From c83b847568fa85427c84bd9b7fac20ce55fa8e84 Mon Sep 17 00:00:00 2001 From: Matan Horovitz Date: Sat, 30 Apr 2022 23:14:42 +0300 Subject: [PATCH] docs: add all untracked content --- Automatic_Git_Commits.md | 40 ++++++++ Backups.md | 53 +++++++++++ Compiling_on_RAM.md | 26 ++++++ FortiVPN.md | 31 +++++++ FreeBSD_VM.md | 43 +++++++++ Gentoo_Tips_Tricks.md | 52 +++++++++++ Gentooisms.md | 191 ++++++++++++++++++++++++++++++++++++++ KVM_Network_Bridge.md | 83 +++++++++++++++++ Mail.md | 42 +++++++++ Replacing_Failed_Disk.md | 196 +++++++++++++++++++++++++++++++++++++++ Solved_Issues.md | 183 ++++++++++++++++++++++++++++++++++++ Upgrade_Gitea.md | 58 ++++++++++++ boot-from-snapshot.md | 69 ++++++++++++++ dsc_0099_2.jpg | Bin 0 -> 1328232 bytes dsc_0108_2.jpg | Bin 0 -> 1441029 bytes dsc_0198_2.jpg | Bin 0 -> 1834552 bytes home.md | 14 +++ linux.png | Bin 0 -> 21115 bytes new_subdomain.md | 75 +++++++++++++++ nextcloud_mail.png | Bin 0 -> 93803 bytes nginx_auth.png | Bin 0 -> 30898 bytes nginx_password.md | 54 +++++++++++ podman.md | 104 +++++++++++++++++++++ pukeko.png | Bin 0 -> 17344 bytes 24 files changed, 1314 insertions(+) create mode 100644 Automatic_Git_Commits.md create mode 100644 Backups.md create mode 100644 Compiling_on_RAM.md create mode 100644 FortiVPN.md create mode 100644 FreeBSD_VM.md create mode 100644 Gentoo_Tips_Tricks.md create mode 100644 Gentooisms.md create mode 100644 KVM_Network_Bridge.md create mode 100644 Mail.md create mode 100644 Replacing_Failed_Disk.md create mode 100644 Solved_Issues.md create mode 100644 Upgrade_Gitea.md create mode 100644 boot-from-snapshot.md create mode 100644 dsc_0099_2.jpg create mode 100644 dsc_0108_2.jpg create mode 100644 dsc_0198_2.jpg create mode 100644 home.md create mode 100644 linux.png create mode 100644 new_subdomain.md create mode 100644 nextcloud_mail.png create mode 100644 nginx_auth.png create mode 100644 nginx_password.md create mode 100644 podman.md create mode 100644 pukeko.png diff --git a/Automatic_Git_Commits.md b/Automatic_Git_Commits.md new file mode 100644 index 0000000..a6ba0c0 --- /dev/null +++ b/Automatic_Git_Commits.md @@ -0,0 +1,40 @@ +--- +title: Automatic Git Commits +description: A simple set of scripts to enable a Git commit & push whenever entering a tracked directory +published: true +date: 2022-04-30T20:10:22.327Z +tags: git, maintanence +editor: markdown +dateCreated: 2021-09-02T08:23:55.501Z +--- + +# Automatic Git Commits +> This techique is being phased out from Takahe - I didn't like it for home use. However, it is useful and may prove useful again - hence this page. +{.is-warning} + +Created for a non-Git savvy folk at work, the Takahe runs a pair of elegant Git auto commit scripts - the `GitDaemon` and the `GitUpstreamer`. After some modification, below is an outline on how these scripts work. + +The first foothold is under the shell's profile - in our case, each user's `~/.zshrc` file (you *are* using [ohmyzsh](https://ohmyz.sh/), right?). If you look at the Environment Variables section at the bottom, you'll find the following: +``` +### Environment Variables ### +export SCRIPTS="/home/shmick/Scripts" +source "$SCRIPTS/GitDaemon" +``` +The [Git Daemon](https://git.pukeko.xyz/shmick/scripts/src/branch/master/GitDaemon) script is a replacement that latches onto the `cd` command - it first executes normal `cd` and then finds out whether the directory is under Git. + +The [Git Upstreamer](https://git.pukeko.xyz/shmick/scripts/src/branch/master/GitUpstreamer) is what actually does the auto-commit - simply by quering the `git` command's output and committing to the set remote. This, of course, relies on a working set up remote. + +You need to be aware of the following: + +- The scripts only run on directories with a file named .autocommit. Git is common, and I want to be in control of what goes upstream, to avoid awkward situations. +- The scripts adds all files in the folder, and thus relies on a proper .gitignore file. If you had not explicitly ignored it - they will commit it! +- The scripts' only toggle is via the shell profile. No shell profile - no scripts. + +# Under Git Automatic commits + +- [Shells](https://git.pukeko.xyz/shmick/shells) + - under `/home/` and `/etc/zsh` +- [Docker compose files](https://git.pukeko.xyz/shmick/docker) + - Excluding Grocy, the Minecraft server, Pi-Hole and Portainer +- [Linux Kernel configs](https://git.pukeko.xyz/shmick/kernel-confs) (This doesn't really matter - I put them there, but whatever) + diff --git a/Backups.md b/Backups.md new file mode 100644 index 0000000..b7229fd --- /dev/null +++ b/Backups.md @@ -0,0 +1,53 @@ +--- +title: Backups +description: What is backed up? Where is it backed up? look here! +published: true +date: 2022-04-30T20:10:24.250Z +tags: maintanence, backup +editor: markdown +dateCreated: 2021-09-02T08:29:45.542Z +--- + + I use several methods of backup to keep important data stowed away. Below is an outline of what is backed up and how. + +> Local Backups are transitioning to Seafile - in progress! +{.info} + +# Cloud Backups + +The first and most reliable form of backup is a [Restic](https://restic.net/) repository stored on [Backblaze B2](https://secure.backblaze.com/b2_buckets.htm). + +Three things are currently backed up with B2: + +1. Photos (Path: `/Red-Vol/Media/Pictures`, Bucket: `Gerbil-TK`) +2. Containers (Path: `/Red-Vol/Media/Containers`, Bucket: `Gerbil-TK-Containers`) +3. Cloud Data gathered using Synching (Path: `/Red-Vol/Media/Cloud/Syncthing/`, Bucket: `Pukeko-XYZ-Cloud`) + +Backups run on a cron job which executes the following commands: + +- `restic -r b2:Gerbil-TK backup /Red-Vol/Media/Pictures/ --exclude='*סתם*' --exclude='2021' --exclude='Photos from *'` for photos. +- `restic -r b2:Gerbil-TK-Containers backup --exclude=“photoprism” --exclude=“transmission” --exclude=“jekyll” --exclude=“minecraftserver” /Red-Vol/Media/Containers` for Docker containers. +- `restic -r b2:Pukeko-XYZ-Cloud backup /Red-Vol/Media/Cloud/Syncthing/` + +## Important Points +- Photoprism pictures are not backed up as their source directories are already backed up. +- `/home` is backed up under the Cloud backup. +- Anything crucial is expected to be backed up via Syncthing, and from there to B2. +- Containers back up their data, which is always contained in their directory by convention. They are also another copy of the [Docker Git repository](https://git.gerbil.tk/shmick/docker). + +## B2 Cloud Points +- When first creating a new bucket, it needs to be initialized with Restic by running `restic init`. +> Example: +`restic -r b2:Pukeko-XYZ-Cloud init` +{.info} + +> The password is read from the `RESTIC_PASSWORD` environment variable set in the `zprofile`. It is also stored in the [BitWarden password manager](https://vault.pukeko.xyz). +{.warning} + +- Bucket names are globally unique and cannot be changed once created (as far as I'm aware). +- When creating a new bucket, set it to be as basic as possible - no object locks, no encryption, no snapshots - Restic handles all of these things. + +# Local Backups +Local backups are done using [Syncthing](https://sync.pukeko.xyz), a decenteralized sync engine. Syncthing provides encrypted, delta-aware backups, and is very granular - what is uploaded and where is set by each client. Sync can also be configured as single direction (send-only or receive-only). + +By convention, every backup is placed under `/Red-Vol/Media/Cloud/Syncthing/[user]`. \ No newline at end of file diff --git a/Compiling_on_RAM.md b/Compiling_on_RAM.md new file mode 100644 index 0000000..af9e948 --- /dev/null +++ b/Compiling_on_RAM.md @@ -0,0 +1,26 @@ +--- +title: Compiling on RAM +description: Short guide on how to mount a tmpfs cache and set it as a compiling environment for great speed gain when compiling, at the expense of RAM. +published: true +date: 2022-04-30T20:10:26.153Z +tags: gentoo, performance +editor: markdown +dateCreated: 2021-09-02T07:39:15.029Z +--- + +# Compiling on RAM using `tmpfs` + +When using compilation heavy systems (erhm, Gentoo), everyday compiling can be drastically sped up on capable systems by compiling on `tmpfs`, which is basically a file system on the RAM. Since RAM is dozens of times faster than even the fastest consumer SSDs, this is a great improvement for compile times, at the cost of memory. + +See these pages on enabling compile on `tmpfs` for [Gentoo](https://wiki.gentoo.org/wiki/Portage_TMPDIR_on_tmpfs) and [Arch Linux](https://wiki.archlinux.org/title/Makepkg#Improving_compile_times). Arch Linux tweaks *probably* work for Gentoo as well, and perhaps FreeBSD - needs to be tested. + +## Possible issue - not enough space +> Note: this shouldn't really happen anymore on Takahe as I've excluded core scoundrels as per the wiki page. +{.is-warning} + +Since `tmpfs` sits on the RAM, large package may fail to compile (or refuse to try beforehand). While the Gentoo wiki [Describes a Gentoo-specific solution](https://wiki.gentoo.org/wiki/Portage_TMPDIR_on_tmpfs#Per-package_choices_at_compile_time) (Which did not work), there are two easier, universal fixes: +- Temporarily increase tmpfs memory by running `mount -o remount,size=[new size-in-G] /path/to/tmpfs/mount` +- Temporarily unmount tmpfs by running `umount /path/to/tmpfs/mount`, obviously losing performance benefits. + +## ZRAM +Since compiling on tmpfs (and in general) eats up large amounts of memory, and Linuxes (and maybe BSDs - haven't gotten there) do not play nice with low memory, setting up `ZRAM` ([Arch Linux and the rest of them](https://wiki.archlinux.org/title/Improving_performance#Zram_or_zswap),[Gentoo](https://wiki.gentoo.org/wiki/Zram)) is a great match when compiling on `tmpfs`. \ No newline at end of file diff --git a/FortiVPN.md b/FortiVPN.md new file mode 100644 index 0000000..07ef080 --- /dev/null +++ b/FortiVPN.md @@ -0,0 +1,31 @@ +--- +title: Forticlient VPN +description: Guide on setting up a headless FortiVPN client +published: true +date: 2022-04-30T20:10:28.072Z +tags: forti, vpn +editor: markdown +dateCreated: 2021-09-02T08:14:33.492Z +--- + +# Forticlient VPN +Connecting to Forti VPNs on Linux is apparently quite easy thanks to [openfortivpn](https://github.com/adrienverge/openfortivpn). + + To install, run `emerge net-vpn/openfortivpn` on Gentoo, and follow the docs for everything else. + +## Set up a config: + +Create `/etc/openfortivpn/[config]` and fill it according to this pattern: +``` +host = 185.163.148.98 +port = 10443 +username = matanh +``` +Replace whatever you need, obviously - that one's out of date. +## Accept certificate + +Now, try connecting with `openfortivpn -c /etc/openfortivpn/[config]`, which will complain about a missing trusted-cert and spit out the line to add to the config - ex: +``` +trusted-cert = 32ad6666ce6ee21f9353ca24392fa3a5db179b00540616965aa8767cd8a2583c +``` +Add this to the config and log on again. Viola! \ No newline at end of file diff --git a/FreeBSD_VM.md b/FreeBSD_VM.md new file mode 100644 index 0000000..9e5d7e2 --- /dev/null +++ b/FreeBSD_VM.md @@ -0,0 +1,43 @@ +--- +title: FreeBSD Virtual Machine +description: Tips and tricks for running a FreeBSD guest under KVM +published: true +date: 2022-04-30T20:10:29.996Z +tags: kvm, virt-manager, freebsd, virtualization +editor: markdown +dateCreated: 2022-04-30T19:57:51.313Z +--- + +Linux's KVM (Kernel Virtual Machine) is great. + +The FreeBSD operating system is also great. + +You know what's great? running FreeBSD as a KVM guest! + +Here are some insights into the process. + + +# VM image or .ISO installation? + +FreeBSD offers both premade virtual machine disks (in particular, we care about the `.qcow2` image) and installation ISO's - a netinstall, a minimal install and a full installation. + +Both have their uses: + +The VM image is: +- Far quicker to set up - it expands to a disk and is ready to go. +- Kind of bothersome to expand - it's about 5GB and `virt-manager` does not offer a nice GUI for expanding the disk. Not impossible, but not friendly. (see [resizing qcow2 article](https://linuxconfig.org/how-to-resize-a-qcow2-disk-image-on-linux) - maybe GParted can do this?) +- Uses UFS - great for simple stuff without the overhead of ZFS, not great if you want the bling and oomph of ZFS + +The ISO's are: +- More similar to a physical install. If you need to do this for bare metal at some point, it's pretty much the same. +- Much more configurable - you can set the filesystem, swap, encryption, and hardening in the nice sysinstall TUI instead of manually later +- Slower to set up, obviously +- If using network setup (you should), you need to be absolutely certain the VM has network access (see [Setting up a network bridge](/KVM_Network_Bridge)) or you're going to waste a lot of time. + +# Post install - system hangs at boot time +So appearantly, if you select the FreeBSD profile in virt-manager when installing the VM, KVM adds a serial device - which is both useless and throws BSD into a loop. This won't hamper the installatin - but you won't get to the login prompt afterwards. + +If everything look OK but you're not getting to the login screen, remove the serial device from the VM's hardware. + +> Source: [FreeBSD forums thread](https://forums.freebsd.org/threads/freebsd13-wont-boot-in-qemu-kvm-host.80818/) +{.is-info} \ No newline at end of file diff --git a/Gentoo_Tips_Tricks.md b/Gentoo_Tips_Tricks.md new file mode 100644 index 0000000..d01edc4 --- /dev/null +++ b/Gentoo_Tips_Tricks.md @@ -0,0 +1,52 @@ +--- +title: Gentoo Tips, Tricks & Shenanigans +description: These are Gentoo relevations which surprised me at some point, along with nice to haves. +published: true +date: 2022-04-30T20:10:31.949Z +tags: gentoo, performance +editor: markdown +dateCreated: 2021-09-02T08:10:07.601Z +--- + +Below are stuff I found out about Gentoo. +# Moving package from Testing to Stable + +Gentoo's testing branch (`~arch`) is actually quite stable. However, in case you'd like to keep something on stable for whatever reason (I encountered this with the kernel, trying to Clang it), you can mask the `~amd64` keyword under `/etc/portage/package.accept_keywords/your_package`. Example: +```bash +/etc/portage/package.accept_keywords/gentoo-sources: +sys-kernel/gentoo-sources -~amd64 +``` +That is, if your `/etc/portage/make.conf` contains ~amd64, you can un-`~amd64`-it this way. Noice! +# Clang + +Clang is an LLVM frontend and an alternative to GCC. Clang has recently [surpassed GCC](https://www.phoronix.com/scan.php?page=article&item=clang12-gcc11-icelake&num=6) performance wise, as well as being easier to set up for goodies like LTO. + +[Gentoo's wiki page](https://wiki.gentoo.org/wiki/Clang) lays out how to use Clang as a system compiler instead of GCC - but note the few caveats below: +> READ THE INSTRUCTIONS CAREFULLY! the order is crucial and is not chronological! +{.is-danger} + +- All DE's tested (KDE5, GNOME3) require `samba`, and `samba` requires GCC's own `libunwind`. Hence, when following instructions above, do not use `llvm-libunwind` (unfortunately). This is only relevant for GUI installations - servers are fine. +- Clone the [Portage Git repository](http://git.pukeko.xyz/shmick/portage.git) for necessary overrides back to GCC (such as Python3, GNU libc). + +- Use `flto=thin`. It's easy and it works great. +- > Use `LDFLAGS` per compiler - when adding Clang's `LDFLAGS` to the global `make.conf`, GCC also reads them (and fails!). +{.is-warning} + +- Use ninja for faster compile times. +- if following [Compiling on the RAM](/Compiling_on_RAM) When building Clang itself, unmount `/var/tmp/portage` - it doesn't play nicely. + +Happy compiling! +# Virtualizing with UEFI on QEMU + +When trying to create a UEFI VM on `virt-manager`, some settings will lead to a blank screen. In order to use UEFI: + +- emerge the UEFI firmware - `sys-firmware/edk2-ovmf` +- restart libvirtd if running +- when creating a VM, select the Q35 chipset (440FX does not work), and use the `secure_code` option - `UEFI x86_64: /usr/share/qemu/edk2-x86_64-secure-code.fd`. + +> Reference: https://forums.gentoo.org/viewtopic-t-1066336-start-0.html +{.is-info} + +# The `Makefile` is just a file! +You can read it! you can tweak it! yay! +> Thanks, [Gentoo-folk](https://forums.gentoo.org/viewtopic-t-1140180.html)! \ No newline at end of file diff --git a/Gentooisms.md b/Gentooisms.md new file mode 100644 index 0000000..4db1eef --- /dev/null +++ b/Gentooisms.md @@ -0,0 +1,191 @@ +--- +title: Hall of Gentooisms +description: Anything related to wrangling Gentoo, solving errors in Gentoo, making Gentoo faster thus creating errors in Gentoo, goes here. Gentoo. +published: true +date: 2022-04-30T20:10:34.075Z +tags: gentoo +editor: markdown +dateCreated: 2021-08-21T18:00:45.725Z +--- + +# Basics +Everybody starts somewhere. +Here are the *absolute* essentials when it comes to Gentoo-wrangling. + +## The `make.conf` +Gentoo's key settings are set under the `/etc/portage/make.conf` file - which is likely the first you modify. Some important sections are: +- `USE=` - Global USE flags for the system (see below). +- `CFLAGS` - these are the options to pass to the compiler. Unless you like suffering, these should be `-O2 -pipe -march=native`. +- `MAKEOPTS` are things to pass to the `make` command - pass `-j$(nproc)` to give compiling you entire system's **oopmh**. +> You can also override to less oomph, or start with some oomph and give specific package all oomph via Portage - see environment section below. +{.is-info} +- `ACCEPT_KEYWORDS` - Your branch (see below). +- `CMAKE_MAKEFILE_GENERATOR` - what program to use for make. Default is `emake`, but you should probably use `ninja` for faster builds. +- `CPU_FLAGS_X86` - just run `cpuid2cpuflags | sed -e 's/CPU_FLAGS_X86://g'` and put it there. Do not question it. +> You'll likely need to install that command using `emerge cpuid2cpuflags`. +{.is-info} +> See my (hopefully current) `make.conf` [here](https://git.pukeko.xyz/shmick/portage/src/branch/master/make.conf). +{.is-info} +## The Portage +It is big, it is gnarly, and I'm going to pretend not to see it is also Python. What should you know about Portage, the legendary Gentoo package manager? + +Since it's inspired by BSD's ```ports```, each package's full name is a category followed by an actual pacakge name (ex: ```sys-devel/llvm```). + +Under Portage's configuration directory ```/etc/portage```, there's a bunch of things you can mess with: + +* Each package's keywords (like switching it around between branches) +* Each package's USE flags (things to add or remove from it, see [here](https://www.gentoo.org/support/use-flags/), and search specific package's USE flags [here](https://packages.gentoo.org/)) +* Compiler environments and pointing packages to them + +Generally, the structure is ```/etc/portage/package.something/```, under which you put the base name of your package: +```bash +/etc/portage/package.accept_keywords/gentoo-sources: +sys-kernel/gentoo-sources -amd64 ~amd64 +# ^ Package name ^ Keywords +``` +And inside the file, you specify the full package name followed by whatever it is you're setting: + + +When it comes to more general things like environments, you create a file under ```/etc/portage/env``` and name it whatever, like the GCC override for my Clang system: + +```bash +/etc/portage/env/compiler-gcc-lto: +CC="gcc" +CXX="g++" +CFLAGS="-flto=16 -march=native -O2 -pipe" +CXXFLAGS="${CFLAGS}" +LDFLAGS="-O2 -Wl,--as-needed" +AR="gcc-ar" +NM="gcc-nm" +RANLIB="gcc-ranlib" +``` + +and tell package to to use it by writing down their full name followed by the config in ```/etc/portage/package.env```: +```bash +/etc/portage/package.env: +sys-libs/glibc compiler-gcc-lto +# ^ Package name #^ Config under /etc/portage/env +``` +> You can see my current ```/etc/portage``` in the [git repository](https://git.pukeko.xyz/shmick/portage), and a bunch of other useful things in the [Gentoo Wiki](https://wiki.gentoo.org/wiki/Portage) page about Portage. +{.is-info} + +## The Branches +Gentoo has two branches of relevance to me - the ```arch``` and the ```~arch```, which are the stable and testing branches, respectively. + +> instead of ```arch```, you put in your processor architecture! ```amd64``` gang! {.is-info} + +> It is really, REALLY friggin' hard to change branches as I've smugly predicted I could. Choose your branch carefully! +{.is-warning} + +For perspective, ```arch``` is about on par to what you'll see in Ubuntu LTS, while ```~arch``` is what you'd see on... Arch! + +> ```~arch``` is really funny to me. Like, +Q: Hey! what processor are you?! +A: Um, AMD64, kinda? +Nice. +{.is-success} + +### Setting the branches +Like many Gentoo things, you set your branches in ```/etc/portage/make.conf```. Setting the branch to Testing would be like so: +```ACCEPT_KEYWORDS="~amd64"``` +Hilarious! + + +## The Kernel +> In Gentoo, something-sources is the kernel. We are too artsy-fartsy for just ```linux``` (Arch!) +{.is-info} + +### Picking a kernel +There are three kernel types that may be of any interest to me (with my opinion, which is useless and irrelevant): + +- The latest and greatest ```gentoo-sources``` (you have been bad and must be punished) +- The Long Term Support release of ```gentoo-sources``` (you are a reasonable person) +- The plain-ol' ```vanilla-sources``` (you are a purist, a snob and a scoundrel) + +Under ```arch```, you get the LTS, since you're a reasonable person. +Under ```~arch```, you get the latest and greatest, because you hate it when things are working. +> This is not true; ```~arch``` it working great, but how can you flex otherwise? +{.is-warning} + +```vanilla-sources``` acts the same, but with the upstream kernel instead. Gentoo does very little patching, making this a prime example of nitpicking. + +To use an LTS kernel on a Testing system, +(smort!) you can change the keywords for the something-sources you're using like so: +```bash +sys-kernel/gentoo-sources -~amd64 amd64 +# ^ NO testing +``` +And to use the latest kernel on a stable system (why?) you'd do like so: +```bash +sys-kernel/gentoo-sources -amd64 ~amd64 +# ^ NO stable +``` + +You get the gist. + +### Setting the kernel +> While easy to forget, not setting the kernel often leads to booting and `initramfs` genenration errors. Follow attentively! +{.is-warning} + + +After ```emerge```-ing whatever kernel you use, run ```eselect kernel list```, which will show something like this: +```zsh +takahe :: ~ ‹takahe-root*› # eselect kernel list +Available kernel symlink targets: + [1] linux-5.13.12 + [2] linux-5.13.12-gentoo * +``` + +select the kernel you desire by running `eselect kernel set` followed by the number of said kernel. + +Behind the scene, this symlinks the downloaded kernel archive to `/usr/src/linux`. + + +### Configuring the kernel +Whatever it is you do, do it in `/usr/src/linux`. +Make sure it is symlinked by running `ls -l /usr/src/linux` - it should show where the real path is. +#### option 1: I have time and like wasting compile power +```genkernel all``` and follow whatever it yells at you. See [here](https://wiki.gentoo.org/wiki/Handbook:AMD64/Installation/Kernel#Alternative:_Using_genkernel). + +#### option 2: Use whatever's running already +run `zcat /proc/config.gz > .config` - Gentoos (and every other distribution I've seen) expose their kernel configs this way, but this is not universal. + +You can double check this method by running `make menuconfig` and checking your option (or just reading the `.config`, you chad). +#### option 3: Use my AWESOME kernel configs (if you have my system, lol) +You can also clone the kernel config from this [Git repository](https://git.pukeko.xyz/shmick/kernel-confs) - obviously adapted to *my* system. + +> Note: Compiling with Clang is a bit messier - see Clang page. +{.is-info} + +### Compiling and installing +To start compiling, run +` +make -j$(nproc) && make modules_install && make install +` +which will output some very cool text flying on the terminal which you could fail to impress people with. + +Once the compilation is finished, you should see three files under `/boot`: +- a `vmlinuz` whatever - this is the actual kernel +- an `initramfs` whatever - this is the inital RAM filesystem image +- a `System.map` whatever - I have no idea what this is. + +Example proper output: +```zsh +ls /boot: +initramfs-5.13.12-gentoo-x86_64.img +System.map-5.13.12-gentoo-x86_64 +vmlinuz-5.13.12-gentoo-x86_64 +``` +Vanilla kernels will not have the `gentoo-x86_64` bit. + +> Some systems *can* boot without an `initramfs` - I have yet to achieve this level of awesomeness +{.is-info} + +For some reason, *my* system usually fails to copy these files over. After compiling, you can copy them manually to the boot directory: + +```zsh +cp arch/x86_64/boot/bzImage /boot/vmlinuz-5.13.12-gentoo-x86_64 +#^ This is the kernel +cp System.map /boot/System.map-5.13.12-gentoo-x86_64 +``` +if the `initramfs` is missing, you can generate it with `genkernel` or with `dracut` - see [here](https://wiki.gentoo.org/wiki/Initramfs/Guide#Creating_an_initramfs). \ No newline at end of file diff --git a/KVM_Network_Bridge.md b/KVM_Network_Bridge.md new file mode 100644 index 0000000..0fa9340 --- /dev/null +++ b/KVM_Network_Bridge.md @@ -0,0 +1,83 @@ +--- +title: Network Bridge +description: Guide to create a network bridge for KVM guests +published: true +date: 2022-04-30T20:10:36.036Z +tags: network, nmcli, networkmanager, kvm, virt-manager +editor: markdown +dateCreated: 2022-04-29T14:05:54.201Z +--- + +The best way to run virtual machines under Linux is the *virt-manager* UI for `qemu`. +Virt-manager unfortunately insists on creating a NAT network by default - which takes over DNS port 53 and throws the VM onto a different subnet. + +To recitify this, the best solution is to generate a network bridge. + +There are several ways to go about it, chiefly with the `ip` command, the `bridgeutils` package, or NetworkManager with `nmcli`. + +Since `bridgeutils` is a seperate, older utility and the `ip` procedure tends to hamstring the internet connection (probably solveable, but still), I used `nmcli`. + +> Arch wiki has a [great page](https://wiki.archlinux.org/title/Network_bridge) on bridge networking. +{.is-info} + +# Create the bridge +In essence: + +1. Create the bridge: +`nmcli connection add type bridge ifname [bridge name] stp no` + +2. Add your main internet interface as a slave: +`nmcli connection add type bridge-slave ifname [internet interface name] master [bridge name]` + +3. Bring your internet interface down: +`ncmli connection down [internet interface name]` + +4. Bring the bridge up: +`nmcli connection up bridge-[bridge-name]` +(note how `nmcli` appends `bridge-` before the bridge name). + +5. Assign an IP address to the bridge using your favourite tool (`ip`, `nmcli`, `nmtui` and the GNOME GUI all work well). + +# Register the bridge with Virt-Manager + +For Virt-Manager to see your bridge, you must add it as an xml: + +1. From the main window, select `Edit` -> `Preferences` -> `Enable XML editing`. + +2. Hover over a VM -> `Edit` -> `Connection Details` -> `+` -> `XML` + +3. Paste the following: +```xml + + bridged-network + + + +``` +Note you do not need to add the `bridge-` beforehand. + +4. You can now use the bridge for virtual machines. Success! + +# Enable internet access for bridged guests +If all you want is a VM on your subnet and guest-to-host access, you're all done. + +> Source: [LinuxConfig.org](https://linuxconfig.org/how-to-use-bridged-networking-with-libvirt-and-kvm) +{.is-info} + +However, if you want the guest to have internet access, you must enable it via `sysctl` by disabling the Bridge Netfilter: + +1. Edit `vim /etc/sysctl.d/99-netfilter-bridge.conf` and write the following: +```vim +net.bridge.bridge-nf-call-ip6tables = 0 +net.bridge.bridge-nf-call-iptables = 0 +net.bridge.bridge-nf-call-arptables = 0 +``` + +2. Load the `br_netfilter` module with `modprobe br_netfilter` + +3. Enable the module at bootime by editing `/etc/modules-load.d/br_netfilter.conf` and adding `br_netfilter`. + +4. Load the new settings into `sysctl` with `sysctl -p /etc/sysctl.d/99-netfilter-bridge.conf` + + +Enjoy your networked KVM guests, yo. \ No newline at end of file diff --git a/Mail.md b/Mail.md new file mode 100644 index 0000000..17805b2 --- /dev/null +++ b/Mail.md @@ -0,0 +1,42 @@ +--- +title: Mail +description: Overview of mail settings, and sending system mail. +published: true +date: 2022-04-30T20:10:37.995Z +tags: config, mail +editor: markdown +dateCreated: 2021-08-27T14:00:37.062Z +--- + +# Mail +A bunch of stuff still use mail unfortunately. + +Below are the deets on how to point Containers to the SMTP mailbox I set up, and how to send system mail. + +## Container mail via SMTP + +Use the following credentials: +```yml +host: smtp.mail.yahoo.com +port: 587 +username: "pukekoxyz" +password: "pvefngmuhcxunzqs" +sender: pukekoxyz@yahoo.com +``` +`takahe@pukeko.xyz` may also work as I've set up a relay - not tested. +`matan@pukeko.xyz` point to my ProtonMail address - similarly untested. + +## System mail via `sendmail` +Gentoo mailing is... weird. Postfix works as is (see [here](https://wiki.gentoo.org/wiki/Postfix)), but `mailx` appears not to, sticking us with `sendmail`. + +To send an acceptable (not pretty - acceptable) mail run: +`echo "Subject: [subject]" | sendmail -F "Takahe" -f "takahe@pukeko.xyz" -t matanhorovitz@protonmail.com <<< $([message-body])` +> Example: Tacocat! +`echo "Subject: tacocat" | sendmail -F "Takahe" -f "takahe@pukeko.xyz" -t matanhorovitz@protonmail.com <<< $(echo tacocat)` +{.is-info} + +So long as it works, right? + +## Nextcloud mail +Nextcloud requires STARTTLS on port 25 - see this example: +![nextcloud_mail.png](/nextcloud_mail.png) \ No newline at end of file diff --git a/Replacing_Failed_Disk.md b/Replacing_Failed_Disk.md new file mode 100644 index 0000000..2f35aa5 --- /dev/null +++ b/Replacing_Failed_Disk.md @@ -0,0 +1,196 @@ +--- +title: Replacing Failed Disk +description: Guide on removing an old yeller from a BtrFS RAID 1 array (for a new yeller) +published: true +date: 2022-04-30T20:10:40.002Z +tags: btrfs, storage, nas, filesystem +editor: markdown +dateCreated: 2022-04-04T16:25:48.663Z +--- + +One of the old 3TB yellers has started playing dirty. +We do not negotiate with terrorist - a pair of 8TB's were called for reinforcement on that very same day. + +Below, I will write this page as I replace the failing, followed by the non failing disk, for the BtrFS RAID1 array on Takahe. + +If all goes well, this will be a nice, cozy page. If I cause catastrophic data loss (again), this shall be a monument of my failure. + +> Do **NOT** use this method to replace a filesystem with errors! it ***will*** copy them over and they ***will*** be unrecoverable! +{.is-danger} + +# Crossing Disk Serial with Device Name + +Ever so pretentious, `smartd` will name a disk by it's serial - see this example below: +```zsh +➜ ~ systemctl status smartd +● smartd.service - Self Monitoring and Reporting Technology (SMART) Daemon + Loaded: loaded (/usr/lib/systemd/system/smartd.service; enabled; vendor preset: enabled) + Active: active (running) since Mon 2022-04-04 08:01:55 IDT; 11h ago + Docs: man:smartd(8) + man:smartd.conf(5) + Main PID: 1014 (smartd) + Status: "Next check of 2 devices will start at 19:31:55" + Tasks: 1 (limit: 4915) + CPU: 85ms + CGroup: /system.slice/smartd.service + └─1014 /usr/sbin/smartd -n + +Apr 04 17:01:55 Takahe smartd[1014]: Device: /dev/disk/by-id/ata-WDC_WD30EFRX-68EUZN0_WD-WCC4N7UEPSDY [SAT], 2 Currently unreadable (pending) sectors +Apr 04 17:01:55 Takahe smartd[1014]: Device: /dev/disk/by-id/ata-WDC_WD30EFRX-68EUZN0_WD-WCC4N7UEPSDY [SAT], 4 Offline uncorrectable sectors +Apr 04 17:31:55 Takahe smartd[1014]: Device: /dev/disk/by-id/ata-WDC_WD30EFRX-68EUZN0_WD-WCC4N7UEPSDY [SAT], 2 Currently unreadable (pending) sectors +Apr 04 17:31:55 Takahe smartd[1014]: Device: /dev/disk/by-id/ata-WDC_WD30EFRX-68EUZN0_WD-WCC4N7UEPSDY [SAT], 4 Offline uncorrectable sectors +Apr 04 18:01:56 Takahe smartd[1014]: Device: /dev/disk/by-id/ata-WDC_WD30EFRX-68EUZN0_WD-WCC4N7UEPSDY [SAT], 2 Currently unreadable (pending) sectors +Apr 04 18:01:56 Takahe smartd[1014]: Device: /dev/disk/by-id/ata-WDC_WD30EFRX-68EUZN0_WD-WCC4N7UEPSDY [SAT], 4 Offline uncorrectable sectors +Apr 04 18:31:55 Takahe smartd[1014]: Device: /dev/disk/by-id/ata-WDC_WD30EFRX-68EUZN0_WD-WCC4N7UEPSDY [SAT], 2 Currently unreadable (pending) sectors +Apr 04 18:31:55 Takahe smartd[1014]: Device: /dev/disk/by-id/ata-WDC_WD30EFRX-68EUZN0_WD-WCC4N7UEPSDY [SAT], 4 Offline uncorrectable sectors +Apr 04 19:01:55 Takahe smartd[1014]: Device: /dev/disk/by-id/ata-WDC_WD30EFRX-68EUZN0_WD-WCC4N7UEPSDY [SAT], 2 Currently unreadable (pending) sectors +Apr 04 19:01:55 Takahe smartd[1014]: Device: /dev/disk/by-id/ata-WDC_WD30EFRX-68EUZN0_WD-WCC4N7UEPSDY [SAT], 4 Offline uncorrectable sectors +``` + +That's wonderful, honey. +But who is `/dev/disk/by-id/ata-WDC_WD30EFRX-68EUZN0_WD-WCC4N7UEPSDY`? + +`btrfs` sure as hell doesn't know: +```zsh +➜ ~ btrfs filesystem show /Red-Vol +Label: none uuid: c2d98db0-b903-4cc2-947c-4c4c944da026 + Total devices 2 FS bytes used 2.21TiB + devid 1 size 2.73TiB used 2.21TiB path /dev/sdc + devid 2 size 2.73TiB used 2.21TiB path /dev/sdb +``` +`udevadm` to the rescue! I even looped it nicely for ya :) + +```zsh +➜ ~ for disk in $(btrfs filesystem show /Red-Vol/ | awk '{print $NF}' | grep "/dev"); do echo $disk && udevadm info --query=all --name=$disk | grep ID_SERIAL; done +/dev/sdc +E: ID_SERIAL=WDC_WD30EFRX-68EUZN0_WD-WCC4N3YN0903 +E: ID_SERIAL_SHORT=WD-WCC4N3YN0903 +/dev/sdb +E: ID_SERIAL=WDC_WD30EFRX-68EUZN0_WD-WCC4N7UEPSDY +E: ID_SERIAL_SHORT=WD-WCC4N7UEPSDY +``` + +A-ha! `/dev/sdb`, you bastard! + +# Crossing Device Name With devid (pointless) +But wait, there's more! +The `btrfs replace` command expects the `devid` (or the device name which we already know, making this section utterly insignificant, but what the heck). + +To find it, check `btrfs filesystem show [mountpoint]`: +```zsh +➜ ~ btrfs filesystem show /Red-Vol/ +Label: none uuid: c2d98db0-b903-4cc2-947c-4c4c944da026 + Total devices 3 FS bytes used 2.21TiB + devid 1 size 2.73TiB used 2.21TiB path /dev/sdc + devid 2 size 2.73TiB used 2.21TiB path /dev/sdb +``` + +A-ha! `devid 2`, you bastard! +# Replacing The Bastard + +Now, run `btrfs replace`: +`➜ ~btrfs replace start 2 /dev/sda /Red-Vol/ -f` +> The `-f` was thrown in because I have chosen to format the new disk with BtrFS beforehand. I have chosen to format the new disk with Btrfs beforehand because I am very stupid. +{.info} + +Now, all that is left is watching in panic: +```zsh +➜ ~ btrfs replace status /Red-Vol +1.4% done, 0 write errs, 0 uncorr. read errs +``` + +Will it work? will it destroy ALL my data? + +We shall see. + +# Resizing The Bastards + +Success! Now, assuming we are replacing with larger disks (go big or go home, shmub), you will have to resize the disks. +First, see your `devid`'s with `btrfs filesystem show`: +``` +➜ ~ btrfs filesystem show /Red-Vol/ +Label: none uuid: c2d98db0-b903-4cc2-947c-4c4c944da026 + Total devices 2 FS bytes used 2.21TiB + devid 1 size 7.28TiB used 2.21TiB path /dev/sdb + devid 2 size 2.73TiB used 2.21TiB path /dev/sda +``` +Now, run `btrfs filesystem resize [devid]:max [mountpoint]`: +``` +➜ ~ btrfs filesystem resize 1:max /Red-Vol +Resize device id 1 (/dev/sdb) from 7.28TiB to max +➜ ~ btrfs filesystem show /Red-Vol/ +Label: none uuid: c2d98db0-b903-4cc2-947c-4c4c944da026 + Total devices 2 FS bytes used 2.21TiB + devid 1 size 7.28TiB used 2.21TiB path /dev/sdb + devid 2 size 2.73TiB used 2.21TiB path /dev/sda + +➜ ~ btrfs filesystem resize 2:max /Red-Vol +Resize device id 2 (/dev/sda) from 2.73TiB to max +➜ ~ btrfs filesystem show /Red-Vol/ +Label: none uuid: c2d98db0-b903-4cc2-947c-4c4c944da026 + Total devices 2 FS bytes used 2.21TiB + devid 1 size 7.28TiB used 2.21TiB path /dev/sdb + devid 2 size 7.28TiB used 2.21TiB path /dev/sda +``` +Finally, to see your changes, remount the filesystem: +``` +➜ ~ mount -o remount,rw /Red-Vol +➜ ~ btrfs filesystem show /Red-Vol/ +Label: none uuid: c2d98db0-b903-4cc2-947c-4c4c944da026 + Total devices 2 FS bytes used 2.21TiB + devid 1 size 7.28TiB used 2.21TiB path /dev/sdb + devid 2 size 7.28TiB used 2.21TiB path /dev/sda +``` +Hurrah! + +# Mounting The Bastards +> Do not go there. You know what you did. +{.is-warning} + +The best method to mount your new pool is by (one) of your disk's `UUID` - which is always unique. + +Finding the `UUID` is easy with `blkid`: +```zsh +➜ ~ blkid | grep /dev/sda +/dev/sda: UUID="c2d98db0-b903-4cc2-947c-4c4c944da026" UUID_SUB="19f4df76-f50b-48c2-ad4b-1f71936440cd" BLOCK_SIZE="4096" TYPE="btrfs" +``` +Now, go fish: +``` +➜ ~ cat /etc/fstab +... +... +... +UUID=c2d98db0-b903-4cc2-947c-4c4c944da026 /Red-Vol/ btrfs defaults,compress=zstd:11 0 0 +# ^ This friendo right here from blkid +... +... +... +``` +Or you can go by just the `id`, which is how OpenSUSE did it. I do not know why but I know they know better, you know? +``` +... +... +... +/dev/disk/by-id/ata-TOSHIBA_HDWG480_71Q0A0PDFR0H /Red-Vol/ btrfs defaults,compress=zstd:11 0 0 +... +... +... +``` + +Now, reboot and hope for the best. + +# Keep An Eye On The Bastards +Now, we add the disk(s) we replaced to `smartd`. Edit `/etc/smartd.conf` and add the disk: +```conf +#DEVICESCAN +/dev/disk/by-id/ata-TOSHIBA_HDWG480_71Q0A0PDFR0H -a +/dev/disk/by-id/ata-TOSHIBA_HDWG480_71Q0A0SHFR0H -a +``` +Uncommenting `DEVICESCAN` also works, but we do not trust it. + +# Balance The Bastards & Scrub The Bastards +You're not assuming nothing went wrong, are you? + +Anyway, if you got this far, run `btrfs balance start [mountpoint]`. If that checks out, run `btrfs scrub start [mountpoint]`. Each of these will take many, many hours. + +Enjoy the rest of your day. diff --git a/Solved_Issues.md b/Solved_Issues.md new file mode 100644 index 0000000..ae29a7b --- /dev/null +++ b/Solved_Issues.md @@ -0,0 +1,183 @@ +--- +title: Solved Issues +description: A knowledgebase of all vicious errors I came across, and how I slew them. +published: true +date: 2022-04-30T20:10:42.177Z +tags: wireguard +editor: markdown +dateCreated: 2021-08-25T20:27:57.673Z +--- + +# General Linux Things +Just because you run into errors in a specific distribution (*Gentoo!*) does not mean it is at fault - some things just happen, and you'll just have to accept that. +## Docker doesn't use BtrFS +I'm not sure if this is an error bit or a configuration bit (I *think* it should do it by default), but Docker doesn't always (if at all?) use the BtrFS driver when actually sitting on BtrFS, which is a loss in efficiency and performance (I think). +[The Gentoo wiki's page on Docker](https://wiki.gentoo.org/wiki/Docker#OpenRC) also shows how to set it up to use BtrFS (coincidentally - lucky you!). + +[Docker also has an extensive page on BtrFS](https://docs.docker.com/storage/storagedriver/btrfs-driver/), though it seems a bit systemd-centric. + +This will also be added to the install checklist, once I bother writing one. + +## Gitea denies SSH access despite good key + + +As I've learned the hard way, Gitea has its SSH directory under `data/git` (and under `data/ssh`, which is surprisingly irrelevant here), and any change in permissions of this directory will bork all SSH access. + +If you come across denied SSH access with keys that worked before, or find the following in the log - `Authentication refused: bad ownership or modes for file /data/git/.ssh` (really seems obvious now, does it?), `chmod` the directory to `700`, and the `authorized_keys` file inside it to `600`. + +## Inappropriate ioctl for device when decrypting GnuPGP File +Like all great things Linux, the answer came from a [random blog on the web](https://d.sb/2016/11/gpg-inappropriate-ioctl-for-device-errors). + +Quote: +To solve the problem, you need to enable loopback pinentry mode. +- Add this to `~/.gnupg/gpg.conf`: +`use-agent pinentry-mode loopback` +- Add this to `~/.gnupg/gpg-agent.conf`, creating the file if it doesn't already exist: +`allow-loopback-pinentry` +- Restart the agent with `echo RELOADAGENT | gpg-connect-agent` + +and you should be good to go! + +Confirmed working, and just in case - it seems to be a GUI thing. + +## Snapper can't create root snapshots +Snapper can't create root snapshots + +This on is fully on you, partner. Two things are at fault: + +- Snapper really doesn't like it when the entire `.snapshots` gets wiped under its' feet. + +- Snapper cannot snapshot a volume which has an active swap file on it + +To avoid such errors, you must + +- Use snapper's really vague delete-config command, or wipe the config file from `/etc/conf.d/snapper` and `/etc/snapper/configs/` before wiping snapshots completely + +- Use a separate subvolume for the swapfile, as [Mentioned in the Arch Wiki](https://wiki.archlinux.org/title/btrfs#Swap_file), which I skimmed. + +> Do not skim read the Arch wiki, you waffle! +{.is-danger} + + +# Gentoo +Don't be fooled by the location and prominence of this list - Gentoo is fantastic, and it's always *my* fault. +## No GUI + +Uh oh! did you mess it up that bad already? Try the following: + - Make sure all prerequisites are set as outlined [here](https://wiki.gentoo.org/wiki/LightDM). This is relevant mostly for new installations. + - Read the display manager's log `/var/log/gdm/[log]`. Unless the error is really obvious, this won't help. + - Try running `gdm` manually from the root user. + - What does `/etc/conf.d/display-manager` say? it should be whatever display manager you're trying to use (ex: `DISPLAYMANAGER="gdm"`). If updating it, run `openrc` afterwards. + - Try a lighter, more portable display manager. [LightDM](https://wiki.gentoo.org/wiki/LightDM) is a good candidate. + - If all else fails, try recompiling (or reinstalling) `GDM`, and if that fails - `GNOME` in it's entirety (and bid your afternoon goodbye...) +Step #5 is usually it - whatever it does, it solves for GDM as well. +## Pre-compilation check fails +Did you try to compile a massive package [Without looking here first?](/Compiling_on_RAM) +> To solve this permanantly, you can exclude problematic packages [as described here](https://wiki.gentoo.org/wiki/Portage_TMPDIR_on_tmpfs#Per-package_choices_at_compile_time). + +## Cant' see/mount digital camera +After making sure all prerequisites are met for [USB](https://wiki.gentoo.org/wiki/USB/Guide), [MTP](https://wiki.gentoo.org/wiki/MTP), and following [Arch's methods to troubleshoot](https://wiki.archlinux.org/title/Media_Transfer_Protocol), all of which will be utterly uses, enable the `gphoto2` USE flag [as listed here](https://www.gentoo.org/support/use-flags/) + +Run a quick `emerge --update --newuse --deep --with-bdeps=y --keep-going @world`, a swift `emerge @preserved-rebuild` and a lively `emerge --depclean` if you're feeling extra snazzy and voilà! + +## Icons on GNOME look like they've escaped from hell +Switch to Clang. Why? who knows? not me. But it did it. +> It likely did not do it. +{.is-info} + +## Steam does not start +Yes, I used to think this was a Wayland thing. It is not a Wayland thing. If updating does not solve the error, simply run `steam --reset`, which, um, `steam resets` and solves it. +> Tested on Native overlay - not on Flatpak. We like the native overlay now. +{.is-info} +## `libvirt` can't load AppArmor profile + + +We like AppArmor. We like `libvirt` for KVM virtualization. Unfortunately, they often don't like each other. + +Fortunately, you can disable their interaction on both ends: + +- AppArmor: `aa-complain /usr/sbin/libvirtd` + +- libvirt: set `security_driver = “none”` in `/etc/libvirt/qemu.conf` + +> Keep in mind this is likely a security risk, especially for Windows guests. Though AppArmor devs do refer to `libvirtd` as an "inherently trusted process", which is nice. +{.is-warning} + +Overall, unpleasant. + +## `make` doesn't copy vmlinuz to boot partition after compiling +You forgot to select the kernel with eselect kernel, you twit. + +# Wireguard +## Wireguard does not work +I've tried to outsmart this, and I wish I could say better, but it's really simple: purge the container, reset to the defaults. + +Swallow your pride. VPNs are rough. + +The `docker-compose` on the Git server works great. + +### Cannot access internal containers through Wireguard + +Appearantly, even though you're coming from inside the network via Wireguard, your queries *still* go through the firewall as though you're from outside (all of the above likely blatantly wrong). +To get a container to work, allow its' internal port through the firewall: + +`ufw allow #[/tcp|udp]` +`ufw reload` + +> example: I had to run `ufw allow 3333` to access this wiki! +{.is-info} + +# Seafile +## New Seafile container can't sign SSL certificate +Unfortunately, the Seafile demands its' own certificate and can't get it via the reverse proxy - simply off the main proxy container, switch the seafile to ports 80 and 443 (won't work otherwise!) and let it generate it's inital certificate. You can revert to the reverse proxy just fine after that. + +# Jekyll +## Mixed Content warning behind reverse proxy +There are two actions needed to prevent Jekyll serving assets over http, thus creating this warning and blocking assets on mobile: +1. In the configuration file `_config.yml`, comment out the `baseurl` variable, and put the site's exact address under `url`: +```yml +#baseurl: "" # the subpath of your site, e.g. /blog +url: "https://jekyll.pukeko.xyz" # the base hostname & protocol for your site, e.g. http://example.com +``` +> Make sure there are no trailing slashes! +{.is-warning} +2. When loading assets in your page, avoid using the `{{ site_url }}` variable, and load using the full path instead: +```yml +#![Pukeko](https://{{ site_url }}/assets/pukeko.jpeg) +# ^ WRONG +![Pukeko](https://jekyll.pukeko.xyz/assets/pukeko.jpeg) +# Correct. +``` +> Solved with assistance from this [Reference](https://github.com/jekyll/jekyll/issues/5709) +{.is-info} + +# Nextcloud +## Nextcloud PostgreSQL complains about missing `/var/lib/postgresql/data/pg_stat_tmp/global.tmp` + +Now this one is *wierd*. If you search for it, the file *is* there, but isn't *quite* there: +```sh +ls: cannot access 'global.tmp': No such file or directory +-????????? ? ? ? ? ? global.tmp +``` +Even stranger, online search yields these errors are either hardware failure or failed network shares, none of which are the case here. The file cannot be `chmod`-ed, deleted or otherwise manipulated - even with root privileges. Thankfully, the fix is simple: +1. Shut down the container. +2. Maybe take a snapshot. +3. Delete the `pg_stat_tmp` folder +4. Watch as PostgreSQL complains, creates the file anyway and works. + +# Filebrowser +## Internal filebrowser commands fail to execute + +I tried disabling authentication (as this is behing Authelia), but running any `filebrowser` binary command returns `timeout`: +``` +2021/11/10 17:55:02 timeout +``` +This is because the database [Can't be modified](https://github.com/filebrowser/filebrowser/issues/627) while Filebrowser is running. As it turns out, you can execute offline using `docker-compose`: + +`docker-compose run file-browser config set --auth.method=noauth` + +> This will only work when the container is offline! +{.is-warning} + +> Be sure to clean up the new `run` instances with `docker-compose down` before restarting. +{.is-info} \ No newline at end of file diff --git a/Upgrade_Gitea.md b/Upgrade_Gitea.md new file mode 100644 index 0000000..6fa589c --- /dev/null +++ b/Upgrade_Gitea.md @@ -0,0 +1,58 @@ +--- +title: Upgrading Gitea +description: +published: true +date: 2022-04-30T20:10:44.240Z +tags: git, backup, docker, linux, restore, upgrade +editor: markdown +dateCreated: 2022-01-31T18:03:38.387Z +--- + +Upgrading Gitea can involve migrating the Postgresql settings, which must be done carefully. It consists of two phases - the export, which is done via the Gitea server, and the import - which is done partly through the server and partly through the database. + +# Export +Gitea has a built in `dump` utility - executing the following will dump a `.zip` file into your current directory: + +`docker exec -u git -w /data $(docker ps -qf "name=gitea_server") sh -c '/app/gitea/gitea dump -c /data/gitea/conf/app.ini'` + +This will generate a zipped dump file: +```bash +Takahe:/Red-Vol/Media/Containers/gitea # ll /Red-Vol/Media/Containers/gitea/*.zip +-rw------- 1 shmick 1000 355487720 Jan 31 20:01 /Red-Vol/Media/Containers/gitea/gitea-dump-1643652088.zip +``` + +Now, this zip will consist of the server directories, and a `.sql` dump to restore to the database. + + +# Import + +## Server + +The dump is simply the contents of the `/data` directory, wherever it is mapped. + +Simply move it where it should be and `chown` it to your user: + +`Takahe:/Red-Vol/Media/Containers/gitea # chown -R shmick data/` + +## Database + +Inside the dumped archive you will find an SQL file: + +```bash +Takahe:/Red-Vol/Media/Containers/gitea/postgresql # ll *.sql +-rw------- 1 70 root 775806 Jan 31 20:01 gitea-db.sql +``` + +In order to restore it, you must first bring up the database on the new container after updating the image. Then, move it to the database's mapped directory on the host. + +Then, `exec` into the container: +`docker exec -ti gitea_db /bin/bash` + +Finally, restore using the `psql` command: +`psql -U $USER -d $DATABASE < gitea-db.sql` + +Finally, exit the container, bring the stack down with `docker-compose down` and recreate with `docker-compose up -d`. + + +Enjoy your new blazing fast Gitea! + diff --git a/boot-from-snapshot.md b/boot-from-snapshot.md new file mode 100644 index 0000000..44edfa7 --- /dev/null +++ b/boot-from-snapshot.md @@ -0,0 +1,69 @@ +--- +title: Restoring Root Filesystem from BtrFS Snapshot +description: Undo your grave mistakes quickly and efficiently. Yay! +published: true +date: 2022-04-30T20:10:46.302Z +tags: btrfs, recovery, rootfs +editor: markdown +dateCreated: 2021-10-20T05:15:59.558Z +--- + +If you frigged up *really* bad, you likely cannot read this, which is ironic. + +However, I'll write it down so it hopefully sinks in the ol' noggin. + +# Booting into snapshots +I configured the system to use `snapper`, a tool from OpenSUSE, which takes and manages BtrFS snapshots. Thanks to the `grub-btrfs` plugin, these root filesystem snapshots are accesable from the GRUB2 boot menu. + +First, select whichever snapshot (they are neatly dated) by following the `Gentoo snapshots` option in the boot menu. + +# Making snapshots writable + +By default, snapshots are read only. They should still boot neatly, but lots of things will not work (like NTP and most compiles). + +Take a good look around - do you like this snapshot? is this a nice snapshot? would you like to settle down with this snapshot? + +If so, run: +`btrfs property set -ts / ro false` +when `/` is the path the snapshot is currently mounted at (use `findmnt -nt btrfs` to find out). + +> Once a snapshot is writeable, consider it compromised - booting from it again if you change your mind may not be as smooth! +{.is-warning} + +# Setting snapshot as new root +First, find the snapshot ID by runnnig `findmnt -nt btrfs` - which will give you something like this: + +``` +root@Takahe] ~ (takahe-root) +❯ findmnt -nt btrfs +/ /dev/nvme0n1p2[/.snapshots/232/snapshot] btrfs rw,noatime,compress=zstd:11,ssd,d +``` + +Now, `grep` the path in the square brackets from the output of `btrfs snapshots list /`: +``` +[root@Takahe] ~ (takahe-root) +❯ btrfs subvolume list / | grep .snapshots/232/snapshot +ID 8624 gen 2199024063871 top level 2740 path .snapshots/232/snapshot +``` +Noticed how I removed the leading `/`. + +Now, take the `ID` of the snapshot, and set it as the new default: +``` +[root@Takahe] ~ (takahe-root) +❯ btrfs subvolume set-default 8624 / +``` + +> The BtrFS default is built into the filesystem - it overrides the value on `/etc/fstab`. +{.is-info} + +Finally, update the bootloader to enable the default entry to boot into your snapshot: +`grub-mkconfig -o /boot/grub/grub.cfg` + +This should be it - but you can double check if you're really keen by reading that file and looking for something like this in the kernel parameters: +``` +linux /vmlinuz-5.14.10-gentoo-x86_64 root=UUID=d9699f1e-6825-4b38-9e3a-c228763b07cc ro rootflags=subvol=.snapshots/232/snapshot +``` +See the `rootflags`? that's us, baby. + + +Happy compiling! \ No newline at end of file diff --git a/dsc_0099_2.jpg b/dsc_0099_2.jpg new file mode 100644 index 0000000000000000000000000000000000000000..dd2c32dba083f3cd66b24b7a9b5bbd20d3ec04b9 GIT binary patch literal 1328232 zcmeFa1y~+SmoEC@PJ#t@cXxMp*93QWLXZ%Gy9IZ52oNB6a0~84a7}QB+h4-||2;E% z=FGY0%=65>vzw>sx2so|ty)smtKeb&;VbB=oRq8-2m%5Gf&hL%58n*8CB3XIKpQ_1>fLVce5rOM5aIygy6S&?2CkEti8gM?=A<)0*p8_|O zp}%neKL`{LoR%6^?)D}m>`bgIOza>fS$Sn85^-fU6=gM14OwNS#}o;6b`};81MogL zzdx>8<}OUEOe`!UAT|~@7Csg>J~lQI7G6F!c0M*v5G^R}_3!!vRRLu_VnhIwh5oJ^ z072A`_$SZ^mPZV37bq4E1auRKg^isBD)x7~(191AA2AhxA>w}1KmY|m#{Djf4@?t} z_^X~`0EUVGoh}DpxcJ}Y!T|ZgKVooE2!FzekMwE)y>C1m=o2>xqzB-)@sJ>PfR+g8 zvseHFNgxgu5Gd|XIQ~xKB3VzcAw;;$rVW>Z0=z`z#7C6~}6PydjEoQwcxz2m$~#xNPv5`G^4s$_G;Zs8i!(J`@0b>mz0WaL1qMJ0H_IfON7yrHB71f1*EO zd;kL~0VDv>;{vS&mn8>aR3H`HA0P;15CMR}Z2>{Rf^hzk4h!gwKWJb<*nh$$0A>Zq z)qs3L{#1WBKp%n2dIO}_KGp$T1_pqEE&~oT;Q9ytiTDh_;OCJ5eI9_obsKTX1ig9e zw?rU4;;~#2pq@dGWr1~G5|9({81x?ah4QDmK?CVvUbFz|SwQ|^zIFqc@G*TBz+pf- zxGWN&QpJzu8qk4x^C(MftgOh7byx-HVSsm00Q!3XBLTVpZVL$11ke)!>Bs=XQvh59 zG=>hq9{^kdq<;nqrvxy#zP?Bx&^rK=0yrGNH2?;Ws|o;<1DFrM9|0T(;E(jcSOPFH zfWd9419SrgfWdwB`LS>ou)IS<{!tYWaL-B(3Vw#b6=+~G6-UDBO z3wR{`2j@B*BnC7#DPTESSRNi8Kmve-#sVh@6o6gx1bhPU*8$dtK%QKWxBtnDs1&0p z3CV9_C+wUj?*Ryw=0CJG`Q!Z`RzO)wiUb6bl2wu<`QtT!;?D;g3p+O}2QTRPW2?Bp zt^SJ^ifU>o19|*99(w~G5@HZ6e*flRVPj*hZHYK*oyEX&@8kQNE&c{J zL{|jP_0vPqgJTuABs4L@iL6iJ_zJVlXW?EQ&vnW)bsOzot`)Si z-jU^a7PEXET~kP4XYzge41?cSWzVxY__GDGZT@sZR@9`kCHo7LHfO)}{8ol@+#%a{ zL=U{TO{%sORP^2+cC}FZv$kkN6@gWJ=)=oW2$X5NQBk{j1$zrO8h9LYfdy>V($k#~ zneSHbg61O=ubPI09zgHhlS0qgTiMoMIk%hmH=R38#pJ^dUpNXF>^xkDS*gfVI&smy zr_WDvFbU4ip?zR!Ga(Q%H@P`TUZA8CBoV$ubl21xNEeVGQZ?*mNKT)0vFmbloBX%! zM-w_YQGvw{Y%`k3>IApH?Xmr;kL~BQC2REvVR>JN#o|&&c1NSVFFC;U1L0b7XH#JB zL}QFJO6}(s*Vpg7N7rW5{3RZlSi3mc{vR}1-|ismf4DhDCkhnN?vJfwWMg=rFl-xI9}JIpL_?cbPE2-UvIBe|fiNgqW~%4C=JrJxPr6Rm~{z3kny5VGB$ zM$3(wbh2y$`0wPm@r(aSHmSt-JVOmv$x%zM->k-ELUqncqp?*6R&ij+FZUr7rftW> zY^N0>^exL{aFhpjv0+KK0{o9(4Ge0EOal1N_ly6y=M1g+>weB3O^ll?ohGAlQD;tU z1T1!XufrUxWcY$~k&5(9M4lzJzy2)EZ0wDM6^Z z+6|fV{Qor~Q!B`jDul>k>edK4}oN{3PA7W*CRPmFW-5<4m z|H{1y@SikV({=abBmW0lVM>bb%Ih!z{$sEddFF!oU$FMlu2EOBOy_xrSNK`;tOCCH zr>uYQU-a-4;Qwn`HMK>m|#0Qm>_f0-P)6a?l!Wapd++HsL?>H9zUA04y( zTcewSO#hAk`tO(E@ymvQtqE8;1J;G3SR&%ABpF)f+nf5=&VGXQm;!qNqCZYmpAfv2 zG5*6^{i7k^wyJB0DoKc{N&F)b0DqMRR{o%Xpa9?iOc;0$7_HUPn+ovK6yW73Aj>J* z#|L0u;$yy*E&W_FUPq?4@dYI#;@;n(i{ATlh%-|6$}YM@k4UE$uRGkO@ZJpFOg8`i z4HK5(D@%U$0IFN!34Z zp5oYfFnRa6>@z~A1O`4HtCLw!{GL--)D-HM6Hx)@osH{ANAso_pPdCSdWOW9EQ^Rn z$}KW=Us2&%6PSb7^XBy8tMOOOZg<*rX&91IDgr&tNI2()`qT|I)sImDQWfAgp>Et8R~V zUoi+uM;k)2`}5Vs%a&KT;#h9wzF$x)PjFa?;d>xJF)Oobk(O(iDu67@zoPpk%SLE~ zuYc=u2&P9}{=bmrpV2ye8od%XqrrMyK;w!1;Q`_Td)aJ}zy4)17J zyIAqsKivnCho<`}VP$nQJjSQ9W`qw>3Pne|cm;I;{}>B3Cd(HCJwSa)8BrSu+ZZq=13?355RefzEeuc-*@r-K__kjmp? zBj&O#TuAD^-$f7Rq~Wk(Yz-%Zro{349-7Z^-8!BNw`uC;NWNVARLXkC8|GPjM5Orb z5~{vjJ*E^!VwL#^x{9QAQq7(#R4OS7^1>GP>Y3nCv?6(Sj!tx1&wiLm{3NeDgu2T) z`a7P6XiX9CW_x~G=ug=P^51iyQO2m=n=!N9Iw~wHWOkt}7Bn1u)avF=Q^Uucq=a{9 zGi7wWeDWaBYaEHbX4Su0FuYAdus{RhkjkOgUmh#6=|Odw_e~k2Ceo}p5GsB^2Bs?d zO9l6CaEij2vs9m^Q`@yiwj(g`Q?!J>!$@q-%lFm`yj@4 zs?fsnqD)=4EB&@&*=f6m^f}nZ2bK_?iV#LTJ71!kS>@cnVOZ!=^2s5&n5v5(6;%ey ze-Ujkl}xo`=x_NynMVDGE&s!p19bVL{0A-s1%HSgg4#b1RkT>*q1f@M9={EvW(2i-#RoEWJ5R! zKCK*z+MlSvVF!SH*#nJ8^Vtu8E&sQ^tP!E&Hz~Jzu8E@3s^&pvIm9bzug#CUqZ+Er zu+#Miqx%hF>}RHYv*FGGmm}~UE+4*e{=i1ouh4srw$LD^{Vpz?*@*dd+_>Vu_GPL9 z|7H81c}K`uIwxk85@Y(_NNC!??k0BOFepu_Gm=K9x>mPsS~IL7{NP4ug+VFiEyKn_ z{;CZ1SH29QJFnJAdJo{su5<@r!vemX2%!HFHD->#c)*^>{_^EABBng7yQ~2DPXTqW zs1ix^q>ljlACUhq^K}2pmx~`YR{E{~g8}*f&+-4Cwp{w@zsLW7-Tr^ge?RBH=0D)e zQTfudC;ofB+@ISIO8H;SWq$MjKbp(@wJ+nU5lxB$`0`+1?g;SZ_<#9wU|;?ZU(N`P zWU-9|?8`$k2?X>Rk%a!)my3VT3}If^)2}SjP6%ma1to_3^3j)z$8rbsKk2{F|H#h& zxAgySUmoE9FJJy|{{L6<|9{v1|MunoYwiF4Pxw#wZ{&ZF<0uod?;Gi*uRAXXSpVSz z`VTDsuJ}7nsw`2ekOSj-BZ|M)GGGaiRF{9RWncwH=>A&EPz2_3pdP}s2D>DiKF3}JHzwmMCq|YZtsYm#;K&eXc1NohMBl)4vtDW!S$zmvi)|lw(SI5BPuS5UAaR za4c_@)lgQQtN*qC*HHh<|HHdc{_X#j)7W=tYF3X)cDw}Uax)6);-9if34hJyfBy3S zkqCbKfB#MSpT87YW^#ebbNf&G|4aWjSbm;7c!PQx;|j9enXX$J{b6ohij^+H^E`^& zcqG1#{DLIk`-qjn{${^;X@+j$i}25IO~C%W>ydy_UFiZf!Cp@OX)O!h@o_CnU*(Uv z{A;l+F#mCXuVuAA*P;8pmR0!2TGlf~<6m?6%|GVy($<^zz+8Sz7a6>kqj=(;_h6Q< zI1jmN`OfC>$sn&Zl9?Z~lP8_YKjpu(v>L?JO1Xna zy8&xC`V7y$amtMiW#jEEQYc3XFPr}M|1JMt`Tvk4B0ZV28e;xW!D~69Z5#M-AOBtc z8%_{O_rJ3jd@06V!NTw@$$f<@I}DCvG_(^$aiQLQ-W~6zmB8$)ssD|$HD!+Gp*Iav z$L3_3=|AxQ{a~U|9@sJ?{EA6$6D_H*Zu#$`QJJB zKY9N5H~;_UKY0HCpI!g`+y4J;|9^eU{V!bq|8F|~`-}D8zx}`eitj)F-TALNLAt0t z>v($fo|XKTi}sQh_?G`eI{PCf0omgD&<9}spD);792Ew##ZUF%FTdsg-(LU4`1LKn z^tSkq`Tyg${Qvd(@89P|;Vb)47T?&t1P`|oY~N9SD{K7vZOQ2^1f=Je?WCHvT z0)|d60qR2Fl+J7GYRM+&$Yx2Owmn;x zO4VM=PirxL_Q}B0`{I`I$JvMW{`QBnh~*ZAWT$hDQm!{LE2)iq+(Aal;pRZE4daNQ#g|5&U7aCbJ`m5-Y2te9x2~B9 zIp2LJX)6Ayrua=s!$p6=czMg zI@$hS;qKna3i>^7vd~r_1GGb)ve|bXawJ47zYU{I+kP@mqh~JLmocpFRt3T6^0^QmdJBh^OQEI~y!rE{2!n6n?CNc`rP-YT{8yQ4{O;d@V|0_+*%wW%yu9 zEqwRt6H!S~;%l}%U*rk0`caU-WZ=@pvU&HsgJ+1dSt}ABN@8__u)7nx|Fa7t5X-4P zoY5z1u17QeWIK&A?Co+y0>@#OJ=@a|?EuIXw5&Hh`U=V3?%`hk**ax2spoe5rt9rT zuS{~dshuWAjmM^4=>>|cC9gw&IKun%?ofR!KhaS7rl|I_xQXQZowJbHTI;?Ct|r|) z@xvwJ+10a=C2?q?IK$VVIk?!m15t8cwftAN9(kUWh znW{#gg3^&^c^l+D2!FxZOeQNgLcUP+dLH5=^^! zYs-!qog0PDVtMhEtgZIGApfSKaUp3J=Zo+Mxdz@@?J3w%zfntV+TD{_w!1q5W_Yjc<_+w3rHoKP-KrH(M5X+vqi>`PNeE*x; zC@OuT6U!_C=yJCp4B-18F7h)g z=a+d&E4V)&20R-lthm+*9O|xn3-V;Hog$TuTRQH1F#RxY?T2%pT~=*<_)a);Mu0;YKL={xneq85Hok5BXIFNK*6g3}$s3NttoNf_mxUD-kWq z&})t1mH-Og3nr3~kA09y5g|=Cd(b@34IJtg<=owPir= z34X=noYm#~^efp=URD{I8B5-t*7f)tjlhWtA1SBu8?`IO1=!07-q8gC z0r|&P5J({I81mO{D>Yso06p#s`@JjXal;6BGYGI9^w$CGo_pLW3*PC1_qelG2Eh1# z!ZeTg*QOK5-@D!RfnAc2kNAZ2U+$&_XZ`S3JAs!#;y`Wx&yEKmlmD|EfVUqyL1^$G z8BhQe1Q`et4FU=c;^7krAKWp(Q*ix%AFx0N!azYH0uO1P0(}MSc!UP;o&+O+78(Ku z77ZN(69k7vN=E*Sf{mR6pu~d!KmT(!U`h}y9Po?|4M>NCfPw-xz(M^g2-up7h7L_i z2Et&)Bxe(ap%7E0WH&Z>SOg&h1dwP@Xdq$GRcnjw%T;-SdQb0f!tZNcA3!kLm2ML6 z7kdfaBA)iR;B@9=9W}Z)mjh3hUHGLrUb%elcTyM3vgzKs1%)p2S5ioPWD48%GW7P5^N|Ab|m{6%ru z1G>WJC^4k2wEJ|lFGDk?G-$OM4Vu!+^HL&q!*5av5qece)2hQD&9be{-G(N_hW*_8 z4YieH)O(8h^j@kjCfH>4)6EWUBoGB`4bHcB_**hYd~E15vYns!p6cFaKdsXdAsC}i zthvmLV=%repS0`O;sZA%vcajfjLGt0%7OM2dw|5Hd?Cid$KlC`Hb$=$h91TO$B?`n zKXLMj5owkg26|{!`su_%ystYb&$lZ%l|Jf8W>ayv&b>QL8QhW~T}p|twM&AZ*!-b* zts9)voU5`o_+r9{bG}w@3xnB-eeHbb(nLpym1x2(sbV5Izj9Qk5L@2JQKS;u_R7C00 z2y!S3`VD6}g_{ZU3{tnL2NUu{FH?R9O(*L&w@FG0$Ez2#s!9LJ4DI}Sd{h`tZ|69A zt7-5?P~Lk$A*IJ|O#rqJr1ngThCyY2OWoY&ZrcBIfS&>u17vYF>FgC8E6oW$ZwY!l zqPIX5K~tlL8!at{JC}NEuIRMOn+TE_c&MN6HMWvf*o8Uc1bsioNisJGt;MWIjgR}G~&6B`@UlQ03G7V znm&_T@Yek)e0_gUj38E9nCDZTCqsX-lvl-7Tmzm`Ao)@SW>;HVfuJyL zN;pG%j4Wd8()T(0(w$!!pD9`vcUmOBWyj59R`y~GBix2h4$HgoN8xagiPvjm7Y*q9wppz8 z01`Q8IQg=zvr1_Dl8BrA{b-d4CKpHZ&FJiW;nut<>6GW3D@wC?GXK$B}@Bu_u_07HI<1n;=LxA_q83;y)R&ONH z#t^TMF=Ay!k-g>)p@lqTQ&8&XZAy&VOLwVb7|M^Eu8a4Q=o+(1i#u*RRKw*SN|bV} zy=O^BKOR6nxJ_&OF1|~HSG&dGgEIy8aRe#yW>yl*S6A;aU#UnU3cj+dd~pszOL`U{Ax9&EfoE#ARNj=w89`M>BW2cNqzl; zR}g!LD&aMuy#D%Yj>?(&-JV^FuEnqbTlkGMeq1`QRp$Tr@v6=gnsJW#7P)%Y=m_dK zr6YwqeD9*qdrr%x@g`UE4qpUUU{+&hldImgIQ0`w5~H_xEL^GBg@_h;YDiac@zhDy zhivs2OCnlxP8X50@eMT}V_`Lgg)Iy1St+CRv^BpYRV*BwXiMzK znR?H9KVbg{H;)~OcD$x=KPG&0<)cAuAoQXe5-xOm`IM^Jf0JPLEAQow8eVq#6D!>x z*-bee#D1caYc4uNRIpzbplsqBvnp+pM8Y{!GU4q7Sz+nNUsT`iNI!s*RyM6u+uAXj1)^h=#)_GU%t-FVnNac*VoWy` zl^UzuNt4{x&cjlSSHC+eSaewuxEs2xvN?aRF@y`1Bc83)R6W>caoCHT&?Ya`uAjPG z8rl$-Uym7YCWHLq$$~x`tCBEo>&e`EQ1+ZOq7VNFl4|b*2aV)=>>l(Si#1C;qZQoA zl%dZIY&{gkD6ggawoZACI7cH&WhN#R5b>?E94!Z3F(NDH-y`^DEk^b2{uG>H{~{lP zk~M;H_nNy32Omp_c^rmoR(;~wLOQOLE`w;A#7+_?$gQlQYMb;qMQFD4hTNB91m$qo zCE=)HO{4CXgI7rlQS!=pd3D+A%R^MA=q86;owAg%J{0}yXpS9|abzZ#9AI-qb;;nGZ+3U_}=Zde858Ji(Wle zOO+j=Ku*z!ZP#2Km8D#PnpZcPZoAH60jt_c9NW~3)|7qJH}z+ixyq_P!}t5?GYnQ% zJ!9hoIC!xq7d2Xs`j)RxkekLK=*n!b^Ml2PK5{9w31(9}>JORyNMWyx&5xIm{Kz{e z+)hp5mk1Jk))1p#vFw03Vk4O|+WRhhzslb{bIewAgNVB`@H=}Ez4u;uuA)xo5RMW}yeC{#9;2)D0LvQ9=jaPS5{+ym7HeGy!!DOo&mPVV3z>(`&ZTO%p zJCvWX_WR^Evd_e`$tNvNZp73kLcQ1OFz!rp-u*!d)->9b>Pjn#Jy7djjZsAvu5>R{ z?_0i9Iple5iWnR>vs&JKJW|;U7C&Zz?s1k~8IJ?K5FvUEOM%;(BLqFPoA##e1E1BC zvh_JU)2KS3Pv(TsLgsW*cltgIWn=Oayb7xpv~NvTK({Gq#NsosZ-$W!Uh87G7Gu#~ zo(yr7qyqeetAZ-R(aw6r6Jy9|E_E;|AW>Y^Yxv!*8?a`)nM-O-t|~!YHq{y zGTvPh6TgHg0Lxxoo~~7h4Q}!p){SEV&vmykN_c*S;^>lB^^AEVy&{#iJPFN>ru!ly zxGG6ss6~QNf$!N~L23yVWzm|=q^7`0|0T@2@7~@~yJ2UK)mhamk?8ayZQgzELZ(_N####kvWT1QktxnB1826Y9a_&QZ1VGz}$Y7 zLnOLHO(d3xu!rCCW9#`EqFskAf~45KW?bTV#Lt1z#Nv$t9k*}3Lv|x})wrNv*4Nvf?7IL(Q{1Yi(k!#>M%W@v%x=y7DM4pS%D?(x2Ur2_FaPPTBy7qXz6bUZaJ&76-<^-N)K%FaOIpqF?AIw5vu@Fp3Wpv$DT6aJS8l8 z0M)r%V3C~mqrB9TX*?F-;PNMm2*aUumM9* zJL5#$yvtS>PX5kYo{VFej38U}oSgiW7Yi7lxb`B%k@~4{Zf)SmGcNCr517^=bmXGj zj4}ldO&q#h@(p!*fXrklb-5Mgs{CAF)ApYCf}C4vXc2x&H4wLE z(Ks7-x3+a(w_I35m3MC5pH@j*Xs)ik{d7C+hP(V2^D;G>Kc4CQM$he3KDqZ*hNm#y zY`!#kU;ErKu1;WCszKKJ^vS^fa}V4ytRJ|%(_KSu$3>}ZZgCB3%cemb&{wuW?VGI{ zR@$0NVbAxgq^XO?QVxz7_NJ?A(fyveZN=mIJb;h|;`HOQ7-L`S+l6$LD>S zGiy%OJLhpaG}kc9h_W;_Sb0CQIosfDEN?z6777N_?Lwklw-%`$ng-BClz;tvM^x^; zy!(Mh;*LY<1I^Zm%6FJtBG#czO(Lt9xo!`sua|C351@{b4<*|^WEllUdN~S3G;|F# z&Sr~-(v7348dr9TY3aKy(d;paBSVMYCHUAcIqQt{XQKkhT7OnC^3U#0A4&?~bY(3l z(d@0uFHbjd;g!yKY$K{DuKM(`qn*?Z>c0)n{oF(+Vd{(Ijq} z1mg>Fm8y+QiSC_g$-RzqAW>==-NL1F9Iv1jMQIyHGDpRGR@VZ5Ql>)RlVNOvMr11= zp?+JdQpb%6KmM%94F}&)EADk0)!P)C;aJuXJ6*C5@3#Ey$FV*sGp^^l_bDns2wt;V zSbBc(CQX_jPiYeAfX#V%QAzhsFQ>Xc^DOR8*vNm7jPJuTUqu`&iKk%(r?~A zO0=%w_3W1xbm=z|rig}CJv1Auve=j9jJj;pX3<*y5;t^30J(2r5o`JVWp}Fq&C6Bs zZ_CY$0iO>lp)~a;;MVC3m`Qv-jpD0e39AN8n6$0gOmJan%tT%mQ`gQaAd2WST%0dv zPHmAmBR+u2n!bDt9Eyxg^|2{~yp>x-Nmx|Iw)vr7i>+6H2h^CKl3~Fx{TCq zvd%MtR(kaB2CsWR;eKv>K~;Gm-ac)oCi~n#k7tE(3#E++J*c)1o)0y^WlS*A&{mV| zBf4lUUQVv!Icn)wtI3`-2BW~2zyjY3=4?6MjmaIAR4jGDTkqFzg)6Jo3w1^Xrb$O~ z-DdcMbT$ell49|`PQKRD(kymI~Rv~3_e@xWTyEK`20XfJ6cufl!-nW!h55i=`B~@X;tS%4nAvA1jzYs5-^=5C%BQ)!<@$yM%CyR^6s>tb1(wZN z>&TzZM&OECgl64bUv*d}Om91TxyhOb-9ZjzGESXnqYZbs7?)L7>Y}3#iWXJc6rYOh z-SyX3qpAXz#rW({IIZuMRM+}7+ZXnv^m zlqt;j>D5H}v`(`XHfrRUuRAML?vs@qy`ww)Je@z`YsLKOgW*MS2Woa!;9vNz$6qzS;Ffu{vh%xVn@Wfs~^;|Bkz2UWhq7OOTKL6C8 zR_>zOJ|UpQ&2iku@O@63$a5{m7deb?YPI%l;=z?b>oLDvT9($UwQYF;r{hLRatB3i zMToomkIHc$@5L%Ax91I|lEf-|bP*u<@jfAGUiRHblx#&IiNhRf)sQtylXJf1F9=8f z#;BDb*z=(anUrB_qG$A0(fgGVzp`%W{<)oG$vXR0EqRip+X-rfckf+k=qZKWo-dM7 z`UB{!GdhYZ76HDNo;kfAVg*&kNu;<0+C|)QK8cGp5ut#E0IBe;4Y^F; zH$8d+kXy{2+xmPQ6N^@KnU}l4rU*rzZemt?HA`lxEv2XqA^PqCR84c#vuo6jc?X>+ zAQRiQ_i{;DM7ek(qm`L^8gLEu$^}h*|nv$$4oI`JlYWX|EV+9zngI zdsw8hVRrGED_WsH6(s&^J9)jZ2hi@(SxL+lgMOc%swUQ(%tQ`YY|1WC)2ntP4X#!> zU|p9Qe?KOrrDalSiORN~Z;miK^yrB+hOC4@@4%5Ea-dHzzr!m_8){+``l7PWAsd>g zrlqqbr$pVSwjqnpL&u5l(}ayL);fBwdQI|BUILLE|tz)$?;;KcAlsx6)<11w7t1;RT zL`?)!t}3N`^Z|uj-W+O4!_hMS^A3Y<0)?M}(zNrB=0d}5RQ}a-((Trft?k;UKd6(i zrH*z7I`NQ;6~u_H+13j1^7Xdd23Lqp8>&sDH4nN^$B#sOW0%v`(%7Z-)-mhMMd5vH zmO{oPrA$JzloHIiuAC; zrZ=r&#Tg%NUfXn>ZOQi~Og5$T7gs8sa%NI@2gYDf-o-}$v%uGxyK z`$_e=`i7uGq~YbNvJ{vb&z;@Zu#J-MohoH-mxss3!ljL zv!MVMW*ZH%Mw@oda#7bSJiaZxTFQR)2A5+hmt2c{Ox$X}Z&fbTY6{Eh??!Yg9R`D= z1a7kvPU_57HU`#uFUZnfyTgXvisBkt%WV`wFYVNal2MfZw3OE`KDteuI{BHl@3GJ! zxq1KgM7Asnf0|}wim67IW?EK2&rs=myIGK%NE#%xar(ZIMa=iTPwRInna}-W-^-_E zQmRAg!MrW=csq8fC}QKGbj*qKt)#tdL*G-Loy$+Tt2eekMu`0x9s`j!K^6BWnZo6J zhwR~+<9VURBbN%zLo*&>4863w!%=TPVPas-?vB{QWdHM1<&l_F(SwMR^m!SAjB}Y8 zPR!6SLVT?sRSI%iq3DBER-v!cwLcZ^Vm6%Kpp7z{>}54Z*444Q@SX}$eu$NqLbSOY z+8)+YrY+H$oNeMv7pDGR7L#B4jX3ejdOi98+aHO&{s9zrcc9OH5n+=eU&uiM>9IO? zt*O{iX&a*~5EZg&a%s>v`7N?Wt=N?u*`_f4-)Ke-$yxHc>v*G2~&SHyflGNMWjU4tI2@N zrt>(z+P@GNfuiD>xl*r@R2-*kJNj(<021=!I?&YcN>M&XZ}sV*+N_+^?AeT1Od7@@ zYq9Wsma$$s!Dv$#vSHR%vy3F4O2^^`eg5(00mR(7nH_fYedi_Z?CMZ)@(OgttM!;l z(M>!fG3fC(Y#A;|KXDvOBX6@4al?0O&7EExJbh_KMIrXG>-o+d)#_P;N49M=^1G4d z=ah`4E_l)nfGP36s@Vrt2aTSzO9;R`fYw>NTV*3%L?}WksP$drKEuHD#2k~ zsO4?C<@&9q;=BGCi(ww8!?H2tIrtgW@A9~wf;UBpvzb04@8oxm#1lve1j4g4m-Gq~ z{rqP~;rGAfD<>Tu9lEZ-=GCvu&7Gv-rlmxNTa3uQh=wqQTgdT#gP)q7n!i`hOqgB& z#8ZBNXNOu-{31}9K3(9%=_(z8ZRU%_u-^DSuT46^Y;%-#wKm_IrCeZ$kVk5(M>}`% zDx~{1%c6glbXjPaar7U0YK}KS2CP=2usmP+}ByMhHE#u>2uI{6xVd`UR%4M;l4PLS-es-B*nOrGpajxLtWth~Iu%q(ooY;24G1*5CCgPXAz zqk}8?A2~>vyPCRKJGogqI*@>KG&XT`cM~K7%Ku$4d#8V7`h42%a%nojp@U zH!5yHmC&M8WQ1s?Zh^jZq1EmU7DM#9RZhy$Rt;a9W}0e(g-umk;ZThx@+uCocB&pU zE}anR{^5~S`o~0niFnAbjpdm*wPrJ^snew^QYtaAW7Nf^7!<@qU6e#gr_%IGh9xkY zvoc%b>u^m}>v8pXTsZ7$B!=$Yj0n2Hs$wgXS^d0tXk~9-bYRf*MU_Y$T(^2*sv<&m z1_kQXQ$d)kV0|PAJkln~%M!23n?*yM)C;< z<+`}Xk|y2$h}@Oa8k9LrO9{C$bHP2881#Eyl5(#jd!k@>%GFoN3kUQe)0#o-9+QbC zOO#l^>fq0oj6`bGr)BUHJ6c@`BJaASXcWS0PeC!N*R?@4;~DjtRO@AxkwHw|37BMd zn1?hyLrj*t1Po)VG&r%N1oOhQM75s8HL^`<#rdBIYT#v|-|~)?J%A=_)KG(2D43@Q z#cAg;u{v={g;?IRd7%`aE7ErmxfVrhs|h$IyiM?Ke9NgxQ^^T@IERHY$Xs~G+NU8j z6tLH~*J>{~6}QODlNVn`r^$KPfM-_-qTfbhn_GEJE6mGOJjEAR-oi*|(ef<`ifv2N zX^A%D+_F5@odh8xR=U%?cQ-K#v7h~g>V&?{G`dDoe6oE{SvZ(=9rpFCc=(4IfG0lo6JO5D!gv>cttI8?Do45W;)An1f)j%`fmHo!z<5MAYs zJ#-Mg@*b{CBw(EI#BuTg)L0H@u%oqpyi7^Ac8=`O?GBMXO%`+3^csR%J)3xL%)ju| zL0zXFWzbyha@JS`QF8#=Sd>T8pqvJ7ibB8Va#`#3jHekUe2HpTGCnA-dS9!HX+i5C zzC6D9(!ih4nfwLSM;Boy`$UJ;$ZZdDYl^`cT_uTO8>7%AYv~zMc=*`f0J+N{u0!SE zlrlI|H8qMiKU}+E?%JD=b62A#F9~!=$}E|}M?4m`D_V+BUG~caIYq)1QBZw_U0U*v z0%guG&$47y-s!71B9_M@k0RQBDNCk2V)G!H{6f5)VW5CHD-mpNkgEyrfv!nfK@i8j zo{siwiDR&;uyODdugbN$1(jtt~z|hoJ=y$C9~Lxn|tSJgTC_ zB#nk360DDj@!K4M)A9b}Z$bkkISPqPV*A=RTDl+&9>iSi1rf^}9=HvSG!P{P z(sLHUm82=zbo%YLQ%;n)95~vI;$P3(LM-jwGO1=h##eJvGi|HzzR*B_0Ns6aS*dXc z(WST$@<)ZVA)<5n`kX+>|Xt8p&TBUz0c%C|U(3&v5VclyBowcxGcan6#aii)D4 zC`CP9u6Hmejwy?-XcwJiG3t^y!wkBTs7f+jz?F^t2Sp{Qqa_QKf&(^$t1z-zGdc1w zXwVqa#z)WD3Q;srvPkpET3<+uheDtRRd@}V`OnCRR?1YWaYb1%2)-&dRvY z?v=VprJV25zPrgOL)TimBfS2q+~}|Wu z3J~&{ag(s2`P3XZUUV!tHB-*VhpIQ?i6kGWdXOWR5jLry)sl0j+n{jHOv84nbm=e+ zOFIb<8_T*5(PM+q8T~b2D-*Wju^DQ5!<)xV6ak>2!;yBvco~BF;}Z7 z@U&j;LN`+gF-@(_=|qMiBWc2okIIupi2qz8*3(?0Wuh5`_@c&h0SH4GFemL!$fPOC zC8IKwxL{HN^)d!)VJ$-i-m_J7CWCx!HyOpqH`4T>0;aI8}nE?8cKles&Uz zo5Tq!=zi_sf@YI}{PqTJ-s@9G9rI3XV{e;O!)GJ;9Y&CFJ#iZ}ZMX>Kc{qp? z=&C9ZR$^(97h(*w*sC%JaJY%gt?JYHlKb2YC8=*jEML98dLat6g*L+U{ssRa>y}nJ z`d1pnfie(3M)FvhcvN_j<|TtPQ<1*XyB?y`9vc{)`cc-#y0xkxnAEHQSi86rDKegp z^ZG6>+ST>VPQR8?x&qdOw|*I}KhEd$$95@`GfT?KlT^RZlyqS{l&avtYRTCG_T+61S@RrqprI0Pr-THj&6AX@uZUd&Fn}=&L z0y`-Y@NeLHgMS*Pyijb=D$RI}MtL)j&w+5))1z0KZL@PHogmISFs5>$4!VYcQFhfD zyBw5sG)}^CMDF?Q*F3&{jAjGBn5fyR(Px+&zy4ND6M{tO)7J;k*Xo$$Z9mpEqoua` zRl6B@62;>9Ua6r@Se0CgCq;-}157oy-knBbTj6H1Hf3BD;*hdqZ${;xWjnXw%4$J) znsE1*s}w_^7OB0^8!%Wq{sHVCxOUea86GBk041#LC8U&;@7*Cqb!!%KSUS}+!RxV1 zza8nWff)%{ND7&@GLtNP*EVBZ=ORe|9=2*K##uy zu3Qoe4~eT&VNxVWz|9iv^0cfo!_ED#;YV~N3Ly|kc>VtXmeh~Yxk<@WKW1s7)beXY zPy?%XEVO1sAS(9RRDjN)kV_D~V`7d!kX=}vYk-WjAhM$dRXabBN;Yxj*boRD&q?UK zn3Xl{sA(df*&t{axUK10e@%xIVh}3=LM9Q9N}+v`TBwOKAj;_d)&)We(VZPoAZK3U zvmC07h9L8`2;quC*{FT_`{H-G4asAdJ z(&2=HTpX_W(_((^)#)7OHxY8UvS0GrU_MHs6jMhu1l3-Nf~^Pm=hi9 z(8|#Y#JLPYfTz0c=o>@aE?dDy032%ULZ);MD_185j;?9G36|<~L6X?WX8!;K`zIlO zZzE8`+9Swph#8d?9_*#aR@k+$+f9n0iBd)vRZ)drlhSTlCpI7vj(9h@vnU-ipm#W5 zM@L;9NU3PL%nL83uJns;8g8nko}R?whqg5(m0-^5d(vsqRC)p3 z!Ba4$dwtYxfO5M}Vm1IMV$T%`?IB{20kOhw3}v-#N&x}yZ|9zM%k>VQS|wCWkWt(% zHqrEQGNGJjGb$S(uKujv06YgXrL$a56xCE=Rd!J3Knbjsn6i?yZ*OIGB}mCpGEz8D zyW%a}4k@#$wprQatU)mf+66$(m1Z8UHPxXa?BOOCR6!v&{kBr*8f0pStaZ#vmqq^0 z8ADs6xG_;d1bgxUNcb$<#~MXQiP-+USqv{fzk2I#ka2x@QerN)}vf2X4ybDPh`YV5hPbgP_lrD}~4*kL&*c zk1al2jSuT?(h2BS8HCQyr)tkl{3~DxHcb$x+HOHchYuyIl!8e2&9)5C9#|Z@AYowa(NSZ zgGZ2&UtFbAF2ql8EW%H@Cx7&trsxv^*#!`z58 z<|+vj?knL-;$=T#xKK9NhW0zkKMA9P0SzDsJb*#r^Obzs+gWX@d_c*_AUosp?PuGx z(GR!q+#*ztJ0b<7iS$0~9hK%lGb!xBiy&ghP*{(ToG!I4Pno=)lAvlZ(QJrjph!*1 z-~g(~S0mqIyEekBahsD1rygC~DcW^ORl9N}h{8H#C`V?c0=C4k0fwwhvGtpE3-VF< z5^1s^H2q3lfLda1#by|-T??wYEwD{V$Qc{2OQIlVB>w>XZ!fqF_Z++5R_O0%DMm5? z@czw*#~-!zI3?ebk|Zc#RRdXuXyB`&vaW@kA#@vp*ekM?nu23#C3RK@dpm?hSrST> z?5P@OMhlIchGDOVIr!7UEm`sQN-d0lT7IWJ&`vz7jT|urlNl=EOZj$X!KBdpGi^cN z1&A?lRYb&>RAG=ET(EB9um`q)98c+2Qzwo{Ht~VM<)N(zi4w>cAKWd+(cAa)ryF*Q z8W0>#Xv(={rG$s{6!{DYK(lgo1d=c@^LeYQhLZ`n)E&Vnn!dth(*>0>xTkC|IM|V{ z8}UI|ikU$w;U32)cUhN4sZv%y`zEzV7%MyshxkQPMJ}e5Qc0(Gxat9AQBZS)W82)O zy}B=M&WaU5U%@dbf>SKm1VH`C@!aY046a6a2oU@Ew{@k~!rje}Z)b49m$(|GNJ=!Y za+B1~j-qIxmGxo*AEeCFU6iwTDTy%Arf`jxQpB0D-fV?Q49-l#lqi#$oS>&^s#%vG z&bn#pQgtpEsKcrS2VvwcPsTJ!_ND-0t~2<+iAx{P5;KMFi%| z{tuGLu1PaM#X%&Q)EyKR$pK1*Din?6&c#gahF233L)qNmQAVHu$N(pA48=;Ec*|!y zj_iR(rjt`3f^Jr9PACl9wQeFbjd*_Di zbrgO3ta4;(gL<;}%z#i?4h3Z4wK)M86$rwPpevMO6jkoGKBLtx%8+o%)MpYTqB~Tx zD##P(4yj3! z+{RU>&;)=6)+80k_f|e}s7s{%PPa*^N`A!~B#;kcL%COPS`&{|m<(jVmB=h)j*a#8 z<59&Wl_9iNMN+%26qO^^il|(>51vK4OF z?Z^<$*$Nw=f>?T;~7c>fg@)ZLkZ@Y-7I;1b%Fi%PC zj@KhRFdsS-5kOzZY%WJ4XG7iD9b(WQBg|?kg^TqEsa(=1yxyH)Q$XPpON*t zWU0udM3#F|(4kOJ6=n@E6pcYD#~P9x7ykSSyRCF8@Z@SCZ&vr&9z=^4P$tLsW7sxu zLH__>+WF!KL*;U4#%R`CF~R_5DMVtGn-Dg9WnB|c+pmli$>?ZqVbTeh;D8Hd1eN~) zLx-%Iw8%XsEZg4xIs5tcX8ONGUa8KMn;oFx-ioD(EWto$5^n$~D%*^Ilv4f;j^O3xK|=a)5!piS*}!t>~byd>c}kZr^D`L`{we#S17O z(;2P-058e&kHd^)X4USwPa5tdr*f*;EK8PB8Ndj^NM!C6$IQL|0I35b8e~j__!%E5 zBNr$S2ez~}n==@7PA%Xp3niE5pSGYLPu0559-%nlm?_ku_0nqiARNen5Ru>Sz= zHhwR}>D^W|R5ErkbrY@?QPij|#RC#F-9un8!nQ*B(ti-*D0W3GTeNB$W~s3M0L+mH zZrqrYhE^k4(aCiu;I!g#mTyOp*=o%dTcbO^s>XR)C}bxN&4N_EpZLMRtGS(0M1)Zc zt}grWeBkY%(FW0Uv&iF)PwJ93Chawre~03DLJqY52#BiG6W?kbS`Kh}D?H~GJ+vwqBUNe%pSA+aeUVNu z0b~TX`)sLYZbbA>a9!=r9o{Nda{jEHg}}E zS5Vw-d&*P+CGxYHfA`AFOxBwf3gycM!o*`7ku&1xW!k~z++OPXJtA9T$UoAAWoi1k zRrYSnx{^@?1*;H%<(bralDw5uGBQ&017KVNpy*gli>ik9M&D&%8G{gg#-RzLB^IGU z@l^&{p1}GQX8nT-DDJ^k5H8G1Wq5+dlXAd^a2bby000~&rJ2FVWYjBwbz=JvH2}Ca zFY!EhyZ0#}fvxYO z_uIOF<4u4JT}i^tNOo5~g$f2Cm9W%hUqZ!bgah)u^?CC7Rj#plmE9Q8N>P0c6+>eQ zGr4xjE3cAQWdhQ5UOa6?sN-89X)f()f?Va0zxK37K3s=JP#ZXGg2q0j9z#J&&Owz` zSjZBumMrQVOa*LcsC$n^CCSc5&acz=6!!4rtFc3{cOW|)c{$c5?`%iXq4F* z0T?Z($t&o8TbuBqGbysrx*BpJMJb0&6q(eSmO@mIKkVvGRCc_Nsc`P>q$~$@-SvaK z^;azYl-VW%Fu+j7yt+7HgYyq}>Mmp-z|#zn3dmkry`9U}#@}Twh?p*-2iF)j9n1WM z)MeAY*Zf{Ncv;zlYO7YzfXpWD>~Q6sNM6}-v#CY_b|b0j-(YGg$vyK`Lac?Q;{a8f zud#jCR~Sq_RUCqc=Dfe4&b*Dd)>q=Q9g^*&~vW4kJM-sw{?WgCTR0g;$~$_E{wBh%N4CDL~RP702eGeJ{6Uns|QMos(!_x zCah-LxAywa`reey6q6=h3j@#adJknp`2kOF4P|#L-R=Ounrt0br9cD~ZB(+Rr*Dtb z;4I-d7EKnaYMga__TM12yNq0ul?mkvuyc|CUTUj_Vq!XmM5Ina3k7)#99U~Y0%0(T zjn4p-?9;cu(TyKN$2E6?sVuEmkrOQLS0;VHp-mfb^CJaQ z*`1f$e=3^iw=k&4t)oqW!Bzw3qc%a2T%bS~MO zHbyJwhU(mwmdCcqG5VNb2A~7jvyfeA5wk@O2rhwe#N)fS?wnN&%v)vTR)~#NCsLq3 z%EPu*5DB1nR3*xTv$OL$9Qu#{04B^^Ej5@5h3u#pyEA1)Cd;YVlB6nO`0r$2b@N0C)Q89prU~W|J3S@2~8YF4SP1=9CUmmse!L&=n|H z&>>9xBHZp%_f=7Q&d;LB$^|6_4uJ?16IH+pJB5Zy;GdF2zNORqnMImyUhr3EB#KQ- zH|#HhG&>otj>k|zW0whZUXcnwGN^5+f~Xf@du5Tqp#_~;HgzQl#KJh#51Ns!LToy{as!xE~7iTg35G7^IW1+Gl`e@e3_W?WK| zES0M&gl1-9JgGv)&Z<@(u7tC0POct5>D&pbO(j0=dx~x*%2@faAx(8SO;|f(S;}fu zxwl8vYHjUGF^NC>eK4_n1D|1~Pt)ntKlvotxdQ6To)LD=a(AmRv1$^TR4`GJ zr^!^q3NSh{hFxD+t5SVZgD@-xK(gS)_XjQH3uO zky1*fqlwT`aY_Oe0GnWsUfB%F#Oz;Fh32^*kNWG<3U+wGY-er7R48-@5$Xsc#GM_gw~0 z#+HRt(amu+D%fIJ0<>6%I;)f;xXG|)BWcg+{{UR(aV96pLS%zz=rusp3x<3YBV3jq z#Y=)cSc1~rxI7j_W{BAa>)V{r1Wk$C*;SQ}H3JNc00fd$s*?}Ci`Y%X%Q9EPX=wGxI%QlW_hJY5V)#ShV&`hlY zx0cK6+@=7|B#gSGaF2$EaB#`Uz&}H!0v8N2Pm6w5{{TE`QfFC(rc0_w&6TDoyA@{( z>{&|XaLnW)?1L?;zO095o>@<}hLpgo;WJr;bxzZjz)xxhQ`{iF2Er=w4@Aa|fT4gR zvf_oAK=s~AT8PT3!I{YJfIcema&=sqVM2PJR+-Lex!X!+daD-0f^b(U@Z%989m@Fns@4Ud zjIQaV!A3w885Ak23cDhm!B9W4SRan~bnTLDc3UI>$A2jO4!!*U06)+3rapHWXpA9e zo7B4H6`aojcAmr?UaF-q4m5guc*AlW-kHnf_x4nMSwLyNw4OCbX|kP=oj@6$t_1>u z9YK)ElMs@UtkPvzoJc!hV>7FI5^>xsoVhH;RkQKApcRQ`P^4MCkYx=YE8$$vMq&bF zBh2SJ5CAH2Qex&TU+L430Upn>IZB*jM3!Ht&C%IaSZ}r|qp7W@qH6sdaU5vpF z^hKZoswova1Vun!S>!M$;}0wARE)XRyX~yO65cX4_D(b)^(AnJYb2(ez^5C~pObW$K+VIm=|7B#2W$2rIh)v%vwjbqwd# zz%0xF2o4RZd+`ZG$}s{crb#{QNCf2aP&NSSw5Y~-Y})A`dw)MlkM?-ajThuAB0Uf) zvbrhVjwm~MX9~(f_Yu+ZPV-m7jz^(%+Vi4yjp# zt2{#}E0E-rre<=YMd_gVt1npEiY9SAM2?ddb0J_~FU^7HS-;R#t5itEKoCnK!ya(| z09`!&f2LAgF!YIL9C^pQf}RinRBWSUs25y-&-2W?0WQMMTXpM>$6c4VH& z?I;eWG}=8mGRm41e+a^PBDmsNC3-5 zz+Bw-zvzadE=SSZs3c9;FjQ#Q1)W(o#HUk)W(r)LfZ35tS0rQSBhdfT;AnL>8cTnNO znJSw1yt^yA1VfyJC1$0wB15B)OxcJ56aWsL9pvK+NaO@fxDC76c{k%#>TK!A6(5_4 zEAjf{{Nq)@y3M+4PD?3HXo~7G#BJ;munA{01JCxMa7Z8xM{m2(8W`VKTIE$35!@$g zA_W;U-vu%ds+=4+KRchZeIl-2vX*C3`0aq&1~XJMMLA#;9ory=L79ar1ZV#M(EUwm zLO5^eeS2)oAKPbjQG(dV?0_3+y9NVN+Cc590BRT;M<=A>CE#cL^NjNi#W{4ttAwqD znqd3kt1U_2T>Bk5lgVa^{FOw~DiXn2m<6kMA3_%*lLcCUga&NGV>EE83I}Q-DnIgl zfX1#4O0>~+Vx^dXzySF3@*(@Z!}dO#tkw{?x1Ys9^Rq1s6D22C9tf7JBQg;qsvB{uHJ}%D$yE1 zhYdU&uo{)_F!PhPPTmL|!>qt0B$Oj2Z@mxei<5JBdBn@8zskM+z+Mni%2JL zbVa1tA}o*UDs|PS-|5Y9faboITEa`x_ zp$g6m5XyBfVg@*D0ssuFwSk{qV)o=6CV`a#vqkwu-$8|7u^_DCM%yVW zNNo?aivTc2-v#zWswa%8R@t}I1;T#Ek`x6A8{`}|23UMaDY?jXz*RBG0U3$UiVWbL z4%rQy1x+v+mOu$yQi(|r5Q4OF2rsCga4ysgL$C_^0pJsW<1Vs0kN^(gTb$g1cjDt- zBa@E6HZ5iE{Op?`n>|S{Bd=|eiiJuqk`RU}?1Te@>=A6tHOU8?+Oi40j3}}0typ2z z>RxhEsvIb*5vQpkhFpdU#&Rz0fBS`4WZ9AK>-yIs(?!>9SHu3(KV_GmJC-6 z$R-wnh*wG_F|Tx&FX%y4MjLx&W+FhIl6sxwb8-#-m>s)~EJvvPznl9t{`Cxfi|f1| zP3TIOB-XDTq#h_qE&~#qOJD24(%OtUV6F2`lk{FPhvck|AnH~{DAP&32u3>=cB^<| z6a;Mp%z>+XmG9FMvpUV5?`IW%)X&-3C96@{Sh5703^-BhuGL|XO3Hk6J(c}OWpKv< zBOt7&ZM$zT=oS9ewLjb7SsU3xA`vA!#_S+2#~}bs!^R4#cChLsfb;wx?@`r$w+OeC zNW?OB)d*=ifrH#o(_Y(9?2_4;it5^_Whrt#wNBc`I+vdHnaGgMQ!PTND=k_6DVj04W5Z}=sIi7b%tyaQ&rH~dv=p3q+ zF3P51R{;P8LB;?kfMtGNqr0gTCI?CiLe1fV$5sdCO~#cis27Zz;=wWC@NIvw)qZG> zpF8*F#?%bWO8Y9+07gZsw{-&sBo|#9P#X@!w0YI4{YR52d1MZ&nkJgRb!bBs(sL@s z5!nGEZGZ#51oPECsmbJ0k*RLOH3cRM8Uuh-jOD4R{{ST&c4ElPa0>_0e;bwNC7s!e za~Xu{O9h%MH*tYJg;hpN;Nw~U0Hrz7j_Q>-^~zjXcd_l{aI@g*r1rI@LgblwBsQFoEW}QJG4dW%dP-;gv}FE%Lsv$K=jsCpl5VF>+{x zIZ$xRkVEVcf(CNgP!u1I+zt;Hgo?4k>KbiFnhLfMsWU7I%bk?47)2n=7h+4A&CySC z%7)ku10L|ZKk8rXhJio>U?~g;3z7ri?ss*oRuv;706z+lU@>_U_CweMooUnCMx8j* zLRPyRf!~Mp?TtkI&!E89mq@9gu$m-j>a5JIO1g$(R&H5|%`(^u6*M4+{)_c0aTRjS zh9QchtrkihJCi^_$xN-wlA9rJ`0^P;(z+th+U+4*_Ekn8b zYQe$~z!wY0BX4zS<7zV?$eA0`d#D&tGN8A?JIdxJCS6M;Bwg-PJ)3WleL$fAdW0@G z?Te#-+d6O@I7(V}-?YrxR{sFFJ9&A4+03;paNrWkxC@fX0I!9njU}VH#g3VFcOig! z0>BVGb_d2z!*3rR5na%b!b3@ibXmOI=UEK~+l0d@P#42@5w;9I0m-2Uvf!-f?b>;# zp$fU6E0t9jnHm*m8vK!@_lf<`ZHEy3@j=oUi-{gUmiQ4y z3Sl~l`DIo;$1EL&5veuYu-Dhw07hjFK_uZqri(g-b-^sdFr`_llp$5hwAIO$Xbnj! z*ux`y00iy$i6Z52IOKT@dmR{!?h0Pm{kyF@RF`E!^od$CtxMCm_E3j13>|w}!5aax z0-$>?aY?Ni2{L_~XD_;{yJQFQ{*zGQyMdL%fvW(A4ab(Q0b;?wVkw|5NJ5|xltw9_ z!7hNz$#Ba&H^hfEU8?SdCT1jEXurpk_dE%>Q)KU-y5j zw^2%rF5--6SzHhp6TN5MeCBQ8eC!A`QWzhSXl6SNl5BL+lBUkC#D)fS8#82WQAH@g zr-Z`eZrS85Qrv#;dDd!Z`zoaSWF=606QE;_p932%Fs*8cG{~5rOo4GEp7qiF)A%b`7LhKXm+dNc+#H0Z-6=N+ z6zoAW3LjDlB}&wjB9fkBou*ZpWp3(~q|Gwxf{KhLnQdDEum%HnTdLcLkBc|b5CH%m zJ&U!@N@;02PD&+OQod?o}; zlzC;agJDG|!I!%=RdJ5o=(%v2VVw{ZCtP>X*%?BIdbX9Bq0^43{)xa2p3AUV?LC#p zg*Z+~#Il7Bpkif13Iy3i@Q+a03d7l(XHpB(E~+z2G6=YWoLb_@1IoCvE1g{F7ASZ8 z^Y_z>KsDKfOFhNzw6b5zae$wyP4V4%$uhn$ot?jp^yR)I=;uq@s|8Bwf#_{l5B>czQBb!kvlRRX46&e0k(GMTvm zx?nyJj|dg64_x}^7pkR4B58cgCSGg~%u216t^rA*z;Mf;E*B+men)*L@#6IUe7Pwz z#aZ3LB;J9}FlhT}UhKd)E3>*UkQsDuohHlGsMFa`Z&VOSBuEaRZV@C90kxS4V2x#0 z*;W3gHEI0AsoR7{`A^4vOk5n-jRFY}X*Q$~z&Ii-#IV@_bp)|4D0Xn90r0AJkz4&x zv1bxAp=D%gfXYy@s*Gfo0ayB9HdXkC7l?T9oO?_WX22kA9BLb6A=SZD1=w!NDEQd_ z07?$T*&5t-CTlRexXGM#)iEimuryYZuW+y~xW)pLfhvMhl!weDUC$i$`vKkKTEVD- z3$r7Sm=SbsY+A>IhSI&TO9Vz%2PhPhuBD9f?jCP4)KZFc8zoVdM=&o3n z2E6qI5gMy=doeieqh%R8i;}K9U?|DK4z!6S3&-v`1CSFaXqm7#1eWm7{3Ebji}%;i zRca_&Ov->2-0bFz*d;>$0NZjyOp@C;@HEuzy6%l&S;=6{mccDCfZL*POmU_*lFitb z1O&^j2~e~SH(*iNBTSW2!5t75AzqRWDVCs`FOpo4SO*>E>Y*tuQ$59U17~T4i&9j` zS1qQhps)kF*e~x%$tQQ z+9RkMNr0eiB|o$CR-I0 z-bEQp_YSP*_C8lsT$Y-?N-hmnY6C3h%ALX79l*d52lGESc--KrT|rUB&sRIXjN1OM$SmiLt_~wNPLsAL?v9$ z2WrzdU;{DLEq}h(5qLg%y3~+y4X03_NjUtG~W!o6_+f^vg z5r1YZ<(i^PgSaTDqXg+(2URsJ6-yOqk}#$K2rCdUc?Sp(`*QLR8j=ZkSp{U2fW9yo z?ar9F{W^U?MBE~|VMh#97GMf32x4>$g@HwNWiD8p76~2mzaQ}H$y=Y>kj})N)S^>d zA@;=kWXwCbJF#4Z(N<9_OSLJM0F)^-H~|YHu-7_*2_2RQ!~zRCDI@0ch$Yu*1yT;8 zJC+F96AIfZF)9KT17=JU?5?kd;;jopMm|zP zmS$9Dx$U>Ga@31H9Tti~L{NcIRE@Ahc`^j5vqv*ka6>o@;*1qT0%*IF+y4OFwJ)5q zfOS!imT8i5t<8XcD@WSV$~V3Z3?(TEeGP?FRv zJB{1P3;<;xBM-cNZkaX8H=EH6mg~q!C2f{{YjnXU1tyOZs0Ufz?9@JIy% z)@6ps$QUxCjAWo}Tc55)Pall8uILb~nQB7i@}RpqH?pQTDV+(Iy{0|^UV5Q&RKu99CPBZ}KSpxer3C5aZVj>PiMpCa!`axzcx)*-wj zi?WAi%aVZX0C4K~XH87bH=AHF)ff=GXT}4q5p4a}M9xLLslw+IEN~Dh(@@z99@rYA zs{+Z1l3cHm{{VG=+ZeZ!>Hwxd1+Wjz)j<`d5X=>1tj@k196K>IU?0N<8vg)AP61pD zgB!cqh1eUTY}^o8J@{AbJa9Pe_cphU1ZG1P+D4prsvw;fg!cw$rPC~n$XM`DEUzDwvDsTH5>E~<4` zY@)7Ej03UChdQPTywL%`RbZuushmRsHP_0PX4eP$RAhie91AzccW?;z;Mr(oI)`I& z2eIdm`_d6slJRT-JawUk88mk@2rBC!GhWk@7IbhGK?;t{zZ7zrsQ?CcSJ?{y(`u3a z5_zBtMm?cLX|UdhUtz1($P}@g8K^>v0hK1rvOjW5yCoEAU0eMiRw1%VnVV1}nIUq>0?++A6SH8I_!1^@F|Z64t_`tbO^H0*{g$qe*ZKZ5o1-Q94^HhI z6S~jRoy2wtU8+VHNKIB!EJ_nfFL7{E2m>Kd*<{^GqL9ciYUgkc6cx$YotruWa-&Ok zS*Amwt162jAlqQiMF)1t3xFp=#h48|1GvsZIoz`=M{KbMvTYWMgp$I6o4Dp^SHK8L zp5X%#9-slbV4-%e%DGl0bIytYm)QGW{z3EkYjHLYGcxa0p;YxXWDMKobs^JlDvC17 zXRgY2VS=}GJb_N3&$vsK zB2>sakXCA4fZNZ^cNa_r)m;cw)UZU^o7F%H?qMkXDE0x^phaeP(M1^+w<8CmNgl~-46(G^Km4)iA^pmH^30ID)SZAm(|&Ix3o%&94!+pRU0OK!%D z7gyT|PF%?gHlso{KOZg4Qy!QBACyEOi5!INex>{AQQFf4Nc_Yi8cx?A&uwx2Pp7Ek zx^abQtQ+=;sbx$%g2>rWz6$Jd=(KVf3jD5rkU9@nNjXvk-$VpC zWo2WR2&GUEK3l-38Z>Yj+8Cp&Bd$s`^rW!Lw#aAIRIor$mU01V>U}$>^8*V{yOlxU z&$!>|PAA$<-W$$#K;&-9RR_jxclD?d*App3i2z;Ai~Ky>0IxSgx!K0OImB2WC_68g z-|6}4i~S?(T;4ZRpMF)Th0u9J?AuJLu){S*a-{nd%WNA57u%zMArpz+KgGXhZoyUi zQ=rspj0hB9aZcJg=LE8bTzup>e^lb|?K-rJB$C&PB+57r?I6{16-z3r&=&0Xv-I%)*2%p<+T10-eC_0bArd zG7a0 z05cX^G?@1&8i_|>r3#^4{qR%U;z@=g#f?nzNuZ+!4g!)GqmspxX^;Yum13;N;HVk1 zZtlQk7rW>G=9mr~S63|w~uHAMCr zIUp+t7ZZyLih%XH+DoRyD-WSn9F2@nurzEN;4J?CWddY z49N2YhE#A^6QctngBd5{XKJ04&Wig{f-O#2fGQaaqbXH+>__wmjhOnUIEGa;oe^^H zx%6ym%Ctg?#oIoinRZYcEUe5*rx=h3G98xyA>$Zq=LeX#*Z94;zOZiW%#`gM9kp)b zCLE(`JrPS9GKQM&j7u4i2_FKnQB^7j8PHN`HegzqYzLYXmRHFn7HSnx=WibhK`HF0 z8iQ%&-h|SxQIb3`bAVO9UKEUAY6$q>M2fSehIp~ACxIA%iGAg$^obwjLRqHab2z>&f& zk>vJ@k&ua3KU2u|&X}Y2cdFzKSN{M;897i3<0uH22%+-Yx3ib7O0Ywp*4?tHLSN7; z3`%;t9jRA4fE83YU`X693XoKX!}^ajj62Yf>XcnV58Bjbp6#Cszxv=XRa^;>tMSnN zMxt)Ex_0LkkRv3ZTV#;PCeqG^bb`+z&7$dw(&%|Z4SsCunEu|k}sa4>mR1QIwcckK0AuEtw{ z0g#9)#rKX^x9h4!(mt8Ui;LTdPTch_Djy7kZ2@3Zu5q@f_7Da`0zsELeCi48!(oK|3ytE(ym7^7|H{E{pg`j1SPs*P2OGsT8hfk4p_ni<;Ha*?l zzs?9$7}#(AlWf!Y7wsdIDiyUS*E+VWsoUEuRa`Le&@$AGGTD488OPC-?cJsb z4^2Z=v3~~mp7>!89S1d9!+IWNh6+k&+ToSu8 zq}ZIIvz2c}p&^H;nG)Wkv|1&dV@Wvpj{1IH7Q(_0K+x`77+Sd=i8L6o5so zRqDO&*=qH8kh`x##QKrU$$kab(o9@7~INFCkKtZ`qfHOOHP@|M#Kxzt- zio;M_RT?_B#-2N41m{Tr)^M(dmf67>QpDheGxDzT)VHn!0-$7W1PKTbWAirJw~=C4 z0jmdn7>mmR1Ob2M-L7=c)cRDp6K&EC+PY-|xRYcT3Rh~NpbQEB0Av*Si0N}~`79sw!tr+E@?k5@co0?17gN;!7a)29k?5QtG8 zZ{)jbN>mOhsd!W_P$_qA<_a^bG9X~Vuvp9@9BK$aM!L;GW~Z}Jsi{&6AyRA=vM5T2 zDx0k^0&jOHMuv2=H}0SNoLlp2Cb-A!9|K0(2n=8VYO$fvMjLexx+ zSzMsmkU66UPT5rf0u^tWvw>YfD<_Z`2Fws{e_k|4_>s~Mvp`u>JJwSrr@a_YY#KU_ zNJ#_x4N%V|pyDAIMvY%8q>(_ZSkP%9(kW%Izpo3oaOxRb?8Dm6tovpmuK#qipLiG4OO< zgN7j*W{gx2fSS>c32e0sFl>avxK#+Kg|!uV58+C+2E_?ujVLx!;YQA~C>onKdwA{a z2lb^nu~jWB7MOYDGh~%wxlHY=24yooe_OUj2|q1U3pcXDEdgLyu*xU_eM<@8dAHw4 za?G_v^%HfYJPy0cO_etmBihGf-Aol#!s-JbjSJLxOH`&wuq`tcW?*DwU7JF2vg0I8 zm8Il>=)|K>UgSKbL_3_NOv@K@AyA+*JoHl{5xbtsyJ!d=%kmWFeZJG?#0pZH>I!!c z{zD>H4CPSyF3uD=P{6WB>t9f ziO7>bei9XOf!s}#*D+<2;fPSwMgjJ0YC&%*%I=RjfP1MHL!guxDV-h$~TrBX#x)%Yxt*lKA~iVIx{rWl#oN zS->mYT~*KP4Y0xT2>|}ZVxd7zO{Gdw5j{rt07(A;>-wwb@2^v<8HXEl!ngf-w>o%w z$`Dm!GNWE+@WAe*5j7D{ql(ZQ?e097Ec+~?$X$NNVlS6sB~lT~Zfh@kZ)tn5Sf%!rJcCd;=tHq*!|aqVP^RE*ef*U zL{y`Yc@%f|khvxEaZ!jDo{UgFcos082u3V>H)7%{P?ic+*?2+j)OoYlfJ zD4+Q=V8Bcx3l`6I%ZihLg4ZWDWW(XujK0AQw$f`eLrq3#yqW3t6=y z`CCZNELjc66FX9q&<(&lC+jRp!p(_agZ694;?MDlC;*OSNdu%tvg`R|EYVqA0^t z87|=AbS_umj}$~C6KBq5h5e8#EloBIsLHB)rNLmurbghE8b`RIatx>e8Ao8j*HU&@ zBr&6EiWL<$?zk-3`K;!Pl`7OZCXA#d7yBw1O0l9ksR4?dvbkKQN6NB2Rw$8RL&FRZ zyf!W{&nNyof3Mv8=^H&(N>*XA>XMs~lL+~Cqk7fZRF!bKPU*>ZQs8{d&vE;Pf|*vs zr0hZ#RoZ2!RH}wn(3z_e!f)jRjj91w4El$eQmoCNOgRmzyCTttV3u5>bVv6)mkKD9iqn1b-dHXq9rrmpDtRxuADe zR>KLBC`K1XC$tD(DhXU``QV6kr$Bg+I(J>&q*?Hi9f{1=ro9V*fTej4V7Mn_H=3T|m zA4OBC1)S$!Gs7u8!liSkV~fXnKBKr>z1u|YGAl6($R7%iO$cS~V6h4aQdAjUOppR> zsKrUmH9|to7=|RS7!$Arl4t(_-XnxO-#@QPabUDoGH+6=t0AU^R*V}hHO?j|LX4^m zYJOgXXCn|8xEFtl!|HA`Zo>MjP{uulu5IA|0G~GE`Xb#$5}=fd87@wYio!@p@(3n` z0;f<0ScN-dV6=LKFRdMuHIQ(gp_*>9L~2P?YIF+4wg@xt>I*e^`(NI9eLt0bDg}dy zYRlUbLgB?E9TA-gOtRA|a(SMY`8Ka|jK@||EYCtpRaJo#3RD0T2FoT`7C9;~ zb}9Ns=A=ZxK#ot$MUey~`!o3$mp@RY33QUtxdPmOJNs(had{A{xjW-54HyOo(YsEx zZGC6~Q8VflLCIh~ZuVFyp{&IMw!5>=OD#^Sp^M<1o4C&2#dg390fhQL+u_Tc-MJsF z2m3~?9^0y-?idX=18MJ)h}(@9WjO0!Z;(e-sulJsD@2f5Ob~F7q3#tLD%E>rfZwpN z0goLffJIi~edE2#tlouN zbz++^B(7!&E&*g^2f+n)%gi>wiC?7s!cWHxSWfb!mta|u=75)X_TRc)zgrf4hyjBhR!Ht4@UpT~skc zmmr26`WtKa39!0qEo9W1-tfm>9M%#A+BOf|D~s z?!HJMCZeswbtfxLu*}0ip*n83QdA94GmrF#JE9{dTxb+cQ(!2&Rof`Qs+~Xp7l4bJq^mRZ(H1MyW7IOFieA4YXM$G2l{Diufb|uCp$g0{F3>X3G zRm+yfNGW%hN1Jav(6S(K&4y#$S=RwbWFO&IF0*NZ1~Iim5~4{{y9yd;;X6fD^g*>I zcGprs6ayy%11SP1gh`XJ0Rv~0$g>~}K5W5+5n%&w%YpCqTG-1)N8ePzNaV=2{-M`U z3C%{&zM!X%eN+k%;A-54?X2lWp$h8G#44;=%)rHF2wwg*A+!T5%kv1vyQVT|Qw^m7 za@w)klL3`*v|yAC;LVUKoaLyCY6|ZHj<8ig8A%F(_bRF=Kw?9W>4PhNz)M)COqAbA zBmux=Ud!q3lD@tC9@c-)ZDA`Y(WI=|P<7Rf8M~EY(PGS8E0*0{EcFa~&PG0NEBt^s z<4)KcY>1A+gBV6(f-(hA+mRcq~)ddj(6k@d}PhbX( z zkZ<;OUKVqwIawgAs_Xk2s6{-pYRXUdbjyZy!|HVm0+e+Oz5*tywQM)Wck2j@Q!Jrb%^rg&RVlU{ z9H?We;AKk!La;eM8Y5Cx4n*KxeTiOPRyfoNL?4)ijPv~cb=fwI6y?x5D>Dkkfv!kF zJOpESfw5))AXWxNbtPwI5}+tov|Wa*AGK{+Kz6}j0OgP>?$5RX$r0iEN~b7IXR}d( zrs&pWVB%!XN>f*Kz*csmA{AklQ-;1z*{>As_axayo3DUK^&u6&n}-CCG;BAK;Xo{L z*;bg~v()(`q#zD$auwfVG)BEJS5wrjQwCZ0H!n5Yc{m9Bss%G&>=Xf#s86_34#PrN zxm^>5%~rK1A)x@}3xr_h%ao#F%Ie69%A*~+3I{+0bbij#6?UNoRzXp!9rjivgmo?# zKB}q$mSS=gXrc3_eUtf%CEj(qF?A3oK~>d4?j0S86#y`q(by7Mo6pHReZ?kj5H|%I z0D~vJ`0>Vs)~7WT3qRZ##fr~8td5IMsPvcQmoXLgcWkmUXaL)}EGmqG8QIu^6AHi; z0sD*6csyX!oI#Tfofy$5p$IBLWo90L(;#Y4fLYED#dzHGOH!q$j0wP{SA2wLD z-GtJExCpBdwI$eS3C<{zc5+JSf!S9_1z3FD0@D~Bt&w(g0R>bd=a8B+svKh)s9+Jx zpdkEJnPlChK|)lp3XXIm0Z1iA`veM9l8KSq_QCi@aX_pSVh(f9j_THDI$*N=mA=}+ zLN-E@&KY!NEK%mHv<&pi7FKTJsLC7^0H=?N1*>Ft_R~d0D!CI?Qdv_cLdrm5a=Q|M z2AE@&W+pS^ESZ^GCcU*HikiAJOd#2EW`eqo+ko%g_4usS4Vj&^J+)%EW?Y~Fo?(j7 ziD8N^M8ddYSd0};V28;U0R(Jv@~&^5G{8Z-MP=NeG8g@YJMF0#PKs2FxpMf5B-1x`1s5B-!d`SoO4 z)H6caeNM^}PfY{6Ej<9U;IYZkKyn*&`H@McNn~ce_P|3LIz&z~Kvd zL7zA0O)bY-REI@%b!}*@&JzI`&vx4;p3~HLqah004Srzo(hl28O^(OB8QPBqWM2w3 zluW6+DJY<`WDx9u(@Ds(2Mo2jEQ3|Lq7N}B809u%-NqiS07PW|dBNR0@;tGJwRP4#hwd`Lg5k zTtl|ex3s&gzsW*~wW3K}C{3APv+7yNP0EGO&1uy*ut$PaImsY6kx-2_{gkC0i!gIl zaQl!G0gJOD_|ut)gjh$0>_G^-gk6`^ok^0pAa=m)IQnR<5xZw%@uE@Diz>E?O0a4$ zG7Yc?9vvpgr`Up2JW)nfS*;yHmRYXKs@@sqiLqU1M&}+04AVGL%vb9@Ikb@+bYnta zbSr|OR)tgmeb)`Uv!W-|ieplQ=x*J+-ACgqN){6}Dy-1ALNZ!2oUd8U*OS7XpA0>MrTWcL1OF< zsa;AIMOG6-mnX9|NV%a!X2Hrc4-VMFFC*>mM=MK} zV9eNMI9zZN5l}AlM;t7e2@Qcht)S;qj+Pw`qHAms#mE zTGQMr85cV@mM^UwWQHIqCD9&AP^l`9+i8cvd8!6ABsS*^Y6G%`EE$-ht^ltI_R87d zKa%qYM()l#0z-LnUB(WhQWjxA1o>j5_uUh#@;Mkq<*jBBODH)0h{Gbf?iGm6rx;ad zb#E9&O}$7&l0=zy&yq^wz;ViYC~hG#g@Oym*#7{8y|p9NRpy9@Q(1+TS2=9txKIwN z6+mWCNp-}G(q9!hXX#=vMkC<3;Qtz&d0fu_@L>iQj2+{vXf>5khUXCrC``JYe% z2qhzHuCC(Wi=U=A)55t3zioWm$!OZeX@FWt?LnfD!B(d(yA!hGXDr0KsnJSH7_zMx zl_E_t8LH?784A0hAwxC0fmJ<|1U&77|Le$vH30EvK)_TJ{*fIxTlAMBQYgT4O%$BiZwqAA^ZLo1`3kP3{fKrS;Cxksn$@PRYei8olU0;Ll>%=<%Fm3pp@CuuRRaM0 zMCslPpg2Wb{w$Wl2$zH7Uej-E(ytj6JcOT?q@CVu;3y>EO04>z1+oOd$nIbU{%;5? zT2^V(RU|Zml5`}oB^BmEWtSBJ_aNemKn}>rUXolEOamm@ne@iPV97h|Y2U z0J9*n6ck;pg6l_Bv%J?KNJcYa(^c?Zeu|UMWIjSX2%{tg%x}Z_vOLov5fe(T!EoO?ZQ`>iK-%^XJ zBIT;#wHt3m3ZN>3fHZa@f2ooK=0N@|(1a=g zA<0rG%9KwP44{N()I?-#x>Zqelw7x#Br*US`}h-e2*@K?s*?1YO_@W`B+{v!jR&0y zq@7XrWfbtrem0#-g#jrUNT6A47^8fWEDKi+>N+9;>RrweyX^hSe@$lnCyL7T>`8x- zKI;VSEU7c?w%#fP*$VFDt1%d4Y-5k>T_B=4NgeQ1U9sI#qz6TPvf;AST!753xMdHI zkDv94>Ip*L7z3+27!b4q=**i|bSheDhVWU&K=?g=$26Sfv>36_$-wQp1_4_Eh)NQR zthNl>Hd_Rbnsg545(M?x8-pNmz_BHq4j9GJF-lBWS@Fsi?jIce^#*lcs&ne>SsB)Z zX;#T?yE&~2G0JBEGb){RQZa%<&(=R5QESAnB6D8Qjip!r0CSnEE2vsC?(7cR23)I; zL<2u1elJw%oV{mQD!%326f?{kD+Ex?z~Gu>?>1clY>-r*n};qbSWXz5i}lF^ofb)jNa zJW!e@Tnw!M)IRa3n!BjT*6W0;24Wo!Fr&hfj6&e#dW`&208R@{%^JP1itj=O4g}k6 z0Y?7jgs*I%3ygfo_~uPbl8lS6Acu2%uQ$lE)}$f;3N{5=$R%OO&Mx(dcN1tTgOV_$ zim9rGHKi5FmDpgtj&KG%t0HA=#dPkltllDf25MMLX9*7~byYhsSHm+P0Z`$C_7oZ_ z5t3(d0LWY;t!I%&C|ez}&cW_L)C24Aq@+}#^-_`Uf}jSQtCpH7l-Qk%Gk`!*KP=cS z@n)%&j|FDq8MVPhcNexa#x3U`&)2q$oYkX1n4#n$Wt#+BNEJd;uz+AXs=D_XOw~a^ zRgp#)ZQ2t}o##D6IUUBDu_-?rk}!;SRY!HtmLwgO(Urp3cz-b`M19l+Q-mzerG~7o zXi=0Ipi`a7w`M`hB@sr?+(TDyEUw@xu&aQ;A;36bJSyV6^JEhGC53yo9tiEJe_#7w z_uE>8rz1Oz)3!v;`y#Ggi_LWb!B}CHS0J70&w@y?o3$0*rmd-CoZqPPqrM=h&VCsdy zKAPf7k{D%)WW^DV^I`Mp+P$_WY@)Od?XqestDsOqqhruB<1;K)y0sjTyGOY>*oG(3 zn3@@~>xInIMrA}Nat7Va+ZzM(4}#@0B@36RP}DSV4HwF`K};3^Ge7IW16-wwKzyo1 zW2N2V=vXI%e+1y4=Wl-BeCy?D6(9&RQ18HkwJ6GfXs$Ft@Gezn7EVqZxn0+|%2s};%b6))y3`O#&S9E` z4jO?2^Sti5l4fc4)uw1jdxXr<12qu2T1`}Bpk^uq5-{068fm!*q9oE5;yCA)M{E~; z1nNc^H~Mfn&*nb*=z5Tt)--yxr|eY#vbBW}qh zJhWAds>zPb3Yw}vyOhSPHK_n71RZqy2j1qX%I%7}(O4@nLn$sw)>KCw!o*}LMJxk? zt_ciaAGG~|bHxgPP`skk4(h>>mR8$mB@U`c<9)Eiw?dsX%96o_z2+m3Yo;#-R*cXj-qAw}Pa$ z2t~=l5(yI^5Ll}jYwQ02apiF8kgp}p8b*V%`=njO$w1&u(*|O5BsfYtlc*)vV{z!v zlvDr{AKYwk17M|&E?ewt(DfMu{{WNbjex(le4*bdF>P9ox7RNO?OB`kqPta8vl)?u z{{RK%7(N9XU^FP_{{Xx4B){8?JG^Fke#auN&HF)iay2BH$qh*lO4)a1r z4#Z43m{rEVD$(?T7b?*+K#w0ili6IFhZb3Hw(sRLRdoTv9-`9TO8*!%Z zm2)vecB!q%&x;<=QdzJ7gB2-2fR`Zr?zsJWcb{*_c0RI0-8MB0(ywX211!2ygc1IH z0z(>q9=BeKrHBHL7iL#-z|BFyGdT7D7F1BE!9xWhK^t_B$h^K^GHASwTskhQ^>k!D zWQa*nj29Ju4R432)iBSLbFjABR1LBzQC`(2NHYEr2huoI35!Oz=`WR^vK>Jl1~ znj}@UP>@NN8B%a9mAss>QpJ?G+XMgxp{KH$?Me9U&oWmsDOgq!#&kQGZvxTwxB1^n(~kpry=62 zKGusw29y;iyD6X4DDHy}Nh~om3|q>Fh>KM$)_P4(y8^fchQeo16&42{aMF2ahs|6~+_Xu#H$4>0Iwny9F)VWUua>QAwV?#ZfJ=s=w<1 zg;6;-Y?#Tmvrde~1kD7Mvbrc5djA0W9|KdPJ{T5u>Pom#Nus7j3M)3uAKm6zK?$O^ z4HaH&ef@PJOu*#zS=%W-lEAYsn}oEf$O3K=UAqh%ugjcku1JtiamcGbadaE4e711g zyB67o72Oaj;3);L-&)o>nn@jBdrX0Zqb-OmN|i(iHmU8HF0br$p zP~}wm7Ak-an?X86{z$q%&8o3@AAXgZWAfqwE4lTaKtZ;jrU1k+_bSX90P&S?v z8YwA3AnX_}!(}7jck9?dz13uL6`tlIis&>;1t7G$tj*h!kgYY;wn;2-*;JVUbs=&G z{{VMA`v5^j77Nr0@f@N4P{vQutd3V^MA4?LiM+c^>iXSX3`lhpB!?Ohs8oy`OgENa ziKik3LqXsTSkjWH3h6XNMWXEOGYYB7&5=_ifYSgEoDIIg$5TaH&Wg!HH13jytQ#_7 zib9vb+yra}$`E$PA<6rqaY$CI*rFq;?1UY%%)zo($!8j4C?5lCl0dsp)9W!2f{y@# z5*F=n@0ZnW3Ea|+-Plaq#goH1?PIB@pUvUu8QW1etzZ2Z#Va+|iiw6`3WuR(cJrYF z8#77!FHWA8TH0$Zu`m?2t``s4ZHA@t3Kz+mf#}%z2cN$VN*VDbT2WP|pV3mtHFjNPh9L>8>1I|%WhhA?g(#${3za&kdhMzBhaJ`7IuKQL1!lq20YvT~ zQo}vQa%sASW!t#8+h2(l%6TfS6bx##K_^E>XH-lvaul;{c2M92QgTK|%4H!RnPifz zGR{{4yYb%n`G7y6z3toYjT$w{rAx3)@^wPa##&b_zpMomHd8PS7Y9(tF`05H+o0|t zq}i5QD=loaU}`3sXF%%v(&3Q_X6y$Ca(|~bqG=L_$WfE z_&dRC0v&XI)LAk~bRv{#mPT}ER#fsCm=I_YNeD6$i6%WggEzhyEMvD8VQ{1NJ(rKy z>8BZ}*`&phs_d&e%ob-j$zmDm1Crgh!3^pcoskuut~BG;YMP1Rw{}Y!-ihb z7;GarY!aXkgMxx!qB|)7Y)QZh^j4a_M&MKsSxYe0ll$EUyqaAE(9U3CUH<^7QK;(K zCt=-0jzF*|6-%a6k_hmGKt%w7U>t+T4Y2cdW~nj3#@FRU)Nb zDMnoat5i@EJyvB}fTpE_vuvS(_=)9~8q`K1t5C}|P?ur|R(*hFlAr@ofb7iFK>q*$ zS7NN%qb$nGnNL^QN}&p%xMdhXKn0gos}Nbnm9p`Na7>K<0QP9ERH-bWpl6uGutKSP zv)~rggYsb$YcNn3V~#FJvH;+&0Mmb;&-bSfMp_l}wJ%`2$byS9}bbO?ltB{D@wN-vP z93Ngm3M_RLGYHPX4ssoS$H!gKk&6nN5YL|QVu`X31Z?7DfStxKOlrPb7hY-NWNxSujH{ z`)QCAA#b_HXzJ{xlmVpK0eMk~?{25`s9hB2_9`hZw92+1T54q0K#{y~YCAhnV#UCnZPi7K%PEs;Rj_E%h;f|5%R zNk0JP{psCV>CAbGtkz;Cg!aOeEFBFA{{SIgeZ^6tsmmcH@Y(KSZ2}@dz$6lHatK6O zT$SVilU!Yf85tH70D1u3eUD%B7Cj{{RP7Tp?YX*kf29-%*wL6m zQi@mafLmmPd*3eFum1qa%*h&M0udmFEd9~Iy_R)xxSY-*JIzp_WkoCd10_iTUBc}2 z*aj@XIZ&^es8U=R!@MfHKdD+7U>qfw1ewOvI3(OQ3Y>zjz%j00T>B4Hdc`29*ol9Yd z%#F_9`d20;5`Yb3rGkoK@C!VRXi(h>!Ss-`{Qm%@rw-bJR)?}HwPC6vWCb|LPgnA) z%j>=T;HqNGg?>4D+)J|c?ZwqZ#1%?>t z3hvo0vGU%>|s4fMOU_j1Mm@<;8y8u2aaY#q(E`VA6NV5+5AhJKZ z^*8ng-?qLaBRZ0B!B%zzE~*uRE2&pvvmP3O*-J1bf}H>lKxn$vX;j@d1S)MTBnO8GCA1Z!U^>`-HDrg2G;l*Gdn1>6N~a6M|nUgv2Ttjh;2@-!Y78T=B%m_oDq!_Qy{oIDIm%AWjQ%*Iq>o` zlyC{aungdm*g6w(l1t`3{@48bMSRva9>6Eg6)T^2E=^6-9F71ok=_g2n84y}d-K^>@tT5r0ehS&9}HCnJ*B7(YxM_iIIPTr&u zp;gvW58S9IQD$~K4fk-!W7|5l5&LL86VR~MY?=9Es{kA(Uv$-p7`L{AsEb&5^2dAl zUHl=ZEy|aAC<;*>0tQ{tpA~UOR94ua*$S7D2UR3v<3rX7N?5O)9E5gdCEQQ~r*QO` zB$BA6ZIR%B#bZ=n(PXJapK&NbS5gqP;1Z9)Tic(H|-nyjVD8F|19$s8yEZ;Yf4S_C%+Kj(xGK zU@mk(&WH|*sO~^i{{SGXcF%Bwoa|I&24MPQ;_qqpn1z`RqNfU7iUQiGIS8(vwx z0unf|05Na@?ahlK!ROK>CRcRsdw3t8>#c_)P-IbiCDb&MuB#?ttsB5}nb}vl8aW79;Gc+_GP?;B5EoqC1g~#k zbTAJ5EaGN2?76I3dg0W0w*V2<7C>RFXW>821ScHamcgE(BWmsiUubu5^5jN%#7 zxC(Vm4vzng|L}Mq}jwh-vh*0I0 zYX1N|)B5|D65dcQHqyeI!3+LAh}8TR*OhFxkWexY#p3C6fD~0 zH=`<&ek)12ma95R;08Qr#0=7ni8zTZz+nhzRKXX!ytUcE|Mg(GPz_5%!opbNoJ_cF}sYb zs76z;4xlC@q4tmM+R7SW7MOh!VVs9`83CxxB>{;!J|1jYhsOK;zlC?ms2~L-n-m8^ zs_xEqa6@Q`GY-~~0c~z&xq8xf2XUP&p-7XX76`>{VJ!$X4{jw!!uTBV|y} zOuG%s6?a8;0hcEqHE8T7AOajV304B-@K9EFD)(93L^JmD{{Tlf{{T9bzw2=xjYVHC zR9UmA%YjxE0r8H%XNp*v46P`{Is|&jF}OmfVX1A!A*v7k)pi7Y zgKhR6sP%VJXLoFp3G|?H#eG0zA&YO?Y&$Rv{#Xu&r}Un&)MnOBKv#I0I;$+DtE(EV z)xljE{GW0~960Ulz}}v~Ky^%mVbby~6aq^Gj2tB1k^NledSMbvX3hS=l6dZxq~HFf zYT2sJt29#cD*2-}?XuQJXATs10QD-lT|)rv({#RZxS0VMY9vk*Yk zA!4*T&jKZv)w+^VU7Q7cGR!+MWz|gB5Tr7I&Y@3mzp)t}K6hVU>D-P9CQVVpF3eZ7^} zaHS}XwFM@Eh1pq1YAu%uoq=EIE&x`^S*ZZ*G;I_SS=3OfmXV_5jquB&g7Yc~){UO( zpJwn0ML8-1cXUA~?W>{}3{(&ZGew%8 zkd+`|l#dF^8T00HK}fR_P$ZDbER}BV=gGD@uz6+Y^fu=Qn=Ka?p>L7@^fmWdR7Ulp^j62O{A7peq%7c_&j4hj;EQRvPzX_RwnxISg}!9klJ5 zDFxUtP>f2f_6bauK}OX^8`L31MeYVyq6z}4!MBhYJE|xp-Eu>}?9*%`0psJOnL;X4 z)`X)wiK{4%9H?cZWrF$KxZ7no$Rku5DauF`?XwlNo~Vg63q28gV6&0rg`%+3uG3ah zK`ekkM09l%XZV1yBR5`f{{E18wo$d3&)5FmhLzMRgjK6Hc247z-fW~ci>VV*RnlmR z1F}6bO9G2>kqH~9B%oj-A9@A^CTI|h1q|Vo2XM^0oNc|*Lq%~$a9C&cq6K0|Kdrk( zNn8`AjlQf&X4SKrdusO7_SJw@EQ(&GLj`a9y|SOtBW>~o@rEMAM6a6xk&GLL(8#&X zj|C*4^cO#pCY7`3uS!?@N19>50+wI{F4tNDY%`e zCxz8$7%bHJVcajWmSR_2H%s;odhww_SxhP8p;Gk}Sv@t?5B984ebm%?kfG?sj<;?LecmS;oUss8}B6-t7n9TZP2ic31|SxKZ&;B&dG%?0F_YEqt~W0%>R{{XnC zqztohOxa6bYznPLKo5Y$RGmib&5u*DT!IUdG1N=Y_HqbyGz#j$LgS8Y zbg_+NA5`29ZOe+RUdH8pXqftB$A-` z)E^_jQ-E#f*M85*hYO7LQ%*o-6)w$P9fO8&Miy!dvdk0&77TU+<{taerMHkYh#;Jk zcWjcwOj|Z2ajgxXseD!@Fsyr9n|;4ispT26+l+~})c`R`D~1TAhTW{9s%6GKK>q+l zpNP;0N(JQ*#ey`~WnnxoZ@JqA9a)Vv4hj&Y@0Ma>wfm1H!$T4TwT#NM4V?&DZY5Gt zLl7xOT@P%ks00t6FWWg9w;<%WSqV)6Vk!bor(A|AtV)E@K~s~i3Vh5v8lvC;@;vc; zFR8z{DtMQ@Jekd9nVAiUB;WKrBchfjebO009oct3tJA zZbSb7W{GEzn>Yxns;!1r0G*1e&N2u!HjsYeE5kZcci#u=u=RzBN-oNKzf{{V&6RdG1? zPxY4n0KrC4mcR^}wp~h=^4h!km{nrz6bQLhR(9Hq({qg<-BFQp#R)3Ju$RrIHg%+? z8C|uWafMQ)fX|h|0IH}9vkxE*l*s@VSQaD!V{wIYg{)1o26Yhz{189g*k< z%0LvQoV?VqLR@_GNC&8cn*g~@i}%f!=cWV4BP03x<4xR{MT@;z(^pBonTEZ$)Goke z_chAObK445ZL0yZd3TyNt|zK?)5`(9X)~xGjBcfX1%L}tY;}7>O=f zvNTs`c(0nFs)ITL6ttO5)q|B{W*a+s4S}i`8o#M^btjYq31f!sZwD9AxT3qXa7!Ol zdp_-3Td0yCQo8J2TP1^K>VUBS08-d#jGV5xEYxoWzn^AK{g#F174Vum=!KAXX+Ys< z9f!2mc~gy9HUr}Pr&v)=JV3 zHwaBxWM;uY%Si5sjJZTAJ8Z#_witZTqf6o_h?e32!zBlBk-G?RHBzln5PUb>-@g}k z@to;@{;804m}ElT#j)-wZJmh-GXAgX5dqt_8)BpfLixw%@i|aN&UZkp$Jk@ENJm(> z%d0kYC)KsrD8uD5`)}B~mkX)B{DUFHWn@)S$O#86S}K6-TLDNU6;)!uF=N&JGw(T> z{$DM@R>cwS0THIX%gssAiE=BI3!*Mv9hG&}tLXJjF)&$J7rl{WAg((SE&cIP$8~ldG0iq3wYuQo5PYBO)WXRcW~_71WN}t0v^|;>sBxwu;m& zmSv%hgR-!CKCB*X`oxs7LUhX-5~JiL^=?;C3_Z_OXV#26)FQ&CRva;MIe+1xvH^X8)n=E^<{jkfvK>m8nUMtnUQYxK@y%h zK6~rX-b0{De<*z9jANXHZqBAu<0}+LS!RR|IakE+h%U&A&b`_N2W<+1s^H`WKQnyl zn#kt1RdxYUG+m#ztnKTQhQMG|oj@g<%zej9D29#F zBlE?W)r{f{BqYs=UN{_IDQCu$uBdVj2W?&<3xz^e6lCfY3>%m3Vo&uBIBr{hFs@0UZBMMG1z|gB`yE>|e_6jP6 zd94wdS@frpj9e?1a7&e?5tH^!*bt1^MSV}iNL)!6fRwO6;9YV0V^VN|C#&p8M34YE z_ZRV^7_px6X9a&~y5f$?9KC0|hQBF0o3G$ZaPrEBT=%JWE&xND5cp+$X(3S za-@&wHa);{V3Z^fiyh9xj%YMBBMi>R#>Hl|6Hg?10KgJRMQ+k13e7u&nQZk^7XXD6 zI+E&ip->%^qOb=m@S#5JmRKwXd1N8>#htXhHgY)1V+FKmw5M~op+|_z?nxmLcEG?R zRX|GMuZ78ul2nw{8xE|hrAn^*S8&5D>J+JEOcDkZ0#CyGYZaYCc_65pMQKbIX6+Tr zWXVu61$9ac0>lqpq^X6*$SNI-otkd_yf&6(cMC;QT0~H<{y-r7bfiioAYu@SXMx+z zo&Kp9kQjc%+1nQP`e~7w=T;M)O=zQ2=%ciuM9Y>S-~oW-E1ZC?G62eQBMQ4V=)p*G zO&O^g5Y-EoEojKH%kK!OV#fRLH?tJPeP*WC*_QLPy z&tfyK-ML&wEarqvDya&<7qg9h0CK4;Xt9IbXg8~NX7=5c2!w}jeY z(dR--rWu2fxCI>L8M34^5XyhO3R@Y-h=K_PlmRZ?h+@aN7`W8{vp`J0S??kdF)VgA z#AlMZWuJE0bmNQxFrZs zR%OZ@U;~4&PzWs#&#rQMk~q+U>dwWeh1mwhs0O=CA^^U`Czc0t*&HuB>>R$GP?hC& zxb=Zw4z$bIWpmpscGwXx!~XzMH5tdtpZrx?g5?#@uo%b(^7ms^XTJjA1bG9<3$Pb& z>90To1yZW=o9W$h$j^Ex0TX2eswDORGwWqpt6nN$EG9flwO1lQEJ5 z8KBIWlTkqD=Q|$bastK^VTL5F3(O3Mbyg^qVpuzs45*BrzSRfe^1IGdUgT#oj%pT5 zO=%{LOOO^M5T(zS#%=@h74s4*=EzIGj|i47F1RV_i>P(JKOWk{kk87~2erJl zEPI+VGbDf|zyUz+Q&U~BmF77=WD!yXUXCzIJp4EyC}u~lS?c3jSQ4R-5X2A%6W6(x zk1CXIK%1kI2_6d;@^OX9+x#+sLB`A%AcMx|tz6Wt4KzD~(rN98FS89cLavQgC*pI z>dSFpY44v6t5*tkmFDKoiArNxumPAZR1v9AD9ML**;wNv zK38^)7}J13Fde>Z1Z{)QEAOnT)r{x!7OeOm%=>;)$4PdAVqAm9L|0iZ%7X07uHNMX z1^_sqDy@^T3;;hi>fd3!AmjNNO-JWQHx<6buCX0IBVsEBR%BN^WRL z6Ox_DI;~5j(UdD0f!rA&`vm~}6R7Zc7vog3zwzqJT>^j=WLML6e)3VmmplHja;#aI zPrx*wX6F!1t$P58DYx9RRf*9?tfCZ1$A0*}NAYV(bz1c**#I?azO+FByY#eX~|HF=S}x?-2ewbqx(CReRmk3a?Ds3KOI($ zGeSVb5=Ds&gO)O|Pv@%eoc=UXE33cK=yv;KS3~Qy6p&+m-l|b!+G9abrJMGn>cu1% zRYF!lf>D{56YU@jr!hd?$ESH1jYA+ni8EFq@*PMgVyTeS)ysV0e!0ad##5X)&=o_H ztD@?P>{C?Hm537Z%d0ZF`0kO}r#X>_PyB*a+^ewg$5Ao0-e{y^=Aq_(4#Ie_A zMLRaEuBcTU;%3^ED9TiT6?Oe}Gb-vB1=cin0o;5TKsprCv+hQXG^Np^x-%Rx+4dU{ z!fYHUECAh3rYxD(G`#8|u)& z`hK40g`tliwJD0CJ4IAYFbH~4b4e1kA@F;1*buW)eYOkpb$RH7vWl+fXI5O8muFXV z+-E=-AkdOoSy(os8?r3W0VP6F8EvUJp>_viuBwOjWtAHWSpW<}pxqwn zc38!U1>d(I$5AB=4)4J#%I??mjc+#YsBh7=(5XM%64kipp77?tVJ+dA+ET)zk^q5jNkoNv`<< zeYev%WSbH!2z4Z@m9F1^>jsZc+{zh(NG-?>FHnxkUG+wFbk*}cwkC)ATU#xm+*FJR z1*S(L!PpcnVoQGdueh)9X_-X)%GXF9Pq@aC>VI=T%fIaupkjrn3RTWacMC~@k;9gl zW;j#*jePPwL+#v}WxN_f{td!5<3dQQ(Tr7c&Y$qj@QhDsV~BSQ1GMuKwT!#(N4LokEXK z%hWPqAg0}@zZuE4Wo0oibRZ}N#?RVP$NRi)=MyBy6! z_!KqC-%>Rsy8@~K)04yEWlEAMke#r0?mFi=QXBPoKBZRx;ak-F(}aLg!mvW##aM8$ zs)i<42R*{zWBK#4)cA+Yme;*boDqTm}FpNFN+|UtqUSWgLE1tmsrSvDJ$EfLl!W0m2s} zWx&B-B#};+&fxG{D&9_yg;6qiC_9RKr_Oa{`Qg()?FD-xE&efa`D$e;Q-}Z}5&9C>Uc8SP8Ozq(!0GfS_OiqMZTVfTYM) z1%Xc7MD{c%8yte50f6d8w$q_VAn#?v6`HqmNnk4N6;{Hs zPz``k!??H_gSL6US))wN2*vb)WnfeKfGjVIj{82JQf8PEEWBN&ECCbs6Z+nA!#Q&0yPdoa(;Zxu)>^W#k=0m|z_Sub z_>3t=UBerqqevk|kPcJ?Q?AJ1gRK&!fC#;_?eTgN{9-Z{sLpCtPlZW>2euV`5r8VF za0>uJs61S$^vsO2@_-6iH&{aE{>*DwT!48!ulzslX+b)s$ui}F%~W_%+sg(d898La z203}Trn@OlTa-v$e6lObU%Fd%_V4-`6R*&Iy85;x}Y~Kh+)CMl4okpbsjesh< zU^kE#R@9L)L*O<52@xHdg%(0<;;Og-Xgs?OSA7byGLGO z0D#T$mI$B$4d<20#yj>m^PulH74kqMGH zSMP18UEOMcyA?x(ATeO-W{816GB!-|3Il@3!^dG@w0O7k`TA=> z!Di5ao8i|)n$&=+>LDN)P=Kt|B?iUvuH_YjGxKPL=~7EcC>7!#XC<3rnO9Eb)CXlz zl?u2A#tY=D6~5w4YPxQyv~~!kS#klI>$4pg`l|cv`(*q^@*IxTr=k%+RJ3N84JKaI zXc-w1Ywk|FHrOf{0Bk~HBnet1pa6Y<;SbCKk(K05KP>m>{C?VvIbCJrTFr#XuHXe$ zK)y*qRoDlks~oP_Ia5NaNG%onO3se#q1D=065K0l!8B!7C<3#wa)FAnf}|0F*maJC zi$CUMyhoJ>+#oY~CS(^ zvo`K7eN^aes6%i-i;xohHYBhECB83(hse&aIZ_T}L@W00?r+=2JZrq<{nLzBC<7HG zg05A4R5LhIc6Qfxe7ROo*~2q~%JV-YOO41ddekz}f(1p@l%r7=ip~{CMhp7O5^~s5 zLzr)y_Hye;!IpuXDk}MQLzW?T@h}Nu%E3ubU|T;pKB?6CyuMLE2LOM!^;N=ygCMT@ zpcrOqY8Yo8Jbc}w=`@G`0BIAO1DpQW!Ny6}RZaAV{{Ut|@2wLL%Ye4e98 zw;f$p&8V8ww`#k;vmhYFPD3htI|W@4@!-DmdebakrXpH}*U|ChlzG)yW@Qymt079U zz-_#&BlI)Oppw=Oa8RIayJ#j062K`6tlO!5r;YVp*eLli^>VXL;oB{lZcD9l12b#j2^45sq&>{gvdty+}&q)5&=!24(0l6B1g0M@yb z_FAt@$Y&Rt+imCv}V4;i5sF+=sP+T@w3<(XXaw9l> z+B}{@wBYYXO_LYK61f|cCC-|FP+@Sap#T_j-t-=*UeRETCiEyW3us*wAUfbLbdT5o zV&E%<2hYlz%2g>t=8em_NCTezpD1JzhSRG`QXM4Rfyy`|J-A$cQ+H0|PMlfLP?e<( zh-3=d>Pnyum-cop=WPfI`iDgT{{Z3+*?`ui)~*G=?Xf_(Mz5nO6>tML`P38?V8k_a zI`Z7Ag^@yM+ost9h_AVmWa_BQh@nA3q@BF7o`^-*Qf?UeLR}8(^ zR~ahQG|FZ0SsyzDDj7vCc_9^ARHVOLLl!7#_@arD6eN&p6tE(WJ7;aaY}0i<@@~)w z%Da_wGlifsCW;0yx!HD50w~n{3?Pyw4NW&0z#YQA#%Q5S&8k2E)QnMqS+v_Z4wgd* zf*1sgghiFe2grWKox{F=PTq9pg{f}P7A^k(wzvpP(1)6oX_R0T(3V>N08N^yWdmT7 zU;hayXlg?>G$WBuTq}k^ zfFgq5=^3+zb|vPmHvKLVEeRkD#-u8-e^5%2r(6Y4p^GHJ$gr=)yBCGc%eP@|PjBD( zgtUH8)PAU=$TszJ-Wsk|M1XJ+YUBkpCd7NwR$+~hmcr<>bTktz02F3t*|4CRVX%y) znabnFr%|Am!%)+td!umM7o3uNEv8opjDbQBol6qXNl*SKDSne(tu=$Z*+i_p$y zXfnZqf(BTJY6J{_%-b!qh7K{V%gyx;k^GZ-FPXf^Q#z;`vb!^|1hcSG!H?`*41fqy zEN!C!ASQt*8zP);m!87sfuWS-MTgPnzvcWo=IQn_B%$pP#05t0V?mMz7G1{-fs_oE zr80A`_FFmMXhLZ^T8vBQ&?M00g(PDhfW8jO+j^)uQcpSdUYTeqRpe?w#*~ngS~~X_ zwU7)3WDS)Coz$}&oP3CR9OaRkHCbf#+rW9qmdWyQHl0GZ{)LnUT!3~zI&G(?(W?P5 z^8!WIY%hi3ut(PUwYM^-AroSMK)WvH=iA7bFZQX=y7OtXX`+UxcPvEf$83)+#*p)S*tUXC3Zgl0PJoHFLT@f0K6)zLOyEK*gys% zz_a533;du9T$gJLW}NqgsPz+mZa4zc%6q}Ev=$`#ZrWvH&J?!j_Z(sV7ZKvx95JjXI}DuRD;yLZ}Tv%L)ONDxl8_OU0|jVUu$#Z>%025Q@>MfDamQ23P{l(D)`aEcF-~sxC2xo zb5gI2sS7J7*LeLwP;%Utng)@RhEX7dg484idM@IWMH3h-K|j<>(K>e{rO9j{#Dp|@ zAa7YSplTHd-MCfL2sFY2<*%-vOk!3>mUh zjA}@VWJ)BD!+5kZn@RZkY4mDFl`-*wx&RS%W-tEGFH*$5x4~N`XkKWmtoy)Jg)_p5 zqbh}5v(IExk&12#5#Dq@4^87Vnr{8pFEZr@kVEUavI_3rFKWOTG zWhu$xanR{zSANhfUDbDHz}?i62-TF8CsIQEle%oWyR7*3g(!@o`_$EkaovEMT9|ec zS1hqoQbAOJzM*pWlm|hHu|%7j*#v(gJhjfQQL70U%AGQbx-W}oJ^A2enXPRy2~sA6 z)B(0zb-+5h>f(qLv#~{Kzo^w)QbxnDh{)_Cw|0{%156FZVy?yL<%?N}Ds&DDzOz;y zmN`znmyuUxxoVM349P@NRkG=jOEG7_81h>>zfoO`CdGABaYrrNE|}SYMhM6!lT`Ad zK+MJzF3pnT@nx7S}XXamc}iWO+eC@28keVlkI z&Fea=5!)NKHz!k2eai+Va>1sCc-^YiL=#mwF65#GLJ0r`E0L+&&3i_nCWTIjX?arA z^8R~D(nKRwP1Q5q{;)nQrP4?nwSs?30<@WS@Mcu%R0o*u<$!R*U=YR#G*(Ec?u>}iQCabpH3bkZaRxR#3lycJw z?m%w#J}J9pQfk1J3;v%Vlwud(F#;iid3Lgi7P~yQJlJc+k01}NmTnuqkTlk(xNR-*SwSpXT16;A5y>+ZIV!S_T=3XZESzmn);2*rB)lT3eFap)<$3{D4+x>FonT(Bmg$gjKW=e?P!lkfoWiss8|H3XY_+2Hy0#6zwTSCSiNrc4RwS zj>)ZN?(0rJEDHkJvB!&X&yN~)A7FlQpyKntP(Yi7J;iY&u4YL>UX15r0=l~avD7C8 z*ZSWpj;>aY_MDTGvKN~dT2LbrS$j$xpGIJ~E3!BUPg~M@WH@|UHJ)l{Su}Q_B)a23 z+c-O5J_e--b(<*xesLdfmkCo6p2bzcU0FpRP)BUHxn^Gu*2;wdYp!w9(5DGh0#OKy z^6o8hk1T%2F11PgGE9TDo*q}Xlf&af{crC)@y%5>EEIy$bzfttU<>SwPNk+>Kn{E< z7-MgKsmZT9iW;mzWlDHEs}NAU^-+T~QlOz4rWqJ1I+`QUB4gC%7Lp9ig+L=(l?1GT zV#=)82&2N_wm`r?F0a&jw3mpnYEO&H5gvqL0U|7Fw*!hxbHx{Q>l(=mP@85+Y(KWel?20g530|RVI~YJ)M>_)2ST81 z_zUP{g@VeSLc6d)a7V|3%2M)@)^3~BnKG3|B4hg)6pI;Qbq_J6dkm$qHTU*S6SxB*eOQ^cSGH(dI_W8$ zmqt;?qkvn>X_I0`rBQ&|nt_%?aIDLfD%)6X$CCoBn`KQa?}kb{0E$a$au9;d+7(|$ z-5NW!b5sDnRHzJh45+wCXCww7B@}zDDY;!$0xCxSSo3hb+4jNmG-gEm{{SuRjK6&> z&h&ZFhSP4yl?4K;Ocl}G866I!A~0O8#XtA?_R%WJUWWv&9RhyV>m0i@x8e=5O78DuePkc^?|@}^yNn=k+wC}7*A z9lMxh25wab#2nO-H$1i8;9}oPn+I}vktNOl03rhL$!9k5uy&nImo{jtDQsw_!PQhN z1PB)eFdk)?X;X?Q0278vPIj4S1tkj*(x%8~iaIz9t4B3ZYeq-hNC&`Qi0IFECc;W+ z8xx*TE9@C~!Dv>X(6TyerekUXOL$6lP#tEyr4{Yh^{{5Hz>sF@aKX-fi3Qd07=S(_ z=4gc4ktNtNKHcoO)MvRS!u^rE2>Bmg#AVq5o@G^P38OLEdMN$pZ5fU-x>Fw2)$24* ze5~|UUD-k16#E5dp=K%#cT$UhLWN?cDhZ$VJ`UWbNFW~8dIFm=_5%X0jB?7_k*cd< zsU}yzB<=CC{Y@1JD&@ibzzkCjgY0raoQn-cxnjhHAh1i6nIHrVfD8bmU@}P_P`&jX zM)v?^9DexW+QYV){?E>6%o)*4!icnqaKH2t~aIY!S zh-T>F*#`cnE>##!+qN4}sDGY~dN`EzpH@&bi z6LFHrH}R}bQ{B#-dLk4^7da#%y{^1#u&3BB%nXh})fw83rR>2&;|PCIaW!GERA8qB z{-KT&sv2{zwI$kOsjCW*X6t}LGX?(u!v=h9xWNHQ!)?apQwCkkD@@=iz}F45+%{CE z8JR%W2N)+}emB|8CET8+fan4J12+4dp6?4- zW~8TbTj#(1cD9~j(mzraDwMjAs_xA0WJ5a{C>oR98$Ri=BWyO!YlVezw{ z%;qHQC4j5|1w$E77r@5Za1$-FDI?1QbO4$7gc2-IjxnDfa&vu100u)TfUWia0DtdI z_Kz%5fsoCS$YMbOreAgouBZqBa)VUPnPG~PLb zrI$GboZ-i&BV5;$X^gZ)-N_78T6!8NR##a7GW%-md?PF4Zm*zyY;&IVD&eYY!hys3kMqc?lG zv8Qcxpw(Fkn3-T#Av7uqu_1szRph#JQPZ{?x`@Q6!2pj^!(G^+26@UW5)bzsOypn+oULkdtn0?`+5U@)o|&It*E z6WovQ;KFd|Bra{=>IxVR;~Ik*Mqo%5!0(UOR~PAg_99d6KOB^qz*W&!ia=6J6h{h- zSwUl#Q0xMSTL;r=nF>s#=u|It%L2zZe3Gi55CdweqXWnQWK`d;^<%|(p@Sh)C&)&d zBC`b}XDNxHz;+11K?h-+{IOjV>;~~#RitS$DO7bws`r;*%}Lcm5{d~7K^qcv%AcHv zscpV2DZh64h(fAuCLxDWV5ZFkFTd0FVCwG~gp4##yiw0?IyPja9K~?m}lO zLS>`+)SxIx3;zJ$oknJ?3LjD!dWe=Fggx5LgvA}7y2OyH-~yA_I@@5%a=NtG5zN%5 zAWet_-a^PYs{w1^FmqzHd#dZm%LOau@3*_|bfZ`@HHt|J$TH4Bf>57g5ERmCa^^&m zimQhsx`?T7Iu&XZ6NAyVU^MEp8zU+P_|~Q8S};+{s9{;*STho#*SHq}wFkzy zo)ugH>_#~?ccMLL7)cfOC6Z|6gDSGk(pRu9qh}bJsU`4n@sXX71@VUwU>S;H_Zi~J z>4@}$W7uI|#$O{Z&XVOg91hET+aH4)oX@Y>N5)g${ zo;;Zpe)jG%s4}V764wP88K%N+Lm>=+;fA;{WB7??C0vjX;oz~KCctGa1fVAy*m*f2 z3j>_sVH=Hc9Nr%+EdWDKBCz#k-OlqZ-PLkKf{6bBuLyQvio~{f9$)f!)vME&SxM{b z7@poy8(^h%bkIHpMUZ%A2WBLEuy$@R3P6z{2E17*%euEr+3giIPm*$fcg1?&NSNnmAe z$HD?Yn`Cz$ECJ2Nod+qj4O)Z~*_B0-g;D)?0cxsyo(oSU@*CAjA-T@4)HwWFP!4m| zFt3&}4%uKuWTdESs%j<_GW!9R)q+KQKDWu_F@S@%)hsA-)` z?D%hueOg@3O=j&{21g4$m-Sa>KiE>IwpT1#WDuYa{giy@sq6<(>pdWk?OC;~2tBx8 zk3<2bm5+_pBL9>`@R_o(p#w6e|L%q!%mzvtvyTK5<`X z{#3g(QB_+0#w;D>Imjqd&6jD7h~8{8R>6H(5D)r4*E)s56n7u#s-!h?2q}jdN+=<+ z8HoVuTCP1rkI(#l)HyP#-H;#l%H)pY4To@)#bnOOMnzEP*DglRWYpU2YKY2k9muuq z!CYkkan7F@RO^_Vy6dzY=1`U&(mBRdDc(jRq*?(%-uqK48 z`P&dv_g$)5HplXLg3r5Ke4~xT?M|y(rC#!4mwr8$z}y4tal6C z0csyru?2w#!JOQ({OS5HT;a`@s$|Gh4I~XKmYXWc(|Lyo3l^y$cM@n&suISnbh-xW zQ(9HksPvzsmOC>lvcBM#pbPr;Tsb3L=VNDnt@U5#LydNzD4w-6SxqYRIxEbxsf)-2 zTBMsaRcWZ#C*pUMsnH!$lM-Jk7P7m=leur~PiI!8dANvcp z>n3NTGQWGa21!ywY8ljFeQ+NNz>o&Sj*>y#BP7{?H9$_Nj6!=z;$>!@O&e#}uZepS z-x<1JL*wv5qc8&s%IahqRx~R{Rym!Kh5!n^wl2yDrmQ+>sun440FgQYt44(hDC2Kw zu&K(S!N_IX8w18}B?#0e3`DP+gMrB>E039;HN8!U2A!JkVfyJ7XA~x@r4v*QI3CbY zq4#uOF8#DcTepgW%yOUs@#G?)Mx$bV&5-4!^eSl7*>Y7sYY>3$?VuqUb|ot>_ga=p zpWUq__@s9%sJjBnGo+PVHb-nGouTmxML-WHnVvFDaYkXWS^KLlOX}Us>UB8SsL#TU zMH3@(dE|sJ7$iKGWL1ChJ=77M7GJYIq-$oo;gMQ z{Xd^?qkLynkP;5XD~A>Vk!L`KFEuP(kx5fQHc9Q0Kid*LmSs-lI5-<&hO|w$2p0kD zqymT#5TNV{*oP?Rw5zJABrw{Uev=FGe~qRwnpT7ry)%Q6P0 zib}9l8wO<_ODeN40hxXj4^K!WlVfxSKtOp+mR>;PLp*!xJL;W3m&uU2uc8Amk2Vg9 z7-qg3{Z$106kw1JSRF(~_9%5&v-ZOjj5}j@*_@z4v?^rHCw4Rr+l2|S^<#r)?Zp~2 z-D8p*yA&$LiNWzrNR-HL83t~|;pSK`Db~7oO=!K{q@kFFB70?21X>m?p)$hZ6e7D9 z3Aqf*v$Neo1~8m@fwQq9!yt2jt@hOl^t$3mDChI~Tb$~ezu9`U`4m?KwQZ@LSG7*$ z!~WAr_>|WY(13ua?IX^s?0!Nn*K!P zBp$!RaQohiTGXXZRVnC*0=$Ej?WrBbPdI-#F~3dg9YTs{2$MB-$CfU;haRj5n7{>r zRT`D{Wd|+O(WE62E|4q{SLrL?mB|OW*Eu?-6O}mU78H@86it*e5LuOigkagrcU>lO=S|*x#%8bj28?Sj^a8p~Q&3JqkV6LYazD&f z)w+K_mPa7U>n_yT&{4+4mpGYR>bivwmj2tpBoC5*(zw>*aQn7qdb-bG2x){|c-3&n zY-_1fMh01cDo1fDbg9^YSO_4?0>F=aJ^=GHdZjc$F-G~n>NMTfDK4KzKpoahr+W|l zwKlE*297}@fz)8C5HL@Ui|gH6gKLR2?g9$2tFnYxof2e_2sm{tRoRq=J_3?H6V3Xc zJFoJmLB)JonF$U;Nf2tT<(71Cf@vb|6-XGKL$Ez>1L=I81YP7NX$6GKx|vjkWpvvJ z5Gz+#cJ)U>Hyy%9$`jpfg*e7@h^Z`LlEUSrzQkF*T!kv;eL^SUj~24<+E~Fh9o*|~ zldHmlbKS!&s8t&Q4|dL*>VQm@LXEgAs&O-qjUDcXLq+4S9h|T&MX6`*l~bKi2P^>1 z5d*GV_T1`7i@x)2t-vLgMofwgIRR9cQYZllx|SLNxo z6cFFHx{N4I5R88pw7s(QV#U<92H0Xy+sahUR}&cAla*$UGyV@6nQlO<8U_fI0pt>~ z^UrXh4;;nPK_kjIW|<0GLJE3#X{J?d(=;EDqBX@0O6MvTf; zra?+g3JnM6?9-cg5`)QIJg(J3%5si!ry)soB~?{$JTcGpuac3&wM${w0i0>L87B?> zB9sok#Q`Yeb3{y!nRNbJ3