7|?x1ei zgS~47C%!@HTxG7)pvN@zd|%<+5(dcwHv)-i0>E8FEiE*%xs78aOJiW-s;eT*e^$Bc zz_>Z2H^L^uRdiRf^VNW&&Vs}#j`Q7Iw)?l9wMITl-xPzeMksPXf9VmDP#z3X2(Gumz1KdvTt5lTK{jti5q)-$NuV>{#CPLAjC9+h$J zoJ+4Dwj`QO8CL(S6C9aCQv(eTmnqSuW9$zpJ6D@M0y8NQouV!Xr4V zNJvJny)vBr$&vM_+YMX!S))>-mxcjtYkOGomVWejss^U0znq6x;IE5%J_EKtwvs>~ zE*U!4`R!pyl#&7mL!j*=NakC`mSL~*<`%@nf?2gCD`E0uxHeSp<>?Q~tRMs~T_&c` zNB&#uzFCk2>3i;hplcFc^h!)RoeP4Mni4ZV(r((VoA&nOB;(V(zKN^Ty>Ok4BooBd zrPqa!XTl~Uus(5TBkNuFS7QzFyC@`L1|x3GeSvqpiRswt@WjUvlJ0oxs;6_d={~-w z=sMrJB!4KQ(9lj;THj56GiJo2-_k25>5!IBR_Sif25cx{_%UtM6PMV+7a~{Z&m|(5 z7o=(XM5fJ@7*lmI;`ZEq_E%Lvg>q%|M~Qv2D?P{ajF0Z#gky@d<3t*HOs}f2(#|ui z7|_#w$T+j(1~#bFWidss%q~U&2%!RP?D#@m?o#cprI_8XOy_*lUwzwsXRK?H6$(im zySx%RlE0*a7CsKk5%B61SMr^Faq7D{tKBz3aq@gxj#nk0i9;h&{Q4K|kL^ng$KMYf z`{=sIz2Tk8=eLZSsald-D!wIw%f0=xm^`Is+?LR$O!_%Q{pm&lkJngp=!q;cYFCNU ztSrUrX|6fd1X=T!K)*N%_|LUO8v$&zals34mFE&CvhpHp!U}lbnaJs47%t-*>fUh# zDt3-mIfCYX?K*gIK}457x}8^@kg2lq&fBsodq;~*e9<}^g^Ns*TGGcn%~#`1bBJ7I zV(1}@99^Pv8L8+|B5J8=+|K`yXv}ZY7xz4kpZOOwnAvQ*Jk5+jEht!@vFq4_G zMLmnuL8ZFFB8OkLqi*uJ@s%Ujp^k#w9^sPPS!x$HN}*Pv3rRJ=#}plt0o&8#?}IZt zg0jqyja?sZzSB>k!Nfu#W_*-#I_SazB=x~(RdjO8*5;}}a?23YXNhL(vGahk8`G_d zkiD;%3VwJ|;aod>{s#R^!}Q(T^3axn&r+jI=2H!BsiVPiytZCMCyYD&9f;FJJPR2-*Gay?#8}5q=$`IuZ8ftKgA+G8#`+ePc?WH^Nxr^Kg47Tc-=&OOA{xmc-{Z2hPK10EFLs?) z=2qh-R_4F#Qe}!4dPlxt4Lw!pujE-KgSm=lva4xRHYyJ$igawg*Rxk}5%s=eAsP6f z$7JCcv`KwNpv*fe7{*y2tln5mw%@Q7$SC-GNgFN4P;nrxp_W@?e}}?@y;5R@^&t6* z^qw>6h?HF`rXK2GVxn*HTGZn@yi|NQb2awNmDmivp7q6}13vihOWsB*1giRr8aql)-fXW2nD%Jyjdy`1c| z;S#2{7<+4F9BE=Aq60i`P7SUN&6aD2WBeUZaGlB1NV@X--Jb97bTyYWeWGhWK0ojO zRRKQ8R527EH;hUtN7|7>avrOs^Z!ux7C?0^P2VqU+#$HT1a}C!gM=W#LU1QoAh^2) z4H7K4yIX+Z1a}J-+}+*p+MILVdvAU9KIi#rRSJ^IUVGN8neLgM{{I@z9-w=oout*A zpo6^&a|pJCDJ{gl`o%SMz&X*SGeEJEwY@t9_XM8Gn5G@q<6h=b2LPXk^bX&-XNSfRxd>yE^u>S?uDgK|t~BEg;AW2m|$cxRkaj zW{-P}oE8QUACNQ*ZE~%_q90%L@CSD&4d?jDTI4-bZ9dKvwBG$pv;k|9jpWtci;@CumaTLSv5h7cA zJ>T5}A3&+MIVW=v2n}T4gVR^iPLR_gl#q$PG9QbO(3`8Be z*F%T6^y0b*OHNDOo>)0@k(k9ksqBizQg?qbT}ByF^4^9U39)4_N6JwspplBwjR(Zz zyQEjwysV-lZFt$@ym~so4#ilqr#F%}q-RC(=nhC_Y4|EN`rVBBD<=nYXWJ-fgr9es z_v%Op2qwXVR<3_j0%)WX`t_N?9Z(|rFHrV6+drjBLx;6Y_G7kUoB^|6 zXpu%i3{WqNX%Ta$Zli(8#sS69CWE<^cU4EVnhIWAZpb{$?BY)Njaih){kUduvYj9} zL%$U`@Bf(Qa|e`fOy7EwzyCJOxde@nv(uK&k?0c8gPk=#N>i6{#W==d;VrYR7<%v{ z(F_BpA@hJF$Z(8FS7X#it=)axMR}@czeIoh(;EhjlhvvhBY%9BZ10Yl6~KfhjgP0D zYAI=dZL0`NgY_I&#w@+!-q3PHBKKs}T=yy-?RQ#s?XsdLyKI4JJyzN#D&SRt_N;P+HuExCeqI$#p+Przz#sZ|OsjI}|%>?Fe5 zS#_@dTk1-=T!aBbuVW1gKHL=)cvRnJExBFjpi?N!v{DPyM{9r_@kkX;Spn57>)t!s z0!j9Ei9O(f$P=nqS;ifPgvM52L4e{iQBhM>#yiE^?_D)sx3w*uu*BuGfp$)dx-B>I z;avp9f{c+7^%|MrJ%?s5_Ak4hQ(6A$w;di6(NdIO(b>sRg(EdudV>jkyNTHn1mytC zlE&}4>!F5A8c4R^&@P;e+FvKOc9cHs;0kGpACaq)#h*@!oB6slE%}ebu}!%r_1jQi z9NwBwXW{pA1-$CWevgJ=hQZ$RM+h|&GniJ8^?0?bi{0y*ct4@Z@G~*W_q_e;>l61= zW3l#5KSgQvP0xLz7*lh~6xiJ6>FUeZP+b8(L+90uxcc-QXg`jQ;t+Sl_Uai>3=_iK&oQZG#1%Ph7iD7+>o z<0*mB#*?m>tE4!X{fmQvMMQ|rNlUJY`HRQk(Zo1vdLqi{vBsE(pj_jEH;^lk$zl|V z&Ty!KV@NWH+D%^3^R2o#rK&8gRVcPNJQ zBg?4P%`c`k{>GJ=X4zolK=qc89opDP#>t?XYP?ayq_Vg`X+f4w<9A^(7tCeOWJL6( zF1k|%DRM~*!jPfH6gw~+ji5=7@%vM~(c)->Cd-`S;2($b=F1{2atWfzYohZG)@>Jr zrnr%^l%C;v4qmI8D@i?fMjihS0M^v+WUJN@D7jc^)Dz!_Hu)!<8pUV?KJJu*&8M@E zsI|lPODdrDd^lpF)wpCOu^?U%H4ZVEub2rZ`BwXl@i71mwHMRLlJTgx535s}m{?rL z92jf|P8XAEG4HxCPeawcLN;DBaYKYB(r&#OE_h(4ekStKM@u0>As3ry`D*WT8iDUC z;A(gOaX`xoNh}S8#AQ#JYcSckNx;`gxGER(T5jvsOZE#zfS}w>(e9O^vJcOR+ttZl z?8ZPA5p)MMQ>3@z?R2ka5~%XqIm7#V;TSk=F3o540&v=HRA+o*`-Iov6ILoTdowg! zh`ND1*XAXq@DCjj=82lK$6&6tcPpj47a;>F8QdAwW9MHf-$Lv3#_ zd@(LxyOsEb#fhbYEkFsR;q)dcQi$#GkrqE`|2F(&%yaGh4?}a^?j2w?ODcSWGNCfd zyYXf?Jje9bLe%BT%Ud5CoVTumMDN=hoM&;T?I6&ss>X?1KDBw=)d+S}b=7Q__75Z| zR{(EHQ-AAa8Pu$!PgmU-#S#|&^fwZEOnH6|c1?f~`U+7WKLD!sb#rfkH>rc+|KuV9g`sW!;@AE7A%|k7ZVr%{ zKC+)j(P`DjBJYwb%B8vtPpH;cKU$;6;@x~Cd><^LRM^~A-dWCg5n1x+zs0alk5VZV z$GgaxrtL5$c^T4LMQ!$DQdJ9__5_5-wiGe7^nDXk#VQ5guZs=qYmJYY~j=)(H%0Zcz+WI~1e$T#N;N>!kh5?YFVM}6Ugp#mwHHs1D(VfkLmW(l3 zjNxa!xndCur{HkkWiK|aZzZRZ;ID}|06=qWmXI5GNk(%iTRCdKNOci-X|D{_&ukSy zp8xclgRkT>E_s%yuJ&M$P{QVw$}S9Hic^pOLm$}G_=SWd!Hem5~0p8 zG#~cMdH17cPuEu<6c|758=t1JySDUE1&s$6s~g}wV;?5J*~;yAzDQ$bKG*w4bs>wz zP74>)Ez}O*DP()r$?@gYO)|L6@jQU=a7|(JNa#%zV$dMfA-=}UPeHGw&-_vO_pWQ| z!s2j-i`I=?Wbr=`m(~5UNV-3`G5mHkolO|D(@j25?7; znFXDQyI^-1CH9HALY$moM?(?A9N!CBJ|~hY;i}W(1BJJfs8~-dO71A2{8qaNhVDnu zTeXzm?XD|jbuVUD7HNk0OX8?GF}-&7R$Oi07HL(duXZn)1ID@PSg#u$=j+PMi+rQ2 z=5TB07dl$RCOVDcX$+hScryHHzAZ!AAi`on5Ip555;U!VeHs66v5u3vp%$sMZ1fc3 zK|kCL>&d2)_nQH!oqXKh8d0lBJm`Kuh6)M3BXx`Kd$o@{2v^<^n6t-=*PR@C_3Jz@ z8M0}P^*_FLkz%p`RpRzz;_NWP!b0uO@GaDtM|a&QCN)a_r-L`%m0hMleqj)O>nBc8 z+qX*}hq#5|A)5bkDR1SML)WBll(#jbfP%^+F4Hp4M*I8?vDQ*=wpQq#-avDo#vo}F zmf3{ntsIN1quRX5*iRvJ2emLpy}u$w$B4g;_|@ z;!c^2`JWtLUlo^D)C+pgt8M0M-NtR&X7suR2Es_@XsHM?q#E8<+gM_dgqH^|{>c`W z!2g60?mTN3a~-#xop|mWjjq7I9~%+bX5f4Y0L{KJjsUUgU!)R4%+~o|@c}@DqmqMP zH0g#HFt?jHmU9c=Z|Bubi+hNBWHYp6I#g{Os-6)7Od-wl8IkiD=38r`)b9e3Lg=w9 zv)g}*e>6kDjRfeZ#Jqz{!UcljYZu-glR7S2XF7^F9~q*S1=yNxm#+PYtNT3EmhZd^wN#mP70H9#9?@;Fh$g3*m2U>1KfRljVg|Z-7Ux zu!ws?jYkvOT^Y>Dh(Op zYfKA>>s~nn`M0c!wE!c020|fURCMzFentkcvPch;EXt&HtpO%7Py_Q)`tTx~6KHAw z_4a2GSfb1ok5>$;f|L|3WAde$RfxWZn3y{F{@Kb{po6dAXI<#Q{4QfMB(9QyPca(2 z;`39RGhz2_W`*cZs zCq1J1k(9;>G<0RE~)00@MZwXT}W)thUF-bw#(7l<4?rcd`+ z4d2f+*eu#rNS#jaP-b0w|c5hBUGODM)e98-7qGfkbf!0=f21rrB zHo*BF@{)kTRcpxbXhiGr+ID>sioCv=xYK}4dwS)w{x?ZHTPHc+4GXl1-ex>_Zs<=r zPooGIo{va5+wUGE&!f|IJM|jA>vonm;Co+quPl8%$udXobcOHRt=p{|+OE^A-(LKJ za)S0u3)^J-A8c6s_awm03{!VNn+X2}SD_qbfmkSgKLsTG&1eY&Y`s1W}Bl1F>{~d2<#4c*!e|>}6N| z5ZZXNJ`jHzyvaz~!5QRmq4{pg1kvdoHqA$d(P*z1D1i;uM@SjlrOk6v=h>I$-TZU! z@8ST%`1*X*6sU*zVh$O8_bv-~$g0C`- zvBYgT2RZ@l|A;5t?()d^eJxOwksZIRLI`OZcm(pbzG)xC<5d4%-TY^6+CezD{FJ|~ zY%JNTq3?*qIDZS!Ca%w1B+~2a*+Qs;v(=`J?fwYQYqE;7vf>R;Y*6rRjPFj*upm3IB^>1-K?7%tdkjjq~PKoOEd{yYkK-+%*QKF{+r zCP8}QKhpDnZ(_m(#L2_i$bWwD_1a|UXua8Z0l03xg-^X1unlsLMr zg78JGo=+=~4u5a>2w;F~!Jh!=YAyuOyZ{8#_5xIe6(OUr_7CT@qWut26#tN}g zW<;P10`xZb6}<*zg#SB~A2dMw%tA%5V-AA;XQ102*)9VM6NK zV0?7sjZX7X1-DS$S8eX`N=-X+JAXkikgeKCjSLIJjpw-`sW{$&v6-ulr@sM9>ORC zh?rYTCr1F$##Zm9UoG1G;d#2%fFO(=v6jiu)0Y^K=lsvc7?_|A0w9z=8-2wx-eC)V zAKKplP?48}7XZZe zApj&^%NJbx$~6zkTDE?C0BYVjLNp%_!rh3i0BN&X$yYK%9#Y?I9ukfr$8rYre$~@| zrRQq;0d7naRLzO?ul54sZ|Fe4fjuc-6#Y66$qb-3UhqXAQ;+|6&B6v$?P93gh}UAp zq(5MQr2-HR1?Q~XBz94IEznglN788E+O^y}j!InRg=~C?6yi4CwEo ziT(>^ne_FU(<$c?U-s+u1Ngr{`2K_VRfHmE@MY-mB?&WZQyH>(UIl07L&@^)X}OR5 zP)?EQhK^g*xCH<(34#z>FEF-EBk}6dNd_>hI-v|yxzvf%t zTi*+sTr~oobWHbV4?rPq z0<2vU2-Wnv@ZX~&5%KpYes+tg5)(Wr^S`#8|1zsGrYS3;P!ZraKAoqT@gD*E>$Z{w+U10c3Hr}VrZ;2MS?Kt}-G$QQ&1B1C6~iX?;VIYE%2)s`U3TD)E*^MCgW zG07RQ-UBph$lli;1_6EW2Q$3fftN}ghGw*U`vK?dhiF)qXO6NRyCdKGw;dtrdG?iMAl!fWfU1A*(!*2%knwgRM)S6{|mU!Lfi^Fsv#C^%>FAaov~ z_vPds$G#B0<$c+`6CX*NQ5z&D4GjvAy5iRXeEtSV0!|_RQ4atsgiz9+EP+`0As{+E zeFGz;{;4o`9sqAO`q;jX_W64bJR`kVMvdbGRJj+NHSmxlSz#fK?PS{wyM1P#zCNe8 z0iQx6nh9+KS>JztI@eTRH(a}Y^U#4TPR_mzCj;JGayn~oID1e1ktu2TNfZhS>gnl& zm&5HpMX>jE5cF{-r$n@(-<1c@oJWMd#jX@mQmNRh&NA#-+^fFQO?wc&tM(&BnbO0l z^lPT@`#mcCwmf;^-Q(H92CFlD^~+?im|a<5;!pcMJ}zhLn?q-ki~WMI`p{5h0bt!y z(9qBz$s+==Qg`mpM)HA^wP=7|#b@_Zn;Xbd@9*uUXmbX%dSgH(wvPKDRLpKxEBlV7 z$J@PgfG%3R3?TXuAk_*o3&QZ(@_+y;n?tFB6>y&T2Y_&F18~`VfIy(`E+v#D4`gQ| z0%xK$h6Fz;5fMRtZSi3J*(zhkS%AmO&2$sTq*hcry<*e*&07x^!4+e4B7XprWbyr=;s8sTtt>xdG|8#+62XGgCVlNkEhv%;qfB}h-Y@;eD?f%by z`Olp-#|eC3CO$naRtM5*UwI$ku>{)1V;TSR=l*G68*e!9f!duO`Y-s9j?@_%^)-UvtwP7oNn{-{@E2pA8V7M&7Ih67QMQ+Kbpx;6_eaCupuf#- z|JjFwzm|oT%d>tlspL@-_Cm-?=Bs_ozz&U`4}bXQ`%LK*ILNF1*U^yio|2-|SN?)O zm-D$_E!`0vKCXg=J2dq46nK6>GnSqzxf-*4P;oUkO8h>BqdJC6hrz6?CEs_#!R?iQ z$nB;mfVT7PS0^-mDN|V2siSdRI%AQi$_|?1 z(Z0kVYfIMfxiaFM)2l66WA4otH?`|n7zd|+cr{*gkt)2d+!(< zGnd@GUnO|4Jv+ymaE$~!ODyDBWR_`?{(hD@ic#ATmZ_Z|!+h3^S zt5;Ws_V-&94(lmgsGn?!9AqrMbZDz5tJy=>s1Z&VH_*ooVp_G~u}p>{)nxzlnk?8< z8F~;eho+Me8=iypyWxE3DR{0)Av*M5-b)P|DD3GmOeE783O;Gy+4_zj139_tM4N)#=TNU+;K+|QX)>kb>Dn-=Kj-xgZ+(Uz&@m^EPyObf5uv%@jTsE|@sas*PglyT=XAi1s zx9#-R9oqgkxjQaf{duRv8l4deTYX0Z9^7hk7&dH#dpUOSm6~9RU@E#yNMvqW;)xth zuz{Vgcq{@p*be7ETUOuCc)lA0coX{yq8Z~^AR_h*a%1NsGAfLOJd~8-M8Tq|8jr+Cq7yFZ@$z5-eSrHv1U<3F^ zvC>0hrJv0kYXDe^8a=~)*XDOj*pru@vILt~O>E1P1$Eqq8-})lCtFLyHd5l6zAqKf z@!h-W$r5+fg?>7LPT85lF?}7OFczWQwiyx9&>8)leLj)wI&EV(wiGNJ@wX1LA1{0f z=+Iz8VCwNv7ry9%3XA@?SL#3rOCof(;&6H|tHYv{5&iV3{!k>1&A>gP=^OPn?@+|C z2hxcj)holkl~8IsdZp%x4twUeUGsTk#>+9G$e=k`5R)2ncKMcvj4>^7p>_J=?_xEK z{=VVN*jOC9&&v968f`RKKCcu8zm15E3C+h zU&XbBiq?EhEl{NpUCF$MXbXgW`LD^+*E@{xg z+u2vI)+210enIgnwyXHs?Pj!iJRaTzi#{r(o_#cb{TiA@{TLq`fj7E!QF6iFZ9G`X z=p}ufR8UDPjtu6ED&XDQYH!zb=AR9;!wXmekS)}MGA49CV{;8-tJq7}^^e_3K6iOc zC`D%Np~|;jUeGLhYVx>?P&f6}yAH1@eQ*&x9DgfdBh((f>2S-Bra}*p!>w?IscpsG zM?{E&e_^N-I~?Fk!>fczyr!&Bl{Z!1kJ&>5;;Xj8()|xsI~5KZ!Qz#`Uh{e$@~I-y zD;VO!78Bubtx@<01Bu)~`ZzQjxkaL2g|sJlDAGm!Gesgpo?r~Zt+I|B>!biz?~z=l zfE0;6%6uvuRbddts5xfuQboijPj5uw*qifr*)DYOC5$CmRH_UG8+VF?$M#YLbg1JohA+Qp z)FM%!9rHA_(aNc-4+p@}I|n0dP$|UE8@*|cLeRYUB>nM!^Um8~#QNRh-uHT7)}>E& zF5gd6-qOAj3Rw>hF+PJypj>%}3r&Y{T|8?CJxI{z0nLO7d%xe~E!3ktvUtIvvHo`U z8|dVra4J<6+Ef{#C>KW(7@9s{#}Bl)xOk)e8?t8YI5W*^D7-AfHFvm1xmDNH)R>zy#TANpQdOX&9n zLIU@)(W#FD7D5KyvH=$?1zKAybnrO^Uddp2jt3oK?Bw;!z#;OF_CyQs*ItG_z0imQ z|78v6K+y4f%uGxlbj{6ok_oR(GECB}nS1HUF;-VNxf+#9dL~K|J~UZm)Z|Ef2@i|R zKR^F!(iKLh`1v!-k)r;M@}jR#$QLUO=6C%Eg{j45MOj4F;Yl`crKNwMj5D`}hT1W* zF}*hswzZ8N1I>0sM;k7FXm`?>&CSVEHZ(kQ68Vvn#%Q~i4%C!bzi@N4%Z+f>qT#s_ zI!0&FW={vIHg+U*D~cI{(B^FEWmZ#(81Bfu?`3F(D6u;lTR6G6%zIMbz&raBxYlmH ztSBn^SVj88%6E}cS}*qN#gURdi49}#QihGBiwCs}x#nvBzyMDCLZfLNzm@Fi4ywV) z;mV!w+1a{2e5?D=gO`B#!;rwXGl`eU-5=G@DT&`xfW?1XZDiZ6qs64PA>PweFgC0J zCx|i^`iaqQiq&8O#Dfz&KouHJ{XKaIpWmWSS`J5_3%*kVx&ZC>-L*EUh9guz%=KAE zdSsI{wc>#6*Gl2uxJs@`S~RQ;Upif%w?=($AK%f?*TMPHVJXUhE*ve3^j{4M6)?zFISh;2>s_Z^_qIF_O*z3+xGG9;Y?s+E6Z!5` z2kkN-LA1B|kFWartv9-5G<6iEE%;QG0H^fvw3$Zc-Ny--rr`D>SN7gqIr3}QvCO8V z*~YKTfDd@d$`oG0&DOjhZHD20sQwV+;f1y#N5Mt|? zIQ^QD5wHU9D2^8et;crgNsGmXlDHz@L@fRcAwaYCe%QcwIJq%ZUJNxh;InSJU==vq zM_~}5q#V@K(^ongLpaI~BCnTnFI+3&FxrW5C(F?3J|Np%NT(GlIg zdf7_ul@cMeSq~5ECtEMi)_N@}$(nF?=7)zNRtfdA{NOx>{p8BeJd*k*BG1CQKKwG- z0i4k4T4}js*su{;yyKsEl(5LXku$L!T5O%M=y@A>vlnKzTe$Z4xHsZ36!(3!>F1Ie zo8!D`tMt7PSx&onEy`IBT-wSC!lAhL@RRWVVo-I9a;NV}V+86M!lF_4p%^iWx_m8R z3?;+F#K^mR>WDOwczG=y{nefIwaA=E5tm4(1y2RHtBw&r!S~FBP}4hX!cyOL9OP$6 ze{XHh9c5x)|Kz4Ky?J!Eo+x}DfgTnXR$SJY$XdUB8oU%t*sk?nJcy)%@8NU;{1gnaA3>@GRXcr6cYyCBH!*MhdLp3oQqXQ-1 zTDaOy$wWT4*?$aROHKUk?kr7VWdcL;4=i;&S>OF3bx?H zG2s$4dQn257hOq~4|<_h$@EuW8x!WoNet&46o|MY6v>jkhF0KB_WIbk!})!DnS=Gw zo$`R!B;k~=C;Br-w`Ei!u)%}}!QJfbl;5V?aS-M?N*0r%<&mUc4)Vz4lpOx#wmDXm8QC^juey+T^d^1f zb=#%=E9I?)&ikd6prckaR)c$9Pn*_BiXJbZ0mdGI{ zi+PD3zUh}r0AY?&SjDWrV+=LuzL#|9{G`ygMy^QBLhf)6!#x5slfTHZp)#PNIyd3q zuVnI?->fslz*bs)S4Q#4@<|SXl0M-WjB;dB_KCrN#KJ%)HvAT!E)6q?tthT~Z7{0+ zO9sZZgj-SN&{+9(Gjh;FH3deS$7_?SASeAe7)-=_p=Dh9XD9n6;|EOblkfxo!(J7N zgB@DLn$v>+qT3O+U$oCoMSWcltKbQUb0Fl6&BT&RBps=ZO+e$&Rd?2rIXzi6UJ!Lx zLp1(cWw1qqMOjlqn%8P2eAs7`gtuF+t^?+S5&l#Qs*im0cJw+PvmelY>90I4hpZ7_ zTVOD&j@%rY?#@~JTq^gN?S=FnwLH+h6aIP9byK$lXFcggK)4W1Fog-%V+7EAbPKgQ&^!d^&9NI_`&E&2l@rZk!R zwHIz@N*Vuxcv*q6poEoC0!SbLnx6Nk!)(`_6-uTN6V301sRiY--PE_99ct$T-MiX47zBs1$WiyqLqVyxxhITlD^A@uzNQiI?)m4eXOX=|Fq;E84 zh5JZ}M`-*dROe((I9<+Eu(gyN<_fe{lS5+ZdY^jk&%lyz>%7vxtsQ=wheucqpSJLBiz?vSxil$_ow2wgUj3sNm$@ zTtc9zAuG(eYF_^B6}QP-I<$jCnT3f}hNC4g_*DCF~y`@8Y)i zBRom>dc;ktIFit;w0!wac;h+>dY?-rmX2>*>81zq-MCxYTdUov6$v103Hg`dK1%Cyrk$f!}l0q>-X{ZrQI z$vrXMoNbnFwM%TXnrmBH@5o&co6mRW(1Kww9`39f9ya$>c-xk{)E2Wc=MFM@F}CD{ zU#Y0>xkn(f?K> z%I23qXmR*!YQfZGIB3|0>U^rmT56bnJWJoAJAw3Pi*jv5AXqq=v3JXMHoeB9k4m#| z{ox+XB2iIM;)fh_n+fy%E0Tnm4TY2~#YV?H`MIMC>c}mpoY!+`*@Gq8c9pk2F++GY z`4bP0v6-daZr@tO?MW<$n3Pk@Drbp4cb4+$X8+zy67P+yC3{hR0R&JoE(m0h|K25( zf-{;!U_@Dm^Jy(+RNAjB;*i0Hpk$I@gIa;p&sMB-StRM6H^M;JOv^M^{Sx~MU8cn-`o2reBp_$k@u4K_ zb7n7=JOyp}L}x@Z{SzNcEM1nz-35uj*AO_HDEXk@%}$#E?H7DYufJ=1{b+Z_?T zQ*nEU`yQA6@?tv4t>xmD$>H)h_J^dp1y|8j_m$jCAzKht(Bh8O3(`SJls%CDD?$UE zWi;7&J7~^dao^L(HEFD+wPlsVbwO+_cjYjedr;o{-7}8o=rV*bu)%Cwk3=R_RNftK zM6GiSj^4`|l-yf$>EgRYdsAhZE8=$r>nG@*eU0;trd!+lF3J}6+Bpvgk!QpO=ssY( zTj>~ai5H}^0`1ukf_GycBc(^(DYNNgN1O_4j(QY4Z6Htfb|{r0UI3{$nGN8{ozu046 zy}0HIfnnEyT7{Aoxpj%iZK&}B#lAi~$6A*omcJ+zu>z_|o{)y;Yrw?!omn&7KJba3*2mL-YD?4^T@2I(SFo zVl`!`*;pCsrLF#!ShhJfYT0BJ>Pqz|#;(ySSTZ*iFLfs z5OLuX8VU^GgA`}mx%zg~7D{y16_x4_@+^kdf8UvZAn}p@vf#WKV(6r%?I^6{`M_de zYh%ztpZ88OCd#1Y$pjRB5K+OD9nqLeALAfGdVolUFzDi=n7PE%8`0pRdVJDDmPK6l zQyZ7CpFr_Tg}_;J%?peYgM+fM#pPxx;xAWd5>cHJcOoQzXk$^lZT6;1bF;Fy{ zD=TY#N<4m&EU-HF#g(>TeVGq+z2ogtbE2wjixQWvJ%?F|F!zMTzQ;k*WX(vL5w6#i z%@8fRgqDJZmmLdY4J@?U0nw?-Ahq)Yyd52F6g6ug$sn!+KSy5SO6&4W9+?yQJBY)O zBSB20U3RCyz(j;4z@TLAIjN?4{f>6-^;MTr+oV5<98vI2CH||JyV{%ttPaf{-Rnb+ zS}||D1ALW+Bs;S^)$)Fn3(`@xorQe8&X!spg_>lFpN1Y2D%v`DHDBOJFpThYBg1H^nR_F*2IwLMJefcKT)zF^O34k`HLo$mb_lxu54@Wp^tddBJGVvV{w!)ua1{ z9hPUaPgx@^x%;%nsVj_r1$nt=o^G#OBR-HdJ$<{Sb6N^`MOT#^Ss7;J7hvrI6SK_3 z#Pquf>Q7Y7IjYQ-XtBjte*Nzl-HNIczEj+`;g`yh)i&WZC0?cNXy(5%h1h*Fw@5}s zvWLd522avXW4)=UfSDgW+KcvgSh3U>5>6PtJJRNrTF&OViEAn#*T2&cqVOXGsbU?U z9D0{eE5O)AZ$~Y-RTlbLmB2<7#6o4Ycdr!C<3F{lw39Q*CW6~w*bjwX-C&T?IfU=k z`=e65)@H7@bp2)VOTIMbJ|ZvW#q(m16|}i3;v|bfERv=1g$G}S+++Wxz)ox-+Nyz= zTmFF`wxtw_utr}^_UG}_%PC1_F6j5G3z}t3O&bnRI(1)YPKR9Zb#B=jj>nnA{Z;Kx zrUam-PfQ+`dK~7J5Q=51SvUQT!|N6$)z`adl6Ma4w_g8b0{?KH-lksq=^1W`}t6Uk^<@mADG6cp=*$GZ`02&72B*3x*X-#%m zG)C9!#M^)um%|p2;ea`@XrlPj6e|UCjmC>58u4r=3QS9#dz{ z{UU!vXhxr=5?YVqr$3NCoSrFII&Eyh@1g~pM(b;ek@y5$g->e}a*7(p8}v)(7jF4q zX*FUjd8>W%QLHshOP6<^ck}F(^Fy~^?E{uX7@}o(f+GS40q|FBP3tlZfgy};eu_O| zn-A02-=?e;>uiT~D1IA9WmAk!A=aD|1Nbr1*SwAXL)Yrw$+qN2cU+cYJLGFu-Ns?0 zbPZ$Z7TEMApevE%1kN3!$ICsyA!i5Ay+BR+gmFUrhs0EV6Q+FH)C0`5=<%))m1mMw zLTh9*R`wSVSE5`l(s)xzTg}j2`AwU!xeqJSOXby*FE^AujL;3JhsMWE)jUTa3Uu9j z@FoffsTZL5@V9w|@mzJPO?zkdopaY| zZq1pzxXSvDbyGfK2b=JdoVsCl_t#vh$Gfl5?=c!HcR-s{!|N^nKMp#a?>o8J#uo4P z@$rTRu|0dOTOX@@`w^*x9?!!Z25sN}T3rPhm1|koC$XEblMYsry5CE4Z_ISW)y;~A zb9evt#K8QfAaWq5>My|g@lrM)jmrr`T-jr0ZraP@kFmoSgMo+d&&mA zkGDVI`96kR?WWf0s(mi~ftbK0v+9g=zyP`(L)ddeed54a@dIzYp%{nyQK-pB zpY}?90%ct{{zXdtblImW`teo%(}>tdJ(SIfv^64nKK+R-W#9VKVy~_N*FGS({gha0f|L_-YFZ2aKl*c`oix!$x*`#r;j_ zGDwd1!^#8k7BY8j)-z*pl%T(K>XY+QI-CAL+K;jd;To_A4_fM#W#gA+Xsc*=E$3tw2U}`li#@<44wqdh`GU*SGXgF*8)HdNC#j#94rx8- z{m63P2>oQl+0m9~z8nq(=yb_wq&Zg1Uw%Z$FUluX#YKv}&!{DTGbfBNpDR7xw%-=k z&S#S6QdgrRsR%ZqB;5fV#r_e^RF`inm1~ZqlV^^Ni)HUsKe}n^_4Eqs)3hUGJG?6^ zsXdClN~w^Hy?0kWVALg3M?2PZ$2%MPodOdVH0EJMftKR5%JHeav{3F{waB|KlUD}g z>(|*BlizEl?sY}3#`g?zDmH(^g=n;nZFX|aCDxi@D4{PLwHdCgSgyi_z8*5iPkOK0 z==KZ9QW?cVtS@@Xn_0a|NMzDi_ThYw z*pDlz7iAt?II%P=`N7A+LwAaTo$?-L ztY}163&R5G0M5_lL7+GM9A{rKC7SA7VH4QfmL$-)Jo;U~s;ML>5T8w-3?JL2;Tn5F zry+Fdp~YMR0o=)XGsYvFt4>?@cA)%l%mjmA9iQ<>6D2C_Lqj9~#+x~m__s@6f9_-y zRvFxXmHccuSN=9E30wN0Wd3PuS9NB7QK%?^Ts)sgj#z^DUu{|8#vF^Gal!8 zvoEs8VGmvQ$c<>$e#>^wq#{0?%@~}$^G@J4dsZ3@w*m=mY<6tq%x1S0{o-M|JgdtKL|KP;2_Ls-OoWr^p!3fy1Td>aT)hAT=kx-mA zUJTzMajxlk^90e6yDB0UZRvXXqYK~nj{b1S)zDu{85Obg@r{T|HT& zA2iH~s{Gk(jC4j;|8z#e`2R5WmQiuF%erVo1C0d@kU%2=f(8rj5FogF2p-(sJp>CD zB)9~32=4Cg?(Xh(Cf{D`jI+TkZ&f|glI?YZy6k)}1dL^(cZ-JJ zg#?N~4+pl5Wa@VAlOGYsAmk3=9N+$YG4B3z_cBUa%GnaTOXxt+xm-W?3OM{x){cJs zla1KdaYc9OF#w?ZnWNzBYC273r7!ku3D?hhzFYKgz83r<^i#h-$p`|X@O@~!grIYY zw)-X>e$~2+R8LsC!GndC*QG(a)i_tsl2Tbw$hYUZtB+^a zS{`6chs8mfUgPFbV@6{OH)B0-zF?Ejxp|K7=3En8`f6VQ0$(RX;y6x-upwvh9E{%3 z6lWDIs;YNr)-rL?@^G*!xVaD??`@MBZI$6*SwUEs*ATYHRlWf9Qck})dc6gmH${Lp--RGCJW}q*L%C-5HUj-GRY|EDC_jNp?D_JZj zG4P>WHey~^z9k-O!uH!xDMt@-vmS0Zp*gIbhNCgUmO@|jatdrH2&#9+@WBEN z#I}AV7|2X^T`SYw5H0u0zXwoVcl&GzPu6d=HG2;~bP4e@wyG51t)!Ujp&Tw1XE-5l z23%eLw4;|Z#63w&!{fq49~xlZA$xXYgVPCy(=TlEy{vFvC4LxGk(ZHS%Oa=Db5V;M zXpxizsGi%WKruW6AA)P!cfV)kOp zf&?7nZfq?z-k<%b1wCH0U+dCP$?~&nQhSpW&OXI0XKC`q+4X8PNyP_z`g%Ab3p09G z3ceoIvZoDC9;)B@=uk9|V^=tizaYgN(F3wL%mkw;7@{!#ww|_N|Iw$r_4X_pTLVtm zrUe)G^j{dTnJ+K7re(W8nf6+3gq^UfK>*`?kYfwY z(XPyGq1bJteqe;1avAuR3Q>v$@x9|=rLYnd{upvZwRm%6kI!Vts3{F>bfSjZv0Mtz zy-~X!Ku%B+z@H)k@baG=hW<2De4PNNN8ezK6`&3|herL1I~dP~7!Eu{cO5sn zCk($|B)xT5#axY7HPHCC?$=S;T0dhogQptg*(sC;K$wVg``f!iCGy7m@Uks zhU<6aMM-S+Isuz9WTNB8%}<4X`56wP>NA7Vcw6_nMTwd>Lpw%Ic3aHm`NdO&AGh?h z^=$^LV2&XarP4X6%nua}lua;?p>4#=L%(@^jOGX@Z4+w3tJagz`4z9kZC(Y4b4m@Z zKKck#A;SNY2MP~`B$pm_dN;HM(=0FpuLzi(7Bs~5sM2d&Ce*asi`f_@FM9m0^EDis zJF~ISoAMZ%??vdGMeajChX__2rfVikH)qfJ8}FNJz1#K`FvGM~X2_iRj2PolFKQ=0DClNO8n%*%IKDQ1IVbPC z!Ql9uWx{uo@{*IoX}eD-4vvpF7uS@BjT*)aI#;p|%ivAsM+XA1*U#Fcy5rT-rv`CU z=6M||x&_a3hrnzpVL|y;`{suWu=Il4bj0s?qaH;WE*w}AxYu|%BVDh|OxhE8f;YuS z1^pnWGaQNlk^>4`2{V&jvH@@MbDYUCOds2Z@98Q;QX+1q`Nv+5NNwYt;%AkrFV0pB zn?69nzjX_T7}NLdLrjmt*q0y0OcJ&v3%3vt*3wG;0Hb5`swluCS@3+Gbv|_~T6(&d z#~04_X*Oq!phQM-X{!c>s7{kn(MO7eoPgY&_Fbp*GM41Sim2*WF#W4irj6hbswg!Pa#SC6)V%HZ9wnT^5#@d>ZS1Sgh=J&w z8cR1CbX-^O_>W!A565J$=lxIkjMk-Zg_HM1?Cat673nntgvjlFN3aT>$D1H+0h>MQ zJy(_UZ+#||ghFw-<7nLMnmo07^w#aO`&K z-+s0nLW6^Pzf&SC9bdmQqtB_Hjb-_&e>rt3oitFld#|}_++-)+ zsEUvNf#lN?@i#(_dVhDqDOZ;B_C~zyW)YJ6ICAgF0u==b)BKOe>C4pT1guW|yBE?} zA&cLlU9=fcD}ZKtvrNXka$|AY;5X1o$G((cx|?%!OCvn_w~2P~ZGRi?szral!XC&; zvW`~xVAhIG9{?Z!w_FWWewj1JCTj=m|Ea zK1k8z7GF@W3D^kYa4J-z+K~Jr4X(}2>6SF)m%E=`&F+@m8q#N`KS*1)pI?0S$J9>7 zP+Rbt7{ht1yWFIjw~IaSdPnGbl#cyt(Zk?V-rMPmX^Wrge9ZDuh{f}4KWj^kZ|-Or zM9KX$knjvs4DW20TrhgHn`57DE+J1Ul6j(*Yz78~auO2A$4LRbFe!Ehtgu!^s+f>I zNy*+rTX_mvNY}XH=S)PNk4R8RZ%V^|Q;tTNXNaAUn>}2cHi-jEHI`;OO^WK(?$>O|cbk|C7@^VV%07+J7R!t8{MEoq7`#Xf z0S~}*{Ea5T-A(nlYyM8yJ!jJ9qi$qZTGYOqF@){VM*lv7?N1SN zF!299u|{*&uD8ESDUC)~mw+8ZVL9a=zcmH#5{Dh;s*3ZFXd9PAMNh9F9O>^xmj(a? zXeuzmYh1D5P{bmtpSKDaCcb5KN#&HJGB0)KsHu$BfwF*q$o9^A5fQi$8{<>N>&jka zTAP+5mxTIy4AtLw+m1sW6?vtOr`&$2w?nhKrbT3PfAybSbao!$O;*M^?OZ-Fj^nee zu}VqtT;62pUhBqgtO$jtmDL}82Il+d^#Lf4p=%3uA>FRe=Ovyb5y4VMUEvpniT6*5 zx9anPk4GBK+T|Z?=@HFM;Qrip4SZa6av*yqiarx&kb?C&xq5g`K|b_mUADq#3JwV# z*hxQM^0-$}&{HrTBVbQ62UMd}6QPczLw6S$BgfL2Rk`n%jal9Z1LLgui}mZ}vR+3m zl1dxyP-rI#Z62GGuNIvJ-WP@8!1%sbf@%JU-vhxutQ!)&?~lHf{}F&Mxi7!VNCw-0 zmf@scQ`v$7;R-ogrh_@snob8hV6;QSY5JYz%PL~~g3Ws4`I0`0CVxh%wJ^&k8Pnrw zvXa&tLs8{_3M(C%!BBrNdr;qPI?1y@c^su=pOskoe;-y{IF%I1l(mBAtWF z%>`}h(8G3(399i*5Y-eaS$jHgV@0Vdni$U7*jzKw3ZDLu?0ptjqYVH zZ!cyPWE7LpUz@Mj#sA3bcgdqAt{J1_?LM+L2Z^mKkCP|fHi}4$n_~~0|b?} zdA>sI@co(j&;v?a(ELxJ46^CJGy2!E_7Ld&u^~k6ZZNl{5!(Bz$@0~byQrmgASWqh z$nRWjM^fn->cl%EN+v5%Ju_Xw!(azpF3U<<+Zq0yoig?2Z)as95;P9>SqYFPOddCT zy!ecl{jp&-ee26kmX<_^UB~Uba@T(7E#<5V@!#Lae+#c5%*#l#zbeq!9E9sz@efe- zy4fg>2YcNKMTrM(b#-5zJ#lGe!jy-Z5gj5#Zh0gn`l;Jl=dSzC5{nnD#F#LAKZq1< zYfT_7)~&w?(W2<7@x!hrXG=RbP+a-FHpkJ}t}T+OAKH5zcr!y>RQt z(|r5nRH@PK-ZW)ovNfruIlwYdG59cOhry_o{6wnhILet_eOT*B#Bc&TwuzTo&;~M_ z$w%;kAL?xeY^UAB=33!=d&(J_@*Q*3D4CR35TD~HSS~i`rFai2?~N<14frU{u)frS zpF;DbR+@tHiU}U-e=#rr?pmVN@kP3Nq&y(rqtR!E?$N-Xd|15sDX>n62VO_x zC^OrTv^b6sZVbH*H`!poum{;91d@w9>M`a-;NZ%^4jel552Hw+Nt*M9ce+xDSbipa z^lzdj*0L6h%{;Wj045d)80;0)BFAh&wzz1;GZi0TV}-TUe+7M-ayv z7^JHRUr2$0ho=Mu)k62k2+mN9TeU-a2!9LfcOQ!Lx?Y;#rM)zX_a*aS-mMXMi(RKT z)I4J$N@xrB2jj96zAi*jZ1{GD+}PA5U1y^v&G%P{ESDR-dsv4f+uF}M1t-SS#lj(p z>RNV+LG)34pLWmg3K&9iegCxg+AzO>q<{J+0mP{nT4n|KWl>yn<*%Ll>+K#vuvu;w z9tryVtnDc&pBUIjfOqn4-&hV<{5MFV<1aCUDq!(I5&FP%PH3XMwKrB4@;HO{^$`He zjal6LSw9;T2o|KUY~%_T;*9ICZqov5q(pZ7Lsbm%Ui2>F?C^0~a^+=lF_1xs7f^?o zF*JSjYgkHP?DP@iZjjEi%xr!{4YT7b!h6xh4WmHGllf%xCe?j*JF?7-X0Uez$Nbx3;%Vi^d%7pnqiog+=nl)^eXRnXb zFVEep@mr!yos7z32J>}lWux>S-TB9RyHIL0sBOzqUqvE?)UdnLXJeRG&D%g)eiL(E zyewu3h?dzOgTu$r+J6Ml9f|Jo&tBr#^QV&mgbB9AFHTVr^UC*qDpFkQ4$21b&rMco zl?CTiR=b~q9k`7F&(-MUJ%BO!KIJAqAlS9D#_XW zkmPZT7|y96T=wz?L*Bw$({e_`lqp7A!WSlL+i3*tzYmK)Uuu)qojZ~RRbKintwe53 zo2dAyK_tH6vJPxRxl2nsbfWdNZ3ljE4PzqsZ2Yqh6;fywgdZt7Oo`wjqeh|M#ILJtp4 z64|c_?sS)&BtAXY5m=#@H|MO!*WWO~fJosSp{8!Gk>5DpSv?Q?UA^CcIY&P(y%Um> zLXEHA(@+57@nHsgc+^HwW=aH=+w);nip%DVKPENhr?EMsW%m4x_k5B!V;OqC`?!A) zE5Z&s&l%hyk7H7D`$vX=)NO(nqT4ghZ}RaIPez)&Pqh=++upow)ye@eQ#tC#R^PiSglW11WmSl*`* zJx>m~&}w};bTLZC@`bY)#(9{2JxcXDJqTNhrC2MbTVdsV2k?GDjTamlCJH&*syDqZ z{8MYyWzu^ezPD3j_;$5qzD6u60+CDxV`dJKK$U#blEI&^Qc9$he- z0IeR8@_;GZr*3rYy%()-d@PfS&n@x6(d1#hN(kq963R~TJ<*h40?*ztDvZWm=of4& zWN-yD0P*&EI!$bANubA-`GLCFDsIvp^pp#^3&k{H&L8}jD6zcrUm z!P%*-{LB{R!x`g3&g0tEOp#+1X7f@!_{{I{=+fuEP}UyJAa0asciUm|%ZtnN4Oe&l zMf$7MH+a};=&YdRwY+KjD{2rcIyU+Q!6!>;Ap0kyP(o~q%%i$4dgeVS>idZXiXA+T z6wfdNRoYpwDckejpNWeP_#DoNS=B8S>KZ@`l*j}eK|QWwJp&@!GKd^E8QaNF=P+|w z44j6M1|8xE$Oas{ewtOmJKmC5)HLHgiqs!B=%4sLdn61Z>3Nd>DmPR8(>VxDU3T1l zv_JCy&DMjv{v0xtoWJ#kw9?=eX%Ga-MnDVpUs3KT@&XsM!?Q@kA)qlCI=-z4+dNdj z(x;BaJ6LUap?_b5p^jYawVQzr2v|Rn|h0L3R zZz;9=>$}_9^4w<;6bH+iF1xohE_Nrm=gbz(`lC2wHzXgv+CIf!oP|6qwr;s!qxdXZ zI_R|OGvT9s_sj2-NT|6k-kXEA(1c4r8&`4AZ$F;lwX(n@5qT$Uz&q%V^H0I+f0%LF z)1^Iu0W|I69An8uM=3-M$tDN z(3r_jUap7p3bTK;tL2)WVP|{8PKijm8s?v@D8oThu~IBeGK1^QdwJgSD8`L;ASF8R zcx2`&i-J#%vLJxadaez?b-%FqQiB`3$V5Xa8r-t)y1Y_deZqK~(uE7fVPWE5aJ#Be zDyo{E?;ekLyOo=^+zfC#$lYf=Pz=?u$FtiKPPxWwfnF0cRw@f?VxC?~@}#A_F%{>- zlA(W0cdBP3#Q`_d2d*ad3IhQ7n0YomoRtUI&fkwVJyXRE4Re)cjsIjpdaI&d`wyoK z*p*V}s&oNhqXV^(ZlyRq|p^X@xbCScO_k}Wy&OLHmj{|lt zcqc8nIFJEP2XbGt%%;L4w=}6bukUt?Kh*BYYam8d7Otp1Pq7p!WIr{V@z;Zeu9r0; z3oyF|u&39!(Em4KH)gYw#ackSZ?M;JOn~MZ{;PRgT5PX39|in`yp0WJky_JF2}!?0 zA$)8E*Hc5d3$ipZ?K>q7x@FN2^AehD( zVU}NIJU-w*`fskqYhcM7AT=j>c-5}6C#kj5{f8^5RxMPMY{nv7^L#Eoq;gAOR0*Nw z`z-cw6SPWAhrOp@y;q>|oM7|jp#M0=)n}+5y7DCk{sQz`Hz&y+pZ8=ZO1D1N=-=q6 zOvb?JE$jhtwhu?kF2_PV@o&i^-Z453LWlBU)D8mNjyBnMM%u%bwzp*7mLJuabS^}* zvpTI+WTs5{aN>%Sn3!@!ore2ITX`jwIMTBH6Ue|wmRYl78igei*UR2{;&BXR2pLnf z$?#*Z<2?F!_2ei^CkTC?Tue=8{S&{@fu8f8*Z6Bpp=GvZbnZ=1^nNTsadtORleS3f zIl?Vyh&;gflTU3;rR5=h)?8T`iT0t4MKFi1-rO%MWt{A&2mL0yf8b%KQ}v%%nZ;R8 zlAgNUSa!WvuHPb0^dQZBINEQxw_f(jeR}n9qVe-dsG?bZR0o8U-8CnqIb|FcT8W}@R?U&{S0br6#Jj#Jcx?|k zhz3{A;%QsySW|?l@bj8|8Io8Q5eOb8Wc@htEy9i*j zx~$z5@1nWaQln?=SSDTm<}MK~{y;A$H}pb#N{A?EZ-MquD~4su^54q2cmUfn{PJ@S zR!_!xqI%D;SvbN`>mjTuf1wV3K8>1mJ8$~ajSixED- z92mnCk~&y6-~vqV2vrr8&jwiywZY=x6Ur%Qi#vD#r-PE5$_{?_?c3;f8h`O#YSTh3 zg)f5r=TmZD^=Lx3tmvyng|cetf^=SnxD=$9vx8O(?$=~lCO^D32jlw+6N?iyp>|lcM#GS*$fCmy(&!C1#dNdk(IA5Q~dW zyd-g}1}

;yk)>gQ#`G7YfW<6i)2_lC3a?yoC4)2|wM+;J54F zp|ZEymtHcTp`pMyUC1p-$a&5M}z<$A}Tp7_}@*@0F~P4{!%@&me1`*aNaoGF;hHMuqO8PCFB zVqXmy`u-TCE3EA&v`KMURj#sf0u`w@1`lyrNEj<aE@O2vLry+8NR^L_m(3 zo^{_tZjOGkf2uky9Vh0N_-kjY%%K;3almU=KY23D)mTl~e(=o1x=E-S;2#r-#+cRVQ(0NHS zNxYq0uFKk$?{#IKNRBWAq&9kc8I-U{Ff^TaV|XHGq7IRNj}nwfD|TQmusCJ1OcsB( zYi2!e9vUtr=v$bn55Hf7^PvkBU|CjsUk!FUxz5MSXY}zHNe?(L7DO-F==|PIRL3v; zQRw#6!jtp*cf?!2?7eUFfX}aIJ44e0&3lWV@Ik=hk8Yxw2`OOIGvnV$W+8m)zp#_W z{bZ+bFx+ro!$2-c=B{aHR%b=e{P`s}iQD|{0Aq8VKOl?$ZIYjS6pbmLp^6JK@JW(ciq^@xsuNh+|JOr$k|XW&(*iC z*N5zWNalCbA0%g9)y`C5u9Uq+{8-L^9}$dlo~NCv6&)X091YIT&o_Rot5mA7A&ar) zZ%ioB{R1&XI@vAo;%FkpAg7T3%!LiHwWDUGlkO}j&da(aK&EER;0~Sl;7JtNt5+@y zz8H*K{=Vpp_!iL|z+G@_ z+MK$iH({>D>)&t1z7jT3REOJb5f)Ui{TRjHP=jj6$jW3ny%_WHyJr0u{=&#I0h=?k z4cz)o`B0-;q?~2LRo_SwHuCE{IuzQ%uT(%dg}MSe~=lXP@xkcc-P|`UkeH9 z6$zo$DZL;PSU4OMwvU{kK6rXG6aybPS=1=VUT)y~%PAbyaa*=1xh^ReV0LbUo=cfX zJ!4_aZcv=|mrYE}cshVQ9w5RB1PGFh>HMvQcVFX2AHP)9#%1E5IN*Q2gRrhzBDDQE zO@{!pFZ=jw8#I#>{jfx=tR9UUP}Y>^un|iYu~Hq&MlV;eED9S5}k-a{PXunoUO)9H{0qB+54Z68S(SCs7u3 zx`9j`e=3Yjq4$XfF0q*1;I$6CsFefV^KEW+->@NagOdCJiW1WzRqeJ|7E8p49crzD zE2-#{+2hyX*;KQ_rkg=FoOuk~?D=iJ2qCJm3{Y zhET1XECC#aE8+_Z3W(9s-E`S(oZdo%PMI^Z_>mz0zU;4dG2ICgqDM|7a5s?hZ4 z{4O^4ufCKWSgD`|QlcjkSf6#!;QlhpFNmr21%+FINzlo{)Zv@Dg!7^X6KZOc14GWK z#y~xAj7|!w$C*u!knyE^!k%x(f`$WhoB3-kzq4XA1e&uE+8B`+@nZ{s4d2|!<&H<|J2G4K*8`3 zFAL3h%ZN8XT%sZ}Qc6R;-RaWo9h&_myTBg9KXJ$X4`MmmnX>5HILz`xWu&M27hx3D z7=+@!$ z%JHU6;}(1Z)lSj4fk=y5pC&DR3b3ga%%jn%usl0#+!eFD71 z9uKpONJ1Sj@-X#fWh=Vxwc?^MpIy#e65QLwxe`ZgHv4c`T-8d6BHO;hT5bXqzmA#A&m;&u5;8WhLfGFUog_n7p~<&iwGnX#9Q>w{zA!}cg-=V;z) zOe>wtFEQ+oAXlnEJ)uxD(fvChpxy69zUhEa9vdSq2Lvh($4(fa0NP#dU_qGyjt{ zMKZ^2YH;Q^8S`DI=JyImuRs{+f@!ZXjCa|8EZ0qEH)lFde<|nRonVeGJjhpevB!vN zT9Jwpm^z6pK5bldnl7qZ=9S7y@)|XeIPLjKe8?Wm@+BB%ZKg87^%wDVhE1KO@d0}o z>*ddEDS$c?_}!aU?lV)RS&w{Epec%HW?jN$gE!))kE`wJXH@e{P_KY=!^F8ETGG0g zrBK??j(&LyFPzxkWz8i!=MPu z#k+Jp`)A(j01=n&JL%DO7mYk zfJ_3V5ymb?LR`k2<_qYe%Y0}$6H0VXas8>|m*MZ45lxIQ;vTRPl9KEheYb33peBvn z?;o_Q;&32**_)EjhMf`KbC+7(+{@`Jio=QdN*wMx2c+^IrJN|&j7MN(Z|g8t!$f&7@Lfw8DDV)V{j_r^C50Tw@zRvm#CIs5*SInSNpXYb~vT@ggYE zQHmvC5E_0aS+M*2y~xFqQ-O(x_^V5Uv6fQL-HQ7w^s^v!SM`F}mt-T^gPVd?-LyDu4d5 zMkDf7?JvDCg)Rp+f`D3&RG5(iEc}lue1#aY-=bi1TP6NBpXXB}s$t zC_)fIWWige2*wJhq8##hWo;qDOF%2Du{?hKGci>NsvkeeTVGUODvgevL%>$3I1G1V zKRjfTmaR(=$$KhwLZqXBr*P{$oOpjEB2i9z50*ujjJj9XdviE6Wo?|J!+>-6`s-&y z!}87H`M>UmmrvCOgyeLBEoeTmp87YMTGfuMoX%^hIae<4nl%!uAvdoW=xH{txIW|5 zaz8JzToNoLSXE@bNs~JqB_ds(n!rBoM1n06X^|f$_o*|rohl?#y@fsd{UI&C&0lGo zmO}OuYG>(Nu@9(R(AMNWQ{70fw#Pyi(3rOZzD}EfLslwH|Kmn*|DTBzGAbq~j?PU~ zN>y7~+m6y*bfc4dD+?FQWpXs*PPz(aMjyE8Urq2`EHla>o^{>W2k2J4P4Dko)x^$k zO_dW7?c_E3VKOFZ&jIbQrSwybyR|P!uQo>v=Yh_)GNo^-Uo;Y?<~h`=CbK3`rC3dZ zfPL#cE}!cH!s!-w?MEsLqCmdk4%h?rAXvYt%4l9$+)~%z90cvhw(e;7`ydp@r1K9HqAv;u}4Bct97)%kN=iyXCmKe^W(Y{bzgi zxBBrpuFu%SaN-!~uC{La>^c6|@`=n9Gz_1kv{i%1I(&-HGP6?t2?cw(m%baMHWHMp z&)FbSAYn`a$n^c)Skz&YWsHtNs5*}6Lb;)zQ&VZDcqOsB4^Lnst&0;z*bvF62s~cs;>EqjL_Y{SYbJKc#xo=9T>Ap~L{kcVI&ee+p3MGNPnrg^~TK z7>UeQ+UqM~)*rp=x9TxY%}(Ys{yCs}7rq$nPAyCAUm^Pc^6UG%m9z3QZzooG2|PvR zr{j&1FYO_IT3V?3ObM{37h!+=bma2(H`qUky?<>sN@Pi7O|>PC z*%Pqptfsdlz;!JYHZ3%rCG9mN9wFQ$go~6< zA-hTlbUYWILnI4u--W0%1RCM8KS*5z%U@tknAxnDo{m(-f?s(G`F?YIKc4{4e5Q z&=uji(Is+PrJz01;YPoFes2vhq~YAgARFXj!*PV^#WJg>K>}vWv}rDNe7yr=Ans4D zfP|p@HFMN@TrNh&(CGBP)N%f+Rr>FW(E>&S0@Ubm`Ms+Qx|crgXR3vN68^kbQmhMZ z*d*vt9klyc$*R=-@!EkW9F}|Q5-o)+NIX5R0~##3FC@Mg04%o9IdA7y#m(%pU_#3= zAS_sP+zC~4x}>W=G>*vQEZf^oeszZI)D_TYG4Q2kVKp9Q&+h_&I}>#TtU4jGv_LQq zIx?1kce8%3mN$tvAk|7XfuJ))+7kTDpxT>-7PmRb%lv z$rvAF&aUpujfWd4D(r%)Ll68pN-cOOsk8ohGRe3;VV|I&7AzJf*xaT3~2p~?Ys z?WT0!rykl2mk{LHB*9PxVs8a+jXW5RxNmZ@oaVkd6D=(GV}3#4x2IA9I%_Sd@X_5J zFpKIU%XquWe|LSO;i{3jNhpH`q2!7mwIMZ8s0EtA?`S2!$yXk~gZ~8;0Xo?K_O)md z!rHQqhXgbXkAv)Z1`o`Hw7p@mhv-DO|{o>*4}ub*RCn{MkNUa#XnNLcS7u> zFp3&pP3N+;Vxscrz#y!M5ariNi#<9TK!7*xN4^6USBcw^mK>$iN6^xCJ-6Ufw@|m}O6if3*kvbudR(!ntBm6d4R1z-3d1-Sf^_rI-I=9n23r$bLb=4=>Lo6PBF(n6nisaNZ5(jVm z)0X_VhxzYE+k*Sa`;x!~fxIOfsp0iWY$tQ;dXt6m36 z0f9(}0P+gwIEjxp4kBATsW%chi@wD!W9!zi(uV{@0`g`_+Y-NBs0|WGi-8}=XqUqW zq|zy!eZHvqzX&l+e|16fIG@C;VmkKPX|^BBGotzxWC1!ge~}``7a)D%l)Vf)G_ZZb zgrOsshWl_*Xe3{%ntb_gZ0P8|DrZl?3IN(FW1u65rnUDRnGiPQS3Cy>o&wZ6&zEEz z_Y16faX9w?3A**NTCJx#5{suO1)9CAg3y*u?h5a%>I<;_Kj?I)Jz`J+3XAcSINrz$9pR}CVI=Oy}ks}O?jAvCZFJZU{J!BQZv zM1B!?Sarnbb>axf1u;E)B+@6(JFSzzHYA%g_3&IpgfHc;IKZeO`}GI8)}z_k39l9s zgQY);D$Xb>5`kb1jIZJ^LXHHZg1d8Ldl!L)~3|@;Qpm5{nz^%w%N-yw6ZAfsOuqfQZzU%<^D}5CF=T}my*~qp!`DqK1+E3~N zF7PpXe28E%X1=K`F)MiB>(k_6p%dyvEmyPO7`Q>G$pE{HR$TJLv&fxOZf= zIJ7DwfYNZTCEytT1So7maW4QPs4RFCTsaXDkvK1N^TNJs;^!O4dvfwzx2cA9QWjhJ z?z0)gB}1;7>gy#p#cIn%b4A8>QUSC55SFv^a~z8OsUm&1CG*^QYieq07WW%#d^YpA zRRW&J{gP(mr-$1Oz4)VS=$-)|J7Lp%=Y5VBA#~5$E9*x8_U<@rN-SBFuKyV zC_wV#Lrl* zWIayxdg2r|6xexsydUof!Y26qEww7YM8+L(>#i^!CG~iFiUK6bd#YIK!%bgXLAz1*9uFrCcD5Cr8z6tkt|O$L%UnazLm zIWFVj;q8Az{En216Ng3)p@KKA1V^9);;}-43zqCJZf?3E7k7pllX$!8cu%JT5Oku# zp4TxkF%|Z^3L>PVE*T9`l(H)M=qKZ9YdlO$W%8Ra6K~_fi1~?Hsqq`u*VmQ5-u@$0 zf(8WN4#)5(3DTE??*Gn>|2@h4AAf0L`>;`>xdRS|aAP3H!)JasCn8D_n`f_wc8^}V zTq<8uF(ug166bgLnAkxBs*{!l!xCR?`X^ky zHH=>1wk^uM^oxO_Bf#SiziEHj8z^R__bOA81> zE~OJ#dan*<^%H(*my;W-_?0w2%~kS`>bSpwQth4pD2EzX!P14Ky~q7!VY*#mGA?zE z)*sLcV-;T*cH;a7Di+|R#(s}TBKH>-4k9s?SpV)nKYkFbjSm(Q+D)2ws)0c0&9OUJ zWyKs!Q?Syqo$8@NDv1Min2?{UvC($}d`2D23bY#Q2!2j$+$WrZ;0x}LrL$v3%}vt2TLF@H0G(EYT0o(4fr{hRtWmwkGbJk8 z>q{5b0-vLzL+<6!ZcRk9fB#rO)5$8Wn3P4KM`K zoZ%4BUWe0GlKxM3l!yFU!+IrZ)6JT0w+Nglba2Nt0nE&vD zgkJ7LD@>7Y35>JH4~h1_CwxE%a2zC3%_9T)27m{{PDDQ3`s}MzxyqE zmTGmg5Ubt03w zgs!yO8aXn_3%rlL!oWwxN-0i2d8sm;q%l&Ai-&b5crdz2dQ$reLT<;6>DZm5SV*pRv**x9 z7}f5&jBOH3b77wwN>u7XGv^ct0{}b==`k8 z&25MfVs~q2j=AgW5g*`|ZqK*pgK=mVSYIqU3Ed9LMlS)m^0LQG1}~ds0#?&+fPtNj zJ-xiO042(K!!ZAIgU98hDm_O;4@sRm4EL%XuH3{TEh^g0+3v}e!)Xu*_C14ub=t;Y zE!lrcW-qw{1NpV2^-7wb>AY?LVHH1zTul7zRx<*$dP8(Sj5*Q0=jr+7>a8HynpJlMiw;!W{jUkWqII zAA!7{n+%u&mH}?Bz5a+S){6zI3>p>2ksg3^Z|zdma;4dCjXwh5HT(yes>l1~=PJND zcYHGEBO#Z4>3SG9y{rv?S}`_IkpMMTdzc?Qcodx0ZAg?eyE&;xLlh`zJKyq$@AnFx zr&IalA~&W+SFK}V`R#!8K8tI(>v$n)5vlMLT&C_-Bu`d{hR;i*$qdNMF zwZN+@t7$Xs@h3AE7k;6kHoG;LxOe~qSnaXXiA0#+1NUe7d^g>^uq&JnNYc0#V@slHq5qg* zfDif_1y120w%G$#g)0I>-hUCErZ)y~Pr|)2o0MA9IVEu_?w76)N|V%4Skf9C_Ej|M zKQp75mxU2>{vR0?k0qkm0ET6!$mFD*4tjvLoXudo_XHf-hjBlst>jC* zMjiu6OYNL;rK$4%e6>|u+9wXR60XYE0_R(Ui?&E#d!&pV^>j+J(Let4vKL03!8r60X?9-}1O>tHh!1u@VuOmqi6yI@8a$iGfHIB*lyOe8 zqwoJy8UJ7Hy=PpMN%t)Zv@{43R8T=e&zMjN4ndIEU_eEJf+E>K&N-(R5ETVXAfV8q zl9S{h*?=HPa%@nMoOA56i<$TQ?t9OlK6Ag{`J`j_Q%}{d+O_vuYwtd|i?6lM*O;fl zcPe#BYY@?HBS?gBhoyy4i?3^urd>wwzcTCl1 zMLjJp(60yX=t7+mJZ-Zz(?iX~D~B}Qyc&rguEkI`b(!!hf34$zK5M>(!JjH= z8Myg8iK+j&4%g54RCHjNW#-gYzp8p)xd9;n+uVm^y9G6IL4taP`M5iE0bTHeEy|d6 zcW0|3F`k)TLPz$+*2=}FwF$E_u)ocG*CqAb;|i8~+XF?oNT&0z9H(?_LzD3DY3Voz zzDck$(G2d`ST&o|v&98W`TF?UIAEj1ewM)xv6^++%PJk0ATIc023B~mbU$qRMs=f3 zT8+K99c(9mN3Y1apnS=Njsi3RMPj&iKmCM%k4ayd=#geVgbh>bbPTV_|GM{1?BF-7^nsS~>87zr!4_ zmw380llv_(g?yeW0l4fj1@EX7Hpx&EiJ#>J_dyrcx<7pJ(+pr-eFJkvN;{fi7hhN( zzV>C_XXNuCw7uj>eo3&9n=H#a_E-e`5o5i@XTr;}GIv@!du%MrL5U3efs5j5sUBix z-#-fG_tCg?*^ZFUs4uSO4nJDnzWeYCUcR;)^M}H9Z^2K{yPUlS;b{7YnTw+5C(@PX z5-nzRzT>#EVGRnuygcQg`#i@X>`ucsEUi^!{|(sFY1g}Qt;UyrhJ=JkN`wwx4M=i< zikikJw97eX{Wj#*hgFrw7j*VvR|Cg%Kh zd?;5{LgQmdb(gt8s)0{gIRS(qOJ(@ zFUiNhf{cZSAXs-isn>fsU<~JrzmH;YJ9}%2G5D`d`#$14RZh6e^b|{HpMwh!;^aa< zQ*ODsfQhoh1?ap>t?DiIu<9vv$~9{`ym-?4`LU}h5bRhVzPr@t2CYP>p$GP-y%Q1a zht+Q2vl#jKE_c_zOzq`p7!ai3V)fOUS093**^S6F|NdnGeaUx5`!@1xn z8MdNMvw1!<3ORA$KbZ}0#5WwIa2-}1L(eSPSh2`^Tc&B?Wdu)9Wi+mh6ic~TNfz`{ zOV=;XZoY76Guw;!18<8HSs`4bl>aR-yp@r_T@0W@=Lr1E#UM+tQ>s>$@i|kRz)Oug z;JFQ-!E_&vFmw7*aN}Bh5FQiw9e+LET;~UT5Uky^)xAsMEA($KfH5L*iQqXQyD)`( z>A~;MSGP!2Hy?yAgcRhh(i8X1DEGlZ805UAF2(ERtuhSK$(KmKIS3ybB=)ly#X(lk zAoWio{~iPfgV3AmqLtWkCEs3#K{)?PWY`>J3I<`Y`OLoc=izusg1z6WKP}uGgh2oX zX)x5KxXIsMg+a7WCGOZ9Bm)g{{G1zw?SjV@!-u|)Ua;DHlK?gxwEjEs-~gpj%;30% z8mlF3#wmO+!SWSumtoIuomQOBgAX|dUExLRgMW>3#0NnY6zATF=Kks#!{%0DH~@1$ zq5bUa)+dsB+jj{5aqDr-o6bm$9&(+4vRFO}7Qw0QK&GaCer$7)D|=yDh3tnm|FXqg z2tQb1fw+>IA=#kEg=WIEo+a{8bbo9?@S$5b-(5lLL(o9eI(GIHg~dWi^n*hZ87}Lq zxfWl~bj@}sWED&4)mX52zHyEA)!ux+>TGzbaF3TL4~2EFCg3~$FbqtVt3UhrPV_yZ zXLjBGw~teR)p?Bt2x4nH1Hc03K4U${pfmcan+YtA+RUpOZWx`AiS|4H+%Bs#Tib&$ z!ymfPS0=u@zE-5mmufrnv%#31_2{g#>A@at9M9iH;mujk2jW-!FhA=rwF}|r`r0Zsc7Eu!@E6`^6f%fxI+-OM3)b>v>b(P@GKV|`+b6XA_R?50Ds{p zQ%@~XSR1tw8Z8d4>v`6%Y9mCx9Meo2le__7NNb^!g$4Y=a-s`86S_z;kz2`~m#7ay zn`MiajyN3pyqo~}LPy5UO8fb<;evW&krruR;m6EM!OymY3F?_&P13NdZ7>1fo1zfF z@UDY@;t@RYEn3IU3yG|h){*ZS{u-99*N5!2U)b=xU_y{!VHK8z=jG^iGw%p#w@l?1 zC;l*3fDqae5aDZySKbZnlY)1}yP9{ej- z5VU-QP}l@$gNMQI(S7iY4tCqX>%DGR3cH@K2F~KbB2PIXb4?^}9Kf+KI4aKudf&jG zw^%#)5D)m0vB^)awl~_+^d`nP0JqU@NxGT}>$EVQM~cMeUrW~?U$AINGE(GrdM0Mt zfFqGAI&&;gtg$fPW>7S0-kM^@wEtvwoN|;lgvqnI$*T`}<$48_`&4kb2$cM~on0&$1$w$Vg7OIBqO-+0={VufvbrcMLVYQN~Q)Kgne5 zGTGZBSUh(nStId@8O~spQ@Y-!Y5iO<*D$uysrK!Kr(+Q&(RTd=!!|wJa$4ts=bGoJ zX#!~GE^W9q@5yoM{ouCnBS`3X;<@qF`E(zv_-J?YXa`9mk&tFkU~g10%Wz=_uWWa) z+{TjsU^v7+izJ^?uZ`tFx4L92pr&#l5FFG>lK&%UFxsOo+V#i%xAp0{20rWat%>UK z(oPOA>5B%i^@kU!1t{&#F}S8OO39UdzSw@imF!&NAna@GbN7~ee$uKlpWr|?ULEVm z>RDV%n;z88F*kx1I(CcO>1NlLm*RVgJ~LmB=rs@l?~2P?Q}38tD2Yyn1)R`_pC!lu zAn2XFnZ`N4)gv!$73TD$(u)@&*P&(HS110C@Z)Lu6@mr7p6JHMxQ`s&>s{q^qI~Zu znW-|&W&G*a)IFN=AsQ!XS=heaI88ar7ri(+#r|G>261IF z|0lE5Li=qiIMQ*%N}r9{n4y^y#GNdzL*75Xgyeyz$e+=c?T5stj=itpAtutzmkH$? zW#qgmAl~X;o@?Ai!A0V6L7UrP><%nWk#ml`ANH&qQ!OW}ciVOY#n`^GPkRk4cLAeINm*@zrWY@7|bx4$s&y`pA|_Z#N? zSUUZA|9H1Uz0=^l3EW|Et9NU5E}c9aX-Bjls6Od7V`$MpBqX193f}iu#U4T3eJzRQ z%SYAY@`X9anl5eckF)i^L)RaNE8B1LVJCOewbaPk7k^cXcKI4pO+`(}S#^pg>*S@$ z8D{c0JN}EU$^PZJ}UWpbP2q0chpkj{TuOc zbe*e@#H3X9D(&ny)lV#~TRnN0 zf!VZd9jNka?@gnmT+(_R>SY=iPe`!Zyonz8dL-uCz+1+F>FVR@`4Mb$>s1FrvU%6~ z=$tE=#M_@7QgW=a(!PZk**3(ncJ0kMroC8tlWS9ZBERAqpX@UKk{BOt9{(u=BNy)s3oczQBW@Lqvmz9OCW+tQb{(fnzDZc^l&(sFj%W0V=O4k>bIi8%Sex>r3r zcJ^ChH>6|WIxd7u{9;>75ykug?s+m6aJG`qbRR3r?a5Csh)!|0zRvrt_=wX8oXBkW zuhqo7NwNI#JlFlZXz6~}$JhWy5np=nohs?`nR03$!4$rdF$L3|Hn%-b1!P1odH-4J z8evGPJZWl7D-b^gX!GIYJlt(gA+jq8iLWdnQa=SRCLAwhx_#?NjNULF`JQzi=EyJb zVgz%t$mWan*T9yk-B_;oiNr3G+y=QB!%t2b%_Zi|#kl?ENLG&zmg2HGEiIAZJgz<3 z6t8+cpi5Jy9!^}-4lEFb?;jsf{C(_a*LALP>KwbZrRnV^T=e0b2|&~(zMAIPFDilu z7p5GuY{g(S)CrM^;-{0A?KeQ6unDebOIN~$_{O1M1y)AS6({R(`ubfjAak@}j~p7U z?V)gOP!aOcjQ;e->lys?TL@rchWqY|?CO|^dOn`uyD~r8B~QowYvL{SL@9ZFasdub zSDIeY0;#9_MnP~6kh|PLd4Fu2B!7z#u^MX!ex{Q{!j?D>v<0VYo5n`CuKoR^ANs_} zFF)<%3VnJ9!@%z!MYCJH$5Gw!yb{x;SCTE>>!Su;-`^>{`H3h3gY^;3#>G3%+5DA- zPNUtkBfWvV-ucV;vZSlYmO!X3fCCyxii68|;zb1`vKt4o+Z$f^UB0cOK*Mx2ORq_~ z=6Nw$Q-k(C{Mrh-;9mT7JC@q3=cgZwY(}{sorQQOkLQ%Ux|Y?n$Zo#k9k9KkR?b9nlNrqdA~>L>t6(tNLcG`Yw&SJ#`#RPIpY{l7vvI5Iuyetq z@5+FyZ?vlwWxac3?f!+Qhdb0&Wd=$kqx<3bWG1JVbY4rjzLT3*)HKv-yi;r??N$C$ z1xDB(d68lkzmI*{3pSJi8@@BCe?=+fqy~Vzoh$|P1Dtb9K}*{{xQKJXP%*L)Cn z_&&X4rTQ*2x4HIrT=$wo+yM!qns2lcb%5>Y_jf^huKfXme6Km^fe2uYcE*qylubMC zLJ%f70t$tymXH@lUOdyy2`RH=bSIxc)PgP|(YWGdeHK`76$1Yu* z`&`mH*QP<9R<`*Lse)9$jK(#aU!%2aj@#%oNHYU9dU*NOL`w!0>Dg~0*Wy*UHKncf z)VOP-#Pbw+y_y9sOnu&O)6VVE{djO!tu8=uEI*Q)H?)JPk<<6=z1piDVgbyyIUcWPpJACA~$h|zLDVR{A&TO ztrsIVQAoNILef)S@=6qZ3r>nQQ&?gO?!NrIiAoM?QF>CAiR$9aqr<%qm z+uv7u&qk4cY0s2t#!_!2rxjKs>@mx@b|z3ciyiru;`eel%6xUpF>?FmH6%8Kfd4By5?Vp3Wqf9z5uhjd9iXl7` zF~%DAY-XN2cz)expt5HqN=dNbqfDM$-4Or-?!pfJHbkdQpkUaJ<0yfDGBNQ=%B2(0 zGLWX*=e6QpAqq@|c>8GadWlIrk2*KQaZ^xdxTlSZ9wMUz6n3F?s2(+)z;muhs^dUkvVE5;xj@S`0@3NV3&`c5aI#d-Juv3joOF%b74$mUd{jRlN!08!Bo*I$gNuk)&tf zG%VQikYY3qg%zt#!@u7~S1m{c5X2^65#Nchf};n8|&62N4R3iN}S&agja&G?5byyD5ADk4uD!ycK=P!NMHB`Pc^tnVH`2Ku7VlgmF068K%Ms-T4E-thb=Dy}7u?fDaeS>K|;CL}YDbga)z;xND zKALTs3q=uM^Gm(}w4`d6kV&?OnNu_g8!XUU z`m=xiZ4z`!q|=%oP%_EeW1&~e2>=weKjaXx1oYz?06|4dKY~)Pyt|mFZKPKKLg`lH z`e-W<++{PcA8RLXOp+nxXkl*uL*M4+@$O=eyd3ME&dxj=gLWm6k~IKhEth8ot`#|3 z6%EA(r2r+)K{DpNS4IHzK|)PFjiS7P`4TSq4n`-}@;!(tPray%t3!4q(=_ZDddaS7ojznoqN(FhE$c?s&|e#^BXSu@nX1VHo} zyzE0!;^mH`;1Hx%U&T|f69jWrNdSSWc+3sm1TI)<6z}@m(ZpRRmM{il`(9w5pIj4a z@c@x@7i3`%y8C3kR<4sb)`L8~4(ngv)jQ05&@lFZ)iDn+SG9gj<1Grio6i6~^ui7| zEL50}&2*}S%%d=ZH`~ykl+AU=SbX0p`?peW^M3Gp&0WsBq>%sCKkS&qk9!BY?R>1< zmiPrHeN7$LRQ8y*9U}pW7wgUP;9(UZW8?i9%O~Z`U4t4@wN(QUSfFG1)Zxjek$Wg_ct@6_R|&>$x|| z@A&J*ADs_m+HWkk*3a^0mh;&}OL90c5j{+0vLKzbrV>Av;iHJj!O$^_GA-ys{@F<7 zF7cul04RI+(aveaMI)`FxEXqF$`_4o^g>pq%3-59Q1nY$z^!o0@@1%2%j9}OqMkku$ zLtfc^<~Zp%)F2&P=>6@*U#*!&N~?gO-+;`c+9AY`S+eR}2#*!ygN}}ZDdgB7!AxKT z3i?iK+#m<9#6dRUJp3;FH^W)~Uh~RlN7Z#%D-6=h${^8#9nQbu1_6H8b4~r>krt{A zUuw*ZbWAD2I!;0@fbLDqI@V{gh|~diq38RdEXW*A-ug%{HIe@__O`bPuqt(@OQ)CO z2FJVd(pU9XNY_5>AZ4M8(0Nf#6;YR4;iT`7D3-OHIshw5m6TV-*eROfGf^;Dc#HE= z3;um?uXSrm1c<-{+kD@rTY#Ul#_5p6rpDsOSm@q*b*#y<%ML-MOxmCS4~nBP9P+UO zc?TxlKupK|>dzrZb%{3!z1~72dt@y#`+R%vwh@bHIF=E~mQ^EEDt&BMD>wJ0%s1r| zz&b?r5><1D1y)R=-9C>rC;oh}v|>8=B z9O_Ov&(?|qqgJDP?@$NrvKvC5oXAM;UrsRe>rZN8k+vu$!dzX+9rfPEq~$u7F_>z0(PW8Kzcbg&o8FyzOwerxe!jo`<=mpoDkqY@?J?sqHs28 z^B&$czOOcQwhN)xU$`6|nzdrr?_Le;jN>@s*(Wc!^2k(+)=hS<;k5PV9eU}x!`_ib z3V$$nERl*USQ#u$zcRNZc8FDQ2qH+%qNgw?>E>x11Qe{7Gbl-j=$}1+5Q5DQ!?^}G zd(nRBma@dSaRB+v(o`73IU9(122XH3<%FfE5p)0Ek~Un1v6$Lwc5rd)+qN5XfQy(x z_10Yr7|^L_Zke-zSzMWrF7IL$dCLGZlr*?9nqDtv<+Wzz@VrfD5qPwG=QnvhJ>h?@ zZKosc1|%93c8lE(A<0^pWmUQL>=r1VYI_B&=Y=SrJxpa9J- zKS2HiRxWyz-SkB^plz5KcVOxb^y?ko!R-IqcdEBj^Lkn7Up`QC(gkRH^q}$#Ai3?u zRy?KG$}zMD=6>g6eL=j=Mem34W>{Ow>DL*&dE-xg!RM3xecq-C7Gm^XW+%GJpe9I4 ze2F(*bD+X(eO)Bb$%4vj=GWI&Tq_x_bouNv{t9~-b|zTn2h1O2Wd7BrY93?kJ7x1@ zG=goV!ETb9d1Ex6g*idM{AuSN>#xvdaIJ3GQ=-dvWdj5WwY&M%3TzXZpQ}^#1I`s3 z)~43Q_Cf8&p>9#W6xK&~=)v#WWeNEYb^u>aRZ1!K!V?`K5dDY^o*iW_c1jhH4NW=P zFV^MT+is9?gK&H|vwOUV1Z(T4HQQRFZ@RHUgEQcr1x9QY;uVaX&FHEhuAK*Ls=$c3 zf_gAR#l^2rb;;Ac#=AS;uAuiC%Y!}n`)%-=rj$4aEN>s5ZS4}KWuyW&hys}YuVznI3DuINUE-vMBDz}R@^UV z|LeTVF;qH{?eDvCV56(a9y8jOo_EUO_nFs^PdE}SD!m`ZG%Zg>wCt%p*cZ;z;0D}v znJ=}q8x408KdmB{-I=sQ%#ONBd@sEgI;=UE0#w^s`ObqYl~;I4G2nfm2_O374rYWQ zfNo=b(x(eNq6K)A;Hbi$bVgq1s}e)p%qf9iDrY)b=xm=dop%{(D7OYs(;xF4SSTp_ ziuTaan-6pv@sQV%=+k|zK-(0xDxjTR<)D>RA3j*IjZVQY|LW3bk2^|Fd1mUlTgNN6 zO$Sv7Zxm|O__rNSCbhBGSrP~5YgHEOVqy}AUC1KFEK~g%J)J`1rBpM;K16~&ywrAS45B0Srk&JBD*V)_#+ zPQKzF4~}=6kzX>Hz|r6nwS(*MY|Z|I$$1cXPAr}>s(xn5aW{h(+*SqYe5U(u?l%7I z@h|NkNWH^7GPa$n5juE`1TdrKZ=xUbMaRh7TA=2^1xdvyQm`)JA?SiaZ`t-isA)I) zeO14SYE0F8X7}Qr`PYFw<`72Yj1>*$%Sd8;WOZQF z$`BMkXCvx<0r39(L(&zqP>_`gg-aP#N?QI-?+v^WCK6Nf>jDKBg=h)c#`(V_SedIw zYlq=ZEhOUG$EBRd&hO(wfjbmO)iAk=|E-h?x9yt?@mYJb4mBz+SMOrF5}D5jTFo_8 z1-1dd(#_*F*XY04+Bbu6bk2s>8%5RV+8N$I)$b6lVT*Ho7|2kuU}{jG1=Suv#WOgX zG72adxY(0pFh_Umcf~31-!J11Jsy?^zeU_GT_3mU(NmROHdOa9Qxg4&zn-o@y)w=X zgQR^RKQ)lRl{yr9Llg*Mu$tyo;k`aFAT=o9U@|kJPJAnQ8x;izhj0a{Mip$!Sdz%&Ha-qLP9(3zg1q*hUh!s~bj(~s%z>D$ zLhq@*a%*LGrd)I7B@jOSDwO7bv%8ZG&^07xrR<%_nlONo^#%K!6q~ft6PeJJ+^19mfTMa~c!ELVzQy}N6 z7C7|y!B6Cjt}3xHN1V8Mhw+9#lZFTATYfPodV$o%MTt3qcb6NKyv{!|KGv{npLdg! z@bahud4&1v0FbI#ko6QyPP-pbc{vm&KGim=-v0o!>Mh(?+WT32mQIVR`w1wc7xN)8}JIyoERUk5_-X^U+L`(&bKOUy4s~{zd~_$&zC6_wV;{qb;|7l9mG{c9 zHI6KHr>{U6NK4~6>ZH0i*H4j^i^=M%(HDf{? zbWz#qSc0WNollsdEzWbahh*@_Lr_m4!Qfb}IO$u<-jO#^HYFYGOmqvU4GcnLS>9f9 zO-)yC1s$Wa2+zTh(G0I?>J1RuT=#p)@z;-esPU{WE=Oh4;;R+EzCP^{-nS9GG6uQp zYR^ft?*~F_qAVxnIqj4ged?kj^^X1HSew0)u{3*A@vb<;wZd{BDT36`$e zqrwPRiTV;_%?5tvmSjzr!7FwJ%k9e6Kn_xa~VP{Xm16|??Lly(DHvIkO6_54+v52cCM^3o&rHhU`v@LF?Pwi2_j zdGp3ay}ltfH*N9tlJ>u3%@!)y31C+T2wH!(ZlY;o*4^#OPbWv) z_D_RCAg3kaa%C{Ui_(5WoacMr-wxC{Cf_z%>rQShNPi7Cq5D z6mpkpL}uByCrV!#2F8hx+hsy~0dkpV>$1PLQ(9w7#5#1XD~^hwpdagmRX(bYAYcub z#_JS}!xxA?bTfYD{JR4gmL0UGOEsD6cB zyX~E{n%Q>C_Kb3UpLM5XSXigA_QnzLtlG-`CG^h_H)oVoWXexz=}x1i%TRYiWm80c z6s0Q_pVgsoQ4pmOSR7JZErM8FBQ$@G5&lR@w8Ov^_)x*vH6EnP=95BepkmOtS@W^Q zB>7^{hfGRmG!Wwwfv64R!UuOL(DC?Fh>}u~3j2Z>(rSc+WPVrA-o3>D==@Y8N@}Jv zOL{LXklHyEx;_q$jo1<^gb!Jx&C!)MP!6UcWI}-$(QLwNXKc7g#3}9!(wFLoH zRNe6mv5ZEsQKknendCMyNxp-d=%z`~zGN&uv!9|#&~~gZuF2Xo2_Bhb=wKwJ%9{ag zWReMe9z-)%dBTVhB*kn>)e_aHOlhX4RGJ&!J#-rEBU}<>ila0U2Q-lnes0n*5nK~2 zouNBRqwLn(nw4)7ncahB))SfiF3hTGiaFMel0_zvMOFoWQ^WcYzM(L>WBv5#mL~@` z`5Ia*ve&oWXg6^{;TY~sQQ&8^a$Agp-vc(Nx})-YCmQ1t8sls6=`IRm;P%62GCVCb z`w-0oi{{Z+_u6cW=c9o`*A{rS=ft1P4 ze|r~b?d59V$GlMtscVUX5~FO$biRx7rImLtAt+G`(BPkeO7p9EByS54nH2yiQJv%Q z509*nGyG5eRf<~MQbn7t!y~8R@1J}IvO;Nwhe{QCpZuUVOaW6o9OvYuRBo&FC*sb5 zwbcd!_>Ix_$dgv)NO_HV@LYBo9bYfqm`@kf?F$!5_*>!srom=T@%f(0U~Dw>S8xZA zkwKcv)RqXAaqch*FX&)gyRt1aLAM}t9Lf-okb9HWJo5#l(-HQ?&rZ)}e9Cwlym9=l z@#RA_@BV~~M5DccQXqt5-EMf*7WhP3RQ*vHm=2+uGSp^>cHv{K{>CjDhMJ2Pdq=}C z_n4o}s7PX?D>>*2oyX0g^1FI5u@@BFMF1+r3P(unKHZ$ZgLFZWY_xRXyY#kAh(eg1 zmcl(mMYx6d^#2Xwh3?gJd<@L9#L*jHyQT|IvV{@pS3ti^Sm)GZ!)LUecl{8 z!W4U0z@J81LC+~QMD){*xU*r|`=LXYyygI@Ow{otBRbIocSeG33SFRMhSkzke=f8~ z6aQJZH2rfN5G=d#^Nz|Nn7yEF0j*oYhv>`3&|;-o6Ez&^;D&g}1oaH7C%(gtw53m` z9UoG4wSr{t)#*o^VzD*O6Wznnr#w}96c2Y+{A@hC>LMCc@lRRXZ@f{j=uK{wb3$N(NGa3j!W&^%qP-%AS`!+dNZb(Jj;&n-YZQpotu=v z`3Z(?J|Mub5%0G3Yf04+mss&Bit%1aL`78AUkPNX6_QNOIMkWtB6^Y2v-QRrFsi$H zl{C$?XlviHGG~7oohJqD;+m>CkPr;05o&}1tS3(w(D9|pa~+UA7A^mdN`<(+@x86d z^p8&`&6^Ya+hD0W1m4+>=d=~ddofj^u0DeJsg2diE|k?=-K+02R)>%Hcunu%7#LhP_2ql7lQjQS*Bzjw3Ugz>148ped=WF&% zmoJ`p@p!EFEB`-<_@&I68Ll=7H?r31xk&?J^(NJper9-gJZ+WE~Z##VgQl&~+FJ(I0aS<*dxOjUpe*cyZAN+F^ z%I1i9#jEq9CXvT_Z8%NkP?`?P?L1US_HKBNeGil;DrTqnj?CDE#n@LLjZ2&(&&A7i zfXsfx<~G2oSx_5zPK3@hjyhn^+8%u}fGbG<6Kk|f<1@=MB!57xWiqHakR~9ww@z-p zSzT|{$)>nRA6QNUr|CXQvB!D52IpAov zw0u%IValx%N)udOchDNX9$<$W2$aUl;$lfb3OMaO3QC-OczEAzz=o=!I>I=R$2~zO zPG02CgqZaOs9%yy*H}?iI>wee0mpq+XZk)q0;zN33WGjVOd8mb{%0kfn71Z|OJ^;I z;!QKs`h-hQnac;#Pf%zamV-hD5F9t@o&^!Q08*F7-ac^dVFn_XOV$^35L7?@NW9l} z5bC-{dbQhp9rDc*{lOxNffeP}+|B!E+|~6l2;8YU1QJ4xEX&Q-AkpZ9mUIGOvQbD%M z7^W(VQ}=;XSXJr)0Q>Jcl=qHUx(V>{e7|15JJc-BaBxZauy)cdaGVnj|I}=}2_VqT z_Xi1;>gWJe?|?Fi4pOs>7Nv0nP(P+6h`I* zaWPiZB(rmEd6sdkyY7`#Q68yMd$l7&-#F3uxP47daXfv$97S^ak_5CENOYyr%*`7BV=kopsqFVi~r1GvY)Jm>$9OmKNkS?Q+LDoO~1drU;5Dt5IK0{Jz~aL2xoex@2m(xkH6drU8X)p8l!)g zQK1@!5=F63A9`ckzEN?mwc>4K1!QgaW9im#_Hfng(ld8&>Me~hNYxgLlJzR|f`SmF zXwuZj^l@Hq?emFMZX0Ft7Dy*%dOslF!A9?HVVAqs+*c;#J*I6jO2BCs2puI&ugPUO;`<&uLh_tdj*@gTPop+eel2&iVw*U-*FLU> z8;kjNKkb#Rcw390#Bvmb3aEmN>7FWhVA-WUOwoL+j^2Ba0(OE3utLdx{77L5XhY0m z?1+G9A(6&)&qNwAW2hil_$E^SqPK9d3)r8DFvkX$+FitV+ZeKzwRS;KxiRzu4J^vW z1pyd%9U8lI+tUp*F#BiW*y7f`JLn5c%>vFu84F5)ckX_&1C=U^p7yKW!^Wi+5evQO zI#~IX&^2_$rtuo3YbazB+w3c@pmtw{o|1*j3-Q>7$)ZWwRRrl*4|CFPixjt+z@~x5 zu)l(e)0P(qr!@Kgj9bNS>D0?mwVdv=UNiAwRz))f&}MYePCe0Gy?MTzC3ml)Es-ei z;ie1mqTuz{Sm-Ww(tHt$Y!O*o(5ct3m(1@2aRJhxq`BVY|IW_k3X-okt9zS&Pkjgr zl^A%Y-u)Wg?gH}D5Ru~6hv9w(@;lz?E14phn^Qg|NfY7XZE*A{--)D z%<-Zp=_iEWSuq=P@o^S8%X!}_%hznFx(xPuACCMB?>7d%()JSrXNIbym)$lx!NQ?G z)v0i$0-jO^_2c2!UqF*!8MtgFuFxKxyTowuU}us>;t%Gw6s;x|$>D>j=ig2NIknKU z?SZd7^1Jcg^*aR<`&MVby=C=R1{R$(>)5P4qdh%iQB?QJeIzk%rXO`lLYVJ3&{grp zpp3g*RS|C1lJr~#DqXFeA87btHaaVs$J6_F6Eaa$oifKZPAO)aIR;fM)WzdzW_^s2 zPB^aa7M3!WlR)4w@u13QQPybFCY>SB<~hb|EFcC4D8!FYh5aKqKncg@Sd6Xt62dzf zrbOTMo7AgGB%aWb2nD{oDBS_1Hc+-A*98onMI|s6%8NTjr_XIfE)Bvp)+4$e`Pm># zg5RK|8*0%;9t7OZ5p zqqUo>L1R^0A8%uAu~`HMblUPlDh*9fkxNJ~e$lTMFm(0=o|bS^)FiTd3@h0NJwL?t z)*&V1U@9BUPuEO#i_!E16#7}zUGvRSqz`OqOl zHtT*%TFHsp%Afrr0d3|6S*p-wu!#+e@+`(^Xj*+-`*+_&(PS?0C#Sq4iqfFOYQkl2 zE3d4oYqut=;A^$^LN9L5Kh>@wK=65V>?;bXv6?<@=3xmUvnPm_#*mV1`15FZ*Z1j?(u?cae-{!<3@cePZvu)`HHqd9iWZ24H`Rk-O(~HqmPpfGTI?o6Q z!s;bmCdPV&+wgM+8#8--s-eYjAA$EebNu>Z0P2G$HJXw&26W!olThkod9j{=%LCf>^SSHS2$D)RmV7Y*;&Pl!gzT)a$gWf*SK-&Aw-Jf9R zDO%{XK)v}`SUP@u3L1xo0d-FNr9yCe2YzHp{c=gI3n-`dQk~z3{OiZv{nq!4)m3`^UP=>|l_0)j5M@mfZxG`fBYk9Hw7}97Go^Rz*ku)2t*_o)A0tP4 zl?MAi?GWo6)&q(Y-$Y<5Bt?sS;|AKgHr!9^MJX^q4_uX_5+_XRxK=^KF`CvSGZ*G9 zA7#v}hQ~*RvA=+bFR|9UiRwe=99+dKryJvqmG?>Y?*6h4S#(e~Q zh+2EHMdhU>h{8VPRgxYKZ?k04N;98zvV-KF^gYL%c-^DT?2_1TTk<6YmkzhB5Q^O+HMo@{pPsz2Vp&C}! zg@m|_wlNIi3=vAjbZ6Aci|G;)OYn1!2SSKVr6Yd_RZG_@5G|bQgp^tJUK%R;^%!_g z2Y?iZRQrHfz63gc3HL0SuSOgmu289OeSuykd`Gq;@`vi?>368Lg%#S4y(Ch*xK-;Z z?Hdwt4AD&5Xm%>p@2A#F&%h^jp}UO0JRhH?9+M!%(8<=@@NiEgheEv?gwl)Mi5u9N zV;By2;h%HjnD(=HrOHG3@zjrx{rkog_??APTxI_#%j=FoCA@!R{@W8Y zuRXk#*xBM#s-c1VFd`||Wr?&DEEL)Uulk^YtX*0He0r`$o8WD#B6{Dm9}YUEYodchpMdcRF`{JS=nu%5jo zgI_nzfpDvxJ@^BZ%n^jlVK+ECv}q1Rp!w?)nJAe9l|yG1EV?-(b6}7;@JAZ9Q8I@) zGDpw4v^1DQZ3Vu5v6RJ>l62b;ahPKhKGCQ#AfFR_{ar7u=oXgPoL#0aG6$K;)e~NX zn2pFrXBJx@N^j*1kL}oC>{~`_g-~;~YVNY}|KkGgBj-5;o@AquXT`VahVC2klMH2h z5O>(z_m{`VdJf?`gCUn@_MOs#vP)JR-j|9{&$y4-vxJ5U{u;`Df~#sp=?MI9>i_)v zfBj(}^U&tMoT1%87rR!mee((b^@)G}kC6ls%2-)(tnkEpGmQWDCmO;NGdI3({Y1fk zJM@1(`2Roge>CEMmgoO!LQB&`z|E+=FR&d$nh1-J4ibc_nqv`8#6~SApr%a z#iLeNbv$s|?Ww1yCl3f*{kUWSZZv1y2ObzyFIm(#FI){yGb|~s6g=uB?CsX6qz1AY z9O80Q8%yd=CF1IeO4H-3Nq-HpmS4i=4xF#TKp81$nm2y0Z~W}%kBlQp}}w49qt^2YGP!V5AVFb5+fT$)x4E_^Y;*P<}J_% za_;Y?U*P}#v&Q!CpCLaj&?{63h={@Y;M@C`W344J?nM4YRfP36C_O7Z2fZiqZu@y&)fzAxs4C4&eywD zze8++E>mwQKfNSrd7NBNf4#ox;BVnPJANN;i3xn1^9W4fd3k&Ww_Wbkp0>?0Iu~Fe z2t46B5F>y6<+p~~Ik%;X4jClDf$kIYaq{V7>whD~2m|vgVYd}DJdA&Qe6d*V*nBL1 z2KYW=M|QrJpDo6Ge4Iee^a{jDZfk2x`C>^r(p2l<=MwM`=+cDv*rv7l>yLPG&bf@3 zu_Y&&6Gu7+Zcjwalf;V@iiWPB1-KsbmUJo`Rs<%qR~o3xC4B}rZUCja0^GFy=`If& zLl(>nK8FM#qJ_?<9}CZAT`%o4*iQIe?nnbip6%_YnsF;e#5(?cMy#YAu+Tn%HFH*> ze;&>E$Y;pI$%$i$|7RWnM8J-XBFh82`6pvO>Ki!gmd#Vg7NR?3+z7|*b>V_zZ zZ4AX>BrdPt*G>AuMJIb_?+;OktP-<(P1TH@KSb0iy?$MIu6KPTdem55{n~0%T^2ii({6dHMS@F0*J7J4M{C>UAxl#9!SG zfVVn%3;pjZmwxzrsVMme&XvdIL_lFs#x9jA>zswRniJ4>3zsafGtn#>TF{eGXXvL> zX{F2-5+|vUYa~-D1|-ZCYtI-J!JaieKqL^ceM>s?DAIZKR91GMm3#Mao*6!1b&g$W4qy99H}gn@R=$= z5k>h8deGEZFut09lM@wXsLQ!OlKLgH|wP&F4^PK!864&9nfEiZnj1yqV=wBnET zox?h&Min~^U~dfx;#)y?l~RUqv;hG5f3kBVLa*0G6{%ym;my?ict2 zXd2Ppovht)nh<6fE%JO4IdJ28Ym2gsR z=(X#+ri4Q4KL(^G)hUf)!=(%!8m-)6SMI)r>r^UEP{AL z)5bmnt1%;|H;xz8F`I*^quv9_iXUIp@}(^8US|(AJfGDne{MJEAu6O;z5sQ_5)F+v zUME5|m?Ja~a9z1nq$R|_qr*ELc?SK@W=o`fny=={q%CdshjXI}TliY6R7lzc0Fa5@ zZ*?g_cl6#v^v4q%BmG1Xbj*oEFOin@U$${Lf6du&tBXcv?ffw&ZS}$l+_?X!im{F~ z%6g{S**oO=peFeO8t25c_n?*F@09}80w6i`3Tb?1`^X$M$$pi_;$V^bj!(Xh@|~X1 zc@{^m0F+oF*6&O>5jrB{7%f_zqh~$%b}85T#qT&>r3B7ZDffy#f&CIj?){vtxl2*Q zA|klc#kSS2)xVq=w(IElf>*hn*ie9v&mO)iVjFLFjFuIzFwI|$F3RHhZuVA}&qr9)UbOI~ z(^)v*!mZl*6W-p7*KUER8saCn|}4=__MW zt~|r-yJ8MrE}y#AV~5q<@=x!XJxE&+p?zSgC#2{bxtgtG;X|zd?8hgE}ruD1$O7x18F!m$Gt`hmWv^Thl`K?QH5nj+70b=sm zIGtC1&~D98g5-6B)$cWF%cWo7=W@MYyx#d^7)arYRZ>xqNd1%MP+uZ z7{-<$VXa52N5YpuNm=WnaBY>@2=p^=jHKR@4A+iP$vE)frM~Mfp&8_HT>HVR{}9pi zNO{+7E@-?lnh)vD2a39KhTCEHa>?-|m7&*}8PBJFG6Stsv(2H_?hNsP=LlBi+mVv4 z1CiPcH<`gJ{8A@3%g%4v*t=D9kYRy~#*tsoagZ9Qua3zZY&M%!vET>JtvvCi8(TNy zZ`>o=p-pSOY_y+vtOY+XhL2i>WeBKcLANiW2vMBzRv|uk2sR-%__$y(+ur+)a?Inv zF0a!wp}2rzr5FhUbCH&w`JDk-eo+t;N#13u$=o_XrE=RZfuG~Db69Qa+;N{V)womBUh!z9YTNHU(bM{I zLVaY|)NQ)4wyCY1``Hq~zM1UDgU36AtLOEO;hI>0n!{5TwEN_3=kRz1u_t(0oAK7X~#o*;Up|=gcIIVA!5d?AH$AR4Zc8#y7UUBlMPBZ^C zqHa!7Zkf~MjjFA{;i7DBCi{6waD$DaYW0f6=g&}jpT2vYCvb@w8YB3N_{Vh~p{cxz z?3MRYBotvBh493N<*J5)Rm59+EwpEjvYB;>DB39H*mMOk4is&gI_UkuGo0ihZ8l54 z#6K%UUYvKa0C=SGjaZWq^x~4~yKT+cReoshaX0IWe}f0wGQLYVl)`KlW7MpTU=I%u zmzI>ICk66f8}w_o7(AI+^yjprgskqKFQUeI%y+;3yhL{#wQ)V_Q(h&aFyhX6<{eAw zby@$YIe2_Gz>Bu}Mz?Hxaur@}b1Fb8yi_U50{SR@5A){I>3Q#Cj{G^EFQvyt%DOgU z&V9bBRL)%C>}%5a;{AcaolWVnk2;o4ikHc%X)wsj#L}YQ)u-|crbWc^cfEDcbN+h- zFKS?pS6h@&d0p8NE4wt*e9hW1&IA4B-SHa2;kKd9vj{ncyVLN-?k3U5o&9bYo^o#+ z^`Y%b!{oh-*#+alaUu2LlC?d4gF1oY&}DCVPukZ%PJr_vT;Dz9=%^6`zO}{k{8o9M z@nALFe454b)~*F>wvg<)1|+I#eaJu*c-S|LWkJp!czuzwtUJAo&}jI(lFFhavckD8 zy~Jmu?=2+oo?tEqs%?=*u-mk+qq5Rf`|@*>DSnC86x$l$Hc6RZ1%6T<$nj7Xp^ZuS z{FGb;B28fAlo0#2 z8bG&O$}AGZy?4i>DALq9OVSf;=}VitI7N*bg8Ok^f&$unE;xmRm!syQg|~4UI-di; z@!_Vj`$VDPF@rzucaj1;Jn{#}nHds1cLZt18smhwf=ZXeZ5e{W>qDCvxoP-2Zqm@6 z;BG;aFVj`$Ne?$_=pp@$=7!C9-0W>S*=%h17Lvr(jCgo-*_MdzRTglf4Tm^u&XX?6%I;jW58_|%N4Js8Pp&Ik>+~p$ z`jl-6=xbLmPTlg4?rHg5J12H>un5!BU&6*?F|dt2Pg1$)Ewp{XuZLehSF;ihD2M+<@F?jT1EmiU1dD= z4({i)PiLdcjv^$Z8257EMO8((hBdR5TefDCEL3Mg3KmNfkfz)#;lU^~Q{AFtdCf<{ z91Cwx$3CFml70eG9X^KPk(n3lmz$-w=spIvVH$Z7z0BD}-lze+mh_4;o85XRSZ~=$ zaExO!aMz7e9{sP;V8M+TcMch8%M9PR7WSJ|=?x;4z;TY$4#VZrnQh7FHjO;>PE6LO zvh?I;SDenLM(|DukYtJu9we{2p3iuE3Ft*?@av`+Ke)K#U-pAO!c$M=-4OTiC$gj|E?rJLI z@SLFee1rrxoTtrJod=_Z7rE5kj1*{k)Y?mwWt2T^djwdKINKEW>$z_!*J|!03k^R_ zg-7VeeIxjWrrUz|$r#vWkcyo%d+j#$L{W1;wwTs01=X*{OskTd(duL4F^0DrTrN7( zHE?GHBXrJ%{8jyc01po>B8?t++GK>8e~Sx0Iy&nA`}ghMGw$)k%w3`*53BU=_!vsS z&bjL3+9#LR&Lxd2?GW~agsEJGNgM9HTPP}N+c%3gz7x4Z56kgaq3~npn~pB=%+)p1 z@@Trcn~wS3cfU{@SlD+q*4eZl#X=vbgTb~}?q;QRkwAt4JXaSreuIouKJA7Rf~E_e z;pv#biT-cXcTBr*zmu;b!f@(rcp-yaS95xX)tDb6NKO}|2sm-t7k-+=q_T`G${hC$ zVF~QqZp%hrMs@N4UF4X0?TfAcykM8_60x>PIr}&K7i@uk3)F3~cpNJ6XME-opti1b za?krh``nVjsCS@b6x?fy1yNJC&tr9Y+Nt`>ns{SX^xT5tdz)u2YxE&2gmqi>u9s}_ z2@$uI>Ue!i*>;G28j}E4TPHx_!}}*i-y_fGh3=_%8R&PL-X+CLWWO1OlYNIrPIttd z9G1sd0LDb$=R-G3^^@5~b1497(rOoUA1@eI*MgIhU~`ZO+c5}{0$f!;3IRexBm9X` zfDsgvcM~aBO48DPF)}T{Z_^iyx9Dh?Zq;KV?bb=+)WBwrDtcqQUd;xTJ=V}r+2q)` znkYbO0Y@?`zP{y?*-A1+jQ*f))Ye67obq>q=vI5aDzDT0;dQIf@CIim0DD7UG%ZBi zmPQt0$!r`Mq~z}Q=V4k8B7qLSbHgsevqc(t_HwAEreT11>SW3xgMF5ZMqm0wBpN`d zIOI;Qlt!NmF>E@eIyz6T!6l}3SG`k%)H#^UBdvL z;pk{r&XyC;RdE%EohNJcP3MCHPs0r?e4_TRs$G_ZD_uZB&?}EO_-+ZSydvc_+it{m z_wsx&$eo`T&6=;#_E5NdWWk!TJfX?|kryw|kZ^gbmn)#=R&_@jsF%i1_Mw}=I&h($|fD{!Vu(Fm!2LOmPfI=tqPsY=`<-?p0Azp7w$p7}a; zZr!Y+amq@)~i@>?lm-$ z&)SU)j!q~Xq=u3J0bX72@2^FWuiuM(Y zvCXN*Loc4EMCy{rqQ)6hG5fE_L|$Vv!dPP?2~MvxN&hT^gVf) zM(xd?{61ic{FC^Kii)BbPy~N-^oJ$a8UINQzrH4Pri#;?pArQa*Sn+vJv`^2NRn?) zYy*A4IXqI)c7~r*%*nU(=8svbE~{Af`ftmds4TDb&h7Q`tNFVYgX?*_$_~Z13h;wm zqdtJpZrvl@SL~H~SH?LT_hg##F+5BT*UPz>nX9K8HD_>Jw{JNRo^-08gwR&GS99CF z4@K&DQjUuhwm+?)Z(Q$DTOuc%^B#DS4sw_B)dXC3pTI0j@&PZy{$^`1XSg-A=MO>N z@uFL!NZaHvr$HOnBmJkzO_seBtDp3C++1?0E_xLb9~5Quc32Z^wZz3ww3R_i4}>ma zueM>P>OVsJ*{?2N4VXcaXG_^qeB?5-)+v`>0K=h^tz@pt^T)dq!$Zrel=j@!L8lxS zYdWhfbKWuAD3IgMrp)oCH9@kCYc%U-Cl;S>>br;-t35QSZXZr5B#V8cTR310YMZ@C zo->oz-}oPbNJdk>tPF0qvY|O7UPeiRZ|OCp_js}kG@*3R%Z*7t@QJxI!o+r90TS@}b+ZWh@s8d;bTv zc9>4kb{q!SCNt5ukz=-B4fYuhZFD7lbYw>2QM;-BqUJzYCbK#18BB8FRYqj)miKbK zNidG(R&{P@NV?B_p^{HV;d!$*enyG(bitx9?6a^K_DaNXe7y>5viQWZWZKE^_^4jyL#9=WzLPV%MA~XPn=)+GBSTbGg`%4XJHr zWN!GD8t?Y%J_o?PS{inxknd`xmW!{j`95je8#u#H&E0$+x0oi%4H@Ff-Lx%|8Hj41 z4atJDx-!#a_Z(4uah%UZOH>e!tmUPk_0##{whhUMIOe0bqru6TzYpKj8zK+M`^)_$ zzLTXj^On+ZO%f@>o3u9fkle?UD($IO9N1L~ z8R(p<9{?8Z(Nx4K0OQOJfS0Fd4Tt}Q!g5IXWVg@hbncY~_X)2$DQuxuM|0L<*~57=+}}B&E^VQ~ z)+q%8zcuFaXaCWqMt0`iA_r<= z_mMdLmJfY$W%}^1Z5vVg{DZlSbLxABTp_lj<(}~Xg!E^&n zSbwo1g!U^@06nSN_q_892#~fA5)z6e)+%joIknb7$g8Bf1;m{~XdvV! zowKHf297whh$F4G>VoyoqwyC#wPP&e<=bB)FB4;no=!Q02tp$h*kK|daL9LvqbHtM zjrmOa{SQ^PpTFhQopG1_ZwT;C8j`W%#((Jiwaar3qvuV*QsV1v!brx~hKRQ~Pcojp zZpU%s|KWMQ2M6~4MT}$OgMCOX!uvlJeC|8ckuHi=THSrDK2B)A6nR$O9(ljO=J_x@ zta+zDn(_3dM}pAPT5YuNm@T4B{SnD>CX3|jdlVK{udkWS%}a;ZP3jCy*~Xf5*(KG5 znuU&q5rqYZ1*f+bf1xu(z$bJ-EVx)5FG$S;<`gp8mDTo_h5FS(QKGhME=cFE&z6;) z?MVR(xCmZ*6C7z{<>d@Qs)P}{ePMVIt_9OL_cipv+r{_cPi3K@`~f0X{>*T)I%&Os zur?Ni??e00s6xkZ!tAIwJ89sT%?y{GUOxZScGCNJDXLaNvRwZQK753*-GZPxdT0Yyx82k^i#djiL6`K~)`-$F$s0K?u1q)a40NZuA!QoZ*Z%qgj z3DixgqMEE=3}ef`B!LdhrA$I;E*a6rPKomYSKn5+{7Fmx)MT8}P$9T|XI`%vNEx+% zjF0nC$|k7B`!4h+cCDnhasx$`ITDfK?W)N7nAxli}sVj2HB|2JCu8n6d4gzieD@gqU7j4ukbl!RMePPtJVmFG+wu=keu{pGz)bw8~ zO`+*Mj0oU(c9(}e_h!_r0g{v;}l{{C~2TLB)-{>FI?Lf`Nuv&^r6-dEU@7U7@R%0 zR+YxUC{?qYmlIG$#r3_io znHr|}1^%zW@4RyCev}0Az|&Bjf^#AOBAaaPHJ?YQ3+ve_ zjpbFmGNCy=oQWW&=I=Wo8%eESccBCCBE};T)&mUwu|t0aB=FxOAO{_Xt_s}$zV-te z#B3IwE$&|4KYIj{_+#t*X*TRJAT~7~7NmXZ{m&VlK(IC>0axvs{a0d{*OVQmKZJ5} za?sGw{;%FMg(qfaVwaAArBfEm4PFL6qp>I5EG;cXML+VqfBTQ75So7|lOj30c4>tW zY!&ntY0{o^k(^0`>a6iEmcQ{o{-aK+Xb}I?3o8XzFwM#8*&FM_M37~h-B4eTRSBtf zHP|02{kv+7%KjKz4qSZvP|a3p!Fd7#0*`i26B82`7Z(GA9ov7VIFpS85`W08*M2El zTw1bRY4V$YI9X}d;{E5csR*P@tKWV2gPN6v<$eD9e^nac-DntCS4{Z);c}e+A+<;D)rk2KQ4(R+XZEjQ$fq%C}&FFa7DKAj!y3O&1*XU(hQyWDTxniO6y-eztjW)3>ZU{T12W8j4lTIfR<+}w zAu?2@b2?_xs)`>Pu32Qx!}nB3`cb8k67os4TxihdK*hV>hVG0isn~loHD2*8+?pvo z2$Dsh^=3Qqva$-{;GWyLVZ^rZKb>_qE}|OErGZlo^Cpe#5R{_7^Jhk+ZEtTYriFC% zc$vt}E#eIHvP#zoDy4}`Yay(Ok0=(#kG(niQY1~nGFbCVR^`mU#3uZYQZIHNW~zi) zEp)sPD2P!5(L&>`7rgW7gTVr5I@V%d>7=z9B@lzvaaapUQ^Y8O!BjHoLT}7jafM47 zTyGid(UVNya(ATCG4dBoR!%9^FItiE<)wVuO=8>Lo;6S(2sQkrjhmX~7xS+8P`%dq z1#b+VmBn6UHyH1`m$lrUZ$X@PXzKkAlR<|YV#FH;PNrWXo2i`kE#c)xVe9s^@rjWoUQ5?61-ULV7TuPa?Yq&It<@O49YDM1fUX!NDRd6>MwQ zlR2Uh_?*$Xm>-5=K!*nhJ3AN##DfdZ_>K-p2y4B(m#rIY<)#K6jOU2j%bG9=j7dh1 zhR{1+d?YN52HNWYd)+E0DVwp8_UzgK@U|Z8C}p}}Z1lIw3`06N5EfJapDKRZru~Gv zfVB!RbLN1qs?hfPgs%+-)4P_jV6$y@wqlG%xtm!sSSK@czU73UX6NJ;{iKf z!en>7sG3F|4ZpHz8l9QBYF(F2*npp}lkptaF(*LRtjvJ>=L%+UiLi1W9oDxDoP;RQ z`Lc7Le?9z+G3idp;bG`!gVGhj_k~g;Uw?I*N`0g2#w;qTg8nH8ws9BoWHpjid|!zX zW%>LbL4DCVC*(MwEQ~I)gj!^7&ZG@(wrp;pv0u4GvT{+_oRC<Hn>-1P+xM-Wou!bPik4QZjBi|J&y9`Sj+7w7_0Rf7UaN%x zrp)eHa@NC2rGA^)S*YL)xl^>Y8|4h}1q_ugiy#&P=K0lNK{sj=PHDbnvZ*kj2mCsmFz|4;Q8WK)kmMAtsTXf(!bm#}$Bz9dxD#3yzCAZ(;8WjzgVy2HZ zjU1Td%hMBPH7+`bQx#g;N32SwKVL2#mEc+=c;_d7f^ln;rUU8bn9~Y%l;1S_EAQiS zl`$m5)f5IRd|UEK{<2nOuN2iKR{ah8%eW#!=5m_3wN$dy4_pD(cbt8yfT4N;Z!jlrtBp_1fWW!N1ye2yqHXlhu2+VG38zBr7W`wrjOo zm1t@G&z~h01$U86dnCM?d`THZ@3w7{YnN3idl@HZe;{si+EG$Os#3RU>A^<^3?G<% z=0hX-T_W_|HY>6nN4c~U&Le8dASZ=@lwgK6C5D?!G@*|)x$pbn%22GW#N8(ou^-vh z*Z3J3zqg5CtcN?^>GmxF5J75<`pQ!kwl%|_odBvR`lJ4Dd49Yf<#JfUp{o>+TiBQ3 zklQVO|L#%VN)l2l(GLbQSlG(#-#7iLK!EwWSwL4$Yql*#;thWCH`9DNf|_?egb!&? zZ0wD1#oLP;|E0;n+62v#zW*KpUok{d6>D8bS8Hyyk0I3*54mG={cFmEO)=STf#uxb z{X4fEY)EkM7D)DkA%xg^LZRbzE41{hSSlYnc2aj(vHILw@{-J7PGKJ^4Zr)*UzD)Q zVdw^&|NKWuApT)?b~Z3wCY^^y73vij)tD;NoAwRD-w$xOgTe1m#y`x(ka$U0+iAQb zuA9@&{QU5KRPTA5UzF^<&5iFv4~SyL}=Se0hBep|Vb_aT)I5_%5dk1^}^cEax^kG@W3tEZ)s^>b?0k-RJF$fLIekLbxsYar)CpjhMJXgrsW_l2YDvj) z&NEHEX0w>h2aSs1Sp3%&CRD?R5J1R?QAe1$#;I3pS0mD2GF+4_7l>MMAAWB#uY4f%!%)U6If^B)&>+!xJi* zyv2XFb{X9@892)Hhw4awp!UL!XjibrD-r<9sR`1>g+Zh9g!h z@<8o`^S$)*<}s$>jaSmb&-`5Hc|X0BaH8QOfEE&!uDY!3$;|kUlRs+Kp(;|PoXz!JR+5SfT>58K z4R$h>cf6wM%5W%Od~D1yEt!kQ0GQmtl{B|-Kb1AO1G z1NayY>dfppi+rv*3Er~VaC)skSyAbPa#8^kOzjY)Jv(&G=gy3X{ar){?kBoU_DkFV10yEDcPVDIR_$M#m;bT%Cy{ zUAPO5qfvEzm(njSeBfF(IlI8)al|3x4%$59nk20$&zg?FlSwUYT*76rNblt&7Pf9o zf=|s)Zn?JczfQ6su!4H$!94vfh_bBAi?3R|9G2SivW=C54q(@T2IB-BxOwM%0b?oI zFQ26QH{IstzfWZLlcddR-~OrXjpbVk*FuPcBLK0C(ib^N(HX_cPEIy6GZL^ z6EDq4J@!d**8BjwIJ(p}c~M$!Xt6YM%?+cQ1skDBu8*QKDc>4+ltkRL(>LsUv}XHo z1jq&*H!N4t5V>lz;@dt6o$VlJ9XdbdZWC^^!j)5zDcg}eL^9m=VUGz_{^xPnU|7EZ zsbo=Gc1W7b%cVa-1{(Jahk|(ZQ>F?1cP?K{=CoMO&9h4O zbr8SPIGP*q#jsEEAdcMA?b`lLE+CnpSM+-A^u7>ecGJ;7!WiG?2Uj=hmu;f4zOydF zNky(A@&|yJ_NFq***?f4poi7neHOX__6H}{{7scwpaB>_Ds5AAMtD$E3y@J}p2+R2 z6Sj{~*;K=4!Cr<3-v)t|NfP75__i222P5+%I=|>h8A6!>cqr-r>VZ4Pq|-_2)8l-l zZeZEza^w5>f0I>6YRu@w%fpjO-G&7j>t7!92cL4c5K7bj4;DburSkn1oF==Ngbl3kvi_1oCr-%r#u{P15lUOmd7804GlLohcN*TgPluW3?J z()hplW6l?n=u7y49hwQW?V{%ms_pIVNd_$bmqpV-h5^X39Z2;>_}qj14gOEl(zoHa zZa<;Nl$fn|1Lei^7No2E7g|DK!CVSEeQ0@}F{xaNn*_9_fO$Dsk(56yl(@%<;rPU8?v%QE`k!oeY93bs^Grge=)a-;wnK6%3tzLJkWvEWnS{1U zzU})>FRYRjOkCk>U7fN<-$+}g1fZhV5E)o1VusC;GBaL^s}7+G+Iul<~W0x>9xB$bxJl83w(mJHp6BWp=#UpClO{CmdgtcR;)# zq#xX1jU9`6R3de;dq5UWDiDKet_6$QLOHz7ssf-$lr9Djsbr5w)6wFNcFfVCf!z5r zR!;*UUNLS*Hr7Qq6owAUQ)z^iri~LY6J^_&2^_8t)mMP~dG%aAosxD6Xs0F0;jN z4Ye$``IVjEcc}pnz7tQ(!hVBhQ?!GR&rE3{Yxc>k%EO6n+AP1nMh_>_JA?%BP=0bk z_;1O$oO6XH6#7{rc8(G1t8DFygm$S4Z%vB!EC@h47I&`{Yg+8Mm;87w&Y8h4k#!y9 z>@$x;;eHK6YFu9=i0Paw7yO-Y&jD)VIt=g21ia7xSHyVn!F2;jV;{OvJW-8RlNY^T zF)86L0(`V58Kc2(BG}4}{%0;!Ef=ja)@ekwN3wp>LoA{xq872CHw>VN{#`Uz83~L;jbPL0Dh! zCL}_`{{MGO06}QJPP_&9h@vtw5tBw{GW1t~As?H3IpU!Vomt`v@f?*rj`^E#Dw4i1p*anL@UgM))VsL642EM*B}(Y7@6H1AP%)0NR^a;81NqD5@HPXOawV)J!%wbZ3%Afd$~-05n#IMzsrB) z)1CQ?2C`J={ydRFy;VB<^@EP*1F7+#Cmv1$ zYvzah)SFX&w-fnprbGr=7RFCyy|j#)D=aOGJG2EQL@}+eWfA6Z#ik9ra_Q*3GpR^vt8_h$T6m*cZHBg46MCH}p8{T=-QmtttlRojpJ zttKI>jhJpd;uX^Xp9M$_d)NmolJkcb`E<4}uJ^-1M}Lg{xGi))sT5)rSUGEutDSfH z8cR9T7ANph3RRq*Kw(~MiNf8+W(mo+SXls4HmmSs;Z7oD0OkkTAwKQ*(?LZJ?c`EI z(K6;GX5|+w9So5cqI)40G0=Csm;4g zxSKW4bu+l+%!1MNW>#-h6f}lH*s952QO$=^eP%CdPIg{Ymtg1NTrM{AC0_E<(WM^t z)i{P*Z@QII2)=0F#?%7VPpm8h9}^QRBd zJ=91;K^Hk?JM<1?#i9hYNy|X@VmvBV%yr*TpW2+v`=2%ym4Wy}!O*)Z4L)XxvNKK@ zT-}iOJSM(XA#MMurlw|JNgd&L>{IKb#TDh?@I^_HL_%?BP=&L(5H+Q&&f2PWRI!e` zR`>~r*IoP3)zfr)p}Mxr=gFFEeMH+(!{F&ht&(DTS?Td^{#)LQt9qq0UbO}BeCqUA z91~HKZweA3g>{wZ^a0ZQ_gL$1stP|wDhc{V`^1I$_&j4F$?-{oq|7UDL#*PnMf$7o zmM2}jYj`%zOmDS3O;LDJ#1Rqm_2filxj2J=tMM~bVbShW6{|L@F%B(os$nk>oaq1b z3wYR0--Rf{c8_Up`-}N4cy%v{B|iy^05n<7gY5%;uJv2kKY9>y+4*FH$`hABGC07% z^BoC3x&;lZL>gnNThKuk!|`_+U_|drES844?2|RoSa=!L1^NDkyy5Ion%9w!$j4Dz zrS!41YnIEBCW1ZeaY8wYX!!e2HRi`fU3L~?)GV(G{0k?sJiHnnXGcM94(|6_6sB?k zvVie5xYFZ%$cIDn_eaU!{aXe&IIw_*=;ynE)p`mP&T(2?DAU%MxnY|qS;b6hq+*Pv zM}+#OBVRq!jgI(JGHArcl`=TKmkes9#OeSf!oh~yUA4_eO40M~l}s9>gY zYZs8X#g_!{dvLK)PLmA!&MsDQSh&EtR#u3#PWN}y$yfoQVYYaJhThuCCwQQ1r1W4& zO@NXAriTKj9Fy_kCuiIQsN?-OBbfxfR8nwKVZ^?%*{M(;olCqyAHAWSa(+SH@TH8M z?WI6;QbK}Q_~8CU$ns9qO{S2A6aEU;WKt5P;m$hh-8Xl#-ykG|+?-ab=3>v9^CJNU zvZ10Ahc}Q?HVd$M#e%gPwbw`v`rTWh5zlKEu;z~a7*0+qHGl6RImM+dugbAti?qZr z=zt|%>wNLJjxct@#}(*7I2yOg%k{H|FpOg1VjzFvNQI@WurpXXob$@5k(V*$sDHnK z^%ftX65jAr60Vxu)1jtmB`h_J*|x5rx*%MnzL_q=TX-@k+s&k@#X@w`;RV{Xt|=r- z^y#Xl%gyG8)bO-j7_52vs0XRT34h`kVPm!N39EC$l1DuL{UpVY-wrO8$e{k7FehkT z`%5SD?Kb<0Rt}@IVVCTDw6rDDemgUspMq^X13!($Jr%WaE&Dn{a@UTao8wAwk71S; zF70209gAz}vpTKK^o>^H`b37*@39`gyC`xwUT-_xP9E-L_gUQhsNl7s-rIl<$ERE7 z0jddqB(+J68o2yvH{3jcgq$8WnWrB))g)0barfDPi=nSxYK03M+-wofSN8?c=3D%r z0HWi9rgwqY-IbMHMt0EBr42L38}HU%re&L3Hv=?eyezvy`ekX@oF)}b*bbu{(#V}g&69$lW3~fX|ifSrLm@Aqq zXUzW0+qu!B(~unm3GU)?^OkO<^@>s?OOJuBcw_?^LXI_XtF)yLhjdNR$sT*~nS}uH z!4wNQBr0wu#D$fuHBbd;H(fV+U|RB}%Me<|bO5i)Ebrc0P<$%iN_giBrhk$7QQb{# z;h-FHBXbseLMqb+WQ!(2WZE%+;%aXtY)OkZF2l1zXnM39ps#*Z6~PsHh3IS?!t2mO zlQS{CRW7W+_<<%!M|PT`iCKj#Ussoof3`6evFTDBAODz?s@<;TVOY*-Ol%p;F~L9e zmD%)BzEuAcLb%Q*&D0h=+j!L;OKbkr)*Ab^(St~{%#Wr6+oi{5wItg7X3vV8Vxg{4 zqPJod?*m}Ixe?E+BzV-}fq!cx_0N6}OR8XX*lVQgxHyjeSemn97&Hj?xZ$Ea_S-5U z_1K|epWwqLIcIF$LSBC;+RcY)ACgw-=8xl;%v2n9zppe2FInym2An<%d>(WlSLuPF$D~Ds>dgg#k5et z)Fcukna$cuLH7d*z7u_Tjpbu)L zMei|IKkrQnuH+m>wIR6a9K>vF5DjarLuL;0V`Jf40;1(7oT&CAOzO1CCgptJkKsZ) z;=R#N3zI`h-pPIe&{s(`qaj?emW=x$W4~Ugm(vOLty86sQ#JO z-~%^V5kdE$1s_Jv4WE4-ss7po&DNb5>d5U_ApHVivttEC#qJ_}K4Y(H{KVSR6l0wW zbbE-zQ1f>Q8hd?0`a!BR(juJzZ|cX(It(HhM39Q^1T73htR6W4;1WD_PqPl++FAoy zT7bMI=fuD?E#vzd#tH{ECiv;80R9_$#kgv^HNQ$9eE{P! zA+J8EM$Y3{%Tdc6^y$G@<A`?PNif;KyS^Z==R=3bKO zB`qc>d3`%R+Xl&GO4%f@A7DaYvwFGE=iWoe*SatFbY(>!Vq-S!qnYm;(|ICH3;mB0 z#A|$-7iC1kiGy)#E~l^ArJDWtk!OC=>)nnCiJBw~ciBSIhVfgdnxNOf*i~BWm-4H~ z6;FcIVpO%9bzRoJ>y#+a8y6`@`>@pMwW6j7%IdC9SMnau-O#aZQ?aqJJ;Vs#U;Wbf zy}yB!Q;6@MTFiVg47js}=9RQ{=o4M1=AOo-czjsaqpvg6+c_#SDI?X5E;_E6FVk3@ znuq>j9BUb{^Z$7)c*h_rYmfyX$=-uiOA&QQi#GMkUqy9?UT|xd0+kT z-j~fGE`n{HwKy#W$H%76fNQ#e9k?+Te$sDC&&yz^ViP-c7-v{uK|dSD_k}UbZ?d7A z>8849hbMk0cMI$7(&lfr9YbALx{qojY3v0;eb6ze`)v8&l&_#byP< z%iGH}1`vQ4wDFo8DRr!7QO7jRC-rlM~ekpYg79Ronou zb~8JjgkLgRoss_3yS~g((&xw_MapKeI0}jY_N3rSQRaYAC}tXKodof`#+|j&B?Xd% z$=$EHjkJ_7%S|Tdi*X7@au3fQA4ZXeK|Hb3Jcgk**-z-87%XnXSspEw0nMux!HAtb zx&!C>Q@uv!0Q(m~C#f3+H+aDS>?Sbn0MQdoC!2x{W3nwe#n6gfyHcVCo$4S$TrkCb zb&jwRECa#PbZK7QihTBD0$t-U29_%uso40khN^Hh#S%ucjXoDY@^V&cEERo=Es|eu zXzI$01he@gMnYb!w`6#>f>^}weHV$Dz)MBjiJ18C-b-zRRwzj-1FrH`3U6bgm_RtL z1;UgnL!?9GB>5BZ+IR}qhWOM&iso9kV3p+F@Dy=!lU<#`vQW%*?kHJ_C%-7K{-%SQMU$k?B!m;*i}%MfG-7iupNN zS_$=oXF)PZ!*Qr}MR|EgZ_P9jj-XPx94|{MIXRcV+3c&@1!BR^<#e&+t@VtISlgg(8x2*ATjGOY zs3F+;6doL6I_ha9>TM2AxKxojRv;N~MfGQhD`12I=7c#+yI1EDK4&RgL@eCLU8m{s zkLHScxDYGNiJqy7wKvESHUi?>nhpHAuhk*u|J#*96bdJIRem93)?w$JQ#sb}1qo%N z#eL^E*DlJOeBtp`nbBqGNcyU-1ezW=)rMj9YHr>Ot1+>m-gvslJF4!fdbEoH>NMagJ!nI!ud0I>+K-^E z+)p5!y^QD!=^N9^Z(e>BZ}g>RPF88yk!$3{b}TS!r|sk3wu&dob*d2Z7WeduP`Y(D`* zk}r8U==THEnl#&TpXeEi({>$C{+~XsJF2N?Tcct{Kt$;fMWslWCN(MoA_4*`H9@3H ziImVGD$=B>G^r5~5D-Fd35oO$N((*GOX!eLLXsEpckjAyt^3|TS?5e9Gjrzb{mss| zzZo^+cLm`ci;u4oUkQI6fM&~tVitlVeUxDBca^n1MH!WM$qGtebN;X*T*!IR+~t>B zre1%-R=~$_H1cZ*UOW8x_1)jcrkDw8vzZU>#hBXGxmA79S4j5k47j}~Dh@87ZJ$GY zq43?Uxa9YeWSr=D^{sZE*MlS(oqW0e8_wmHZzgpa2H4x;Be~n4@zaF1wlm3=;V)!_ z1MXV{)J#Q;;VGg>RjtUapItQHj_c|r%vSWWSYT{RjM*wzD;({|GW_xbY?>mhw8S-t z_Y=aa20#3CQQNL4yAf}?21B_#^3p-HebvtQKc`Z06Y&M~o5J{WnoId6U$SOU?D?h( zYkP+;G2%kq9&g0==E@~@>^)Tm4-@uvbD zf&M4v<(3{l*$v)bkU`j|m8p+A7REE4m{x?@THHfDO9^5@J>zKFdW>q}9PVpK zFee_|OD=dUoBXEGXm=U<$;Uy4s}8(QB$ipViX07UvCyHpic5sOFKxElvbUT*P5F@a~))zQYVxP6Z*@$|SCW3m&nc z=B0bzU_IU-OYVJ4X%^oT;d*0kw7v|zNaN~9Rz1&kOQcDvq=L3vO%i8LJfyBBxtyC8 z0*>DFDLFJhJ(2a})AL&E zbj~g)F7lmBpznWEf0srCzWUkFg)Sa+j8LX%+2r|NYLp5TITLVCN($V08Fe#y(JdKv6&xzXaqK+PpAU3;H~Luhg>sJqZ1MVClASV zY$%3f$LY^pxN_%p@#JwD2fV@c&n?|CnqbkJ@n7H4(a3OA2;D!obTmGiru^hhzZ2v0 z!<+E(lP3M2x$ZdYC;GRsSL;(i$_y2~cdw;qh23JbB%Z-U!Tb))mcq~aoz|>ryti|W zYTw9+f}$eV`BQ>|f@&Eb>?6_YK96GBh{xDjpAVM84u5m+<@SL9 zp8czNq#tR*Ww+3*%6#$%TKgI4>R(OJ@5sdqWzMI)Mpx zlwL#m?OwgQLLz1-K`HC`V$$lW1CBadqNk!*+}n3DrBed8Um%s(ue8kN&Ky&_;*vOl z=i}q%MN7@!6dh&|_>&uah>`=>ah;)mTmKupx-oO|MEeOE;huSDFER`v z73ge?<1<)vvZ}veXu8Klxd3mqF!8m=SAzU-gV!a_1rw9|eH4(T%sh6!_uOZl`c}I~ zDr9qujjcRB#0jM3R6lXgjAY2p6;VoXckYsMidd46(~okbsMoyTW)NApb>`jWTOF=` zKbO*>y+e@ml=490ZmtW4IA84%gBL_Fk~c1Q?t+&Cwv2Mt{YhD;J=RDMhZA!8N7N&& zCWfg59HsL4IwYnbCeVLvC%$Dgq;?qx01{i)jJ9@Ho}t}60?Q^ktQS&sm8XL3j=_{v ztZx9r&&!wL1Uf6-m|xR;h$gxv5{cpAXX(4C)tGhe{rTBre-I19VdJu`Xq7I;PvI3~Zk-PY<^ zcxBnkc5_R9hFM|Jn)9YE?n0K}q^v{=0X3g1?=(DiN#RC0{v7-8b%c+hhyI0U55u_U z79q}ln~wtDZx&gwp0sPRSl#!soe$b=RASblq)rp?jX(|WvW z)>YA#jU|L2Yw(hFl!y&xNkZ+Y8uCPpy5H^b|v zKk#`|Zjj(osDduP|C{#G!rv#Z(2yZ%lWPeN+4*|W-u4GRp8i6+^gG?Jkl~%8BtAX3 zP?U`(gJlP+^;G>YSFQl@wFe$?9yXBS;-x#%!CQr4_ah>;KJ#6zpzE+Y6O!p^Npef> zIcy4HTrW;zlv-c=+C<&CbrJY3n|JOr6g}U)@^o@O2O5dBD*^=I$|8!)vWk02@UTL6 zXX?S$52}WDT?N_9%#;syZ~G@DftF26kh!f1vF)JXF;$dA|JEUA%)z=P@)QiLOT96&9Gl%MQjMQn!8O_$Z6&rrUEIF z)_JCsK6pc$@k`rqxd7}lIr8Iv$v5kE@=k4njvSL0&Z(%#g(iy6r3WUPSxr8K3@}M6 zhs9pb$(2*~9Dg(R!#Wq(Q=|d(i~DO;4UQGiVMA?s2c~e<=*Dn z3^mZ1w8|{NW^^2O>p?`Ubq-csbFzH!rw;Zx&}PdOb1KA3V`-LU(<8aVpR`kWhd+hN zsnqyLkFc5a_GOG6a*!!`^k_xAWs!#HP>~XazM|EtH|>Hu+dbAu-BCtvz6CJ>Ieezu znwWHJv|D8Vz_BM*Q{jCeeQ#cQf5$-cKo zf2cB1#5h^k@ZC#*#=`uEX6~v?R^(9hh3?^juNijHbzD}4-40Exdm*nAE%*uRH{NC7 zOJtXdCn{e$>0}S6%zL}COuI2EWM6e3xp|gsp<=1u1NJ^%>m{Q-mz;CLY2j!Y zlmn`xk<(~y@@^ZbKcKuI1Rn|M6|_rsl3@uzL)MJBFWk`+j6Y+ETayqIM-KqssQMe5 zA7)H8z@#01WkCcsTf=i07PWN&V6LR}x+3RgboUm-J-;L%JG+ zq(BL>pKm!a%i!)ldr_>1w)tgtU%~s_CrrEW)p;7{QN}o%jv;Q{Gd-{Y-W%aKVt_lhw<57Al>-5vMVt<6u3XylSn+O51AX)A z<`h}DmtWuOauGE-*eJ0-Q^2)`R#wC-dybY&&gZ|b15M$P9Wt2r& zpf*5YYP_%Q&}7w{yj&nLCTg2Ip-AIzq*KIUZhQgNs>8saR{o@okAC%z`a#>dCw#xN ze%DKZ>d4jR$~c@`dhwnPku{-<(s-Q-ti@h~9zePvMWDS+V_@QOB-; zuX+b;&vyf1*#vEjTo)}rMOzLom?XdF?`2p{(PMzS++E0TOA^Hi`Oj+qnw7BinG;{v z*BRnIv|~~h^gp%9>q$^_^S&YSs8#gyy=do)vypq^%qi`oeKWtRT+XJe7MKO*?6mmJ z2{by2gBBZlvNflmD@iBH8e&D&suKAN*tWcN*66+)qUQ6ewA{nsz!c_1(fSYkw^E{| zvU{6VnNxJxZa3Se{n)f^%&`k68Cu6>y@y_J!b2BA$rc1EF=ut*Ql7(J{F0K;h7&m} zSrY?32o@Zm#${eZ?A_5^cUfFy(eXPZM;W7{Npf3{z+LxEv!{{+R^}1|ZC2O$xK_N* zgQU$Jz7?ULR}suk)t>Ikktd?i&r!NBU$LMxG*{|+RmF!3F3wb7BO&c7KI0c7>%uPP z#YO6SGA@V=$7Xu%y_k_b?)XcRrrgYgty?5NH=_M3TGRY&cKA!Es@Xn~lEol4uDIi@ z(lD!?@QojVkB9)GMuT6t1aM8s-ked}L6m#(pF;>rHnCd}&Q>Xt& z+0pQV^*cD?JT4iK7L-P+tjhf*|8B#Q!4gmXMiOZn!ci9AgvL-}-X_0|+cfp~l6VRc z?*1#k1&>1|7#RjQ{OnusFjmQm{$vG7M8iC~RyjP4of0MwM)TD|V`zH9#B-a;9K?3D z$jdn5l!UDM#;7(}j_~<+{Z7rs!P!GF3-L29YXpj+iT9{az;38OOm#Wz5;80`-|LJK zLKD%~ytpeOF$iA8@O78Q(j!R0T1LQ|;;QbKEw?ny^@YZ6tcct)(0+&!`{DSu(^p@$ z()^|vWutGfsHot+m{{H9(rnZ*G3kHvY$w2orptHh>zO3PW>eQTLq;8=-5veD10J}> zc1k$~o+df{wt1q-+VjCEBu&j@SYg)n9s4^6&s$;lP!#FY>C>r?wa&&|mSYU{{ia>e zqaOa11EmbSZaV$8n*=itmEG#V4;nwoY$b{=X)19GMvl5ukg9m3niqQ0Zdq1wG z$;K&y%fRbqJUaXmMV5dQLNAJ&AA~TfYiycmYFPFkOYOImbz!S+){H4_<7-klcl0LNsd3bG zRm$iP5z=nTmwW6D0X9UH1yxb(RvTmTsoqvo?4Qt|B@SwzIDKJfMyyvl-p1kih-YV> zMqx3N6$ONcAWY46-L=#1l~n$1g*>MS8R;3|?n(meSr*qT6s?I{#k3SxBuleW6}%XOXXO$#ZF zQS-RWJMR{gcBND*8=kHw{wLzA)E6y!7F1Rrb_~_W7KoZYnw}e!`~KxdqL|| z<4?pH0J&3-vU*yNikw}7Q8%gN@cUbh518$4!W<|);Qj#vO*5$sUKLUY=s!r3b&c3R8j9jxwjhG1I?jQ*h=RaXugDo1ChqRQ%o z1Ur~9qt%MP$G9(MR4r;E--So-b=RGJPiV>g-gEN$`X>|BB?!4I-f}f0E*F=|rY(tY za>9egr_6$;vNB@$gvrya$)S|FSc$CHKMwF1YD1$YwUvFB+-~lq0)GRJj41EOO!KRe zul@c7X}Qgu^(JYG+wfHXYhr(IG+a4L`M{b77175F)Vv3HuR;eM1_Jx?GU6t3}o>VDp^Lg*x zI)Q<&HF&Rba?hN&_xW>gyG7S7`nBQ6?ppkds;Hue@4A{3O+{H_V`C@r*7bX8oz5(% zbiO=I+#mxue&L&n`YnddWK~idLeZ~;LCe)4fZDb?R;5Y8w_8+HjmU=%C}|AKhh9<8 z5R8@k^YE)1^#6;rtsgmaMCpyg%pLn2w%j~jCMpYz%WB~&P%3qGqC0=C&GN^lT^qxm zLyrdY7m!><_>~LyUb5`anbM18K0Wz1^7Qe$lVLy3gq9gR|G;_stn0_;3U}3PW%y!7 z`8vaMIW9I^>MpA(0(R5KRNRqc?nn|fs~Cb`e4tpBG6jqHv<4&huo3qP5Kh+A)&&f2 zASDF`fH{Yf8=etb`xA-TaOweO)dgX>e6Xt!xV^hh9)urm!YRMtK4;tA;m2j0j#pb1>{+$*z}Ef)K%7 zWl^w~{Atb0B4EFn-NL_r1~VUV6#@8&wPYe$zz!hP!&vxXf8$DlCt$vi^ZcKdQOA4& z{0lLccxPq*^uuw!1(|@Q^XdL`c`E2GI0$8XbX9)^aThH8r>y?@hyScFgKWp^(auqy zRGF0p8-Y*I(V>Fc9BEbP=n&!v3}qz<0o$mXv7jEqF&vdjq+v4(+yB;(fMXraVzE~c z$LQ$(`4L11%pFj?W51{S2|FuGNB2W}zT($rkMPd51K*`{oUNIB_U>C;baby#p26Q) z;n-z;AJEy|$x@3w$G^?s@hETzEdy2l&G81mpzeFsC%fMnlA83(%ed7IDjPR%KXv%L zH>rNF%^%_=Lsr$k&ojv__!5Vdj`R~=(J!FI!r9j$T}wMqmdWSLDcI1${_c#9V4#Jl zbyn_-?`55v4cY4a?WVTf?T)lj2&Q69SJpoIrBtYwdzMEn6q^L>O%3*B$`~R8c_W+= zpb_r=MEU5^NaAd5wO>Q^Phv9B!NU%z(&MVy??sijK~^)Q14C#QDKwY-?WiXC1a% z1;~2L$dl=p6O~CGhIyhox=8r8;>|<-7`6C!C^<**PD^B*PxAaoSLh2fH~tq_E7j)u z$D0=l!mM)?*+Ty|s*1o~W_M&mqC8=WGTE0F&^q~)IBYhoF`-#5U`EC)(JOV^^xX^( zX)6wU6}jzzWRo_tO=+2I*7|hjW81*PPveEh<<$)5*^NpHgq;4o+uw|xj{OVah2wo* z#SZrrkmlfRMK1>R=urt$Sm_YJi*|k$)L$NvSTf1xw^wmPaiHcvj-tURRrZZJW@Tm-M-Gurss{HHPP;f=|KkJc24GmhCHcvyuPP8<`xtf}uk>|HI|N-ap*+uX z^cd;JG?%0q4DIGwP!41ipemOr&$S4ki$9(sZ=1ygbD zwXpGwgpBa4atwQqM!^K5K`*Y`YdHf?@54w(x8dfavg*9>-XD`Qe=EMvC5$lB=Poqi zx9%)gH-Q#m>UTAXlp?}HdQN(oFRss<5q?159=SyxifOx}dCI)Mb2#j_N|#HtJZnjp zJ15d%RY>>dSnC+cG=9GuY5X+`9-PiJS9>G6%(t3`3Hc*YrAl_IzU8+V3~Ag+|JSXr zjx~Jxa-fv6`pmYRTr4#bm4MSk{)eO+JhnpplB|IC7o<0qeZiM3vmV3;;Og+H$>t$t zW4(P$T@JB-uq>wAaSWTGVgvT9g?G6HI+$3zHyo6)5&GHDx~>}KzrzO2Zcrr@M>-3~ z4hy=OR?d)7;u2fF=gP3zX2E?2<+^T9^SbO_sn&EL$XG3h-n8J@>N^<2SdNXgv@@imEYCLRBn&c$Lybvegq3AH)A&m@wAE%yrW z()1gYxEffGG~j|`a_70ZR0-@aA)O&@s5K7Hmf9l_{c-4Wl5@;;{cAotM{qtHw9h8J zTU+p6=AGxH&Q*kjkq6Ivd-goL(UWU|iWno(>O8+EWWM5o`&0TPxS;MzdJDjrJ>ojc zz3co;W!-?<eT=DL(qOpG(!L71@>n17fCgy4KBe zlRQB4j-S@2J^2wwV6Hh=fiS3YJ9sg6r3zJv2;bUy&4`IMi7SIYNFX>cHqSnL6tNtK zWfo(qsjc`07*D_Py`-nNLN#yTsaKl0SP-8hXY>UkP#v}~ozUB`#9==7X_PD5r`$<~dHvMX<5>>ks zVYs5zkdb+R$#S4jabmQ3@|8nXjFnL^ls7Qk)A%@F`w*rcAdr$U33)Wpa+fqF9RP+S zw)<}qca1BF-i_dPKdjbY%)s3&4)rusC@G45JXHg@YCSXSF_tCD+(}HIMk#cpI5+rm zGQbk8J;-;<>PhSSvF}r2uIRQqNX{2qR`a1a|*u5=GkaW*N&{2YI6R0}a^K{&|Yg zTeIO*LX_T{I*yNg0+fWKH!Uwi3ulgyk?v2ocm4&c|6k!h$oTp%{Qgt(pTf??#=90v zcH8v8G-S`O@!?^;5RBiE6+6t*!k4uWgI>MDqO6IcpYxQKZ$ELw=bb;B^haao{tmnc zuO2ZWF3!~HDm7HvWtBLLjvio*=$!=T*2ZEf)4>NrJ^?%rNg1+K>m%UBe#Cm6ds^UK z)tPf4(^;5b9?l!?f$82|t~Hi#xmVG6ASWH?Fuj1jX0p;)WM~%leF^H^yA=vc*Wd?K zm2rSv4BK+Vq+zJE56d!n%1fp#f$pLymC=AU{IJF0Piy`{Ccg^aT%JUNQ1B%rf%RKG zPp(=GpKNs5D99goiQnmcrHDm{DBDwPo;7(Re@xt86(FhAS)ZyJkn;Zaiunp@TXPs~ znD-JFx8!y-3v*kw$_o`qhbvHXF80nqUPNL&mTC`yz5=#Tp_#G7!=1S|_@%0ah z@g47|`R-T2@1ZqXmlozMR>Uv*NK74n><2MMJM^NldgJORn{~zq#XyL;JSG!G3B59!;{gAviN;vpj z1n37P#CXV(0N40o75SzTa_c$JthU3;&6L>_M+;ZN0@TfF30e+!(vB_y*p#h~XyZyp z6FqBmZ!!Duk2xd}#g$T=L%hC?qvZ@qeZ1gjS8<>e4HNe0gz9mgnEpw)b-=={C#tXP z*m0HiRkWiWrqzAY_HNAJnWD(C-y$tc_-sg$A64XPL``=qEO;*3exBf-alX-&In#;K z&4(f(3>Mzh&T&fE^Fpt$}cYAoaa3pX7)w|Lzcr?Lcy^h$A{9;d7_QFB9 zJb|v?8no!@>ZjsIFA6lM&`$-mURTjQ2AVG>WG4ku$Y0(3^Iw35jb<00g$N=2m0u4? z86?`ZOGx{ebY0vUr4+MRPxTuGZdUyQr6IKYuqUODe9tT$yE#}Gm9v%7<@%~1YrAnN zSl7lzK8kdY%}gNq>NW)6SOxLQ$K`eQxz+ZVL&P&dar2e((ij7N8u&9Wc;(CB1q?~* zHyRZ>=d8ATIp1Gjt>ocLmU#kgbEIAicIAZ+bb9^}`tIi=iHPl#l`OLenbft6Mpf_a z5S5_DEp>4(m1QR_FHF|}9eAzf7W+0$h%CnBy5L5= zT{o+?OgS;%XqhKu{@uh|rrVa=vG}w!E0?`Eh zqL_q~?Zl8ixC#nb=h|pr>u6IfWmuvDj|Xl8o_e4s^k~EA1?>8Xn9C3 zT!U}bZo%D$2KU)Fn?@{6*DRdN1N1!NL8<=a^rHwE0s+Ia=;bN$J>$c*;}hOH$Yf3U zEOCA=-v8~~Nu=mPfQ9#+?bL!gFMjuJCG|g6ipuhd@;d+D)`b5L{*QY5KjP~DGuVFZ dHB3FhdHkoNRLf5&EySeLQrEp-bnp4w{{gs0Tr2

Date: Wed, 11 Jul 2018 13:30:18 +0200 Subject: [PATCH 32/35] Add servername to openssl to use SNI --- layouts/shortcodes/ssl_faq_ha.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/layouts/shortcodes/ssl_faq_ha.html b/layouts/shortcodes/ssl_faq_ha.html index 083994ae01a..b0f4525bfb6 100644 --- a/layouts/shortcodes/ssl_faq_ha.html +++ b/layouts/shortcodes/ssl_faq_ha.html @@ -73,7 +73,7 @@ certutil -decode FILENAME.base64 FILENAME.verify

Command:
-openssl s_client -CAfile ca.pem -connect rancher.yourdomain.com:443
+openssl s_client -CAfile ca.pem -connect rancher.yourdomain.com:443 -servername rancher.yourdomain.com
 ...
     Verify return code: 0 (ok)
From 0e3bab1453e4017fd4298d77f3f2f2f044ae37a3 Mon Sep 17 00:00:00 2001 From: Tani Fiduccia Date: Wed, 11 Jul 2018 13:41:04 -0700 Subject: [PATCH 33/35] Fixes to Auth Documents Changes to OpenLDAP, AD and FreeIPA tutorial documentation --- .../authentication/active-directory/_index.md | 13 +++++-------- .../authentication/freeipa/_index.md | 17 +++++++---------- .../authentication/openLDAP/_index.md | 18 ++++++++---------- 3 files changed, 20 insertions(+), 28 deletions(-) diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md index 3cada243ea6..db729fa2f95 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md @@ -27,17 +27,14 @@ In environments using Microsoft Active Directory (AD), you can configure Rancher
>**User Search Base vs. Group Search Base** > - >When configuring AD authentication, you must enter a search base for your users. This search base allows Rancher to search for users that are in your Active Directory. -
-
- > **Note:** This field is only for search bases and not for search filters. + >Search base allows Rancher to search for users and groups that are in your FreeIPA. These fields are only for search bases and not for search filters. > - >- If your users and groups are in the search base, complete only the User Search Base. - >- If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required. + >* If your users and groups are in the same search base, complete only the User Search Base. + >* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required. 5. If your Active Directory deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step. - >**Search Attribute** As of Rancher v2.0.1, the Search Attribute field defaults with three specific values by default: `sAMAccountName|sn|givenName`. After AD is configured, when a user enters text to add users or groups, Rancher automatically queries the AD server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. + >**Search Attribute** The Search Attribute field defaults with three specific values: `sAMAccountName|sn|givenName`. After AD is configured, when a user enters text to add users or groups, Rancher automatically queries the AD server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. > >The default field value `sAMAccountName|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields. > @@ -47,7 +44,7 @@ In environments using Microsoft Active Directory (AD), you can configure Rancher > > With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field. -6. Enter your AD username and password in **Test and enable authentication** to confirm that Rancher is configured to use AD authentication. +6. Enter your AD username and password in **Authenticate with Active Directory** to confirm that Rancher is configured to use AD authentication. **Result:** diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md index 4d157433a5a..90c035d72ea 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md @@ -29,27 +29,24 @@ If your organization uses FreeIPA for user authentication, you can configure Ran
>**User Search Base vs. Group Search Base** > - >When configuring FreeIPA authentication, you must enter a search base for your users. This search base allows Rancher to search for users that are in your FreeIPA. -
-
- > **Note:** This field is only for search bases and not for search filters. + >Search base allows Rancher to search for users and groups that are in your FreeIPA. These fields are only for search bases and not for search filters. > - >- If your users and groups are in the search base, complete only the User Search Base. - >- If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required. + >* If your users and groups are in the same search base, complete only the User Search Base. + >* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required. 5. If your FreeIPA deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step. - >**Search Attribute** The Search Attribute field defaults with three specific values by default: `sAMAccountName|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. + >**Search Attribute** The Search Attribute field defaults with three specific values: `uid|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by user id, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. > - >The default field value `sAMAccountName|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields. + >The default field value `uid|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields. > - > * `sAMAccountName`: Username + > * `uid`: User ID > * `sn`: Last Name > * `givenName`: First Name > > With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field. -6. Enter your FreeIPA username and password in **Test and enable authentication** to confirm that Rancher is configured to use FreeIPA authentication. +6. Enter your FreeIPA username and password in **Authenticate with FreeIPA** to confirm that Rancher is configured to use FreeIPA authentication. **Result:** diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md index b24da3eb12c..8d1775563c3 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md @@ -29,27 +29,25 @@ If your organization uses OpenLDAP for user authentication, you can configure Ra
>**User Search Base vs. Group Search Base** > - >When configuring OpenLDAP authentication, you must enter a search base for your users. This search base allows Rancher to search for users that are in your OpenLDAP. -
-
- > **Note:** This field is only for search bases and not for search filters. + >Search base allows Rancher to search for users and groups that are in your FreeIPA. These fields are only for search bases and not for search filters. > - >- If your users and groups are in the search base, complete only the User Search Base. - >- If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required. + >* If your users and groups are in the same search base, complete only the User Search Base. + >* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required. + 5. If your OpenLDAP deviates from the standard OpenLDAP schema, complete the **Customize Schema** form to match it. Otherwise, skip this step. - >**Search Attribute** The Search Attribute field defaults with three specific values by default: `sAMAccountName|sn|givenName`. After OpenLDAP is configured, when a user enters text to add users or groups, Rancher automatically queries the OpenLDAP server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. + >**Search Attribute** The Search Attribute field defaults with three specific values: `uid|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by user id, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. > - >The default field value `sAMAccountName|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields. + >The default field value `uid|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields. > - > * `sAMAccountName`: Username + > * `uid`: User ID > * `sn`: Last Name > * `givenName`: First Name > > With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field. -6. Enter your OpenLDAP username and password in **Test and enable authentication** to confirm that Rancher is configured to use OpenLDAP authentication. +6. Enter your OpenLDAP username and password in **Authenticate with OpenLDAP** to confirm that Rancher is configured to use OpenLDAP authentication. **Result:** From 35dfb190f9296c8c1828ab55769ac1a85d9f10e9 Mon Sep 17 00:00:00 2001 From: Tani Fiduccia Date: Wed, 11 Jul 2018 14:43:30 -0700 Subject: [PATCH 34/35] Fixes to Authentication documentation --- .../authentication/active-directory/_index.md | 6 +++--- .../global-configuration/authentication/freeipa/_index.md | 2 +- .../global-configuration/authentication/openLDAP/_index.md | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md index db729fa2f95..c79513802ca 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md @@ -22,19 +22,19 @@ In environments using Microsoft Active Directory (AD), you can configure Rancher You may need to log in to your domain controller to find the information requested in the form. >**Using TLS?** - >Make sure you have an LDAP certificate installed. + >If the certificate is self-signed or not from a recognized certificate authority, make sure you provide the complete chain. That chain is needed to verify the server's certificate.

>**User Search Base vs. Group Search Base** > - >Search base allows Rancher to search for users and groups that are in your FreeIPA. These fields are only for search bases and not for search filters. + >Search base allows Rancher to search for users and groups that are in your Active Directory. These fields are only for search bases and not for search filters. > >* If your users and groups are in the same search base, complete only the User Search Base. >* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required. 5. If your Active Directory deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step. - >**Search Attribute** The Search Attribute field defaults with three specific values: `sAMAccountName|sn|givenName`. After AD is configured, when a user enters text to add users or groups, Rancher automatically queries the AD server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. + >**Search Attribute** As of Rancher v2.0.1, the Search Attribute field defaults with three specific values: `sAMAccountName|sn|givenName`. After AD is configured, when a user enters text to add users or groups, Rancher automatically queries the AD server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. > >The default field value `sAMAccountName|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields. > diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md index 90c035d72ea..5f4423261ac 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/_index.md @@ -24,7 +24,7 @@ If your organization uses FreeIPA for user authentication, you can configure Ran You may need to log in to your domain controller to find the information requested in the form. >**Using TLS?** - >Make sure you have an LDAP certificate installed. + >If the certificate is self-signed or not from a recognized certificate authority, make sure you provide the complete chain. That chain is needed to verify the server's certificate.

>**User Search Base vs. Group Search Base** diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md index 8d1775563c3..773ed4169e0 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/_index.md @@ -24,12 +24,12 @@ If your organization uses OpenLDAP for user authentication, you can configure Ra You may need to log in to your domain controller to find the information requested in the form. >**Using TLS?** - >Make sure you have an LDAP certificate installed. + >If the certificate is self-signed or not from a recognized certificate authority, make sure you provide the complete chain. That chain is needed to verify the server's certificate.

>**User Search Base vs. Group Search Base** > - >Search base allows Rancher to search for users and groups that are in your FreeIPA. These fields are only for search bases and not for search filters. + >Search base allows Rancher to search for users and groups that are in your openLDAP. These fields are only for search bases and not for search filters. > >* If your users and groups are in the same search base, complete only the User Search Base. >* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required. @@ -37,7 +37,7 @@ If your organization uses OpenLDAP for user authentication, you can configure Ra 5. If your OpenLDAP deviates from the standard OpenLDAP schema, complete the **Customize Schema** form to match it. Otherwise, skip this step. - >**Search Attribute** The Search Attribute field defaults with three specific values: `uid|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by user id, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. + >**Search Attribute** The Search Attribute field defaults with three specific values: `uid|sn|givenName`. After openLDAP is configured, when a user enters text to add users or groups, Rancher automatically queries the openLDAP server and attempts to match fields by user id, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field. > >The default field value `uid|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields. > From 352a22999c3fc2425065610af67652e3a5804fcc Mon Sep 17 00:00:00 2001 From: Denise Schannon Date: Wed, 11 Jul 2018 14:57:00 -0700 Subject: [PATCH 35/35] small updates to nginx --- .../en/config-options/add-ons/ingress-controllers/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rke/v0.1.x/en/config-options/add-ons/ingress-controllers/_index.md b/content/rke/v0.1.x/en/config-options/add-ons/ingress-controllers/_index.md index 4c0abf4ec46..bcd3ed5ee3a 100644 --- a/content/rke/v0.1.x/en/config-options/add-ons/ingress-controllers/_index.md +++ b/content/rke/v0.1.x/en/config-options/add-ons/ingress-controllers/_index.md @@ -37,9 +37,9 @@ You can disable the default controller by specifying `none` to the ingress `pro ingress: provider: none ``` -## Nginx Ingress Controller +## Configuring NGINX Ingress Controller -For the configuration of nginx, there are some configuration options. There are a [list of options](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/) for the nginx config map and [command line extra_args](https://kubernetes.github.io/ingress-nginx/user-guide/cli-arguments/). +For the configuration of nginx, there are configuration options available in Kubernetes. There are a [list of options for the NGINX config map](https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/configmap.md) , [command line extra_args](https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/cli-arguments.md) and [annotations](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/). ```yaml ingress: