From 1894faa7d28e4f71ac776a57700e3946b66239c9 Mon Sep 17 00:00:00 2001 From: Gabriel Windlin Date: Tue, 25 Nov 2025 12:07:37 +0100 Subject: [PATCH 1/8] Add official Kubernetes base manifests using ConfigMaps --- kubernetes/ingress.yaml | 28 +++++++ kubernetes/postgres.yaml | 93 +++++++++++++++++++++++ kubernetes/rallly-config.yaml | 21 +++++ kubernetes/rallly.yaml | 139 ++++++++++++++++++++++++++++++++++ kubernetes/secrets.yaml | 21 +++++ 5 files changed, 302 insertions(+) create mode 100644 kubernetes/ingress.yaml create mode 100644 kubernetes/postgres.yaml create mode 100644 kubernetes/rallly-config.yaml create mode 100644 kubernetes/rallly.yaml create mode 100644 kubernetes/secrets.yaml diff --git a/kubernetes/ingress.yaml b/kubernetes/ingress.yaml new file mode 100644 index 0000000..b58310c --- /dev/null +++ b/kubernetes/ingress.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: rallly + namespace: default + annotations: + # Example for cert-manager (uncomment if using) + # cert-manager.io/cluster-issuer: letsencrypt-prod + + # Example for NGINX ingress controller size limit + # nginx.ingress.kubernetes.io/proxy-body-size: "10m" +spec: + ingressClassName: nginx + rules: + - host: rallly.example.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: rallly + port: + number: 80 + tls: + - hosts: + - rallly.example.com + secretName: rallly-tls diff --git a/kubernetes/postgres.yaml b/kubernetes/postgres.yaml new file mode 100644 index 0000000..1961f16 --- /dev/null +++ b/kubernetes/postgres.yaml @@ -0,0 +1,93 @@ +# kubernetes/postgres.yaml +apiVersion: v1 +kind: Service +metadata: + name: postgres + namespace: default +spec: + ports: + - port: 5432 + selector: + app: postgres +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: postgres + namespace: default +spec: + selector: + matchLabels: + app: postgres + serviceName: "postgres" + replicas: 1 + template: + metadata: + labels: + app: postgres + spec: + securityContext: + # Run as standard Postgres user (UID 999) + fsGroup: 999 + runAsNonRoot: true + runAsUser: 999 + containers: + - name: postgres + image: postgres:15-alpine + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + env: + - name: POSTGRES_USER + valueFrom: + secretKeyRef: + name: rallly-secrets + key: POSTGRES_USER + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: rallly-secrets + key: POSTGRES_PASSWORD + - name: POSTGRES_DB + value: rallly + ports: + - containerPort: 5432 + name: postgres + # Health Probes + livenessProbe: + exec: + command: + - /bin/sh + - -c + - pg_isready -U rallly + initialDelaySeconds: 30 + periodSeconds: 10 + readinessProbe: + exec: + command: + - /bin/sh + - -c + - pg_isready -U rallly + initialDelaySeconds: 10 + periodSeconds: 5 + volumeMounts: + - name: postgres-data + mountPath: /var/lib/postgresql/data + resources: + limits: + cpu: "2" + memory: 2Gi + requests: + cpu: 500m + memory: 1Gi + volumeClaimTemplates: + - metadata: + name: postgres-data + spec: + accessModes: ["ReadWriteOnce"] + resources: + requests: + # Note: Adjust storage size based on your data retention needs. + storage: 1Gi diff --git a/kubernetes/rallly-config.yaml b/kubernetes/rallly-config.yaml new file mode 100644 index 0000000..edd96e2 --- /dev/null +++ b/kubernetes/rallly-config.yaml @@ -0,0 +1,21 @@ +# kubernetes/rallly-config.yaml +# Stores all non-secret configuration variables. +apiVersion: v1 +kind: ConfigMap +metadata: + name: rallly-config + namespace: default +data: + # Base URL for the application (must match Ingress host) + NEXT_PUBLIC_BASE_URL: "https://rallly.example.com" + + # Email Settings + SUPPORT_EMAIL: "admin@example.com" + EMAIL_LOGIN_ENABLED: "true" + # SECURITY: This allows ANY email to register. Restrict to "*@example.com" or specific emails for production. + ALLOWED_EMAILS: "*" + + # SMTP Settings (Credentials will be in the Secret file) + SMTP_HOST: "smtp.example.com" + SMTP_PORT: "587" + SMTP_SECURE: "false" diff --git a/kubernetes/rallly.yaml b/kubernetes/rallly.yaml new file mode 100644 index 0000000..af6fcd5 --- /dev/null +++ b/kubernetes/rallly.yaml @@ -0,0 +1,139 @@ +# kubernetes/rallly.yaml +apiVersion: v1 +kind: Service +metadata: + name: rallly + namespace: default +spec: + selector: + app: rallly + ports: + - protocol: TCP + port: 80 + targetPort: 3000 +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: rallly + namespace: default + labels: + app: rallly +spec: + # Note: For production, use replicas: 2 or more with a PodDisruptionBudget for HA. + replicas: 1 + selector: + matchLabels: + app: rallly + strategy: + type: RollingUpdate + template: + metadata: + labels: + app: rallly + spec: + securityContext: + fsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + containers: + - name: rallly + # Pinned version for stability (latest stable at time of refactoring) + image: lukevella/rallly:v4.5.4 + imagePullPolicy: IfNotPresent + ports: + - containerPort: 3000 + name: http + protocol: TCP + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + env: + # 1. Configuration (from ConfigMap) + - name: NEXT_PUBLIC_BASE_URL + valueFrom: + configMapKeyRef: + name: rallly-config + key: NEXT_PUBLIC_BASE_URL + - name: SUPPORT_EMAIL + valueFrom: + configMapKeyRef: + name: rallly-config + key: SUPPORT_EMAIL + - name: ALLOWED_EMAILS + valueFrom: + configMapKeyRef: + name: rallly-config + key: ALLOWED_EMAILS + - name: EMAIL_LOGIN_ENABLED + valueFrom: + configMapKeyRef: + name: rallly-config + key: EMAIL_LOGIN_ENABLED + - name: SMTP_HOST + valueFrom: + configMapKeyRef: + name: rallly-config + key: SMTP_HOST + - name: SMTP_PORT + valueFrom: + configMapKeyRef: + name: rallly-config + key: SMTP_PORT + - name: SMTP_SECURE + valueFrom: + configMapKeyRef: + name: rallly-config + key: SMTP_SECURE + + # 2. Secrets (from Secret) + - name: DATABASE_URL + valueFrom: + secretKeyRef: + name: rallly-secrets + key: DATABASE_URL + - name: SECRET_PASSWORD + valueFrom: + secretKeyRef: + name: rallly-secrets + key: SECRET_PASSWORD + - name: INITIAL_ADMIN_EMAIL + valueFrom: + secretKeyRef: + name: rallly-secrets + key: INITIAL_ADMIN_EMAIL + + # SMTP User/Password (optional usage) + # - name: SMTP_USER + # valueFrom: + # secretKeyRef: + # name: rallly-secrets + # key: SMTP_USER + # - name: SMTP_PASSWORD + # valueFrom: + # secretKeyRef: + # name: rallly-secrets + # key: SMTP_PASSWORD + + resources: + limits: + cpu: "1" + memory: 1Gi + requests: + cpu: 200m + memory: 512Mi + + livenessProbe: + httpGet: + path: / + port: 3000 + initialDelaySeconds: 30 + periodSeconds: 10 + readinessProbe: + httpGet: + path: / + port: 3000 + initialDelaySeconds: 30 + periodSeconds: 5 diff --git a/kubernetes/secrets.yaml b/kubernetes/secrets.yaml new file mode 100644 index 0000000..eb49b48 --- /dev/null +++ b/kubernetes/secrets.yaml @@ -0,0 +1,21 @@ +# kubernetes/secrets.yaml +apiVersion: v1 +kind: Secret +metadata: + name: rallly-secrets + namespace: default +type: Opaque +stringData: + # Database Connection String (postgres://user:password@service:port/db_name) + # IMPORTANT: The username/password here MUST match POSTGRES_USER/POSTGRES_PASSWORD below. + DATABASE_URL: "postgres://rallly:CHANGE_ME_PASSWORD@postgres:5432/rallly" + + # Random string for session encryption (generate with 'openssl rand -hex 32') + SECRET_PASSWORD: "CHANGE_ME_TO_A_LONG_RANDOM_STRING" + + # The email of the first admin user + INITIAL_ADMIN_EMAIL: "admin@example.com" + + # Database Credentials (used by the postgres StatefulSet) + POSTGRES_USER: "rallly" + POSTGRES_PASSWORD: "CHANGE_ME_PASSWORD" From cd0b94cbe919baf271d0eab7c3b960fa976a5b68 Mon Sep 17 00:00:00 2001 From: Gabriel Windlin Date: Fri, 28 Nov 2025 14:29:57 +0100 Subject: [PATCH 2/8] Addressing PR feedback: fix probes, image version, and add docs --- kubernetes/README.md | 46 +++++++++++++++++++++++++++++++++++++++ kubernetes/README.pdf | Bin 0 -> 72426 bytes kubernetes/ingress.yaml | 30 +++++++++++++------------ kubernetes/postgres.yaml | 14 +++++++----- kubernetes/rallly.yaml | 20 +++-------------- kubernetes/secrets.yaml | 3 +++ 6 files changed, 77 insertions(+), 36 deletions(-) create mode 100644 kubernetes/README.md create mode 100644 kubernetes/README.pdf diff --git a/kubernetes/README.md b/kubernetes/README.md new file mode 100644 index 0000000..3cd5c0d --- /dev/null +++ b/kubernetes/README.md @@ -0,0 +1,46 @@ +# Rallly Kubernetes Manifests + +This directory contains base Kubernetes manifests to self-host Rallly. It separates configuration (ConfigMaps) from sensitive data (Secrets) and uses a StatefulSet for the PostgreSQL database. + +## Prerequisites + +- A Kubernetes cluster. +- `kubectl` configured to talk to your cluster. +- An Ingress Controller (e.g., NGINX) installed. + +## Configuration + +1. **Secrets (`secrets.yaml`):** + - **Important:** Do not commit the `secrets.yaml` file with real credentials to version control. + - Update `POSTGRES_PASSWORD` and `SECRET_PASSWORD` (use `openssl rand -hex 32` to generate). + - Update `DATABASE_URL` to match your postgres password. + +2. **Config (`rallly-config.yaml`):** + - Update `NEXT_PUBLIC_BASE_URL` to match your domain. + - Configure your SMTP settings for emails. + +3. **Ingress (`ingress.yaml`):** + - Change `host: rallly.example.com` to your actual domain. + - Ensure `ingressClassName` matches your cluster's controller (default is set to `nginx`). + +## Deployment Order + +Apply the manifests in the following order to ensure dependencies are met: + +```bash +# 1. Apply Secrets and Config first +kubectl apply -f secrets.yaml +kubectl apply -f rallly-config.yaml + +# 2. Apply Database (StatefulSet) +kubectl apply -f postgres.yaml + +# 3. Apply Application (Deployment) +kubectl apply -f rallly.yaml + +# 4. Apply Ingress +kubectl apply -f ingress.yaml + +# 5. Check that the pods are running - should show '1/1 Running' for each pod. +kubectl get pods +``` diff --git a/kubernetes/README.pdf b/kubernetes/README.pdf new file mode 100644 index 0000000000000000000000000000000000000000..8e44d78a953e9f2357e73fc2a12e97d327e74719 GIT binary patch literal 72426 zcmb?@1y~hZ_dXyU(jj?7LXbK%NT+m*bPI>>E=3wax>0EmLAo0O=@e1>EE-WS|&SYhLj}Dbt)ZWCv(Z(KdU(UuIWNB%@%)!J0 z(7yi!2z&^T1z9_}0$jN{^*GtJ=>WpEww5O9CWbN~M`jK-E+#fka7CF%s&cXn085aC z2|&`s$ifC(@sWvvv89QFgQ%Ikjg<*Ake!u@<@z5$#o(!dJ?O{H;D;;P+Za0;nSh_J zVgWK>1}g%v0@wZv7Rbh0%)k+>ffz3<3o8c@$jS|5W94CCdBDO#3;qGule01YeH8%# zR1<6C>jq)_yJ3tB06RAYim`4nxJk&Pd+|BXvKIynRIBo^kX%~De8Q$2(<#T%ZQE;Wv=c+Pd zx8wEY_a!bL5{j!+A3g7Vy{jXN%dh=Dr*9n}kjr#Q$~i)Xu0yz?Q=!XvZ*MWmb!Du0Sl zV3vHJ6_9od*J1N6UpTpntblm-M?52s455r##ggtFxR9Kmk6%oYBvT zPb}!Ze?58GOqh-R;Op)xHH%H6-fY6^9x`9R%=sIBxCr)Iw~JNkc={Hin0{Hh!YK3v zk+JvqdS9!n%UZuB47I>2sn}BADiV88y$I(=srg{0+~mCapfy&TFDS(9Zrhx2rdTMj zg4N`8)Ksc+7e-lI*^CFA6%K}zz?N9X@wwpLD@nvw7aM9!~o5(Vx+<40eqz#zHEU+n!N-~ zTFs~HiE+UDul0JIHv~$HPtIXJ-%lxP`CJfSA?p`Bxza?Yh_%c^!@AFc`@WizzB%Rd zh)JK7xeoi)>XJ|0d3X1qMJML@Y~$5rM{H-QT>AL(7~RreKPFsR=dImeJFRzpK+@G% zjJ_w!+YR0XZLTPW-dEGzHVwTISmd)8-JukAgco}EBeolSPTo5JueNrluiST69|5aK zyIT1h&bA|FdE)ViF#WUa`+%3umCD*Totk{D_^7{S1L^8+qkq^=_~>_-CSP8x#zBu zb$z*QWcrYG{bNSO7a6yXCYOaTwbV0_UhW;8n@Tg)sqr6A$?tCIHiQ)&c5`_J(Vv}a ztJWu!yU_|RE_yUSbY|OS4L2bkFRqQwwLU4 zEO>PgID2`>rRR0J-*_?nZTs@%>f&UV;&RF7vZG_$`{)hPlHr#uY1e(110$3M+OQ7| z6OSAoHv43xFGh$0p;v1z%TL zp=kNfR#r^veZHtG?G}}Hwd*J%Gdu5XwPZH(>P#OWV`tA(B&^zGm|{M84S(kG;X$E( zA+w~wNBEhsU>EU=n4GAZ+P10hwsfX07l?-$Ch_jlf{WqovuP`>IA1LWmYF#+XQr1j zQp3rOoYm{zlf4yp|MqYzx8;Lr?wVn?0+Ft-gdT;!=Z+)h2GX$4Tr~o4?^(p6JQVni z``bvh(F?-j%zHh*DanLKjt!%}{qXj9Z>N~7ul5Pw#lpNN^_QgFyD?F?O3@0<9ZjmI z9(>Qdi?Y~aw~Po@l=$6gh8`%p9rrLZf$GAJgUjB`u{lV+QxcWDl#y3rH?sW(x$%ZL&+V?Q~oO7dm)n6)fFT0%^mj+ z36$T5zM03iF942+=kD(Cy!bL9g|KToJ{m*l zMLa>=bD4##c0(Gv#lEmfTUME8OBka4=PqOsEI^Y6;LbhS%tSq$`Fvl#C;6hm*@Zpl z(c|gn;!AE{f;Hd=n=LnPCuITyK3n(+$pm6&XeGD~_{+x3+ni9j?8vF$xEAM? zhLnI1u09zj>*{DAm+`Ge$B%Pn@`wg}R=LD)sHZsH!inTJbAG7UC>X}DUC4Nl)UvE1 zmmRZzTHU!JlXl4--P4+(-O(>je%t9%bMdP}IfGuPcA6KXz1v}V=R(6*k+o#Ex_gCb zDc$@1;!OPlgw=E3D947s!FdOqAdw@Kj_w&IO!~?tAQ?Pj0k!NHJV#J!Hbyt}&m(ct zALh&L7C?UUrPEwbfRKm(M0@dI!y$4QEa)lS;zS(yp~_D>$X(ILRG{K6TH+BU0G%BS*+xK;6C-KZ@-0Vmni1Y`flUA4ewGioab}0r3#6bBoTkg>gG7B zW&EvQJ6}?a{!M5P9busfr)s|8hLdd-C3|1IJYU+dE~%t@DrDj@ z8e(!B&aJ@JiYD`~=5;`?0W{Bhl=xdGU*mehC~CeD3nqFaF4)B=9DXfyOBAZ|v`rML z@_dEf%kgcI$Jpq7EEb7Cr5lrBf!)$uH~K9S3fZN2S;6=z)bIi~dZL4`RQ?22Q>@}K zMAaHWcU@wv(6spyhx3v4hQ$bT*(h81Sj#3`%;7z48hWTvmT}Y{j)qM<2%#tuwwBf( zG)|PJ`9^I^XSQ(1HawCP5U;I7O1<-1pu3DA{Xyh5Dnmb=@g9eJgQR~9x0}It`K8Dr zoXJaAVw!m;`d~|9mPD}%bQYRg%$~j(7P+$bQ@%VT-}H|;C2VnGkho()Zu9jUqw9v8 z!bChCeYTz)-tW-f@i>8?CwkrQ8NX!kOcZm6t?_F#I)DnkeW$~&{cA-0;-|@NM za&tUIg-guz!?mq&n^|AO^>-^m3(}9t-=Xif$}D;}lq1%Trk_2qb9q3xEx3vn;?aQZ zRZi@Ia@1Aoy~5&*kf5dIrsA=!J8_z|z*aYiSW-(Yc^a}K`|=jKgkyGl&WfyDN>c?w zN*)MsTc%5Mn9VXfoA!~n-1&13t3nVA6|H_Y&C`brRp{8%ZeGVp3LnBQP=g!zkrZJ) zX@!v6Dc)dk;t0{`5BM4+c*1P4NWpPFSLP!9cwpokx(Y0bB4p1Fh-|q>q|(~?ee4K< z+>=`vILa3Aff6{X7n!j38hpgWGJ-YC|3-MMHt+3wkCrI=wE5_H3rkzeRb@JhEE3wF z$6(SNznNPX?nJJA#PY^#N)~#&1MJu|SeE-{wtS-~+_`IoA%T-T06YrUa&J-J^K&TgP@UnN+{~C~(3PS)LU-{Lh8^p$>N@UB*eX=B zG8*TS;XX~KCT;Gok>8cw4xh?!fOYUYT83?=VER1rdKq?xV$gqNni{)Gt*V$AQ>t_# z{o}})Nw%x<>*Dt-AFxAhUn?A?eNN!1r*gFJ98~Z_PTgsibGpEFIa{vH(W0N03RDo_ zKD2+}OCP>7{?2Mi*}d;W%0tG6k*V%-bXu~kczFvV8v*IXl$FV;cRtF_DSq20{7wz5 zjNbdxFA-i%r;Sw8m1j#n3N}CyVO?cCg*D(8XdK}#wn=BzzkH)_r+;;qH^3Wr5ZRjg zjh|wg?3s{2{YYDr<(e$@T;)JxOl;T+(cyP7oGHN<@;-=~u(=xXlE}-!#iNqFw*A7X)1q zE0`r`O8M(#*DY#UU%Twh)m)6{p&r&MBq|Q*L}&7=sUR+Vx$z!EoaD$mQt1^~`XcVQ z2}uHEVK_vv`)X;;Jx;dsSl+R%2PvqOxR~Ae#%K-5<}gKSFQ2(6^fC=Mm#hgF3CiJ1 z>e7a?H(OOOiF_QNb_gGNM(K{|oCtzF{=}YTiuls)O`#Z-YUPliv7>Vj`>mY!ZZOrd z#6B3!*+gdv!V)&YNgXNymAj?E?JTTkbk{|bBcSoVl;T80LaQ)orp}c(doc%E6kqX&uF3HxxuBpuJr-Xe(Mi*$Z zQa13>!(2gjHDx<+PYW#ls@GR~m}SxD1nHS~*zg&+sa9aL)khJS3f=kT&?%-K8iAMw zoMlML$?D6xgeeLw7pL=E2@6!Fboag#T3S}`dAoFs)yC&clWobwtDRT3UEoa<`W&x` ze{ler#1EV{4&L|nlvv54;}>~5v_(bnMq~^<{Ug$#a*iQVIz|ETBZ@AzReBWN?UV<6 zA|N>ZZ0?;8EoILfv$@}}^|PO{h1IT_Y6>xDz$9H!3ud!g%@xq0FIw06kH4vHg*ict z1+t&UE4PtK`zRWSyk)l8yCt^nw}DjhWJf{}rn;t~tvfs}7F z&wzX|Mm3TyXfG;~+~pOL${h9LTB#kfFxw7vhdh3rhHOK6#6SX5^1df%KxYAJ$9Op&eum)cs>?x+$ZzCbpn<9;RV#E|Uq@dxHtVcBQs)S@*ZGTZn|I ziS=IYA{3SfGj$%Xp0epVAl%cFB;LvY~0bMBskTC@e|ANtZ5QTm&w?$y~C;` z8E)Njm-rSbKrCG?DMo2RjC990&mS}u(lLeZ5#4b-dhJ7#>Lr0<4y?q0AfP*+l2FyXS)qRezVpg7H*Q^P+O7|nA-;I z3?IjZx=;)RUb(jbFqn}13+Zh9JEAa@pRW@l2JxPn)8|-zp7I_>6k}&1(+-d?Z216> z96U|SGM|ux71XZS5p!CXD2%PvpMV?Hi&7wwo@(mvsQt~~cpnZ8E=_L%3vov&y6iSt z1a3IpCsS=035mGgA(%Ug{-{^frE9MUV3RyCkz@ISBGIq}pAkK`OGxXyP^Q0x&8M0$ zG3?Axr<28SJD}$%9XxBQJ2){6a{GD<{V@+>>*vU4Xujx88mgMhD)g#$4dTahnJO}K z-T6KHq&v-uGG6NVAY@WLal@Xgkn(e(f~D^*i7R`%d=FhMKAn)xHYmBfyX<;VNc2Yq zM%hQ4@TctydBob(0aug+{QJJxaydp+|Mj_!Zk;Sns7wc7e~d@m42M z!BueYVD(uoU7z9HdCXmjPuGr6R)qhF&9zcPM_A`<@RgWHkU{t{uPE(HpeWD^CctH0 z5#tWWTcYRYEo=q&A1!kW=-~&nMw5+FnL4dy)Qu}&N^3OMy$m&X(2Jbr(Q)Z~&OUMO*A!GTdAOSqkva&UH%gx%#;h5s^sYs?-pomrtTyr9MK=obPT{xR zCJi#RlYSuwp?JAL*-WjWj7ge(UUIS^&UHoe!M#k~a>J}Hi7iPR&2eQkonEz#XU(o{ z#sd2sW1#~kJ4&e18+KwD$|+0rVtAfnJX908CdHBPHgnM!iMhDhNiBCLax;K;a9*yz zA^_n!!5OOo2dhb14+x1mKuJ&c%afYE5mx1R_*)%}^UG>WCaxG=*<2jMYaUIjLqZ$lpUES+U%FdN=jG)x;}- z+XWc9=+1czNhfQMn)(cSma*tbcS!IlU5SE7JnhyHv>%UFa-YD}3{EQGHbsun>Ej^E z4m*jm4I-utI|;IBq|FITJL{>BKbO6-jk6e`7g8=NEy#E*o^pEZbWA@hdSx9KJVHsk zb&x+QuNtdtzb*Q{^dOT!n9O|`2S5G&mf$Ob6d1&zc|SZ~bW|Og!7u@?W7wk+|6A$d zBBUmP(QiklZ8&vJzHnN8&d4j1zK=Yg&##CA3dv1_w%8qhGh_-m% z(%mEj?fh(Vd~_AHLvCTV1dR4Ws}#)kODh(Vddwb~*USMcLoLAxma9!{Pb$KC{m{_w z?z|P6dq7zT^y>*nEU_a=#l(ZL&d*oYqt!_xy)t@MF*l1)<|g^QEF(XU@vOZ3V&#ra zh`~|oZG_N=Qw*NvwMK!x{$!k$UTza5wIupqgl*4Yt$n`Sw(TBuUi^-cz+C4oCjW*N zW~RXU?qS3ipA%8aWes+MDlI=R;0dun!rf|%p4jtaMI%cI97mn@#or} z6;-eH_%!PMkfTCwnWQQh_2N15D;f>qNdQVEis)8|GXkpV)-;X3KG4cLKfo!!Z!gws zr>e1UZt5nM*Ba0vPWOeWJ2WH4*+`!v3!YR0C+jgElTo;`8o4m9o$Bi`IOQU26HKQI3oY! zQTCY(w$P6J(vSXhd?;xeCE64=Z)so!%4KfTV}npjSQ}mx()DpTqS;G*^t-@DUSME( zoNq@?^k7t(pMN`8*#INrrE*9r0b)9V70ElLklN6f_ocC`^a9AUG^hMtr9X~MX36;c z+HW8OFF(UN9j{D%z(95hj}L8$os25^cFOU-YmJ0)6Jncn(+9+U78Z;&VR$S)zXEnw z#6)ud>QLaT(UHtzMl)q2{S-Wjjj-XCpwwn_hGow6k}ujDAKoj~J+W+e)kCip+2GRw zFgNcz5@0r$9;>cm@rABetHI7?#(hg*>$hBCNAR>oPMxWIEH@$VcsbAWd`8@V62NJ> z(0R7IQ?W4EnCyD|z2wUyvZ?HenUKKBdN_eCtjLJ4Xj5@opNY9!pT>6F!b*5-f=gU+ z^)`bTCC9hEja6A$qB~xn3kBKPr)Xh}B`9%H8>Wz&>{GUXQmWty;Lwi6h(tz`9Oq7y zTzrt6`7|Y^UTfaCrh=Qt!&>hSJzs|yJ+V6{=;ME$-GHUTidx38_%31f%d0V39t6 zM(cPFr}&euVAzJS3;@x$#DS&gZTbeV2TP^vaa-8i97|1Yqmk-b> zw-osHlYL_$EUMw}+{068G67s@s4s7&D*9HdpJPc0VH(L&8`U-{`L)(nOkCe;^bGa>pE z=G_}|3uPZH)XFqMj%OSaL#xy1UW*QLo~D!=agZY$T=@!Xo)P5yKJVUIb#^$YG&{V7 zsUXjfqC5bNJbhHRd%cVaooM(JNaXuCiBWVki5)BCbK$d{vMwv^($B4lA_dlc2g^@# zo~RJ|)sBo{Z)&SZmRZQ@ELtg8fTj1Gu}K(B-|+DG=|m6r3zf}JGi0(wbNrr)%gvtJPl8r#zzoR^?d4bn7?N|ctmCV0fl`LvOdXE^h?Ce(wA>l{vBdy{I+ zUXAFv$?3dEsv)BPJR(jXS_2m7Wc=cB2X1xngC+mRySUZl^WX=JL=u{#U`I-5nw3jL z?wO5G<%vs)k!rjhWx}@F*ej){P1mtlqYNAeLnUJ~_>SxNef4AIoy(!`rVY!63<9}E zY2&aF`}TDmd%A*{aIm-QNr{y8sdW1YK;5srk`n?^I=bDc$&FW*%%UqEO?K1WzjH9Z zR274Gy3hDLe6<0YW(WK}fT9-l)RmKLLb#fPrCHK@;C5W|iw`n#r;;8(5(1~=Z)N20 zLa7t*FfdB~Ob)wh0XnGRCqyzKnHp#{3d3 zK+J%d07IhY+#BPhs=v>A8T8#rMNv_gYbkMXJYdo7;e)CrRczNHbNk&R3%6-rLM&KQ zKPm3`F|dhrB_&+xitf!<*M)B;#lw_W1U))X*XvrRyk%3CZ}#13L%<1KJTxV3{#{|i zBWI5{`#oE;8BKsg^9uFnlo4Z$kk_;}O%C;>LrMg<&$;`J+DFMC=Mf_kbJ*}{+&n4j~;qmEuF2-Qp}v)e&M6uf4Ld3{2sY-!CS9& zuhQKd7jsC(qh_n)U?jZg=wcyl;?O=XFgNhQNZz^>TfR(Ap$mshqvLE#>iYLi;CH;P z(eplxR_`#H3A@K{RgZ$kc}oXON-7w#EEH2xGQ~z$pQRMbtf@}(mA*1#`;>28aZH`h zKImME&oY=9T9GX0XH*s-K9X)wMo5$IICz-E(l%a`?e2Y-arNUPp2cikOq-=ZZ6-gbD67oM0K zb&=;7M5B=|9cgwiSi}uCcIZ8FlEK6yMK!++f|1kW9j6Lw23v)+3$M9x4PqErTpkT& zi;d-R736?e)9t%hLKRHnfcz9wWedvQ((TC3hTBOr<=I($XY7f@`UZ-pd~nBtISvd#J%1#YG`LVw4uYFa(S##>Y{DepSkdJy zDIkX|shj;`?J0#0=l#C06^fVMwPGY_DWjk=viB;u7@G5Y+*%xJIlCSyIzcOM-eRvv zTBwUf#fAaG12_)0pW2gT>B)Uhnvz(LR`pw^v~w=F%P-R)QsyK<^og+#XoH6kyIhSprnQ%lDvIX?BOooR~}kWF}zWC=?T`OyIRSV zSn7Rj-5hz#3{JNIS3QhThywaaU8V6jW^DawGTaZtbmh1O!N2r*++RO=BENGE3ibL5 zANJS{aq@F?XD>c%o|U}|yU-|m6|(f*c{)`f)(}>2;{C%tb##K3 z+?A36M7k#|8A$~y9)#&SleJ>>MSSHhcZuKcFm}6_3xKvoM!J<9-;ZUPF?I2}tkbNS z(A7MC5<>nis3H?2I5CvN-$o#{V+B(o6e?PtrHvcHc#^bZX-D+Yvb!@M z>xnhzN1o4XB?NL-to;^)Bf#yE>SVLAzG-bnC*9Cx`@Hf-v@w32vGlx^y*dIp@%V4$ zW?M-v8ll-DJ^PxDa-y$6I-yTX5=CnY#TOnlwGBBjP9z{^$n}3tm&2MvT&*E^nT{~l z72h}grhqER(~FU}!CRZPzOLGb*}2;4S^j0Ns+~1mhM=(%t!qD)~9_PwPCjJ2Y4hs>(I^w zM|s;>a7Dbpu{CiU99xSC;Mg*LrY4DFm?BfmVw^7R{jTM1(qc2cXu4E8!%&}nW#;F6 z!t9qUTHgupFRPFZd!fkA?W0W%mvI&I*Y*;$w~K{-o*VmOH4*KZdH3J;E zJ!7ng9^_ocKm=fK_6sEq@`dzOJJSYPv`^XoN}sIzZAzaN1BcSfk2vCz4?)FmIW|)* zMa%|I>l4Z}lMv2nMziaUWiJ`W<&}n2WgHapK&9Y@NFW??10~UQ50%Xz5oGrVE`jFY z<8oq6S**#D-C&Vnr^G)ZSZ5g`Ai*Q}zLS^Bt6kVTU}f{v&!4ejR^Y0%RG+3!I^)l- zb>GFD@~qKOnJIGI#(MTaCZTfDx^m;PoUxSl$bCB@!5Asff4h;X;tDTxa}samGMMX( zv!}9uYsQ*s1?2CDtSVr|1eiLltM-k1*Ja`$+&|Wfz^_Mqh_i{3KD>`VxOx(@;yAIO zCZmTe2C>o+`iry6wVTW;b8!S=rE^8z>?7z9-L z;_oSU>524w!3$w{IS3lXKr`RuVLGUZJdOfStxH3_!femjpItE3y}vtE2pheW;yOa$ zLC3XLI&)<(E46m3arUTRy-J-UP9#aqXqZSa+nm9_@?HDJ(%HScE~d=ZXmzR)S@F74 zxK7v8TMA*J4G7f&yOH~tf)dyoNhU6J$VvrIUo?0P(n}1%mqtaD1~K%D#4ffnPC9DGbBd|tN2K82)%#4K|o_S5nF&VbxE&Q#~W){6Y-6WHN z&lj-BIC2jg#)516~(J%LZI(moo#I-!rPY*2A)>&~2VogrC z`*AuzX`Q9F{jEZmU7f!x6^XEK8yVb2xPPxT27`}%*^ZkJyF;ErKp`@ctKv}U$z%BR zdr<^&v2OJIZUgrj9^mFa%`x1mj6+eywQ6Y_@iA!%+KA35DUh#<1g*;g>AT~q4P)XW z#jBU=_=4XDV>PPI4H}0{<=*UXt9AScV^&e z@f~@hjAg8xFeL}%&zW4$M^{Oj1fJdbV7x?vt{Z5Y2KyX_P&x70yFA-wT4Bt&dKII& z#r*N%k)2{>XX)(+oa?wv@^|n0*1vy05f9o7DQuXtY?}0X>P_IUL)WPLipV~E9kJTSj#(Q_;FE{yj@X+aSJ>afuCO<+|KFSgt>%5`&JeErDDZ8b z2i|9;E_(RYrzycuhXqFbW87PMZ$uHL6pR-+K~t1ZKW@q14cJYbAzjDYZHytt$39Limd)Z z>WMgbUg&3Rgq=ntG5`2%ZwtVqdyC1B$`4xtm&%5r`-7ix0yaFJ1ihwGxNynmnn!$( zypx5wgmJ#2@{-OF7I^zL5{&0_ZIDmMv4_-bj8{KWiU&r9mbY>_J0xD1SUsukNoT?p zDttU*lHTP+uAxua>qKs)-_k!CQX?x@-Iva!Vw_g~>CHyZTdpUf%U-VfjP8U9qpt22 zX1*cA=$-_9KFRSC5|e9)Pl4P&U|UXnXh$YoRiW)qdbaO zlhj)fOKMBOra7@g4vR&tG2sx4$@@+7Qe^*JdQAT506@DZfk9^|rywYese zog3mBc|YP53|nLJ@a`*poo5#nN@LdKz_j1#K|-Q&ypme@DT-pZj)oI#Rprm)M~gO zSWgKA#D=Wr2+Z*KzK!`MO+{*XIpcGF(Tj(Dtjy1!JvzX9!>F-WXlBva4N9Ka>Z+rn zI1jB*yilqLv3lk=$*8*hZR?DtY7%yBbFnbli-`0fbnc7U%p3qFk33E%=HWzU)K@q(R`1Q_; zpCPB~BYZfPsI}f=dBULJkkfuFl|1#J;0hF-yV=TxSSoa31&bz`{#WP^+EjD7JTn@F zoc)zjOCDA8fgx0j$U5q|hV@`L>0lX_kThF&u?2lffR$0rZhmUusy|JSyz|`NKS8l< zPUAZ&F!6fs#wiHQH6F6eMFt|W4wnz(8LYm&^y<%wU_v@W4x;O~uO+9*qv@voBv4Q) ziJ6odH%=eWf9DmIb4ASCnx@1p`>svy7vZH+C`t&1A*G2ZgYZTnrJGV+y)4=6B$-%h zLfLH*Z_RzDXgXt_cH^h_8ltSpu?_l;r{1-q5YBsd z=jB%y0J;Wa>3nzM9P{F}x2f4HU2g*Kh`cw-*kA|0kM@AyM+3m`qrvo*`dz&AEbc^t zRULSEu9021=NMF&X*_E1w+oWAwY~l0%`(35l3~HpzQ_fcCGs1tP%QPF(v`-emz&Ui zJOSRlUx&wtkaht&7Ne4iHKj;SW6#;DaAMKeV@$QneeSuuG9;KoE3^E5P`*Fzus@D3 z^Qndi?F26cx*3Y;3s}bL`yRcB{)H$Xkax68T2QQrki=2}K_9xDd$qnU`?mMus;y3R z#Ce)n7A3P1m%_cp5jNqOvZUnI=_hp3;5U9{A z;_t(wm-u9#?FxLzT30|pwCbp5>}&LDTiGn6_5-OdO1FS^eTD`CdZID?O+7;A?546)jDg`u1)d^c#}Obi$X) zr6!m35mO{;Q=Wr-qMUgW4r#68{l;B}oO$AMz^9_Z8bf_V_cr?r89;(MDrxM6rSI(V z3iu<;#_C?@-s52-59aKqUVc(yp|Izj9&XJ_Ly_LA{E|*G{iQ4}wfsnAbdq&~^U&Q3 z3-p~6;ueo8$x?B*3aXQZDqVvX=5g8&@7(CoEwW2lygNOFm6PuJiE%`yl`zZnVQ3C* zkRIe}@U0}V`Fud=J8xFbck|VZ5g@U|tb%!<=G~m+q^*AhfZcgTM{i3Nd%udblRU+N z9>w#CQ}yXZ)am|ue{>7oi7DP^*^tt9cHZR|sN*J4;XH0qm(h+rQm@W)27$Dyk1nGt zdYU%`LEWUim(k8WgE73IR??pOXwIHu27XX$O5`Wz;TG-|LfQbk7ex;=Lxu2a;_UrT zo|LpjTHU=RM&_1i-__ph1RHmbYo&^%zo&4UO&WvY#FTcvXE4eqT|7^AXz?`}%S$(# z{6G*b2M*)w-d~@>in=;h0z9r82m0q0}ZoIa?WLTY_SUYl#@}Xevtf6q`3gQZhT|HZITL@aJ zv3VU|>e03XaS0G4n9B3V$r1aMw~$(>X7vyZT;QNSXQeD-WqxY2jNk z+e8{jZUl_>&MUzH6dOV1ojl1$@KhPhff>>4^B%{0(M80{+gl|rjpS+jYo6h;!`PbJ z{F+!~NUe_a`iFU3t}=0^)iG>VZM-Iu{cR;n$L~vn_Sa3ZYmrh}C_`kUiw1bfzPaUn zu2z+^tWC6bcu&S>C+Ja)k?nc^u#|Crmh=9XrzI}Mue}6ZD5|P--tDQZtvbI8IU_Aqmpn1U;eym zaVnJyvmT=E>?qagWk$sl#tDZ*5~2L9KKSlSvT4D?;kAzP2b#+VOKtDo7xbjpI{Ticv{O3VBtQ~!+O79qK5fvT; zsCoj(#&$!w&AyXdb`uVG8$i!(7x_NBF9AU*hMMe zG;3gEh&nlk<2sBAPpi5ut~Zb;Qh=?}E=_CPB10C!I-NJgv^UMmls-C=$cfa?u3N~7 zg0i`fhCH~%VKDhnma+3C-M}#?|Kzd!p>QzfcrS%sfQeEJ=OyptRL-_uxEMY$l2t#y zvdgpK47Sb94YNGZ)?~T|^NF~1lHNufOl9njcO`rk(vZvO=#wGJf z6sOvn+9Kt~M#Z|xk`FrXro)XIAJ_K!yD-mM?3lVy_3Bbp&K8f(X(h{>ef>yFK^|jO z(eX7|W@CzQ-ur77Lu}4W{pMJGzj>gI^M=*S^xFiN@QMY~L8kg= zFU1=R#+N&+Q1^6enH$c{j~ZEOuiUJ2&%SSz*K;*+J)ZXJJ+B9p8y_tRul3bjYCa$N zkZNABG1Fiq$Tm~RKGl~s30t!{j&Wol+Icwhsd%CJnBPM&z$b8oYOB#)@hvUYF5x#^2oim`P(ILcf=7&EU%jK`V~@O zHP`O-p3xuMF@NkHW&L|&sH&T-34mGAz!bcNQ`yA9#>w8u!~p=_ZwubeYNTS~2+)G; zWMx)0adiYROId*{iu^c={y0kMpfZcQI!dZIUhi)O-zv!lxZa%JRD3sKpr0OjqJdiGcX`g@Y77J9UTCWjjLcND&W1XMvjUG_K>UK4X~;Ph7JH` z74XJg$Ta})x>c@`{%9n~-+ygB{!c48T#I%BYXaUjD+4li0BAvO(}BA0TBo1xyLq&@ zrHK_7#`QK`>zga!M+1OA+CtG301*V13IIY0yDt8nut#7VU@4GRhTIEjQ78e|t@%3v zKco3!1!y#^P{OW@et>=EnFXdq9A zGB7LDChD6o_?@9xf0zdv4S1vTU)};K{v8@wscST>*W0MU-Y5frJRKU%AGr`AW z*tFOntq<-qpbhXx?)59NKq%INl>g2GU=FgeHof){w*Qd27Npsg0T2zr2Z+l-L;SZ` zg77lik4{+za0BvhJFx!|6SDt;34u^l2r2)+smT5xI)p%gay0gTQ|Twy_)8A7+XFeE z6#OH%W&ee10HLT0QvN#y{}r1S`whDSIiak`{zv}%OO>IB3{w6(kT*oe{(~@N09rS8 z1wdL}8F14G00<~(wq^gLaA1c7)X#hbgd!x4KVmnIU$7f1RJH^u|DDc18|D|-v>7V1*7pjz8**eyK8a`2Cx-{|-M0s{?L)902h- zWx$R30UQuU0^GC=0D=@cCOQ8oujYU}=pXG16_cEQ+{B*`Q()QvQFo)~~Q> zK>&ffJ?NO^{G%@GS7Ow)2jrITt8fc3^X!UnmL$biXdt|K}ItSdi z75JU@`ZWP69w9Y9MtB4A?{0wWkHUfL7a1HI6vJ};5&LufK=l&?K=BEr{CB$j zWYu3`(}Dm3Ta_Eys@LZKpTx35y^25{`#Whj48ZlDgjEaD?Ezd6XM~3LZymtT zT0=UdpE;Qwibc8pEo%P>j|<{xP!95Mi57&A{&p~}8#@3X5B|wh|1EvFK?21@H&Fn% zX*#GD;{Kz4hWi)&3_BEsbN?HzpW2)I7ikqcR9Xco|D8MhEbSNAv><@Mc{Frd#r;Qt z^-GnZ=n_)?JCJ`f5%=F|KBU=|0XHoGfFOdlFQn%0ghH5z>qibD1GoYCx1(|Yk>7Lw z%I~4bmgkSCoBIbUXeMHZO3EPRztin!tNsF;76cI3s$5Wx%=2%t^{-;tq39CQB)xvMIqV)AZVa1%JWBk1J5t|1`a5q1nIDTD+$~?Lrt`3-6ZdTn=TV@gB401kmZk90m$-$p`p2p11cxG zsqj01{~Wu$L7@CMH3M1xhzWo!zoG&tI=!jzJ4pYW4}t*r3DF<136SMibOOblK$brW z{9nrBgd#g2%e4dlPQ#!0>DTh0(l{W?A5qD#W%# zWVwzpW$+9-Bx3*{Z%FyZ7q741e1l>P|%x{FV^Par z`2G`9k3l9bCiaTsNQ^I|N0~F*TSJA7FrLe zF6`!`??3=}`3)B*c!|$%J`B&v&I;~Wp}q_6;bE&i<~FS*xYpPlC7+GjXtfwFt1f=7wOBb%IyJckry2)9}70{a|?t`c2)v%m2-#VZXl5rB8R` zIZVtPF;%AI;TTuy=*)fC6?~Z0;MJauz?q>d#DUpcu152DZdON?mFGNwdem2To`-D* zu3le5eHYZ;WUh!kwI&d{Do=1WqY0Z&!)FwHcDaW00Uj9(!##(*xTuF zDvHgvXpJr1Fkac2$gIdXJtcbqbKhTy_>%rV;@&bkj$q5y6f-k3GlRt}SzVQN$cm^{tM+&H(fa^aIBs))*c=D% ziTn1ONU)2F$zV?Z@mtpgrg2f$Cn^W*oqqLuNlw_~d$>Tcw|Ytq+M6&!kPLMtNyGek zY%Y*Z05mPU20gwA>H}~kQ|xHOL@M2WSe15zyGbFYz3{60TEx8jZCq&hDxJ-Z#*TdtS19G?qUYXu+*)Fbu5Chv?F)EYp8A6IY2}xYg4%z?7CYS`*mkhH@vGqs?ew1Zw*{?X%8ls z!m0&EIv^5^mnjhd0e>jY45jiFC5uvD$9%0yeoX{^{U)`6ul0hKqCdsrvY|$y>f-v2 zgZfUGqTLz-+e-8{_160p+uQwsfmQ9YI%((bnfH)sSd=%q+Q;Ej^FEBf0n-D&CgWY2 z)_oOng7L7vN26{0^59vg4_(GELT>kn*1kF^?c(h0cgx(;D=$!Af0F3+Gt;m!O5(9N zCpPW$oYdRG{(L7(&k!x=RJVkEeNHWEBRc1b{4x6@Du?WkR^VQM_Ym3m%O_8X5AM~W zg)sLAnFQq-NK1?r@8B;9wxdg-!Qz*d5txr>C7pd3* z*qJK?J2U7zh3JgGcw;Uo&LMN`-pIC;^P^PePwt6~jzelTl0Y}nnJB0=Bym`Z*+54d zZEaa?ZFy~Nd%jP-CEz5vxSFKCRER2`dChue4+p0?jPGcgyLQ z^ceFW8YiAV5$YB}oFw08`v`tSDCPSozU1HfHhg5Y>%ZeaKsF<<_l!CpWR1L(wx zFkp)`rAv*RSzn7fGr>I+jRKAJ6O0A@eLJak@VB+WnoNnDOW;sJ93}cZXxP)F9AS!- zxZ#!7$lNLKJ!mG-Mb4H05ePC?zmlOukXi~oS{3EwZP_H>LgnQ5FLa|*15KI%zZSHo<33*ohdfdPE%z4Yx~rb6tea`*Y2iXYBmD6LXt?>5SJLR6i~}5Z=q?ZlJueP>RiFrdIZ|6SScW0#p7D} z&&czh4;D%?F?=>k;f6FW9j#DGPZo1Wi@s%F^ixxCG>6(>Op0kI#^K~FW%r80`2qum zq#ryYQo>7orJ_^PKI(CC7+It9H{zM=a?M-$;+HVya9YkB`6kAr13*VB0Uto+hl9$$ zi!lwbn1*k%nInEVLuQx&LFkH94m3U@ zK~CFr!X629C6v5%;;VMOL*bi>bj{9*u|Cvzd6*jzNt|wcAAsrXhwlpE1Rm0ZQY}6yI2y;t}R~7469a$6Y7#ukacdLk>#Izlm zQNNg8yzdPttQObq|5+g{rSw^m^7l@^IzNK`)5PA(Uoe)#3DHejwJ<$2^SwUi@GcdtIDuxh!V%DH^P9vDJ9GYZJak zPZGnqWQy+ON{OpfoILA#=!sUmI-?~sstvc#v_Yt!sC=APANH-)Z`x=2SCg{+G)JQJ z@tT!Imev*N{*k1~T7Tzcn8%m?&i7>@ZgPsX{x@dQ@ofYPhi4<6_;F3l!*zHB&ZlEX2FO-CCc{;d0Z&5`wkD)m_A2K*z6lQ8+0K@OT%{iokuutGGZ-$;-!~Hvt#%96+3D-ETxmwb?+d4Xh?+UE zjUI>&jsFnUGHH*U8a+-QI>_Bjw0t`4B$_3as|*Zo`>N%=Lel<2c~Ml0O9a}a^_IC> z2LXl{L>P)XE_=ds?$x^JXQ%TbMtZR$d1^z*<|@G<&(e2~0Pf9#rwFkSO!w+E1uA3B z^gThAeAiR{yUs~hE8*%)+E$$HuepBj8-q@}{rP-H^t!=s)vgI-Y8yW=Ff(JzJ5P60 z^Q@5#2MI2v$RxU6m87az(MLJrSkVqU2(dPf@O=%~K4#i-*hmepFY@HIYR9+n^T1`# z(3qQNJ}juzQIR*1VD9XcO_6hi#&5Cp3WwEo!`8pYy$AYYUEye;7&F_ z^%dz{P&_M@?Vo-x4MsBlNNiXhG4i%pr12HUz$ebhZjhGCU`M^j#bdBuXB0knkO*#B z3VF$vxJSg&jGOOUKmF-5vmLt_@)B2T)KV?hm<`U?U{z%(0>(xN6Y>&P2X!C((`P{g z4BDusPSR|e-#C6E`yFH+7v>HWgfuJ&u!#V+{vlhSaD`OL==I%GG?=?2$BfGE;plaf z2Yh5Mlm*2A)-p=4slpiOOsVK__6`xlYz%7{64E8KfmRJ=Bvg=jOqe^V0OWzBUZ~wx zz!prcu1+-}pY8;GnnazFE0+P-i303Q0cxz)lB5-mWZJ;kjZJ3T4tq84!iR+ozipDZ zhyHvEWNLpwLkxMzj4#47+av)$ltLBZo=_IY;8|+bW6PPqPN7qpXtjw4`Dg^R*p3i` z=~azH^EZ#8bF04bUh-ktnbs`y*Kd#n_S+m$LbwhDG>F8Y2I?_1sk4sWDw&`}{jiKg zyWVP)1n#jjp@w{p0<`$kN_xmB&$Hp6++ER3$zAEm)3;28ci^tLRfW&X@}U+Xh!}iE zpq5;+HjhD#^uv3aC<}z@94MoFB#vkmeGxTc&G*rN`cisUK)+jzetgSV z`bn$61|@jyhohCDG}U)fH3*U@U@qByJ4o7UDDHIa_5AWvr*=LsCXIETXBTyQ``udu z#vcOjAMwV1-i{ykF%(;{?Y41zxT$O+}x0&|oAx>FEc{q9Gp8zOXSTR}0wS@w)G{cuVN#Sf<(8ly8nB@cVtdvD&@DE=qKJU7l+X^P@ zM-6;LOzFRj@i!;EAO4zfD!7h@m_gGPCT?6g{2BPhE0(N55C&1jF7sH;vO|?qQ#7eJ zzw5kuPLQtk(cd3h_IkY|(sVC(ktfnLF548iwFlHOm^|<#Vw53$OGXhin=2ZXML<&D zx{7ZqtdYa8s?*MAWp8V19r^WqiSvWW?au5Zc~0PCEfg)LvbN~ps`XT-N9V&GL;r+G zI}oxj^^(R!SXf+GR4kb+kr4=y*DZ9T0Om5GJEZNro$oa4OTOF2=C8H2VriFmT$a&W z`|dl&qV=mzIw`U(L-?s#(tv|M^Xc2b+mn`MjsW*==aVlJE5fF+Ux1Q_?7B3HsURCI z$y8L=9ac30*wy++cgaS?$w%^G?xp&w_j?T=w_iig=V9U<=j)}f$F+vn=SN*#kc-b@ zg+y#OyYpp*M2wHC*<;(0nR$)w_zSP0*I;G1RJK|LiDgbvpz2amyB;j1RIN6eaVM%7hjfLW9j+s z2s6ImraM=Bur>#iw9X(~tA|muL4il1x&0Kck78cb(I&}fWz$iTsZGJ?_^LzVU_%p8 zN+nNM)0SC2nJ3-u`~Dk#e|7$`YwLZkkMV7>T9;>+XJyXsSU{`k?W)Y@<;dn__bHvg z+5(8U-YG?GrK41g4C6LofTJvmEJSdQh-~zi!{L&)t00k$?Ti1)Haq=g=4uc-a#@k5 z>-@>#w|g7I#@jUW>5}~Us*8t!tfn99+HZ^#&GJp`90>NXV(lolBCcEbJcM4W_)ssM zLOBH^%PaG#{K~2~N%OiD;P6%Dz6w5^apQ%h|YkX(bYw z;gtxe%L_9D=}3)9SyjtuOjAt->??ogA?34zw4`e()s0PNK(*T|J2=l=G^Su2(z0~! zPfoY3RWBc#oj0+yG&gA?n^#!cx|X)#EzAk?#K`BY(WxW4J{8sIaidg2!$C&R$jIw! zN7sDgWMwfPueoHlLd4_u(1<^eW=DTSy(~X)*U(jXYT^tH8G5I6*Cc!eVt95q)J}NL z){#@piAFp4Mw2{DG;U5WD^{3^nGQh^6JN-RfkeT8PJ7qdV&nA6%iqz}`6X5T9G*L~ zoPNzqAZYoRqps||oVG;gF4nZT{mBKdjmf>TVO>{&+wbn)IQoGHCqv_E$t|VlV@Nv3 zmt1ABk6+`XpgZq&CmyuGK2V{@Ddn4$S1tXLj${-~MCt$ybOIYyLM4*rluSK#{Oz=H z>b6_*kNx%F3$Yk=f{C-=?MXFC>m!36TZ{3(MY^w(@wJ<;))w_R&*#6xe5p30$T@RZ zV?)Bqchqrg?F(kB+-$5SWYjRDAE68xgJ!|KujZFz!IjbM&*)oOC8qi+r{o-D zM)o7E-pjZc9qIu$V07*>*jhp}Y zksiAb1Gx8FIXw=X(tHSJN)O!wMLuNI+OYeTZ}HVo(Y5g{&%#KQb;@t|$1hn&SuyzP zu^S!-6UG+U+Y!GBPvnQEN8@F07k>#jrB(AsaHdY#r;_z#L_rg z7~s7jJ!ZW|Rzn5(lFM=2HqoXh<8b1nEW4(pLeH;oTN++m~vp%`p>s6^#dP21d`luz?Jf~-* zolr-A9-%}@7a7peUa-4((BZ%gx1}HS6n)n0>ihAS_qFJGtwf;1dM*ray^WQDd60F6 zpTm1cTzULt$|4Cn@AT5!kI%2H@hyG6i%&~SMO(|(=koW1IwQf_D-WOduh+*wA)l<< zl5-KXe6$^nEYH?3SwBNbVyW~g{AMw+;QYD#xdfvOk{GQ;l;y9|!b}}@ev`{9$9J4; zGFv8ucJQ|IjkbAJe$uBJCXZn#-vGKi+5 z#YfKiqvFg(vjmv$^LcbRK{uN7NZ0DDyi#71 zQnn*4z(}RK=W3GAV+;1#`Ke2%`ent|{wbPP1hd0V2j8pQ`o+un=<)C{CdQ1W=fmo) zjdWR{<#m;`plsoIQzUdkxhd))ZFQz4`Dt8AoIl>^@ZBka{LGO3sz&~9vjK76x7}~7eS<-L>W(C>nxNU`U}Yjvg2y|HCedEcarKvP$a+6r zC+XS%+*vMtP0d@k%I2AM>w@{gJLj?~QQlEeX0~ZzT%%X_kNBUJp_$nkGIfKhmUfct zO~{X!o+jcrk3(!s99@?luUKU0w7MPATopmhyXA59{L!M$;o>QkDn{8>E|F5@6+L&y zAup6)o;>ywtT{{E*p`Mf3PKS24Ry&$KC<=SGqaB`+@tYiV!m->F1lo3J8UPB`xvGT zK(R2RjQx-#%Zrjsn3Rv>1|OefBORr4pUFbrbk5k+mKLl4Ez>AN-}R)y+gG4dKZpr@ z)lOna{tYV)+tS*6`OD3D%C=%<8ZNDiPD(Xva{M#vC3ea6&~C+V2yP(^*9~22!rGXu z4Dna(5kaeAD9DrjO5cO}`Qmd6nIrecA^PjI*=J<8Ka=x zpvOkf-56~i{#^BR!nO;=&~=$z+nCbAYG*U;^%S|42y#uDCfTkVWLX^SH644tt7f8PSTTVm6c%~C_Iyw#1`4M9B^~6K)5JZ`IW-Al%H?@ zj|It(#^ax7(^#b_RXqs(dV;vGdCy6&@ohOM_Cf;yTaaYnxNn@xUNb|*^t|5Skecu$ zpJ=Nqh70x5$L1`jtK_J7|q<-=M4oj&i@;OZ&xqYxe)28q82rEHg>Xf0AxD;M^v?(p)DYWTj=i}t(?7!y|SU5Grh3AjS1kmjiI^opX|Ou z&c*;879hTHa04VCKo5UP^eo)0e^ew>TQz|E3W%2#F?5hLwKTT?9O7gKoFxTNs4R_z z?92hVmzntX+ z0T7>V0vM&Gi|5~JWlv|oK>w+%DVdsE0`9ga5tR@iqp~SLla_ZfF?F*1qf-C#G(e@Y z>z_o?euM{2FjbiFTGHwL7NsN9UWERNYS z^>r4$KU$`<-duk5Sv#4*L(eDVdHelo#~pK4a^tqnwNp`HL=pihG&Z%jxR=luv9H`p z=+yltF{Ai%{7T)^>N%+L`O~&eA4fMc{DTxRUAz9Q&V_sk(vFRSQf$*!beFYZ@H_!p z*y1r3DF$^zBfycj#UUhT(N!5;H6prQkhr_Q_h6RBIWaC72W0Iow5AzBKnei~oc{BQ z|07BN2aWh2YvkYN`kzS-Scm^_YeUQqkd*t+RQ|UWKri{vRc~SlSfhaT0uaHO{{ce) zri6;Us-5MZMBad@{8y#_*M<8p%*{UqUlwLgZop#upC$_@2j_nhd~IEDmtD8J?9G7U zzy#rLqyqCHut45={qw=TNfnYIZI?XDhNB2dkqIj0Q$>)Fe{D8lZ^n~o78xdtPG5`8 zSXiaFh~>HnLR)uQ%ceOZTThmAb8fz@ULR=M!z)>%xVS0qh;TO!?65ZzR3dbnbAF`U z;t9Q)@_yQI@7eTyf`{}6G6)&(6|yq;Y{sYjd z?;y8k{J;U?zzCY_vG6)V-3*0*m+{@;Bx_gtO=X2Wt)J+J4 zmc!#n$EW(Tg4h6*3grJCl`^Jia(OTZ!~h>CDJPZ3eP_X{?-R(v4wUL+w(Mo}eo%tZ z54ZQ4!v7_x?LH)=lVRNx=s5?7C`)b{zk)7W8t6?M=y~?%+iu&UfImLavB4g!c`SV+ z-y5MmB#}P2ATW}HD>@7?FdQNYA^{fy1kp8!512gYwt1D=HgEuFQ{@MLfoo16kPp|Z zh(E~m*y4|^(NF&lSIWR0q3@uf%;4|?7ymp)8x53Om{8&Yls zwnc0}kbG(6wQjhPfJRUZwN7WX@PhEMK#9OXcEGcdvTu+#YR!&%1u1`lov4@I49V{( z13g39M0t#`%tO^`+K^M^fpYzjhP=K;neX{B6$GZL0E)ZYZs*>3Q~Fr5ez9=}-kJHAgFGowDC*ObF*tpOK=#Pc_i zBzq!aA^iG5E!el&dJCxq=Xp=%PRlOK?ljC0UaHb5LC4A_p!_Elj^{7)M%u-AIe1@Z zjuW9Dc^8w*Or|+ya$NRbwb$(nOSf|ILJDT!Hzo+fAPpA9KkObjZfZ95n);BrK=@`v zw16aEPeae9D?=a3x`0A=YQ+JQ?C6+BZj$Pqkm| za-jZiKA@BW%a&{+tW>!M52yX9-=9>z@Td{?Hp)p8Qrd4z@9QQERbA70V(JrJC0NpZ zHwW&8Dwybh>HNgB)(gowV-iMw3qnAx{rTjQ8U*pIi+|XMc;uqt4@z`W3rq%d9O}sh zc~?s~=YWGj4A<`fSG>cU8OW9y6663k^^;_xmp2mv+D#CC;ip?^s9D@LUS`l<-1j@0 zXjCT9k{vur1!%-xx6%NL(tt0e0pd_1d@@3OGJ=b1>2qu4bGj9FIz^}u20&l(UY2jY zj^?{61`G)>wn;KWuv5RI(vM+2y39?L8WS;5=Tj(X5=*P1On*TDmSB@~Y8q2A+ORkqdF&!^J={J?e z&8j}U=xBL~dTtqVBE<$7Dc)<#K z8gbv@ufCN}>5JiYO5q8ucpYXE-n{6E)Nm9r3^0g18v;@n@opVW| z_6SP+TwYZu^f!;AZdMlZ&s3O_2!wLaCOPiZ#It>U!Lj0rdf^<*rPOIjEI4jn5o!n& zKED%1tyewh`#ZT)<6@+xr7gn`5h;}P!oS+klX#P$;<1WbF2JdTG>x4GD}j1| znov^eLfR=ETUC|ABTcAuzi5^{M3I50WWAA`j*vAg8IfXT|M;Ck6J0g;41?9-A_zK1 z{gJ%F*HEj}1j@2R`J|bti5g8gK@@iH6$>~VW2}y>sjg%vSk$(>OH?eMLzQ|Ca3v}G zZ0LK`mek~miZP>xT7~y`k|xh(%_iJUc!`X`Wx6NWU+>SCzjSp2YAW6l$U((!;zf%~ zspOdP3yi{Sxxa$c$q>I9lLlakrO+udFr|(#Jt*=cX=^2{)Hhq@$S`LGb**t_2!mM3 zCtwWml+kadt0=czC8)g2?whk-R8ZQ%skbDgQqfana;%ORVwu-mZqoF9$ zyYoO2treleFvf8hVU9S7>PO3$59$0cNo`Mp;}S7ERbv^^icKJ{q*r6XvzAVRo7SpH zK-SPMH-W3%$Tx|qq*rF4Sh7=P@vMZWc9Q#Ch&$zuiz~v3kXW^YRyOU=wYI&E;=tNu z!qUOzt$_auGxKw1cub1u}c6hG#Dpv4OKL!q*CEOihBk_z_Cv;!jnl z&d_HZ*RFIEjgGrJYri@8D*Jx^YL>7YTgXcsUCWiES2`NLmM6}(gP9jE8rnc9mhD0K zVdPU!E#ppu4N~o|Lh4!{Cn%NcZCR##nKZ9t^m9DF8n0t1_}E1y^n@WKFtYss>i{$f zvD5;ab-+T1*TtqxJh?ErsF=yN8&$S^_E<3pZ`@FtZP4he3zcJ53fQQ379tG!C{|?S zi=(BKn)wJmwN=(Jp}g#HJhAqy!odqn#b@Doda~cgYgfm2>6Bd5@*p!{@DV7oIiCBvmu2n}&ys?&A^2<&- z$)IL&m(n#!vO6Wp^@xn_-vwycjrGhI@qGGuGAD)))?u`bo~>^)b{9^Wmm~z}=4Gk@ zCNEp4Pkl9}ZaO=<3oTmaT5}JCP3XF{g@|kF^L)P7K6a5QGcoL^XM@1)ZhF4jp0Iphp`bri&eYVgblrf4qTW};$V5#+vJ`Fle{IVAaQICzu9+xLjXrds|S{MMg)4~=NoDrmC zKp(tCI>WsKQBDA=>xt*H_Gju0nc^~}>x{AjCfF@F@;s@c} z!AtE$b**PayhbAW$wkU-pdQYSqhb^tpOJi#t#*d7w<7aS3eS^MseBOdR0l@dE2Oyq zYjc{H$>4A4EQ=offNXxixOsJD-q5b*2fP&!sgUc4mreWd#d8hi-|TX)_u< z8ab0!GOTJ~R{QS4?yW^Zw``L9((*%hNSYpqIi9m`{OzX|F&+w73{xN(d@$WT@Gx@- z(;RxhS6q8)=og=dXm3ehU4=*7D0KKQJrD)6C#1zT2RZELux@ON@G7w&+LrC@X1F{@GS!wZFE@dq898qndLnj`80^X!e4|3^w z&=1>&$HQQG@TNEkgYmQdU(-ouTL$Vk-#Dh4 zp7m-g=`Y#x`hq7{?nPceQL$Z0Uz1^{L=<*xO=k zfdp?fp9cx0O#6bO`JER@Rkk6ui2J?W`!@)`>ijX&NIll-juUp;#bB6d_r30K zb%8Gr2SI!C0$%*l-*_L!tW7+x2O+b&>Tf|6qQ4WynNsZ8g5zSGqc@}zv% z7D|PP8Mo!go)!c3CPGSD{J}(Gw~!rKCa=a`QQoXKbmZ4|7Lfgd34x-|v&EvlhZrNl zAh7-{Xr(>zO5U0Jj`*0rzdS|f^H4iJ%jnhp{5)d3@iN5O^bD?1HAXMig0_E@29`}) z+yN4y3`^DhTf8oR^N20Nu5!u@5l_%*TQDn&jpy_fk9Mmms91tUI=OG`SW^~nC%}L) zbV2}`-6~%pw2S=l-qbyll=0D(28nZI#poiI(4J4$?7b)b7v#@N^8}Ec&mWl^ zUm93>1e4YENH=KVpS3m|Ee|wx5vLPPsRHR|Q39W+`smwT$PMg>qZZ=4n1!=*M!%&~ zet)ODR_1m31BuHfdL$cHD2y7M)D5Q)zXHq- zuuyAynnc108Nc^g@}NN`zov?_)1T)@-fG?MkGmqUu$YVtyEnsjBg@@^5+4>H_v*2D zA8T)@jNQ)zs69{K+_F&>1V?7x6JesgdPx4cg2mAzcT9E)4}Ez!__iTXZgn%Z&e{_b zJADyq^X*@w+|oLfY5QnnRa%n$%nxy=qc(Z@y)CYRH2K|p%SM{5R zdD4N2>%DO86FFB~5@zEtxs|NQMzE3M&NgZXIWu*>3c_mu4`&^z*6x1u-q01lew=$r z-ut*+%?c7R-KYwUy-bhclvhcHK(LK$`O$Q-=1ujMvPT(d18Ga{eR{A))56%~cNDiv zbK216W=C5C-~Q|26^NM7|9ON3OB11wO=M`1)r5ZNWRrUAfxjf`X4XCIm2k8u09X)9 zw@a3xqPuEZ)t8k$Quj_F9pkl1_z~-0i70E3p+)& zV=_p$(A$en-ogZTOx`(&=`m^akfshir-iqJZpSk+6w2-m!tC;F4-Iz;sXQsF&Z~3e zBd)`}cdqXyC_wB4%g3(?GYFDiz_Mm=rN z(-Nv?xz-9B8m9@bxW2Sm+US_Hr*hQ>N}d*l(XMM+#E`R2`DH9fJQ;`^Zb-7rLKhSCF0Y?B>87Y2A{jI_2t_J;pn`JUzW{wYU{2q1jee z>LI1MoLpDmTe0H<#|Qb1wdYr06qgKW30^3?<#7bZp~NxDLd`WNh~LPWZW-*;spHDQ z9f->hmEb?7Ub^a7byd3vYACgSA9U-H>z&$8ZavIA@7rIXOm28KbI#3+C4aLfp7-55 zwN)xS-9*&)XrhX}7M6R`_K#Dx{;GAZT%erJiu8kA_ocfd&VSF$RVHYtgY$HqNd}7Z z8>1Wxwrhtj6kxDD>x^qKRpP*z$847MOBE+2JScEW%Mxrkl?L7FC80Qt^17{DP3E~P z{=)h5KfNJZVjG7Ova+&X0AuCT-D?nq`8apJC_j>-N=m@nGS=?i!2pXoH*&MF-8tVw!nM}kNu%k4<`=TKpQ{2 zGkxnuWNH+Kv^H|!fwqWJ>40$q#y&O}RX+=#PaA18a=h(EgcrS9U8Q8Kncb%rSOsi; z*SA6$Cil#qd%@}6pbJp2m+v8{N7IZ$Ppd%h#9tDl&vMEj4lnH#C6Yn>7ogiArorC z-Fo%u8y zmO3&%g?k@9d$+Sj{`0*macj-@7-?$l^t`yf>ZPVL=l$ce?2}=>bPU!f$Oj5f#R?7$ zXqTD~{H9#KO$g=}s0G5$=HN()Ln!f}aO3W{4ovR? zas#G`hm!(|dPgQ~S5ljsc3rtp4GZQYY;XdfV{L(!w5NSLnRO=ABGXL z2-Xsh8=(eCn-C$vuM~F$yhvU{Q+-VC4Ib%b_*vMK-_3VVs;hCT6qopZA-ZAt41PZY zSy7cZ1a}Jc?g%(KV(Y!Evv>~+3ZOLDvV zUZ)MyHtRG?t9}D%?FVbV5<>%{tKSRgCFIVU2hCO136=|~w~_jWPy-8>$Fp01DJzLk zDS?6vC+dueEu^h(q)*C1m^li?POl+1^zDL%)ED*EFKR8Ke|0&yBkv!W zb`-%QB(NIkmf%JGigxck&c6FO;61);?`B^{?4IrRyXj!9Exb6dYHr8&24i{Zcf0S8 zyMlEI5YrD|ba)G<#8|&k?WH? z846?FO%e-*m5s5AY?@NuD7$|gb!F^swT+FB#l35GX);o7@_AI!cJqAYc!0k-wcRBn zs1>=Q#dA7)O?k(Pov_3%`Q~^dzR{-VzZ#vgZ?XUamHoaqu55g~^o>1~5E&6IkWtG_6l7(5Df>*@PeKVQ zMDGG08nZ41nG^QcBh=FnuCckSm|Dyc?8Q)n@fKg(I(PVejZ&=KL?#-yxR2)Y!M3;8n~&lRfIMLQu2^@S_x0828 z;ghR=Dfx9-_S4-6LVLF;8)0%GM8r9Wrud4up~ginR_x(t+W08`S_v~gg5iVMR4~fI z{VbU?=_&c8RI6IKYDr6;eePF%{)mpKYIrf0;w=GQ9dzxQC-=}&a4w@8K;%-4c;G|Ampz!Pmyw90o z`(Fia=Kt!t{zr`dcL3xcK*&Fk7UBPdv;de5R~y4W)XV>#YGGmj|3tL_)bD>%Er1Yl zCJxU3NVWXKtovWZ@jvn4{};vnKMo3@s{f67|5xSyza8AaiT(dSfGr$<4Ho_hwg4~` z7Jx$nE1>ev_UFL@fK*rkcLDHU7vPdh1lVN<0P-{Z zbuH!mYi#}pk^ulK0K|tK;CIdqaH8P+>ukUQuma!&IEium=?>tS@aG)Pzy1q=^SJ;Z z%wIHy0|2u8L1Wms0MyN2GzP%au(GiM3IO_r13(NXUvsMf%j4P8RfrroMKEqx}jQc4VG%)USbh z@|%yTFE`XB2SDV!gIv?*I zl{ls&u2w;!L10}-CBPGH$y=B11)Zk287=fwRaKFgPW8XVmRnQ$X!!tIG2%FeC_oUB4xu8G#1iKqN6nV3h|n;_T;~QwEQt#_`j^ge_Kxfg`N3t zSK$8|pZRMB@t^RSzpfJh`U&wb*Y!_)20+KL{lV$}2fqYPCT@VS(ZA25DlcdUongdDDrd*DFEgG-s=q1jNqXa!%&1_ zP4EE&E{P|&K3gD7eU<|)05&2A)FdIV*V@Rd#{?ru3FLG+a1yeh{&|X+195x>@;ptc zoH8|n`E?EG4aVP##??v69T5+BzX!C`>+t>sc6B-roJel-+u^UdvN{ekAYwXV#3ZKQo}Exo@)&Ex0fPQFCR^La8wbSxSQBqhwHnKMy01}#R#B}l zY3x>|*I$SC1itxJm%fT<1S5L%Z|S^j%6q)*WviPl>rL_+)kRzZ#R*Mjle~j@LZb+( zQ%hK~sVDSX5F`5^N_*y$DbXD6x4y&4$sr`PBybIJ_M5wp0#4@Bx?Wz z$rOr~?1*>dK%Fu9@ow)W5V+ozJ+yWGXt?UrBU7op`9XhGu>aZ^B{w5+QgAPSoHL{S zhW;y18w*7(#2$JJ#q_53+3`m9Mz&1wbnSLZl66jhME7>@cA8!{nPGfA*{}Ig!@KgR zDyQk=i@p11qNl+4Yg*O%qvg8((K7ax%7-;pSB$;<;C!$TOW(+HRjtvE3{JA-%40Ze zWU8QfBD$=&*r@4Q1iRseG~@x~fUR22pcN}FLCW+PwWq+)AeC(jE?GeyRsFh}YtdW8 zYXmGg)pz_Q+FFtxYIu2*7Wf?=z0G@9yXS5fdQUg`%#fVuyQ{%&7tqgcJF#jIUugUG zZ1s1_Gjt^8xAULf4-g;0(gg9b5WtcHCOr; ztKI^vseMe}+m7axh_q$=Qs3jORuLPT*KJob?lI^mHzzRW2~F(h*tHV7(&&5X%$Oq- z*WhP9&gn&w#W34P6n)~}eVSLO^rtcG7t|9^>F+jJ%-;f-`3YGGvyOuive--o#A9~- zaP}Ha8114=o9C|*rstn5BUJX3?|pA+d~+BQSvrAcxDaY+%_}eb4n+1mLWXW4c}^iL z@JOFd?jm0sxh?UW*ubwA zSNr5|w+4Q*Z#Ah~^k%EwWmU^ISGkT+cIl+4^B@=#*OHXCvZwS)HgjO;&p)J;(RNEH z=yNeYrwYZ6Jr)Yd&qacy#w~!D0_I!&=T{=p@hfBfbpXt-RFV(zG;tpD7_L*k(!z4Q{%;bZw&jwU_#TY`vLR{H_1{HAG<_;orS>-xI9L~Xg=O@nomctM#M#SnvTQIdEf@}YM5_03vE2m?x)0(P`j zdnX)Ts=`7Vl0mga=JfEd+0xN%RZP`Kx2SMeR&`uSp+>*FoY8kj zLe#hLvLMHt!@KGsRgB0%U%Jfe^2#7({P5uPDaR5FO%b|F)*hAStQPyDO#9*8Q)E|H z_97N-y6pRMnFCu6xhBVQ`V(0S6llhRZ)UL!OfrMm;@l0fs|A~iYJ+9vvkMPKbPh3R zD2J%wgDQdXf+U7kaSE7eJmq32LKG)fJ!7JNR*I&{7Iaf|TEUu4VarF-ObKu-{||F- z6&y*IZE1>`St({_W==6PrwPU#er@|x}3I~V_M?pgaeZpG;`GSZDBxFJ{OC&OKO=IYl=`*F;ajkjK&W1~>X?sPHn(Int|r-7)o`zpX`vTn)M&)Il!xbp&n*KePu~H zifm<-WD1p*C~PB&kF!269sMJjrDlJkE7d6O>v8V$@up76a$30wLeXYLnIcL~Y?-uF zVRSLE4D>bGNVz~F{jOhRg}|?HZRL#ZxS<7He)3n6sw(Qd*7mV7rbMl>o(|W|kk^<@ zFq%k&#@*u|iE}l>ong=m{vu~aq~o(*DM*GI6D1_@t9=a9QqAG3GcYYsG_&b!*osN| zG<0MN+k&JhJ5Zc0P$U)23*UasKz6f55IUV%w1Ws8&MgF|m3U^}Hp8YKa@ajQ0+u-?;Q;0tev9)9*h z)u`)nC3pGeK&Dou$X>ulFRos#&qQa$LWrZl6K87?6&|TwT(6t+--~J@ zw`zFg@?YXd#-#S@n(ln-`fSV@y?QkyJxT5DwKkorH3*v`zM!gj%KLmD@ioo47|sK#D$h78iwV6r?L|JQ(6Swe~F`iRjIg<6TbSY!By%W$sz# z?CMJ{!t3A7e^|6=Dlc9x#uA>bj+e3@4I4FLXdbC)CXOUu=RUJ3rl?%8HONuRi@F!L zh%Ks49T&ipX5jWXb&z{BPh3bDvUZd+QDtgH4`pDI2N)lkFM7Zcc31A9eQ(#U>czV@}#=F!R6;x6u zoyyQQUjhzj#oUm+$VU)oKgp5i(N=IYWsGR5o?)}v)r#M!kBvr^KFtD#{4HajU^BaG zKiZwcj-#f;AZBs>k6d%!!yKu>#Y<5qPaX$|KX{-HOpQ~k(%BJa`fE2_9P4yqDs$Cs%HLmMfDPwb{t$awvAED#x0%wk+W$C(6 z`zl8Wl@%M7O-lx`0{LY&g#wM62l^-TL0^5{>1Ts`8f{BE4>q@$`oEH$6y%Fo>SM>_ zbHA(qEX!z5U$quwtY&Fn}k2$ec2fR9=y|J}u z;%O`@oteuXuNSPi6ONKURQ(hr95sAZMUp$8t3xR=mFkm<&g{uHV?;83<3yw= zl)mNSO4xOBG|ZhDivXWyL4#@(n;wWD18gMOVW<@n#^!Zi~Ffym@R ze`;}W9sL@AV{+e~OyUtY!Ijt~P+b-=b}bRR4;ObRF@2q$`~7Ozoq(km?lJC2V%nEX z-0^Ybft3k6cQhe;XAE}?o4=s!=I5}xJhnc>+rnQHB$05vHF;*H!_6E>OxI_Ua1GqO zE_#zRnKV9CN`!p2AKty9L`e8+rll+3bT#*CLJGZnz`am-f`ZVR!z|xrDZvn0pX8j3jOf}wyNz@s~-NjpaBQgH@ZnWa?P|~#CyJzqm&GEmrhtOF-q|g zxPcdMd8*~s8ltsMUnX;ZySjRNyQ-C?rLC^2s$La%y@qvKbX5qqHX!81UqUFF?;H&q z4?+JZHHnZTHLtPEZ!BZuoLZmE zX7i~A4BZsC_ilT%yxHUQQE{9LTE!zG2JVn2q>s|YiXfRw5hqVCM1b%Fh%|V?@N(?| z(tZ7{nPcl$6odv8G7s6LZ(loyn454~i|j#~<9b11BMZWCU?ZTIA&`^9?GQx$x4b$e)e1k&GDthc@{-*onIkShj>(`Mb4gauxa zhrF(+dKMRZ*1?b9`v2U>xV|bMtWE1=Q;}o8dd6E~r z8tTe?CjyR+pUzXpJ_Gd^*O>CzABMj!aMh%I-(Jf2l~s6kRiG@Z8-RKOc$4jUHXtJ3 zLXqh?6<*i{sTx!E(+CmO^12a_#3icq#f`V04)w6Ug0{xG9A6Ul2JXL~Hyv%guMSGj z_}x~tTm@mVqa4HU8)<7mh7c+lWYndudwYXVjfp0jlJzFvCDdJy7(U%z?`!!Tja~t) zTP`xL;*mW`9yuCXutr$ZdnBcgyUKqFa%PHCHXuiMh7+nGLG5CZh6j?;ZvkHoQ$M7p zrF7zkxJCt2E19g|X4!&T6RuabgraGZzv+G6TGG3C)JTcHT#=?n9M}8qXa~HZIlHD^|JW0#$A9R7stmoj6NwugJX5mTKm_gB(+@myS1mfcGFYO# zwpJCI>f7A9Z5s16(oQ)(XU0njrRGUY%hs9HLwwls>TyLZ3tom(eyA?UJtSpd+6Vzu zV1&R^E&P{SBs6cWVcqUjQ+_zwn6}S4ROrK*!Tf=9lHjh4)!B;ZuC>+L3Mh++NJJ0` zN$Uzj4(~&WNRvLV%d2!#!*Z_2zBS6alNZG&0O z?S1m=H(IVg(Ts#vnT}ouepll|cxKAdkf=9fJtN04Nm05Zu4bPB#joVzo-6`PN9$sC z`9QYL!P+&!k-Xmyer++6j%91I8~sou+IB?ij9RA@4A_0tbP8{~uAoDZ{loi~_SMl^ zc8L@9bu%g9?e6`B)N^wYdxIB}VVAf%sh{NZG1p%^DT^dyW~UU=8wG)H#w(g%LQDp- z)f&u1@*1S%)U_JUf_^|BrurS!BA(q&wT9>H^fc>4TrGGcJf_%s*6i=W-rTq{nF_ zn$7w`{QHo8mZ%SdCRL#X5t6`n0FpOZd4856yIt%2*>s=J{{5~ zcGh~dAXV#{F*N<|DpZk_#2DQLdr-2;JZlSDHr1KM+TvdBT-+a50W^}WiSyGxeKiMy zG%t1;sR?1PLJAPGkjL<>L`b&RT{eM&qgZ5zD7?J%5ze~jgsi4jba)R7cCf?qEWO;4H6B_7gwXokzi7!RmN2H=Xg@G zt1y&gFE2*-!~0hPtQF_JiC2jo>iIb_Kl~ZG6X6ShuIao~ zn3*3V$~s=FgB;0B8sp1pjTi%c1Mlbied_wiMU6ntQWwL@2LD!Aa1l5=H@^-Qsqsku zFsE(bAGT+=0!}S8_`4Y;8UI@tX$H4OI3=;zz6+a=TXRsnW|E}d^4y*Ss*2|Zf1Es3 zqn0Cr9ouq~>0C0>jFs@&%3xSejD zd6hz2-}U-w)W8VFQCv-NYU~j){0oIvkR!f@bufxNKf3uzYP9K1Z1nH}C3XEcCB?z~ zu&dWou<7Y8%UsxSYs|9yqOFaq3FOTq}=MXi8y8$zD@z;Mgz2OWBK+ ztlySDw1f8SQua6CwUzU6t$&F(^w3>zG}P2OFS}bN?-mMAm|9O=k8+GH&4z9@-)>u& zi%Mb8=kRPX?Z;Q7V>LuvD*Dv-b@Q+?+IoE^$@i5nqp|aBYBwP)vLiCc@N^-x;PHKq z>=i;Hf4$Squw950L`_aCh4-E%U)%?bG zN{zn>_>=1kdgpCf!ggJNEgve~Et&`mow6h^Ss395Z>%YCW1p+tJB+}Zw-)dW!uKmi z0aB5d*VcZQKRUubLrrA%x57d-o4RVM2X3TlXx#H{D}KXs2k!z2Lf6`Y#)q~%?@Qzo zmgZa49p>mXsN{0R{>_Wnr=96LhmV$^-GQ7ovw9wdTiEb2YMxjxL-mLjB5!69e;b3f zW>RG7zOk|)3rNB^V)K=5?#TvvPI24k{9HvdD}mOucR)1!6Wxrd@AMwDAk8t|{=iTZ zd|6R@dA)xbh7k^AuZTAV;GuEwsMMA7^Rlr^D%lJ7*)gMR*C9cnV@qG}@~O^e4^d*1 z%~P}HQC0n|aYJAB_ zimc2P@Z8y*J*BHn!H!T0JA8hPc>4T2Uf#V|J3KhGsHvX&n10I;_z+mo*Ave;%L)sv z-?A*|=z%jGwl{xwea#Bv9Wp5H!}&JU`ygI?|I`(A>@9S)x>;z8^r`RIoVz4A@Y!Y! zazL?|J<@4n^q?#pFtDctVr-knnHzT4~G#e{tLC0H)BAjKNir#9B4?#Rc- zwdUEH>7G=f?FmbI^msa)ud5&|+rwiR=|_8b!=bV;UmH69%I!C>u5<`%d>as8XXYzL zKJY@k2ZavS$*M6C1Uogqir>33~c@lnwy zrwXA5!sEGSy2VvS}RLzl+BtAL^~maiYf`UEu{EPMLzev{8Zpk;0X_Le`k zCoiun`Xd@{A|h^}wP%dN5c$>@?nc)O#63ghXQpy^xj5Wb|L8}-V`pFQ9BU70KdI*; z>&fBUowBuAeKh8O zcLn$i{gLQB#=gq!b9d;q`b9Fq5c?=L5>~|bMX3>X_JEn|b(yqQb%x_7+)7tR%P>in z?NlZ-3p;D86~rtPmLi;>lUHRIK^gS0i86_aq=f1kZeMGZp{>=5TcBq)AZs^kO&vi5Iy~ToVf~)x2bPfqT zg|a8@woUk}r(4R!>Jqn-+q~K@d7PLBdb^Odg;{(oTxxo3g>%c8uF790wN^Ixdv0EM zD_JVV`roO3?cl=_1x85>$`alri{;DTL?Id=1paUz0CYBoDQWzeX*(E0k&>)1*~2Yp zX>AMBAxbMogfqO`#iGgIoP+uVFtHWtFx+u*jv5k;t{ z^mW&l$w^6CYVXTN$+8{=nds-V8*|_E`)H$3BREdxHO2y#4>Q7ve92490(qfdRBP{AX?X-xY0H{z@DBubQo{ z(%-fJ?l&5583bhZx?&VzVkA-opK?|L!5;+@Lxg*{&u=h@k|p?pnKzTuwaao^#v!Nh zZv6KeX~ynrRo@qQH(g}kzw6eeJ9{iFn~FT@BQ6eRH;;~+u(P67;%TBeTzV@l&wOX_ zPGjARd7SiEhCk7B@phA);By*(WBr&F9JlY^P3QQ{OyN^g+Ga_3sj*gIE|IZG8)l{T zN!6Pg(Qefs%JJ}LmRFVSM9O85m?${hBl*Y!pG9e^?+&R}TiZ{4wX!E&T)3TBFJY4Q z7A0zZkoXHK8Kej3K(Ior*GkcUvZgaRt{(7HLn9{{Y6|I_KU~5^VK3qsG}C+{zBj(- zBLktqQ$E~}r`b+7hzMx!-}eP@iVO1iK^l(AdfOrj?ybiD`9O~(fq`_uk9!tfKr-E% zU$1hx6E#;_Nz9K-DoJS?!eh9f zUYC4ZJxA+T*yye8mKPjP z-iSy>K+t&|oPNHYMZ3y^Q?i7(nGE#0U zz6W_m1Ue1bed%bmJ%jasH}R*s+-w#$blWUB3Rx41MsIt$YW3DyGo0tZo|E`af# zp^zlOAHt;;gf8N^(G+}k<^+QV1L-ci=hi<1Mg$ghx)>1@?08$>5P+lHjLgbQ+Jr*4 z&3+%Ldp|p=3~)n6@*P7L=y*iDx_&hCvhzN?bh08qq}<&K6ojCgK|67}=ZOdE6y}mH z@|Bh=h~kBrl`0WV7L^j)iu0No?GGZ^CzsKA@Il=oo&nvD$@@ggkGYqfhI*#8jkscj z=+`EKKwejZuO#v(jv@xw@Hc4;GS{X`0m;}|BbYfLq&;h#96j|B{P^j&>N~*`&hkZZ z#p52?W=G2d(hqAd}myVJ)XlK_=7QH#VMbN4%tmlCB(h363f~gC3 z+p+C5(ZuP$aRIa16OdUot~sPgeiGg-f37eOOs1jct>mjjKQ7KhuhlGXo5Cxm>g!j( zqxI1;*wQZU0X5D>S#Ir?FnNVY{M4IP)jI{se$1Y57G|B=WqbE|p1(H!)`tEJish_i z3rp~7b?_}by^EivrFL7s_HgeO70_XTe4E~$cNxzn2@QbMN{%v~HPZ~QQ(0+@?5_hH z-gR>swqe_&CwTYFNfate1!#Mur{=p#w)u2V5Pag;Q!kS%PY|Wtj&&>3E|UY@(d!J6 zqnxqwA*HVh{6R_?#W1d`=BJcemOmXTJdM10R($h%p2ji!6go*Le^YKyse1k~fJ=Iu zXE6ruyI(q?*CkJ5uVITec=d5i`V5>-x^PeV%v{g!D?O6L;|Ep1Df1-|E|0!H466BzI>l~nNiy@y8HLTvdI6KG{~+6m@wz_{0^tHk7rgW$9VxKZu? zV(Fts$VZG(Md<@%v>xc!AS%v8QF4H?`*}d53GE(SWcztdqkmJoze&0Ikn*1Z+Si03 zIpaAC-@*e& z;+h-5Ik0v_Dp1J6dtix-sjIw%Qoqvo22?&%2$4PTlVQZ5ex0`qlR}Fz3Gy*0b(A6s z6Gl>uxBFjJCskF|k^Jeck*iuZoIABQ5fc=qtEhn@yC;3>ZL6y@D_g=cKRI{{H>b;_ zeR6qtyazMp!k2!(KW>=7tj#8H%o&RHA+J@r(amo99DB=B4QC9%T`=vy^R|8$Q z65(@f-@N%#IpXvIi&YsE+Bzs@LM%ei2n+-d771D<{+L(Pp^2gKN}5?Rem!+PwK7U2 zgc=fbvNmA$}q6?eypE&Vkv|XLzQO=|ltG@EGaJTEdicKSM39 zhv{)h9N+3{TI77= z_dBaPx@;S+Y>V2n+EZ3+5`BTq{2W)|lr*%C7AjYh3re%*78S{b-@!1b`Zy+I&^+qO z^2S6m<%2V&f`Wq$$sClM0>{tS-$xr2(8fHq7KkZx@So(c<=0tw`?824%ZB+#`N59& zProgI+0a=u&8@e#&|}9?GOHA-J@;FlNRqyKdU?5*S~XUuC{wR&EaOFtfy~_J;Da`R zAwQtv=`IX!>ji{sk8qbVWHVs6MZsh0@pn~qnLSyH{7rhcrZ4`ve$d@&VS4NN1Y*^@| z!XX0c7xa!GH6|o7G-dzF)SeuDB_)`YXhd+E1PBNzVHgUx#r^>WJ_(;sLTauvDK>>y zEZ5_zzV{i;;Ipz;dS)iC?%-2&Zy3z^lqxl_V!kN3#uLq;-&C}+ z@F=t+;ekt!@K~1|Jybpjx`Q5V7l#aj_a58)v)Kqv`Mmx6WlQMZ`#A@YGY8vjaM2bF zjLJRS^{>?U2+CV6sQ~3YDM6I+w^~SoZ7rpJ2(v4y9Ne#jm0)tZN--AMgveR;9-jG} z^T$|&jtKGQaDq`U;Q{9srNuczWAutr>8-7IXHG>-uU2YB%%Yeen~Z7$BcZ9bTmDYYf2AVQZ#-z9z-SX?(5$)dKP*wH{W)Zrb0E#6^m|*iDLy3y1N)H)#2c{O|_~J zmyVi~)y(%O&0RSBPAoCmT*`?cON39>zgy&yb2~k9<-mE#=9+J{V&8JAU7M6UJ(=v) zJ=7Rk=(nGWnp0tIaIw;royd*-OmOCHz^bT-Em3MXUHb4*-piiLoyYrDrY}zC*wMpG zB%Ccly5oc54|DI4fTUEr8&4`T@kBpL*PTq6ILa_4_#%8d=lS~D=>Z=%f`XH_A4TA^ zdvex-x#?N8SzdQxITZ~iPxpT6KJaj+?z=jVq6U&CEOaSdts)6&L2^2m!9tQ!xUFu* zO^&1&z-h5isBaCO7(quQ_MNXH?VTZ<*}}(1*o}1uZ@AaIjc{US*|>10rr%oLWeBm) zm0f`fM#*G*|IDt9|D~4FR~V_Yk!rR6(XAo2MmvUd#plTmV+I5+bliRr-%-Wop8Z$Y z_Y7W-byFVY>P4z-MfKP}(Wa4~i1*kw+$nM_oN%e^?Jyu!@f_Gp=~|pd%$DXBbT-WW z3TAfD4Vf}@?D9e8R=lxbSW$;r=IC%C9m9-Jz+98{LYG0im3f^+DfRP^!}s*_0icnqq{ zey5}qjt8Q;5|uEgoCWHf9w^xnsoLXG44H?9RAYw@un$l|mT8Vk#WX_DvqfXrsT+lo z*h;6nX0H?ugkN$V;BlVPN^59sGG!Q-i%_Go3~8o-S3_rkH}fhtdsFAQVo{~bJRX|{ z)=qZ@oOF+;cz024`Fy5Pg%n_ux0I=tYMe%P{tCZzmBJ=xCuoF4t=KgfS;}rMYFsa# z3I{-U$+}FMKYyU7_QIToX)A>po|cn)?6fSIsS^ojXxvXkRwho z6HyU5qz|e#K64J6>>qE(OQED+p=|})+QLYoI!(xrH0X-{KD;4s;ikk@J|8nCDiHARoaW9MWxYj*uAEy!mi zgq1VmGwOBa2vAvGQqWVfYHa1LqS2NQlIxC?&4+OuG*Z}pRn{bc6g@$n5fM2Dl(Ub9 z4_%K^6AebGt^31rvzj!0qpL$`s82Q1W-Ud#wcM$*w1OrMC(fI3f-uy|O(?`sc7ALG zm@mtuGU^PvB$2_VUAHdTQ`w!tsc+l#>_m3UV%H9?)r8XAxn}J^xUc3<$h9WP;b*vmzSsck}-X)g)swapW6eL4-ui6K1>)n0L zJHm^yOXlstZJ9eto9x)NKi8rGyRc!`iD;t(?4oti9<G7t-1ig9eT~6 z99&IXfi5N?@E{}^O(XTlx~!kud1=nJ5ihhdwj42{RPB7(-QY_>H1ev~if_lu^gL|u`p z+BO@R+h{LYWnyM08N2j@T(0_Reo3wQCY(+CPvf(Xk(QrTIes(|Y6faXiK^K-^%>^q z$}){G-Sa(ua*E2Tk79V`n+<`6r24<^zNLwagU(Zh;tCN4hQ}*2VqltRSb;rY* zeN{e@eMxj3_l?D(cRf3+=Cy49Q&iT%%y6(_t#F;*kMtDxLH!IJXR2w}HO7A%f1@}6 z9wDZw-!(Q2*IKn_lCV;y4^UwX@_8G3eM>y zImc{@oLx?N?kO9D6LK2+EFDV6ES>a2_727Yrnpn`tOG3iNe4L0X?r-#L%u!;mn1rO zUx$90n)LWqX{#C7G z`Wx>07rpMkl;VGsz(xOWB=G;XyEP~0e@p)caBTmie>46w2lyYc#Q&)A{ewyFztg|} zBUJbw_3!`v+5P`S{Qf)W{(oGmebS?^TiwE1yHnE4wUA9SRR&xRDgx zM#WueeenMHxi-D zpipY5`3+_|y)BnLc*yRwJiou$FdA^J8{ehf^l%2VItte*CJnE&!1!1}8iybWCo8C^ zs;0oze7fZ+sxDV~oh_f!(i9-=rY9%FiZX~M9^+C`aOV_VDjO`UoueWzB$DEvq$KN+ zm|&tzQfY{dE5k@Rj#0T2H{Dx&zdiF?>b09vLcE#_<;?z*-@-P$%Pzpt(PF9FcXN^; z`>%Jz|E7NOpKIV>=(Yd-y7@m9um2-d`=7<@zc04ZKQ8Ql09^m4cnydI|9^6SX6Ir8 zW`T4 zdo7VxIyGlBBInONN$r};I_X;biF0F?Z5F7-1!tE<(%5+`e#zw$kKCH1D@9gu%*G|V zg_(6tC-m4wM|-gZU$$xK&-kOhqxYliudmOq_b)$sXpnrYWkNz0hy0RMBrOQpk79|lfu)_9{_~S2Z)N_*Y@V#TDqSC=RL$hCHN5P>lR%`rB3; zM-H$#$4Rw879-1(!8g`dv6pO-O>STOqysS!#|61D;_oD=!rTtUqvT%{FHN7cn3t$5q0%3`Bffe8(!O%oPLIFXscwTd12Dm?&r+1Kf zBWcdghN-`uA`i=*i-8QJi(*hX@C)>Q?m_xp37u@p@1YTU*iRv&WpX)xV2BLBD>w1F_qYO%!O$04H%lk>4P5;Bi8b|*(3bU zY?^b%&dGWW^x6wcpw0@LB&`}B7*$ia?n=HI)8k=`^yKC$w(-#ciO+i44=s^axmLEx zzkqqFmw$*EC?jk>>){x>`Mk_7cLcmSy6k6sP+@qH59J-bIl{lc$kN>69ZSDCK6IZ6 zXx0UUH<%qF*uq`QSKn89EAbP{Cm1*|Y*1MxwzQwfHh!|A>W?bkZ^R#(+&_FMWqmfz z7~l>Ac(t&3<{ukEUydIll{J3twp}c(zEPW{CTDF+c=rrTc5|v)UA|U5Pz&k9l;15l z1mBkJNCLoIjW{%ay`9z7@I*g4oyAUlep70)>03LD^)slRS*8`m?93OTkUb+Hk$z5S z0Q4u9OtnlpyyD${^NBN+gy$F8BB`5yIwqzXxdW2j`4j3mjNL2J)k-a={0uI;LznqW z{qoc=r1V-j^OwmTm$WigK2`KAnwAC3m_GP+jE@D3L+`ZD@XR~xQhEWE%m?+GZN`L& z{Ot>C2&HVnS~8jCBZX|Q$z8{yb&>Y4=hTf{=CAUVBgQpGAXtREaB_@yCtHsoPMOSn z6oPbCF(zNbc@WQ=D;cfe*b!N+UqY&W^6mjy})jPwgk1K`?U0@Qp9SlQsdL-@VY;LtHxj9<)Zt(xDhN ze*)B+g@=S_4S-Km(Gxl2nm7Z%C$YP|;Nep3mjt6o>W%ZA5HM#$Fq(fLPe6>2q>Hf} z+GCW>8JM^J(>lha+(#5HD4l$d8`aR1;ed0v!!`W-gKchjrq zkL+#=brCe3?}lV{gp7`nL@CDnGGFjFoJej|;mI6{n~!vg1V(J{)9&%!6l25d>jwy> za%?nGwzzh+w~QXrFfZ_DTvm6iw8>lm-dPHW3&`rgni8$=60eBwy-d znJNZPydmlSUVD0BaE6!}c*LyBY4Q}i^xnQ?3aToY@EWmFg-4VZW_K&Sj84bV z#wsZ(q~D)GsA=YQEe^Nklc-X-;Jm0h$8jMjPqT;*)tYIQQLtUeikQWstPIpDBBOV2{!V+@x@==zbv>+THJTt<4U0_SLj$+1SVK#QxW;@W5EwPk-et{ zLF`7mv!*}?7*mhz7#R}wHWuF6;K};NB%DKBOvK$$vHrL()|51i=Ryg>{@#Xj224H) zELRhk048$fA{=f&*A|Ow{?(60v$$(1K(n-4En&1Iqci1QQyncBfO_MeO|m_|8*S`F zZxzmmdAnFTFj;i8jS!NdK7+iOdcrln=Ez5J-6}j2(fx43715UBDR*d-lG}9Msx_nO zp1(Rc%;EOHOaFCh|Mubb%X@xhP)aa{fm+oOlpPzNxQBMx5!fcgefH>Der}SxcHNQjCi^iLtR2onc1oM9 zXRUwRROhMTBfeWVY;3{rDmOa#k_PrF>`34n zxUzoTQic_YZLL*Ut!q^fVtgJ^!UbGY`R4frLesSV@VJCwEz6|q2^WmKpp6=&hr|z7 z#_mSua(GKkHny`pMfE8CE7HLWOPD75oc@7st?US3atOHAY&-|GbSS!NR;$X@o_TE3 zuC}I%sh5ZJ>LHGH)zlp(vQ_~X5f!pUHxW1~^b^jw=GNfOLTr}i0JtPnH-crjIM$5pZ$NZZl(+mE(i??C}@(7L%!1+t?GSjILwlPivwRBPv`8 zJHzoHn&cZz)Tlu^;Xs(eP{xM6MsJZt!xLn z7YEV)__y6rYkfuBN$H#Cbfi zb~6|In_F|{Pfr<(Fl{A4GyR)e3-Z`+nyekVt8{`~{B7H!dB(a-Fzdw5gtV1@OVfG3 z-It2#l;e(jw#4o8N%y%cpXG>f%H%mxrkua7kwdIuUnzSPD2jl^OcV46HzN{EQ?V~z zFzVaG+2C=;?>f|?BcLN}xR4bg0Aof4*hB!F8R7{C5UH?1>b%|cJQbR$#RtUL6W)?t zy!RIJU)yzqSk*8AN8Eko4449^{yZudt^qix7 z9C?5_weGAFfLlwa;F=-%n_D~Ky0@-7XDp!i@F39)6MA{WzLmcx z2h*5Et2(k1r3w~P5Iz>kPo4}9R$vC!FqRAk5=t<(qbz(*@z=j0Aj#ABN@=e13ER}U z2%q&(_zVqsoXff{fCy^fj}i?*p(zo~mmUI7{$qm{0v5%LJVde=ORS~AsoRcNUQt^a zjMy7_%Um~d;YgiD;3Z3mvbcIDfE;zRw-il4SE-quP~M8m#&FAPHSMU_vAd{sHk5xpBsw zgqAXJ1BX~xln`M#I;vajc=a39rdA%ApP*ggXg2sQ6+f)E8geABcPbiOYnzKGN#nVz zNB92dpY82G0RjE}pIcHN+v7$8{Ep}1aeD8-ka+rXOtm4r!IY>SNTLq zq<7~J46cB<0wi=MhP>nwu=F8*kf>l`CCWd1L=~x3Xch;BNIiwMwS|SX)1^z`RaHSQ z)KGpL;-AY9nYalKwPW|}tR$qu^hxs~RssjPzsROReoNW?3K-U?pCyMSG=>YlUh$7d zjv$nQeT(iZ;sliG8`HvwFBD5^NT??;qh>^s_h5}v%us^NaVsvb^t}*{a z3H!iS#jSO|(1QX!EVwDg;x*Lw#48~YD{v3@j|Ik`b5f$4URtZg-u}qnT%Y`@Ta`lh zfJY955w&)O|6G&+3W`Sud8&mY4{uD5`|V4XnddQ2oSwq4D^Rs(b$XBGEf42~gIL_% z_ydEk@Tw4*q@f>%Sn5C&iA@;Xw;BwDI7SFa051wjj0#qAJQgQ4o`Y6V_r!&UY{<1L z`un{3n09gR#$H78w_S@1@&;KsjxRb?D%QHQ5p8^_Y20tv*m>&dGBpW`uV+FNKa#M@Sc$owQQs^+7>RoXz*L?}iAgmH!aO~}K->ej&$UuNg zj1mj{B^r!1VhD~c90-0e1jDn7QK`~CM#lGTY{?Nz4c2skCOo#r#+H*$U^F(nCV|B< z(AD@HL8=fI4w-q`1iwFMO+8!r`SHc$-g2&?A(1ZIDZ=(de7hfd^hA>)3zN8Ohc=2A zj1WyDiu?r!wlk{RuA1DTJFNuT_D#u&!4{XkZ0n*8D;;}NR*Si%r6M(GB=)i@I^~R? zx$m(}&MnUEDuQojRcD$i&duJ~xmvK6bZkFQaz6I_`WE$1w1?dQ2;{wn5fie|Fkv7{ z0zEc`FiN=xsWo{0Pe5|iq|YR_gXKf!kVV9A$e@SDb5FlRyRx^>hO4L>yWtY0C>^OS zy%_JWH?*yf+Iel|g$W<-Uf(E)ldfx`Z&oy<$;m4ff)mhS2GL>G3w7YYnhv0FaTAI< zKLX;Oi+PdWWt@6?QVGL;UF_D2ZZyisF$gU3JfB#vCH%0N65W12S!rrPeSjZmHR|&^ z-Pw}$(ixCCvEzNZH~2|Cj?2TexNwlJWA`SCEp zOG-(8uGMogI{x!&hF9Qo(NEj{Vtg@a;NJB14pZ-IwKokwzMm|9ea_6C!U=xHZi*5G zGEJ%dXbA@)Q~Oo0iSG=fc+4Is=cQ6%_tZrfx$JXTk~X@>(6_EFx)$l_6{YsoT%M+F z3z6RyO?fV4R=purE-_3?YS$?ykysIJy;@g{WzQ4EM~07Ij2^c&UQ;fr^$jW!3UeZ<*troAxj)p-+2e^??v*`V`h?`#%EMakafJm_K5Hu%-Vy_C zD@%iFmMIox%+WzI$4Jf;GFZq>LANdY8$D~~cJs{0t!$aBaoo%j30=dr zcD{PsTMF_v=>jR3<--Y zW*pI7Q2JHtfW&OWJch&V*@GWQoi}pzKtrY$McXgCuC`E{DW*)!TPV(M==Jga-LZ?; z*!{`3&Kl1%9IB9KCCTUhc3{BAhvcIus5Lc{-}7y1JXXqOvsFbGk=1EDIwhEA?mQOjPyS~lRe9{S19 zOMLsyNL%@!;$ew8HqmfG&3eiR1sY;)jU>x=VHz=^0GTSM%llLKC|&mf+wqn+^O5;60bsGGS2`_8s~sV9l!o*qsNZ6Q zvrMoFg5YBk586!ZArGF=-Kv|^`W;G!49(-$NO3MWOSWx&nVF0{@I-XRUrBw)JOZuW zCKuEjT#FS1Fl_RO&>szh0m5r$xpI67?uSZyKa154r8=d?o&_EK1ZD_XVY8pP*CX*7` zN*H~PMD)cO4i47mYz=A8W(9KD#-2^}ON+esEqV=8?`sb%rsSFk_EW~>*vgAZ?s5_k zU18gf80QkH(}Ra0&$!RvJ;vu3y>q4`j{DAH_Cus~-S&x@w6_8)8ADbgFD+8VZozTD z&_GWY3hMo%KG*+M-FE<0(KT&~fFdAD5=n|A$=n*IVAUWrplZXV# zQBgs%8I;sh8MDfpFLqT zc<&ZG@XVvlfL54u8AH+14bA9WW@G31wrmkHF=dCV=whzjLDlZS?=^{WjORGw2e2r7 zKgIETNA%VOjmR-ldI^h*GnD@5E{XD{{T`$>TT-|^Qc#q>!E+~_ZRK%r%uTf){RVi!hkYDlK$mmzL?=jmPn$^(mqcmEe*up8BS9k4tG~Fy)ER-sEjw zH*Rsul16Q4ZYJb};B zKUfbf#A}V35*EG6Ju#`McAFU1#r4W9PDf9igmhI1-njpcKE23~$e@JiMd!Sq zBaK(!b)MxHBS-o=qC2i9V0uo-FOQB~^eRHT-?c=Dgi>mXN$}?)iKHtld4+iv+K#z? zA8k`$+1p=M*^IRHN*~U`yXStX%3O?XvP(S3=k2P)A;l9fe3l%sDV;tVs&ot*B4FjP znFhthUEFW&A>N>+ovyZgo?g5dXdroeb-9+$_Pbf{)>vZVK)#7_4^8cq-lrMw+cK7@ zszn!_q`CWFpSJ$4-3rm2W5P|t9GUSe@Gb1ryemRBxAo!_6{$GkFE{$c2e&1=bk92Q zBkir~1==G;`uL{=U6=dUHr#YH-SsMX!S_;@jxN9B(=HJ@U3p}sODipKml4Eh9MYpoRM}A#&beLBN_%TsZ__rb5GLR*CkT3o zlML1(H)i+NlQ$Btot96m+aLVuDe;)*QD@DnTu+1e>)Z;u+#Dga`(|CK9+Q<(Fl*IT z-96Ck9()`!oE7?Or&i$DO#1rcpOloHdN#w~;)Dw(Op;s;bBr z1Db-=J8Y#$RjVV%#avO1YP{%XVVW4 zk{vq=;vMNNJdWo3GaaXvmx`D6W9-LXwvpu&j%**BNQ_LaE>}p2mWR$F%~TbQtnM7~ zHK$po>3MCa)T}E5ii!;**giFgHj`v`)Qw5RrN6 z0SEE2U}yWl05s{})T{h`{`(&*RsIj4aR2X?fB_(@Acj9Og?|CM{KpjdZ-mUhrojJE zz<*^x|NoYNLH|-<^iNrEDC8Xct6aDb!}S-N$An?)nK;`;av@S9uLJ#0KGmJz+>nSj z6c<^3=g}NlhAF=c?(J&mBEl_7QZcB=UmK7s$5(L0#Q3b**^({cU&1_KF6i$sp-@LV z#Ff58SMCnIA5Cy)6u%F^zute+n7q7DkVj;GN7<-WaX#h)%eaGa7UZuo)z-QQ5JPtx;tu-)e`<#>O!w11fjRi&g|jF; zOd0R#^&HI1py{q;RM!2zy!+;-eR=G|57x0?(yO4~`0nWEK}3 z;smbZHC>6RkKc*sxv+KNQ1U`g?wb*LxA{enDqJf_MptD+!V}ZOrA-x2!wYu2yu1sk z9xTUj;kpYjp7i?X@a@;xI1y$zHb-kK&zm;u+edI*ZoWnK&X?#!@IG|Fb-LzhbI-#< ziHIcq;#}_q)!I^*Wt*?TOBVvtJ9)LW8$SQ?^XbLCSiL+gEKG>6>iP4zH%ylzm<@*| zq$w=^!q-F_B#3b#)Vk(Gz_3CqghSWEUov@w@gLB#{%PAnli5;aso=4?VlF=Y z(~4lz=H0Z;X>hvjkAYtg!>64wvse68o)ZCCa-huX?k5ul9J|mRwooc|bRbF8Mbko6 zMrp=e{l2jJ-cR4Z6C5EZv^mFFo5a)bKT(}-v|T99vfK&q?ERKh*I(L;|VKb&G&lef8r8F=j^kxL?993b#rIHfkU>Xv(<#(iF#-|rN8t$AbMS2-oovYtWIe`Dezs=@6mS>4BHoun6IcX z1G?FYYZ;<`6ChpPYx@yK4Ue1}XUdiq3Db(VU6eh-njZ!ez>6>oe~&Vf@0Q zjgEaPKv41=K$hynKeCPeTtrcx+K3tCXs8#41{NvV#n!=)-!5ORCuT2XK&6? zKa>lpB-OViuQ0qD5pU_Vs_i%*jmL7Ibh!PfUZs5p%L980o?=!v-F|`^FR5GOj98I! zYP6Kki(ek^^CDqGg&1*(j8%!yP?ZG@Xnbh!n>6{TOI@U1;e;1gyrlh>Wes>iqe7lE z%!$r6z~EL9%0D&EqUjrZXIN*AZ)#j+e6hxgMvFL?KB-BD!Bo{ISC2mat||V!Yt(U2 z(-j<&3YO%frxJI#yvRgucb>|+t!WED|`$d0WWo3>UA8=tNd*9IH7%B0gQPvO)F+2!E)Wx*s(eo$KP%08r zSwvnP_XH(viv@ENPdTL|X;&-z3s}vHzX9E@|-6Sl<^6^}1TJ znx@6Z(uO=UT{+#>WlOom^ah)!6+(#IVPxvk69ME38IvT;jWMm0esn!4$^Cl(1D+)L z{nLz+eGQ9Q$NlQcQ1Or+hx<$G0lUY!MAfFgQxX?QQ=H#(D=INo<=ba`|G>=LzW?sN z7^yR(WgT^`0*Of21cUQHnz8ca-exv%CGj;}T*?-^j=TKpSn~Bf1Oip#Vfy?-d$3+#*hsWbG2KiJA z@+EUry`H*xR>8+Xh>S~u?L1VO%&OA(TH*`@>TV4@C*~_8g|%cnaKI?(zZyayByC%Qe$3PNVe_`n#A85o-Lx=Rp;VK zLvL^<^Bim?KUVm9!(OWl^EMI5A#;o3(L{#+sPDDb{nziVg<;$tm);qi*;9?-uWGB( zSjg%=-DSb8Hh*w1 zWWVmdE4MQ&tm$F%YHFP>N~Xf=@holX$K!bAyBJ|SYk}xj#N<*ucU8Y#RbpVsdQ5aR z!srffRJXdwZibyjznOl6X397GK0GA>^wT@rcix(pYhf5npFIsI+NQT3x|2S_&LqOf zvY#e{=M28<lXx4R{EExm4whr|AwUnSM-RR`C6kj{ zvI+A&%j!!?GX36@{yaA3OU6jdj|XmUIXbnwg-wJzc4KcPOvG=W@;xf!m_=|Lq38Ev z+8J34y*+O25TvD0;7c!CcNAri#l{Zlv_Ga_{k~JWb!li|V0o*sJM3+TQlN7B%FouZ z+rP|@R;gWFXJda*SJuG~hxutejy9oB7U~cu-1lW5D|U*E${KZ_Ud_K0MySPRd{`x) zR4eP@4)32nxl#DzeG?(yLxk0$qWEos)1BPz3LK8GhOcA=0p0h=Vv5s*ui(qe^U+7? z`thc`!nr-89F_08*~YDhXcu~`R$!L95{z(>`C|X2SFwy}f_X-*vEe$RkZ#L?I7aH% z{txv@ZYTbUOAfh>eSvmtDf4~;CvPQoY5r;H6x=2mbcdd*hyFUCfR1jJXAbYA8Hux{JA0 zDzP(}+UH+K1w@xm!>bd+h<9K(QTK_sR1 zR7nqSp_82EV>|k8A7{8`x7r6u;uq2C3j4cDm1)*axl=fS8f)ss5P&J z{-u(BZ>NcwSV?J{L| z^0@?0E+hvUJhsP>87HD-AQFNfLOjyu{X!47rNg_WDb-kipl|PnvN3Tt01(VZt|tO> z-O^yql4yBG?Uy@{NFZbUo^W+u+Y(WfAa3XGRha`N{VAunu07QgIW2DzqtY?1rK9)S zj+IJ1p~Z-&$KLieKUI&>n=w$f(gI?En#A~KD;m}EMZzg%edbHp_OaZx1@yN(-&%8r zJLyKuaoyv$3}f+czy?*-O``IM*=0i(s3;ad{nQJJDqV$nEs+o6B2#({IlssTuoLAO z@Z?(EaYSmv(ocw^kTOmnMvwW% zf_0f(U!tf1i-b9SMS^jDtMp*ZOHe_fK(=lE%|sLCHaZL+XCH+HrWWj>@*$<=p>Df& zoT!aYTqO^tF^8^I@g;Y;8Y*|Z(Ql6DwTM24&$|z%^3+-?y8?ykrKAg2^rRD5sxP+s z79`!~ddcSc$!<8IXRE#avK+?ovpHYm}GYN18M3YRttCezzDy-kS(xGWjA{w2fAA;>CP;61xq}ux#LfR(A}#ctG}YK0j=r{b{3doE6Q$ zVD}*ujdVw4b688rZ%t-FG0C7Bmgle72CJ_mSNT!}i-_YE1qco*NbEe}tm`=WvhhR= zn)$(QI3v+lMGeZHADYB&MKdHDIl$T-gTf5UCJx-_wzC?4nJ6zm0ej;+P?Psv6Te5^?pu36pUjTvoWG-E zZT>KsJ@Tz$p5Qa*v083{YwzuzO1G2?WWH-9c2m5|RCam1rH%BMX*Ipx2iL4*O#I@P z5evCx6^UE=LOzk3Lz>|?uI(+qI%xKW=yx5gtdVx-5J<$*h?X z1#Q-unKi~ocs9$K)Wcse5EZhsN+jN_)Xk%1S2z1`W8~Y*tnbBpE9Sk8AQm0%@OCpZ z^5RmuP4;%&MA|Gy_OG=1(W=pM+w!ZB82C_9Cdp!g`IqL$wha@M3M_q}xC>+wYfIsfp|9NAsm@UM=b}BHktMG}6$r>F|ju_?X5)i%uhEPcrGhtZt-F zj%4fzy`EKzUmra+6g#9jZOla>uBRMLPgGg*(B$M1<3jn|`xSzR9dA&jlp-6l;C^C% zsCBMFsK#QkV1ZTrnkoq0k+U?qUoQg=y!O(8{}Bi8QR4&`7%>n#OO^8T@szB!vPvu} z{2PdfI??V>7m@wlXx5m2yUng@^Vae^s~@+Xu6WrBnZL*^n=HGgf+{EzEQ5t(VPn)-RRT`#s!uu;7QEiAPS6T_A#6QS;B*ngZ+5A+r zwGB@GVbeem!zYMZ~vJa2Qhx ze~<`Xyt{Slm^S-wUS zvTQz99&F1Q_c(1ub9b>*iW>X9HWe-Bk?;8mxrPd0Dcg19aV z6eivr)!LjLPR2hCW$gSq63pc1C` z0v{juaIt!356J7w=4p{rod8(so-IRBs>}gI(@mtWc6;>(3$E`#;TJn)zgcI zlJMo`0_}i`g-y#ICT$VqkXbM_2WNtP7u1w^qu*!tPd@0U@O0NLVKt#beVH5m7Wo;; z*~c;Y{%hKZBmfYcU`eOQuglyitS@Q$t3P4HSUAIdO;u`8zINWOceOdJ_alQ?nsZI) zO&0k)Qd8PVCMjwIE}sejdWorEzIoR+!Hj=`W7@Yz*XJ@1*VwP5#plmN`F=A11tZ=tG&kwWxr9r04QDz0;(yNk z?56bWF9T!P>R_Gwg-x%pz`t>e|A`6xKh9tLw%l|1i{JbGmn@!>jgc`SfcOZ55Q6^o zVL-s)K*G|P;a@Z`ki$FsFj)LI4Gf2Xfb_^8G!O`a#->5fN(}!P2ZaFto}3h=4hNkjBLA2V0R>^L4*@iTJbx|-1Oox_>5p^4K>Nw_Gzbig!lFT8NWfLj zoqN{v@;nXr0f$9HBG0cG3`d}WRMNTm&{%SS;V38&k^UTqfFrSKAo$A>l|YzDO7vOMghjSvS=`KGhC@2_<2MPxCc0GSC6pby%-}n(4guv1Z3JJsJfkI>RKw-rf zz{|1h83KZyHHiIFS7^WxuxMvpZO@N`VDm-8;MnIvk=Q)oXQBBIzQ9_rd~o=5*98a| zhQgi?xawi?fCJ5q&-4A=8~NOt5pZlBpnxXF=gtM7od1UQH{)P1EWQvZ0*eNPV%rO# zW-L8J;Mn^CL10}&ArK_?9zlS>fh7k3Fn~?N<^cs^^MHb}c|al9Jb*sY=VKUfFMz$5 zFbG!cguq}}G$_#0_x%0>+C!iB87T0&$ay_O0fRZe7AP>?`EfA7eb2`~7zhEvqJgpf z7lwjj-7~;YaI9DYLjf0tbGnD20YKw(G&l@9ZomPvI`1EF7y`@2;czfkEJgs%b)E+T z0>!!xA|TlNh5(d$K0YH*a5y#%i51rnC?I(LTQ)lzy{G0zHiQBKyedy!jDFuM^D0|f t+A#n+J$pllkXOpW*pdM-&)@II+1lyZ*!{k*Mxfy!I3Wv*xPk=Xe*suW(?9?K literal 0 HcmV?d00001 diff --git a/kubernetes/ingress.yaml b/kubernetes/ingress.yaml index b58310c..da28f3b 100644 --- a/kubernetes/ingress.yaml +++ b/kubernetes/ingress.yaml @@ -6,23 +6,25 @@ metadata: annotations: # Example for cert-manager (uncomment if using) # cert-manager.io/cluster-issuer: letsencrypt-prod - + # Example for NGINX ingress controller size limit # nginx.ingress.kubernetes.io/proxy-body-size: "10m" spec: + # NOTE: Explicitly set to 'nginx'. Remove this line if using a different Ingress Controller + # or if you wish to use the cluster default. ingressClassName: nginx rules: - - host: rallly.example.com - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: rallly - port: - number: 80 + - host: rallly.example.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: rallly + port: + number: 80 tls: - - hosts: - - rallly.example.com - secretName: rallly-tls + - hosts: + - rallly.example.com + secretName: rallly-tls diff --git a/kubernetes/postgres.yaml b/kubernetes/postgres.yaml index 1961f16..f6bc0e7 100644 --- a/kubernetes/postgres.yaml +++ b/kubernetes/postgres.yaml @@ -1,4 +1,3 @@ -# kubernetes/postgres.yaml apiVersion: v1 kind: Service metadata: @@ -33,7 +32,8 @@ spec: runAsUser: 999 containers: - name: postgres - image: postgres:15-alpine + # Switched to 14-alpine to align with official docker-compose + image: postgres:14-alpine securityContext: allowPrivilegeEscalation: false capabilities: @@ -52,6 +52,9 @@ spec: key: POSTGRES_PASSWORD - name: POSTGRES_DB value: rallly + # Fix: Point PGDATA to a generic subpath to avoid mount errors (lost+found) + - name: PGDATA + value: /var/lib/postgresql/data/pgdata ports: - containerPort: 5432 name: postgres @@ -61,7 +64,8 @@ spec: command: - /bin/sh - -c - - pg_isready -U rallly + # Uses env var and adds timeout to prevent hanging + - pg_isready -U $POSTGRES_USER -t 5 initialDelaySeconds: 30 periodSeconds: 10 readinessProbe: @@ -69,7 +73,8 @@ spec: command: - /bin/sh - -c - - pg_isready -U rallly + # Uses env var and adds timeout to prevent hanging + - pg_isready -U $POSTGRES_USER -t 5 initialDelaySeconds: 10 periodSeconds: 5 volumeMounts: @@ -89,5 +94,4 @@ spec: accessModes: ["ReadWriteOnce"] resources: requests: - # Note: Adjust storage size based on your data retention needs. storage: 1Gi diff --git a/kubernetes/rallly.yaml b/kubernetes/rallly.yaml index af6fcd5..4f76352 100644 --- a/kubernetes/rallly.yaml +++ b/kubernetes/rallly.yaml @@ -1,4 +1,3 @@ -# kubernetes/rallly.yaml apiVersion: v1 kind: Service metadata: @@ -38,7 +37,7 @@ spec: runAsUser: 1000 containers: - name: rallly - # Pinned version for stability (latest stable at time of refactoring) + # Pinned version for stability and reproducibility image: lukevella/rallly:v4.5.4 imagePullPolicy: IfNotPresent ports: @@ -87,7 +86,6 @@ spec: configMapKeyRef: name: rallly-config key: SMTP_SECURE - # 2. Secrets (from Secret) - name: DATABASE_URL valueFrom: @@ -104,19 +102,6 @@ spec: secretKeyRef: name: rallly-secrets key: INITIAL_ADMIN_EMAIL - - # SMTP User/Password (optional usage) - # - name: SMTP_USER - # valueFrom: - # secretKeyRef: - # name: rallly-secrets - # key: SMTP_USER - # - name: SMTP_PASSWORD - # valueFrom: - # secretKeyRef: - # name: rallly-secrets - # key: SMTP_PASSWORD - resources: limits: cpu: "1" @@ -135,5 +120,6 @@ spec: httpGet: path: / port: 3000 - initialDelaySeconds: 30 + # Reduced delay so the pod becomes ready faster once running + initialDelaySeconds: 10 periodSeconds: 5 diff --git a/kubernetes/secrets.yaml b/kubernetes/secrets.yaml index eb49b48..193729f 100644 --- a/kubernetes/secrets.yaml +++ b/kubernetes/secrets.yaml @@ -1,4 +1,7 @@ # kubernetes/secrets.yaml +# WARNING: This file uses 'stringData' for demonstration. +# For production, DO NOT commit this file to Git. +# Use SealedSecrets, ExternalSecrets, or manually create the secret on the cluster. apiVersion: v1 kind: Secret metadata: From 6d474527967e1de46605247e29022ea400ec6fec Mon Sep 17 00:00:00 2001 From: Gabriel Windlin Date: Fri, 28 Nov 2025 14:48:57 +0100 Subject: [PATCH 3/8] fixes recognized by coderabbit --- kubernetes/README.md | 16 ++++++++++++++-- kubernetes/README.pdf | Bin 72426 -> 0 bytes kubernetes/ingress.yaml | 4 ++++ kubernetes/rallly-config.yaml | 3 +++ kubernetes/rallly.yaml | 4 ++++ 5 files changed, 25 insertions(+), 2 deletions(-) delete mode 100644 kubernetes/README.pdf diff --git a/kubernetes/README.md b/kubernetes/README.md index 3cd5c0d..eab5406 100644 --- a/kubernetes/README.md +++ b/kubernetes/README.md @@ -13,7 +13,7 @@ This directory contains base Kubernetes manifests to self-host Rallly. It separa 1. **Secrets (`secrets.yaml`):** - **Important:** Do not commit the `secrets.yaml` file with real credentials to version control. - Update `POSTGRES_PASSWORD` and `SECRET_PASSWORD` (use `openssl rand -hex 32` to generate). - - Update `DATABASE_URL` to match your postgres password. + - **Critical:** Ensure the password in `DATABASE_URL` matches `POSTGRES_PASSWORD`. Both must use the same value. 2. **Config (`rallly-config.yaml`):** - Update `NEXT_PUBLIC_BASE_URL` to match your domain. @@ -22,6 +22,7 @@ This directory contains base Kubernetes manifests to self-host Rallly. It separa 3. **Ingress (`ingress.yaml`):** - Change `host: rallly.example.com` to your actual domain. - Ensure `ingressClassName` matches your cluster's controller (default is set to `nginx`). + - **TLS:** Create the TLS certificate Secret named `rallly-tls` or enable cert-manager (see comments in `ingress.yaml` for options). ## Deployment Order @@ -40,7 +41,18 @@ kubectl apply -f rallly.yaml # 4. Apply Ingress kubectl apply -f ingress.yaml +``` -# 5. Check that the pods are running - should show '1/1 Running' for each pod. +## Verification + +Check that the pods are running: + +```bash kubectl get pods ``` + +The Postgres pod should show `1/1 Running` and the Rallly pod should eventually show `1/1 Running` once the liveness probe passes. + +## Notes on Storage + +The PostgreSQL StatefulSet requests a 1Gi PersistentVolume. Ensure your cluster has a default StorageClass configured, or update the `volumeClaimTemplates` in `postgres.yaml` to specify a StorageClass. diff --git a/kubernetes/README.pdf b/kubernetes/README.pdf deleted file mode 100644 index 8e44d78a953e9f2357e73fc2a12e97d327e74719..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 72426 zcmb?@1y~hZ_dXyU(jj?7LXbK%NT+m*bPI>>E=3wax>0EmLAo0O=@e1>EE-WS|&SYhLj}Dbt)ZWCv(Z(KdU(UuIWNB%@%)!J0 z(7yi!2z&^T1z9_}0$jN{^*GtJ=>WpEww5O9CWbN~M`jK-E+#fka7CF%s&cXn085aC z2|&`s$ifC(@sWvvv89QFgQ%Ikjg<*Ake!u@<@z5$#o(!dJ?O{H;D;;P+Za0;nSh_J zVgWK>1}g%v0@wZv7Rbh0%)k+>ffz3<3o8c@$jS|5W94CCdBDO#3;qGule01YeH8%# zR1<6C>jq)_yJ3tB06RAYim`4nxJk&Pd+|BXvKIynRIBo^kX%~De8Q$2(<#T%ZQE;Wv=c+Pd zx8wEY_a!bL5{j!+A3g7Vy{jXN%dh=Dr*9n}kjr#Q$~i)Xu0yz?Q=!XvZ*MWmb!Du0Sl zV3vHJ6_9od*J1N6UpTpntblm-M?52s455r##ggtFxR9Kmk6%oYBvT zPb}!Ze?58GOqh-R;Op)xHH%H6-fY6^9x`9R%=sIBxCr)Iw~JNkc={Hin0{Hh!YK3v zk+JvqdS9!n%UZuB47I>2sn}BADiV88y$I(=srg{0+~mCapfy&TFDS(9Zrhx2rdTMj zg4N`8)Ksc+7e-lI*^CFA6%K}zz?N9X@wwpLD@nvw7aM9!~o5(Vx+<40eqz#zHEU+n!N-~ zTFs~HiE+UDul0JIHv~$HPtIXJ-%lxP`CJfSA?p`Bxza?Yh_%c^!@AFc`@WizzB%Rd zh)JK7xeoi)>XJ|0d3X1qMJML@Y~$5rM{H-QT>AL(7~RreKPFsR=dImeJFRzpK+@G% zjJ_w!+YR0XZLTPW-dEGzHVwTISmd)8-JukAgco}EBeolSPTo5JueNrluiST69|5aK zyIT1h&bA|FdE)ViF#WUa`+%3umCD*Totk{D_^7{S1L^8+qkq^=_~>_-CSP8x#zBu zb$z*QWcrYG{bNSO7a6yXCYOaTwbV0_UhW;8n@Tg)sqr6A$?tCIHiQ)&c5`_J(Vv}a ztJWu!yU_|RE_yUSbY|OS4L2bkFRqQwwLU4 zEO>PgID2`>rRR0J-*_?nZTs@%>f&UV;&RF7vZG_$`{)hPlHr#uY1e(110$3M+OQ7| z6OSAoHv43xFGh$0p;v1z%TL zp=kNfR#r^veZHtG?G}}Hwd*J%Gdu5XwPZH(>P#OWV`tA(B&^zGm|{M84S(kG;X$E( zA+w~wNBEhsU>EU=n4GAZ+P10hwsfX07l?-$Ch_jlf{WqovuP`>IA1LWmYF#+XQr1j zQp3rOoYm{zlf4yp|MqYzx8;Lr?wVn?0+Ft-gdT;!=Z+)h2GX$4Tr~o4?^(p6JQVni z``bvh(F?-j%zHh*DanLKjt!%}{qXj9Z>N~7ul5Pw#lpNN^_QgFyD?F?O3@0<9ZjmI z9(>Qdi?Y~aw~Po@l=$6gh8`%p9rrLZf$GAJgUjB`u{lV+QxcWDl#y3rH?sW(x$%ZL&+V?Q~oO7dm)n6)fFT0%^mj+ z36$T5zM03iF942+=kD(Cy!bL9g|KToJ{m*l zMLa>=bD4##c0(Gv#lEmfTUME8OBka4=PqOsEI^Y6;LbhS%tSq$`Fvl#C;6hm*@Zpl z(c|gn;!AE{f;Hd=n=LnPCuITyK3n(+$pm6&XeGD~_{+x3+ni9j?8vF$xEAM? zhLnI1u09zj>*{DAm+`Ge$B%Pn@`wg}R=LD)sHZsH!inTJbAG7UC>X}DUC4Nl)UvE1 zmmRZzTHU!JlXl4--P4+(-O(>je%t9%bMdP}IfGuPcA6KXz1v}V=R(6*k+o#Ex_gCb zDc$@1;!OPlgw=E3D947s!FdOqAdw@Kj_w&IO!~?tAQ?Pj0k!NHJV#J!Hbyt}&m(ct zALh&L7C?UUrPEwbfRKm(M0@dI!y$4QEa)lS;zS(yp~_D>$X(ILRG{K6TH+BU0G%BS*+xK;6C-KZ@-0Vmni1Y`flUA4ewGioab}0r3#6bBoTkg>gG7B zW&EvQJ6}?a{!M5P9busfr)s|8hLdd-C3|1IJYU+dE~%t@DrDj@ z8e(!B&aJ@JiYD`~=5;`?0W{Bhl=xdGU*mehC~CeD3nqFaF4)B=9DXfyOBAZ|v`rML z@_dEf%kgcI$Jpq7EEb7Cr5lrBf!)$uH~K9S3fZN2S;6=z)bIi~dZL4`RQ?22Q>@}K zMAaHWcU@wv(6spyhx3v4hQ$bT*(h81Sj#3`%;7z48hWTvmT}Y{j)qM<2%#tuwwBf( zG)|PJ`9^I^XSQ(1HawCP5U;I7O1<-1pu3DA{Xyh5Dnmb=@g9eJgQR~9x0}It`K8Dr zoXJaAVw!m;`d~|9mPD}%bQYRg%$~j(7P+$bQ@%VT-}H|;C2VnGkho()Zu9jUqw9v8 z!bChCeYTz)-tW-f@i>8?CwkrQ8NX!kOcZm6t?_F#I)DnkeW$~&{cA-0;-|@NM za&tUIg-guz!?mq&n^|AO^>-^m3(}9t-=Xif$}D;}lq1%Trk_2qb9q3xEx3vn;?aQZ zRZi@Ia@1Aoy~5&*kf5dIrsA=!J8_z|z*aYiSW-(Yc^a}K`|=jKgkyGl&WfyDN>c?w zN*)MsTc%5Mn9VXfoA!~n-1&13t3nVA6|H_Y&C`brRp{8%ZeGVp3LnBQP=g!zkrZJ) zX@!v6Dc)dk;t0{`5BM4+c*1P4NWpPFSLP!9cwpokx(Y0bB4p1Fh-|q>q|(~?ee4K< z+>=`vILa3Aff6{X7n!j38hpgWGJ-YC|3-MMHt+3wkCrI=wE5_H3rkzeRb@JhEE3wF z$6(SNznNPX?nJJA#PY^#N)~#&1MJu|SeE-{wtS-~+_`IoA%T-T06YrUa&J-J^K&TgP@UnN+{~C~(3PS)LU-{Lh8^p$>N@UB*eX=B zG8*TS;XX~KCT;Gok>8cw4xh?!fOYUYT83?=VER1rdKq?xV$gqNni{)Gt*V$AQ>t_# z{o}})Nw%x<>*Dt-AFxAhUn?A?eNN!1r*gFJ98~Z_PTgsibGpEFIa{vH(W0N03RDo_ zKD2+}OCP>7{?2Mi*}d;W%0tG6k*V%-bXu~kczFvV8v*IXl$FV;cRtF_DSq20{7wz5 zjNbdxFA-i%r;Sw8m1j#n3N}CyVO?cCg*D(8XdK}#wn=BzzkH)_r+;;qH^3Wr5ZRjg zjh|wg?3s{2{YYDr<(e$@T;)JxOl;T+(cyP7oGHN<@;-=~u(=xXlE}-!#iNqFw*A7X)1q zE0`r`O8M(#*DY#UU%Twh)m)6{p&r&MBq|Q*L}&7=sUR+Vx$z!EoaD$mQt1^~`XcVQ z2}uHEVK_vv`)X;;Jx;dsSl+R%2PvqOxR~Ae#%K-5<}gKSFQ2(6^fC=Mm#hgF3CiJ1 z>e7a?H(OOOiF_QNb_gGNM(K{|oCtzF{=}YTiuls)O`#Z-YUPliv7>Vj`>mY!ZZOrd z#6B3!*+gdv!V)&YNgXNymAj?E?JTTkbk{|bBcSoVl;T80LaQ)orp}c(doc%E6kqX&uF3HxxuBpuJr-Xe(Mi*$Z zQa13>!(2gjHDx<+PYW#ls@GR~m}SxD1nHS~*zg&+sa9aL)khJS3f=kT&?%-K8iAMw zoMlML$?D6xgeeLw7pL=E2@6!Fboag#T3S}`dAoFs)yC&clWobwtDRT3UEoa<`W&x` ze{ler#1EV{4&L|nlvv54;}>~5v_(bnMq~^<{Ug$#a*iQVIz|ETBZ@AzReBWN?UV<6 zA|N>ZZ0?;8EoILfv$@}}^|PO{h1IT_Y6>xDz$9H!3ud!g%@xq0FIw06kH4vHg*ict z1+t&UE4PtK`zRWSyk)l8yCt^nw}DjhWJf{}rn;t~tvfs}7F z&wzX|Mm3TyXfG;~+~pOL${h9LTB#kfFxw7vhdh3rhHOK6#6SX5^1df%KxYAJ$9Op&eum)cs>?x+$ZzCbpn<9;RV#E|Uq@dxHtVcBQs)S@*ZGTZn|I ziS=IYA{3SfGj$%Xp0epVAl%cFB;LvY~0bMBskTC@e|ANtZ5QTm&w?$y~C;` z8E)Njm-rSbKrCG?DMo2RjC990&mS}u(lLeZ5#4b-dhJ7#>Lr0<4y?q0AfP*+l2FyXS)qRezVpg7H*Q^P+O7|nA-;I z3?IjZx=;)RUb(jbFqn}13+Zh9JEAa@pRW@l2JxPn)8|-zp7I_>6k}&1(+-d?Z216> z96U|SGM|ux71XZS5p!CXD2%PvpMV?Hi&7wwo@(mvsQt~~cpnZ8E=_L%3vov&y6iSt z1a3IpCsS=035mGgA(%Ug{-{^frE9MUV3RyCkz@ISBGIq}pAkK`OGxXyP^Q0x&8M0$ zG3?Axr<28SJD}$%9XxBQJ2){6a{GD<{V@+>>*vU4Xujx88mgMhD)g#$4dTahnJO}K z-T6KHq&v-uGG6NVAY@WLal@Xgkn(e(f~D^*i7R`%d=FhMKAn)xHYmBfyX<;VNc2Yq zM%hQ4@TctydBob(0aug+{QJJxaydp+|Mj_!Zk;Sns7wc7e~d@m42M z!BueYVD(uoU7z9HdCXmjPuGr6R)qhF&9zcPM_A`<@RgWHkU{t{uPE(HpeWD^CctH0 z5#tWWTcYRYEo=q&A1!kW=-~&nMw5+FnL4dy)Qu}&N^3OMy$m&X(2Jbr(Q)Z~&OUMO*A!GTdAOSqkva&UH%gx%#;h5s^sYs?-pomrtTyr9MK=obPT{xR zCJi#RlYSuwp?JAL*-WjWj7ge(UUIS^&UHoe!M#k~a>J}Hi7iPR&2eQkonEz#XU(o{ z#sd2sW1#~kJ4&e18+KwD$|+0rVtAfnJX908CdHBPHgnM!iMhDhNiBCLax;K;a9*yz zA^_n!!5OOo2dhb14+x1mKuJ&c%afYE5mx1R_*)%}^UG>WCaxG=*<2jMYaUIjLqZ$lpUES+U%FdN=jG)x;}- z+XWc9=+1czNhfQMn)(cSma*tbcS!IlU5SE7JnhyHv>%UFa-YD}3{EQGHbsun>Ej^E z4m*jm4I-utI|;IBq|FITJL{>BKbO6-jk6e`7g8=NEy#E*o^pEZbWA@hdSx9KJVHsk zb&x+QuNtdtzb*Q{^dOT!n9O|`2S5G&mf$Ob6d1&zc|SZ~bW|Og!7u@?W7wk+|6A$d zBBUmP(QiklZ8&vJzHnN8&d4j1zK=Yg&##CA3dv1_w%8qhGh_-m% z(%mEj?fh(Vd~_AHLvCTV1dR4Ws}#)kODh(Vddwb~*USMcLoLAxma9!{Pb$KC{m{_w z?z|P6dq7zT^y>*nEU_a=#l(ZL&d*oYqt!_xy)t@MF*l1)<|g^QEF(XU@vOZ3V&#ra zh`~|oZG_N=Qw*NvwMK!x{$!k$UTza5wIupqgl*4Yt$n`Sw(TBuUi^-cz+C4oCjW*N zW~RXU?qS3ipA%8aWes+MDlI=R;0dun!rf|%p4jtaMI%cI97mn@#or} z6;-eH_%!PMkfTCwnWQQh_2N15D;f>qNdQVEis)8|GXkpV)-;X3KG4cLKfo!!Z!gws zr>e1UZt5nM*Ba0vPWOeWJ2WH4*+`!v3!YR0C+jgElTo;`8o4m9o$Bi`IOQU26HKQI3oY! zQTCY(w$P6J(vSXhd?;xeCE64=Z)so!%4KfTV}npjSQ}mx()DpTqS;G*^t-@DUSME( zoNq@?^k7t(pMN`8*#INrrE*9r0b)9V70ElLklN6f_ocC`^a9AUG^hMtr9X~MX36;c z+HW8OFF(UN9j{D%z(95hj}L8$os25^cFOU-YmJ0)6Jncn(+9+U78Z;&VR$S)zXEnw z#6)ud>QLaT(UHtzMl)q2{S-Wjjj-XCpwwn_hGow6k}ujDAKoj~J+W+e)kCip+2GRw zFgNcz5@0r$9;>cm@rABetHI7?#(hg*>$hBCNAR>oPMxWIEH@$VcsbAWd`8@V62NJ> z(0R7IQ?W4EnCyD|z2wUyvZ?HenUKKBdN_eCtjLJ4Xj5@opNY9!pT>6F!b*5-f=gU+ z^)`bTCC9hEja6A$qB~xn3kBKPr)Xh}B`9%H8>Wz&>{GUXQmWty;Lwi6h(tz`9Oq7y zTzrt6`7|Y^UTfaCrh=Qt!&>hSJzs|yJ+V6{=;ME$-GHUTidx38_%31f%d0V39t6 zM(cPFr}&euVAzJS3;@x$#DS&gZTbeV2TP^vaa-8i97|1Yqmk-b> zw-osHlYL_$EUMw}+{068G67s@s4s7&D*9HdpJPc0VH(L&8`U-{`L)(nOkCe;^bGa>pE z=G_}|3uPZH)XFqMj%OSaL#xy1UW*QLo~D!=agZY$T=@!Xo)P5yKJVUIb#^$YG&{V7 zsUXjfqC5bNJbhHRd%cVaooM(JNaXuCiBWVki5)BCbK$d{vMwv^($B4lA_dlc2g^@# zo~RJ|)sBo{Z)&SZmRZQ@ELtg8fTj1Gu}K(B-|+DG=|m6r3zf}JGi0(wbNrr)%gvtJPl8r#zzoR^?d4bn7?N|ctmCV0fl`LvOdXE^h?Ce(wA>l{vBdy{I+ zUXAFv$?3dEsv)BPJR(jXS_2m7Wc=cB2X1xngC+mRySUZl^WX=JL=u{#U`I-5nw3jL z?wO5G<%vs)k!rjhWx}@F*ej){P1mtlqYNAeLnUJ~_>SxNef4AIoy(!`rVY!63<9}E zY2&aF`}TDmd%A*{aIm-QNr{y8sdW1YK;5srk`n?^I=bDc$&FW*%%UqEO?K1WzjH9Z zR274Gy3hDLe6<0YW(WK}fT9-l)RmKLLb#fPrCHK@;C5W|iw`n#r;;8(5(1~=Z)N20 zLa7t*FfdB~Ob)wh0XnGRCqyzKnHp#{3d3 zK+J%d07IhY+#BPhs=v>A8T8#rMNv_gYbkMXJYdo7;e)CrRczNHbNk&R3%6-rLM&KQ zKPm3`F|dhrB_&+xitf!<*M)B;#lw_W1U))X*XvrRyk%3CZ}#13L%<1KJTxV3{#{|i zBWI5{`#oE;8BKsg^9uFnlo4Z$kk_;}O%C;>LrMg<&$;`J+DFMC=Mf_kbJ*}{+&n4j~;qmEuF2-Qp}v)e&M6uf4Ld3{2sY-!CS9& zuhQKd7jsC(qh_n)U?jZg=wcyl;?O=XFgNhQNZz^>TfR(Ap$mshqvLE#>iYLi;CH;P z(eplxR_`#H3A@K{RgZ$kc}oXON-7w#EEH2xGQ~z$pQRMbtf@}(mA*1#`;>28aZH`h zKImME&oY=9T9GX0XH*s-K9X)wMo5$IICz-E(l%a`?e2Y-arNUPp2cikOq-=ZZ6-gbD67oM0K zb&=;7M5B=|9cgwiSi}uCcIZ8FlEK6yMK!++f|1kW9j6Lw23v)+3$M9x4PqErTpkT& zi;d-R736?e)9t%hLKRHnfcz9wWedvQ((TC3hTBOr<=I($XY7f@`UZ-pd~nBtISvd#J%1#YG`LVw4uYFa(S##>Y{DepSkdJy zDIkX|shj;`?J0#0=l#C06^fVMwPGY_DWjk=viB;u7@G5Y+*%xJIlCSyIzcOM-eRvv zTBwUf#fAaG12_)0pW2gT>B)Uhnvz(LR`pw^v~w=F%P-R)QsyK<^og+#XoH6kyIhSprnQ%lDvIX?BOooR~}kWF}zWC=?T`OyIRSV zSn7Rj-5hz#3{JNIS3QhThywaaU8V6jW^DawGTaZtbmh1O!N2r*++RO=BENGE3ibL5 zANJS{aq@F?XD>c%o|U}|yU-|m6|(f*c{)`f)(}>2;{C%tb##K3 z+?A36M7k#|8A$~y9)#&SleJ>>MSSHhcZuKcFm}6_3xKvoM!J<9-;ZUPF?I2}tkbNS z(A7MC5<>nis3H?2I5CvN-$o#{V+B(o6e?PtrHvcHc#^bZX-D+Yvb!@M z>xnhzN1o4XB?NL-to;^)Bf#yE>SVLAzG-bnC*9Cx`@Hf-v@w32vGlx^y*dIp@%V4$ zW?M-v8ll-DJ^PxDa-y$6I-yTX5=CnY#TOnlwGBBjP9z{^$n}3tm&2MvT&*E^nT{~l z72h}grhqER(~FU}!CRZPzOLGb*}2;4S^j0Ns+~1mhM=(%t!qD)~9_PwPCjJ2Y4hs>(I^w zM|s;>a7Dbpu{CiU99xSC;Mg*LrY4DFm?BfmVw^7R{jTM1(qc2cXu4E8!%&}nW#;F6 z!t9qUTHgupFRPFZd!fkA?W0W%mvI&I*Y*;$w~K{-o*VmOH4*KZdH3J;E zJ!7ng9^_ocKm=fK_6sEq@`dzOJJSYPv`^XoN}sIzZAzaN1BcSfk2vCz4?)FmIW|)* zMa%|I>l4Z}lMv2nMziaUWiJ`W<&}n2WgHapK&9Y@NFW??10~UQ50%Xz5oGrVE`jFY z<8oq6S**#D-C&Vnr^G)ZSZ5g`Ai*Q}zLS^Bt6kVTU}f{v&!4ejR^Y0%RG+3!I^)l- zb>GFD@~qKOnJIGI#(MTaCZTfDx^m;PoUxSl$bCB@!5Asff4h;X;tDTxa}samGMMX( zv!}9uYsQ*s1?2CDtSVr|1eiLltM-k1*Ja`$+&|Wfz^_Mqh_i{3KD>`VxOx(@;yAIO zCZmTe2C>o+`iry6wVTW;b8!S=rE^8z>?7z9-L z;_oSU>524w!3$w{IS3lXKr`RuVLGUZJdOfStxH3_!femjpItE3y}vtE2pheW;yOa$ zLC3XLI&)<(E46m3arUTRy-J-UP9#aqXqZSa+nm9_@?HDJ(%HScE~d=ZXmzR)S@F74 zxK7v8TMA*J4G7f&yOH~tf)dyoNhU6J$VvrIUo?0P(n}1%mqtaD1~K%D#4ffnPC9DGbBd|tN2K82)%#4K|o_S5nF&VbxE&Q#~W){6Y-6WHN z&lj-BIC2jg#)516~(J%LZI(moo#I-!rPY*2A)>&~2VogrC z`*AuzX`Q9F{jEZmU7f!x6^XEK8yVb2xPPxT27`}%*^ZkJyF;ErKp`@ctKv}U$z%BR zdr<^&v2OJIZUgrj9^mFa%`x1mj6+eywQ6Y_@iA!%+KA35DUh#<1g*;g>AT~q4P)XW z#jBU=_=4XDV>PPI4H}0{<=*UXt9AScV^&e z@f~@hjAg8xFeL}%&zW4$M^{Oj1fJdbV7x?vt{Z5Y2KyX_P&x70yFA-wT4Bt&dKII& z#r*N%k)2{>XX)(+oa?wv@^|n0*1vy05f9o7DQuXtY?}0X>P_IUL)WPLipV~E9kJTSj#(Q_;FE{yj@X+aSJ>afuCO<+|KFSgt>%5`&JeErDDZ8b z2i|9;E_(RYrzycuhXqFbW87PMZ$uHL6pR-+K~t1ZKW@q14cJYbAzjDYZHytt$39Limd)Z z>WMgbUg&3Rgq=ntG5`2%ZwtVqdyC1B$`4xtm&%5r`-7ix0yaFJ1ihwGxNynmnn!$( zypx5wgmJ#2@{-OF7I^zL5{&0_ZIDmMv4_-bj8{KWiU&r9mbY>_J0xD1SUsukNoT?p zDttU*lHTP+uAxua>qKs)-_k!CQX?x@-Iva!Vw_g~>CHyZTdpUf%U-VfjP8U9qpt22 zX1*cA=$-_9KFRSC5|e9)Pl4P&U|UXnXh$YoRiW)qdbaO zlhj)fOKMBOra7@g4vR&tG2sx4$@@+7Qe^*JdQAT506@DZfk9^|rywYese zog3mBc|YP53|nLJ@a`*poo5#nN@LdKz_j1#K|-Q&ypme@DT-pZj)oI#Rprm)M~gO zSWgKA#D=Wr2+Z*KzK!`MO+{*XIpcGF(Tj(Dtjy1!JvzX9!>F-WXlBva4N9Ka>Z+rn zI1jB*yilqLv3lk=$*8*hZR?DtY7%yBbFnbli-`0fbnc7U%p3qFk33E%=HWzU)K@q(R`1Q_; zpCPB~BYZfPsI}f=dBULJkkfuFl|1#J;0hF-yV=TxSSoa31&bz`{#WP^+EjD7JTn@F zoc)zjOCDA8fgx0j$U5q|hV@`L>0lX_kThF&u?2lffR$0rZhmUusy|JSyz|`NKS8l< zPUAZ&F!6fs#wiHQH6F6eMFt|W4wnz(8LYm&^y<%wU_v@W4x;O~uO+9*qv@voBv4Q) ziJ6odH%=eWf9DmIb4ASCnx@1p`>svy7vZH+C`t&1A*G2ZgYZTnrJGV+y)4=6B$-%h zLfLH*Z_RzDXgXt_cH^h_8ltSpu?_l;r{1-q5YBsd z=jB%y0J;Wa>3nzM9P{F}x2f4HU2g*Kh`cw-*kA|0kM@AyM+3m`qrvo*`dz&AEbc^t zRULSEu9021=NMF&X*_E1w+oWAwY~l0%`(35l3~HpzQ_fcCGs1tP%QPF(v`-emz&Ui zJOSRlUx&wtkaht&7Ne4iHKj;SW6#;DaAMKeV@$QneeSuuG9;KoE3^E5P`*Fzus@D3 z^Qndi?F26cx*3Y;3s}bL`yRcB{)H$Xkax68T2QQrki=2}K_9xDd$qnU`?mMus;y3R z#Ce)n7A3P1m%_cp5jNqOvZUnI=_hp3;5U9{A z;_t(wm-u9#?FxLzT30|pwCbp5>}&LDTiGn6_5-OdO1FS^eTD`CdZID?O+7;A?546)jDg`u1)d^c#}Obi$X) zr6!m35mO{;Q=Wr-qMUgW4r#68{l;B}oO$AMz^9_Z8bf_V_cr?r89;(MDrxM6rSI(V z3iu<;#_C?@-s52-59aKqUVc(yp|Izj9&XJ_Ly_LA{E|*G{iQ4}wfsnAbdq&~^U&Q3 z3-p~6;ueo8$x?B*3aXQZDqVvX=5g8&@7(CoEwW2lygNOFm6PuJiE%`yl`zZnVQ3C* zkRIe}@U0}V`Fud=J8xFbck|VZ5g@U|tb%!<=G~m+q^*AhfZcgTM{i3Nd%udblRU+N z9>w#CQ}yXZ)am|ue{>7oi7DP^*^tt9cHZR|sN*J4;XH0qm(h+rQm@W)27$Dyk1nGt zdYU%`LEWUim(k8WgE73IR??pOXwIHu27XX$O5`Wz;TG-|LfQbk7ex;=Lxu2a;_UrT zo|LpjTHU=RM&_1i-__ph1RHmbYo&^%zo&4UO&WvY#FTcvXE4eqT|7^AXz?`}%S$(# z{6G*b2M*)w-d~@>in=;h0z9r82m0q0}ZoIa?WLTY_SUYl#@}Xevtf6q`3gQZhT|HZITL@aJ zv3VU|>e03XaS0G4n9B3V$r1aMw~$(>X7vyZT;QNSXQeD-WqxY2jNk z+e8{jZUl_>&MUzH6dOV1ojl1$@KhPhff>>4^B%{0(M80{+gl|rjpS+jYo6h;!`PbJ z{F+!~NUe_a`iFU3t}=0^)iG>VZM-Iu{cR;n$L~vn_Sa3ZYmrh}C_`kUiw1bfzPaUn zu2z+^tWC6bcu&S>C+Ja)k?nc^u#|Crmh=9XrzI}Mue}6ZD5|P--tDQZtvbI8IU_Aqmpn1U;eym zaVnJyvmT=E>?qagWk$sl#tDZ*5~2L9KKSlSvT4D?;kAzP2b#+VOKtDo7xbjpI{Ticv{O3VBtQ~!+O79qK5fvT; zsCoj(#&$!w&AyXdb`uVG8$i!(7x_NBF9AU*hMMe zG;3gEh&nlk<2sBAPpi5ut~Zb;Qh=?}E=_CPB10C!I-NJgv^UMmls-C=$cfa?u3N~7 zg0i`fhCH~%VKDhnma+3C-M}#?|Kzd!p>QzfcrS%sfQeEJ=OyptRL-_uxEMY$l2t#y zvdgpK47Sb94YNGZ)?~T|^NF~1lHNufOl9njcO`rk(vZvO=#wGJf z6sOvn+9Kt~M#Z|xk`FrXro)XIAJ_K!yD-mM?3lVy_3Bbp&K8f(X(h{>ef>yFK^|jO z(eX7|W@CzQ-ur77Lu}4W{pMJGzj>gI^M=*S^xFiN@QMY~L8kg= zFU1=R#+N&+Q1^6enH$c{j~ZEOuiUJ2&%SSz*K;*+J)ZXJJ+B9p8y_tRul3bjYCa$N zkZNABG1Fiq$Tm~RKGl~s30t!{j&Wol+Icwhsd%CJnBPM&z$b8oYOB#)@hvUYF5x#^2oim`P(ILcf=7&EU%jK`V~@O zHP`O-p3xuMF@NkHW&L|&sH&T-34mGAz!bcNQ`yA9#>w8u!~p=_ZwubeYNTS~2+)G; zWMx)0adiYROId*{iu^c={y0kMpfZcQI!dZIUhi)O-zv!lxZa%JRD3sKpr0OjqJdiGcX`g@Y77J9UTCWjjLcND&W1XMvjUG_K>UK4X~;Ph7JH` z74XJg$Ta})x>c@`{%9n~-+ygB{!c48T#I%BYXaUjD+4li0BAvO(}BA0TBo1xyLq&@ zrHK_7#`QK`>zga!M+1OA+CtG301*V13IIY0yDt8nut#7VU@4GRhTIEjQ78e|t@%3v zKco3!1!y#^P{OW@et>=EnFXdq9A zGB7LDChD6o_?@9xf0zdv4S1vTU)};K{v8@wscST>*W0MU-Y5frJRKU%AGr`AW z*tFOntq<-qpbhXx?)59NKq%INl>g2GU=FgeHof){w*Qd27Npsg0T2zr2Z+l-L;SZ` zg77lik4{+za0BvhJFx!|6SDt;34u^l2r2)+smT5xI)p%gay0gTQ|Twy_)8A7+XFeE z6#OH%W&ee10HLT0QvN#y{}r1S`whDSIiak`{zv}%OO>IB3{w6(kT*oe{(~@N09rS8 z1wdL}8F14G00<~(wq^gLaA1c7)X#hbgd!x4KVmnIU$7f1RJH^u|DDc18|D|-v>7V1*7pjz8**eyK8a`2Cx-{|-M0s{?L)902h- zWx$R30UQuU0^GC=0D=@cCOQ8oujYU}=pXG16_cEQ+{B*`Q()QvQFo)~~Q> zK>&ffJ?NO^{G%@GS7Ow)2jrITt8fc3^X!UnmL$biXdt|K}ItSdi z75JU@`ZWP69w9Y9MtB4A?{0wWkHUfL7a1HI6vJ};5&LufK=l&?K=BEr{CB$j zWYu3`(}Dm3Ta_Eys@LZKpTx35y^25{`#Whj48ZlDgjEaD?Ezd6XM~3LZymtT zT0=UdpE;Qwibc8pEo%P>j|<{xP!95Mi57&A{&p~}8#@3X5B|wh|1EvFK?21@H&Fn% zX*#GD;{Kz4hWi)&3_BEsbN?HzpW2)I7ikqcR9Xco|D8MhEbSNAv><@Mc{Frd#r;Qt z^-GnZ=n_)?JCJ`f5%=F|KBU=|0XHoGfFOdlFQn%0ghH5z>qibD1GoYCx1(|Yk>7Lw z%I~4bmgkSCoBIbUXeMHZO3EPRztin!tNsF;76cI3s$5Wx%=2%t^{-;tq39CQB)xvMIqV)AZVa1%JWBk1J5t|1`a5q1nIDTD+$~?Lrt`3-6ZdTn=TV@gB401kmZk90m$-$p`p2p11cxG zsqj01{~Wu$L7@CMH3M1xhzWo!zoG&tI=!jzJ4pYW4}t*r3DF<136SMibOOblK$brW z{9nrBgd#g2%e4dlPQ#!0>DTh0(l{W?A5qD#W%# zWVwzpW$+9-Bx3*{Z%FyZ7q741e1l>P|%x{FV^Par z`2G`9k3l9bCiaTsNQ^I|N0~F*TSJA7FrLe zF6`!`??3=}`3)B*c!|$%J`B&v&I;~Wp}q_6;bE&i<~FS*xYpPlC7+GjXtfwFt1f=7wOBb%IyJckry2)9}70{a|?t`c2)v%m2-#VZXl5rB8R` zIZVtPF;%AI;TTuy=*)fC6?~Z0;MJauz?q>d#DUpcu152DZdON?mFGNwdem2To`-D* zu3le5eHYZ;WUh!kwI&d{Do=1WqY0Z&!)FwHcDaW00Uj9(!##(*xTuF zDvHgvXpJr1Fkac2$gIdXJtcbqbKhTy_>%rV;@&bkj$q5y6f-k3GlRt}SzVQN$cm^{tM+&H(fa^aIBs))*c=D% ziTn1ONU)2F$zV?Z@mtpgrg2f$Cn^W*oqqLuNlw_~d$>Tcw|Ytq+M6&!kPLMtNyGek zY%Y*Z05mPU20gwA>H}~kQ|xHOL@M2WSe15zyGbFYz3{60TEx8jZCq&hDxJ-Z#*TdtS19G?qUYXu+*)Fbu5Chv?F)EYp8A6IY2}xYg4%z?7CYS`*mkhH@vGqs?ew1Zw*{?X%8ls z!m0&EIv^5^mnjhd0e>jY45jiFC5uvD$9%0yeoX{^{U)`6ul0hKqCdsrvY|$y>f-v2 zgZfUGqTLz-+e-8{_160p+uQwsfmQ9YI%((bnfH)sSd=%q+Q;Ej^FEBf0n-D&CgWY2 z)_oOng7L7vN26{0^59vg4_(GELT>kn*1kF^?c(h0cgx(;D=$!Af0F3+Gt;m!O5(9N zCpPW$oYdRG{(L7(&k!x=RJVkEeNHWEBRc1b{4x6@Du?WkR^VQM_Ym3m%O_8X5AM~W zg)sLAnFQq-NK1?r@8B;9wxdg-!Qz*d5txr>C7pd3* z*qJK?J2U7zh3JgGcw;Uo&LMN`-pIC;^P^PePwt6~jzelTl0Y}nnJB0=Bym`Z*+54d zZEaa?ZFy~Nd%jP-CEz5vxSFKCRER2`dChue4+p0?jPGcgyLQ z^ceFW8YiAV5$YB}oFw08`v`tSDCPSozU1HfHhg5Y>%ZeaKsF<<_l!CpWR1L(wx zFkp)`rAv*RSzn7fGr>I+jRKAJ6O0A@eLJak@VB+WnoNnDOW;sJ93}cZXxP)F9AS!- zxZ#!7$lNLKJ!mG-Mb4H05ePC?zmlOukXi~oS{3EwZP_H>LgnQ5FLa|*15KI%zZSHo<33*ohdfdPE%z4Yx~rb6tea`*Y2iXYBmD6LXt?>5SJLR6i~}5Z=q?ZlJueP>RiFrdIZ|6SScW0#p7D} z&&czh4;D%?F?=>k;f6FW9j#DGPZo1Wi@s%F^ixxCG>6(>Op0kI#^K~FW%r80`2qum zq#ryYQo>7orJ_^PKI(CC7+It9H{zM=a?M-$;+HVya9YkB`6kAr13*VB0Uto+hl9$$ zi!lwbn1*k%nInEVLuQx&LFkH94m3U@ zK~CFr!X629C6v5%;;VMOL*bi>bj{9*u|Cvzd6*jzNt|wcAAsrXhwlpE1Rm0ZQY}6yI2y;t}R~7469a$6Y7#ukacdLk>#Izlm zQNNg8yzdPttQObq|5+g{rSw^m^7l@^IzNK`)5PA(Uoe)#3DHejwJ<$2^SwUi@GcdtIDuxh!V%DH^P9vDJ9GYZJak zPZGnqWQy+ON{OpfoILA#=!sUmI-?~sstvc#v_Yt!sC=APANH-)Z`x=2SCg{+G)JQJ z@tT!Imev*N{*k1~T7Tzcn8%m?&i7>@ZgPsX{x@dQ@ofYPhi4<6_;F3l!*zHB&ZlEX2FO-CCc{;d0Z&5`wkD)m_A2K*z6lQ8+0K@OT%{iokuutGGZ-$;-!~Hvt#%96+3D-ETxmwb?+d4Xh?+UE zjUI>&jsFnUGHH*U8a+-QI>_Bjw0t`4B$_3as|*Zo`>N%=Lel<2c~Ml0O9a}a^_IC> z2LXl{L>P)XE_=ds?$x^JXQ%TbMtZR$d1^z*<|@G<&(e2~0Pf9#rwFkSO!w+E1uA3B z^gThAeAiR{yUs~hE8*%)+E$$HuepBj8-q@}{rP-H^t!=s)vgI-Y8yW=Ff(JzJ5P60 z^Q@5#2MI2v$RxU6m87az(MLJrSkVqU2(dPf@O=%~K4#i-*hmepFY@HIYR9+n^T1`# z(3qQNJ}juzQIR*1VD9XcO_6hi#&5Cp3WwEo!`8pYy$AYYUEye;7&F_ z^%dz{P&_M@?Vo-x4MsBlNNiXhG4i%pr12HUz$ebhZjhGCU`M^j#bdBuXB0knkO*#B z3VF$vxJSg&jGOOUKmF-5vmLt_@)B2T)KV?hm<`U?U{z%(0>(xN6Y>&P2X!C((`P{g z4BDusPSR|e-#C6E`yFH+7v>HWgfuJ&u!#V+{vlhSaD`OL==I%GG?=?2$BfGE;plaf z2Yh5Mlm*2A)-p=4slpiOOsVK__6`xlYz%7{64E8KfmRJ=Bvg=jOqe^V0OWzBUZ~wx zz!prcu1+-}pY8;GnnazFE0+P-i303Q0cxz)lB5-mWZJ;kjZJ3T4tq84!iR+ozipDZ zhyHvEWNLpwLkxMzj4#47+av)$ltLBZo=_IY;8|+bW6PPqPN7qpXtjw4`Dg^R*p3i` z=~azH^EZ#8bF04bUh-ktnbs`y*Kd#n_S+m$LbwhDG>F8Y2I?_1sk4sWDw&`}{jiKg zyWVP)1n#jjp@w{p0<`$kN_xmB&$Hp6++ER3$zAEm)3;28ci^tLRfW&X@}U+Xh!}iE zpq5;+HjhD#^uv3aC<}z@94MoFB#vkmeGxTc&G*rN`cisUK)+jzetgSV z`bn$61|@jyhohCDG}U)fH3*U@U@qByJ4o7UDDHIa_5AWvr*=LsCXIETXBTyQ``udu z#vcOjAMwV1-i{ykF%(;{?Y41zxT$O+}x0&|oAx>FEc{q9Gp8zOXSTR}0wS@w)G{cuVN#Sf<(8ly8nB@cVtdvD&@DE=qKJU7l+X^P@ zM-6;LOzFRj@i!;EAO4zfD!7h@m_gGPCT?6g{2BPhE0(N55C&1jF7sH;vO|?qQ#7eJ zzw5kuPLQtk(cd3h_IkY|(sVC(ktfnLF548iwFlHOm^|<#Vw53$OGXhin=2ZXML<&D zx{7ZqtdYa8s?*MAWp8V19r^WqiSvWW?au5Zc~0PCEfg)LvbN~ps`XT-N9V&GL;r+G zI}oxj^^(R!SXf+GR4kb+kr4=y*DZ9T0Om5GJEZNro$oa4OTOF2=C8H2VriFmT$a&W z`|dl&qV=mzIw`U(L-?s#(tv|M^Xc2b+mn`MjsW*==aVlJE5fF+Ux1Q_?7B3HsURCI z$y8L=9ac30*wy++cgaS?$w%^G?xp&w_j?T=w_iig=V9U<=j)}f$F+vn=SN*#kc-b@ zg+y#OyYpp*M2wHC*<;(0nR$)w_zSP0*I;G1RJK|LiDgbvpz2amyB;j1RIN6eaVM%7hjfLW9j+s z2s6ImraM=Bur>#iw9X(~tA|muL4il1x&0Kck78cb(I&}fWz$iTsZGJ?_^LzVU_%p8 zN+nNM)0SC2nJ3-u`~Dk#e|7$`YwLZkkMV7>T9;>+XJyXsSU{`k?W)Y@<;dn__bHvg z+5(8U-YG?GrK41g4C6LofTJvmEJSdQh-~zi!{L&)t00k$?Ti1)Haq=g=4uc-a#@k5 z>-@>#w|g7I#@jUW>5}~Us*8t!tfn99+HZ^#&GJp`90>NXV(lolBCcEbJcM4W_)ssM zLOBH^%PaG#{K~2~N%OiD;P6%Dz6w5^apQ%h|YkX(bYw z;gtxe%L_9D=}3)9SyjtuOjAt->??ogA?34zw4`e()s0PNK(*T|J2=l=G^Su2(z0~! zPfoY3RWBc#oj0+yG&gA?n^#!cx|X)#EzAk?#K`BY(WxW4J{8sIaidg2!$C&R$jIw! zN7sDgWMwfPueoHlLd4_u(1<^eW=DTSy(~X)*U(jXYT^tH8G5I6*Cc!eVt95q)J}NL z){#@piAFp4Mw2{DG;U5WD^{3^nGQh^6JN-RfkeT8PJ7qdV&nA6%iqz}`6X5T9G*L~ zoPNzqAZYoRqps||oVG;gF4nZT{mBKdjmf>TVO>{&+wbn)IQoGHCqv_E$t|VlV@Nv3 zmt1ABk6+`XpgZq&CmyuGK2V{@Ddn4$S1tXLj${-~MCt$ybOIYyLM4*rluSK#{Oz=H z>b6_*kNx%F3$Yk=f{C-=?MXFC>m!36TZ{3(MY^w(@wJ<;))w_R&*#6xe5p30$T@RZ zV?)Bqchqrg?F(kB+-$5SWYjRDAE68xgJ!|KujZFz!IjbM&*)oOC8qi+r{o-D zM)o7E-pjZc9qIu$V07*>*jhp}Y zksiAb1Gx8FIXw=X(tHSJN)O!wMLuNI+OYeTZ}HVo(Y5g{&%#KQb;@t|$1hn&SuyzP zu^S!-6UG+U+Y!GBPvnQEN8@F07k>#jrB(AsaHdY#r;_z#L_rg z7~s7jJ!ZW|Rzn5(lFM=2HqoXh<8b1nEW4(pLeH;oTN++m~vp%`p>s6^#dP21d`luz?Jf~-* zolr-A9-%}@7a7peUa-4((BZ%gx1}HS6n)n0>ihAS_qFJGtwf;1dM*ray^WQDd60F6 zpTm1cTzULt$|4Cn@AT5!kI%2H@hyG6i%&~SMO(|(=koW1IwQf_D-WOduh+*wA)l<< zl5-KXe6$^nEYH?3SwBNbVyW~g{AMw+;QYD#xdfvOk{GQ;l;y9|!b}}@ev`{9$9J4; zGFv8ucJQ|IjkbAJe$uBJCXZn#-vGKi+5 z#YfKiqvFg(vjmv$^LcbRK{uN7NZ0DDyi#71 zQnn*4z(}RK=W3GAV+;1#`Ke2%`ent|{wbPP1hd0V2j8pQ`o+un=<)C{CdQ1W=fmo) zjdWR{<#m;`plsoIQzUdkxhd))ZFQz4`Dt8AoIl>^@ZBka{LGO3sz&~9vjK76x7}~7eS<-L>W(C>nxNU`U}Yjvg2y|HCedEcarKvP$a+6r zC+XS%+*vMtP0d@k%I2AM>w@{gJLj?~QQlEeX0~ZzT%%X_kNBUJp_$nkGIfKhmUfct zO~{X!o+jcrk3(!s99@?luUKU0w7MPATopmhyXA59{L!M$;o>QkDn{8>E|F5@6+L&y zAup6)o;>ywtT{{E*p`Mf3PKS24Ry&$KC<=SGqaB`+@tYiV!m->F1lo3J8UPB`xvGT zK(R2RjQx-#%Zrjsn3Rv>1|OefBORr4pUFbrbk5k+mKLl4Ez>AN-}R)y+gG4dKZpr@ z)lOna{tYV)+tS*6`OD3D%C=%<8ZNDiPD(Xva{M#vC3ea6&~C+V2yP(^*9~22!rGXu z4Dna(5kaeAD9DrjO5cO}`Qmd6nIrecA^PjI*=J<8Ka=x zpvOkf-56~i{#^BR!nO;=&~=$z+nCbAYG*U;^%S|42y#uDCfTkVWLX^SH644tt7f8PSTTVm6c%~C_Iyw#1`4M9B^~6K)5JZ`IW-Al%H?@ zj|It(#^ax7(^#b_RXqs(dV;vGdCy6&@ohOM_Cf;yTaaYnxNn@xUNb|*^t|5Skecu$ zpJ=Nqh70x5$L1`jtK_J7|q<-=M4oj&i@;OZ&xqYxe)28q82rEHg>Xf0AxD;M^v?(p)DYWTj=i}t(?7!y|SU5Grh3AjS1kmjiI^opX|Ou z&c*;879hTHa04VCKo5UP^eo)0e^ew>TQz|E3W%2#F?5hLwKTT?9O7gKoFxTNs4R_z z?92hVmzntX+ z0T7>V0vM&Gi|5~JWlv|oK>w+%DVdsE0`9ga5tR@iqp~SLla_ZfF?F*1qf-C#G(e@Y z>z_o?euM{2FjbiFTGHwL7NsN9UWERNYS z^>r4$KU$`<-duk5Sv#4*L(eDVdHelo#~pK4a^tqnwNp`HL=pihG&Z%jxR=luv9H`p z=+yltF{Ai%{7T)^>N%+L`O~&eA4fMc{DTxRUAz9Q&V_sk(vFRSQf$*!beFYZ@H_!p z*y1r3DF$^zBfycj#UUhT(N!5;H6prQkhr_Q_h6RBIWaC72W0Iow5AzBKnei~oc{BQ z|07BN2aWh2YvkYN`kzS-Scm^_YeUQqkd*t+RQ|UWKri{vRc~SlSfhaT0uaHO{{ce) zri6;Us-5MZMBad@{8y#_*M<8p%*{UqUlwLgZop#upC$_@2j_nhd~IEDmtD8J?9G7U zzy#rLqyqCHut45={qw=TNfnYIZI?XDhNB2dkqIj0Q$>)Fe{D8lZ^n~o78xdtPG5`8 zSXiaFh~>HnLR)uQ%ceOZTThmAb8fz@ULR=M!z)>%xVS0qh;TO!?65ZzR3dbnbAF`U z;t9Q)@_yQI@7eTyf`{}6G6)&(6|yq;Y{sYjd z?;y8k{J;U?zzCY_vG6)V-3*0*m+{@;Bx_gtO=X2Wt)J+J4 zmc!#n$EW(Tg4h6*3grJCl`^Jia(OTZ!~h>CDJPZ3eP_X{?-R(v4wUL+w(Mo}eo%tZ z54ZQ4!v7_x?LH)=lVRNx=s5?7C`)b{zk)7W8t6?M=y~?%+iu&UfImLavB4g!c`SV+ z-y5MmB#}P2ATW}HD>@7?FdQNYA^{fy1kp8!512gYwt1D=HgEuFQ{@MLfoo16kPp|Z zh(E~m*y4|^(NF&lSIWR0q3@uf%;4|?7ymp)8x53Om{8&Yls zwnc0}kbG(6wQjhPfJRUZwN7WX@PhEMK#9OXcEGcdvTu+#YR!&%1u1`lov4@I49V{( z13g39M0t#`%tO^`+K^M^fpYzjhP=K;neX{B6$GZL0E)ZYZs*>3Q~Fr5ez9=}-kJHAgFGowDC*ObF*tpOK=#Pc_i zBzq!aA^iG5E!el&dJCxq=Xp=%PRlOK?ljC0UaHb5LC4A_p!_Elj^{7)M%u-AIe1@Z zjuW9Dc^8w*Or|+ya$NRbwb$(nOSf|ILJDT!Hzo+fAPpA9KkObjZfZ95n);BrK=@`v zw16aEPeae9D?=a3x`0A=YQ+JQ?C6+BZj$Pqkm| za-jZiKA@BW%a&{+tW>!M52yX9-=9>z@Td{?Hp)p8Qrd4z@9QQERbA70V(JrJC0NpZ zHwW&8Dwybh>HNgB)(gowV-iMw3qnAx{rTjQ8U*pIi+|XMc;uqt4@z`W3rq%d9O}sh zc~?s~=YWGj4A<`fSG>cU8OW9y6663k^^;_xmp2mv+D#CC;ip?^s9D@LUS`l<-1j@0 zXjCT9k{vur1!%-xx6%NL(tt0e0pd_1d@@3OGJ=b1>2qu4bGj9FIz^}u20&l(UY2jY zj^?{61`G)>wn;KWuv5RI(vM+2y39?L8WS;5=Tj(X5=*P1On*TDmSB@~Y8q2A+ORkqdF&!^J={J?e z&8j}U=xBL~dTtqVBE<$7Dc)<#K z8gbv@ufCN}>5JiYO5q8ucpYXE-n{6E)Nm9r3^0g18v;@n@opVW| z_6SP+TwYZu^f!;AZdMlZ&s3O_2!wLaCOPiZ#It>U!Lj0rdf^<*rPOIjEI4jn5o!n& zKED%1tyewh`#ZT)<6@+xr7gn`5h;}P!oS+klX#P$;<1WbF2JdTG>x4GD}j1| znov^eLfR=ETUC|ABTcAuzi5^{M3I50WWAA`j*vAg8IfXT|M;Ck6J0g;41?9-A_zK1 z{gJ%F*HEj}1j@2R`J|bti5g8gK@@iH6$>~VW2}y>sjg%vSk$(>OH?eMLzQ|Ca3v}G zZ0LK`mek~miZP>xT7~y`k|xh(%_iJUc!`X`Wx6NWU+>SCzjSp2YAW6l$U((!;zf%~ zspOdP3yi{Sxxa$c$q>I9lLlakrO+udFr|(#Jt*=cX=^2{)Hhq@$S`LGb**t_2!mM3 zCtwWml+kadt0=czC8)g2?whk-R8ZQ%skbDgQqfana;%ORVwu-mZqoF9$ zyYoO2treleFvf8hVU9S7>PO3$59$0cNo`Mp;}S7ERbv^^icKJ{q*r6XvzAVRo7SpH zK-SPMH-W3%$Tx|qq*rF4Sh7=P@vMZWc9Q#Ch&$zuiz~v3kXW^YRyOU=wYI&E;=tNu z!qUOzt$_auGxKw1cub1u}c6hG#Dpv4OKL!q*CEOihBk_z_Cv;!jnl z&d_HZ*RFIEjgGrJYri@8D*Jx^YL>7YTgXcsUCWiES2`NLmM6}(gP9jE8rnc9mhD0K zVdPU!E#ppu4N~o|Lh4!{Cn%NcZCR##nKZ9t^m9DF8n0t1_}E1y^n@WKFtYss>i{$f zvD5;ab-+T1*TtqxJh?ErsF=yN8&$S^_E<3pZ`@FtZP4he3zcJ53fQQ379tG!C{|?S zi=(BKn)wJmwN=(Jp}g#HJhAqy!odqn#b@Doda~cgYgfm2>6Bd5@*p!{@DV7oIiCBvmu2n}&ys?&A^2<&- z$)IL&m(n#!vO6Wp^@xn_-vwycjrGhI@qGGuGAD)))?u`bo~>^)b{9^Wmm~z}=4Gk@ zCNEp4Pkl9}ZaO=<3oTmaT5}JCP3XF{g@|kF^L)P7K6a5QGcoL^XM@1)ZhF4jp0Iphp`bri&eYVgblrf4qTW};$V5#+vJ`Fle{IVAaQICzu9+xLjXrds|S{MMg)4~=NoDrmC zKp(tCI>WsKQBDA=>xt*H_Gju0nc^~}>x{AjCfF@F@;s@c} z!AtE$b**PayhbAW$wkU-pdQYSqhb^tpOJi#t#*d7w<7aS3eS^MseBOdR0l@dE2Oyq zYjc{H$>4A4EQ=offNXxixOsJD-q5b*2fP&!sgUc4mreWd#d8hi-|TX)_u< z8ab0!GOTJ~R{QS4?yW^Zw``L9((*%hNSYpqIi9m`{OzX|F&+w73{xN(d@$WT@Gx@- z(;RxhS6q8)=og=dXm3ehU4=*7D0KKQJrD)6C#1zT2RZELux@ON@G7w&+LrC@X1F{@GS!wZFE@dq898qndLnj`80^X!e4|3^w z&=1>&$HQQG@TNEkgYmQdU(-ouTL$Vk-#Dh4 zp7m-g=`Y#x`hq7{?nPceQL$Z0Uz1^{L=<*xO=k zfdp?fp9cx0O#6bO`JER@Rkk6ui2J?W`!@)`>ijX&NIll-juUp;#bB6d_r30K zb%8Gr2SI!C0$%*l-*_L!tW7+x2O+b&>Tf|6qQ4WynNsZ8g5zSGqc@}zv% z7D|PP8Mo!go)!c3CPGSD{J}(Gw~!rKCa=a`QQoXKbmZ4|7Lfgd34x-|v&EvlhZrNl zAh7-{Xr(>zO5U0Jj`*0rzdS|f^H4iJ%jnhp{5)d3@iN5O^bD?1HAXMig0_E@29`}) z+yN4y3`^DhTf8oR^N20Nu5!u@5l_%*TQDn&jpy_fk9Mmms91tUI=OG`SW^~nC%}L) zbV2}`-6~%pw2S=l-qbyll=0D(28nZI#poiI(4J4$?7b)b7v#@N^8}Ec&mWl^ zUm93>1e4YENH=KVpS3m|Ee|wx5vLPPsRHR|Q39W+`smwT$PMg>qZZ=4n1!=*M!%&~ zet)ODR_1m31BuHfdL$cHD2y7M)D5Q)zXHq- zuuyAynnc108Nc^g@}NN`zov?_)1T)@-fG?MkGmqUu$YVtyEnsjBg@@^5+4>H_v*2D zA8T)@jNQ)zs69{K+_F&>1V?7x6JesgdPx4cg2mAzcT9E)4}Ez!__iTXZgn%Z&e{_b zJADyq^X*@w+|oLfY5QnnRa%n$%nxy=qc(Z@y)CYRH2K|p%SM{5R zdD4N2>%DO86FFB~5@zEtxs|NQMzE3M&NgZXIWu*>3c_mu4`&^z*6x1u-q01lew=$r z-ut*+%?c7R-KYwUy-bhclvhcHK(LK$`O$Q-=1ujMvPT(d18Ga{eR{A))56%~cNDiv zbK216W=C5C-~Q|26^NM7|9ON3OB11wO=M`1)r5ZNWRrUAfxjf`X4XCIm2k8u09X)9 zw@a3xqPuEZ)t8k$Quj_F9pkl1_z~-0i70E3p+)& zV=_p$(A$en-ogZTOx`(&=`m^akfshir-iqJZpSk+6w2-m!tC;F4-Iz;sXQsF&Z~3e zBd)`}cdqXyC_wB4%g3(?GYFDiz_Mm=rN z(-Nv?xz-9B8m9@bxW2Sm+US_Hr*hQ>N}d*l(XMM+#E`R2`DH9fJQ;`^Zb-7rLKhSCF0Y?B>87Y2A{jI_2t_J;pn`JUzW{wYU{2q1jee z>LI1MoLpDmTe0H<#|Qb1wdYr06qgKW30^3?<#7bZp~NxDLd`WNh~LPWZW-*;spHDQ z9f->hmEb?7Ub^a7byd3vYACgSA9U-H>z&$8ZavIA@7rIXOm28KbI#3+C4aLfp7-55 zwN)xS-9*&)XrhX}7M6R`_K#Dx{;GAZT%erJiu8kA_ocfd&VSF$RVHYtgY$HqNd}7Z z8>1Wxwrhtj6kxDD>x^qKRpP*z$847MOBE+2JScEW%Mxrkl?L7FC80Qt^17{DP3E~P z{=)h5KfNJZVjG7Ova+&X0AuCT-D?nq`8apJC_j>-N=m@nGS=?i!2pXoH*&MF-8tVw!nM}kNu%k4<`=TKpQ{2 zGkxnuWNH+Kv^H|!fwqWJ>40$q#y&O}RX+=#PaA18a=h(EgcrS9U8Q8Kncb%rSOsi; z*SA6$Cil#qd%@}6pbJp2m+v8{N7IZ$Ppd%h#9tDl&vMEj4lnH#C6Yn>7ogiArorC z-Fo%u8y zmO3&%g?k@9d$+Sj{`0*macj-@7-?$l^t`yf>ZPVL=l$ce?2}=>bPU!f$Oj5f#R?7$ zXqTD~{H9#KO$g=}s0G5$=HN()Ln!f}aO3W{4ovR? zas#G`hm!(|dPgQ~S5ljsc3rtp4GZQYY;XdfV{L(!w5NSLnRO=ABGXL z2-Xsh8=(eCn-C$vuM~F$yhvU{Q+-VC4Ib%b_*vMK-_3VVs;hCT6qopZA-ZAt41PZY zSy7cZ1a}Jc?g%(KV(Y!Evv>~+3ZOLDvV zUZ)MyHtRG?t9}D%?FVbV5<>%{tKSRgCFIVU2hCO136=|~w~_jWPy-8>$Fp01DJzLk zDS?6vC+dueEu^h(q)*C1m^li?POl+1^zDL%)ED*EFKR8Ke|0&yBkv!W zb`-%QB(NIkmf%JGigxck&c6FO;61);?`B^{?4IrRyXj!9Exb6dYHr8&24i{Zcf0S8 zyMlEI5YrD|ba)G<#8|&k?WH? z846?FO%e-*m5s5AY?@NuD7$|gb!F^swT+FB#l35GX);o7@_AI!cJqAYc!0k-wcRBn zs1>=Q#dA7)O?k(Pov_3%`Q~^dzR{-VzZ#vgZ?XUamHoaqu55g~^o>1~5E&6IkWtG_6l7(5Df>*@PeKVQ zMDGG08nZ41nG^QcBh=FnuCckSm|Dyc?8Q)n@fKg(I(PVejZ&=KL?#-yxR2)Y!M3;8n~&lRfIMLQu2^@S_x0828 z;ghR=Dfx9-_S4-6LVLF;8)0%GM8r9Wrud4up~ginR_x(t+W08`S_v~gg5iVMR4~fI z{VbU?=_&c8RI6IKYDr6;eePF%{)mpKYIrf0;w=GQ9dzxQC-=}&a4w@8K;%-4c;G|Ampz!Pmyw90o z`(Fia=Kt!t{zr`dcL3xcK*&Fk7UBPdv;de5R~y4W)XV>#YGGmj|3tL_)bD>%Er1Yl zCJxU3NVWXKtovWZ@jvn4{};vnKMo3@s{f67|5xSyza8AaiT(dSfGr$<4Ho_hwg4~` z7Jx$nE1>ev_UFL@fK*rkcLDHU7vPdh1lVN<0P-{Z zbuH!mYi#}pk^ulK0K|tK;CIdqaH8P+>ukUQuma!&IEium=?>tS@aG)Pzy1q=^SJ;Z z%wIHy0|2u8L1Wms0MyN2GzP%au(GiM3IO_r13(NXUvsMf%j4P8RfrroMKEqx}jQc4VG%)USbh z@|%yTFE`XB2SDV!gIv?*I zl{ls&u2w;!L10}-CBPGH$y=B11)Zk287=fwRaKFgPW8XVmRnQ$X!!tIG2%FeC_oUB4xu8G#1iKqN6nV3h|n;_T;~QwEQt#_`j^ge_Kxfg`N3t zSK$8|pZRMB@t^RSzpfJh`U&wb*Y!_)20+KL{lV$}2fqYPCT@VS(ZA25DlcdUongdDDrd*DFEgG-s=q1jNqXa!%&1_ zP4EE&E{P|&K3gD7eU<|)05&2A)FdIV*V@Rd#{?ru3FLG+a1yeh{&|X+195x>@;ptc zoH8|n`E?EG4aVP##??v69T5+BzX!C`>+t>sc6B-roJel-+u^UdvN{ekAYwXV#3ZKQo}Exo@)&Ex0fPQFCR^La8wbSxSQBqhwHnKMy01}#R#B}l zY3x>|*I$SC1itxJm%fT<1S5L%Z|S^j%6q)*WviPl>rL_+)kRzZ#R*Mjle~j@LZb+( zQ%hK~sVDSX5F`5^N_*y$DbXD6x4y&4$sr`PBybIJ_M5wp0#4@Bx?Wz z$rOr~?1*>dK%Fu9@ow)W5V+ozJ+yWGXt?UrBU7op`9XhGu>aZ^B{w5+QgAPSoHL{S zhW;y18w*7(#2$JJ#q_53+3`m9Mz&1wbnSLZl66jhME7>@cA8!{nPGfA*{}Ig!@KgR zDyQk=i@p11qNl+4Yg*O%qvg8((K7ax%7-;pSB$;<;C!$TOW(+HRjtvE3{JA-%40Ze zWU8QfBD$=&*r@4Q1iRseG~@x~fUR22pcN}FLCW+PwWq+)AeC(jE?GeyRsFh}YtdW8 zYXmGg)pz_Q+FFtxYIu2*7Wf?=z0G@9yXS5fdQUg`%#fVuyQ{%&7tqgcJF#jIUugUG zZ1s1_Gjt^8xAULf4-g;0(gg9b5WtcHCOr; ztKI^vseMe}+m7axh_q$=Qs3jORuLPT*KJob?lI^mHzzRW2~F(h*tHV7(&&5X%$Oq- z*WhP9&gn&w#W34P6n)~}eVSLO^rtcG7t|9^>F+jJ%-;f-`3YGGvyOuive--o#A9~- zaP}Ha8114=o9C|*rstn5BUJX3?|pA+d~+BQSvrAcxDaY+%_}eb4n+1mLWXW4c}^iL z@JOFd?jm0sxh?UW*ubwA zSNr5|w+4Q*Z#Ah~^k%EwWmU^ISGkT+cIl+4^B@=#*OHXCvZwS)HgjO;&p)J;(RNEH z=yNeYrwYZ6Jr)Yd&qacy#w~!D0_I!&=T{=p@hfBfbpXt-RFV(zG;tpD7_L*k(!z4Q{%;bZw&jwU_#TY`vLR{H_1{HAG<_;orS>-xI9L~Xg=O@nomctM#M#SnvTQIdEf@}YM5_03vE2m?x)0(P`j zdnX)Ts=`7Vl0mga=JfEd+0xN%RZP`Kx2SMeR&`uSp+>*FoY8kj zLe#hLvLMHt!@KGsRgB0%U%Jfe^2#7({P5uPDaR5FO%b|F)*hAStQPyDO#9*8Q)E|H z_97N-y6pRMnFCu6xhBVQ`V(0S6llhRZ)UL!OfrMm;@l0fs|A~iYJ+9vvkMPKbPh3R zD2J%wgDQdXf+U7kaSE7eJmq32LKG)fJ!7JNR*I&{7Iaf|TEUu4VarF-ObKu-{||F- z6&y*IZE1>`St({_W==6PrwPU#er@|x}3I~V_M?pgaeZpG;`GSZDBxFJ{OC&OKO=IYl=`*F;ajkjK&W1~>X?sPHn(Int|r-7)o`zpX`vTn)M&)Il!xbp&n*KePu~H zifm<-WD1p*C~PB&kF!269sMJjrDlJkE7d6O>v8V$@up76a$30wLeXYLnIcL~Y?-uF zVRSLE4D>bGNVz~F{jOhRg}|?HZRL#ZxS<7He)3n6sw(Qd*7mV7rbMl>o(|W|kk^<@ zFq%k&#@*u|iE}l>ong=m{vu~aq~o(*DM*GI6D1_@t9=a9QqAG3GcYYsG_&b!*osN| zG<0MN+k&JhJ5Zc0P$U)23*UasKz6f55IUV%w1Ws8&MgF|m3U^}Hp8YKa@ajQ0+u-?;Q;0tev9)9*h z)u`)nC3pGeK&Dou$X>ulFRos#&qQa$LWrZl6K87?6&|TwT(6t+--~J@ zw`zFg@?YXd#-#S@n(ln-`fSV@y?QkyJxT5DwKkorH3*v`zM!gj%KLmD@ioo47|sK#D$h78iwV6r?L|JQ(6Swe~F`iRjIg<6TbSY!By%W$sz# z?CMJ{!t3A7e^|6=Dlc9x#uA>bj+e3@4I4FLXdbC)CXOUu=RUJ3rl?%8HONuRi@F!L zh%Ks49T&ipX5jWXb&z{BPh3bDvUZd+QDtgH4`pDI2N)lkFM7Zcc31A9eQ(#U>czV@}#=F!R6;x6u zoyyQQUjhzj#oUm+$VU)oKgp5i(N=IYWsGR5o?)}v)r#M!kBvr^KFtD#{4HajU^BaG zKiZwcj-#f;AZBs>k6d%!!yKu>#Y<5qPaX$|KX{-HOpQ~k(%BJa`fE2_9P4yqDs$Cs%HLmMfDPwb{t$awvAED#x0%wk+W$C(6 z`zl8Wl@%M7O-lx`0{LY&g#wM62l^-TL0^5{>1Ts`8f{BE4>q@$`oEH$6y%Fo>SM>_ zbHA(qEX!z5U$quwtY&Fn}k2$ec2fR9=y|J}u z;%O`@oteuXuNSPi6ONKURQ(hr95sAZMUp$8t3xR=mFkm<&g{uHV?;83<3yw= zl)mNSO4xOBG|ZhDivXWyL4#@(n;wWD18gMOVW<@n#^!Zi~Ffym@R ze`;}W9sL@AV{+e~OyUtY!Ijt~P+b-=b}bRR4;ObRF@2q$`~7Ozoq(km?lJC2V%nEX z-0^Ybft3k6cQhe;XAE}?o4=s!=I5}xJhnc>+rnQHB$05vHF;*H!_6E>OxI_Ua1GqO zE_#zRnKV9CN`!p2AKty9L`e8+rll+3bT#*CLJGZnz`am-f`ZVR!z|xrDZvn0pX8j3jOf}wyNz@s~-NjpaBQgH@ZnWa?P|~#CyJzqm&GEmrhtOF-q|g zxPcdMd8*~s8ltsMUnX;ZySjRNyQ-C?rLC^2s$La%y@qvKbX5qqHX!81UqUFF?;H&q z4?+JZHHnZTHLtPEZ!BZuoLZmE zX7i~A4BZsC_ilT%yxHUQQE{9LTE!zG2JVn2q>s|YiXfRw5hqVCM1b%Fh%|V?@N(?| z(tZ7{nPcl$6odv8G7s6LZ(loyn454~i|j#~<9b11BMZWCU?ZTIA&`^9?GQx$x4b$e)e1k&GDthc@{-*onIkShj>(`Mb4gauxa zhrF(+dKMRZ*1?b9`v2U>xV|bMtWE1=Q;}o8dd6E~r z8tTe?CjyR+pUzXpJ_Gd^*O>CzABMj!aMh%I-(Jf2l~s6kRiG@Z8-RKOc$4jUHXtJ3 zLXqh?6<*i{sTx!E(+CmO^12a_#3icq#f`V04)w6Ug0{xG9A6Ul2JXL~Hyv%guMSGj z_}x~tTm@mVqa4HU8)<7mh7c+lWYndudwYXVjfp0jlJzFvCDdJy7(U%z?`!!Tja~t) zTP`xL;*mW`9yuCXutr$ZdnBcgyUKqFa%PHCHXuiMh7+nGLG5CZh6j?;ZvkHoQ$M7p zrF7zkxJCt2E19g|X4!&T6RuabgraGZzv+G6TGG3C)JTcHT#=?n9M}8qXa~HZIlHD^|JW0#$A9R7stmoj6NwugJX5mTKm_gB(+@myS1mfcGFYO# zwpJCI>f7A9Z5s16(oQ)(XU0njrRGUY%hs9HLwwls>TyLZ3tom(eyA?UJtSpd+6Vzu zV1&R^E&P{SBs6cWVcqUjQ+_zwn6}S4ROrK*!Tf=9lHjh4)!B;ZuC>+L3Mh++NJJ0` zN$Uzj4(~&WNRvLV%d2!#!*Z_2zBS6alNZG&0O z?S1m=H(IVg(Ts#vnT}ouepll|cxKAdkf=9fJtN04Nm05Zu4bPB#joVzo-6`PN9$sC z`9QYL!P+&!k-Xmyer++6j%91I8~sou+IB?ij9RA@4A_0tbP8{~uAoDZ{loi~_SMl^ zc8L@9bu%g9?e6`B)N^wYdxIB}VVAf%sh{NZG1p%^DT^dyW~UU=8wG)H#w(g%LQDp- z)f&u1@*1S%)U_JUf_^|BrurS!BA(q&wT9>H^fc>4TrGGcJf_%s*6i=W-rTq{nF_ zn$7w`{QHo8mZ%SdCRL#X5t6`n0FpOZd4856yIt%2*>s=J{{5~ zcGh~dAXV#{F*N<|DpZk_#2DQLdr-2;JZlSDHr1KM+TvdBT-+a50W^}WiSyGxeKiMy zG%t1;sR?1PLJAPGkjL<>L`b&RT{eM&qgZ5zD7?J%5ze~jgsi4jba)R7cCf?qEWO;4H6B_7gwXokzi7!RmN2H=Xg@G zt1y&gFE2*-!~0hPtQF_JiC2jo>iIb_Kl~ZG6X6ShuIao~ zn3*3V$~s=FgB;0B8sp1pjTi%c1Mlbied_wiMU6ntQWwL@2LD!Aa1l5=H@^-Qsqsku zFsE(bAGT+=0!}S8_`4Y;8UI@tX$H4OI3=;zz6+a=TXRsnW|E}d^4y*Ss*2|Zf1Es3 zqn0Cr9ouq~>0C0>jFs@&%3xSejD zd6hz2-}U-w)W8VFQCv-NYU~j){0oIvkR!f@bufxNKf3uzYP9K1Z1nH}C3XEcCB?z~ zu&dWou<7Y8%UsxSYs|9yqOFaq3FOTq}=MXi8y8$zD@z;Mgz2OWBK+ ztlySDw1f8SQua6CwUzU6t$&F(^w3>zG}P2OFS}bN?-mMAm|9O=k8+GH&4z9@-)>u& zi%Mb8=kRPX?Z;Q7V>LuvD*Dv-b@Q+?+IoE^$@i5nqp|aBYBwP)vLiCc@N^-x;PHKq z>=i;Hf4$Squw950L`_aCh4-E%U)%?bG zN{zn>_>=1kdgpCf!ggJNEgve~Et&`mow6h^Ss395Z>%YCW1p+tJB+}Zw-)dW!uKmi z0aB5d*VcZQKRUubLrrA%x57d-o4RVM2X3TlXx#H{D}KXs2k!z2Lf6`Y#)q~%?@Qzo zmgZa49p>mXsN{0R{>_Wnr=96LhmV$^-GQ7ovw9wdTiEb2YMxjxL-mLjB5!69e;b3f zW>RG7zOk|)3rNB^V)K=5?#TvvPI24k{9HvdD}mOucR)1!6Wxrd@AMwDAk8t|{=iTZ zd|6R@dA)xbh7k^AuZTAV;GuEwsMMA7^Rlr^D%lJ7*)gMR*C9cnV@qG}@~O^e4^d*1 z%~P}HQC0n|aYJAB_ zimc2P@Z8y*J*BHn!H!T0JA8hPc>4T2Uf#V|J3KhGsHvX&n10I;_z+mo*Ave;%L)sv z-?A*|=z%jGwl{xwea#Bv9Wp5H!}&JU`ygI?|I`(A>@9S)x>;z8^r`RIoVz4A@Y!Y! zazL?|J<@4n^q?#pFtDctVr-knnHzT4~G#e{tLC0H)BAjKNir#9B4?#Rc- zwdUEH>7G=f?FmbI^msa)ud5&|+rwiR=|_8b!=bV;UmH69%I!C>u5<`%d>as8XXYzL zKJY@k2ZavS$*M6C1Uogqir>33~c@lnwy zrwXA5!sEGSy2VvS}RLzl+BtAL^~maiYf`UEu{EPMLzev{8Zpk;0X_Le`k zCoiun`Xd@{A|h^}wP%dN5c$>@?nc)O#63ghXQpy^xj5Wb|L8}-V`pFQ9BU70KdI*; z>&fBUowBuAeKh8O zcLn$i{gLQB#=gq!b9d;q`b9Fq5c?=L5>~|bMX3>X_JEn|b(yqQb%x_7+)7tR%P>in z?NlZ-3p;D86~rtPmLi;>lUHRIK^gS0i86_aq=f1kZeMGZp{>=5TcBq)AZs^kO&vi5Iy~ToVf~)x2bPfqT zg|a8@woUk}r(4R!>Jqn-+q~K@d7PLBdb^Odg;{(oTxxo3g>%c8uF790wN^Ixdv0EM zD_JVV`roO3?cl=_1x85>$`alri{;DTL?Id=1paUz0CYBoDQWzeX*(E0k&>)1*~2Yp zX>AMBAxbMogfqO`#iGgIoP+uVFtHWtFx+u*jv5k;t{ z^mW&l$w^6CYVXTN$+8{=nds-V8*|_E`)H$3BREdxHO2y#4>Q7ve92490(qfdRBP{AX?X-xY0H{z@DBubQo{ z(%-fJ?l&5583bhZx?&VzVkA-opK?|L!5;+@Lxg*{&u=h@k|p?pnKzTuwaao^#v!Nh zZv6KeX~ynrRo@qQH(g}kzw6eeJ9{iFn~FT@BQ6eRH;;~+u(P67;%TBeTzV@l&wOX_ zPGjARd7SiEhCk7B@phA);By*(WBr&F9JlY^P3QQ{OyN^g+Ga_3sj*gIE|IZG8)l{T zN!6Pg(Qefs%JJ}LmRFVSM9O85m?${hBl*Y!pG9e^?+&R}TiZ{4wX!E&T)3TBFJY4Q z7A0zZkoXHK8Kej3K(Ior*GkcUvZgaRt{(7HLn9{{Y6|I_KU~5^VK3qsG}C+{zBj(- zBLktqQ$E~}r`b+7hzMx!-}eP@iVO1iK^l(AdfOrj?ybiD`9O~(fq`_uk9!tfKr-E% zU$1hx6E#;_Nz9K-DoJS?!eh9f zUYC4ZJxA+T*yye8mKPjP z-iSy>K+t&|oPNHYMZ3y^Q?i7(nGE#0U zz6W_m1Ue1bed%bmJ%jasH}R*s+-w#$blWUB3Rx41MsIt$YW3DyGo0tZo|E`af# zp^zlOAHt;;gf8N^(G+}k<^+QV1L-ci=hi<1Mg$ghx)>1@?08$>5P+lHjLgbQ+Jr*4 z&3+%Ldp|p=3~)n6@*P7L=y*iDx_&hCvhzN?bh08qq}<&K6ojCgK|67}=ZOdE6y}mH z@|Bh=h~kBrl`0WV7L^j)iu0No?GGZ^CzsKA@Il=oo&nvD$@@ggkGYqfhI*#8jkscj z=+`EKKwejZuO#v(jv@xw@Hc4;GS{X`0m;}|BbYfLq&;h#96j|B{P^j&>N~*`&hkZZ z#p52?W=G2d(hqAd}myVJ)XlK_=7QH#VMbN4%tmlCB(h363f~gC3 z+p+C5(ZuP$aRIa16OdUot~sPgeiGg-f37eOOs1jct>mjjKQ7KhuhlGXo5Cxm>g!j( zqxI1;*wQZU0X5D>S#Ir?FnNVY{M4IP)jI{se$1Y57G|B=WqbE|p1(H!)`tEJish_i z3rp~7b?_}by^EivrFL7s_HgeO70_XTe4E~$cNxzn2@QbMN{%v~HPZ~QQ(0+@?5_hH z-gR>swqe_&CwTYFNfate1!#Mur{=p#w)u2V5Pag;Q!kS%PY|Wtj&&>3E|UY@(d!J6 zqnxqwA*HVh{6R_?#W1d`=BJcemOmXTJdM10R($h%p2ji!6go*Le^YKyse1k~fJ=Iu zXE6ruyI(q?*CkJ5uVITec=d5i`V5>-x^PeV%v{g!D?O6L;|Ep1Df1-|E|0!H466BzI>l~nNiy@y8HLTvdI6KG{~+6m@wz_{0^tHk7rgW$9VxKZu? zV(Fts$VZG(Md<@%v>xc!AS%v8QF4H?`*}d53GE(SWcztdqkmJoze&0Ikn*1Z+Si03 zIpaAC-@*e& z;+h-5Ik0v_Dp1J6dtix-sjIw%Qoqvo22?&%2$4PTlVQZ5ex0`qlR}Fz3Gy*0b(A6s z6Gl>uxBFjJCskF|k^Jeck*iuZoIABQ5fc=qtEhn@yC;3>ZL6y@D_g=cKRI{{H>b;_ zeR6qtyazMp!k2!(KW>=7tj#8H%o&RHA+J@r(amo99DB=B4QC9%T`=vy^R|8$Q z65(@f-@N%#IpXvIi&YsE+Bzs@LM%ei2n+-d771D<{+L(Pp^2gKN}5?Rem!+PwK7U2 zgc=fbvNmA$}q6?eypE&Vkv|XLzQO=|ltG@EGaJTEdicKSM39 zhv{)h9N+3{TI77= z_dBaPx@;S+Y>V2n+EZ3+5`BTq{2W)|lr*%C7AjYh3re%*78S{b-@!1b`Zy+I&^+qO z^2S6m<%2V&f`Wq$$sClM0>{tS-$xr2(8fHq7KkZx@So(c<=0tw`?824%ZB+#`N59& zProgI+0a=u&8@e#&|}9?GOHA-J@;FlNRqyKdU?5*S~XUuC{wR&EaOFtfy~_J;Da`R zAwQtv=`IX!>ji{sk8qbVWHVs6MZsh0@pn~qnLSyH{7rhcrZ4`ve$d@&VS4NN1Y*^@| z!XX0c7xa!GH6|o7G-dzF)SeuDB_)`YXhd+E1PBNzVHgUx#r^>WJ_(;sLTauvDK>>y zEZ5_zzV{i;;Ipz;dS)iC?%-2&Zy3z^lqxl_V!kN3#uLq;-&C}+ z@F=t+;ekt!@K~1|Jybpjx`Q5V7l#aj_a58)v)Kqv`Mmx6WlQMZ`#A@YGY8vjaM2bF zjLJRS^{>?U2+CV6sQ~3YDM6I+w^~SoZ7rpJ2(v4y9Ne#jm0)tZN--AMgveR;9-jG} z^T$|&jtKGQaDq`U;Q{9srNuczWAutr>8-7IXHG>-uU2YB%%Yeen~Z7$BcZ9bTmDYYf2AVQZ#-z9z-SX?(5$)dKP*wH{W)Zrb0E#6^m|*iDLy3y1N)H)#2c{O|_~J zmyVi~)y(%O&0RSBPAoCmT*`?cON39>zgy&yb2~k9<-mE#=9+J{V&8JAU7M6UJ(=v) zJ=7Rk=(nGWnp0tIaIw;royd*-OmOCHz^bT-Em3MXUHb4*-piiLoyYrDrY}zC*wMpG zB%Ccly5oc54|DI4fTUEr8&4`T@kBpL*PTq6ILa_4_#%8d=lS~D=>Z=%f`XH_A4TA^ zdvex-x#?N8SzdQxITZ~iPxpT6KJaj+?z=jVq6U&CEOaSdts)6&L2^2m!9tQ!xUFu* zO^&1&z-h5isBaCO7(quQ_MNXH?VTZ<*}}(1*o}1uZ@AaIjc{US*|>10rr%oLWeBm) zm0f`fM#*G*|IDt9|D~4FR~V_Yk!rR6(XAo2MmvUd#plTmV+I5+bliRr-%-Wop8Z$Y z_Y7W-byFVY>P4z-MfKP}(Wa4~i1*kw+$nM_oN%e^?Jyu!@f_Gp=~|pd%$DXBbT-WW z3TAfD4Vf}@?D9e8R=lxbSW$;r=IC%C9m9-Jz+98{LYG0im3f^+DfRP^!}s*_0icnqq{ zey5}qjt8Q;5|uEgoCWHf9w^xnsoLXG44H?9RAYw@un$l|mT8Vk#WX_DvqfXrsT+lo z*h;6nX0H?ugkN$V;BlVPN^59sGG!Q-i%_Go3~8o-S3_rkH}fhtdsFAQVo{~bJRX|{ z)=qZ@oOF+;cz024`Fy5Pg%n_ux0I=tYMe%P{tCZzmBJ=xCuoF4t=KgfS;}rMYFsa# z3I{-U$+}FMKYyU7_QIToX)A>po|cn)?6fSIsS^ojXxvXkRwho z6HyU5qz|e#K64J6>>qE(OQED+p=|})+QLYoI!(xrH0X-{KD;4s;ikk@J|8nCDiHARoaW9MWxYj*uAEy!mi zgq1VmGwOBa2vAvGQqWVfYHa1LqS2NQlIxC?&4+OuG*Z}pRn{bc6g@$n5fM2Dl(Ub9 z4_%K^6AebGt^31rvzj!0qpL$`s82Q1W-Ud#wcM$*w1OrMC(fI3f-uy|O(?`sc7ALG zm@mtuGU^PvB$2_VUAHdTQ`w!tsc+l#>_m3UV%H9?)r8XAxn}J^xUc3<$h9WP;b*vmzSsck}-X)g)swapW6eL4-ui6K1>)n0L zJHm^yOXlstZJ9eto9x)NKi8rGyRc!`iD;t(?4oti9<G7t-1ig9eT~6 z99&IXfi5N?@E{}^O(XTlx~!kud1=nJ5ihhdwj42{RPB7(-QY_>H1ev~if_lu^gL|u`p z+BO@R+h{LYWnyM08N2j@T(0_Reo3wQCY(+CPvf(Xk(QrTIes(|Y6faXiK^K-^%>^q z$}){G-Sa(ua*E2Tk79V`n+<`6r24<^zNLwagU(Zh;tCN4hQ}*2VqltRSb;rY* zeN{e@eMxj3_l?D(cRf3+=Cy49Q&iT%%y6(_t#F;*kMtDxLH!IJXR2w}HO7A%f1@}6 z9wDZw-!(Q2*IKn_lCV;y4^UwX@_8G3eM>y zImc{@oLx?N?kO9D6LK2+EFDV6ES>a2_727Yrnpn`tOG3iNe4L0X?r-#L%u!;mn1rO zUx$90n)LWqX{#C7G z`Wx>07rpMkl;VGsz(xOWB=G;XyEP~0e@p)caBTmie>46w2lyYc#Q&)A{ewyFztg|} zBUJbw_3!`v+5P`S{Qf)W{(oGmebS?^TiwE1yHnE4wUA9SRR&xRDgx zM#WueeenMHxi-D zpipY5`3+_|y)BnLc*yRwJiou$FdA^J8{ehf^l%2VItte*CJnE&!1!1}8iybWCo8C^ zs;0oze7fZ+sxDV~oh_f!(i9-=rY9%FiZX~M9^+C`aOV_VDjO`UoueWzB$DEvq$KN+ zm|&tzQfY{dE5k@Rj#0T2H{Dx&zdiF?>b09vLcE#_<;?z*-@-P$%Pzpt(PF9FcXN^; z`>%Jz|E7NOpKIV>=(Yd-y7@m9um2-d`=7<@zc04ZKQ8Ql09^m4cnydI|9^6SX6Ir8 zW`T4 zdo7VxIyGlBBInONN$r};I_X;biF0F?Z5F7-1!tE<(%5+`e#zw$kKCH1D@9gu%*G|V zg_(6tC-m4wM|-gZU$$xK&-kOhqxYliudmOq_b)$sXpnrYWkNz0hy0RMBrOQpk79|lfu)_9{_~S2Z)N_*Y@V#TDqSC=RL$hCHN5P>lR%`rB3; zM-H$#$4Rw879-1(!8g`dv6pO-O>STOqysS!#|61D;_oD=!rTtUqvT%{FHN7cn3t$5q0%3`Bffe8(!O%oPLIFXscwTd12Dm?&r+1Kf zBWcdghN-`uA`i=*i-8QJi(*hX@C)>Q?m_xp37u@p@1YTU*iRv&WpX)xV2BLBD>w1F_qYO%!O$04H%lk>4P5;Bi8b|*(3bU zY?^b%&dGWW^x6wcpw0@LB&`}B7*$ia?n=HI)8k=`^yKC$w(-#ciO+i44=s^axmLEx zzkqqFmw$*EC?jk>>){x>`Mk_7cLcmSy6k6sP+@qH59J-bIl{lc$kN>69ZSDCK6IZ6 zXx0UUH<%qF*uq`QSKn89EAbP{Cm1*|Y*1MxwzQwfHh!|A>W?bkZ^R#(+&_FMWqmfz z7~l>Ac(t&3<{ukEUydIll{J3twp}c(zEPW{CTDF+c=rrTc5|v)UA|U5Pz&k9l;15l z1mBkJNCLoIjW{%ay`9z7@I*g4oyAUlep70)>03LD^)slRS*8`m?93OTkUb+Hk$z5S z0Q4u9OtnlpyyD${^NBN+gy$F8BB`5yIwqzXxdW2j`4j3mjNL2J)k-a={0uI;LznqW z{qoc=r1V-j^OwmTm$WigK2`KAnwAC3m_GP+jE@D3L+`ZD@XR~xQhEWE%m?+GZN`L& z{Ot>C2&HVnS~8jCBZX|Q$z8{yb&>Y4=hTf{=CAUVBgQpGAXtREaB_@yCtHsoPMOSn z6oPbCF(zNbc@WQ=D;cfe*b!N+UqY&W^6mjy})jPwgk1K`?U0@Qp9SlQsdL-@VY;LtHxj9<)Zt(xDhN ze*)B+g@=S_4S-Km(Gxl2nm7Z%C$YP|;Nep3mjt6o>W%ZA5HM#$Fq(fLPe6>2q>Hf} z+GCW>8JM^J(>lha+(#5HD4l$d8`aR1;ed0v!!`W-gKchjrq zkL+#=brCe3?}lV{gp7`nL@CDnGGFjFoJej|;mI6{n~!vg1V(J{)9&%!6l25d>jwy> za%?nGwzzh+w~QXrFfZ_DTvm6iw8>lm-dPHW3&`rgni8$=60eBwy-d znJNZPydmlSUVD0BaE6!}c*LyBY4Q}i^xnQ?3aToY@EWmFg-4VZW_K&Sj84bV z#wsZ(q~D)GsA=YQEe^Nklc-X-;Jm0h$8jMjPqT;*)tYIQQLtUeikQWstPIpDBBOV2{!V+@x@==zbv>+THJTt<4U0_SLj$+1SVK#QxW;@W5EwPk-et{ zLF`7mv!*}?7*mhz7#R}wHWuF6;K};NB%DKBOvK$$vHrL()|51i=Ryg>{@#Xj224H) zELRhk048$fA{=f&*A|Ow{?(60v$$(1K(n-4En&1Iqci1QQyncBfO_MeO|m_|8*S`F zZxzmmdAnFTFj;i8jS!NdK7+iOdcrln=Ez5J-6}j2(fx43715UBDR*d-lG}9Msx_nO zp1(Rc%;EOHOaFCh|Mubb%X@xhP)aa{fm+oOlpPzNxQBMx5!fcgefH>Der}SxcHNQjCi^iLtR2onc1oM9 zXRUwRROhMTBfeWVY;3{rDmOa#k_PrF>`34n zxUzoTQic_YZLL*Ut!q^fVtgJ^!UbGY`R4frLesSV@VJCwEz6|q2^WmKpp6=&hr|z7 z#_mSua(GKkHny`pMfE8CE7HLWOPD75oc@7st?US3atOHAY&-|GbSS!NR;$X@o_TE3 zuC}I%sh5ZJ>LHGH)zlp(vQ_~X5f!pUHxW1~^b^jw=GNfOLTr}i0JtPnH-crjIM$5pZ$NZZl(+mE(i??C}@(7L%!1+t?GSjILwlPivwRBPv`8 zJHzoHn&cZz)Tlu^;Xs(eP{xM6MsJZt!xLn z7YEV)__y6rYkfuBN$H#Cbfi zb~6|In_F|{Pfr<(Fl{A4GyR)e3-Z`+nyekVt8{`~{B7H!dB(a-Fzdw5gtV1@OVfG3 z-It2#l;e(jw#4o8N%y%cpXG>f%H%mxrkua7kwdIuUnzSPD2jl^OcV46HzN{EQ?V~z zFzVaG+2C=;?>f|?BcLN}xR4bg0Aof4*hB!F8R7{C5UH?1>b%|cJQbR$#RtUL6W)?t zy!RIJU)yzqSk*8AN8Eko4449^{yZudt^qix7 z9C?5_weGAFfLlwa;F=-%n_D~Ky0@-7XDp!i@F39)6MA{WzLmcx z2h*5Et2(k1r3w~P5Iz>kPo4}9R$vC!FqRAk5=t<(qbz(*@z=j0Aj#ABN@=e13ER}U z2%q&(_zVqsoXff{fCy^fj}i?*p(zo~mmUI7{$qm{0v5%LJVde=ORS~AsoRcNUQt^a zjMy7_%Um~d;YgiD;3Z3mvbcIDfE;zRw-il4SE-quP~M8m#&FAPHSMU_vAd{sHk5xpBsw zgqAXJ1BX~xln`M#I;vajc=a39rdA%ApP*ggXg2sQ6+f)E8geABcPbiOYnzKGN#nVz zNB92dpY82G0RjE}pIcHN+v7$8{Ep}1aeD8-ka+rXOtm4r!IY>SNTLq zq<7~J46cB<0wi=MhP>nwu=F8*kf>l`CCWd1L=~x3Xch;BNIiwMwS|SX)1^z`RaHSQ z)KGpL;-AY9nYalKwPW|}tR$qu^hxs~RssjPzsROReoNW?3K-U?pCyMSG=>YlUh$7d zjv$nQeT(iZ;sliG8`HvwFBD5^NT??;qh>^s_h5}v%us^NaVsvb^t}*{a z3H!iS#jSO|(1QX!EVwDg;x*Lw#48~YD{v3@j|Ik`b5f$4URtZg-u}qnT%Y`@Ta`lh zfJY955w&)O|6G&+3W`Sud8&mY4{uD5`|V4XnddQ2oSwq4D^Rs(b$XBGEf42~gIL_% z_ydEk@Tw4*q@f>%Sn5C&iA@;Xw;BwDI7SFa051wjj0#qAJQgQ4o`Y6V_r!&UY{<1L z`un{3n09gR#$H78w_S@1@&;KsjxRb?D%QHQ5p8^_Y20tv*m>&dGBpW`uV+FNKa#M@Sc$owQQs^+7>RoXz*L?}iAgmH!aO~}K->ej&$UuNg zj1mj{B^r!1VhD~c90-0e1jDn7QK`~CM#lGTY{?Nz4c2skCOo#r#+H*$U^F(nCV|B< z(AD@HL8=fI4w-q`1iwFMO+8!r`SHc$-g2&?A(1ZIDZ=(de7hfd^hA>)3zN8Ohc=2A zj1WyDiu?r!wlk{RuA1DTJFNuT_D#u&!4{XkZ0n*8D;;}NR*Si%r6M(GB=)i@I^~R? zx$m(}&MnUEDuQojRcD$i&duJ~xmvK6bZkFQaz6I_`WE$1w1?dQ2;{wn5fie|Fkv7{ z0zEc`FiN=xsWo{0Pe5|iq|YR_gXKf!kVV9A$e@SDb5FlRyRx^>hO4L>yWtY0C>^OS zy%_JWH?*yf+Iel|g$W<-Uf(E)ldfx`Z&oy<$;m4ff)mhS2GL>G3w7YYnhv0FaTAI< zKLX;Oi+PdWWt@6?QVGL;UF_D2ZZyisF$gU3JfB#vCH%0N65W12S!rrPeSjZmHR|&^ z-Pw}$(ixCCvEzNZH~2|Cj?2TexNwlJWA`SCEp zOG-(8uGMogI{x!&hF9Qo(NEj{Vtg@a;NJB14pZ-IwKokwzMm|9ea_6C!U=xHZi*5G zGEJ%dXbA@)Q~Oo0iSG=fc+4Is=cQ6%_tZrfx$JXTk~X@>(6_EFx)$l_6{YsoT%M+F z3z6RyO?fV4R=purE-_3?YS$?ykysIJy;@g{WzQ4EM~07Ij2^c&UQ;fr^$jW!3UeZ<*troAxj)p-+2e^??v*`V`h?`#%EMakafJm_K5Hu%-Vy_C zD@%iFmMIox%+WzI$4Jf;GFZq>LANdY8$D~~cJs{0t!$aBaoo%j30=dr zcD{PsTMF_v=>jR3<--Y zW*pI7Q2JHtfW&OWJch&V*@GWQoi}pzKtrY$McXgCuC`E{DW*)!TPV(M==Jga-LZ?; z*!{`3&Kl1%9IB9KCCTUhc3{BAhvcIus5Lc{-}7y1JXXqOvsFbGk=1EDIwhEA?mQOjPyS~lRe9{S19 zOMLsyNL%@!;$ew8HqmfG&3eiR1sY;)jU>x=VHz=^0GTSM%llLKC|&mf+wqn+^O5;60bsGGS2`_8s~sV9l!o*qsNZ6Q zvrMoFg5YBk586!ZArGF=-Kv|^`W;G!49(-$NO3MWOSWx&nVF0{@I-XRUrBw)JOZuW zCKuEjT#FS1Fl_RO&>szh0m5r$xpI67?uSZyKa154r8=d?o&_EK1ZD_XVY8pP*CX*7` zN*H~PMD)cO4i47mYz=A8W(9KD#-2^}ON+esEqV=8?`sb%rsSFk_EW~>*vgAZ?s5_k zU18gf80QkH(}Ra0&$!RvJ;vu3y>q4`j{DAH_Cus~-S&x@w6_8)8ADbgFD+8VZozTD z&_GWY3hMo%KG*+M-FE<0(KT&~fFdAD5=n|A$=n*IVAUWrplZXV# zQBgs%8I;sh8MDfpFLqT zc<&ZG@XVvlfL54u8AH+14bA9WW@G31wrmkHF=dCV=whzjLDlZS?=^{WjORGw2e2r7 zKgIETNA%VOjmR-ldI^h*GnD@5E{XD{{T`$>TT-|^Qc#q>!E+~_ZRK%r%uTf){RVi!hkYDlK$mmzL?=jmPn$^(mqcmEe*up8BS9k4tG~Fy)ER-sEjw zH*Rsul16Q4ZYJb};B zKUfbf#A}V35*EG6Ju#`McAFU1#r4W9PDf9igmhI1-njpcKE23~$e@JiMd!Sq zBaK(!b)MxHBS-o=qC2i9V0uo-FOQB~^eRHT-?c=Dgi>mXN$}?)iKHtld4+iv+K#z? zA8k`$+1p=M*^IRHN*~U`yXStX%3O?XvP(S3=k2P)A;l9fe3l%sDV;tVs&ot*B4FjP znFhthUEFW&A>N>+ovyZgo?g5dXdroeb-9+$_Pbf{)>vZVK)#7_4^8cq-lrMw+cK7@ zszn!_q`CWFpSJ$4-3rm2W5P|t9GUSe@Gb1ryemRBxAo!_6{$GkFE{$c2e&1=bk92Q zBkir~1==G;`uL{=U6=dUHr#YH-SsMX!S_;@jxN9B(=HJ@U3p}sODipKml4Eh9MYpoRM}A#&beLBN_%TsZ__rb5GLR*CkT3o zlML1(H)i+NlQ$Btot96m+aLVuDe;)*QD@DnTu+1e>)Z;u+#Dga`(|CK9+Q<(Fl*IT z-96Ck9()`!oE7?Or&i$DO#1rcpOloHdN#w~;)Dw(Op;s;bBr z1Db-=J8Y#$RjVV%#avO1YP{%XVVW4 zk{vq=;vMNNJdWo3GaaXvmx`D6W9-LXwvpu&j%**BNQ_LaE>}p2mWR$F%~TbQtnM7~ zHK$po>3MCa)T}E5ii!;**giFgHj`v`)Qw5RrN6 z0SEE2U}yWl05s{})T{h`{`(&*RsIj4aR2X?fB_(@Acj9Og?|CM{KpjdZ-mUhrojJE zz<*^x|NoYNLH|-<^iNrEDC8Xct6aDb!}S-N$An?)nK;`;av@S9uLJ#0KGmJz+>nSj z6c<^3=g}NlhAF=c?(J&mBEl_7QZcB=UmK7s$5(L0#Q3b**^({cU&1_KF6i$sp-@LV z#Ff58SMCnIA5Cy)6u%F^zute+n7q7DkVj;GN7<-WaX#h)%eaGa7UZuo)z-QQ5JPtx;tu-)e`<#>O!w11fjRi&g|jF; zOd0R#^&HI1py{q;RM!2zy!+;-eR=G|57x0?(yO4~`0nWEK}3 z;smbZHC>6RkKc*sxv+KNQ1U`g?wb*LxA{enDqJf_MptD+!V}ZOrA-x2!wYu2yu1sk z9xTUj;kpYjp7i?X@a@;xI1y$zHb-kK&zm;u+edI*ZoWnK&X?#!@IG|Fb-LzhbI-#< ziHIcq;#}_q)!I^*Wt*?TOBVvtJ9)LW8$SQ?^XbLCSiL+gEKG>6>iP4zH%ylzm<@*| zq$w=^!q-F_B#3b#)Vk(Gz_3CqghSWEUov@w@gLB#{%PAnli5;aso=4?VlF=Y z(~4lz=H0Z;X>hvjkAYtg!>64wvse68o)ZCCa-huX?k5ul9J|mRwooc|bRbF8Mbko6 zMrp=e{l2jJ-cR4Z6C5EZv^mFFo5a)bKT(}-v|T99vfK&q?ERKh*I(L;|VKb&G&lef8r8F=j^kxL?993b#rIHfkU>Xv(<#(iF#-|rN8t$AbMS2-oovYtWIe`Dezs=@6mS>4BHoun6IcX z1G?FYYZ;<`6ChpPYx@yK4Ue1}XUdiq3Db(VU6eh-njZ!ez>6>oe~&Vf@0Q zjgEaPKv41=K$hynKeCPeTtrcx+K3tCXs8#41{NvV#n!=)-!5ORCuT2XK&6? zKa>lpB-OViuQ0qD5pU_Vs_i%*jmL7Ibh!PfUZs5p%L980o?=!v-F|`^FR5GOj98I! zYP6Kki(ek^^CDqGg&1*(j8%!yP?ZG@Xnbh!n>6{TOI@U1;e;1gyrlh>Wes>iqe7lE z%!$r6z~EL9%0D&EqUjrZXIN*AZ)#j+e6hxgMvFL?KB-BD!Bo{ISC2mat||V!Yt(U2 z(-j<&3YO%frxJI#yvRgucb>|+t!WED|`$d0WWo3>UA8=tNd*9IH7%B0gQPvO)F+2!E)Wx*s(eo$KP%08r zSwvnP_XH(viv@ENPdTL|X;&-z3s}vHzX9E@|-6Sl<^6^}1TJ znx@6Z(uO=UT{+#>WlOom^ah)!6+(#IVPxvk69ME38IvT;jWMm0esn!4$^Cl(1D+)L z{nLz+eGQ9Q$NlQcQ1Or+hx<$G0lUY!MAfFgQxX?QQ=H#(D=INo<=ba`|G>=LzW?sN z7^yR(WgT^`0*Of21cUQHnz8ca-exv%CGj;}T*?-^j=TKpSn~Bf1Oip#Vfy?-d$3+#*hsWbG2KiJA z@+EUry`H*xR>8+Xh>S~u?L1VO%&OA(TH*`@>TV4@C*~_8g|%cnaKI?(zZyayByC%Qe$3PNVe_`n#A85o-Lx=Rp;VK zLvL^<^Bim?KUVm9!(OWl^EMI5A#;o3(L{#+sPDDb{nziVg<;$tm);qi*;9?-uWGB( zSjg%=-DSb8Hh*w1 zWWVmdE4MQ&tm$F%YHFP>N~Xf=@holX$K!bAyBJ|SYk}xj#N<*ucU8Y#RbpVsdQ5aR z!srffRJXdwZibyjznOl6X397GK0GA>^wT@rcix(pYhf5npFIsI+NQT3x|2S_&LqOf zvY#e{=M28<lXx4R{EExm4whr|AwUnSM-RR`C6kj{ zvI+A&%j!!?GX36@{yaA3OU6jdj|XmUIXbnwg-wJzc4KcPOvG=W@;xf!m_=|Lq38Ev z+8J34y*+O25TvD0;7c!CcNAri#l{Zlv_Ga_{k~JWb!li|V0o*sJM3+TQlN7B%FouZ z+rP|@R;gWFXJda*SJuG~hxutejy9oB7U~cu-1lW5D|U*E${KZ_Ud_K0MySPRd{`x) zR4eP@4)32nxl#DzeG?(yLxk0$qWEos)1BPz3LK8GhOcA=0p0h=Vv5s*ui(qe^U+7? z`thc`!nr-89F_08*~YDhXcu~`R$!L95{z(>`C|X2SFwy}f_X-*vEe$RkZ#L?I7aH% z{txv@ZYTbUOAfh>eSvmtDf4~;CvPQoY5r;H6x=2mbcdd*hyFUCfR1jJXAbYA8Hux{JA0 zDzP(}+UH+K1w@xm!>bd+h<9K(QTK_sR1 zR7nqSp_82EV>|k8A7{8`x7r6u;uq2C3j4cDm1)*axl=fS8f)ss5P&J z{-u(BZ>NcwSV?J{L| z^0@?0E+hvUJhsP>87HD-AQFNfLOjyu{X!47rNg_WDb-kipl|PnvN3Tt01(VZt|tO> z-O^yql4yBG?Uy@{NFZbUo^W+u+Y(WfAa3XGRha`N{VAunu07QgIW2DzqtY?1rK9)S zj+IJ1p~Z-&$KLieKUI&>n=w$f(gI?En#A~KD;m}EMZzg%edbHp_OaZx1@yN(-&%8r zJLyKuaoyv$3}f+czy?*-O``IM*=0i(s3;ad{nQJJDqV$nEs+o6B2#({IlssTuoLAO z@Z?(EaYSmv(ocw^kTOmnMvwW% zf_0f(U!tf1i-b9SMS^jDtMp*ZOHe_fK(=lE%|sLCHaZL+XCH+HrWWj>@*$<=p>Df& zoT!aYTqO^tF^8^I@g;Y;8Y*|Z(Ql6DwTM24&$|z%^3+-?y8?ykrKAg2^rRD5sxP+s z79`!~ddcSc$!<8IXRE#avK+?ovpHYm}GYN18M3YRttCezzDy-kS(xGWjA{w2fAA;>CP;61xq}ux#LfR(A}#ctG}YK0j=r{b{3doE6Q$ zVD}*ujdVw4b688rZ%t-FG0C7Bmgle72CJ_mSNT!}i-_YE1qco*NbEe}tm`=WvhhR= zn)$(QI3v+lMGeZHADYB&MKdHDIl$T-gTf5UCJx-_wzC?4nJ6zm0ej;+P?Psv6Te5^?pu36pUjTvoWG-E zZT>KsJ@Tz$p5Qa*v083{YwzuzO1G2?WWH-9c2m5|RCam1rH%BMX*Ipx2iL4*O#I@P z5evCx6^UE=LOzk3Lz>|?uI(+qI%xKW=yx5gtdVx-5J<$*h?X z1#Q-unKi~ocs9$K)Wcse5EZhsN+jN_)Xk%1S2z1`W8~Y*tnbBpE9Sk8AQm0%@OCpZ z^5RmuP4;%&MA|Gy_OG=1(W=pM+w!ZB82C_9Cdp!g`IqL$wha@M3M_q}xC>+wYfIsfp|9NAsm@UM=b}BHktMG}6$r>F|ju_?X5)i%uhEPcrGhtZt-F zj%4fzy`EKzUmra+6g#9jZOla>uBRMLPgGg*(B$M1<3jn|`xSzR9dA&jlp-6l;C^C% zsCBMFsK#QkV1ZTrnkoq0k+U?qUoQg=y!O(8{}Bi8QR4&`7%>n#OO^8T@szB!vPvu} z{2PdfI??V>7m@wlXx5m2yUng@^Vae^s~@+Xu6WrBnZL*^n=HGgf+{EzEQ5t(VPn)-RRT`#s!uu;7QEiAPS6T_A#6QS;B*ngZ+5A+r zwGB@GVbeem!zYMZ~vJa2Qhx ze~<`Xyt{Slm^S-wUS zvTQz99&F1Q_c(1ub9b>*iW>X9HWe-Bk?;8mxrPd0Dcg19aV z6eivr)!LjLPR2hCW$gSq63pc1C` z0v{juaIt!356J7w=4p{rod8(so-IRBs>}gI(@mtWc6;>(3$E`#;TJn)zgcI zlJMo`0_}i`g-y#ICT$VqkXbM_2WNtP7u1w^qu*!tPd@0U@O0NLVKt#beVH5m7Wo;; z*~c;Y{%hKZBmfYcU`eOQuglyitS@Q$t3P4HSUAIdO;u`8zINWOceOdJ_alQ?nsZI) zO&0k)Qd8PVCMjwIE}sejdWorEzIoR+!Hj=`W7@Yz*XJ@1*VwP5#plmN`F=A11tZ=tG&kwWxr9r04QDz0;(yNk z?56bWF9T!P>R_Gwg-x%pz`t>e|A`6xKh9tLw%l|1i{JbGmn@!>jgc`SfcOZ55Q6^o zVL-s)K*G|P;a@Z`ki$FsFj)LI4Gf2Xfb_^8G!O`a#->5fN(}!P2ZaFto}3h=4hNkjBLA2V0R>^L4*@iTJbx|-1Oox_>5p^4K>Nw_Gzbig!lFT8NWfLj zoqN{v@;nXr0f$9HBG0cG3`d}WRMNTm&{%SS;V38&k^UTqfFrSKAo$A>l|YzDO7vOMghjSvS=`KGhC@2_<2MPxCc0GSC6pby%-}n(4guv1Z3JJsJfkI>RKw-rf zz{|1h83KZyHHiIFS7^WxuxMvpZO@N`VDm-8;MnIvk=Q)oXQBBIzQ9_rd~o=5*98a| zhQgi?xawi?fCJ5q&-4A=8~NOt5pZlBpnxXF=gtM7od1UQH{)P1EWQvZ0*eNPV%rO# zW-L8J;Mn^CL10}&ArK_?9zlS>fh7k3Fn~?N<^cs^^MHb}c|al9Jb*sY=VKUfFMz$5 zFbG!cguq}}G$_#0_x%0>+C!iB87T0&$ay_O0fRZe7AP>?`EfA7eb2`~7zhEvqJgpf z7lwjj-7~;YaI9DYLjf0tbGnD20YKw(G&l@9ZomPvI`1EF7y`@2;czfkEJgs%b)E+T z0>!!xA|TlNh5(d$K0YH*a5y#%i51rnC?I(LTQ)lzy{G0zHiQBKyedy!jDFuM^D0|f t+A#n+J$pllkXOpW*pdM-&)@II+1lyZ*!{k*Mxfy!I3Wv*xPk=Xe*suW(?9?K diff --git a/kubernetes/ingress.yaml b/kubernetes/ingress.yaml index da28f3b..57202d7 100644 --- a/kubernetes/ingress.yaml +++ b/kubernetes/ingress.yaml @@ -28,3 +28,7 @@ spec: - hosts: - rallly.example.com secretName: rallly-tls + # Note: This Secret must be created separately. Options: + # 1. Use cert-manager (uncomment annotation above) to auto-provision + # 2. Manually create: kubectl create secret tls rallly-tls --cert=path/to/cert --key=path/to/key + # 3. Use an existing cluster-issued certificate secret diff --git a/kubernetes/rallly-config.yaml b/kubernetes/rallly-config.yaml index edd96e2..878f9d7 100644 --- a/kubernetes/rallly-config.yaml +++ b/kubernetes/rallly-config.yaml @@ -10,7 +10,10 @@ data: NEXT_PUBLIC_BASE_URL: "https://rallly.example.com" # Email Settings + # Note: This is distinct from INITIAL_ADMIN_EMAIL (defined in secrets), which creates the admin account. + # SUPPORT_EMAIL is the user-facing support contact shown to users. SUPPORT_EMAIL: "admin@example.com" + EMAIL_LOGIN_ENABLED: "true" # SECURITY: This allows ANY email to register. Restrict to "*@example.com" or specific emails for production. ALLOWED_EMAILS: "*" diff --git a/kubernetes/rallly.yaml b/kubernetes/rallly.yaml index 4f76352..27dfb16 100644 --- a/kubernetes/rallly.yaml +++ b/kubernetes/rallly.yaml @@ -26,6 +26,10 @@ spec: app: rallly strategy: type: RollingUpdate + # Zero-donwtime deployment strategy + rollingUpdate: + maxUnavailable: 0 + maxSurge: 1 template: metadata: labels: From c1ded052df41c7af63dbe15efd314d8d1058db4f Mon Sep 17 00:00:00 2001 From: Gabriel Windlin Date: Mon, 1 Dec 2025 15:05:22 +0100 Subject: [PATCH 4/8] fixed blank line, added more info to README, fixed spelling of a comment --- kubernetes/README.md | 7 +++++++ kubernetes/rallly.yaml | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/kubernetes/README.md b/kubernetes/README.md index eab5406..9de23eb 100644 --- a/kubernetes/README.md +++ b/kubernetes/README.md @@ -14,6 +14,7 @@ This directory contains base Kubernetes manifests to self-host Rallly. It separa - **Important:** Do not commit the `secrets.yaml` file with real credentials to version control. - Update `POSTGRES_PASSWORD` and `SECRET_PASSWORD` (use `openssl rand -hex 32` to generate). - **Critical:** Ensure the password in `DATABASE_URL` matches `POSTGRES_PASSWORD`. Both must use the same value. + - **Format:** The `DATABASE_URL` format should look like this: `postgres://:@:5432/`. 2. **Config (`rallly-config.yaml`):** - Update `NEXT_PUBLIC_BASE_URL` to match your domain. @@ -43,6 +44,12 @@ kubectl apply -f rallly.yaml kubectl apply -f ingress.yaml ``` +**Note:** If you update `secrets.yaml` or `rallly-config.yaml` _after_ deployment, you must restart the Rallly pods for changes to take effect: + +```bash +kubectl rollout restart deployment rallly +``` + ## Verification Check that the pods are running: diff --git a/kubernetes/rallly.yaml b/kubernetes/rallly.yaml index 27dfb16..abb4938 100644 --- a/kubernetes/rallly.yaml +++ b/kubernetes/rallly.yaml @@ -26,7 +26,7 @@ spec: app: rallly strategy: type: RollingUpdate - # Zero-donwtime deployment strategy + # Zero-downtime deployment strategy rollingUpdate: maxUnavailable: 0 maxSurge: 1 From ce86b19da3fb3b43ca0dab3ff2cde2318fbf4916 Mon Sep 17 00:00:00 2001 From: Gabriel Windlin Date: Mon, 1 Dec 2025 15:17:10 +0100 Subject: [PATCH 5/8] expanded README to be more informative --- kubernetes/README.md | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/kubernetes/README.md b/kubernetes/README.md index 9de23eb..d5badb4 100644 --- a/kubernetes/README.md +++ b/kubernetes/README.md @@ -10,20 +10,20 @@ This directory contains base Kubernetes manifests to self-host Rallly. It separa ## Configuration -1. **Secrets (`secrets.yaml`):** - - **Important:** Do not commit the `secrets.yaml` file with real credentials to version control. - - Update `POSTGRES_PASSWORD` and `SECRET_PASSWORD` (use `openssl rand -hex 32` to generate). - - **Critical:** Ensure the password in `DATABASE_URL` matches `POSTGRES_PASSWORD`. Both must use the same value. - - **Format:** The `DATABASE_URL` format should look like this: `postgres://:@:5432/`. +1. **Secrets (`secrets.yaml`):** + - **Important:** Do not commit the `secrets.yaml` file with real credentials to version control. + - Update `POSTGRES_PASSWORD` and `SECRET_PASSWORD` (use `openssl rand -hex 32` to generate). + - **Critical:** Ensure the password in `DATABASE_URL` matches `POSTGRES_PASSWORD`. Both must use the same value. + - **Format:** The `DATABASE_URL` format should look like this: `postgres://:@:5432/`. -2. **Config (`rallly-config.yaml`):** - - Update `NEXT_PUBLIC_BASE_URL` to match your domain. - - Configure your SMTP settings for emails. +2. **Config (`rallly-config.yaml`):** + - Update `NEXT_PUBLIC_BASE_URL` to match your domain. + - Configure your SMTP settings for emails. -3. **Ingress (`ingress.yaml`):** - - Change `host: rallly.example.com` to your actual domain. - - Ensure `ingressClassName` matches your cluster's controller (default is set to `nginx`). - - **TLS:** Create the TLS certificate Secret named `rallly-tls` or enable cert-manager (see comments in `ingress.yaml` for options). +3. **Ingress (`ingress.yaml`):** + - Change `host: rallly.example.com` to your actual domain. + - Ensure `ingressClassName` matches your cluster's controller (default is set to `nginx`). + - **TLS:** Create the TLS certificate Secret named `rallly-tls` or enable cert-manager (see comments in `ingress.yaml` for options). ## Deployment Order @@ -50,6 +50,8 @@ kubectl apply -f ingress.yaml kubectl rollout restart deployment rallly ``` +This performs a **rolling restart**, so there will be no downtime. However, ensure the new configuration is valid; if pods fail to start, check the logs with `kubectl logs -f deployment/rallly`. + ## Verification Check that the pods are running: @@ -62,4 +64,4 @@ The Postgres pod should show `1/1 Running` and the Rallly pod should eventually ## Notes on Storage -The PostgreSQL StatefulSet requests a 1Gi PersistentVolume. Ensure your cluster has a default StorageClass configured, or update the `volumeClaimTemplates` in `postgres.yaml` to specify a StorageClass. +The PostgreSQL StatefulSet requests a 1Gi PersistentVolume. Ensure your cluster has a default StorageClass configured, or update the `volumeClaimTemplates` in `postgres.yaml` to specify a StorageClass. If no StorageClass is available, the PersistentVolumeClaim will remain pending and the postgres pod will not start. Check your cluster's available StorageClasses with `kubectl get storageclass`. From 63d784f550089cb0d350faf11ef15d7f69ad0bc7 Mon Sep 17 00:00:00 2001 From: Gabriel Windlin Date: Mon, 1 Dec 2025 15:22:34 +0100 Subject: [PATCH 6/8] backup infos + wait command --- kubernetes/README.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/kubernetes/README.md b/kubernetes/README.md index d5badb4..1714059 100644 --- a/kubernetes/README.md +++ b/kubernetes/README.md @@ -37,6 +37,9 @@ kubectl apply -f rallly-config.yaml # 2. Apply Database (StatefulSet) kubectl apply -f postgres.yaml +# Wait for database to be ready +kubectl wait --for=condition=ready pod -l app=postgres --timeout=300s + # 3. Apply Application (Deployment) kubectl apply -f rallly.yaml @@ -65,3 +68,13 @@ The Postgres pod should show `1/1 Running` and the Rallly pod should eventually ## Notes on Storage The PostgreSQL StatefulSet requests a 1Gi PersistentVolume. Ensure your cluster has a default StorageClass configured, or update the `volumeClaimTemplates` in `postgres.yaml` to specify a StorageClass. If no StorageClass is available, the PersistentVolumeClaim will remain pending and the postgres pod will not start. Check your cluster's available StorageClasses with `kubectl get storageclass`. + +## Notes on Backups + +For production deployments, implement regular PostgreSQL backups. Consider using: + +- Kubernetes-native backup tools (e.g., Velero) +- Scheduled pg_dump jobs within the cluster +- Cloud-provider managed backups (if using managed K8s) + +Refer to your cluster provider's backup documentation for recommendations. From 3f8a67426ed8fd5ff042425f41fdb82e0b617279 Mon Sep 17 00:00:00 2001 From: Gabriel Windlin Date: Mon, 1 Dec 2025 15:50:51 +0100 Subject: [PATCH 7/8] .gitignore reference --- kubernetes/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kubernetes/README.md b/kubernetes/README.md index 1714059..6b7487c 100644 --- a/kubernetes/README.md +++ b/kubernetes/README.md @@ -11,7 +11,7 @@ This directory contains base Kubernetes manifests to self-host Rallly. It separa ## Configuration 1. **Secrets (`secrets.yaml`):** - - **Important:** Do not commit the `secrets.yaml` file with real credentials to version control. + - **Important:** Do not commit the `secrets.yaml` file with real credentials to version control. Consider adding `secrets.yaml` to your `.gitignore` file to prevent accidental commits. - Update `POSTGRES_PASSWORD` and `SECRET_PASSWORD` (use `openssl rand -hex 32` to generate). - **Critical:** Ensure the password in `DATABASE_URL` matches `POSTGRES_PASSWORD`. Both must use the same value. - **Format:** The `DATABASE_URL` format should look like this: `postgres://:@:5432/`. From dc0d54364650c0434493364a16cf99ac7597b21e Mon Sep 17 00:00:00 2001 From: Gabriel Windlin Date: Mon, 1 Dec 2025 15:57:21 +0100 Subject: [PATCH 8/8] TLS, storage class, single replicas --- kubernetes/README.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/kubernetes/README.md b/kubernetes/README.md index 6b7487c..4a0f6c9 100644 --- a/kubernetes/README.md +++ b/kubernetes/README.md @@ -23,7 +23,9 @@ This directory contains base Kubernetes manifests to self-host Rallly. It separa 3. **Ingress (`ingress.yaml`):** - Change `host: rallly.example.com` to your actual domain. - Ensure `ingressClassName` matches your cluster's controller (default is set to `nginx`). - - **TLS:** Create the TLS certificate Secret named `rallly-tls` or enable cert-manager (see comments in `ingress.yaml` for options). + - **TLS:** + - **Option 1 (Manual):** Create a TLS Secret: `kubectl create secret tls rallly-tls --cert=path/to/cert --key=path/to/key` + - **Option 2 (cert-manager):** See comments in `ingress.yaml` for automatic certificate provisioning setup. ## Deployment Order @@ -55,6 +57,8 @@ kubectl rollout restart deployment rallly This performs a **rolling restart**, so there will be no downtime. However, ensure the new configuration is valid; if pods fail to start, check the logs with `kubectl logs -f deployment/rallly`. +**Note:** This assumes your Deployment has multiple replicas. If running a single Rallly instance (1 replica), there will be brief downtime during the restart. + ## Verification Check that the pods are running: @@ -69,6 +73,8 @@ The Postgres pod should show `1/1 Running` and the Rallly pod should eventually The PostgreSQL StatefulSet requests a 1Gi PersistentVolume. Ensure your cluster has a default StorageClass configured, or update the `volumeClaimTemplates` in `postgres.yaml` to specify a StorageClass. If no StorageClass is available, the PersistentVolumeClaim will remain pending and the postgres pod will not start. Check your cluster's available StorageClasses with `kubectl get storageclass`. +**Quick check:** Run `kubectl get storageclass` before deployment. If the output is empty, ask your cluster administrator to configure a default StorageClass, or update `postgres.yaml` to reference an existing one. + ## Notes on Backups For production deployments, implement regular PostgreSQL backups. Consider using: