From 6ab34757aaacb8affc0975ba0a66b35605ee4f43 Mon Sep 17 00:00:00 2001 From: kjeld Schouten-Lebbing Date: Sun, 7 Feb 2021 19:23:17 +0100 Subject: [PATCH] Add Traefik Ingress Chart Important notes: - Uses 80 and 443 for primary ingress, but warns about such when installing - Currently entrypoints are hardcoded, PR's are welcome to change this. (thanks to co-author for fixing the icon url) Co-authored-by: Stavros Kois Signed-off-by: Kjeld Schouten-Lebbing --- charts/PLACEHOLDER | 0 charts/traefik/0.1.1/.helmignore | 25 + charts/traefik/0.1.1/Chart.lock | 6 + charts/traefik/0.1.1/Chart.yaml | 21 + charts/traefik/0.1.1/Guidelines.md | 93 +++ charts/traefik/0.1.1/LICENSE | 202 +++++++ charts/traefik/0.1.1/README.md | 90 +++ charts/traefik/0.1.1/app-readme.md | 7 + .../0.1.1/charts/cert-manager-v1.1.0.tgz | Bin 0 -> 183582 bytes charts/traefik/0.1.1/crds/ingressroute.yaml | 12 + .../traefik/0.1.1/crds/ingressroutetcp.yaml | 12 + .../traefik/0.1.1/crds/ingressrouteudp.yaml | 13 + charts/traefik/0.1.1/crds/middlewares.yaml | 12 + .../traefik/0.1.1/crds/serverstransports.yaml | 12 + charts/traefik/0.1.1/crds/tlsoptions.yaml | 12 + charts/traefik/0.1.1/crds/tlsstores.yaml | 13 + .../traefik/0.1.1/crds/traefikservices.yaml | 12 + charts/traefik/0.1.1/questions.yaml | 453 ++++++++++++++ charts/traefik/0.1.1/templates/_helpers.tpl | 62 ++ .../traefik/0.1.1/templates/_podtemplate.tpl | 257 ++++++++ .../0.1.1/templates/custom/_appStorage.tpl | 52 ++ .../0.1.1/templates/custom/appingress.yaml | 69 +++ .../0.1.1/templates/custom/clusterissuer.yaml | 197 +++++++ .../templates/custom/delay_postinstall.yaml | 28 + .../0.1.1/templates/custom/middlewares.yaml | 74 +++ .../0.1.1/templates/custom/tlsoptions.yaml | 18 + .../0.1.1/templates/custom/wildcard.yaml | 21 + charts/traefik/0.1.1/templates/daemonset.yaml | 37 ++ .../dashboard-hook-ingressroute.yaml | 28 + .../traefik/0.1.1/templates/deployment.yaml | 41 ++ charts/traefik/0.1.1/templates/gateway.yaml | 33 ++ .../traefik/0.1.1/templates/gatewayclass.yaml | 9 + charts/traefik/0.1.1/templates/hpa.yaml | 20 + .../traefik/0.1.1/templates/ingressclass.yaml | 21 + .../0.1.1/templates/poddisruptionbudget.yaml | 22 + charts/traefik/0.1.1/templates/pvc.yaml | 25 + .../0.1.1/templates/rbac/clusterrole.yaml | 112 ++++ .../templates/rbac/clusterrolebinding.yaml | 19 + .../templates/rbac/podsecuritypolicy.yaml | 69 +++ charts/traefik/0.1.1/templates/rbac/role.yaml | 61 ++ .../0.1.1/templates/rbac/rolebinding.yaml | 19 + .../0.1.1/templates/rbac/serviceaccount.yaml | 15 + charts/traefik/0.1.1/templates/service.yaml | 112 ++++ charts/traefik/0.1.1/templates/tlsoption.yaml | 14 + charts/traefik/0.1.1/test_values.yaml | 558 ++++++++++++++++++ charts/traefik/0.1.1/values.yaml | 555 +++++++++++++++++ charts/traefik/item.yaml | 3 + 47 files changed, 3546 insertions(+) delete mode 100644 charts/PLACEHOLDER create mode 100644 charts/traefik/0.1.1/.helmignore create mode 100644 charts/traefik/0.1.1/Chart.lock create mode 100644 charts/traefik/0.1.1/Chart.yaml create mode 100644 charts/traefik/0.1.1/Guidelines.md create mode 100644 charts/traefik/0.1.1/LICENSE create mode 100644 charts/traefik/0.1.1/README.md create mode 100644 charts/traefik/0.1.1/app-readme.md create mode 100644 charts/traefik/0.1.1/charts/cert-manager-v1.1.0.tgz create mode 100644 charts/traefik/0.1.1/crds/ingressroute.yaml create mode 100644 charts/traefik/0.1.1/crds/ingressroutetcp.yaml create mode 100644 charts/traefik/0.1.1/crds/ingressrouteudp.yaml create mode 100644 charts/traefik/0.1.1/crds/middlewares.yaml create mode 100644 charts/traefik/0.1.1/crds/serverstransports.yaml create mode 100644 charts/traefik/0.1.1/crds/tlsoptions.yaml create mode 100644 charts/traefik/0.1.1/crds/tlsstores.yaml create mode 100644 charts/traefik/0.1.1/crds/traefikservices.yaml create mode 100644 charts/traefik/0.1.1/questions.yaml create mode 100644 charts/traefik/0.1.1/templates/_helpers.tpl create mode 100644 charts/traefik/0.1.1/templates/_podtemplate.tpl create mode 100644 charts/traefik/0.1.1/templates/custom/_appStorage.tpl create mode 100644 charts/traefik/0.1.1/templates/custom/appingress.yaml create mode 100644 charts/traefik/0.1.1/templates/custom/clusterissuer.yaml create mode 100644 charts/traefik/0.1.1/templates/custom/delay_postinstall.yaml create mode 100644 charts/traefik/0.1.1/templates/custom/middlewares.yaml create mode 100644 charts/traefik/0.1.1/templates/custom/tlsoptions.yaml create mode 100644 charts/traefik/0.1.1/templates/custom/wildcard.yaml create mode 100644 charts/traefik/0.1.1/templates/daemonset.yaml create mode 100644 charts/traefik/0.1.1/templates/dashboard-hook-ingressroute.yaml create mode 100644 charts/traefik/0.1.1/templates/deployment.yaml create mode 100644 charts/traefik/0.1.1/templates/gateway.yaml create mode 100644 charts/traefik/0.1.1/templates/gatewayclass.yaml create mode 100644 charts/traefik/0.1.1/templates/hpa.yaml create mode 100644 charts/traefik/0.1.1/templates/ingressclass.yaml create mode 100644 charts/traefik/0.1.1/templates/poddisruptionbudget.yaml create mode 100644 charts/traefik/0.1.1/templates/pvc.yaml create mode 100644 charts/traefik/0.1.1/templates/rbac/clusterrole.yaml create mode 100644 charts/traefik/0.1.1/templates/rbac/clusterrolebinding.yaml create mode 100644 charts/traefik/0.1.1/templates/rbac/podsecuritypolicy.yaml create mode 100644 charts/traefik/0.1.1/templates/rbac/role.yaml create mode 100644 charts/traefik/0.1.1/templates/rbac/rolebinding.yaml create mode 100644 charts/traefik/0.1.1/templates/rbac/serviceaccount.yaml create mode 100644 charts/traefik/0.1.1/templates/service.yaml create mode 100644 charts/traefik/0.1.1/templates/tlsoption.yaml create mode 100644 charts/traefik/0.1.1/test_values.yaml create mode 100644 charts/traefik/0.1.1/values.yaml create mode 100644 charts/traefik/item.yaml diff --git a/charts/PLACEHOLDER b/charts/PLACEHOLDER deleted file mode 100644 index e69de29bb2d..00000000000 diff --git a/charts/traefik/0.1.1/.helmignore b/charts/traefik/0.1.1/.helmignore new file mode 100644 index 00000000000..f605c59ab4c --- /dev/null +++ b/charts/traefik/0.1.1/.helmignore @@ -0,0 +1,25 @@ +tests/ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# OWNERS file for Kubernetes +OWNERS diff --git a/charts/traefik/0.1.1/Chart.lock b/charts/traefik/0.1.1/Chart.lock new file mode 100644 index 00000000000..3f084b4f405 --- /dev/null +++ b/charts/traefik/0.1.1/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: cert-manager + repository: https://charts.jetstack.io + version: v1.1.0 +digest: sha256:e85da7e5637ef559ea333dfe4e10e169b9cb3d976f826d587c420a82120589da +generated: "2021-01-01T22:54:26.9144279+01:00" diff --git a/charts/traefik/0.1.1/Chart.yaml b/charts/traefik/0.1.1/Chart.yaml new file mode 100644 index 00000000000..8ca178c0379 --- /dev/null +++ b/charts/traefik/0.1.1/Chart.yaml @@ -0,0 +1,21 @@ +apiVersion: v2 +name: traefik +description: A Traefik based Kubernetes ingress controller +type: application +version: 0.1.1 +upstream_version: 9.14.2 +appVersion: 2.4.2 +keywords: + - traefik + - ingress +home: https://traefik.io/ +sources: + - https://github.com/traefik/traefik + - https://github.com/traefik/traefik-helm-chart +maintainers: + - name: truecharts +icon: https://raw.githubusercontent.com/traefik/traefik/v2.3/docs/content/assets/img/traefik.logo.png +dependencies: + - name: cert-manager + repository: "https://charts.jetstack.io" + version: v1.1.0 diff --git a/charts/traefik/0.1.1/Guidelines.md b/charts/traefik/0.1.1/Guidelines.md new file mode 100644 index 00000000000..e59a5175739 --- /dev/null +++ b/charts/traefik/0.1.1/Guidelines.md @@ -0,0 +1,93 @@ +# Traefik Helm Chart Guidelines + +This document outlines the guidelines for developing, managing and extending the Traefik helm chart. + +Optionallity +All non-critical features (Features not mandatory to starting Traefik) in the helm chart must be optional. All non-critical features should be disabled (commented out) in the values.yaml file. All optional non-critical features should be disabled (commented out) in the values.yaml file, and have a comment # (Optional) in the line above. This allows minimal configuration, and ease of extension. + +## Critical Feature Example + +```yaml +image: + name: traefik +``` + +This feature is critical, and therefore is defined clearly in the values.yaml file. + +## Non-Critical Feature Example + +```yaml +# storage: +# controlNode: +# type: emptyDir +``` + +This feature is non-critical, and therefore is commented out by default in the values.yaml file. + +To allow this, template blocks that use this need to recursively test for existence of values before using them: + +```yaml +{{- if .Values.storage}} + {{- if .Values.storage.controlNode }} + //code + {{ .Values.storage.controlNode.type }} + {{- end }} +{{- end }} +``` + +The non-critical feature defaults should be populated so that they can be enabled by simply uncommenting the section in the values.yaml file. + +## Optional Non-Critical Feature Example + +```yaml +# storage: +# controlNode: +# type: emptyDir +# # (Optional) +# # volume: 1Gi +``` + +The volume option is clearly optional, and non-critical. It is commented out (apart from the storage section comment block), and is also preceeded by a comment of # (Optional) in the preceeding line. This facilitates configuration, when the storage section is uncommented, the optional features are still disabled by default. + +Similar to non-critical feaures, these options need to be tested for existance before use in the template. + +Note +There can be optional values in critical features. These should just be added as an uncommented non-critical feature: + +```yaml +image: + name: traefik + tag: 2.0.0 + # (Optional) + # pullPolicy: IfNotPresent +``` + +Also, the first value under the primary value key does not require an optional comment: + +```yaml +# ports: +# http: 80 +# # (Optional) +# # https: 443 +``` + +This is because if the main subkey is not defined, the entirety of the feature is optional. + +## Whitespace + +Extra whitespace is to be avoided in templating. Conditionals should chomp whitespace: + +```yaml +{{- if .Values }} +{{- end }} +``` + +There should be an empty commented line between each primary key in the values.yaml file to separate features from each other. + +## Values YAML Design + +The values.yaml file is designed to be user-friendly. It does not have to resemble the templated configuration if it is not conducive. Similarly, value names to not have to correspond to fields in the tempate if it is not condusive. + +## Comments + +The values.yaml file should not contain comments or explainations of what options are, or what values are available. The values table in the README file is for this purpose. diff --git a/charts/traefik/0.1.1/LICENSE b/charts/traefik/0.1.1/LICENSE new file mode 100644 index 00000000000..907ff83212c --- /dev/null +++ b/charts/traefik/0.1.1/LICENSE @@ -0,0 +1,202 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright 2020 Containous + Copyright 2020 Traefik Labs + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/charts/traefik/0.1.1/README.md b/charts/traefik/0.1.1/README.md new file mode 100644 index 00000000000..658e657cc83 --- /dev/null +++ b/charts/traefik/0.1.1/README.md @@ -0,0 +1,90 @@ +# Traefik + +[Traefik](https://traefik.io/) is a modern HTTP reverse proxy and load balancer made to deploy +microservices with ease. + +## Introduction + +This chart bootstraps Traefik version 2 as a Kubernetes ingress controller, +using Custom Resources `IngressRoute`: . + +### Philosophy + +The Traefik HelmChart is focused on Traefik deployment configuration. + +To keep this HelmChart as generic as possible we tend +to avoid integrating any third party solutions nor any specific use cases. + +Accordingly, the encouraged approach to fulfill your needs: +1. override the default Traefik configuration values ([yaml file or cli](https://helm.sh/docs/chart_template_guide/values_files/)) +2. append your own configurations (`kubectl apply -f myconf.yaml`) +3. extend this HelmChart ([as a Subchart](https://helm.sh/docs/chart_template_guide/subcharts_and_globals/)) + +## Installing + +### Prerequisites + +With the command `helm version`, make sure that you have: +- Helm v3 [installed](https://helm.sh/docs/using_helm/#installing-helm) + +Add Traefik's chart repository to Helm: + +```bash +helm repo add traefik https://helm.traefik.io/traefik +``` + +You can update the chart repository by running: + +```bash +helm repo update +``` + +### Deploying Traefik + +```bash +helm install traefik traefik/traefik +``` + +#### Warning + +If you are using Helm v2 + +You have to deploy CRDs manually with the following command: + +``` +kubectl apply -f traefik/crds +``` + +### Exposing the Traefik dashboard + +This HelmChart does not expose the Traefik dashboard by default, for security concerns. +Thus, there are multiple ways to expose the dashboard. +For instance, the dashboard access could be achieved through a port-forward : + +``` +kubectl port-forward $(kubectl get pods --selector "app.kubernetes.io/name=traefik" --output=name) 9000:9000 +``` + +Another way would be to apply your own configuration, for instance, +by defining and applying an IngressRoute CRD (`kubectl apply -f dashboard.yaml`): + +```yaml +# dashboard.yaml +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: dashboard +spec: + entryPoints: + - web + routes: + - match: Host(`traefik.localhost`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`)) + kind: Rule + services: + - name: api@internal + kind: TraefikService +``` + +## Contributing + +If you want to contribute to this chart, please read the [Contributing Guide](../CONTRIBUTING.md). diff --git a/charts/traefik/0.1.1/app-readme.md b/charts/traefik/0.1.1/app-readme.md new file mode 100644 index 00000000000..4dc0c1ef344 --- /dev/null +++ b/charts/traefik/0.1.1/app-readme.md @@ -0,0 +1,7 @@ +# Traefik + +[Traefik](https://traefik.io/) is a modern HTTP reverse proxy and load balancer made to deploy +microservices with ease. + +This chart bootstraps Traefik version 2 as a Kubernetes ingress controller, +using Custom Resources `IngressRoute`: . diff --git a/charts/traefik/0.1.1/charts/cert-manager-v1.1.0.tgz b/charts/traefik/0.1.1/charts/cert-manager-v1.1.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..ad4ba674e3b756e443697a988685afebde1ff6e4 GIT binary patch literal 183582 zcmV)CK*GNtiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0POwycHB0WC=SoxdJ25vE=ukz%6Ck-d`2O=cp>;yd=?%*WJ{W&?D9PETd27)FEo}HraNfe_% z6AGGff%5dTv*0l~K?|i4d9uGhr)rT-CjpQ5|4x)tIJn<0yiNlR(!DP5-`u@MZ|u@=N$fTlCb&CJy||-5z3RDadBv4be~SiI3jbtGe!|nlCVH56SXr& zDv~=frc7bVh=6ZNjA?X&{*GfJ|IPJ3p?n7+hV>-llrbWH-Z6g_x{^E<0Rb?bQSneh z`e$4J0!klnloGjh2C#bnAH6ty`J%M{UmP3``~S1FC+M8aa2hFO7QeEoCp%Bj?Se`~ zCBo=GPT##9&$x)OQY1t(8WH`%ISC>x2ztPR;%P)AQXEYQO0bk9M3gCxmOK?mkvNI4 zB66}bkN6ZvCp!o|d4jIVj0nO4qCez}ATChM1woPof+z_ws)U$J6o#~G*O;@`+2#F~UGzt+41i^}&ASF_wyG(d^LxNO)bj2eYEX`|# z>GcUu&(rd;X~^I4HH&^2arq8}fiF?xv}sal|y zXiD_L=ucxVmHnPfb`XmA{4IGP(Fr=zeMAI@M7)kj0Kx?Z^8~$rAVScP00fOync%>p zNO2^UCJX)B87$;GoB-wwFhndg0Or3wLA${I~R}pchF|qRm zX)@NMFcdS{v0s0uKL%3S0m9T{6C}~g$;I*n{UgOoy*+A$(l`SO6Zj9Fq5v~wenuF% z?EwpK5MiHq$o6U0V{1=46&iq%BZcRB`9qRKe2Jz@B#Ban(5Uo`X9AyJ%n;*-p=q`y ziP|$eORFs-i83t*J<=$0JJ5Wr@ccy26N{za2+$EmA)OPc%s1Q(5woTK23|EUoFKWt zN5?Nu4#>gRM`0L-hqJF|uV%rkZw|h}M*)60dwER0eiu8-!@R4ph&RPH=6$Tdy1%G|tIRV8(iFhj^LW;JZ6Jl86TykkcT5J#1Dl zApxCHBDLI53nGx-ZSWq#=EdB`vR&_#_^AeTYmuxsC*Yz4L~%XO904j#cnGu5!qVu` z(Do2EfT%=s!id@TsdQX(mPQf$?t~?PWEs=XNfR7~)cun&uCV?CqzVp!2!QPU?ixvS zQ@{~G%Y6x~Zl|FGF;8Q{l-wa7mB6QBp2@!tl9-J+i_AWSspnQ37+8T=VEt1`JgEX8 znI;Jru-`l#B0>ID!PIE$8OCchIrO<*&Ml%2{CQZoXrUmAKN;m(tCKPQ0JlES1P zS!fz<2Z!*)!}QNIQ5(?tEz~#@xrca6jly+jyS&RyR1aLzIEj`>0z)&bG5db!iB_=D zBQ~4}L>`&UCr#7J&*7kE4!LKSoLzISoNo98$N(0yLK#+_)eFE`iT9v@#|dYIDdZ{P z6Ht=>?WTsLG>r#1!BZMhMTy@8q2P)8_ZXeNeQUQ04&SqAsb~K!jfmkAIgwC@o}C9C zr7w|GjTYA0I7 zu-cg1(=2_KMtVzXf?VJSttuwzG@=2Ju{EyXtDm*0H{+TPym}Gx7*nR{=bERApyTHg z^rMy@Gag0!(HNo(k&ie|B9O*}$y87_*LrYX!f0g`2LX}r0cCTc|H%b(efyVNBuKzT zC=pf&M-fsq)`sa5bou`F^@-6}tmu*GjVDcXI5|AfVD8RRsd#+F!}H6VyMo5<*-D0U3OU}rye{9Sfvs*!25%B=tDg8i`>F(hK{2P!zzyD>IN9Gff4(|+b+Fs%4aVK?heuye4kiba!@YOc9IkU&X9 zS&}Lwl}H1iKP*u~gq0IopU`&B3Jxor?`7X>qq*0{IHCIwhm*s@{U>-fqfB$#hr@B8 zHMS>4BQsmkP^Npw(WxfH)6z4q(4E7+y$Kd1Otl4lF=yOAe*KXIsqqZh&kQt2*0)5& zGWXjU#aIQ4*B=v2=fJqKAN9}oWO;&SoKL1$fG<|?h~!^Eh$k8Wddpm};xEQMc2az( zyVRR{$Isdl(&t|r#UuSYV^cIg;MJv+WIcJV49sUwQiU?M@*wD22~U#SWEqW zABD$GvR2zMO2u~d9fVpmo;sbUsPz=}o(`H%lkU^sGWTs@M9m9KOki*p13f3f{*nO|@Vz%DOZ zpJn^AVu9A#py1knOCJa`id+cPN#UuULKVf)If?MnbG4U- z1tmmK@Xvc*2P#Sm%4!bMp;3CutPxOaaj@=4j_U?;+;bc|MTzXlrYH@IQpb`;J!Khf ztVG~H7WZ$-4zWQQgMse8?Tl(Wxwe~}+uhvTuCuxbM_=#uhW_mu4|gvg_owi38%k_+ zbbI3==hxlDvs>})_Vez368~<=!@F%CZ>^WtO&gq4;GfNl6N|ZsN=3jL*Sy{_Z|mh| z=({(sy+LmcT)C&|*Lh?!7L0I0tqlvFH>|CBh*a3HOLXriV@+kvTcq*eafV*Jcn;V; zJUBW&m>`+iW!m-!=do6Rh_Mdgtvy4>n%5(qDz~^({t-5|e#8g~VPyqaNm#=UC_UDVs^S|A^zW(9j>~%r40&S48(4ds1@l;RtkKj&2)zR&g0u*#s zw*p$dR9Gm8qa$tnT@nQ|ig{?_4FKml?<7wp(Qkt<*l?jRzZ7n%&{LTP3vHF0{&<64 zzqxs4g17-VHjM6jd6B&p;D`qN*&dpb0P8+1*^QG3v#h7-65s_ua#|CPQwEN0fCxQk zp*unsSLp2G{2G=OhcT6gXBh+-GSLw9Z0#Bwlu^hOSP)NUfN&Q;&s1KXuXcJ{q{HHXF)(P2V82gl_QLdZytfPV@kU{%|#=xi7H_uMdMF}h0(K!qF z`3!1juD?O^95l}_M)Ulwa~_A5wL<={&(7Sxe1H4;W}-f-ZS>KS|9^P!^FY2cYj@6PDU>3Tq)P zHs@;0oU8jgJKu6q9$cm8!g6RnTSzg2JU%U4cg}L?2HoqzMz_6|wTBeG*E&U{O(ARC z-`ODWST1OMx6^Ansl;=#ZvpHNO#FXFYvBKXTaYLrLQYh&`B9J-{{Qvy^YZzxmxssC z2mb##+AqKCe}x`sd;%z+Ijsk(cDs%^i`XgYu_8A zkjy9}Xt%&b^as0WoV@~Gn~6Dac&VXHelUlR^qbyH`ERY(vH-n&4*#U_O*)&=k7#$C z0V6Dgf15#`8HE`8K0tJ7(<#y#d#EiG82)7EM`EDE`%3qrry{*?3!G=Uv>%xCjFKoc zo~ek&R1vEOQ;DA1eC6}Y8~v^pSu!EPvo_o~tvs6&oq2S)A3aLkJB=@N!dWCUNdF5a zcJin0%aR+X^|D9{WpYg-f+aB@`>__D_8wp&C{r`E`@iM*f6LtxG}CV%LTUPUfq={j zM}Vz~-k#4xSeo>DyVT|_@FKLWGQ7ImIHx?y&A*);{omjN!~sFO|NmXI`?uZocSU*Y z)|;9w6DgX+mraCQd~IS4RsEti3V->Q2Dp1S<-zO5+&G7`kB87f?Zv5)J0(?zo?%g6Ih0_qf{<{Cm zFP_Hh@G(KZ{yGlur)8XexW8kbnZ=SivCI0`JF(50MS9i-cRkM81y~~o&BYo%H51Lc z+BP4}AUCkm?1h1w=8*LX8R}6dhMHfOO?c{-HN*@Tn?^@=*Z4&@MX`>sa!juo z`g(k?BfJ{c_gkCyt*ycTlg)UXF~)TZgS7a6ULLB-z^jvDV#&%uwth|h0j2Voo4>IMQse2e_>~QtHh<{TW=;w!2E4r>Q9O~0 zeUKoH^Re>9PN;d=Yx7IYNBKCewjUJ#4;)9`f&4e3EYu3ti);{@QU3btj#fi*=R%}G zPZe-J9m)W4%9^1EI05uFM|lQeatCY1_F*#|YnlXBdp@%w_% zshQp?beGa5{TG$9_$yIfE*H=N=efMc+;$#k0y%F<03a^_CIJE0<;8WMe zzy7Mb@qdF)$!o;sCzrW~^aJ?*>BQuAJ<~6tfBWSZ`?q<)sp=;=HT{3tnVe=RXA_0z z=+|FSuD{*V3=638^SH{TfYl2gcx{rUiWPxiG0$PUi9}ubtKzp~G#)?vsY;ObZ`aO2 zgD~~4#;*QVuEI$T=tAMGNmiw$(p7_M=yE$-Ial_kr`^MY4l^R`;iND@L%&z=&;NFL z`tJ43)#=&m-0${G>bHW&CxyqzxI?bVto+>mas_9{ojA-;(FqStDaOUQRQ7y+5E^(h z`WidPWc}e$2Xtn+x2u;cE4h;`mxsTKLFBV?v#txdy7``KI9X}jt2%S(zBwu8514PQ zlUxpQ)=%O1bmy+VWQRbz{h!Fh)lU*UB5ODS+VcONA5`rBuaAfPzt7UT+5ZhHSGmNb z|K`_Ut$V29#?|TXk^uTGzxiePsG0U)sDJ@vtQ)EouGPfU1>6Ry+IC_SpS_3MH6PH ziHVdc8k6EsI>D=-SuMPpz-S`q1C7W$UoI0yc;$Y0Edv~xlU&6&NO+d7bAW#OYp#r^ zDbp}3mNCJCAQ~symQ&HvLD43it!)dUc@(${7)IuA5+`bTPKEt55nR(53GLsee75}~ z<7rG_QbB#8)|n2W4kyp?`kG3G4*>zjzwF8@K{+eiUu zJOB0d*X8qHUk~?xeWtdF{0GX&y~^}gh4Up6`h)L zW9|`T71M3aJPoPpI(Pl9r0l+bzvJ=vH}rT7T=4hk?J9Y?KBYsel*&}=R0A4*Qocvc z)IjV@+Z)OB6ElR|O>U+6^+{$K_Qlq;1GpX`th;Q_A9g8T7}rpYtemQZXz|EQuC~da zvAI6d7Y{7J*9IFwK^*4Hm3^p{Ihpe(Zx0Wj_ZbG%%rB3{-1E5EFrI(iO+hh2KgNkH z{c3#=MTKm|OhBROG3f?r*Fh8NGz|~eDp^Ka?mR(rfm!KNu!IO#1r!eML0vq(5JjGV zd?$#yD-g>xnWb{A!Ms*VIE+%Wjx!v7Cn9337#e_5{o z_VwYx!2dr-bH{Hai64kK<8guoLA!rEoE*L!AMBz@K6W^HlTL|c>XYxNvj2Qmv-5Hn zte3L^>b!!b+yHa2qPyk!+&csd0;3YIE|;w|9AX^c@l5d8-p7A}MztkwY-t?LMMib3 zxcF5~aXa_rYK}UpVW~}D<$3C;o~br{Y6L)!F_&2FiZ65QcI3r&E)L-D2q`Ux4`pXn zrLP3s(|E?CG-g&u{`Z^rm*!B;L@KOOISDv3AIP8n&(nXKKz+hL?OqccE_a{()xMQe zqv03$+gytvmAxRO2s|Od#8iR3CNscC4u-8yi*lz2{VhnVfOZ;jOr*r~e0Mk59Qt(U zk1d%Rxt!h7m`H`=1U?Ok3V))+PfeqLkpZFgvs%g%(x(?l(0L&69_IPk|e=G z)10|^5I6)nizwVN5aXpUer~JNM=5a~`|;aS>qz%_{q5QF=g+@^i=v@S3zhouhugDB z4*jQgF$}Kl?HO}pCYGt#>YFDyM{3Stb!~_revGJ8ZyH{BOYKWZlnNZxZXlC1v*1Eq zW<8EkApAesfhqID|xoY3@iE009cLS2MVP6=&v0o)C6=b@9XV zn_xj=e`vfwU%RI@)Aa5%#ob*G2qQ`7jD&^z(KUm%P!ZxRtN!FFBZsbH^921DL#I*X z>Kr{%wJ<)Qn*K-91HIE5{?4Yh#HoU-TkuQ~f!ywypxQY=(IY~k&Og+{_5_9y7jWy^ z9>NlZgmGnDhg3;)XPJTi54khLHG{85l!uAYh%+*l3$8}qwYG<1g3Z-3DkF6X*kp6K zg@!WNWUyaFjt+I3ae;6F<8XU`xu9pN-yg$04eq#XBJ>8#?nN;U3tV9GOO(pg) zt|<;AO@%GhUb+Yw(bm65$@u;m};%NK$ zrUX%QW%Ithu_YuB4T8#ahGUzW`(;?QsD@1{&rVlP=t7>I8lLPV3PcLTy`jK7i<3r@ z!6oeFspMbO0!i->t>svPRrXFexF`qaF)_1;o(pC9E1=|2H<_)DaV6SDWEQCUNW6ND~im5D*!MZIfAMw~f) z53T{?!YF1OjZFU|&0)*;J5*r$DvWdbK$xvGXym!n|IUITST<~$8ko7OhxANpNA5;j zxROE-x^ziJK>pY4aUYc+2G2#D8>~XNjvT2ogdrZbV-E zOo`rPFdqRrVwK^nU=*lEDAslkvT^%;gXz%L_hqh{;@0|hgi`L^58m z!sF`oyD?z_*M$D@_~4sb&Y5Gy)9N0#ES2Q1SkuhMeqElvxgzBRO_!>EHZ@o=oOI=6 zKENw*SJr~Kymy$9`PkfnsttrpUe-yDl9-uj{$e5MkBxOomgwgD_aEM#YnI^9N13#j zuT_Aa-CTnLfzESV^e&`xs&E8|!djWR1Euxuo-8#`nkfqk&TMZg3(GjB zio`YBxujK+B_Pd%aRSvyGke*hxq#-LEJ0hW-4jlSQ=CU~LW!D9xR~!RR2=P#S#W&x z>fnjA83`{YN0YPN~vMp+7D!k9&saf)MvW>y$Mh%inn&!lbE2{@?CJxE~h)67!%2sCxx7_>cAM z;8Z~tqtV*4KY8dkHgptY8r1+z1Xo$YiQJEA4A~+yktBe~hq)g!d!|yxNaX*nftgAo z^zYs+Wyin+ndHY5(?D>^X9~%ApdT=zWPp?E#zOGMsPde!v{EZbvryYf%`X*_sClPK z4>d29$)n*FPc3z0!3wv*@RU>cn0p9*wU*EL!FJ7#rHb0k+coQwi%k(v=?-GDWH z=BTl*cOcH1AIh}a_=+Lj#-BCa*8G?!rIR9*9PfyirqcQjx7^9udJ{Dg(T`IV~E zD#n??QFvN*FEv@j#;Mq36C1C0voUNfE~}~=Z;iQNx?q2GF_i<{MbANvdX6iIP3Me= zJ%l64(LLjjRbq2i$|-u9n-MxSiAHMqtT-#q5JpoX)tJm?TqrcfvgDM}ZMw`|V&^@f z*=3-6u2XIBNtwpp^`0^q=RV_A9^o&0-i8L2L)T`w7DT2I*x%mCl>51=TozT(8mv^k zEDJ21N4E|ya0g<*<0K+l3FPKx#2KcMHtp(e8PvbQ{e8Jh1M3zsSdie}IpglKIFa)Y zZ(|)i(3Q*Z*7_jK9?gBF>4vhBj|RSkQ($rw|OJ; z=?EBKGlGh|unA8q2i@cp0`)gbFDU+?AvS1^H6EiT%@H~ASI6uM2>UjB4@t!Z$#|Uc zzBIU_D`RxB*r`%3$V}NRO2O4V$6{)n6p=d-pvBG<2lrz>n>9(=Ccf8z`x;!87h(+F z6H^b*XT$ox3WvWQOv(q?N@4Djc#SHkwhT|Q{fmQuB+6W5Q^-iLSGl|70{Anh7oea1 zx?`Y{@CP>z{jhwDaY)trADyc8yU5Wpv~XF>&oY^~-2eE4bs1ix_+xO?^QAMAsWgdx61^4 zb644!4W9L^*CVs2DKq(8Ip%N&xmC9d;$Y@`aX|D?dulpR>!FIDL^S&is3ZHq3V>tHU}`wRyoS zS*CRfQUv9|*=@MM4+LQp5jIx~J*$^5;9^J|C`~h5pc#48B*PJY;I!&FoD&9;lFbn{ zrXo7Kxt7-cF+{9|p2@}1TY>DjYRD>gU#V0tWGqVa<_LMB}1LdhW zX$!}`JUlw~;n^z*WpY_m=a)BbCZ~~+tvQXP#@E-f ziVdE}-T{^0S%MzAn4#>Q8hQ!QU0w?6MVNyYpm`lOn*#?b#Zf`_x(QXCALV>KC#4I~ z9WS$w_MeN;d!rul5~+pY>AV^-EWsT~KZed(h!9ge4MRbsY$3|mg;$HDX+o2=#957F zm}t;vBTf^4F-b8O?7BlX(CfM{Tr~_}GZ0a^Crg(PWB6ZXv{Qnt(WqQnONZWB=SM)gvX==D`-7XoW=BF0r)6RM*zj)(XTgE!8zx#XTDm zMSsf_S6GBPA~b2Hzw6Z2(wjq?>Howu(|fWsp8l2F_>FrjGrncc3F)CAo~k5O)?Hr> zX%zhlcRBY!*`v^h`u=`j8!ju%;NRce`MF11~u@+D6|t z1Ko_vrvA4&KcY5T@iZc`IBe&Jv^=#%A$3hNDgoXEG^3IA=RhJWK%M;kUfy{=mt&0(i}J0H9BTwwl5gGRSR=$b`8LS0W_*?CYY=6FC>ums{-+H^S>sQM zpbuD)H`Ps3Sn&6WPj9v^OZO%0S+mzW*fgs)FplP2P_?K{XDp27)V=BQd~;*Tz+}mV zZK=Qc&ug7sT5>tB&Yru{$Hs4KA!0#Xj{L5Wco%Vjc1aNGe_qVcogXAb0{lTk6DW}M zXL47s92kFEHWWQ#{kop((ecZIvk9i+I=v^=gGB|TL)Qgx2QOaLz!Mf)_GKOGY063+ zqwAZ~+UKv&&TD^JxnaQ#PuaYcVs1-B0uqVO1x^-AaJ_|Cgc3c~a_E@{TZ^$e0vX8y zbi@C%gR4dQX;_CmO#%Jvg7&!!3j_atwQGh7r#rX+q50%c|6U6cetxy5`Ex=7MIT7C zoD`18S^#vm`nW4vxu77r8-ID#cS(iKbu<@{wJz*+;q@$@vfz(J4&}3NYH=lqjS`d4 z6tcj1MNRKJBis_f10tRG*m{aD$paA$%UYm|f>xMyNN11~9&%!~H;x3s;S!OLv?hBO zWk!P4eQUCLE^;6Nj6~B^X}v)|s)eb0hFH7jnGoFe%v1np(7O907N+8dOANwPHn?xJ zM)`=Tf-`<5ImYHlsR@D`6|fDp)k_Lh%24wrRy`Y$En{Sj813aDpBGt(0qJS!9;v?)v8RZqG!%YGLLW)twd{y*m8n=+0z6!E(3@ z^E705yPmAejA+I9Kwh{Jwu$1qqvMx)fX`pOFylKuI&2)?@yokTED@ngZWQvunRvs< z>pqC_M;fQ`3DVf9`<*iL`#~c;=^Zq$#GY1^sqiTWt!WfE<|%`4BjmH%EI%N$R0zUU zv@`+1uqgQ|W4&Wsoz4^yce%3(g^LR84xLlDr~oTP;zXG;cZ@vN8j5AARfXK0N-Blo z3P(P3!S0w$iiw1{B(PQV{?3;Gim~F8VY5AY4Sr@uRJizwa)Yh?^t5d&_fpam( z%wB7OqYsR#_8Gh{e1qVlFL6HoX7a^MA>mTt=!}OQi0KO6g~AtK&iJ+Q$AS){zfo9` z{VVtWmofoK1jW&18c*GQ!K>x~FCzwT_n*OP)maHbRAbg!4LxUn*2&pJ&AG4fGe`AngkZt;iPQpBMxZ?GYNnI%*dl8p3_iUl#0 zt%u_CG%c1_5kSo;JzqP;p3gFa_q#0Ht5sh?7M;|L=WgQT9K{||R_X&X4(hx#w$r=< z;!o5eE)cM=&T$SG+-hAlsOMp%3v4jQrSi4w3ulF7R#B+XA>{YE(2!sF+5#k7BUKl+ zYn`Rx9T4p^7d&ivj-@FgYP~*Nn<@kwan#B?ue0}xd{Z?{yeS16_M8oI7E8r4j?yIH zvC)yBJJ=4vf`n;Qb(?K4=LcFY4^x@&?rj#eMkDvhsE&@Yv_b6&`mgGa{?ViYt+;AP z&(g+2voNtwqq!@WYRh#!cH^o#9W58pno=dQ?WSd7--UEyDB|-W0WM)uTKwY~)hdUcunp79 ziWlZUeWucdew3CfmI*Owd9LCN&b=c16|ZWch2`nlyVse&8mPwpIaK-^D*X+W{-CX0 z>8~knfX&?~CSU8r_1jjn_rvvDfB)gxyVve=6$7A@4{DtL1(sIW0-8juy4=|dVWsBE zaoTsBwMs*c?HM&1Z+Teytr-`4h)gQC;UPpm;y8)OB;c{H_>-lQ*rIr5CZk6hg#i}f zXm8aa&37MeZcBC(<816cMjm~zR@XVbb^J2pJH=x){_(e5pzm*QuMQ4#x?O`O#xgh~UxBwdMqs10E-yYGj?iD2 z4yvy0j42wwfpfIo{V|_c|L;G(L28l4(?r`y|2p|2OhpS}t>@PGqre1!0(h>2f4!T) zOwTWGiW4nNY>Fj$`NAEAtN_0G{`BbhC6cK>tlMXtMI|$9rEwxfKB^*eAs51o@b)ja zHhScejwYS!u1X#~w7ApHTn+(5pg}UgXV$9^oY#8V^#GesDLPgQeU?dXow{5hlLv<# zP8Il?CWXjV@!U=pDa$Jp^`Z9Z5+y`vx^!w}iG_Il|ohvC~OBU8%%+`16sJ*I3 zW!BrP?14T>bq}=F3LmIzl@HXR(g#|%+DGezYwWO3U-6>{ZrUn;ptkBCsJ#M+X$xL0 z7u<8e?PW^JETi#7J(`9eTW5psag1p%o_h+PKTY3=Et6ms(^su8h#m(p2 z(bD9ZoN*@8m4xUEEVL;imakz!P()_R!kg%J2wAj)*=x5;YJ(FvR) z4EK^jaCXO-5=*@qGhSVmN2=~7$wJ?`Q%4fvNOHsosf(NTnpC?!R9Tf~jirF?bybx> zQ)XXPm!PP;rTh#`|Ze!ehF2$~0+*#(ak@T8HxO&9YwOaXg=0E%GBo|JoKfm3F z&5iVk?Lq8R8djHTeMY$hqiT_x;A&#MIH}7O{(0%KzCTqU0lIuC?O)I(i{(4McxAg9T@089Rme6v2KvXZ)TUTxGtXATnNi~Pll3#%{~rOMv9(^MeKA7xo!7DmKCb$XUT+>ECTN`N@C zx>5gHrqidNPlG;B-kLq zHp9)AV|}YGvGLZP#4I>EeEzaCzq|hSOuvtw?w&6hj%k2Cz*%AGc8&?YqZQt7gl`_F!xbY>tOI33lQnQFFjapel-BQC(t?FzVI=Favg ztmwn)OFgwLv1i6)nj~DniE+0Cxsz!o4_?18K^IN5V4D6!zis{I7grB2{aAD7X9)`; zE=|=g`HvL0Tt7O6wNny3C6hV&>FD6#@FbkRIypJ~>$Cs&fB%5=&~%T^O>fHSt_0}= zI9t1#RY^KOU3EF8Yt<8rw>KBx<*v)jo%MBOub0ZN(aMS0^_%GZ6dENHRHVB*J-|}3 z!<{Y43%|V~ODOVIf9scPSP)z0K}#Pqrs9o=PXjE;m@-MAgy{o$wwl@B-F^S=^z7aF z@!cJIYGu*0J^T3P`_sd_yWC$#$1m^hP-8XKJjk2xPmd3e?(SAPk2olho;(&M&)>((va*siKaJ+4DTlk6-Q69G@Eg5 zkQ>Y3ET5yt0=at5rgX7!Gnt$SOJJZNRca!Y8)Rxw=84o_Nvanu_&J?rOJ{@2Kiz!tCizO7}g}dY?j$v7^ zl^OKvEpAFz`Wq$<=c5v7M)fncH;3ebwmCIT(m1#@Cq)sh1)cZK(tteMLrb1^8D$E& zyJm7AfFlwpE=+Y;7lXrPcD)**-*VwDWpWkfO9fqlH}7eLOSqmtThf()y*^Ie-A&kD zffVu}^?x^yZrp+~7~r0ovW zn~esLjm_mbkX`R)Tp+|&kGva11I9PDGYpsNy%GiYpl5WcBztHpE}M?3%Zq`0y*Ro`hTZv(_xWkRo*DijAfUU9OsW!lk6s zh#>w_nF=ctG9Dr{7#qVtcji>7bxbTJw|n5JM(O>5vJC|MQEr2JR@0gXpR2S z{^XHF(HQPkGll$o|NDRWkN<2|M-@k-^7KY1;bHDlYS_EB82Pk#K&BC{9u>jCB3FCX zp1QFF+^C0iJ4B6}*A%T!n(>LH_vay3+Y(@IFEB zS+sO_2aaH=ljqTAU!3aZS_5(1R&G&iV> z5N7QVN4dLPMnjO zxUJe9BOMcYUCUqdv%38@=zVL5z5%nfw-VO1&yLxSuXcK^&C9mZzMv&dC6CILbAVgo zYIr=j>a-#w5oMA<5)5UE!_{M}O%|^RHF8gP8@RVt+8HthkH_Cr2DidHK4*0Xf5)0c z5xw`=7|-i2pUXEBHqjcfsgI4(;mIM2agylyPl#e|hhdzqdKY`e< zlTCU%4I+Q*BL5Shwezdxi<9bF0UcL7yh%vluNbQ`u!hSv%B_xB=NXr~)9*}Mub0|x zT`eMY8!;Xd=WQSDp%I?JRh3Kq?_%`|fY{9#Qap0^>Um=b3*s_?N$9Sbjg}L1+Qnjl z)CCL4l^vsV#ybQ4xbf>gES z9hF-}cXxME+iWewVK`Kxm`jz>gu6>f zcd50lo*>;F+ETfDh8_u>FO=LvbVA^Uwq6jyb(>)?CPYbuBYzBcjlG7lSWOI9oIdr& zr1fR*`B+YQhipt@dx)rD@@x;>A4RkBvKX`D`%h$;{$5U3D5otum}Vq#@INh=@x z1ub8zNoWQBv~5v=?r}+QnD}3wxhvz=geSt1mtQ%Igf5fAAeVmCx+OT|Ec7 zp!0>JRcy?}(tha5h!NZ@Na7xR7*(}!Tly>8jcd|3LW+pk;~h4P$quq6RBTcndjd5i zfez49*vwRoBrvxzPo7QCDPm~{?WNf2rdk|4>nALbpQ#z70Bu7*#%?%64 zUJGzZyiAt>b0n>)+8HVFRrItb$igJ;^~IY)1Q8#&JN%q?2cvtkT!-LI1Chq; z-R9ihX)8#7C9F77lSHe5cXJsvwas>dX&q94SG9`L4s@!aZU7Xy%Y$>A3nxiLH^4eT z?T}5o;_H5nociWSX=^yY_IGw~gc{f=BWZ|R^Th>C`kGo*n34cnbeF3CfFs)O^H|j! z`iv9gg6*M8t}fX6J6yNdAF0$v#yKbQk}LRg6GB1gJ7sQ}f4dQ!tq`2S{np6slp!nx zULwBw#By89Uso^PtRiR27+VN)CI!u8r< z7k2)7unYUb9PGm1oZtq#a1)?|T{zfL07EI%_I_rtE1_yPWIuAD|I-VoUJ@nX<}30*m`dT$6nUV5@@qE}JnjXQDwCnx zXMXFtU&=hVx8_lD0N4swB|l_urdmiIvI(Q`PuN}Wulwb>q4m|Ovd1xvB26bI?QN~8 zl_r-<8*_u8U+3sUsfntW4}C3t#y-XCEO>Mc)r#OKRAl>mRws-3K3*kHIV*7#)f zPPr@*;*g_NYD13JT5a&fuh#}&eCMwRUwmJfgD?I!C%C~EzX{O67eDyo2VeZ)i*Ij( zFaCG$iyv~d`n16=9PGm8HrR#z+F%zBc45~x*oA%CU>6Q{;b0dIcHug0unV*H&ubTM z(D{1ZuCr9*YKXsg9#5|+_WmT{;g-spB|O|hRWo}t4j)H6z{-}R*Pv~#nQXg9G2b-u z_uw8!Q%Om)TgYuOHSrQ2K9$cpOub`tEn62Y8aq3-ZQHhO+qP}nwr$(C?PSN;JITvA z=ezITA626US8Fxfs#bH(K67dw&+h59Pju;O%6WOXVZ0721;Z z1L>al6$?`r7(Qm6hP;Y@NCCfWgGO5k!qgMzK7qvtHy}XxAy(T_43gUIg-sDvZ);z{nHi%0QUjcSJq`Ns&|1| zxOzb8*+P;{(DE+5OeZrb3MeaJeRfjDfq~BKlKx+e`n;ZD3{1 zZd*!z1=HF}>7FlPEC#4^pFvKHr0EjPT>*6K+YDz6^f(`?VTskQ%B`0jq)uB{tUtX_tpg z#Em|kwcH-TRklvy`HQ-h9kt8@h!M#QJa)6%n;{56_)x1LR!*?dNQi`1`w`RTE=Vy8 zB#pl@2B)!C1-x~9M(X8Z$4)z<&@>+G?q`!&R$o zzN1(&-)*!V{ zZF`Q-dySd4=VPFNwq)U?b-qE;L?TJ#Q=d#rG1CONPTB2yiD(=hxeUKhu^LEwO!nO) zKxBqV0}sg?pSSkyrR7$(jXxLXvW(qq>AYV#`139JRwC_})ez+KlUc1USPS3h)l6Ev z^=0uOrj(z`9yXZV2wU46H0kp%WeRfPV-A*0fu2>cRMU|-hVt*^ucpH*1?G_|S@FKo zmk7UGW|7Y!moR_Lg7}*}iu#kS&6x@++fnG6m0r55+KJOE)LeX&aH{5h0FvZc_m z`%~eWM=WC}M0d+NWnfLgVpkq^&)0w(Dp9b-UYDQFt0wNZ1z~%t{ykHLY~4d0N~XZD zJhm?D1GApDB}w-OQA%qapR_pGrnPp&xsm1=qR5dlLjrUwTKU1kI0WKWRKJEtT^eu; z!q8(^OZ>Z1>T}bvC){vz6*b?M!=x&)mPJ`%ysaQ|Fm&aaRib3m6mw-1xrNZj@<#Z1 zbeY1rlXQ5qxx(>b39N{wSQ-T>ZxwDzb+M$exQrzrRk5Ts!8b=PX*0F_$#sKF!g+I^ zdpF$6`u9C)giIb`#YGY^bB(lVU~@5xKPxF?MshI=zHR()b1P~+LYc0fp-po0a$6LPArJ$cz%<2ZDu^Mg z4^d}|QI!&cSJ!*n&TKO9nptSoSv?K5it}btgX&cSL9P*_9;4s+8`^m5z^_vQ0_dlS}O$ z{#CVy&H6=o9g;dpms;N;>+)k3<+IA>0?sr$A(vWPoATL}7TA@JRhu8JWm7)K>c_Ai zdZ~>ifL`fT1M65m`x9?z_2VtzT>H;m_Yf)lRyzHJ=l}1>{P~5dOrX=u1+Q$Ib9h@MM4t!#_^Eng6@b(^+AwlL;nqk zY27w?Q6dZUh-tS~ShenWwL&qlFFmGqH*BCsCf`6*Ns=-0mL5sA{g;okmgkrXpiKk!0xx-7;Hou zA=@DxPlQ|&!@#iP7Vy85D{6l228yot@4k$q#D!}d$Zj<(#XHe=>34>`s8NK1bje@I zxAn@cpGq3^Kz1@p-i}tQShWgoE-JR-YShxFATmdEO3w0mc6r84n-a@^M=D-4lhkoO zH#2{q?|!e@0yX-%Per$MQBzY-SiPYupf2{S&C!oD+y5EovaLT(Oo)jw#4tfd>3?}h z7J5;MwXYdXz_am?xz{|FYS&DU0Wp-KNv+b-sEHRNXw_W4YYK>bPNd=2?~&BcECr-E+i%nN|0laA+PlI{{Oc0OS|$ zV_X!|V@N8pc1#pA2oMF&Ogq$^aO@*PmlTAee>x%|I#jBU_p>L-EKal?rq4o`wj6way*z+PnX-M8oJ06^HekmT< zS=`2#Rp46!hI14g<5r&r!MZ>7XL2#p30i<(Pzq!U9OTyg zYv;2pHJP;c$qB7({g7fdDEdpIz#85QW63V{#8T(tRA~}lJFKWcq2RFWLU~jLeiojV z)7o}u>P4levAj=RqXP_(@r}0ulq3X&Gn7HrI`y}%C*lKwN)+74sZX`CSgzA%@zlwW zWZq=SU;U+#pNB&B%Ui2QZtM z`r$aahsp1%3~^W~a={g7@{ZHYs*=D9?}`Ws+LK`KVF$zniTT8gMxk-nyHj$bs<77VUiiO@ zS^z*4D&|3;%rsN3_^aZDlgaklJu5|LYND~5HF&G0^#MIJ-0;}bECsa+YTK?* zSZuaE;VqYr4Gq4akr>YH;2aHyV*a3{V-bBG%5%g`5X|(|+4qaKuSC_J&l^bnvj1%T zU9_?QHCLWYfv{$*>aHm*j;#iIyKX&lm}H_DoD=EIDM3RGN0kwdhZUIY_NSs-q zFA(S@LkF3Ph$z3?MDDgc5o-~E2a$<5I4@qhluo&$0a~aeWM6nsO0N2TG4k(vZgg&7 zN68*{UpEK4aGPI;NFYdesBDXWnC~a{Yy6D}Q*w}ya(Io|UDwzT&jrG&@NoS$ARu?O z_8MF&R&cO`$ox^DKcgb5#V&lSzE!eDl7^|;OgmqIGCos_Fx{#P+a#1>^nNbUEJPK@ zFXsYFff;*ZCUxItM-YpKK(PchnrFT&xaaboZA zb$HC<01Rr+cSSaitY|a0Dgk-30suQVEX&>`1aCG+LHe?E^OX(Hek--LTD=S=i;}n< zrZ4pYr=DuRat=v0Fz!^B9R^A99TBdhZQbg>!Wur{$3}%A^3NUc-5=e6S1gGI)H|c( zq)=h%2H*Tx)?5%4R}PkrID{xVC!a|E%O0<{2kKfCEY(Lpt^5 zdrb}^HCrVHC6S}BH~N8PV?^=i{=X<_dv4sj{ot>C(MTjoUdqAg8~4{be4mR0dr4&8 zZ3dm362<$sO-ecWNnpk9=14Vfll`!tX7Q(;7#9pSKg-nKv2--zNHWI;JnH)L{qo-=-3dOHo=}C# zl!VcoBxEHi>kGqBQmIXN1(VYlaf|B@PN3Yun zjL!e3X)Yh{%{K=9kG&V`M8WqmZRmiDc_6UUz|wJX_cM(S>iSv+!2&eCf;+B4#jdiS zmz0fW#gVhfA?tJ!BZPm7?=lSizNb5Cp>Mpb4@)A_lt;i?p`P!KfT-g^bs?r41XoYz z+rhg`JwAggV*W8X1x$PTSAvs|zX!0J4rZ4)jRM21ZH&yg4thct2IrQI%ok}W$^QtZ17mQUqhXjER{Je^gPwyzE zQ+16*U|#$-@M%xALf=JEtLwPktD0t}C&tRMoM=vo&y(qH)lGB$ZH{Td@qJiEcBy|- z0#Inrf#Z+t+Rj0C`dL$D!{C0N&w>F7jAl<}a2lO3IOKy0PZWS+E0PT^>6Y48JLC}c z0m&!%9he|29wSbb*~-7%vCE<>f1a2l&Y6_7$G+mY;>~my-q9lU`H>)$D8_hX&M?4c zp(MixNPVeAk%LN$LHbFohdOpjS-`nm#(F2A|Mayz9te?@bWs5=AyJ`tZ(>$}q`rws+gl&kWTu4%k<7CT(MmGDT0_B|r`82O+5R zZ;AJC@%Gkk5X`ldpX^Fpqq)rJN=;`GI7W)XoX4h)vH2YV+el$yx~9vV%Mq9(M#u@7i1ro;f+OJ((g zxn-31J^dU9R5sljUA91+Ad6WT4tWUDaAq(o5Kxo{Jc_|C{S2f_hL90QOBtSNT{GO| z*xfBbK!5=U;iFneugRbeD}tehJ-o`QV$ab-@OOl22x!8hVdbgj`YHuVHoN9l69&mw ztP@Q|%Dy!&jX?Y`gMopN|B{tI(%smEN5KJrQ~rEnnI@1B1q(0J9~oA$qaOlCU%+;9 z>mnXu4fqoIcEoA(dCZwQ&2FGn%tkw>$5m@Cqo&aq<$O_jl8QokP~~`z73>P$=~hNv z5q+*)t+u^35UbrS52URe6V_W2wR2=JOrR!X(BWk|xp#J<^S^PkE{Ou;g#!7ZWfFrT zOA*T#h>hA#2KW(#o^tbAg`$W(rUB}trb?$gL2<1RmP|34u9w?`w&?t+slCw>K;8ln zwAK%DG~=(EU>mc(pXScQQ;FZw18B>=u`PKRF~e4MrR6sp6?et1w7z`PlnCrmr##7| z*&2o|Q`u)hE&4L}N)|;s$kz7QBx;7sF;j5_@F0VX?FH(=aN}lJW#fUCy_Ql;on%u> z=Cw5mB1bpdCykb0z+*ytIk_2xj$dJ`MsP3Zfc4E7XtW(XZjQ#Uf3kiM#9dw=ct058 zbx=^xAH&g5k>vP73#VJLl@SPl+TV}ADoVChU(av#6~vxa#-F*=bhBNCuZP??|%a$CXc+F`bkXpjNrj z1Y3eqoY`}u&Ga&auYqC(%@s2aKg?tTMDk)asBOQ}aLrP4(uWJXyc)Z$s))oj#CbWj z#!DoK(UtA{EL_q|SxJfYNB6j0PNgu^k3_E4>h&!7DJ2Rqf=8d!Rf}cb?XpU3B;e&b zrfL$az$?KG{!Wi%6x8)bDpmA;KrsWc%G#qR+QZ2-5Yy@98*;a=LqNNW3#Mx!ZMbs8 ztvRMvC33_UK@BFWr;;8gKcyDpx_PdzN*J+l^jIS~4;ck!KXOQ+mcvD#WT{kH$5Jf= znvqh-Sial%xf(>Oyzk{O_G(O3Y%LDhV|yVjWicofNE#C-1J5V^3aBFl%mnjX8GP< zw_VA9pY_ z>LyheZ)KB52qG?k%coe+V}Tw16-RoqN&PfbG-$5Pq1Y-4o$>W`it7KQy~qwAd4cHW zOgRR*xzwxUP}8*kKIxc9?QHM(n&tjGW#D6gX9myoAU=7-Kj`0d8tl+c!rab=o~N)N z??Z6spIb^D%hx@rLPXr*(n0piV?B=H=AYKp&u1>ihC-QKYLto<0UQAofQy zym1G%8DCcfn*`9?u+tX_D|8k!#)FOUe%{MJX5xYXw8KOQ)`;0fi{hc`{Zoq+=s1Fl z2Omij?fqXU8^>#~ei<^h;*Y|Ciy>vtO9&?uuhtBYc<;s43=D@}^QWH-CEO`(M)zLX z&COT+Oj6AB`@GcFifwDuYMZ*tCT_N}@WS((G)?C(Gv^N5S#oil|GbpSsLC?3`Ou~+ z2OK9YqP8FOVzl5Rds2%Va`7T+E-R2q#1G<7M<+>Qm%9U@VZp!fgPNVvhJ*3h_5|Uj>mw(?JHu-r_`=moKSRvSl!AHDI%zzr*yGy{ zm6^jeIIl0fG)o=q#yli|Xu!XfD>Xr_=Rm9yqQ53DUs{J}w1FdqR zDanoWAxkf>{A#Ow#{q0Z2L>(aBO1r$?XG^V-kU#No6@u+DmWH&xE^xkYyG>9Q16NQ>dvPj)1e_Rx(PUi%?K zunZGo{RvdeZVJfP5NlVzgCn8Mz|}dlbh~6iA9b^+Llyg9n5mAs&LpwI`Ob_;8<0os z^Lq1EJql*2m&0wDCF!EUU{4vRxH_}=y1=07)(eR>ZBBmAAC)o2haiwvzZ6*_%xn>E z8@->tjg3IY?W?G}@NkB!=ZUbayC=(`uw&-`+f?_9ql z2o;niVG3?XCtw`l&nc77FOO^I(SwF0WL zkW@o=0I9QwJ({x?*I)z~6rgc4k5oxfvckhF8f;VX$I-@2kE1O z2({Sk^#vkzYV0pF;rK~cOs_m}TdjZOY}P-A)#zE~^|x#)4_B{SN@i}9G*WbXmA-Vf zeK|gxtFaWdvDcVKviuppkIgi^l4-i}zpB-&8oiG}R8R1LHlx68?cnx#-SkPLlW(t= zOi|FjdCz0rnMgI#&}SEctIwge>W;Pl0YL!GN-Px~wf-3yJ8!J$6nL3z)3)-*`MuqV zPmrS&LWB#yjYwP90yjHzcK3Xyml-ApYaw0=n}`jY=pBE&@}lM8ru^ES6YKNSfA9SE z*F^4@@8?a%7ZlG9j~*lT5`d3CXYLnb(k}@?2*8q^{)zjY9|)>kk4MTs5L6_|DHGK^Yl~Gk;X};Ua?~kX!pa^$~?!Ydx$9#&^5SfFNR1vv} z6WE{5&i3~1h_ZS)+1Ovt8{dEW{P;_Mo1^jG2%4WPcJ6Rk=b1MZKdwrqYfv?+^*sFp zK`p3eHgyF|(W$6~*44O(=&*-M_K;_~yM5A^ve0y!8L?>$)iCe#6-xCi+uae+Ozoj` z3bfT;_@x!m1T8HvzXTw~SSpQ3T2XpyMs|LC`^T-!>~1#h?si^@N+a)PV~lMt4|jKm zC2eLR)9?HI?PMosSLJKs{$OE82fWQhj+BV)VpI+={So?)fCS$7XIFjEn`)@2Zj?4e(iug*a;@=HM%iW&O5OOyr z0#9P|&?0m0k%69w$-x?sYd{`-g4cNMeOoR{H94Faa}YG8OPBWg>uJ4KMQZor*EJBn zNyymyxoiOsOpM()GwtXz@9zWqz10;$LvA?>ac>slo=;FqNzH?W-`32_p_z?;5Uf({E7YUT;Hi0z43nT#i zFs+>0N+f&W9hL!8j(Vz?N1MqrH?n9oc(CUfAXrErb6m+a9$Di&M@)>aD?^}e8}>ZX(om!x3&-~&U#g+0NDCc*Vc!etd+E9gd44MquyT+y0# zXQDUN+t~B_Q2xwmAr)yqPPp-s23xN?3>?nbK=LWrvs@6)0Yuo5o(v5rgj;-PPA91G z%5S^2(JW6-=knD>pScaw6E8&6b5hU8%LzJc|9ZJ^a4h_YzH7Cu+4Msix~p=!a@_LN z_Akrp-xsdZQYniEHL+@D+@=p7O|4k$8o}S26+6oDC70kx&bMiTS4*}#7ctxWDZKPy zjnlu6sjT|yh4b-IH#Yo7qIqpiS!-C{q#f#|sCCt|+wT=S^%v;mD_G)KPz$P;~y%H8&)GoIO@A(6HOqH=q6IGO2 zrNYnYbttDcx=pHUCHbOES6{06gNp=pdpRzd(kkWr-FTSAlIfnwxPp{aP0lX%2qaT? z6!O9B96Ei86`DKE{wgFj)oIhnexH4RmP~c0Vbe^)>gK11g~IHmi^45$H}+yUn=7xx z@9XE?NW5@YYM|oKZov~8%rG7uKPal@C&EA1G+@sOIX%C) zj?8h3CVvBZX%a)T{Gg+Ji<;@;#IoZd^~)jnWFBW#H{@7U1e4?aD!yg$21AY3wQr}f z#vN^Sk*ZJbxS~&sf%;s@4b9t$;sw*%Vh=td!SN3g=4owVe$R3Y&BztaadYorBcI)n#ud_%1eb)5e7X1x zrqPPcq+#s^Tdx&oa{>Fl_@(*||NJ5Cp^x4`cvs$+m3_Fvg9HYhNL^oBZpm60ZAi{y z#!WSbX;4p+EDR0p(a%r-Sgv$~sNDFzQUZ54mfD+7+t4RL72k_pyr)6`usPMwtC=L-y+#A3(MdSKK|k8{|njwC{46P_S6uZ1}j5Q8@e%TS1}j>-)-J zZrvL-SJmY{k{yH-c^eNhy&f+u(c()a7%16?YiBMPLh~)FJ0wY*n18hqR?sO zwx5CZqwqb%oW#;okUBeNq+!@8j3A z7Yrj%-MdPnCyPG(65^nbe=STTiV;&>91pq_lZz(>(_`TL`SsSJm;oTq_&`lTv%|29 zWk@e*lBs*qcT5T2cin2*WJe1^JT=IS*+@#zM`c_X-O!u0k&aqbcslyNpIYR2wbu`a zMaZ9jHRVvFMj}yE2)U@Im%oq`@Zk2)2Y9>?W7S`h>-({0$CvoSgf<^_qIhp9ji*tb zTidVSP=BPMKB*Jq5@p75C|8!SrzGW-?!G)LEcEDL6cxsT^nAGwb>OPHdJ+rQz%_ z#C30fm}ci@#uA-LHsWP1lFH?c(Xu0{qbK<4~lhsSi!Mn z%9~!^k!NRK%4?(3x;?9}irl65@IH!#Q;hoOm02;pXa-6LD#mQPRY%P|Sy)Qt=8{`* z(miXW*DgW#Xt%DuzF!mVbHMaj#N`FifWV!9fS{Smxp}w{Xkp1_yI$tb83g^j5DJT~ zf)V7U(3=GrshE&0Iz+}Tad-y7vIU-Wp1~Dl9+@U1g)F11^SDzQZ#qMQHeDI)fD%j; zGYd-e^|*a`i%-bX_9%lg6W&H%%4gcZl1GD`9As1ZRK2hBiT7zim2wuRI%dK!;dEMM zC?D=-j`175U+O3vNZWLiJ--2P{KJs!cACghCOI*;`olS(q!r%NfV`)#>>kFDMXM;lvAjVczA6dPWYS(^%>$Kdi zntkMXeU^J*4r5Rvu*}k|_)}tM7Q?K7Kq%8fOK|gduW>k;Ddud$S0nbWwvGixF1i`j z?<3xg-sLLwXER?E-@~2CE@YipNQo7dC07f+-Rjzh7UiAy-R!SBnWtryd?XjNYX`c( zCfNva`PL|Hc*|IYwR*&~0fR(h2f>d3OU^53YfH(~+1%KS8ohu}@>qL%DH$OMvC3bo z$L-ANMlVUmV)E7Aa~GG!VBpee7;NHH)}5W_e%P%w)udfKRUXaH5Y&QA=@vcE1#xxw za)0VjpXWC$@Sf2%y_bi?c)*rt#dt=M@t*w;i*R`_8LHpP!{R*O%Ez1|crOqBH3_80 zc_vSiAw8#SBgCj@fEGWR#k5S$vlMxO$#cNZHV_knrq7snybpo50e~`2b3xv^C3*UA zXyx>HbEpDadpPz#v@90p^<*+bN8{oW7)@SkpVaFX>8>%^4_76fe!Z2f1z-6fO7}7_ z-~hNAUegzCQu6Pzm|){EL4Xq?q=GV&@x-6>4`sd|o)@ugI0VBxnEvjwgpJd%vf<&_ zI{-w6r>3rnxy@o28iuQUB~MzlkMIZ&&ru>GwoEOhUrAeMNFMx@rF&wBY;Urd-Z#ou zSN$#rOoH4lk->#XqKNfu2v39lfyg#Di80YDQHaKVG|wA*w4qz%qzvkXW~~~dic)$f z#f>{cDXzf921V}(CIid^@9D-3q!v|>T61{CizZ}h?Q6(x{*KBqE?7kp)(mgu^Sikt)f_(%WX-v1ewe@seIbHJ^VZ)ZRIb5Biio-nlk zjux=xSrM*LWSl4ey#n0N7_0s}#@@?Dox*s}zyC3%<4=q6NS-7`cuLofCsRh_Evukt zvZ{}sm&SQBoE}s!Z!^G|8J)7WVLz%215?kacw7QE-_Z=d1FfxB0%{iGu@hyQsZn_G zn*d?`<&R*1%Zow-_F(6+YBz&@tv<+Q*=`Eu1GRd?9s0#kn)>3(D8|M6Zm(!-r!v}q zM}>VzL}nT5@)zj{zAt2J*1(}kVXViNxem2x>q$NM6aW*lF7lH@()soa-RDeRIx$6+ z2-}7N>nv48tUvZK-GV8lsB2xO3E=hd3~LnUdtv0FmeJ_dJR&ygTgm7;6eh+6>{NP( zvf~_&LZXx-=5GM8hG@S|4m%Aea4H81d4C{GcVLy~>EytShbKS^crmrN=eRKb^~2+1 z@w;Wx(^3%Ei4mh@l`Lvy+=TQ`d(wJ^?a2)MR3%od$KW-)8@XjRv^*`-5X8Ka0Hi!@ zwtnf;n|3@9GgURf3@8o%NdzxWutC&4?wKZAd9Yf#M6nhlSQCBHI!8R5`R({?HUxxn zE;|#g2}o}fs0u#!-gO3^dO+lUWCk&2Oc5X|(}Xj9jE1YF4yAld#xZ4$7QeN3WRwMM zH7F%r$;M*GI6Bzl0oy#10sDNCKHSg2@iRY!n^!X6oL73O8FHN_cC-zK@cbCabji0( z0k$~+db}wC;G~Za=x~0j?gwUOdjpt(n8P3Al*5AZof@Rvl z(IxNy1+0i+F*z>1-X1-H-X?uq?Av&b zWRN(?6yeg)oW((;npkvpn|PX&IrA`*4&B(Kxc|0T5e+IJaz}8Gkv{n7_#bYMntl}B;c zG$a2iwav{ml{<2BgF55Gob;UZ)*jv~F-0^Q3OTXXBx&Jl1HZ&1x(U~C2Ixot0fPj! zbrvdf;nES&0*gifw@_;-=@K+yR^Fjja0c&TH76izxJAxnZ0ikYlE7dCe0jAzo1)bd z>au$+Q>mn?73vSBHrq6AI^U=4W4a2X^F*oe!}srTMX%I8>D*JzlyK?YL_eq8s}61M z?bebHAHxn?_|i-4$tP~p7q*f+&)q9T0)~=1@Q=)(H<-_R1$puj)NjOF6klZL(&U`H z1+7vjt8YD3pIq*dboAjZC{{0+wO3d1&tWZXb(UGRpA}&8+JZ^u6%z8}IDf_Z4JRB* zj$;$Vt7a=*oJxdNY%YZCU8XR|@^Tcg4h+Ke!LNSG&Vxob$`J#Wq->uaC41N2YhQbf z#L+b=t2KN3n}y4BQv-{n`EWlV=_QW?`Y&A3v8fpEsqz+kgiD z#f-l*KuTQepjH1lsywgesWJWsnT#GE)mt|dcU~BLB>-n0TN{Ivu90tII|kQW)38Ts z`)&!$Q7$-NvP~zdH&4<$8G!D$)%?s%_`y_AH4C>VY5_*SXEwM7ZJ+LGC&%&ZuaK|h zi&N7ezO(!}408{#4%D2xh%@f{?IeUbkJARo5vDj7v^j278YV!mGw|nGX1F|%=|9N) zyJbN4s({^f3%)r~Sqmn1DYG_sIs&c3} zc@XAYQuLN!GVB_|&iXdM<*dM?v12L804+=u~#=VSmyv%tbR<$z@eFQqO+bU@u%{7TcrIeC@rbpqh7g1L0e zV`|ZO?63;ik{sTW$>_0H98utt)b!Y1vxmJW793HJOS4F5UWbQ%u!o1G8g?5|V&lx- zV>H(zL|iL`l34%fE#70WKRU5yuhE?D^+ptrmqV@li{YFucf0$`;f00Tzt%D2e}x$8 ze*$Grw>rv13~Puf=@x7U6A;YQS>%TJ6vw^xH1-IvM8e{}_l z&FE?=a(mdR{%_W{BDa@=QOWG*PqooQk7%C%d2W8P`4*%sDdFav;Gn%?58+#|Lv z&KsK#h%<^o$dzgM;l$xgz-G`H-|e7U7WM#ejE!kf1*?4BnI9emzAerM!BTBO? z>;>Ef5AFyC1ibse7knp^?n-SVv^IXU!YaPsw%7~>pc1&|{Ify+WzxI?PSfCE(xBB> z56LyD+=QODF!JaXDPEy)JurodHG^4Dub4wps<+l&->)acQAr z9>Jf5oMNQRu@E0}XegSAH>n^GaO5aP)oNxho#LZ@o8O-X;hPxHkn=5gmf*;tH#Fh= z$sx@4`jF?B16y6SF_`Scsl02HP$62J_t;#dt)D8@3wh;rVde{vQ*F zI)F5GFIfi<8sWV5KG^#7cJJm>_8`c`^su{tzlpH^-q*vzC(wLT^DCyq1&v@j4a|gj zIZi895E)Rx>uQ)rt!?she!u>4z#sI-V@VJ4DSs3SJiVRDp}S56Ac0{dw+@RuT6P;`Y}sR#e!e z#^!Bl?2;YBM0wz)QgB5@_aGA9xp!eKh>vuiWgEhwSN3+_(*&qQzFc9@!jIw2sOd(` zvfUMKjUql=h4QsALIFUVK?4t_ z#vmk|AQH?fK-sE*G->?GNKns++#xftsNyhSNQzWq&fa;l$?J{E0%%&d?x(3aF`89| zG06fc(wg}@f^7|YzR{dF@(tYEc(AtA!QUy#QVNzbz0tJY1%VrU>nZdr&siD<*}W$ z&aqu6P(pY4DrfKzXp!~3pkXtr)d|VA)+uAsAlMNUTCEG!!b)BDQ^maoj zIJBp)X!{AmIelgGZH}BN(etiQ3t~adgHjN8m#YSG4a{P zHw{IP=-#C7&%;bSOI-=_OL6gxx+$8%$Z51+PuFjZ9vki>M{jur9tMLD6I0{AC?>^6 z^x3a=*w;{(7w`yJYgz_kZ4mosf!MHcf?!GY(qqM-x08;Cq&s_KE3g9io18_;R0!N) z6wt%1Fb7GPwoZ7Hbat*6^FqoJN@~}l`a`AIwN755IANCqb-kc-9Uqx;b#pFR_q7yV zufG4>Bl|za8Hzqld-1Ebxu=@<$R=)h+lc+jcCJ+A;|emu4#-vy2zZC#)xf^xFz#W> zIs~E*gpY^TnqDv}J9W6L> zOIZF8twqQucQ~>kbuj@`Sel2AV(XQDdzbKG2W%X!xrP}dd{^#y?tYp2kd($$+ z@%vB^$b_|GZ66K7yJ{)_DLo39(-Drw3a$AQWqe9uNyPaX=dp((qUafo7Ov%_ zOFFc(^IU8rX(VFeFf0X(L2~#HG0=9 z&wjm=Ln18~hQPx@CS`spW6cG)Zo?vq`=GRIX9~dZpNrr^(N&5htAGp^Vg&~BK;G5_ z+C(X#gzjESrsEQr`{qt=_QDsx#Op+TUC#^KbSn05TS_LUVKe_Jhi#yL_WS8ylemOI zVtIFp)%^T2@f=#j(;3{Xu=19I&RP*zZS9@Xi8uEWa;v7SxvtC{(@gyqgbeakM=ljC zaiKM_enu-UuoeT`mrDKIwenf2vk21bI$E<`TeQ*aK(nh|<=iiK>hrW+JzdTs6`174;i5l%sP;#L7^+qg?<4e+^c#9%!YAQ0lnL4mhjWKBMY6 ziwpULE-ue7ezpO|s>-D9Y~4gG$EvT@2ai3n!et5ljC@|5TUDM@Cer#kb9j`%Cj-V2 zuOEw!9AbRLLwuuxu0fsEfQvzFQa2juH+L_SgCQS%HqzK)i=v`_1(UMj1W4hMsxfCO z+uVUZIV_gGH1(@%k}&S^ijlR)uKLAk5!Lt1c$$(trP^+N4`%fImSw#dy6RFyhwk^19~AE=%XZWTdg6A!_`h%V&-v z+*>(uMmZ;BKsmIa5|Dz$xAo0nExDW>TkbP|QtJLP$Dj3>_t5f`D_Wa7AxtKCnQ1)n z2mXnp3nIB&imjSu7;OtJf$Tws)TO zwl59lVHi&}daNYfQ~_IHTjpP^V#r1cR=ypU1C!H3xe3RwmPz)a{?99e4~Vv?lU^8- zCVnkOS;p_qkX=qn8HS5Yb?1?;W+7z> zduq(qP%Z(t>t6_{f}Yc(`EX<3F?Sc=f%{6&;}-|*id!F&EZ4?7?Fya&ZfsN4W=r+f zmqgg1kO+eZ#SflEyahE{hTyPZ)No~{yF+z_ zoaHyjNHu>S#dWw3ci3R|FcD%C=gW&{4Aa33aj62t;ap-6lpvEd%37p)aq{a zlsAtlLM~INYc-7?P#MIg4*%w%wP?7pvD&KNxW!^Gy`~9RCjgtno1McvlNIZ0c~zvM zQU%j8WrFQCWLR74NcqAl5hAPxnPwW*6Iri(YOJuf+PZqNSGLk(Gb>u+f_C;{P^0m9 z3$DJv5gq-jsZGWoJaPVp!ORaL%Shg)xzj?2kZ^(3PpUja>WAt>&P-{h=Z|FF%q@@fkcCdVj*cdeLyJ=hafqxky zHg)#pSgG{&&K5yzN(3XH`wO}G6((S9*{ohJ2bX^V-Hyrdu#!!M4+)UoL}2Lm7;%_4 zS&4ZxUuu1JFK_BWN0?~N(~BrG{@pk*Em9UwL>F)2V#E&z$uX4!+*f`8PW}1BwKD#x zxuOMod1XVPk?Z};)-`q}eM%%tn0jy6OoBH4NG-?jQcFw2#7>0D4-V>_41x3vx=Z%3 zV^7MK+X$OW&Ot%lBpj6-vB5TQX{!~9du6?69Ij``zwtY^xAa*pONg}?N?*AtC0nNC z$IY)P!JQdDJ>NV~FX=box~MV@-P!C!6}5un&X4o_%9+ZB6e+(xZa)@X#V61C6b~s6 z=l3QS0WN{2;bVn)F5i*WA*l?B@@4vruj2F5hOEB;P0kj(tr*q;WMq#y&Vb z(_ebO+?#^SuYk$`TcU-5Pdu?EHYT=h z+qP{xnb@{7ani}ewr$(a#7@4x_rABj_eXbi)#^H{*E+pUch%Xyz0su`o?*m;XfkyM z2Hh|8s_zD)USCmC@y{yjg~-oPA9&uWT|l>OUn^hE(&-XoHpmAlMj6RiH^K5I=gIl> z1DLF>{H;whFLzR~Ml<;-A{JZZ>rb`)aZ8UvoNUz$ka&g1)-hfaTk9{#(@oY+8T}bf zbN;f+DVS*%UO!^d@xvk%8QQp9xbsl4uQq1*mON9A26x972Xump|)6ogr$ zp_YlH1$4PQB|oW*vtHEzbt@=+%jFMNt@me=#Dn~3pCCE>QM2in4=$je@eW!#Da}hh z{&6_vvCl!*t@`|fbYmmy?|a(`hBkp*l%{@CxPjo(P7-^!sm$5pk%rgww<|5ZMPdH@ zDQ^_KB_n_A3rD5XqQ0!ZB99fHiH}VKZ7kr^3p62r#_+3BFB4 zEqUPs>OCKpzwX|@0E>~&HD6qTi$1q|_U9X*3)^AcJe8UYB*9s_EaV?#Z`p^_o-tEg z{O086*s(g;Z=g1j=4dHyihd&YMj2>(WgxZ+)34-XW}X|UmG-?WGi_kJMuxH8q1G;^ z;eXvIu^1bM9c9urY)4YbMYtiws1Q)-lIt;y4SMD;jMu>0!zmoh@&7W0 z)#Ue~7@Q%tzjEUvjLkf#W90chuKEW&fa#G!q()xb(J!@L@w5Lbc;i|)7I24_-(Nmt zwI?$Xv_I^K4~Kc7dy+Oaz(~%_7}gS0f=o7lY?f+=&{6Fzpj1&7X>(-n=w{1AbD?~_ zDK#Gfl_+b}_mEk6Sv-8o+XVM^aIi5S1Gz#?~uPiAs-(UJoWib2K% z{H7XZ2k<+V;<(5*k+qUvPzZuOc#?Z7XY@;Qv|8l{%sI=WFsn9<=X`A(rR)0S@&5q_ zC&ywM{9es`>Fh109BfqJrNnO>E*c!s)O#)Qec}!3qRL@8Z*c&61KVht9|x%H8AAf< zp%N*?xpuh4{2dZS&0eYH+X-iHeqvJn#3NJu0Ig&;<+OZ+S;GE)9xK%@4f*aMft50> ze5l>qYMC28AI}qiqB64yL*AP!g)+iIRLW68UB)p_{ebj21V376WS@LNsKFfrEc==; z8rN@q#3CRnsoUMzI*D4EVi6US3p|laHx)$`>nNyG&U`IV`9U{O6{Unqzq7znh@-A0 zyTmXIr~~Q=!o={HTmlhE+Z1rll-;>omZ=wuH}Ue=9U~D_i`>oZtMLlhMZUG@pAwr> za~CV|rgGDAEk|23>Zavz^-7(7T}9D%m930Ur<7r|w%}|FV2fH91;+swWO1{CE%7ji z9~mStz!jr)-vq)EmbKUTLZ!nw0GVWFssmw|6w{L?cyWf;GM}_-BdD>n3I`s~=96~+ zw%P3#d({?$&qhf&ON4Kz$FZCI#cBnf52Ef4iB|z`nbYrgA+mt&RAj}NT}ocF%^1-c zVitg~t?uFGQR%p)Djc5dc%|xrJ&WW3XNp7#m5sO)w9>Ue1x$OMcagm|(_V>lVj3Rr z7)4AR6$v)Op(!f1_7^Tfa0tAQ$rSM~+SZ=(@8c1YxDqZ0!59Jefv zU_D8FOj^YM6tZRA)RaN3-MiOc?1JfBh=-VJTn~Vb_7nA>mQ+fQF<4WSbOi4-AQ=I3 zCi;%75o-_kxJwi ziK||rKP*njHEoIy9(lqmcpahh{XP|9lyNBv<-!_pEg0k+UhTY4HXolP#A=|G`C^J` zn5-v(l8dRfpp~#qm1mIq@T!O-F81>)LCB-g8`oODG6X~?yFG59X|NiK*P(T*ZnHzg zav~$6$}IiPt5%K1g)()_JM{>+V2R>y3Z5_F#NzlOQJT6fl2rsSY>Cr2pZn>+1OGDl zuGaoLSn4a^SI}a?cD8#HAK^*)N9=f$2+nt6PUN%Bx|WU#q8S-V&Zc*+RE2R09iQMosUrrvfn{6938((x9~`!Gxj~SBgyQp zY;N2l&V9N_Asq}a3@kx%{PM%CDYL85_w;q53>E%ib^y;y0Q;vBdScuXblpT0Bjoxz zt=5C&W+o3zbL;8EVO`8};f1vZJu7iBA#i!RV>B1vP@CQ6o|S1^Lb&B14MM#}4U>NY zN*REavHkfN5A(9V9VFVL#)u${LI;9&cX)i#e*P3gOiPHgX9h3t+0y_e^HsrUdWl*2 z&bEHvbC^}q9UV$O>^4I8nC|917**MKcg2JBZjjH?V5GVDh#_y9Ew$T{uv|u!bwgv5 zv;Vt#FVAHanNmT5`1M;!VrvIDl@XZ4&qRd7L@I4==B6wJlg`#wQ6z*gX6`XmZ*bil zm|N_evTi+Ry2YUn{=6KDP9G;v=a0tE!>{Z`bJ=R)i4hXYWnp0_`l%T10uozB_$${q zd&{{1(aGVc$z8c|49F5=@b!S-h-NErrIltc*G9T5?GcqoYOf<=ekzyrd<)e*V4u&q zwK*HzVvX#*4SDUAb2n}TPOjI1dQ1=B*EpG`N

M{-7#xw%n-!lEH&5mv?aTLW7?dJt=990?WerJ>}*D->lx)i$=Gd%s=2pX zP;0hzyQd{Ueti=P8+SG>DX{dg4FmroVI_QaBh$|e=I`0Zer;B+z2TzbD8Dtmd0OO z`n-J}d2?(sQ?caz)UhV!K6(6*UDj)z>bq|xRT53){@E}LzuY*=TOfI8k!1SgyX>+e z*?q$EyJCr$)d&2ar-3d8@^%-Vg>>ORf||r5vNz8H8aEz(%DByZJ%~~akrTV5imUJU zL{+Z{)%X)*PxzZ_G6~RxQ^?9J?pF62vq!h^;R+&*w3<+tjMuSzA?+_E=3c!!UkP8mCs5lAJyVk?TVoGgd=l>0xiTOUIkZH zht2Qb=;Khm@toxn~n zcNKp1(fXt9Bo@d;I(V$NII}XfG;FL$M)wA>S=YT#GeCUb4UR^R!i^Hk1RE^fHwSEl z>`6X39;oP8=j{158koJ&1Ybkz9YF4`Cd0BIymH3@*YohW8n4{P-f|CQXiPVS4`3tN zrR>MDRJ5`ZJxR6uWP6{@nK<>G%-`2$z>W{IgPA8VfFVf?p`N8OD(>dPKZOeo%IKI; zyUxj&lIu$wbk}78Y!_6|Tg!fkEEnFRBC2=Y^Ap#UE&W&&m>;~N2nW0KraKTBz8o(u zSQjGqHm0+S&lxW-GH9XqngjqoT`sJ*Tm5TS)RWw(u^3ocP;Zt}ePuN?)8(6%3e$5E zUhU}X8<1uEmocf!E++)~Bl|dIZP4@%ucVWczC2r4BB6Vd-iu zcC(?{>2PKRoK)6LB-uzm5^M=n)0hNFUyqLJ;sdknm8SQpSy+G8>sn3@!KdT(SknV)Xsa)(O%axFPHSB?Iv14vzqXz;NueenJ8w59m#rEK zMnCj$8PdJ!NTI*_uq@kHd>bs<$-3k`u&3#Cf8#V`zS+cpiS&0O^*?F*rqH%Ti0_=b zzR6o&U;ZI1=KGI~^!`Ui%7z{r$*GN3O%Kt;%n|MoP8x?Z-1VKiqQVPu04r{5Ugt~- zxnoT@ZJ#jk@5;NT&d!~@U)JsqyjQHd55(Vp(vxowQ#kAadqhSO|Mjxi@u4tL^mu@YpqFvmXVawq1$Pa zc9i!>XNlDs7_4@?CZNhVe)UN?eno^Xx5twyddeX@6F9<)_~1zG4ZDuebjPR7_7~$u zqWUqN6pD%k+W2Yi76XUr$49PN>kw_x;2_@?aY&B3+#JV_;h9UgZo&DC@(=B+2x3P+4|6=ynX-XTd_HYTc@2r#5`}(9i=OK0aZ+jK z3aE`DPcn$lBiL~BnzgM7PD*+Tm*g*1;*l{^^kgEM4=#ZDCQlWsft}$cRkn3_J zNx5%j*Anje2C(-y6MrV`1?R&@*8wl_n%6V>`kg+Wk6at?R}bg)-JQ>0AO8MvEH@Se zytc{~!ge#%sYI)0g6=so>6(-k>a0L9lBQo2jm_*{ifdba;b{&Nw>EJtuMu?zoXxTbA)YR8GP=k02AaWo}lRma= zM~>Z;7tzLqGvP0A=wQ1Z*=bUu;Fmu%4#gS8AU;D)1>}kaKULDot8x3iI=ESRG)mO1 z6|<1W!b{TfBX89_-6DOE{UQW7p=B&;jVf6G3Y&IXuWYsK&%+)!Eh%PV_r7O50q)f* z9+9;$G2=07jif{&JNo4fdC_=B{IvViSt?|P#C;>aGK(Bb3FGi%(rS{_WZ3~r=Fg8` zzh+7JV4U}{7?~Q1?Tk)WsZK46&TTh3*{xAMSr!^Pj}lr*(Lde&K6(jJcAdz1rFgN` zvduJr``{OQC1bcVM-#&wg&>z*@C6!9zCK!Kye60{JH(WxF^EZU9hRIe?Q=puG$5;~ zDkw7fx@><@WjdFM{vjyAJUOKMV5NS`6P@;!FHpb94SM<^b(nVhF{PQt$Onbh6P3*NU?hHZUr>G}BqNblqEK5MGcG9rEaRYU(8i zuJZVNW!0Z(@dk4ZX1SKNzsYXDzPkiu#7Glm+my*TI0cXUY1dGVVkCXCKH;L#dyI}q zmvg%QPCiBKJP6{=!>B&1iK7%G^wZrS#JTREcL^L9moMkXRx0a5jYC^kR>A?xi+82|Ux zF+gzjf!|JjwSKyW?%|D#AyXT^Gfs$v_pqj`vo%E6!R<_c*Lc7&y*;(L<^LEDz~f*h zLgzLktFBa1HX{F>8&1zOOu++|4+jVgb7zH|2vtvt7LIr{_1n)^V`WYbV` zea*L!pP&$bMy4QX%q}*&-mU@H8Di{e^G|2^h?L`JsHE;}GE2UzIf_?DPwB9NfwWzz zJh(n>|5U7z6Y5vnBF2Cds~_C>aI*z4C`>JEMnwbKmA26%pinLti}n~&sxs?zg+#(m zl{BZ0XpLP}Uo~0ko6I4IanWvXCl&KrReV7^&I>pTeaiV)v9jx^xaGeP6zeWxL0LVb z<{wBR3KxNuR5P=E53L+u`M<8|b&om^EEMhjf)4Vqm^=@$c;z2?Jxt~c7gdCUL%rF^ z*BvWP)}1)4h9WiX0A|H)nZIo{9|tu+SccZb37Q4}U|V~o2KCB?51p4Z2u&R-8FB0m zu%cI>x3(!ry)JZWo~g>JJe|^Z3MZinyQ+PpB4wwV8yVFPt4gt(ZgKkacA08B*j}5e z_u@+||FIcqD45qKy^|&VXW2mdEmR^pc|C82!5t0ave?dsQqNv-DeN%_BL6w=Z|J?G z<4KTaIJyIQ_tqi$njMB6Tjtwv<3blmG5Dc~&^`(7`5j$yH5+A2Rn!8MZ_q?GqugRH z=~1NHdS!_)Y|vXscIYGoINlNV(i2*6?cJXmNPi^wxad=*`&;LIMJLl8sTrb_*{(=K zx*6)#iIF{~D|T>;m0mdQ``~w0_+IZaN84+6=HD0u}&*;F*0~Q10b-Sg<{vZy0-tQZwX77r@Q}{If0SC`L0Ks$6 zZNK=*1U3HF04W2JxuR+|FU|_mol;J+db*>Kr_kXIai5S+4^-VrWionn*uYUVaF?}b zoz_$ZfAK5IM~BcoTn-q^BPmIa0U!|-%mkKyKUs0_nNAr44@gWfm$W>Mz1c$gg-kVn zFZK0PJ@DDInKjGTnTSvmy<|3?75YV&2-P(DVRK@rK?9AIeF~}>H%0pk(r*O`1XNc) z*1D5Q5*tl6{__X6KQXY9l#_T5H)d>(7*UiQiDF zH{wF>-ju1~0B?mUl_+UElTI%}5t!hVP&g5Xe)RfUxvN3` zTrWW7MV1>X|AAS5pKl+>hDu7UKQuh@1$2A35>36c!MOj zJGHY{>rZ!-YUozeDeq5H9M74!EIz=%YFqIjbois;WG$a~urq{=-XKO6n^>uP^eZs& z{4`W=ZG6eJfAd{ewEPY&PQPlF)2MtME2R(DR_#Q|f@iD{TNwkXr1QK zH|iey$uA@XVyW!}k*$)xqCV|AY%drLLV<2U(NA==@Laq7P+PB3k{$sJ)fErP6rx&; z!^(nmLbO&x8k@ExQoC4%$`FRY*gqrzB^IMqJfj8CIcw$PLoID{n92-G=5m3d8l17&3<_eYlrn-3Tk5y#+PnpW6C97?XWWW&Y1 zxb=CY+(AZ%-g4^X%p3-76D@*ThVzS}U;DMTrmU-%nv+G<;s(f>gEHs3-+g@`JlFgi z%fhDQ-pYn&{zD!4Za~>l@>~W5bRK^d;|vGIdH;n0CDQl*m;m4qbf3>ckqTc%+3-Q6 z#lRR1VGh4_m1-yeYm+%(EYKnLCo*M^joA1k0bdIQMZDpbq(gVs!uj~>*~Q`bA8dp1 zB(T()6!eda#ow9+_kX`*DXSe*g*{+DwB-hp=;g3H4byj$>0Bon+{Q$le(OOs4#Qeh z1GxoI?mwpsav(+2(&TfV2GT&`FHK;G6LgNok_3k{|N2t3_L$JJJ|BHSK+F#?FtoIF z*^b5{^Hb;q7KIO$o)8wf$i^m8tY--+?;40L_;Ka#RWK~slOt;kNdPuj_bLvbF0(^t z3(SEoc=P3Mgv(rgVJu6k4UO=e1)F_ zuE_;@A$S1(^P?AB6Rs?);rQw=mdJ$-&}pZ+Q2h&1*v4GKIiZG!(=5$8&R2_Rkk_yG zejHhDsTtZh&jI)0cN*Le_{M$H=%9EJNp`L=PQ9bte8ghYz1iu@!J@ojj6A4&&z{`D zV-R0_2csKLfjlT&B_I5mfBL|uQtA7DhO)JM@M~53_|@@eit>CHj2-?%9SYn)*`e&S z00wj(K&Vsu?>Poio%x@y|6_N+4f)O#sq$nNjGaVFR1Dwq0TnZKy-Z^4z6Vi2-cfuM z>&bz`+}wJYUPFv;UiuQcg>A)Q6 zKh^C2|IFi^QltL~(=D8_v7tGMbM0m{EXm2ck_pmJe;0{>Q_;C&msrvk`N%WSE!*YDU6C^sD9;}Rq&~$fRm<-e~EiaFJQa$T;9{vU;L6V}DYn_6xj9FoN zMxUH3wSB0D+NQ$u;RW>fKvvRSU@g}RDjhEICJsvanO%^O+yF^Itvgg`TJ8s zIPK^sj^#GNpB;TN#G8qX=^+^dQ-MAL&f;CiA_Doh0~wB#B!6>g%RqNu%% zCrD>4aN%pyB};x;PSh!%D+O9jkg8j5f*S2B>&Q48(kggTPNq(Y4l$%7b_eEu?+?rc z_YTMf9}moh^Z9@(pe^_mKr<231I#WQzrS@5c)a=fW_XeN`(`)-)b@4T zcJG4Q5IEEx2jYO6Uf^gS^Dgu_^CDHVtq{4Blu(=0_EsdBM{gpzb7xe)knoTvPGg*YRKi= zku%>Snl}Et16MN-377rR|2Hrk6KcM}RIt^QnEWA0H1B(oO0Hy8RPp8n)}KUNUiUPX z>jj%s`XQb8oD|UEG&xh;@44yNoPSPgLPlPl;hcI>v1s};9#=SRP%J41w`5_V)9PLz z?a3c`VoD$i*hs-{Lrz*J!Qw{a%tOd~dY*y&GmYV@}mb66a3A* z%+@|XTgW91JIVxzR+ZS08)G4)l!hqQiKb{M5a1#tjSSZt@{x1!2_gWaFb7z5tgIP& zNUQHZwuvY1kL)sFwikkC>oO2je>$K`QBA@qJyiFi4 zxfjj#CTD2#P!^x|$>kq(LD@Y^>~+bQeB~jRJln3FZd|r=uihd~y9BeF+-a_#(jSh~ z`_4VP#lt7k`*1wE#Ycjne|>h4=U=0OCVj+SG!{ZS`QBvSdmB9n`Pm;x+sb;%u5Xva0H~=HwPuvpPFJwMJ2Z z28Ed2@HL^inNI_n9++5j!0jv( zIoK?}2Rc*CC!Xg5oB76_^Ne6V zkiW0`zwGS9;PmlLs&{AWzfXQ!+UFT@dU;@4o+NU2qqr}XV`s;C=Y;Z|5*TM5X*}_f z=Q)lz&W-k%Vvdug$n~sh_c;1vl>xoN&0pqT;`vN!uvPl)mJcnw8D>Y7HE-=5u0tDq zTdtpd@teDO&-j60JLk-0LxtH!3D%AqlNwcbcbmpwgIC?jvxvaDW{@JYMc*iK379pG zKqD4|8xP<&cv%i5Z7@vogEOd6R!=SV3>O3xGZd0rVG2usE{p4QF39sMY5p=<&v~+Q zqCB`;HB_728p@dfAZZ7y?cf_ACHv5#Kod}(-JH#!Fz91WrQ1r_7V8VQ4a(ra9gN2p|%+s=?4f3+N4acuwo3OKklRMKc-OuY;^yX8@U?)HbBYoKVV~z z5jgD$<8U=94Cq3#YwFGELxI?X*ZYQ^dg$NdLK6cWiR{hApeFF~zq3+-@4=z|pIPtp zy?Q*mRp3-NJ*~Ius>zYQ=&|J_rEUVU*@sj1ymS_H2|3L_k_#JPY<2KN6WDNo_N7Mho9JK$z5IaScD^9gxENMij5Nox{b z^P+ex#o?EhIDGX9J8qAf_9ymbarEH%{QR4XFi;;LTaU>L@OHfa%zj{*Wm7b+GVEkz8ObaxxV-ip==8mCYpDG?T{r3zTCTcXHJ)i!y!Ae_kUB zFHC7j1OPr1xbqoo>;=IKX?_QSNeieWZf&{RF7ya?YqU#y1O8U_5`)yk>;pnze;rMd zePAYxxsCUUfcx%1F36{zz*uFiAi zpQ72c8oaJU>wdAmAD`8qSWYzT?FniakPOZ;NctCTt18o!t7_>)3&k>bt?-f`{|KoGMedaAvOlJb)n-j<-j1`SmHjnBYVm9i|&oH$#P5@Mq$OG$whq(Gk5E# zeNJdHoDv`DmJLzy>H9;~@H3T&E;PCBIb!EH5UhUGv=5jDs$aHCYHVnvBFWH_4${Ph z`X)psNPFkC^)UUPTiGv;zq0YnXdbPG!NbfX0Qy=OpjyD_v92U0V~?>uQ}fVCHZlyb zQiF{x)F0%eghYlQf6_98W!^*Tr$Vev1>rBDjpmh5H%7=nHb^ZhXNgucZbMcr26|Wp z=>~r9?}yice52u3w~>Okn*JW*SyqB2!&EPOL_NDWNcJG(&dMpE1}lDG-pUt!Z8?%!uHjENW-80Pa_MEnN-rdw~jAEcu;?}1tTRlaPnOnOh< zQ0#o9ThMvaVC+=WdA{Z)pltn(Y9moDf7qJ?YlsVm$=V`encTDzGPF{dGmvcpP7H3K?zGhbs}P@PXHLk9Y(1li3Xx>8U@ zBBjItyAtkH0z5;Tsfx{lTowOT4)Lc0Oyf*KBF>HQF(k1z#;N>8bLLxRv!prfYvdNb zVlz(wIpvfqirzo3t|0;pHB|#sMsC zYy{gRE15m!dkn`Tf5@kQ%Ii;ap-(6}Nm^--v!bzRGTXSADzF*g3c>AwtAAIZ@%g5;OVGZC>x`uKdvzKk@G{cWXBx$h zSvkCIlEl`qr7X;?y>9+0@PMxD1#2fQZ#*fbv9255Bpu9WRe$gO5K)`z_GL$;ohTp! z;sFlgoWSf1yTEYiC(%VM{V49&dZ>mIETt8)wVAY^GwQ^$dtO|HGtb86o1n-0mnS7gFD87|x4^Zm>yg(1!<{H~<*{UFsp1hZ z3$Lz5ii%PnkPJA#PWI{%|2ZnMDEVDP7bz1ZTva3SXYU(@B2SuGnlxY8__pN9>>MPsqR^*Ebbzzxb+E1=e00cRlWmLa)whaJYIiVLYR3XtuedR~j zUPKHY{pHabK0Ql>_vq~AY5!_@qHo*byIuK5h>As&m}>3wfaQRD@}}!zo8wp8MqzTw zT$~tc)7ZiTucPWH*|{VU8pkT3gcgmlN=)b)t8HuC!;rnK5ii67-by>h|4&!4N#8L~R`6I3D8=JopYG!lpDwwvT|FM{M75;w0;Q z?PIBUa9{TiJ#q4dozK(9$1^cn;ZZRBMR_h+-9S_y!bDQec#ah`$6!h@PPynhT})_| z^|PO5jIZyk$k4}im^nj|vh*y))ArljE?yi9w) zq-Yr_xjaxvy;Y1?C>3NpTg$ou-Dd0_UW+tm%m(Sp@oDcP|AhgbS0OHkIGnP!q+Vf2 ze%>212iwuEX~vrsYN|}I%ODeugg~CMjPn3(yNSYW!C>IYv3S1S>Gk5|Ae}kiJXTir zUN^K)5P9lB2xo8U9SMh@@l)JPWK&Oo-}?hE$ETW_Ad)r#fyQl1Fdpz$ zC-=J-zb&_1?v=F(sw=ci%XI1XTX4{wT~n0*G)q#Ewn??HXkVxX7c-GZwKX+0%6;)w z18kkysH)pJmJzKdGu`=nBBu;ZT+%yjL3!eX?czA!gjaBXSrskHo}(Z~G`(mGP3lDU z#rSh&SzT?auQvv&YLSqC{W-D;k$e-%q1*~cOEGMC22=IT=j#IGLRoEEIvu6Ow4TQu zAdn^yR~3t6{D4a+8C=+1%IEW<#8|p)m(~BFH_J>(3HohMmLpkyhWU|S#rp6%aUtRzrsChWL#lV_CGO0}%q`I>TH+8D| zhTaOc2%>vm>W%v^MpF9X$E8l?>w_!4=!_ikZviOWwl~z6jTO6kwNf&X2Mh;(yR$!> znqs&JOqTK!-_G&I1+#Ry$BI<9&yI_iKD8uh=7T~h3ln#z)hsb-8o8-~zQfdP_lqOt zJ>Vz2!w)n}&P*39go@Y7lLTF#J2vhBG8tPVS^U&%EoXF$m0D}Lw(`t59}<-ZXF@J! zR|aPN1rUVM2VAR7xb=IN;E)b7ZYokqiRZ@v%W8Z|{Nu_l<71vcf;#I-JdJuczP=Bm zvDx}MmvuPzY`6AA1$JdJju!D={Cd3E^8(87G*olaMb+;acKFzVQb|%s#dCt&y83Gf zl2{+&QaYlz7u=fIq`CoEeF(z=nV8=C7neNg2buxqtD&ig20BD3b_d|8;+9T0Ae#|Ra z@`cU*G+%K|_%S_|FDM;>oaH$eouW-_rSl86UYVXWJIf?h6-|r5G~7ujUL>L$qAOSX zx>XJpybX(9p)oo56~40Vs46TxBT2Qh^#|)3-+4YHqQ3z7_U>7Et9H*kd%-k0;x*m1b}5A7iJb!%KN{W;3;ld;HXjKP?rwfi z=+>!Ln|6@tZe|^1bTw}rc>Q$WVdBfS4IeO{zAvRyB6`_fdoFc=<@PyT4V1t&f-W^@ zG}bvF(D(=h#sP3!lLEa{}M#4AW1XHtLs?uWNyUB@eEeLpWh zW*X@f*6xU#woT;&!(@9U>*1&C5?*~*GFVk3DN;*l?J$(J%|!NKi$A1;+~s{JlbHN`keogS4S^$0CW^Bbpg2Sc0xBQzEsfkH!9 zz1+$S6mVDz6%9`#p|Q=oa}h{7W(fZrJ4=vll8~`7Rzxe|5)2+%DG^2zOF_i2s+^i+ zcFj@U8-7*R(5~2n7?!N)$)m~#hbwaw!2v%C79j_*S?z#wQBE2tgX$D%+!hqc%zJ~l z3p`!)RBv9RTLGFYE7w+hncyrPW;>55to|R5M{LtFYI_iD<9z#QlU#bPKTNfa_DrXi zU5TU^>I{Bjh(x+L=PQ|ju#7IBfIgZyRP4`KV1&~B4HUt!+V?uMgJO3pZfj`Yzbg^B z>2>m$xX^E6X)UOD%wAN)|AE%#O#?Pvwr#NlM&ncp3Qxb8)x69mtj0)3ZwDA3t(F-) zi$;wFr*N($qY!paeLn|W9hGon=UF2mBD;rt*S<1>)4jxHxuT?6HhLx^-V^StC6--`oC4>B3&;STgE6K=IBOyQ{(rWunT-O@a*7lod zZw||@BKHhYHmIc&QQ4g!$nE8Fn#~pD3C8xPq(M<*H{c;FJf4(hPtcT3XTo-7Hj{tm z=BVs(klnsALECixA&0SbbbW1Socc+}aZ5)}6D}){YbxIETIx+DHAoe&0?pKA0%~>f z8PMZm`5oar-F9gotqX<9<(kXM7j*)W6NI{nIHBio#SQ%ah9qk`0h+Y|Z?NH;j9Vyr zMcX1=rk@=&dm$OL{4MBw@L@ja68^kD-_8NPoT)mg9b-%dbU{-S-0ySm(Cn?gprFykahileK4)5DCfd zn&Q!7-t#fBZ%HC&b`j?74eKj(Hf&ZS7il=CFuN^SERx(0wt)QL`xuy zE|oJ5ZLfwWvg!^dt-%@**Imx<*nV|Ju^>VWEJy<%+_F&Hya!mcO8jS00XuWwUov7) z+68t$0cc4G&HQ6x_(v(zT2bM%*C~lJ&prnD3$88CJlb_7Ej({QRoR{sUu~ ztg5|~*fN&)M&ledJKP*?NJ>CPP{9HN&6GKova)xpUfkK|DoMcGq17>|&uUrdHM_|!m7Tsq*_Nk4`#Xw9QB$ZH zwTyL;)J<{(+h$soH*`9tH2o>E+uhuW<$QRqhFubg$`9}29asnxUp47mqJy!WV6Xi;I%c(T=i?X~bw7Y~ zWT%O)vPtcF%p;KFbdXRea5r$eP74_zY1~{kl^4ja%pEOd3cg&u`g&W}AHzV$SCo#h zJCIhSG;ic=&TRIpMwPqVQ7CtGDhoY4&vG45u&bAeihC1IZ#X1E(OI*9D;oB7eVaHc z6RQ$Xp^!!CGx?ygscI;zXQSp&Obj`q%5#ErP`7{shi+h?p39bFUT=6r#bCe~3zg3~ zRkU|m$ik5g6^n|PHPK8QUgO6`wd%tN25Wg!B3)fUN$KFl@mpzi4y|0P;2c(^9&%}eY<8x&bEj%) z*sc5dVMjaf<9T1|1s>>LZ@)g+^>bSe`c+HOtEuFEk^VR*;S+K8**_dlqwjuycYb~X zz6$Z@|9ZdJ{`y$#{#su(|N0#4?)ECie{W7R*Z286tn?SAKYsR5mkb#g?e5HeuXft^ z`zcDx)+Ra)!O0VU5JX_qsGRe@+dZ{pt`E@5&3}N1y$KalQ6gTto`YwEb^l;ZIqIgr zs4LcPSbDOn0s-KOVl3MSzgi>yeMQ=6Q`6=|9T7UQ+NtO!j(#&3d6`B?B8YHoe&z?G zxeBBNyhRQl4Ij(KE4>&hIdQ|-{8M6t$)5edc z@+jmo#zTy66k~bCY)|SfRxmE+Tix@|H*=FL1B(n`Z9)NZjUwj4b?9fA85lOr=Co~O zh{-%hHbF^Y^+`Xu7|pfhKFzjA7I~Q&Cwa#`vzUwCD(S$VJG16i?_{m@T9*$~N?~V~ z3zWfH=`__n-(bXV@VlAp)dVlg;B3UpK5D~qD*Z9C(GWFEj+XSlrtiMm)l&EUKbE0! z_qaT7nq3b!Qn*8q)u!cBE@t+Qu@NE;iq-yF9-`uR@-J1|9$lCfW3wN!#Z`+97oh5z z@p&;l6(o7aW!-aHBoaj4_5J;Ukkf-rfxB+OGp%@flyujIvjW5Jex`325R_u<3eCUr ztKf*|cRSj5vs#U!FGMf^ti!X&=T`ceI|k@x`Jy9~Ubiz$45~%x6!zj0mXD+}JIw%! zM0g8=11&Q8Q7DcAK&1ll5Wx$}k5hLw6rtCm7fUmOHx0Jgo@O@C;M>UTJ2cb@ZBtZu zmmGo-qm|a$RB%lBOp?_-n0o*b5j9~ex8;+GBF;e7qk*jHJ2^fe<5*y_<_Jl)s7@HZ zcA*tvVZtT+NZr)|cx(I|VWy!f@k}st?4*MT)TUJ^u|o`vMU+YVmco`YLqKI7?}0;Q zL9~FXEyLN~bA+hqLVL8lu31Ey28MuJbaWG`fYip``$U<^rpclGs*VX1MZGYcIU`Bs^ zjwV_PDa9xb7zCZIo|0ve&k@U4=YFqBFsOmuSo26PX8K8vYa!^1&UG@UiCAse*4nbe7`4FQuH6eLfiO`YFndo5; z95%rOJ?nr6#aimXZ8B-|R1d#!-UP?z=FFYmpTvdO|Ka6z@zv%d!p`pixk zsnb_8BB&!lhn!S*58Nl?EJXGg@5sz!!&^d_-4nzgfn*HsC6jmuuY4#Aych^*Les7KxS}?T7(7g>D0p$Zx~oet~EJ*?%S|3}z623fML(V}JBwr!)!wr$(C-DTUhZQHilUG}TJ?>QH7U&Q^fM$Y_{ z5o<-{nwjI9W0F?}ZNL1eYBuqmm54auPC6C0$GQTs@*9|{90G@wuV|AloKj9@e5YiV zPbW{8*iF_MJ9V@x6i4i6Q>T5#_|efv#DYI^ox6+E=8TB_rLOps|G{MCT~_yml{-N{ zR$!z#Ikhq{u4;A$MSTp82i5$VEE}!4k@_XPMldMtR7_35fBTkuNp`7eDcZkp$e43~` z^0F=-|8Tzzpgi2|WNOO9yL zX7p0(3n$sq_YZmC_WVz$L%@O?;AkIA&3WULm2>Z^vRi{@-=S*Ut*T_SxI?q-fQV+Z z&P@yr>KM$K39eYbX0z>0cXetP{HfuM@s5qglAz^@%74x^A@UopBHBD4iWYrSW~n^<0c!o-uEmD6Z3R05_>m%bB@Q8NsE2cI*<=j zyJSSdBi{c96sYis|Ii1=o45ULRt(VtznCTF<2e}o2MS-x#JmaOUhcx-{{v_9vv_~@ z5%D|Rhr-0X-G{_xH9d#Kba;OfPD;Ru_^z1ouJ-%!{sRV4;9l-^VgD1r|LViTKi&NU zXG%Yi2K3anwZXnLxUoqr=6qjj*X#8y+Pv$EZW0*Eb>-*a1p5>s7U^CTE*6OrB^G&f zaTZVX81q*gF%G3%d5u_vM{(#MC{q5<;OFe`tb5TIKe{4_Z|bxo4hTsK$%j9@D!Wi0 zeD;|IqL@V>@x764r>NiOCNphvFxhyy-#xy9b?kRGD=f=J>rbw5HAZo0^j5WxmC78uxvXn~iJ3nutOhT(cAd!gl3WwwP zi6r10il)L6#TwR~e0$;USl4s%Sl`ackF&(wg@}mJM;%_P2TGM~8rk<>AALFqA&Dza zl5#Jeq>%*Df2V{3 zY=CF7Kt6i=jgi0k1u?ue<`7yc7)rQ`6@?N>07F7TM3wG~dpJWd7m@KF?M^Q(uwiqb z1Q)`_$LS9YTG|U(B`!4TdD`^aTo{5_qD+J4i9?MeXWKa~qnyoj)xv61F`q@KI<|yr zxMK6rEhEJMj%$`#nd;X061>QV*`DK z>41}4F{>N6e8(nleZyb9I?jh+hQDP^^>_?a$!@~QV1BV8cv5Yg8Ss7Be!-)+x-Xkm zJXh0$JA8<1o3jyamD?K%YGeWUa9KX)0JkaG zl*Nb*o+kx%`S=-?)X#C3H%y9Dpo7I0^(zaI5#L`4yxWc8@yq9sWkY_@&+7W@|Gm?z z;n(xiO}(*sd=MgonvprA=z6sWhQA=J>udX2{B2!1LwrqkT;-pEn9jVky;CQLs}w=k zO7RRs0`?cX;^GV!15Q%Sa66gfH)Sl;W^46bL&8@*win`qdF!iMX)bAg6a(J@al(6W zX{V3Ij9{A`3>=9-?90iA(DR3i3OKF~{=l0nroo#lLguX}ACv)LNkeZ1>} zO1=lIph;+qlQoZKN+!o1k!X%KOeV0uU%lp11uzptn1iK(G9;u|cc-3e=1{+*W6=kB z5ONAFv>XBG(Kvx&I#HLUp0Ppgfo_$5hENbJH%ujhd$D+;m$tYc;Ye0%>%uL?6Az*#3Hb_4DznOuf0* zll{J|)H>_{BGQ@=q`q_I?)14Y)yvVVdVgWxy|DB9Oy$p%^SfU@-=O!qw^VDnS*J>8u+~;am^gb!SB!5n*UdL>n zCk)Kv7z1;}28i1clqx-n`UE(g;$k(OUn=Eh;>_>QwG!zJ*Cx>@Bc93ds>In4Z|~Rz zk3|afy$DgKjCO{;>Pp_vN7)@ujSE9WS5Xu+=z@$zh80bLO7w&RMJ~BoV%ff;R@%UA zET?rhTu%`EQyMK$UoB;{EJ6V?&%uE8w{|ftc79*gjO=rnkJjl7+)QE^!*r%#tpM~) zsdb{H$))ELVZd)XH9?DOfV?o{jqt$PHKTjSkp<;)vjcU0jQ zl&O>-C`*0GXcBxfwtyo4-SOvLB`KS+3`ZE9pS}-u6Pr&#>lhEp4#IO z9S^m|+mk`as)c*!DY81Nib*b+$m3Rsvrs3e0Q88Aq1^dmL2P@`R|1H|-dq5qfrXBk zC>mIbaQgNs_gg3@vKcc=3;^buz`K)X63^62rts0uaw}C!Psr#7d}?QJfXD)@Qp_Y4 zp)BY{i6fs? zy@se{zn(W)R_>2tV&0NjZm5?AD6O?LxLTmdcR3IMqeWQK*G$)cdP?LqNy+!~zW?Zj z3Al2Ufyv~#*D&W9v<8Ia8Qwk^YP*%=`^PC8$^Eu}6qm7(4IclL^cJCOWEfPex~tvR z8dj;cS`fxp|DZ=n!Qgxii=R5)+B_gGGIO*dHCVO`AaoHw8G!3ee#G`qc}zR z%3Aqe+_!f#{TA_UM%1Ip*u)~qRgk zbxh`yUs;S#=pynFP&7$G661=>qzDkSX%^SGpNKPPTX*Hhz#7Ytgns2x228c>7~ED! zwYVA$PKIz;jU%y8i=6$Qzux?BjJvc;=m?^o(E3_@lOlZ zG4ul3&()}+ODh}^wVL6C|Kkgt*8Df+zm-ZM znpugVI)nHTEv$qR5iO{RY($Ex$wQi!uR}8YIaRcX5PwqxIg0$MnU13T_Xsg&A_a03 z>8~A^G)zRG_V4iD7}hX!z;@3^;)70MZ*&U8UDBMjxEH!@QoL0?p(t`+ZF~{$)Vq+; zLMoyjsX}jo4WggGkUz?(Ba1_B{h0`r#N{v0DOO#I_lEjQy>Rm_RM)C?Z}1F~01?fS6#ld4_jg zM?|6)d=&XxdphiYxlsw*Gw4OdYaX*>{*SCr-G4)cJTVE|EpfyD{=MlOjvVQfldVrjj+`QGmsl<_F(+Ov0xzwh*o`;S;c zYFGbUQj;jAK_d6OSLS_B7wvZBrE-IVcLekEIEX^MsVuAO091`Cf=->J2thMDdR|8i zv5mHcKmjL~J$wz*df7ykIgSj($6pXakacaTa!)u-??1YNHk;_1dHvAbVfVbv$jkbp zD%(kCD=X}Lq!j}~0>6=sz0~ue0|+a{3}Ip{gG0v7|9!*}AnB=G`=eVzS0SwzL2 zOPLGq&gZ{7umpC2_4x<&@*N++H@Vf(^BMe!)>q z{@pbe3l{LlwRE}Z_+us4#t$v9Xn7NOn$}=&oqmH^D^c0+Hk}Jj_#^_-BMZ`#|0}c` z;T=blY$lS_)grlb;KhT{^3+@fA#vr5LD~K;vN1&Z21m&3v{rAU-O8nn9V&-dI_8lG zNmqCvO58mYU6~zeCl=}1|5>oLawkf;U ziij6kInp%ES?OpL*7ox2bE@a83-wK|vqE6y{8W2QdqA|M0rG5VxO^KH&Q(%9;dwaQ zX}h@mq>qyod#HwPx*da)yzi6lCQCn>SOMZf76YtJ5HZLLcus6^QpTGaq2c z*{|PyW-8e-jyX_9S?Ycrg)QV2)mL$V{pWf0+;z&_7eYySfa;0WKYv+MbK-6m#(v;K z6ht8C2EfJoZ0vYlguXZ1)SPH;Z=jI%fihnW;oVKm#J%uW#n%``wPOO2qHM;}5D7-IqU-Wq+}w#_9M7?)!Lq@pU)}6_p$pmk-j7ig zCz*0lJ*}QUAGpsdTA1w<-f+>1%4(oxMXzU!P{b5Y8Xv%=CQjX%mY1 zW4---2}JnHxEu&nMjrM~@Y&fy&l2WJg7W2J3U+)ez;!E;#0cO4j`*7N2PFs;Y}Cb` z+i3;&on+`35jJ&oz zhV?drfz)Y-D<1iXlwseWLid;jzT`zGk8h34;y+e~KLY9b#zAflu>yG!;kHmPc{s|0 zDGc77)H{K|B*F#2IBFS5n+9GQJH#CIXs~Zb+^Zp-}LO$^m!8<)wVZ zptRpB&1TB3cx@c?VIvoaXHljv_N4w=e``ocJ&##Y!%r`TnSWt23fP(=`lG80gM|4U zXPQI1B3}eo$_6V^XGR?%DZaho{H?Z@-fAp1Y!A{I0oi(*fsP)IDVSoakioBDAgj)c zienOzJDPl=x#N{1=jR4my_?b)O?HY&-&)P4ckC^JiKl!hM&vjJrsCoES(t;8H~kbT zMTaW!J&vi7iiDW5(`0QC6V$A|N)K+OiWmxRg_(!~v+^QIUnI%J&KmpIBK6CWB1<9` zgYet{MYf>S6P@@-Yz7@uppPnU0f-W0cR^9Fm??VQYU!<974;-;eG=dP1O>tvG@ix^ zgqgB&oE9~v-wsy86?R}CUN)2JrqS_KbUCq0zA{#+5Ef*V^fZA0W|sqFrZYQukk-g3 zCU@9g*DRt%xv7{hgcelOC};nsu{pcY>?e?b8^m&<&;{@5}p5KA&kJs2+S)$^t~H ze7V&z%zT*%;~hoEK}2_r+mNBLsg1Zw1(^vJpJtJSXBN^}>sXkU^9V-q7*3%hDEwvz zf=>(-ku&*(MXwi|ra(NB=o~VV#2D?456-CWSna zcF`Wrnx5z-f3bC56+9u7cZW)QkW_}vZNwrZsi~^v@|%WuUN0Ul?ZC&&-T1RExz5(- zha>lYD)DAXC&#i&cdg=_w6j4>jH(=Tn{U;_Jl=e_`(zJ7jtwToOaNKV|DZS|W8QEh7nPM!MP6DvyAs4Hcx4D_C zo15L+^K$Zp#@nd);BM{L^L2jp@Wl4AtG4UyWmU7{*z4`|wtQ_PM=vJVu}KJfVo&f! z-N1AglFh=t8d*(9l^pAPDEe_)ShvbI4kq(kG%9+v&lDt(<0{r8$^eda$Gk&$@t87$ zu1onSvo;Lh;`JD-o7n|_`$qEju;*`ImKXCe>IN(fQ}AmyRh5;6A>aYFEm*)TQcnW& z*hXun!SQT|Q>$2_E4*zZ!clR$`jaYQgkP?G=`3!|PJs6g7O81sZ~{zS*dq5EDEwoT zGk@%|`txPdcVteqrO`f)zLxgV%@?H6NM*(&7V$DrO+49kDtO+Fe)dj>d9{~ z-avZ+K+0?Vj`_R0x)`3VC(Az-;WqgvPf#3+@ay6B-jso~ zbg=m=-`lXIWQ2UF;cp}hl$!SQf$xg6ZD25`EBRg^QL^5O$Ve6&_F!L!3YZ>IJ?Ecu zkF@kpve$O{$*!p#s!w_OnfY>1G&Wc4AV$NW&3qJdhp1yPZA^h$H~q*-`hFJh1BRl> zeTE@luAe7Rbby&1q;}nePlsq2wH=T-8&h)KTYiI2Z((%>Uo8?KplZuabT`dFe|DHN zejhSw{#o#;4p!!0M3mRZlt4iTGg%lWX5wtcxLt8OZ=Zx?zVOJBtCo zxXJ2&LP|{{FaG{!TYoT6tp0?|Ly7caqMTMCMSkh23b1fX71_l(OrcoirY*Diz|%S7 z>?60^)!zN(TYH$=>YnV7rMfp@g*n}zxJ)IFm02lH@VWBXGtQ_r?!$1{rn&h38r7vt zO^SK>M?+42_Ya0*fIx+6h>Te?2{ixFh1OlCLh=yXMkbjiwGY`<0onkXKRRey7ien2 z3{yDuU(E1gtc9;F|K*Su|B-gPVM$=ZJC3#3=AP`Ic`#=3tC*-X1nNH1P{I{6u;%uYWG?CO*zwoZT@^-0BUn+gVb)?zX8Meqa@ zMf3~t}%Ow#JuCg-4LQP zjyvwxwweCCN2Rz&F`#1j!bR*i5CMfrVd~E>sXKjFzW|!LZm8aA&7i+-?X_A6y{cT& zIyc9Gcs*oLL_OgN%q@>Iq0%bg>{hWFj=}phnOnu9`{bCRZYnV_nZ-O$2*@tXcf{;F z{rxaI67~m-5fs_dlUbZpx7r3&lFTK7K|x)*TXAbu&U@W1Ss8`M#Zp(6aW|#5ap21q z8FKA2RKePKCk@wDXOy$u-VuOd$su5v+RXJaJm%)MnFSxQrCL%)mRd)*|T{s>sJ zh*$`fE>S?Oa=DBt*sGfJ)~fW93~Y(yacuFTtN~dK$8@T-GU-ZX#{af|vKrrOFe2xv z(tSuJmPnfC-n}0uA~d>eS$56p{~kJf7^a+XP&n)9h?4DE-2Yq6NwS0UsTzCc2NhlV zZqXiC+G)X2m*I?RPO z-sHhl^$mp4YulhDqkx%~ilD%J*O`OVx&I{(Vq_E<)pd@W@%gxGLoqfR0RL5rnO3}2 zS+MetP2@x}?u+|b9^zJ2MnYpikXW@9(;h!_n?E6GP8uPgaQZT;_U>b}Ya!@HJYGo- zth&xGnum?JgN3`w*Vkk4gruJZR054nSE_F96_4uavq3kl@KvMXz#iEs!;us18f!Uw zM?(46d~@o_%dtv9vY9=wLJ^W9@>ab66jK5Qr0r3Z#Xa-Mq{LN-p52U^NJC{ry&M9(b1p$v@rR<$Q=GQ$YCykfKd#bsC$`nQnu zv887)^$WFiGWhyit#;TA_Ow0K{YKjg;pq$fQUy9>u3f>Tn+@b0mDm|@H64{NF3mc* zZsprt37}H4Z)+5YuNVfD9)kU64^b68NYi6sv#c9#J@Y#ci^Y`Ut~RA2)6tS`A?>ou z8NYI>_s+#PYzA$Gg}o$-E3PPVD;nan0|PcI-*^fwNKfqS95OAUZ^kCJ)FChgHT&CA zK^ZU9)`f{b6~A#GI~v%TGaBMBDkPteT?RGng*OY+KUY&Jc^Ajnl2argtVaBQr$wCr z*$#@tD?lV%4%XiyPw`xvp}1YOdtFxBuGGewWRnHIHG%h;hM2LZZmo< zNU@2kX`lP)`sOKSW};_}QP=GCDm@f3S^YW1CG}B(6P0Jq2}-z+#>A``N7W^z`XuD0 z4=)o=mB#)~u@1POW!azEVw@q+?FrhmeoYL8`!+kE{b<(p5MNTL{X@NVrQK=dWB%>fV6p+tny)5|cluPBNYd)*fF4p9KhY^I4hS?X1Ch=!TGWE1U_pr32l|@dRt3rv8|O8s2qqzN zltVrq1uvy2XX$2N{g&)uBCVj?R=xB$fY?NlMh*)R>-$LYNBq^h%Lmp!$tZb}=c3O$d!`8ivrdQpU z?jNgUCaPPdG+TjKoZPQqY@S!b=Y4dzjXv0E?;PrO+Tz|sdY*B(-RkwW@G?W;eJl~S zBG$y7{`p$XZT=n3Z9kK#_P8(NsEiNfWH=vkM>dBQHg<1sH)? z1D3y`Mq@~lwBd;_vb%hMj2ll6iUUPN9#q7crj+6~KRkOalEq#c{S1!9S>pEfPm{o) zsIaIbcK|Th)!7E2#9ms53*FRt+KucF9S;eIJ3aNcS?iS~Qnklw-LQ8b3aJ6lggQTVKVaQw+&)wqdjJCYvcWHs3i{z6fVhogeOgbE8oDAP99QN9H3mL*~jF zgv6aX4~9E%7YuXc%LnGln={CgFB|uC1KZa0Ve&)aDuM>Zoud!QDEc!g?oC6ES~Z-J zdr^=0%)m#rL{jZ?lO~my6Fz#;*cLY@pd)@}Z%g9LAq%Xue=6Y4vR!QBuU>{FpU+9h zlK81*C7E{mod={u*vxC^6S>cPX#yF}?>svRKqk%qD60zSPU@dEZ11;9_6mauyUd1m@rrxF$1!a`8E8h#np z211HN5=^br;pC%Q^uxc;zK7Q6RKTxqt+EV_1EQYknQvoDzKvR}vGHqom!i~5T9KLP zqL)vEKEPlwl=g&mhUu#=&e@aZ6b270m)V@7=zuZkniP+D4jcM&j%Gb5m;F~S4WxZO z!LN$0DHPg@y^7(;spx*5*8F@fz02BtfSu{T z9zx*gXuY#`AHN{@78|e--kO%S367?}{^YdvO$Y8Et4h3?{e4-x9)Pb1;EM!%rThJ` z`#ev`Ku{|}^;d=Kh;mr`$szjo6pzba=!2PSuy?BvD{kublj7>V^yV&hJ^A{tdLuP| zyVAP@xdxwr*prcLL-fpL&hg}!PgQCVM`dB*o4)FF4%F)$+yyVEwch9h`a#l;n*9|i z-BZ>;clO*o;HNt79Czsqvj}`PAO6gB2ac!rtVLv`;`-DR=$&!(XBUD z(ti(WTHh$zyNs};^nOOwKEU(B2r|h^XgM4VQi~fl5o({#TQDEjSnP0{E z@OJtFqD`hcib_oEbQA?4jvS*rCa07;k{HksgaY-OIxj%ccgoSHJP(wC$`M4n9xo%0 zaYguihkWa2)`OS;RjIs(k@5&}YFK>Go2gVe<6R+MxBcleg2xLZImjV9qLFYPU+M=p z%oJN|`mPtvcNc}3e9XDm-G<-5Wdjyc-uz{YdyeuV0@;F$iIllv$zp zLc$VEC}z0VCg$f^Xf2|T9W*7>r&R4tH*8EUgc<|cHeyvWH9~eAu$_pGoY7`6m-zxV zene)TZT4+uxHWl$dD&Tlc&ofx!jM|_WLSoT>}13wbrDxue%tU0=vT#3*Enk~T9%lI4ua$JkOYsctYf^+WPjgC4t#{GPPf!OseGG&k9Z{F{eB9_YGChWKeB5O zrHmY6y1JwfSey6?25+#32-6ZP3*!m)s&bDg8c3tBlAio0ekG~-(e~k8t7i^Dcf|I2 zgh+d#hIEX&cm7v`SqA7ewN}RNhDp20tms@j4TtbIo-k=Ncqm zmL>e|8)aZX(N58VrA0(zbX|xKnf{7_&5DeoRAB6Iac=C@0iMdOhMPYd{a# zBeT-6I?EV%q5RedPxUoGG^9Q)Fs;7FcvJpKC-T)iWmz3}Ad~=70#XVBx|&@22f11Q z<{fHopwZjm6gIz>J<*Qe*u~t&!zTJZN=57Fbx%%1M(!Hy3a28B6(Uq(jT!dI22|FD zS=MBje!RkgkLVtpb#sS->zhrOr*(j51fkepotNP$6+Pc}2j)HWiQ#2deT+58>NZFm z%S+7RsysctOgN2+@Vt5An8mcDxAQ;LutSw2&b9^N&FbW6*1>31_r?Iy{*K)INxjS3tUrzTIQMC37}$OgA9pa zv#ur$BB;s+p#8E8Oi8-d^KGs^y{(%zru~P|ymde$M|0=_yHX3uG~IFGXxNhKuO@9M#(Bn4mA;0 zba4b#xI?@VOKBajiYMEn@|?C?ud*vNUWdj2eH?a-Dt`40uK#lBv!?#go^Yc3%N1mx z$+JcjSXP8@wdA6D3a4p@W29L+-Pb93wJFT36K zyGCMjgQKNi1jpMqX=_as+!iwZ`IxEOj9+yDYuuE5URm?b)66nww!n^oP(a{RE4+_V zw$so_Hg62C^6~;Je5iqHa{ZAKdVLK}{FHQefn5yR*S<7ne3V^8p(@yCyWg)t7CbCZ zd%wmwXD4`~hh*kz6B=99Y4!5T%i+I+eQ`pa3^9pbnw>H(rcp`KH$ELJ+o9JEVXS7I zXK7khgKjhUxoan&ojX36S$Fu+L00x*rz4a(=%ruuUcWuxXFzwOA1$^<;7|17lT}p; z!D$o>wFL=is{Py)3H>)8jdRHAf^t1S9tsquGOkq1QQZW9_xv zM+ZW0;tB&%mi5{hL7pV`%-N_{jRo*7FxYBQ42LvVX}y*}60V#8xOR*>P>GtL@}nutZ& zPYZ)ma5e&u&}?xwacwm;b}WvPk0F+fcy6Cy(4Fl@{Kh4}zbGg7+&kgzjA8?N+4&Gv zl%lmGe4p2RWDJ|~#^^)Q8GI>f1VWm*iICU7qrv!`ZY9%!pkn^*OTf@{(ToQ&O_DJT z0$4+*F&8M+eJw7bA^;cmt|f2uB%Mu$92xbXb33ooBl<{yt0je%S2 zZSA$HTbSPs+q7CMv5d2QXFxxv$09rlin^Cs4fKXigQi)e{#JiB_XDhMTQYaoNIB7s zK){`|br)EkA9G6#hB9KcZ@-!2*kb7R_Vz%wa!EM>_1Rs=V6XVf-qPAxdA(^tbhp{x z*}NDtbn_6~7Oxe1AqzY~8bD?Rvu-6;2l`MI@0Uq<)Y84_+5vNVAL0ZxAfnZkDu7tzxq~!N|evXI+wX zqwVY;G_|u6Cw=5PIW9b#s7P86`Y2t4N&Lr5TdgDX{b&pX?I@j&oz2eWxb5NxE^eTX z+r!5on=y^5N8pr;(eu#^nDS6qc~U{vj}CjX!t1@a0O(uzzp=2?+SWpJ0RU=D19;od z{>3<56qxmtxYJa2*xbFj+^wVg>Iv z*dJf6P`vEAwJx~11`<7=%tSQ%9hIy6**=fct#Er9z4rg5gPTxV0Pp+oORLcbmYS$} zJsMMiQ662{!y+1%K5*DRO0?#1)ZJcK9lN$EAXyq13;}tfxrjp&tE0wXz55{97!+VYFz2OSyv@Km(B|sE(R4u(- zO3|_VG~1=v-d6@Oh0ahl4&hn22)xYWYQ+4yQwU{XnpTtgk=6jn4q+;12m+>Wbu)Ic zlI9R&GU~9AO2qm-y!9>rqB%%FBczz`MRwcLFwyMq0`Mgrk-Ufun-ELVvD{g&Wp#r^ zo`|NdC)~qSgp|{3k_-T@h*6M4 zB>gs+QnP&lbq7$BaMC8fPLeIR0as0tnQ>dO%Sm6Cub2buLF*#62vo9bPgN zf`NWesuQk2=$hOHcgXdjd|9`+$2-M#(yDlM1mr1$+)tWI?Oc-Sk2`I&+20lsR`<)S zsNt)J#>}@U6&-v{9^=)+gHhacfiuH_L;Tlt`qF(LP9V%&^b{&pItf&FPfr!@DhG&M zUQn98Rj7l9!*4=i1H6z|WYm-3ZKZw<*);oT^-P0w42#c}EE5*aS@(9E=2xmy zsfoKhEPkYTBet@M_e=c8A^@8fHEqXo@i(~{aeSE6|BHK04}(eoj-6ClXfJn2lIwgp z-{VNcVH8{#q{tGMd!!Q`i_4;C3iMaOD+X1B=qWDlku%AgZ+UOxx0QCV?B1N&%&g71hfU^SYe{j$0+Hg}ev^Py1c1yw1gW!`akh4xe>#CdzQgEC>O9S$f zUQXTiqXT<*Fhq`)c7wZYp9&-*@ejr#NKDY~_+jmOfpmbjhfuLmlyoKZ9*prgi?S#o z%^>dORvbWU(Vg|20@pT1YwuXqrz|Hhm&a&T&8*-l;BiFr!tHGAh}OpUp0?-9>zAoD zsxA+|3W}EpM&v0$dP^x0>Fiu1G%B74J6albrpy6nCGKlC`ycBpT4rWla~DB$99pKY zzkpX$1~*a_JMy5+cnIB%rV1AqIvJ98&nDs)g!10V_#TtXs6?%}C6zT5EPSAfNl(Vr zO7;A>#bvwS_qA6AW@G78VNO{DZugBV!ipLG=sKmHV%ZDD#a0e^O_NFP9mR%Il3MZ| z8|Fhg7`{6?ew2aW&2@S(b!oiS3{}(%1j^D6O}0XmmJ=Y^;%PdTryUDUZ5hCt5a>4V z)Q#F0YoKWNt(&mh^cxT*>Q?F9i9J5huN-^6K7DC@Pwxd28%T`6_K_rfQ`HlggWZ>t zY-L7%omQUC%IOs~_I9~Dy!DQL-+q6gp39x7W}~-)u?v~pK5p}m5S$;-Xqjiww2q`- zL}?+vpS=AQJGu-rqr{D}LTWYVUcMw|UBOOcY;Elzj;VXNrUjv$YE&~WUXA#YK>$x? z7g;U2<~n(41d(FOmqsEh&pAItKYMyAUHxg0qVH+%7MZO=;l3ShDy@Z*PcKS{974VnZX#fxTcESlW}qaq9$xJ_xn zIFWK&24rPz0Q7RvOBHDY(+?Sa^6X@w0e$69rEJ+6%NxTe^T^7lhb|H-5b8s~&7q)*hqG(6m5) z+1;HD=imS+#;5<2l$M8H6i0ZKH)hGNXb}x`$YmM1nxg>JE^BT9nH?OW?S`VvF)e&U94yYD7iVug- ze|>{)z*s1$UoYs_>FX2%V6{N&aS2U(kgh0UfGxum9-AoGIe1+xJ< zOG0ZvcLo1(EqlsynxHnK+yHeb+Y5$*f&h5)tasHa76hQUplkKZO}w}-;zDwT76jp^ zS#GbKYm}F3y-4HwlP!LODCp61|I7NCo@>%+xAAlvMGRbdDAeh zJj;is89~R&WSBcVGT5b1mYqqGgqgasTidc|XX91{3|ms9=8_eYqgI8FQwvxPz1cx|@$Gz;Aif!h{^;0@JWQss4^slt zOY^$y#WuAUCTEhN(1`-#>&B`JQyLD38?Xdl7j&y$n}0Nuzr0#^)bQZDuQ)JtdZA>T zc=BWiy$38bG54Nmq73x7m0WgkUFDvPdJcFuJ^9ttFIFcoTi&~s8sgv$3n?YBxr#*< z+Hy*TVgnlmFFmT?ND)uyfQI*1Hv7=jsck=!^>^Hx)pRW}zkXRW^J;B*JxOS^8iS-$>|2T@R|}o+(y6)uWV8*}wr4>>v6U=z>S^R$+$wCuV#q@} zV^Q`Ucj`1zrujd4=;h+WC zs)PBS`t)wL*=VuvwEsy*&1uypHNBni<}6bn1)o2LiKAPaYd4a7@u#|eD_t< zYZ1PE@&H(%!HWC({irflnj8uDlzDkrvRo9#+exG7b+Vj}i$ITiLgB}Q9!MXl>% zPjC0IO$lQMF}0Hsp+1BK=%Fs!P???ya?FF&r`yuy#LkrY1fO9U)pqJCtW`gvO`PeI zo?gj=H1VdgCK+KBCa~Z^4caqLNEA^a0?B3=@f;nVzsvCSh`{;X%&wLN+LU<4a6ajJ z0@{-`Eug>=-OC5}jQK^U(Nj^Xb#zVJ!gtrluVOZKdX9KC?S8+~Gcl8ugIR9Lw+fu- zJX0QU(o;-kCgnuxE=lD#Ay-`lg$TNIwlCUspwnE7f$VmpESWyjOY1>-tybg(FCnMP z%r}K|Q(s*zOrAFki3zlH_L=PWtxoJTq5=frbm%vRAU!lbkLB*tjmHw^n zNK}ovpY8r=AgG#5d0|?wO4p>zvbx-5SC_kN+qP}n z?6Pg!wr$(CZO`w&_x{fL=A5%;*38A5Z?1^E%FBG>iFoNHvi3r?=x<5MYecMs)yQj{ zrJP-(1>okUe-ToUvHcq62%DoHQ@J`3<29$Sz!F17!%Lg|dLtL$nqth|YPwDMCyw@S zAFtffzsJcq8h5Ps3njfi7jsaTUdMU(7y7H%u0yIh5c59z$6i-YByI-OU3PSu40 zS7TRa_=M>S^wY`a+GOb5HXR-P3v$ZyWcw}wMnm(#mVi1-Gl5Z(nJ|-F+S6Z-JklW0 z#z7-sHxff9XD7WWbwtO0n5^4DiVSjeHz#4xC-%b$Og(otO{OAd_p|(B?yF3>4Gx#& z7MCaw6OFwswyVtdWE!jMh`i#hgnvkLzS=*R`(M!c5f0XH+pidcQ&slHvA-1ZZ@%8#3p%1nP9mwOynAae1kbG$*Y21TVCigBKo5M{lzP`R{SU#JP8H5!! zSN4LL|65D;Osv2AFgyYS6o?QL>=O|j{zZFvI=+!V`+Bc!`}mgz-3o0h!tCw`b`9*i zir4_O^u96{TyzWVQ;83t>~aS2$eC?~`IGj2tzW22Hoj`IC~|t>HR0zZN2WNA+z>@u zi^?~gQ5fC;!nI)^>47DGumfwZKU?MuAGXYi>=daZFT^kQ2xMp`wd<)IjdGczX#QZw z+#Ha%LfLpmZ;a6B!veoX)q4dl<~`gY5dem6oWgN{T0p*4^+J6{WG{h%!kLN;fEzZ` zrTE~4j4o<#fJJ~&0-<0W4m7Uwv5M97-)z?$X>kX z-ddh*Xlp{ywt-1Mok~WomVtLlOuTCPiD-{%H!o7SAKfCLx)&|p>R_?C>v9}}GK5BD z$T$*}KSgIb-#q@9$Gnh*XRKzKde+?4bQ^XI%VI<8sm&rDQu-uNaFp-d%>>?wE+;Nn zcI#_x?X+mz!>5u8DS6Co%Z1eo6&&3$XPL_AUJSuQK%Z(hy5Ky4NB2Nk1co3`KH3sV z$AWe_G<9C;e!)6)j21H&7W`Z;J|U*HT&WrC7*Ye&K5Jhu2`%AidDfW73SRrZUi z*+t7RVh-I>TP7J=0O@I0DzmLjl_fOHBnav;m=NL!wTqF<=H|;Yf+o==%Wz( zmc+$t*LvY&nh}}B-v*2Odgo>b1wUvM73vZX<}5@X<&L`j+z^1U4e=2+c}ezA+>d4J z#tZcNUclL+Yp>J7wQxQpbus6;A{r+>8S$PFOPY1ttoOtKG)A{aFmZBJ#G5EvRUp7y z=X+~ye&%rAPaX(&gD>})YKkjeUN*0K|W|NYWqexf7 zzCXbe!1b~^(x>;THhgnp499q^1VCnwgcLcRk9q(=*47v91Q6ye0Eh0D0HEh40BODi zU}qP=2|R`~1KB(qK$J`3ry?Ms4M;4H<&U%gLUcK^24M!mUiBYS^k)`RkJHJ@JRMm7 z#hX(!x{Cl*IYk4{;XK>#oa1PzSz@BH`QH@!WXL+{p96x)P7{^alyuFw;uDq8RVN}R zVYm|*yHYV;skzLb`8R#NLqj7Z&+1&&f@1i~t8Q=jzm=4b>4cVXn0&XMB4fK_t5;?F znaquc8Q;?Uvu&nyath@GJ?-r6Ri;981rgZ_KZp)PImK8dM00nd*|ZXXEvJwviM49P zdKE_UxG)|IX5sRDc=&i+k6`#(bIhHx^vJ7irJd8h#@!mBJBQtg)+?V6k9+rH0ESgS z1~C*(D*Fqs9V_$6f$Db zZZJ{WBJJ`)r;;Q6m|<*USaRO_EXRojh%)fI&x9My&BXy~(e%UkFUW|^X`2?0Z};(G zw|IusELiG3y#g=Qd%Ra^BbZl?TAFUGpO>B?WZcF?6BIOYikq3@WGP#*KQ!epsj;6h z1u4yaM z+h-gNvu}Lma!WNpVyzL>?T`gi^iHxq$ID3KUZb6|`C`@l^M0K|;g2X(OH11lYCWR{ ziQiPC7d-?=Z?MAUt_F_~ZOlTtqB<3oT@qqb%{1r)d&Oj%n7PU85f}I z+YuPHDx(Km_%4aNzQAmITIy zH}ly3n&zjaK#jL?8Fo1MtM0F`^z7nBoWFEH6-GH=lr*W#3!W~1TgnF^gc5V$t1C$b_$#KuxJ)ezN!6^YW_NqE9G$cEN$3&}k9=f=hT3V~0S>}KKGfR(D?3fuQEa`*n7&-_C9!GqUR#64h~ zLdmmk2p2ShzA+|~bJ7uS{Yi!U$)$dILk*~#ugz)ek2e`CkRM1H9!M{<)tM5V{XY+! z{_zrW638SOLT@6HnI#1El$7zYl^6s@51BhPAYQ`Paa2e$wh$OObS2@e_+Bm_;$vhsm=_bQO(cxqReut3(fx;xp z`?I~!QijF#Pn?U{DzE{hRbhbhggYbZFfmYNI^YPYh~5EGL*4sB=S+ z*gM>Sr@#skQhn`})*Cv-Q54s7qT>-PqD=4$5&z6qI3+DlVo}X0ia~Ahu`~Afh#~^# z_(NK+gOH$qEu$P59kqSL(J$v5@#&&0=(O{zMo6(08q=6~}HRd3n z?>s)Vk- zEU>>asmvCzkXP~U&Pb!@g1mBb??AOi{?uc^f;X%zxqSb5~!18MB!5J*TF=pjm&W08Dq30oF`t9o{T znXN@YHk`BMZ1vjxMe)HNpRFi+J?EY=GzCvK;g5BEJ|BI2$5A>cggZLA+2EHAc|SAA zGV}wB#p2m3OIbA1-MCFpAEdUkw0w`Fy{%-R2M!neQQDontd= zI@drhQ!4VtF<|LV^hFAkcT+I{icCHIu(dFGERL$_44Qp|VBTB^4Tse_-RZ-M0^O#s z$|FU)Sh`~ukY?5=vVJJ%P7tWz4KWHW(;A*$_yyE^5dKQxg%S3-uM|T|82dSb7lKe3 zQ7OY$A8E|a_jg(XwP7dDjw4PHRZ;5t3mAg}YWhA-u8|$+QPQMvk3Xy6Aj^<6j+#W3 zNTN(MPn=KMmXCBs&6t%(=KG{jm%+!V616qI!U$^F>@zIw@UKPa;HA*_)#0PmiDZ?s zXUn(4z*0b-b2+HiL)q9JcU6UqG%yM*Ic#_?2gl zK%BaQqBP^{8}d3;)RqQDrzQA>#}eLY3ch9;G1>!*D$w=z=f9KdJxeVQS6rmcBG7fH#LReZ*Dzagk5lgEs6FGn#{pFHX%|5=G|fL)vTCUoa5^ zfU_3>IQy1R8eX&g1DrPp0l*n%?7x6>SO;?;061q)6Su3lZ~O~5_gVe}oN4Y*n@^4y z^pIynfB*pvWh6xxTo^T=jQYLbx!$OLyy>1GjZE>SMRk=@r=X%oBHxCM$*AL&+k5@ zs&@C!`Bi{_cP^Xt2m^5fA%EashAaZ3g~bG)VZWwJASu;upTN@2&P!^Od4E4MuIF#l zR(90d)?OV;CmYVmyxLE94JU7w?kbk*>Ahybl*xgDPjJ9EO4kqLFB+9d=$31at;#@3 zlvXLr7hud~a?jiXKFRQP6UzY02%)8^^&Bo<#on``3B)j?^Zj+Ol}_8K>j zy!l3CbcdeV*~zFDoW@`2i>bVk;=IBDynKy*H$ZHx6EBFcXcW4nqhsHCTJGiGn6879 zK;vjE$S627>8p(9hqoEK2uXx%1o?a3vr+It8oWl0EFPMH^~&BuM7eoL(SeA8WUYy) z6o_r&GdiG}39OHv2(iuN%zE5)Ic~A{nSoeYnvYSGJ?=#Ly2H9s%|cUBT~}(>DRK_B z#-mdv6EQgk@`P@}kYChgyk{bt?7}I{ME2~MghP)?OPDJ%C|AVzg$waHfir{C)=p$q zKM%uIpH(8OXSE`pr;o=gYWktbUwdrbbf%onGuS~ALSl-c1eK)AG!}AL1uqw1I`ez; z0Yqm{%KwPYM*>+6B;y$&N!{&g;E*RvA^9=P#L%Z?1w4r{SHFJS5u_oZ>1&2$I}->8 zt|;xXN1Wd%RQ5~zKhv(KY>U^%!<;ZlfhK!a&7@ibJ2OUGLF|*@0t02vj=a6sWxU2} zYh&vQ=p7s%4&tYZ9h(mAq60CJ%1?thK;H2%(5sXf#*sa|z12CZ?jvye!s+`}VhkM) z@&zFTy8SwmQA|O0mH{(i(+j>8Y*k)9v<@=TFL+$HPntd8+&^quJSxwiA@BD${}2_7 zTFs%juJ&1o2X0u^wi_)ZJmq2g?S-J}K3`YJ1h-_b)s0=DCWMY#VT4P;3&%>SB6eIf zB*%R^N9w;XX+Hod2A^+>#I@LtPQYW|H3A8&?3REkO7N1D^hS}WH=&)sB-2=ix*Okq zf2{1w`vgB)Crlg9{c`^tc5OxX ztc}XDf!B%{>jr&QuE=1dUA~|O#hQF}UlMR7-E_^0XrOeb-Br0aedH_$xYCS@VPm>1 z#%VA5h1g^_zN&a-S0dl>--;6R3kAnP6gNFNwtrOT`LixLWP6zZxXuM?|G3VEQ1USR za~eK^qm8nhuJrJXQ7>klHazl7%EQN%_lcf7EVyrJ4aTO$9kQWv$PbR7%|+DmfK z{aQlWDXiLs)MdCDI{Ij6j?}xhXvmsRVW>#fs99RVR>9>A6GT2-+YqRUojh+XR57X6 zX;WX+0|`x1hQSgjMEJ-m5^U*MB{nYIfVcopoR1;NG9rb?GF584^5P=cG#2Vl&%nHIdTT|A#FM)xlWueZ!KtJ}adG0%Q$1K7`quW!4jV#9lB15|6$ zk8h%pkKo1=mz7tdzbU;uVEAC}FHqD@o$`E;2Y?QxW*g1gqgcNvd*dX@;seCWOx|9= z+B!c^A6H+`!)>f>W*PnnMGrq6pJz`=+t~Pj|5NPK+??j~L9?CV?c}jOKRz3O63>Pf5608V!?Z%2#uzUo zrm$zjI#)q9-+n58xQbW);421r&OGg+IN*voNxp|BoopAy->}4p$J!B~kouSYycTnV z?o6&pV_M5tey+R0|C%bUG`Mu=gu{8%v)y6{t#!HG63?!>FH{$2=513OlJODf7Mevr z5Bz%KW0%kTpVktP2z+>yz?oKqL4s+_8H3V3lEPbgHtsx*UgP1N3h%zo{S9@&KR17R z$?KXKbf*z-I_~(XxT2eVvSFve?`fzMhEz>rFY)zf|%B| zP`w-?H1agB8*-X%Jsfk7e`I%fIe3A*c1G!J?I{h}ot=^|)2A5~mMQsw1PvnIVa!QI zt%_gyV+=2*ZB6SO6snVtszy(1)y_I_1}PqO#VhH}t5J>i!MDDl9#|_9*E;R3z~_Z7 ziDyH#mw;7*?Fa!8+VmC{)c@QI^90u?Zz=8%2?K}AvAfc!o#O@OgljUWwDDkki;l<= zT;)et{icq`TG8UgDc97{g0~@|8&UDi$gY&sX4(*>_`eI#8~+xdZ>0Yp1n7|sQL8Ja zUrEVS!dDfs8?etzJBAp%Fl!UG;|g3?g>0(QMsd57^9^=oIZYC!jBU%4{OLEiwG~kg zCZ)<_s0pdI^km9f5kLxE=amm?icm(X-xi3 z#f-alxwlwAYbdW>%RO@q*isml4?zlx_GMtQdeFBzeM|Qs6nr__XC)1i(ZkfUXPszB zw-%a0_;={+X}Chde%_2%CZNBP=#FEHrv+Rni%56k@3(B={ZnssIO~jUp?=@Rhj&?< zG-0{MOD4LL`0^%dw+gqXQy2pk?sWBc`;iqV4?&gE?UJGSb3dXl?Zl=Y)n*WCS4?PV zm))7xEp)9@s#)|%beT{G%(L(P*9`hH<+tlM46PEq0!gPsSK|LT&pz#2zcS6_fDnb= zi~7lHlc#vV<@6vrksX4cd7=TfvzX$hFa)bPxRR8tZ66nAD_C!pFH3!X5E{_3OSWIR#%GF&#W$+sx@4BC$TKmW-d_MgT&sl&xVtPx|$`KFkX$edVIjf`M?MX%FG?lX|q_rTt zFrT=o$iWLPsDf_co$$PBZr>iT&^A+c2@MMLS_1l+$uQ_bB7-zNnOn~*{+yk4@Cc+( z`VDo#wL5tGE0aL^4W;Q6B;x(aN&vNLu$jrVf&-dP;mt&>VSFGexyDfANzlbfV7^z$ z1*N;H>HMC$QA4CocT{OP8#y)_F)5Dp*B_sGF$?0fSomyI_0SJNoC7sXmpP{kuG zMF0`lp@n;7_5C0H=92%-Z%%gm|LHel{eSkGBZ!Q`C$NsEyskE3B@yKy^Cl8KQ+jD& zvhxhq7+mI!SqaF+_0Dy#)CR*SP5tZ%Q9)7E>v4lLo)j#LE-JVB;4TNdbnQQMk(#-~ z8}&3LXV*fOf~aQKOp{ElQjq=yo&kgu=+F*eKeIUeIG&*yGFo{6_a)x1GdQ=-r8RU0 zsUk|>rli$CaAarm`trmpjx|ciRJUEekuU1{GM9xp|2V`WIMZ9sa2Z&(Y-RF=aS-+U zlYkspQ`Ty2ChfUX$?nQt&i{veZ(=(!OL;jE{+y4$#u1~X3XOAFr%u)LiYJJE8> zNgb1nEJ(bkfQ`8`@h?9}EIRcL-li4t5BG!(I0|IT^~u5Rc(bN< zHfFQRlrA}0m8aS)_3bSoV@69bj|c0^Bf-<_6m*OasEPNZ&6}8?YZ~^~1eNLQG4$h% z`DtWQ9z8g-$O3+Ad-T4X$aU=PZL}tpkZrqQ(=YlcQ@0^wCldCnC_k8b-7EZR3f%)JU?Wz z=P4d^lqp>pMP`7awNdU9Og{*(AL2s4i)_!F+s~FU)0-iEf*(cdNOp|Oo&y4nGXxcw zR^ehYQ@KcbFOnf)8z3^TwFVv%SO$cWw$IP7+TBK>4>APdmkfoCU7V(iMb?@(L!|HW&6s~($NEoj9 zvzO{fY_6J22ftK7kttI4IHh+H8IBkCzh_XESFgvQ#Nc&}9 zG34x}TQ|}`H^YlabLX798yj1V>UJ?nB!UZXvYRtOHG+ADwvAXOQ`_bP@Q^=`*Xf;c zA0Q$+!_0mC5&k$_=TE`{x`Hrroa=l<+P4i8G5yZ_I#+l=LT9#I(bwLm+=qV`EgrU? z+R?jV^A8fBz-3s`-lGHQtet_MjN^K719=#a`+)`xTrf5+IhzMvrCu>Ifj;4Yg;{pr z_=PE*B=r^agpdA*Pjux5W{N&t@VdeR+29OlXOl9U#nD#p_WffBK46D|svIa+Mq(3| zf9nG8IuvGu@`Ot-vA~BUI(n1(BM0*&-!$eLSnS&i4+j|JPQ8For%)hEKEe=h_{IAw z7ld_yC!gVCoU811Bx5_eugm8Q?m9(ll{%WK{VtxP5zi&=5ZTd?=ZI+hq~l7hD`I2V zoh_uEoxKd+c=4h%2L3W66JVXk^jQW0Bd=oQbz$GEdwBO>!VEXBaXxQI)F5}Hdc#p~~l{})D^9xR|nAozi z(3HIMs5D-i_o0#Pk!8!0T}-BW15B^U-f5O&ni=_0{w`Lw);}hKw0R*J^4@WGf>}fv z#09c9!x_}#K+MNbNpaLG1v})1vsn@DbEXip-Pt*KocDn_nzD`T(=`bytfU-L--jK5 zq4Ne@ahFT)clSGXqJ&pw{8MoO$&xsp_)TsBQtx;czrsugYBaCet`|RZHuV^21sh=% zjVl#hRQuHe~0LvDK&RQRcui>PU(G@AMmt{J650jZQRyZ!Zc_7HB;2EtSUn`0cT`@g zta?(pDmuzhSN62MgbX@#*0LvF%rxozR=t!td5>XqWKd+r;xyBi{v)Z+XO|({ucN&+ zz?{*Wp$F)o*>STfyJ!3UPKS7^=)`ZrE|okd>2tJeVa<}Vllo(~K)jKnAiY|g@}cknEJf_E@rnP}JY^mJyzt%SE_ln}S9SRX56Vo2J}haLXaXIXmQx3(FF_VfX|+~I|h*vF-kwb;sN zDe6TAjJ*t~dy;(#2;%WR`5P%BHhN%eAe8eO@xfKEysa(#6YTUX19C}`o3wlw%Bb=% zNx~KXX1nAg^(!Ku_CT`_t}HTmGlao}ywiV3hW&XVya zQ6tfbs^;722=$fRW0n(y={+zUWg1tY)IyH&wN;erI)%i~E3wY~`fcf-EPeyFc+|vV zh(_{=9nRUC{e9;K(}h2sd9V)ctg5`52vm6(l%jU;+g8Wtp_9B`wXsttCZ^YLX^&R z_t>~PCog{u-PFzeJy?U9OMB|xq*qnhQ|dL;>IsR8LA+%Gdex&`j%8fD?OZa9T9S-z zPqZDVGokr-n2f~&;++e)36LP)%$czCp4_G^xe4fs<)wH60%emyT*jt3WGWSVaqgXt zkrBpSHw${p{D^?WKIo~(_&aQcAY5GBqDW?l+fo9JgLyvBHHMJ}w!%IFGS;bIykWG* z6r~TdWQLbTLv#sq@70S*s&3Pn@3tlz!gb`{BJA^$8eK8}a+`PggvM`oTdX=3*7SjS zR3*d_l%OZ2V}wgJ{nyU$^TMgq+dGGl%pWm-;&R(OdPC)EM$7ItAu2os^}dVnY;JU9 za`JHTYv$yKms@;3?^qKGsxcfYT`zUf^YdtZ33SdhwG z6M?j5*mPK7fyo9sV1VV2ro{^vbRoNF2%lT*&3CZ^>+iTW_44EUX>hj zJ@-K*I_4GDum>L_>x9{81F8l{^K;)|Kl_x8uN?%H>cV9AE)_#6yP*F{&%N2{$Eb> zIOczIn$7-Kr#TJg-%fLxHeec{9F?Yg=e0M98R^CBTWiyNG6MSb5}UgXn#_NMX48$L zxSMpe^@b*Td~7q59#?$bGyO?-|MR#rJSk*lnWAOQu}^h1VN@>9Pon?jbRrQ^aJRW-#N

gZk53ONZd>Iy_gtG5dSqf_7H zahJ1Am2zTfVqFFD**(@Vf(x*YKN<|BDX#0Xjd)gdRAG3tT~A2JqYuqCCR8tkL119c zJrP{^xhs6Hl`k%{NI11`)4^`-&1?nf!B-K>y;{#;$`UBO!B&a9 zVOb`>M@5B9E|>`Gz74pc5Vyc+v2F0bzou<$@9GY~S8ker~k|(nPQn^=YVX1_S^70yKNpdyEd9aA(HJK#X7qi^ukdWD*T@F8YNc+=zw*;!T zvbsE9@1Avez>uMklJIP#$6e|`KNB!86$FOmaM&aBSyP!1iK%NK@Y^)bZ6VGrnwjDGZxnch{aZ$SiQKd}!^opf=x37wW8`JQLuXJ*BsrLoV zN&w7-W=n&nW_JqBa86psZegjK}rH_RT~3jW)U?uz3@ zOZf*D&!?k{yqv=!;u;>B3sY_LxI)-XWA?zNw{|bHv-wbmz5fsXu5gG}ExCfEV9aLN zOB|&*J88x}WXnFA4r{`oeZ5PgI?! z2JB!ME5xuH+rbED)`dHFpr$SNeCJ?z&(Q^no4M_l;%)$}(b3z{%H3=Msy`N&&Ft1@ zEPkZ+N9BOyy@#^KgP=FhY|#CW673tPMo>O+l;f-E5A_((C#*KPy6z(uGkJrr+%G4UeZyjNa%IMMPB~T7#8s8ir$JE|}sak_{DbHyXse-PxinmR7VKgNEeDyW zrl0Bpvr?W1K0=WkNUmDr2#xf4lE`?@%W5X?&e#-f+6FLHlaGIz5kuhqQR$k#9@s;c+b^)fv%J0x~rSgH4eUQQU{hV@~_JSfW^ zvk%h|Y|#gJ&kITrqK7~C+Y)*#tV0r97i17e{3!E`MG`GK2ufX}PqZG<_FZ~TRM9Gw zKD{5o0r5S-OCn-2A$blQf=2h>Y{RtG9^2uSRt(sej$JhH>KI!{5l+TRmGA#uGKJ?( zyl&Glf2O_x?*jSWK9ooy+o`XK)k(QHE}t!s1YAWYRiX|PSm?RW*zvZ?Dr|wLIJ8|q z=qzZY%i_;OMD+!%H%j%+tZD?3mlxIgz(668z@`WM^q>=ZpR^ z`P8CIlCsd#%q}4DhpWN%%@12d7lDZ+xH`I%u8~L1;S5=iO>q}1ApmyQ5=13iUXjtI zN>eeAppoY8y0t+W1y7s6K@;X9R=CR=mV9klWkac548B~~cJAHeS0V}T*7mm`n78E2 zo@6dYY>m;6U;V6Xi0dB<*5}?2BB9rJteiF|EpQ2<`PS9>BBTN>vf5G52s3xLxs01- zsLV3+f-5R4nhoDi-geGYP_dD@}WRC z{}p+ag6UvfWKe31iXdW5B@(Rjs~5y|8M*&F|5A#Qdy=(W*(lN_Oo-eD8r%4_aF$irPg5N&tGn}C{OJ~amt4nRn(2!7^C@GZa zO@~b>LUM;QGU%%K;F<=2roC}wx;#GLUhsmy0cCdhPsq;7HiMN3NxN;2pVrp~GoH?I z6O@uiSf7%U71inI_bx;oI#XE>WY&Bee=pH3uKqrN>jTKNmgpoEfJ{rnd|YyAta#{u z7XgqD3&}F8OQZcueTX^p9zR2FE7xiN^1;*7do*b=-n91SR-8#x7%tpqc6B!oTURI5 z=lNi{jg1Y}S3q|MySJUk`rOzo(v`JDCLQ+QuPmyaB+6j6oKuP%)K1ADrtj(eoMq}> zaOd{C0YOH4g=L>n6ICEy&)Fz55WT0yZEeR>q2yw+wvmk*6`Jb3@KB`;3Llx$v;=4TuSbu4;ktc zVZZ#L;TUU^$$ZnSo;asAQDBt#LyRkWIKwRr-g1T+3wb1f#M0Tju%rqxCl6*n>6WN# zb1)|DaqDMFNAmKbu7@1rNxG@}AcPA8FCw2&sIQ}Vd9qQ7=lnuJHzwieh*6mjFf&&* zK|!1R1WQ!W1k!m`{?wbE@6n7wR7ve>Ec<|S^P3Kd3C0`RbRgQbq!VUy&IFdvKsb(0 z$N14&n%wMLAVm9r|;u7 zf{Jb_-H4s*iZ=InY9z^xk=?f@PfY@8zMwjAjH{ul+WYE5pg7;wwk-qMOD2@d4rG5s z(xmD2szllVNuMa}u(&q5p&&?rd^@0+X;sURD4_0d#XQl8i(#?A+JcwZzR^9O@&2pD zQiWX>SViL%CwJ-DjY|A!Hxt2u_3P#~ukB|FJ%8n{e5XzECsG;723Z;EL3g!J3%;!3 zoQ|6btR0?<&`p^2&kZ5(wev5A!6Cdvw995XgkO?M`xLFg?wecgL%*F_iC|LSs}B** zf?vt;^bM0Hti533LLN1t^0_EHfDE6QSKx7%Od}B=M=7>?|bAEUr zTfH$-Tzx@OAeDJA+bg+<+<0k`Gqih7tPP>FSUl@w?XR0Yt15Fr+#K8mpJRnwKfc(D zp@kOM{VmoGHHAwIQxhPCQ4t{%6kVn>{@wCSf{o_l&f+1LW8P{k(9W|>k$>oopt#a( z7~5*A3{iI%{PA8jvY7*^uc2Ptg)B*_@)l^0#w2dRcbg|qwxed2?gxBhhgvK!F_?|_?lB3nb5!K3^q0 z=cNX6K^gf8mDq2j^4moo<|@ehCu3T&I857!ZLk8>+xP`l5xw}yn}NEA;!P8Lso>VR zOfJ-mY;A@5@f07`a-_U*S2)Ilddy0x;g4+W6#?883EG=D2mE@E{A}xZ7Rt#u6tHs@ zVDg5%`xtubq`W;N1X`*3hwOf*Z+lrbET`|M;yS0+Ed>Q!r0jHAq1-PEijFYs`vC%#rYW`@DKDEN8R=c zTl5OMMNE4RRjyIB-3mLemfGy>mXihxHyb^2siTr}6p*t`vC)8A#*O$MoJf@hH?23T zx(|deM~A324&|)if=!<-f(@~-2Gr#emR-fc@@70upm4wp0uS$#9xaM$pnPLz+M9@A zDu`He`&AIMwf4m&`oB|QPL}pUgZIO8hr>yrx?%p{O%kHE9mrpu`N-RUyrmQ{j$f#g zPH@sH)3ayj=*PKwJ!8@3d7-96xa`}{uz6#_LCDWn`**6LKUP>3`x9hmHd5seqnc!M z(>?8@8CdARqbEB>t1?scv?ts;4duo{zeiFTz^m= z(Yo5_d;s;#5u5dZvn&x-W9|x-d#we-b=hpdd3umxx6WDsvIYN6;T;c50n<$a%DF2T z+i7DA*ak*5lyKegm;%g2>6$sO33nJ!`M6J)p&XM6Pw{&*9jSzq+|m!shS<9HwnhC7 zwezT$fLT@SS_{&%T0Al4)l&;?aAzo2dn{wWzZsG%|04ry!eg44QGx$YSRb?h*1DQx z^kzx;a?4QBIFNIfbay7ngV9ihvXy7%7sQZ>L%x>Bi|!>wkrW0)+6>VFVWJ!~jt03S ziih%<8VpIBo~`Gij2(GPP(Z4wCoAZAFM1pZ9GNlv@I#69bQ$Nb#Ax^ z_IfeAtph|>_v)!8g#1eOIb~#r48^ijZx>W|2l>)d@XZ{9m+B9PDH8{Hi8I0DGYrR8 zg90akGoyT=c)&tp4JbYVgG-cNr%eP;0pibrUl}bgg;C(ki9fCqqF@1mJ>iO5-A&0r zhz-VSx&q-3dfgPP(v(Okzt?Ui(q~;05n~)4xl9fcx(PlYj$go zjRRAuGBub|WG7Ozz_2stFODCQ8pw3vv8X$Di_hE@@f?3fB3O0KGFEY|%3bw9DMRt& zRO_h*xm*ak{4465CqB3m$Bkk@#h%D~wRWfUb|}*25w221-f94IAq~kCK5gtLF%@N>p^ERhG>w8%LkgO zyW75%h9CXpo>Q4I`k?gdb8HA}&RO&w%aYCRWiCU~_j-rpy0gWC4s;TJwpWwKy&L#H z6;k!VHSXkqd{P4ua5CUM=1Ca!=|cIOdbrCMYA~Wj#}*=DC+wF#b;qqEV27tJDm!vA zXV3(rn$cSx!$q-7_0I|;wbyL(lbO!|pY6k35LRcytOOR$P%?p4j+HU|P;Ph5XpJ>2 zu-K5uu<|6oQSvHmN}Q%=eV+c%$nD9?>%CTlFq~XdT5t32VPA*mtXYuK)1AnTdkY8J z&s!8V>%e{Bc%lLVa)yAku+yYsO4hBgfqAiA_0Z5?xhn3O4KUYDej##~zimG$49&a8 z0&ka>seRqZT3gOphvjAc4rJqx5LC)@psOMRbO6=;S{6H%S$e5-6h^a2IV`n&;1RrrA&%ul43D95;;nY%sV`Wo%P4(D$CF#ED_Il!UtnK2Qzntl@+4}ji=4djfac1{0Cro3tAVOpH zug$*}MYIJ(F9wWjx?24B+q4c~6-JRLBq&(z9%Bm~J7+htW_`DN1aTDonr1Ew+HHMn zagu$Lw;Baqo9yJ7V`5JyHz~T&xT$M-UvP! zc@las^2UCm=ZfMyUe&ZUzFIz!)yW`3ujXroE$|^%#ky1eM%fq)%RG|+x$?GDEPzut z+2|#al^M`~3{Qz3(UuZ5^f4x?>eA4Xe#nc-`Z>CNR!Py=RS6_{PbDV(;Xo3IEfV&b!4C+T_1Csw11hr;5B6m&8xQI;O|X7P z$t*YIo?I?s0;xw4y_XVKLUgbmToowM>b(FK2Z(udU%sR?S|v4s+1yB3DMjj>#`IrX zTVV$fkU`B>xfu}WKzh}G)kk?nVV}GlYjbD*4CmE_BDg<=>_F|+3VN&I-Bm40e zlDobElj1?GtUYKX|I2l{W8Zk_I+cvJ$v z^ML$S)R`{g+8B4upYH>WG03O06jLYV_B}l2I=ij6J-W&=iiWA}t{$tg`vQNQ)O6%4 z&Y#j_-)a2TX@FaKSUX~|GuPclelqH(+cx+a4xOb+|AUHt!d9Z~g&?&vXJ2OIOefHr z1QV|f4m-`yZI>6%S4)+_nR$;k>dfBa%C> zi@qx)BpvW~F>PSo1N^zYjSwGE_TOmGl()Swyez%&G`5GAo@*cf2>;hkruSiUc!@;> z55V>Q9W%aoJ25y{iP$m(BxrEFEV&}Mo4Qzpe0+;erc>Kvz*QD292+SgyKgHa5<_!3ZLUB37AK-bKuQ33gt;i2ty(SbO*z#F?Pi8cyM>$Dw^ zm8Y8e)M#g9HVAX5obFh>k-l}|_NT9?BxSJ*YU{^uvfihtz@Q3eLJQc4zI(0l(xnYU z-;NqjqAEnd0>G)sa zruo?+-%@F0Aq8+W2Q&B$I+7=);O)pJjP^H>DaM@S;WCrYnFM?Y8YL?zh#M6h;n1MXd60 z0^{$aybB6~gl;I}DuYCNMDWB~yB7J%RCy!{`MWYq@}b5m*aQdAsso#i=_--a4j|wt zy7dwfRqwFnXsvwe&oX}XjDuOOQN&8tivVR1HjWei74jXDky^)^>$TgQd90r8|=lCF21P<8`HZv7$o91>Lt zVoO;zG$HJ+5qy!*~DHyqR$35k#Iwn7F9PEf)hDT&C4Oa?j2aR-Cze#B#d0i z_Clh|z&ybQ8CsY&@gFkX_M;wwQ)-%e3guUoN)kOQgN?~)Y-KW0nOe`rFb+a?#clg* zb|N+L9APRcbdwedj7*N*)Ev$&zf|KF{Pjl<>beou4+zkvIUW7b8Hfy!onbIbdKDjs z(5xQEG6US_EWIw)kPS%{;68VN^=V&|zWIRrGYk}6Tz7hmocD^t;pF<4ZD7rgaRgQ* z&XYc-*zWIPbog(g-zc#)Kmd*g;Egqz2{BXt!5d5o)EKpC;bHFG9<+B`1ysE7deFoi zEd&gkLGuAoPglgl!hqpRf*{%jqFCNs+pFXUp-C;*uE1-sz8wly0EQ*nJkcJeZHfWq*gt~ua8`~`oqMv=S{OVK-6NmOY_dNNU5u zbMLkaEw9a${wGxB2?mCM1>G+X&k-H{&0In3oNHK6Li63KwpV>q=_{ipO8e_OT`tct z&WF(L@89kHntRw54ZS|_=JqX397OZBOGq-LP{+t3ikf?Zu3YF{U~Z|x9hI6QQ?dwcSe5Ji}xuR8y9)ukYo*#{_{h!1!h4pu)+ z4#l=gY5jZ~E=Sz_gXqZ*?}@mk>+YtONIQEVGS<#R%EXdHnK2VSp~D)MOTiHF6K&op zI8oh({esrKH@L(U{PP7wp`j*0$jyIPW*K*U0qHb@NRcAYcI?i*#^VH)8dXg6z!glu zd(q0~hHG?UXZz-<2nMY$k(>)oEC2+j0t~L0>qjhZ1&U%78Y+cmoM4*kHqy>74Q2(? zZekvAl#r@?>hMF_wtD@kl0Vz*FM?#`dx@_UcTU-i6e9vhiAlKJ?%Rp1^;ZgNCUkT( zCbO9^RmwMT0~W9QD}(p9Mh>@2xOp06s&JXGhwxSeDD35(YSXcjgE~q)m!A{6g(k6T zzZK0rj3PWF&8Q)*BaB83qZk$e3sff{mSZuz#p=crW2 z$0pN3=SNObH&2DEmRG|F)i?JkOGTpWnGul2S9fZ$`y1MbG0m)(kx2J!C4;Sq6EeZA zOetjlp701HZn{KlO7vFkpq^uy&+W>Gaav!yZl??F?)qj~W_x7hsPXezajLc>AX_vZ4IZfXA}ZfhsWsnV>LlNAY%)F* z<0Gat?ropRz}zrv>?-`nSueTicbE3R1@hLBsk7RDMimGs%6C)v zeh%AS?a_XOQ{#Vd;6(cfvs`>UWXwd>%ZEVILc2WTx5Qt@`UdK8PBzA$Bx}e`3E4fgiQITcj**m3fU-HM^l^ z6RK|Qxe5}gioa*K>ljQnyn{O_s3M!Ud z*oW#q4QzO#mXKvn<5k15e5V##KW+o)nqfTK}ObQK%1@SY*p-@uyBbG6P597s}I)2r3u(aPY&&(r9C?4@Wy=#YhKBP#~BBRVr(HAMO zNao2*A<=szpgW((#7$h_P&YsDM4VEH;e`6x(uylV3yztC!q}v_8xg*l?%&f6q_GQyF{_V`w_siF)7N z9Jy@p1|<*Nkan5a{LjT5Q|3U9jE4qB51!>2s;&50qh!&AwC@3_6H)_8%3+MtlXwa} zoTynY2)(c}BFDueB_Qn!baUH)ADzzRn7m}H^6o;(ux3NCh@(J0KTwp7l$e-UKc8Vf z8O@z|)^2W1G&BrV{)ccYjw#y`4KHP+U&MIGEfW!|4gR|v{E@#}6Ta07rRo-nryA#G zgsDfvH$Wa}h@I6b3R(?z*Dhz-F#Ze@b{OkHQ!3V1HFAJo67V#cLgt-OF$?&_Go9xX zBkIj47igyycBIgSwTYaJ=mj4WwSf4ITT5nYHx!+EN0MIDx@~F?#)bZSUyQ~Zt==;Q z&w>wE5q+}NAbu2`I}e+%*AQH{l=b5$$CL-hjuh{={fNezrn%tAZrTHP*3!{`-GOa2 z5xL20CS(&h8m4l!5@fkyuR~=DC~H8@iQubL!|^9CI5fr?Fb>zIG>NE~)nv5PBrF!* z5>}D7Zrcj+tS)oY%OHGkR5}bGe-vebWKT0@kR`Aazp&U(Hwk3bB7o8)PtdQTgH_d6 z4!PHeNAgEBM(H44Po!tABi%FF)#LP+lptm%x>|KD|Y% zj2OEtHMm^a#YxHr{Lr~3t8y5P{l(M5wB(fVv^@7{eH{ZmjHAuDxdrvgMJC)@%9`Fv zO;jpb1IYu1sVjAnHeRN*iK{A%*s$RRIwa&eyUybiA$c*Oc&0oAGzgx%(EkaK_8{FEi|NPK${o!3M$)8xy2L6w;?wl;c)wn$gQeuoR{8!#1bMFC+#Dj%Vfzq!F%Lk}{hMS9Z+cq` zORfShtMxiw9`wyWj}BbBxxXpCZNHwX4>P22dB2-u_cX6cT?~iy!2IC5y=lKUNPb9H zA1;?x>MeEgzkN=Jyn5C|LX z{oSFvpD)K8p(ZX*dA88PMK)l=iy@vhc7lctU<6HJa9=b}k?9q;?AG)#U3A#Eo)5oM z)THw7EjW%WsXYE=I|uw_+x1t-uwJmAK1^8B;r>4%Up)hlgt|zk3ZXWH!&C6K z#7cHD8MjcH%SzJU&6OCLjl>eu$lnNpV2_SN5#4S_(mLn@^chKpq~e3IEIuF4UPAo9 z|Ike5!18=+9cA;BML4TgSHc-b{CGhDEu5;Z-rOPl^zcGbq3tEm@b<~OQl&i0lcn05 z#TPOkOa6iGcua=L^t3O{r2vuydqeuIKyGSC|MX@&W;qy95kC2CCQo18*`pSQR|^=P zEdx?{b;R6pq$u8E)et4D3c828)0kqMFO~eSM3^b;$O9$|y(cJM zKZb*i8cLKH8N@W8&9*$?_Gm-X8M?+FYd*Cn*5ihq0w7Mf?S{01`0f|r;npc;jofNF zy2Vq{m#$({glw#44=k>u)ZPqHtKEdW@L)qUi+G+-o%`y}%Z67PAhf#83K2e7BYv+Ob^5FeEsTjffKO)LyS+fv6vV;bRsV zaZE5T1m?gS5t(&Ia?w(fU1m^fB#1E48lVQd#vrd>Q(YeU*RQQPrOJ=k{C5*^D(>tJ zMXN}JRON^VRhMor#(8Yx(^X!C_()YxCc;l@z`(tFpLAqGM|#2|kJu!X_i`|7o*@!g zC_1_->Vo!HhXOQr4zi5efT6|y3Z7&@Dn$6);=RBRGb8Jffs#-%4@`J;a!7cPMzHC; zDM4ZeA_%L{H5AZGox3U(`okqAQpBajiIU{8Wx4stU>~0j-F8jz;IW_eNga%6VslDn z{T;%eW}#e(;G=1EN9Te;+zeN)86%XzwMVyhbWa+xK736@EMb zclo1dW4zJ3PG`_3oVomk9 zNlRoO{`hp@Y!XDwZyA@+V&oH0Go&aM1#r@K0Nz$82-#O{h}U zXV>zLnC(Q6Dt^J2*O;n~p|cchsKu=GTS%=$J_Ey+CRi0L>>s#`DN3@HY?j|XaG0tf zA0g7>gGQNb=!$ohaUz|^q71sUzCFbF?UdVEtaQv{@)vGk{JlN`g2%(9*5~dl&kR$K zrd>m-=moaZ=MJ;2dq(de_yXI>_xJ1T8{7I(q0svWddC-63beTRFRldT)XAXNd>eKn zH_Fp)F8*CioJOptAKqq83EGg#JsY!Hk1vE_f0rRMhD zoxv}%AI~d8Y+g%?Db!GMX0<`Sk?Uw9aO})H?x`)v7OsZCS-p=>xV-#%O z4?z^&a49L(xQgO3V%*50ntr;5Pzd`czgOI@Dd zoun=J7tobtWtCU)9a>Gop2)toTA0=xSUDXATz0&IZd__|GE-kb+_cb(2VZGqpjnX} z;OgXfej4i5rgvs_bpVObpuf<0mbv5%rj>A8lh$eRH7_)*-Lz_{EUZm2TmHkvL4v8& z;5glptai9^Wj&3_1p9H zsoTxQ>C*5g$J$nPg9}(oV=l#%OT}2+oqWCaE$tcEG7fl5bD0B0_3^i& zk0@k)w1e8Bq+s3Abb&#-*3NKU6lH@a`Vj#&kfBp3?OpcKg6Kf7hUPrEl28=k`R_{- zH6`FX3@cwi33)H~6AlY8?#g?PW$?Q$NW4SqqzNoM9|z5= zo{ws0t0i8l=)g|g)0I=@{KUtfkW!|oE>$PElgr$PTIo@<1jyj5CeGk&172FK^0(st zyA^blg0H#7FIK1E#RIve?3Zy28MBQ9Z++=Xg3GjHWvlWg8x@n_nbL|sF&F`=(vy0n zE{YHb7xt`sT~(RM^iqorB{XbNbZkFeet-xq2H}b>2E0AqBVua&TtP)LQ!i7Cp^tE| z$JF~7K0LjkI>^v%-W|R3M;`)D9UG2S=OIOspjNno`M4`Z*qoLg46FFEnO^#%fLt!W zStF8ggRQ`zN^e<6r^<08ka2!#cz*%)|Ez%*j z&5aSpMch^#cnN?w>%YM;H?CTlxmaFVSiL~|5^qh{``pRiN-=6Cd;kv9=T%g0fl)_wO zUGW1Lg!mq03K?mRhsGd-*U@qH=c6s?>t;?@#rIL;vobp_1ea-@?oLU%Mi8yLd2?OM zrt=$SysE}H8A7H%98%`L_Ov~N7()@+#1Jm!i`|I;u*o2-#2T%CGzkQBD=Rtu^q5V-QR77BP$~Vn4)cYQs!o@V;*;htaQ4gi ze9Ohrfi+FB6AFg+*n@jYqH8c{AX;n!JB*N)?uOhK-!){Q%DH0TQhHjpl*Ws`OmuO~}|u;|_dZ z@RN(BNg&;s$55LK5B^YF)TTDxr$=}vVK<}l`-^`^1;gWC#h=jRd#6#NxwhVkP?dEs z#?17nzh&%8TQoDZ3a|Rg0)?58m`yintv+RomFZhFmp`l3ApO|m9I(?{4(GuS%I-Xf z|1%jKH5yLNzs>F<|3ahSMX`@TP&_T{gNNnPf^szPAP*R(g}{MZvCr0cCQcB-H3^P% znV5^Mto7yAUpBbjHwNUyk<%TM4pPp-AnqcyYmwR}=&pA;5dA;tmE_ z&v+w`fj%8+#cl(hq5uj$g?iX|#Qgo0P9qPPhqpLMsS^w#(K!R{fE)2&oPhB03hg$>`?(3#sEWO2`>`mY^AQqNx1^c)KamSR?F{p1w2qKEe5Wl9#p=^|9P+=KUgG%{%l@EWA$mpV$nf zW6NhW4OK4ReifV?D5`)iUrL=~`U&V*f1XF#jtK$KzF1=y4hl+<{hg`GSHCy|ANF{F zIr`zM!!UO|H=d4>Wroo{QIE(1{U6h3GN@BJ%H?RMSI#&3rr-JT0??* zRU-)$E!LpXnBz*roYTNAUeLNj8_ef$3Lb<=q4QTD+!tSe;J4+o{|Ua!GI|%xdNs}D zZgxfByBz)-&1jlvsFN4OPaaIk3|0X6(=T5-7T!48%7MP3Z}*!fbI~pupSGF=6G*AU z2_BTMxuqtTKihm|_TQ}9c`uD;<|iepS>QxMj)L2;C}Sg3ze-UWIxAJv1zO0YPz&Z1 z3zb*HCV6JkfbZsgXT!MQ>(Xt2r+C<4smsb0ygw^pFj+ zvAQIU$$^K<=flfYI77Gy|FBo?lW~3=Q+uL*jP%-kliXD~us@%~pvn%(U^R}F%p^oX znJMfx2|Uz1o|%stsKFH9_so5k8`G>UI8gGSxbK6`+^BcZ_atqb+QU-;loQM}isu$| zC`oV*D_>N=gyqpy>h(RViw?M%J#cHC0 zN%LqzC5<7Fb+_`sL*SRT*7Lyd1w~@b7g(*>f{{1UjJOzuQzLM z7l8|zAy4`EQR5B@;UV<>gnSX9U(7W=YwDRtpfK#3ocd4)T1>pXh9FpdOaMUQHH&wP z=(hWBgL$*%HyCE?LzTVO7p-sQC^k|{pCP4p>c4CqL4)VM8RW!D`lCU$FF(6zdT9o0 za3-TEhq4rjg&8Nvw1%Y$j0-=7A5E$dUl$~rm1(d1vMoEyE4Le@OqHr9taK8Iax8A7 zWA5@glMV+XpXUDi@N?rk_>CT?GVF*i16sa%zk0IUAX? z+Y-Ou1BtCcf4zpKq4q8`Jx`CP#(@udC~q0O^z8j;`sPU2q^T8&<;gM{icFw4$TERg}9O+f6LZGN(RphbB& z$E(#dyO}3I-pFh_Lqp9?9u)wo?^Rkax4d#Hv=qlPQ7A@1=<$rdUOU)ZvAS2ALU@u#X+>qNf3l9%&JnKC_l9#Sc#5vthip zuUYbwx!z45;Zq^<8myJiM8(`;`+OKwXTtZYv32y(<(T~4v%1)4ukuNhyiJW|Qbc1#)fSCX7Cr{vK%LyDT@vr~ zz4p3^KZ)6Zm&g*M29T~&+B-E&e}nZ>p=sRg3%#Lu9-$eu#&jCRu?{FGl-tVi6G@h6ZWIEM-bK zSV6jWi4khS@iN^taq@{56+G3g2obUKUB7z$RIz26P#U-^|MLman#wK*#0&h>ef6Vw zLkIem(dT?J_$sm;(ML91Os}AQJ93_@3jtG*Fl)_+C-`_>Zv_6zDZuG>#mQ$W*vZ4; zhuof3bXH{yZ^onN{71G)StsM?Fw@B;_~(Ps*k{?q(d(3@ zrg&kj4~|j1gL&QLS;0&4SjiMz%;`-tXRlFB{AAQ~Wp1rPmx=(*-&?hYUYs#OeBJq{ z$G6-mv3%V|lV5|Ex0tU{=n^VH+}ha zJeSCR2K3>l;fedn=Ph6Sc zUt3LG%Are>PAIdW9=<5!t9CleSL%pLDK8>1{{I+~FkYu(uN0j)cT$-8Y;M zCdPe8I^4Sw;~@wSy8!h1qKCM>B(#Z0UF5jEt$WS zP@)vK!=8J*T$TH~fZM?>~eZcHP({eCRKK6R_BjOClxkE(tZ6psR0f~pYonz=m|=p>dT4A{AFY^kJOw&pjX3pz z`@j`HghJQ9k|Hy`q4M3fe(#F(uK>9x!|RCB|F^7kd*#V|ckIQ#NSEp9msatw}cM z(rH_M*U4w}oaE=oG?+!0_=TAivsDk2IPV*%ks^qTkomtb6B8H^HRd};DET3>&0*S` zyMZ&JXOnPWbm}!5Y!>u;qy4Zd@NcQgSvK_zZORpb2rORA=vG>SA6LNS4BdHE`lY=& zQ7*bu*3mvT1ojoH2~%+hd89C0;FST)8sWzS6GNd!s;%$Rv-k4F6xJ`1>t7)wB2han1|7p<$WX0j&LU_RNcd=fcGY3 zVYqp^hOu*O!;8eY?6De-g~_0x#el1{KjBwRtJ>I72@VqbbN#vOGA6#}p1`0e!6NG9x{z-ZZ;XpqGac$5P7Q5;R z>NJN+zSAyz;vta6Yr-kENNCJe#YzAUU@T^N zAGMHb#Fu6&1(@#;1ifA4FmYHxV4`ccZ&k2U5sxt;jOf>Xv+F@FA2aJXiBwFs!>~5f zXZ<A<{&ul?V|Lac?y@+{Fn=yqFthY1yeH-rjZ zlq!LHE8-mlOm=S`X@2?wfT&5!;N3$rgesQD8F|5TeZ8sy4lmU17DU`T8pf2e1J&n@6jl_qoN zAxkZu<7r)or_-b;!7{YLV4%q(Hr%&}Ep5COqsW>;D6pG061(8RjP=U3U9|_y@)nKc zVKrd+eEm4n-#v2z;Q~zy8n1OLXIs^}XpQGYZ%e?`4ez3(4~^>KVT+fq+}CWJkzwh2 z9Vuu|YkKt)bw0qiPU}sne~MzF>9@G79z&HH9GkFMNFQ3E zX(eq@siS{`b4E>2>&X$z&J*<7ZaB|2-Pp*s%=WWEOoarUzBIkvEq*YJ1D0r#x#Ogz#D(!^pYkjDtROM<8)64d?GPIH@FbVlX2uRQg9Kmjid>zKKohZ9Pl zxOT9fb6sC#N-ue%LRo?rL5+D|%|b~zq=oTO7=`=v0)esNpB6UfjE* zvNRYUX+9W*%Sy8LCfHNZnEFe~xo@9TR77w@gczvyM*%5c8YLRq~E;x{TWZJLL>7 zb3a4yL+JS0x8ARo&yRXGagTC^TA_*jmP9R}8FCz`AtDj}O){vwP#3Q};{}!m78jf@ z)3v{8hanE#Hx8Tr2-%NSS01fnXDMBb8M-Iq06Qll%dr@R4__YVP46(4c4jjlC&R2P&ccriAh?N zJ;;`&oDFo@e=U#l?EJU@!Q->Eu45c$u#o_P-Wpjaqb|@w1vN`1Q_F zKf9^eel@00#=@1*fr)kDXSSbCMoWt`FTf-?GnqywCH%SzjyDL1FlTc4LzWwhh;(uy za#)l}b0l+)G#aqm+>QM8A8WKMUPR_b|JJE*;4VHWQqJhRCscA#G@{u-AiN&Z~2Ai2dt z4+ICR=Ly*BlWUK*nxwB>wBMzO$W-CrfTVgVO}Ia3R6aLnWX((WXxRqFR6-m$KzlBo9GQyI;U9=J0+-zRLLCcT}FsLs6< zabQo{xCyZZ`pR30G-g1dq(MwReMPoona|I@U-urq)|sADjIR#j0(Da)_M^udiBqL; zhM(wBEh|(W2It2Tkj=8dosAKlAeq}Fv56*+S-rl8n`-iYD{V#N+Mz8|YcY+G$0UCi z_S|a>uAzk6(|RzKv{_2-%Q%j85dBdhvE8@H(?~Cmlc`?=AxD|hiH7{+CVQ=MEw%zC zoFQCxvmhcdndD594NX6Jtacv0r&h7hPq~sv{%G1sF^p`qV_;l2Eqx5ar#7m ztR{#E5b^Sz4qbjgN={0+F|4boXv5oyDo;*T^K3})0hr#gk4w0TDs_wCgZbE_p}68M z{9@viMA`CHOiUUIu0}i>;X%EqEe-SuAeCFbosTl#Jf%4KKI2S|AJmTjF@Zz z=Z)MdNUH8gTx>`@^dtzxelyZU?FL(mFS{bJSxJr+2-h8K@ys`O63^pAXHnC4JyCu9 zGl$42VQa-bx~McS3<|}soAoMt6z~Z^OlFMWP&ueKAfjK& zm)E+g4xDC~FIjRTa-7d!ogfjaRtzx<0+3feA^A%+a1S~a6_&|JqVPJ@KCHWI)?r!| zEo)pK#1wN4tk}J>?q*sV7BPi080FJ{uuf(K|GD0^L{$K*GDfC77wpiwuq20b^Jgmx zi9T~s<4I?(JgGR3;oqI7%AdMTg2}^*7VKi+J$8@l_RUpG`H_Oe>1R-ENc%l34`Y%0 z0=L+_H67rF^~kK4DJvhq&TkrNkgbem3=^=&$KcPb&NH)HCsk})#e>*whzGH1<}uDZ0X2!g)m>2G^jUGdtr z@295mwd6SgE8~m$+3z3pfxSR73@O@W=|0mb&;DW3}aGGy=)n z_C(QHgzq{nXNl;~Eks)iwNFKMJqSBtIdS46F$nxGEjH|qoaR>H3vC&{;EsyEUKVD8BO2j4_$F0zV<6a zxdG~Ua9HMH6xsPZC}#97HR>8VrQ5S~y&}-k$IHxr)n#+kDbWCj9+dvzn`vtspW-|q4iqeRrrgNZJ)$a}d%d}auvs!EBAJg2V?Fx(V) zR@Np!H`23Hg^^9!!qExY@5pcgyeemu`!TH%Ph;wJCAp9|Al=AwUV97~zlPFp`r;w)8xKd67r0MIjs2>?8@Z{Dnw&lDA{TDP&R5NsnP8j2- zNBO?USkUaj4Tsgw6D`v<2LmRkXcLH%8@0a_swZV~@ZVQQ78@0nCKABy3Rq1@=wbDU z2p7g%{NhQOjfow{Cv*GbGk4*gc1mE=%fBgThPMQ6N+>1_YXHgjU_@Bo7H{O2Ef#A| zfWKleP`TJ-R2jkkk)L;d02ya(@gb%b5VNV*7Yxz`E**l<12+Tu0%FPQb-SYQhSMt}V|SXmBF&p^u4P`h^R)l&-b~9XAgYK9%j$1_Wfp zCgM>RYP^6}(y|#W+DAh;X_mb?(W{WYsO9~t>&^t0hNQ}lb(QxKxp(d+4oOqB+_d6T zLT-NT&sRR7lCg4&^J+l%e)!RFqVkyzx(`&Lj*f-e@1fnu$P{aQ$Su8YxBK(nnUCr5 zOCQ&7c~8BMOVu%YXBbQYMv3tweW+?R*XgNSl?-p@zulcX+K_27EipNM|91cO`#1RY zRe=`Q(w3-$Qrur?u+^&S&;|PMbwOr27`l-aj!dAJD*;J3DkNC~AT|e zjJ|QnA0;)<*F&Txy9%N4y!CS)xeH?uGqY>jIF&GSP)xc9(OQ=l-Z=fgrV=yeJK@z~ zycR~SYDfi|W?1}#?{t+dl!iX>+{RxJL;)LzN!>)y*VE*rp_{<&E}oi#gYCDMzxW^5 z)x(g2gD7YIi$}vf4fCk~FRH9k6LhfP?;snW1Ea!JafFED;=~75XC(81#PoDl|Wm41|oNcYSKcoi9tyzs1;1K zl_od^;2SN>v}epjwoqH+!ARo;>ITRarIpTa8J-gYA@csJY=!kJAYKH@jaEwDVG&p- zYIjklyTgB)Q|~uTgL*6R4C5?a(EiwOgZwcld}Qc*%iswF zS^qCSIY8r_3)S^%0+|aq-<-FQKQ`mh1t>_wR`zGIzGQ)ah>S``S~9vM*5wV8OI=!YqN?lVc*|c zg!h6_&}f<`m2UbJ!mf2f+(SR65u7Pt6PQe<*8-tjb+<2Bzv2lxzxxm7waAh-ST2+S zSXjSx@U^!P#F>#_p78t@fO`ANvXqXAqQH2WA!lt9ID`0x7FiIX?IieD1=udl{v4kg z$&Sri&M;ZH*%4!NKJ@q0{B|nALjoPuJ?;;rt2NWr+)F~h#!0NZK@u=_o7j#eXdRJj*;?hDf0inI7#itwrzDvIM9CZymlbQiI%%eano{D{nTfdAr6cs}!LIA@GsOmAZS8G6 zuT7a5J+GtYmo7?cO#-%ino)ni{@P87WD>ftPnSm_5Oi*{VaT3p&C%|7j44fupwoT3 ze#zn$@zYydI#R;L_>_fds?s!eb_((ctmYk4FY~%m%SYxuKItBWDCbS%oVW%8mFmZ zn|_2LtTao#Mhc7ybWzlylBL-37|8VG>~(f4sRtgjqQ%GDFEWqP+Ekq1H49L0Rv9yk z?v;S;9nNKov~A2C9sJHLY+F>lZqqf;cFEN6i!lgx?mTox>_k|LWh=dVJv7x7Tw5W9 z*FfQF5@>D{Q+lHbv8!_i)30W-Ju_748Wj_1QmucGXqONa|J9NAaW7Jm1ShL02HjAQKcOF#i%l>U=wc90~qH{tD6enbI3A zk5w_E7{*Itiv6Z^^x|x$Z@c?@xSuwi#lFa37rUFu(|6g*BLP9poeROQ!++F(VDQb2 ztbcCc*0dnS_YK`K^9}=T3zOY{@Zj8Hv$Mt{=hJyvNFOY-WbQ(852Dr%q}dP$ZydY7 z5+n~EFTP^ro0Xr7O{+bA!)A-t#p`}^fz5Ece^}^}%*M~81CwY;ny`S;i*KQg?TsO&-Lw_XT{ zos$0!57}F!0yGAIK!fj)nMp^fa?s4T;esf4hOPj68Im#Dd1{+sD$2*l{qyG&1v_zK zd^lA+4h!~uw?i3LdQUp8Yu?a^@c-j_btBmCUE^8GwQ1cMDn7d>u!crA&k z`k6{CPUfWf%M!1wGg;bRT%{fvGegkg-qYnNV|~--^ZKh$cBOnx`(|SHs6Y4h_WqG_xVgE| zxAW_+;kD`;&qrTJUT4zIR;V`O2mA3CX;U%D0Itih!A(=k<*IQnTET#H+=sshO%_hRtrY4U{iri+ z=)dfrIY!Mc+0pT6#S(FUqbVoBa{QU(Ixs!`|0a^An)$r-w=;FKs;gBPdNo*FMTj0U z$}jb3abs0`?XxOnvoZu5goLeHcrwwZoUxiE6Z*&+!>)U+l8IXwx%BySLIlB>n7NqR z_<_~omJwpf^k==fEMYtX^F$>9k$w+q3()rphUQ#x67H#Hg<41-3EtbQXiNkz(>;Sw zlN{mZ2|Qnw!kJq`cky3c+z_(f?Xx4G>w+3FphoEX^axE@9K0VF(6w6=xPoU7uZR=$8ABnswk%vjA&aq8AgbzuNxHIKmmr^aXvyzvpZVb&3H!!jz?|H9Msv0( zcq<*>HZ64EQCiRCQR)bg@Gew3`nQwY>0jv^80H6Qy92Kc;1s%ADt9f#A58kRsW$T0 zo)j(KO{Q7M?e^#jB(CH|k51v5GRG5HtcLO-D$vNOk8SfIZyip6PEwhLBKU5a3D!eb zU@~1^E<1UyWnXljrQpZwODJqb(;0MFJwO#8jw#yO5?S3euxIwSY&TV}VQa|FiV-xX z9B!ztLO*>UnR|dH@WN^)@(C?iH! z18GikeD1%8A6WE+Yb%HpnQK|^v;zOjxldyXf8Gw9uZn9{7|xA`yrMGn76g4TaEE1O zUa~fKJ+rp_=^EAp+Pgx_j7f6gr|}Wz>npJ>1|QKg*@%C{Ej;Sbqt{TEReqrk_^ED* zm?l}txzGYs{Gk{?@=v>iDhg6A9XzJC_o8*n_lKGS>mOZNb>?#5ODAUki@kenk8@G@ zzaQH+8Z~azpmEaJwr$%s8(WQS+qTiLjcxoV?OJ+8)q#8{%trBm4O4 z>$1E%h=1M%sCXQ*3|HAUW{3Ut;@eZBucx()_JWTAqmv>VK4j}b#pXtSq8f0iC03Aal5Hq4mz^r2z1?25H z(UXz^>HGF4EMv=A__Ewu;;X1kN+ zb61dzsovhIZvjSFUq<^);;#C{6HIg+Q1;U)7bPbuH)z`~#gxbEdVOQd5yqotyjt6o zlySvmN}&OusbAcjP8fcAJwpe5aTPSw0`{Za(NG)w(vZ_FD9FnpZN&-DF=9v=S9((P z?dR0`T;@vKI+(T`wMUdx_yIg>Pm`j!imK4s*r~D#(ws6<-HvE2Vvhs5T(Y?BtY)8; z{Y)bEiU?CyQIm=TFRbwopB?sXsU2}lSow!9j`ZVZXll(fK3#QU&E+;!_SVOtMs^R+xVGAYBhW>#0=O9xle<=tTnc53OJ4bqP(bb1ldAC0!VDX8-g z-*f28{#4&2|s!nl1aod@26&({zl zuXu3aYo=<~68T2mA0UdMZ>KkmcpteQ-vNV`1>GDt`0FZ$5HbkAqVJ(@ZFYnq+!sQ? zDV;*eDwNq*)c$)N+m0#$1JQ{fvGwlzd+_gYUz6$aeB8C89rO@}p&f(wjP3?z_E z&7hNCPaG2=o3wPqS7->`J9ua;71KZBfB=)A8`{IByURY!l(r{H>_Pq z?IH*-Ca3OWu|s`At`DzQ<%aHY8-;cvS@%Nd3_m$AA(iQIobLt&)ZS>^hLcv9l&u+h z^wi6Up1R>`D4I}yW~h;gw~jCP)L26(2Ra1~Nn@NJ@qVc{#@veIl4;R97Q70p#<&p6 z?vj}TA)_sIKqlizM*Y~VA5L6D%147RbzY@6wCj0b`y`{B)>BeVQP*Gn#guwr$jXua z%0=gtbGhS`JWA?E#F3DIVBk{_cv6+OBQ(8fA{icDR_hMJ@&-zc*?p}W*pLQ82z5<9 zG~FuiPJhju?F3Vj^`uW(^XgZxT_2sdp;#l8iB)ym46A;twlNwyyC0T zNt_DlCxvhvl!_n|cM+8PZWLjV=zWIjecR1udmQSyy@YG$-*trn3hvFP3K?k)kbR>Z z_y8?ghu>aSYX&fraR5FExI24)X@Fm+a5AoQi^<%yKx>f0<2|dO*tKewXYBg2ALFX*QiL%2%LnHofyGV8er>+J)uSAV0xDHOI+hWUnoNJ1tcr2$%tlss6 zt)o_vjuz6^W_F?C-kQZq*iS6i$~|u&es4DQx4R*U{Hap+}Yr-W%kC$8EnJ0dwNUa6R_ajRPILLUv5A^Sw)hPU!FYy-} z@&=69mBTT%;LW=qW2e5um2KXlA3XTKjuJPtD^J4wfmm>o2p>yic1ccv+m88h}=Y9af zZy!>Ahu@|yk-WBDnG{7hf9<9mD&6j+GqntlpeKBi`@lDR z71iRY?#%1^tUNIXa=8iH|4~5&J4oz1^1MZO9LRXJuzVjk%Z;ZyyeR(04PtitkowX& zO=9X&qKh9a;yHm*vv$93v{|p5gQwkh)*9<8+~r#6sN-ok;al@C5_i_YSkKg55q#0J zsxzO5u?6-T?H=20-wVkl}Q*nqpZd#{&1PkNC9-~0%KCe4ioY^4~ zthu3%NHc>?7pM;-!L%hxw1kougXnc2P8l;}xm%sI$`Ca7h{GS1SIj<4ysEv9FK>*@ zE@3y3C!%l6_Kg5zX&;uMI^DKRv5+F#7sn03<@^rzAc}3`9X?59-?sNBjc|euV_L!k z(<|JM+KmQ+F(!5?h_2t(ON5mN`&{!aq<91;%qlOyEY}X$Qmo({!;Dmu*P`tNu|Prv zF(eiISd4uBEvvoK(rT>%=Ve3N*Otd5BX-wuW;}nDyM3{qH8jgJbkJ#LgLAf+7$r_d z9thUwvLxd*=}G;RzSZ9z2q|AM)a_zm14+B4S_FxWjqQwnPUk=$(-qEhfu?4)GvKty zsh_4F|Kj|H*cJ3Ap7gOB+!Reb;*)$sVKUiOm1CmBIOihSu!AV0JK1nov`aH$Cau6L zqoGem7;ur%S0fj#mR8OBRk*<0YWr5ji*>I^@>!0JUXLw;MP8|N^KhdS@w0Oj?#DB= zMzNyk!kxrsn;QXtKNzsm>Xzr^OpGny;z)-sKzq&e++2*=E$-BhqR`QUfX=(EC?3+FG%*oh`dgLUFQv(Nr$;O$)6J%mBLeDedV7@of^Op$9w_3&> z!l0jcK67}xK8OYlXA-y4s|KCMAA&zU+s3hP&svTA%(fqvkHZ}3uXR?%mu4@`v&+>q z6E2;LB2RXFz=z-Y#fH-I9Azn-v{~)u@PKbFl(ad$=M1>#9zoZs-~aRSixZ)ymvHHy z2j{2RJ#KL|y#_P$>_Gsp2Rs9K;hrGik;;BmLBMZv+ELEhl(p4(wi6{-rOz9^{>jMI zA`wkD`{(XTbm1ABi{0bk!4De1Gb`^;*gB*TXnq$qzTY$i+*6O57}_*+vtR+ds$kmC ztqd#U;?)%Q%(*Y2De2tlrz~HH)>?MM_nGDxI|_L$#ZMtscb{cK+&=G3!wrvzvHk#C zLv5cbuIH8=H;Fh1jPFR&0mdI)G%%9@{7am^hDq`rj7b8qnN!p-R~m&9B@y?2Fj*P~ z9OVppK2^GpD2YW{amFS8Qku00cRf*3uVGYf0NQ2mu2VV>A241$Zaw)yixxy#P%1t%%Lq>k+=|47Wn z|1L23e2?8ua{3Pzx9>KwGIT?P~SoeG-1FXj4 zXd1PJETOwPiL@b)wiINhv0x8ISH4;!p^@pg#N<-{_D5p2Xm9^pVlIdL&dMR88r=zh zkh|BuA1j2o=Z2_(ne$%i!NWjXm=CHNdc4`s0v`|B^@}u(#rDa1igz~=?e^MIO_fRT zYxBPjHVHk5o@faO;~gH6A6R3KlQ(pcGf+TwC!~<0<$g%{_R*~uh0^KBQ@!Bq275;y zWTGF<*-L_3|0eu0mnvzbx=_+r=9(e$-q##s5XnZ84MGJ^c#LFijQHWI=aAsm;wb=^ ze#abx1NG5-C#tkZhF3|TU^P{W<$Q`2fBt?^_6i9o$b^W7SY+7|BPVW7)?!!u$pK7 z9=QW`WL?d6HuH9??ABm^FfR3;xdIe6d*jSB7HRwzk~8$l4=i1CQ>0Ux)wCHJeZ6fj zc^_<>%F^u`(2=lkQ|}Y@o+;`q`+Y>}Dc%wKLqR&;;Jk9+QS2t=?`RUuN?DGZQb_u~ zEBA<)sRaSBmRRdL$|kht4M{Zez>gZRINI#J&J&>oQe_cU#lGlH#-y*VD${B**ET4j zWGgjDN(OM@VKk_CSbJO~&3e${DI&?y$s&QTs$oA(@5P{odv08+snS0v6hIN$rMLKD zobnBwA>jDe8rjHJ*FTNB`J?3G?fAf9zyd+yRhM`Sq;+5^VjFimK?uzjr~-;&pQ$v= z>n&mJ_M`QjEqdZD!X+DDJ$i0h?rlKdC1%pQ#57{=aaZ?TB}jlcD<;YMwA_>HtM!xk zNyON7ASg7Q7C#|Pq3XWi9w0Hr_af~00BdJK_3Vv3dSL3o{b}Tuf&J?24-3JQ_hJ+T z*62V~Q48W?1dHLwofG{?QA)-dbzx3RBXrfJ4|cRNs4Zq;Fl`f)A*`D{<&7Y%3xU)o zy%ZlHqMal%d+2Yq4~zj4lk#5@vlr!$#N^}%l{{I1e-R;8w<%0P2a&8s zBc8v_Q~f0|fqzR(rFV%*LDjm2aY+J@m~l#>796!?=Bp1kU*d!+^;PPlo$im$=SMf= zACwucp`T2Wr#SCrT}A@`ekP7&3GHx~I(LezYszROe9pBpivs`YKK$p5(a(7=(DcHX4y5%A)Ct_Um#31LD% z=n97p2~YUd8~V=VWgiy+F+X?wK&{648)BX=10ZI*;%|sKNsF*n`*leV1jJPnxoJR8 z@^sXoe@Ya*|b-h-ST5_U?&)f^HJNIAugXj0_5Z_2b!m$TB%z zd=Nj_o|uZ`bmpnf)**(=?2|T`H|!lYw-dZtJH0cJXXZ601I}rjcRHS-ryns#Kh(Ec zSp;pG!@^jkv6Cn=2l8FLBfrVM;RXe1#SM|ANSdt71W83yB+7na8Tsxo zo$oAc5B_qPV*k})+W&{c^m%ufmd``9TZeXESQ*HWO?OIoN`*-7BB3BtZp2 znp`3zjZr3X_TTr@xzagB94Gq?bZnh`k_)7Xl23OV&$B*HOO|iR&=s->M`CG`$m7$B zNC6xs>u-nI{+GklY)P3gT@~se3O@Lr2<5>q1TArFrf%hmyM?+ToK`qX_M@^ZfR-6{ zJf^ZQLQsN=`BuHSZMcT;9`VMDP4rZ1zmVegCBFKbv*#QkOyn32w}R_7X*??3=|bGi zCPMfr441H467LCrgNnK%rgK5HO$oq6~zlHt?_+ji< z!@jR2N0<70EkN0Rm2ecJh6AV_?7pY5*j{KWgmh;pPzxs~oo{yGZO%0F9O=)ppxr0a z%OOm)>MUI6Un+%Fsh(R z$;RJcT`1c0R7-S1HSPPq;m$Y6%B7Zg#+RUfskUD0Xbq)U>(}(@6^@L=FuLi77v(KS z$n*2ixuK=NibFKC!-?Jw9*DsCq{2Z)7=0M|Nn#I1AGBEf$MmT%`M!pzFLbDo+mCLo zTYiSijv+WgEb<}|3;|;_o5!4ET9QnM8ngX$QD`6q1NVI0tni z*DTQd`@IYDFyRVrC2atgF4jT~D@n7aGK_gH&j|W*)dyc#_p3RMOlG!j9r*MpUUy0o zi{12hg~=S)C#)CGTD)x_8^Bc>1j1a5=e`bvhpPy~HV<=I$Fn+O?$T3o*x;bhY1Bu{ zERU3AC{0$V#v_t+vNzfLKvAVmH~~ztL;hi(kH1DU>-yP%E4loj@Q91YY4su*L)}V` zF?***q418c5ynl0a{I}BW3VB(C|__SeE3Smk-Zx`?cWHq){wOAL$P)a0!SwtOlT|o z;do5CVai!&(Qw4~f_H?;_5Xn|aeTAkS^81_g)q_o7s3pTWioT&ueG4;v>$)ba>h2T zc?40q@x8jU9?^h4S;)lQ%wpml-&5uTE<_$E`I3fl8p-Qs8)9HvC?5C(a=0zD&0xI? z>n>zrq>yI*`3J@|jVDuH+l7?UtW@IW71r36w-U?6Xcc}j%-N4b%?GG&KNZ7TS;NTh zNK@n(bjh5AD_a_syoUJPlvhP_lu`*2ea?4o3N{^x?|A^<4CVo z8S>cDk}3Nmoy_=7OL{j(IxA}=>SezZVAhCtAY7< z9(QSvnUh^#ZB}#@zjLrqRwx65i7G^o8T^6UZR(21`;EVx#*&8E4yaeEUj+o|D{aZ$ z8mrW_9n<3Zr&GgxHr#k@$?qCfcGAcCnX z2rs$Lr7#Oe@f(fIv**!-{q1Cw?JODN>be-H{VNOgpmqkG?G=d|K6u?V3p_g*ZBcrS zpbIA-jH!9SYX|3bw61+>te}ZwKFuu36Tzm3Q&5qR56ZvPsnGf&|99d6xJ|32Cg7N@$X9-lC zL^mGv7UZ#&;vw>{T_Q%84SyTY6%z<-53S!7oaK$xD435YVZ;O1qdO*Ot!23n~A zggJcaEF4~g3*u(8EKGf2%h!>uck%U?_en1@AAWQU9=_ML?z+{!7^ky;QJoqujt_)l zGiPZ5e(F_L@(eZ3qry1IE$0P$l1O>RSD@DcxnM9p4QOL*xsIaq2OGM5UUzu9SiOmF z^U5gf$j{okpEXCmW={oJs3ZwSJ(hrTt<~}iGTk38QcEzQS_R#0`e>5J)~XT%!W1g1 z7%1EMGZd6*wSdpfhkZ&6M&QLIa+aXSAAm5Z&-ce?HiP6V)j#2=?sH*^&sd-@ShH&h zs}=9IOE^?)uB{EQ2#bZuZ{(vaVaRAiq%c{5%~Pn@`@n)wRv#M=MADTL2q6r!qi<}( zwujL$pzfwms5nX89OfnmgRy+%0EO+i?Ygb&L^u~}@6}4HFSPGw7K~BbA5dCRz=ZQFiM6TRETIM;5ailrz zzKi}{L%n;w|FXj{{4Ci9uPy<4JF==$pxK=@fgF_;ypJ8~R;Icp#(n>ApIZAYH;BN5 z?wMcYDzMYUih!rT$fkgDX)wK6NPGHP%i?3Uh_={%I{$^ksB1P5)IQkqSD&_J>+6Uv z;Wa0fUL(KE9opdPJmh_C>sCC`6owWxGvo3T-BKDIIv0qX>JbTa>jEp6go@9KgxQf} z+JFcrsXCBw>Ugq;5zg{do(#~rX+8eIpkkOHAKpRuU@6-IKI?;fb_nIIo(Gf8ezt~ky69fJ zwoiol#Kr)Oc^zMWpHq-qT$T*5iToGFbOT^arH+=FVizwA zZiVfmrgx0VO=I1?UdC4q?jL7MSfP#RrY2C*q#SHHyc0<1y?3eqf(9o0) za`?S8gm%7WMY?`_MSN1a}oOE&duXh)hdf*P1j zpbaq-?28%&5Cg+z;Fu0jr0VP2k?v9=)ZIyAdg<8W^3%;_*~ zi*5AD5NS@m*Kg?2{K%Q4z^F0_v??6)M+F+b_boqf8s0r7G{9rhsRBIa`J=%A#OX!% z^Inob>Xq(5gwaGF(flrH+0Ia4eXrPocF+ThE3jcpWhWQK`)TJ8%X~Rd4!HH8X#MK> zc70qL>8`!Dd3Mi0h&(wNbg^fgWY&0BP{ob9FIM^&o(QdWD&?-S@K&9J zS4-TNnG&x`^@FvPEzKbT)ymlgs9V1XGQ^YYn*P4)%n1{Ha(;HDnG+@#_R|qvXvUDl zNk2iRa&>gzqK*(-{`(0!>(g`5MXW;&7|pTd7NCnuz2Q*UpFnMDy&|krRPz zhkVTtE>06|XF<5EPgkmq5KqHj;mU;faHWLMd$=;TC7<;@Tsge76vGb)S3aeUhAnPS z-3uaoRQqgke7WtDc9<+asF6x^gUysQRPSz+xZPPrDbMxL4D2JQ)N&~LGC|ASL5b%iduWls>)#tMT`090~<@)AbY{v-` zenz(;7r#R`zv}Dr2xK$yQ#un*iak>Oimsijm>P|OV^CPJRt>=QD4mrOTO96>3apbq ziNF#KRmY(xJ>w@Y@w#e%Y}-(G1rN#YCL0F&GlbDvB&PM3C}fL$GGt7UW8%jh<)x3N zJxlqLJ4lS0fB{elx$!t(iZ8ImBfB~Wuq`LdEq#IybPja=v;&+if1QlErrkfXte!4Q zwn#WAYq&I9t3k&TKM=vYpSXjD)HprOq#@0{ZcUX+^kgzH0lpI_xhKa))!{_aG5Iz| zqqHwE-tOmhwgE(@gebvsgR20j%Sh?k8Ww9V*m^-()T!JlSn=e&Tt#_k4FstQ zalbF=x932rVLnWtCty3>$!=i<{rQ6;OQ~YfsbZO`TcuE0} z|Z3!zUke0JB+b|xhQBW#%4n)*!tW>5>jhn zQc+p&=}Oa*c4hq4^`Caz`0we;B;|jnE72nUPr9-w_&r?-ETNylcpuJ`r>!;KiLkj# zZotSGYapjjp7(0ZhfYGmW}i0<`#C-4?cs87bawIA&$Pu#={Kk6x7Ra5C=3+p@F~kx z^n8wn8y-_`Q$?{7;72al*VVMqGZ9sFs>8+~^g-Z{D0MmFEl2CXJxl8uno_js+ouS4 zYWJ(^4ONY!uaXSP0Sj_FGAFcjOBpib5E>>B;7bR`_bkn=Pp>b_4^QFB&d$4md6R>l zcL!-_lTv4=xo=OG^NY^T7rK)4`0vasuF122CQp{l$($9cWsU|bOxdTA9vZqQ}`y^H9 zE(zBzl8F;kQ@$EHDLUTc)=9p*+m6P5r`9g4$wz;^47Jg~TgO16*5Xs{FjtFh)$VZm zSn-T!ZsFXvzDBhD7}IZ(IXboUFOr#$=q6%(t^J;@lsbddFNQ#MW#r+qt!GQdk$}mp zkxA+PP$hL1EYCFRr5@A*mmA0lLr*6_@5BM2jXMABghq48U%(j2)#p2(3^*q6NqG_K zVNU*38c{spbEv#`lG(nq^6hVu$u4S=$n~3K_Fu`{XSGr;^&8C`?j z+%ag@t5i{NRtNLO(fYc@Z zp*~3|hvKHDx_QsQ6izqFB}ih#;w|7X16v-c1O5EKg#HNvIOvHkVy>P=!cZ>Y&06>u zH-gw9gHMH^*#rc5!#S>weuY?co1=b>=GYrbX;muOnD1>aj+`!;O*p$U&)OQlM*Cnk zb;}T`0t1I#_!8gtPY35%A%Ze85@;c4Aub-0C?2BxdW!_0<9JxZl-z4+t zgVm6iGahA{_-1Ccff)EA;9?^{$TC!~1^i5vU-}Nvu@qOg!-BnekQMf%8` z(&CXO&T1-(uzi@2oe%i%>je5*DhQEg6oU7rDop!+Vp#iaa+2#wtFohvVA$~Ry<_?L zU1SykMCQw_DI=}v{}h>|dH*Rg_dremQ)C`@Q@G!ryWh@SC;pwWG_2*!Gs5gS9*u@v z!e&)os~QRI$`L!6DLR$ z{Sldlt79@L1b&12jO&q|ehzm>Mim%N`1+b(G7YWk+sbwI|68hWm)O6^q;r69yUR8%WS%Ch*yU2Vi++o06qdD&UTVxsm zM5gF(ktz4FKVTR`z|QF3A``0FfAH7ryU66K=-XpEHQh`8D(z4Fg_e<;hg8laugqpT zO7*dt>Gli)?h8$3`Ux0XO)j`+?mg5aav_Zm2Sfx_4ORSl6i1Awj^M2yYUmS$mQV0A z`SB471Hs$#K8ZNYEC+c3cVfOZB)2tu-&Y@vZ7-VzHfWu@x>THsK@p-JzN+Zv1TA0l zM4{K|+-+CelY#Os6tnCu*Pb?eI;N^kKe7>)<_oP;JGWyMg^mH16j4hts7E7Jr_`w~ zG^YJ};+Ev)cabR(d5Zd5WbV~54MYTKt!zvY{w*?*-$mvz_Qp5!CjpmVf!uVy?0fOW z!DNoxUN>+J|5s#^DSbV#PEG~?TVyg}?gtF=YCV!`eJ=$50m;Zi5XbZ(%;sRhlXvJ- zXW9^Y9gO`+(@y&kew3xYS>j+9pHFDMX4&|mDAK|gsVc%>xAym%$J~Q*AY>ZK_?%l3 z=;SYt$xe$>7j#fmj`n-=0Sx8qwSQx!-L(;!|ariHi1pc-~S zV#-nNCR*$ZAGE+=;J|5RXKKVSWpn-6edF94ev*iz^lbyd1IBkHHk=6>5iQN-O>iLj z)$yL<8|>hYl@J-DA@?`p@ei%Gm#ETh*Hutte{|?}lO1d0{~#N`ityjD_g*7zRp(C) z;wcsO8DsHp`XHXVRdd6vMI(-1$m#rW3pbS7s<}&%dcjNsQ-3BtO+lDn{pNZVYfg=% zE%KcQu)q6-bQ3@_&u+IV_SioCA(>47i)3oRypv3!0fqD)<53t&2qMLbbkHA&lC*iK zDomPJ3Y*wp##;xHx|8@r_x0ky1AD&E`4xY~`fk@>md#h~Sop~TrKjD7TLfc_DYfcb ze)j27Xte>f^iV`GG)eQ`W^iAYz$Ym@NWCmJgrGH|bB}Oezs~G3|A9uSgu%b_Je2vKDd9#Ob#q3H-Fy6XrWoF}|Ksp8iiToX2RKREq$&3oZmRlb{ zGQUSei(x8>{UMpX>q;@7{*cV{`1Ua&|*DOKZ@icQ>(pb90FQt7d7cr~U()j;jk&WltA97_MAer+Ni1L3(rZC`J{W)#^)jVfEF?pHv~vf4!_>QBwmYoKUqcW5=*y(Rta zr@ehV;qes7%Tsot*HQVs;d{+edKeZ^vuyagX8G;^)GROls#&(a*DR^P{!7g=u_|1m z3A!mr<9alVWNBwUED~fN6-uT_8 zQBiN7HF67@KHtBvnzOdf9^gf)K5j^QVsl5ou&}S2VKW(-h{5CYXGZ1q^Ll&F`k)-# zK*qv-bNHeFelgO3NlKgG-Ia)|@g-4+pvZ}x|5uDg&>?=j9~Bjxe$GTXx)ylK45u+a zqL2j~{2`x6UTEA3%un_}5JDABkp3Tlk5-kZ8lm_os24k&;NCaR^|1ioGrt{{R(c_p z0U3B9m;xG>nTSbI+hul~P`0BSoHgX~pTq4w8cy^r&+kcVug`g@zzCEU5zmLQRnL#C z#+&GV_W_AbhD=Rl3g#7bkV1!2buMbwtgUA9Hb;aWH|ES6Nl59Bz8hBH=FLH)sf^ni zf#8UBHC>i-AsyYsryUW3`q^ekSY9;<{@@qZk6Cb3k0=aA#>ubca6c{V(3(P>vj#6W zW43GpG$OxuS%%?YGU2T!R{3*Jz8-4ns_#Gpq26f#=pI)b9|cU5EZuPEHn*p+r`ZPd zB%x6-j9p$yQFK@E+&ggDffB`+4i!aL^Odcn1moIf5(asE3s$?bYDA(5d&3))JVkKA zC=jrAuGgI?xxK;`$MH0yYD>a1{~UEf+E;z-N&-%~EjH zO{Gl7^4uK!MQhDBfIB1fzb68FTpi9+U-opk;id5JLX~ym)Ee@1xIH|1o_t7ayQV9? zrByGx<3Ed)OSZE#biy2XN~G=3@3EayS_o$C=|D(0T~|nzSVKeFCR!5c@8UmAp-!pv zC=SPQ%Pu&FB_79o&24slM$79_EYKme-*@x)I_qAYM`}3m)66%c{&QeCqgQhicEA7?tYTY2%eZ1o zje@7oXGU+!Z)ourz<8#g^*=-!G9!^3I%;*n#9`IM1R6e0frv(3K(x5b2hu126_o|- z@?GVVQp=Tf#My(#;k}wYP#o8pJveko3x`AF<9?^Y0s+Bi#Y^o=XlTn2IKa~Ig+0i8 z!4Oz#__JT`5fhZ&ol86*y}%!wcv$d#gZ|jDo-KD8w~AW#Mu{p<6(h}!W%!7@{`FvurQhr9`+Lx zWUp*1lgh)PnD_RB>b*>8TP=O89epC^^eicCkgGC~4lC&Qyno%E}i}+@E zTY)Ucm6`f2iTev+fu1H!rCpyx{cUNl|8Wx$Ss%Ufd%Xa?*D&hjo$Xt9+Nxq>o8_ALX!qLWxuEC?v*WM^IQQ=2><4J?G{U~ zmLQKb44P3TzjH{XYbyf!2 zVETO`{8jhB0-E3Gdglu{xzS@Pvx1eDE+A)#i@s61NUpAY0g+Rs&^jAuq1~S!;SU{V zrw9`%?hh|ezhf~?@t(7+`;)UYtQwWOiB3p>;C)0$uf`x26`*Uui~kb;i*HgYix9O}b*M5Y3HL=vvAhx|%#Cv#m;|q4gU&C7$|O7R?W5eq)u>c+ z0ScWMXj22nFoF+9@z}UcgOFEA+6bl-!Prcx?5O?<@$pqrB$(3()EVB``-{8a3O_qu zZ`0pTJEi(G`j{nP$C;TOD-q$3UcVoZI9u956&_0&hD=JyQ)+-=!5o1V4rAc2M zwr}$2(&%w~ayfzIAhH@m-L?i8|E3yG5ZbvB>uB+%T_Mcq?e3H{q79lESNWu-J_2Lt zOFfLwu?rMn^TtLn-AqIU!DpkQ2+DeaG0CZEPi*X&i%o5+QSjMHaBo}7Vz{gscy+_^ zLun3pL3mIYn=^_JPIv8?-p9Q_Bp_UhJ`Znq_nS*JwR5i~SJ%Uo*x;k@CJFFV`d=jJ z(I5AIxt)B6hDlg8qI5O=*a!5fw{7!H8^KWsHje49n&tKxTRdV`n*g9@8IH)RuC)C+ zJx_cHtflSI^eYxK_Rc{qf=K9*jfT^m zhVkOqhCp8%i%l%6(gDNC_t9_s6^(jY+&U0BX?2n%SjI%oI{y(2)LD0qyhu@~Jr&W$ z$*sL6;^5!I->`t;Z>xkiZBOK#fb$H^jkO=~6%=#LXf4SMj=w#K4EwJmFKMOr`zCf(6ADnV~Biy+b$auSepJ@lK^fKRNQiz$cf8HIF z0&CfrT|D8;^(ZumWxcji_Y%j<`?LFPA^ca*QW(&)Opf^7vvd@-{@t^zt|kry^epdK zlK?%-oQqIAnL3Llz&R6`b)F$9s+pPZkjaQH*8FaZrr%pvKHZKTVu-6EOm+bEqjn=; zsX(6YC&HQM;9Nu)KA>m0|HVB7sI#F`y5KX-iz=XJnP%W<0ewT(ar;rb__AC00SwK2 zBNA7yu)IdsewgVneLBG4I_3f_&=ySp*AHxxZwYIfQ;$+3q5~S1g9pTh%^#K_F}^u9 z3!#U2X{U6t+*}u1Wlr-!(TvulqGmq5X6~{3829%7Q1U^H%^PAEg@M#ZQ(vNC4OcAY zP0$%Jpeis5_^jlkMWDXHmA9olD@bCggDtf(F@iI zb+$6InsW8|;>NsTy*AAum%b5| zJRoTK!a)94&{DN*EG5;poLHp-Ki7e@lEn3h_$DQev&M2W2;%&ka&t3b_;RG|T$O0} zsB9$mo6YTOq<7=SbtfE%v+dc4v70od0bkFm)?v?!{uwo$U(l)=j=5`)Ww}4-rLJRI z?jB_4pULkLinS>T^7qN_@^AX|zbC&Z0h8Yiu#{_2nT^(Zs!>wy)(jjCD^?B`H$XA6 zJG-N^l^q+tTFB(#_t%G95OKYFq}UiA@nloMxM`@=XEs+8yJ$ku_;Ewx&U0&a77( z4)&VNM8Mx+u>mxoy7fzIx*A*mIzC(7d1Ir6u65E&nqCD|dBFf+`CFs(OHL|$(-fRp z<>c~(xt;Uf%Tw*u9cJa}=@6`NR`k>9BV>Bx4XU4%Cl3N-^1T8m#0?L<}*qZ zKN=c$XnphnfBaQW^!6xq`a>W-*`E-vRJy_v;)CBI<}^o^cqG>x%9Rsh_zWrc5zrIQ z>k>~vD`(iu18}WkQ(T~KWycCjYJ}X4l5z_3O6xRfJ9HQv zL7?w;fJ&RD=I0TDs2%m1~G^8lb;AI=yrUj_|U3IY-Uw7ph@0 zZEpTmv>ao~JO>mlp-?DTJ|Zb=gNxnMuZxfw+x{+EDmw=MU9_bBt7s|BzsCV6T5=TI zQ;2we2NW%FB@5a%7m{|-4UUtxMjl$4)2Ykoob@EjDCm-<8pLmXY3toQMg<9d&gg3R zO-z)`ArQMuCJI>frY3Rn;Al7iHDmTW$GtKKWX0KBm_CNlPsg5+)av{KS7QA0A%7;o z#}NsuR%$4SCMp!l@iZ~^w&^-nP@=tMmC<>;roC``%e&#&${4XmYy1r3D2}m8;aV#B zYSkK%bkZwOSg)CGUh~nV@~jJ}o~S>tm$8_DtSmGFO?@?@(t!hkyMxCnJ~Bxj$%lH| zjGFPp`!=T!q!~Jw4i9s@!P+&Tk#OsBG+@x0{6?mv%Oai(dh(Sezej8f!@k0+sX4I8 zEt*f+AyzbXK(YfzW|CN$-Tdd}o|}7MTObF5C8v)t@{u@>4b-T5c5I-LXRE%kym_kt z7y;CTQEV%cEo9%l!0QXQFYY`wDC=TF{w9uCBIs*w!ik1sr`v7=Njzuom zS5nC$F-=J!hZZ(Hhr6$9;V-9ba-Wkrxb%m=!BiM$wKWi6qV_w$Zqx>3o=OhRB{l4R z!uVuW46$S4s|t@nBxAzp`0zQ&Y9rOoQn!+s#C;m>W1P znk@fagO$D0t?_(>de!W^Iv&>Yuc_mZ+tzV&$9iHvHOV6XL@F&cdv>#s(^Ih0rVRoS z17+S=wVi#aV*_SHdOQf*ZsT`V*Zx>~Dn>>C3OU+vV?(nXGVJXPNwZ2)Y6bAd&V8@Ay7YYUv?eG8m$pe5{m z3*6(cE%0aGwi0^htD=U0xL=YJaZ`<6DNrn`;C3kkeH6+XR8|-VN|et!^WEIPpi>yF z6YJlk2ld~#z`d1ALA!88nj^+Eu71VYDY~`CQq42!jNe>1n+Xrk2eR4;THc-$0Xt-mbG_F3^10 zemAZ>Y#6|8kos&tXJQvxZlY``7-jDymKDBys0}Kys0SFdj0Fr@O8qrxxp4RWVj9+4 z8^mdZTnRzy=zY-A+V@_(tV8H{Ft}3qSWE_x<$6h$hXDpHSz+bDPy{wQ<15WREbz7) znKo%T&>jS1A084jVU+)4fjbO(0xa;Afmxbp|3DyQiB|RWxp;!|uNnIM)29a)t&84K zgpK-Gf!zn)lb4ucNtOy;K9^D+Lg+TEjpKya!%5_RdRI*ukyiP zmS<#7mmr&Wff6clJg3?m%SGCtP%vOL^9oE7>GFgjoj^$Mt*6A2NJ9F7vG7#kQrpgX zZ1I=pi+-`de{1BpBe&VZSggP^#zPouC+D7B>#I@W*!fvQlGo$i8z8mV$<-s3c7O>v zc<`rL$hGMk%O_veXrNRp2nUfQmTr?{i#GKnE?M`pt5eJv)~~HYax6O*>L`{Q$$4^o z;zn=R`@{>X1RXKbzA+GgzKVA+yG3uD_REbp=p*i|;{kV>ft1vN6I8NwO%)D8)DEz= zpr{%+_(lA)XbA^cwB-C)v=k+;HvPF@(!uPS_BE0|kUj`$yq^RXCg`g+m{K@kOe0J~ zAkgqw)?kt3o9C8S3{8p|ivgvCz*-Hm(J)e045kvYsN-lSLMZ=t{R|HHK0XH=xE6uU z$Nwx^ek6Tb5wi0Z+3vM2@@S3IYrVP)pSlY*EwZF1`mz2?3ne4jT z_VeygQISPuA%6fSGVH{ihUy1-77y`FpN>Xx_bvWs(ee{Kku-K(@L0;nqNUeBfKa_O zCVnDad4l-X3+|o#_tpvm1LbE5$4(f|y8pqzHT3})I1B&-kNCeBxb?(0N`l>pad*T2 zEL!eJE(!6hs*&K(tW})8W8n0yv=v5QJ(S|5w4bc<|G~h)z}~hz)b24j5#<)s5oS?~ ziAHHW@&~Ok!KnX*flu;j>rW67H!&rrX3%T{Fz|$T3>=mC9Rt6~b=?J&kq*usF@=D1 z@(55&S~GGzcZC72B#D{f11ierh{+AUFI;-!Gk|Q;5s*+m10K=Q{CF3@1N?qrwon7< zc)-N#7A8$M!-~mNNsx?VjI^BKf4kDL&4VxBJUjyIO|cMm2#to^g&3uw(ITz)dj}U} zvK20!u6JK8#(=pHYjSP@#9XpDwDOHssZP(PW1JR667-ut9~r44!HMF*ipil0s-XiF zWfA;=^e4n&5=^JqO24G<7tE9CC4$=;h9~ihntY$-gjg z_zw&`8~g(UM+IQuh4@sdWXg58k}x#UplL+#B_;UFR^mq&mA*iyBI`ZDW;N4&jXlWP z9)1YbBfV7ckjmJqdB=6k?Xg1X8$;wh2Amnb5{Tc?m-jIUzvki zeT+Fy3-f2i(F8DJACuu&SV6XZQgvxJafkLd2F~##H4&7dV^)Lw4asqm*Ba28vxfQ=}=$P8Bo!fiy>)_K|+AP#8KVW+f{&T1H{ zq!|e2+$JHBcMQC4tZ_J8e#O}EvJ2-e7i|aH@ijsrcR02Q|K6GNZR%j3jDIm#?CD-W z?sZ=4a#YfzyDvKqef`40dQx6o=~V%Pk0KkY2(emUHIBR#V+R+a8$)M1xlmYIWnSJD zn^YND171v5g=|EZndlIgHzw-jYNB>orP{~sLtl+&4mQ>88I z{V_8c;D?*y1S;Vi0>&S*-bg*kZXEWR6oxl=*dcN1`>~cVC2$b;gM>aJ-0ZxTE6Y(; zY)`m#HcGVwSBByEiW_TS#(@MdH@Ol;*J*SMn46pj>`vy7o&%2VFaWcXVSwSu6F$JO zr0QQcmgYM>oUj9~^NJmS9bIt)jsSNY4F!DG3$F_S{G`)?DgY6_-Tbf@$J3}MntTWt zk^F06^5d``Uv9(UV)rI`vRC7miAOy?V0v=ruaU}$i_THNQ6o-fZ0G3Bq9x#7Qh?b? zbw;k8*BQ3;^AKtW`mNJn`2mRS%>p(ug-(QfvPBG~`iKVSHaUp5)+70tap|abJ=)6D*(fk1 z>&T_7*&zaSN+Gj+hc@6PnV7?bivv+^u^*?oTt`^G`cEw44LNYq+1XUz+}~WWH}<~a z0xa;f>u;H)p)}vz3o2To5ySKzQJ$HYj6y24-YsyEx^qX#73P`D#RJ7Kh+p8N<+i;~ z{#=+sgc7~toy^o$A>cJcMGl<&3jeXdpRIXJLm!bT>;Gec>-jDx)t(c2o*4lw@Kd6H zEbsyz=>Kbhn`wMl;GcE5d^D(_BD~%$@TXmvE7K8x1%4@zNA4^|6=*~+VJ)Vm3SM9* zHHz9(WY|JwXJ*~13A^IiNJ0B)f(|0jrL#|OvTn-$0`h<%2B2I#FlH>{lZ~B43m05; zUZl!>y6}cGMlF7;4&tPtC@=eD5PN$(&JUaRX&4-PhKL!6|DOE*S6skrR~<_(6}UU( zA;J{WBz~p~G^&4G;*W?H3z8or7X?GbM0b3$1)5%0%#;c@!K8{O^UsZv8^_E8Kfp4= zDbHR~yatZY_e50a5{=~2L2`c^VO@eQ&_oe#rrE<)b3~IPGd+%mywCgxUCJo}tx!`Yi;h zFy{a;CJh=8JcpsmV+6Z5V=2=_z$sirkyM>6Pri+E^StE>+PejQ_O}K8`fh<=Zb6hr zH1E(kd>V@y|9@HFLU*wfR}r6(IkmW`*h};;r7mIDags(b_X2o$c;Kv@Y=iot8sWp) zWtL&Wn;fqy5V9{5WqH=AfRu46k`s6;(TROB!wGRJCYsGrPpcDk4ArjpG;_$D=TK1H zGP6J1bp&bIfxA|~s{IO<6NbY(P2maBJL#O5EDugrvMpqVCN&1j-3=xUOC@0BXmWFg z$q)F)0>8bR{>uVK{;gD5MR7VE0C6) zO{L}=uaCcyME+xeZh?|17HXEGUXC+E|}F3S-xN4HY|SAsJ(P(2f?8z@d3S2hK;SrS(mxwdhk zW8ZS9dVqR9-z)S>(4T&K?3tC!r6b${N({r-1a_-Y+; zPnc)f88ZeDN;ZH3Hv>@MU>_8C{%kA08u*xBnF<4rH9A*+#7!t|g*ei939Bam#Hlr{pe<~0^&hsX{^8Ykw#Bq|fp~VF z7P-K)Fh8%qP(OvG5USjqXL__Pk~GnunM>+^=3^+(Er`Jrn*FPEG&p`?H)OwM?R=`p z+;3hIM9{A6bg@uRH(`Nlc5t=63evuWk)~2(H${E{2&Cy;=1Ab!8v<<6w#<4A<@Y?I z7aU)iI75{wyz&?Mc*pG(EFD$lmvg|2tqF}MAw})}#snrpnGkcMo?`H^Z6LkYYylyA zv@dA~ZZi%Fr~1p1Tb9{+3_zIny+$h!v05G+$-7vd!5u~9T@I{po@uLvv+}-l7>7o= zTqNw%l8u7cR7k2-ew_KR&jrjs1()-`uS8QG6ZP9FU zKcsr}{GqkX(b5R@LNP;Al+90?6y4)Z_%HB}UhU&nGsooQPM*n)D9@jY`BAV^S-py{ z`XtE6wO1=hkCTlQL(xmI&{FP);i$=D@aD*oIy{eDr#ZUiMgOX1|B0ZnW0n9QxIXaN3kjcj1 z(voE$!5`UW!Rtqe#AMa4c9!JBo5MCp89^O@P)zR0UyGI=Yl#CvMvA=Y32Z+JGTil! z#pGjG^3m;2E;q#1rd2zw;&3jie;Gky%7A@(kqU`Lq zM{ESc%tV_Y7aI*udjdTs-+P+&884zUC}c`E);1TL#s^QI$v61;j72e7({TU9EJ#-& zvEEGfz~u5Z*HxXJ4%A>V3&9y>MjbMO{`-aVE_@^$d7N*TPwDh}9jgwIPGrAR>|9m5 zjJVyYSIe5z)P$+td=FA-6qVu75XY{dqF}jC=_*-U>s1Fs(EKdHh)OYCojl0 zXxcAW3nFr$&qZ5d$36Kp@hF%~Z z$g3+GmAyJ9=`^EwTv8}5zm;)dN?W@Kv4nWzulzh`NhGe1#d082a4VD}Lw-GzKYnjA zzATf~6wcoKGfaH9f~uZS?HvNIWO|3dcP&he`!vi1a2G+>0wZh{A%+~Cu{!*OnN<dG;`ro7jmuwpOCd3;QNe*BXd`px^D6xbRrm2Xtd` z;QHSwiY^XuHd!^{Tfl@y_mSBt_7CSld8&Q_H&^7m`w7g!R*GU@in?pz+nBg;@l9pU z=CIgjJVeX9h=6W1OH#JMCx&iiH2eFtoPHBu2B_?SjPO|CH{({m!^dF{2CYfC1y7%o z#vMl5#??OKFM}o}vgd)es5jM$efRfm(KZMQ5}^s`@dq_WjseVU)btg1=A^HxW53P* zV!#Fe%YYMdjxuck7;sD(DLwp&SWmM3!&pPt21KKCroCS#PzKM%w;cJBL%^#f@~rO+ zco=D46~vbwVnQ~0>Ux8be%;_^qj5NGdwfl4SYor;i*Ke&iarNv&+TVS)5f>p>d1Oercms0U)x(5h`EVXjifQZ?+MKw`G%I?!jmKBm0cjhtTgL7RQR& z7OZ<{e``FMin{M)mKSBxbRICKbib8bZYLXXE26IV(zafGrkE;2`D%wEb0)!5XxJlp z5~b^6SMd@PcvIOJFId6CO9Q+$cr4XZ#iVtx~Wq za(k8)|Eg}#>X7wN|M?dKp3P|Un?{eWJ_=ne-H*tgbX4C0VcWE&ERkUod_Dn-t$NhL z&2gZD>@CdeR625?8hLS3k=GtLf+a&QJqp zYGG!_n=Vl$%Jc8g?WQ}#OeAlQ(Q}__DQ05#-Crw4estv`uYWuEu3`h%RJ(wpJJoFw zyg*~5Tt`R|F>c4X<-wpiyY7@Lx-~~RYAVFbD^a9O+g)6%?AB8?7dDP2j!YW<;_?c% zN~nrRgS5$1Ill5cTGhBjKbzb0A$=c2QvRV+lSR6q9klyAm8fz87rw`;lQiK4JbDrR zNyl%xIIPc)vNK_{Vjs9)pZ_P0_;+mCN_FA*_|MD;5zui!WXYM(7d=n(?ROilRu0Hn zW*N{<@TG#~;Vs2?)zUI&tIuC^s4g}Cz{66*VF8}~PG#lMX}*R~JJGv&sGR*y1H4`c zIlGy9xha;5+W$dp`ulKd;{|(aS*r9P%)HOI+S!KQh~|ZNQ}^-Z&Fp+7X=k89WaAo@ zVlTI%0&Cp+C>QzvT=d7)S=PN()kgdhY#RrOHsY6_*e<@RN40@ZXM?-taU9Uk~{4 zfdu$DUJj}W`LVACpvzg6{A|?SC7WblJwU>R#MV3;nh0nRhuhbWc(0?($kzdI;Kp&qCqaf zi|A9|3%F6l+mo~^5*f%X`aC}>01LFPdfG~4pdC6}sg33{U4_}(Shb$j;q`bGP4K$C z7Bm6^@ZjP9@!%7aaBD@C7-6ReRLG{|N3XMWbr*b!S6DO1lxg2k(|%`OW}utGe8>M? zudhn9LSNu(%mW#Dg$8|*h!I~U$Bh9b5LMF5H@|bI4CDu7(osZ2{wto4^kK|gH*T7N z8eEbqp@#00JuAvjlMz*d{PJ4;TN=O6*}>T`=udGM?4M^!+-!ye7tJ!RW(#)|hvHo! zNQhKv&|}jIuF(0@>E@WKe>@m_l^Xc(GrhlLSf>#y$=rm3 zeC?o88Exo5A4g0}4w@yVWFc%Erj2tc4Xpx=l)sQ_&>EIcwa5WVUd&aAvg}k`?FztAnqX zteYh@`Qb$tr!+c*hdrxrhN*th0O?A>&#tGge`gP}Iz7XQj3tabYSVVMeK@jBG9lJ9 zPZteKRGchpS7fh0O~Fm*>zjMsPZ;bcHp}@N6|_r9K!Up5&n3Dn1Xwi zYE<$_;lK%Y-v5#*9-7?1qOWjme%m>Wt;slh&Lsv43E}4GjE&1)z9nL4e1a>V zrPy{(sV9s+LvVDxlzEd87b10|YrzUzala6aa)X}|vY@37_EyZ|@`YJ$-vTeIFDj&K z7seaImz%R8Ti{4abjl!R|$m-p0H6+>{EZD zjOQFueke1^sGccZ2?C)Hfnw%kBdXGe3Q?UF|1Gb<%@0 z*`rO-E2}?+s9$dB5FTkbUIQ!X5S+)5vFtuc#mTE`UHj8&(`=e1_G^GQV$qMKbe53= zOkKnnUDWv+as^Fg9OW9M#6w^eD1_ptkakb^N=LQ03rK3A^ZTqA7+K?!Dx~uH(+T~p zGT1;&Svg6ajh**VQOHIv&_sTfal=TcZQBGT#j`KeOhv`6;k1sVFxe9?t#=k3W!lZfP)Ltt8xPPaM^K zcwWA*+jC8j-p|p=8?ReH#utI-fS$8+kv8koAQy6D5P7-&DKmYimQK<8UJ zPG-}~XCDagq4P>U*Ry^`R~!Ex#eULvX=rpkTmsIrslCu#r59moM|VQ2pA_Np2U~@i z-K^DC9Ro|;FOf8q!6dIsWoU`uIs5E|bwO~1GH*+eGs1$FoguhOwQqtm{w+#&vBbe8 zF-5z$C*UWU1;fXt=tb!i5#~MSO>wBm!&vR!^yPJ|<1Jb5=Aq;fSHsk5bY+mnLm{1Rt`1VM@P8%#328C z7yNE4gl166pkYv7<<=uSj5etIK~8d#$4C)B zg)3-In+$cjA)mE{E1sLx*))I}>xyle*?(fEXunY9}j#&?;b7on< zrYIExU{iF&4bx(Qg15eU3|f36i+R4Mu7&cvtlOFy7S% z|1#d&WT^2TxAp!p-b)w4P2jhW+ZI+L(yV#`QS2pWxl7pDj7MH7#;={g=L7m+p7>s2 z4BDZ-oU7qjy+Po@nJ&q5y@y9uPl!|C%Jr<;_a_~f5LOoN(7014qjO`|>#Zm9A@-%^ zRf(2Oe`vDZt_GImt{Y4@1T4G9mqf}=NJVOF=0}{HlrCbWNazKF?TCDvS)rqtFA;3i zhBufZqD=N|#c-M{!4hi}_4G_JAO?P${siY_`lzEy?mcTGHFcx$gyz|egr!gGS7ZvI zZt}NCVWAbtpBJPS^Il_d;LjqNOqLfS2Q6>kk#`B*VVW5};Nb(TpzdG00mT?#-AXEv zSc6(TPR^0rI?vLu3e(LV5Apeq2E;?=jcw066C##nvVW#UdS@6Mu>G*Q>ZEh2_Q3JI z@lAKU|1#d6eDwgvyX)9cw~J2kD%OYb{^RNK((=?4^DpClT0UgzhbRaC3;j2)e9lo} z+sPGwfbkBfVif?!J8#&#@t!_lDb0&2a15-Qt)qRvSl4C4MJpPUb4_1ZBuSJXs^l$x zIG;c^4fKVMC~=V1quxgOsngqpTHH#k#VvEH?rB>2@b-AI9MjMn*JfQqzM{gA=ziMc zTz1S;R#Wen>?V)NPa=&wsgleE%dUoF{00Z)VHw%Th6>4GqwC59Y!?}?9!DP+>nWou zoAFxkn5SCSfJ_3TVIl5fYX-*79p(-e&{7=O!#n6U99Pg{`HHY;WxYNi zLNBv)_NE7t{^_hzWpw7)Y=5^FU)3o;u|Yc3=qMfMlWi#zbl73#ueoZ`XM$hRpGN<) zD%u(R+$LYV(HU?r6??9q_DqqlZNbWR()XUlCReR+3cDwl5ot|x)IKKBiQ<7!_h7Cq zM(7jV>f*|&MU7|-F=A7q$92u5OiyYXtI??w4Fsc>papxk@m0Ce-bKn;N9XOuMP_E7 zIw;{f9j1&jiF@~tk=mc0WfnHmmxn9S4Fa_cnlMTlgEcU-dtN$IDRuOFo(uEs9HIec zMPDcIh`OpykCh4|Lwr?B)aOPTx!C^4c~9I1IPdC+xhH6PR}oxhEPS-9W;_BamC7M* zZ-80RWm|glb|uR=C@Pv~fb(AZtJ6%tBHc>a|Mz_&ba8&Ql#5dYyr8~F+-%0hG%GsY zBrp#)%6BbbKH(@uhfjJ|`VofVDJG^J6sW~W(wH)d(*c)-dk5)8y`G|CHyp-!(`lv5 z63&W7&L^KE05 zjX%5oEF0OgZK)axI9XQlUzP6TYUg--7-+{%;!2Cl@FPO&Z$F@$@f;z9MOt@NL_fpF zJ|CX7YOW}(NitiU=i<;u5BDr!#rG;JAFJD+QkN~*3Jn9Z+mh0v7|hy2;a{Z83Lzb^ zMpJCY3*M;2>-L3ovmVjA(7L&cT%ALv~J0KG4sh$bW32`HZi@paySZz{tFJ7r&F zKY>)LUv^zFj`S52XogRonI975GW`R+Q*F{4i}H82z0Lb7VPy|fOj9U)K<}_wuxtU$ z>}kBnz0l8t;Rln^dV~4rx}AJ~4z}K&JADn+#mi{~n=IJ#juvO%3ib+AC`(9xooifd zXlHjCnb?%%Oh&h2p#A=2j&NF$mnA?Dv9`XvH`_yLThqb*=T3L*^t9G@6kH{{VRli? z6BZj>SUcQby1{P%;ePvqwYB~A&(84SV4Yf1(+MU3dgpt6e0q-GSy|b9(`|dYyPG#m zcpEL-L2qip)`(~0f?oa$dT&oLY6uT{hu)L?G%O*feEti)%kT9js3cpCKL80=vfVcO zD?bN)A=h^4nFIXURrDlMMY!EMuCV;<)TyJ+*n<9@){-KA`wqP?0HAj<0Q8=q^bH*6 z*c5kTN(JMNU@?V!Sidiy`=g8Xbe(isGxHdsKL)D zev{w*s)L)Bd1(<*7MY=+nCpZ1lNTMTd)|MW*8afIU zsLR74PTAl@1D$DQOKnV&24Ub!0x476oMaR5yY#NFtOss+&u(j6X=?D%#m>6_uk>#9 zA-(_I#ePWdW)%)l=oH;f|$*7pOm04k+)>_JM!M}fxJt+Bk$KNwZHQ0zDlz-G;#}X`fpnAV+MsFBlaS++&{zFDp$d+ zo}8k-_pqgjr^O$0qQ55Tl{BS_9a;*k^FTyMqTKM5-g{U?fbecAZX#c?=;4V$ksfI` zDa^80GFvyPt0h+yul-x*TGIB5UI2S&345b3U{Z9UxSJ!*NHq`~3MDOqa$`S(jCNQ+ zy&WmxruL+S*MEKLLV#o#s2ET6@_K{w>G|!k#cbnvE*a3!gq6UMJ5+m0MBa%u%)&gQ zcIR72)M@KNY-z#{-+VTT%>UNJ*^wv)<zX# z`(&y2d`W7?YW6*emB#MK4X)Di8&AZ)uf85P3Jg{u0ePlsh}7EBz56GKZGmVh@7}ml z07oxB&1cBa@Fq)kke_M<0gqPwB#*fNg;vfweht)0mEL@4Eq@{hFS3{yn{P5FyVe&Y zDeeN!$jpQb1C_}^kyH~yq9-FPHA1dFS16Gtl38_r$#V^1pd^ zkpJ-RSw;&c`8gUo1i3V%29?pefH6^&DWsAcJrS6Oaa;kSciuhJu2PI2jx6?fy!)zT zCd6{2z3aSK)K zkxOTcVDyz-tGwXVQLzTngs>{+&yT^kGDP)bR52wSBzzilDsy@Qa;hXeL(Vda#0M#|f%m=0*K zi4WcVn-76i21qrx=6K|+5eecSg1#SPl2u)-Qp9iOx|eP8tq#=H4_FlTSq$gx%Fv5; z-AE!bwi(H-8F<`iiB%HgrjqGM0hJm_nFH(${SodqDRic;(~yMZO8L)lPt@*GhMcF; zQ2DvZjm$TY#li5B<~e;??k+)N+1}?}<=K0J_P41FQy0|;s-qwtQ!A`d`_fnoRvXez zD$@4kM7aoRI(JD!nxcuai@><@DJ|xU4bXUV~@{h!YP4&0tzvdg$#&8eWGxZ=~^) zx-v$FXS?I#oAr1D$ItPs=DwQWs?Q{v-xfprE06x@E8TpF95TZT^CSBGOn&GgY9Q+d zchX|DZQ_B2=#x|1OUP|tv30&$icl~zDTk~eK+V69#JwK6y0yqsRKy7Z1{^DTYG{Kd z7f`+K7_cVZl-_%4_{@m~onWuiaPJrHHBaw340)Pb)`VeDL#tZ-st>V(tc`giTM<{d zW@`0ii8ZiHuvKtZ%;}-whs5a;c(XMEpoQgrZ()Vofc|M=Q55ppIsNOn8PAEOBvbo= z&+sR}ncNrLSNZBoWDJ%Tk(aj@GwTzL^qYPryW=o?&9c_}iaaQ~6;bvt-Q6#lXA}uK zYI4otyNw;R2HUCzFNkp^SRbm!G+1)Qk4r<1BaTGOy%ksjE9cflIiA=WJwOY4V3Dmu z@!rD5&#DseDGBOP0H#EZ&*9d05V$Yn9ZxX(nw!LcE+oP}bob*e@xz*|a*6Q?rLt;7 z0#G9=*{xa=r9^l@3(N7*!a|T&8~)r=Y6rBi2vT|wdN5|1Me%*qC=(7_GPEV1-IHLc z&F!t%Qn45>w{$u1NnlN(qlL!|<-eZvsn-gNT9aLc>Zk5)JojaL1GYpx0b8PX?^~j6 z{a?EE6y^nXw8)PE{VN2Z)Lf2|o!4Lkq?+A-ZHZcVxxdG-cYqic`#pwb+Q{y-pn}y& zW!KluFMiGVf!rMhIXIbpZYxe~yln8XCED&))6X-?gA~25lb3#ki-!vB6dDLM6P#ec zY=FUz8rYlxeU3=0G$2+8OKnO;>ieB{cFUDI1Z;sWY_&pg{6x*fauu*8iU_ZopoEC7 zzDsBFz9riC_m*g4ukT5%4E$bxf4jI0FrnGDuIRuyf@6B2fY||EWdd$ruZ~EMz>clW zewC}y*QJV@sMA9k8M@q?g+j~38a*Lj(iddJm+xgZYev>`JO*Zb@@hF@BsISy@#@H+ z(A;VfDH5qeZB?Bqva~Y{Ci3*zsgy#~#(Mu7!y*B;M1L0Jx*x!5Z~ne?{2c_4B*}U;nFD=+$t;4x@y0rZ$52= zc-^IsH?{Z+TKF;i8Y~co`KBY?q4OEQyQ3Aw86Me_T>%rN8XBbzz~<}`y!2h0md3bE z4>QkIoQ$)h{`?p3&LDJF-zYMG9_>vTo3qO)w$@R>o%7{SE8-*0)rM66ked48Gk|wr zF#KQMUE^=wT?4?oqopmPxdll5i+30N;N2Smy!#4(cR!ti8wBv~MgZQu2Ee(*8k<*@nkN) z!)OAxW?ce!cVDeaIQ0vDnjNMERb;|vs|W0*^&X28I7Q}Bm~(f-J)j7B(&KNL?R3t! zOTEe###bH58{L^H_&3<*p7vRIIc>kbDAQ|y*(m~jINiJ+vhYMEx>KmLniIVDi>!u?AKpF3 z_xyI&E(5i*yx>6Qh0${#4*&ZdoRUc?e~~Es2zeVN7)?szZYb3N$9I2r(c}jc%Ge=l zD~i@grb-Rnf?q|-g%g621+XEJb+5Sz(8s_Eb>DRK755;x@s)NNZ#3$LY~Qw9^OsS> zF}{+#E_^@vl;gy~c#E+qk%#B{!&=WUX{>iZgNgN8JDFsLboeBJ1eAY!Z{4#I?s-KS z$aNp&3oA7eaozNq%$zMU%JSf@YuR?|D^~P>W7rt0aB}FvuN=_$uU{*)NM{F=cak{s zpK^5tz(JnIrrnDXEh+C{ApAYf+U;#?L)*|ThDoyydxgyS7pd<(P|mLLfs-Gku>XK! zU*Qyk=?(j4HNIJVRqNr4(DQU6d^tJ`+)&J$LO-N?*shPN>J|AVa?pq`N62-r<_OA@ zNw7w4_2f$>@H4Z;H~+F>U_x~eZ~Qsa!grEsPB-OkC*|fo!1tMP&sW9t@{n8Ph>f`$mRc`+p%S5_rAWU zW{8xJo}07#TtDKX4)#|i@76pr{flD%>+tpA3Kvo@#r{{zt}MY zjy{Q*?VdC7vS9&2StCFa3oB~Y_EsBtueB|?DCNd{Q%oRCZ!NE-bVyNwuSga&*EatV94xLmnB!eJA;pzdBJ~9y^hW%J^yT1x$j03{q^&*KMnr ze!%E+YG<_|x9gsJGP?O&@9Qyry5b$K@ubcPLvx8u-#3`ujV>1HqMC>{8+gKSy=r?% zd(NzoIGoRqBqcoM!;EN~q=0>10mKu**f*t{CDPsT1Yh8wZNXe}XCXiiODfJRozz&03Qvy~?r>s7gIJd4hsXXasGxCsbY7-^z4kj=wbW%)~I+kE@ zFYiK&;Ln8M7oZuy`Oiul`t=)h@w|-V)OJo(oEc0uP8K*Yb)a=H=eDvrYws1}m1(br zXYhujwt-H8d>6W_8$!*Ir2>fTMOOPBI9TH5;5rAKp1}eTj%>&^yP_o5LU4ih1~4o5 zf9@FR10?Q7tbazu91s9QJKQ9^gprk9H>#B6#K8S$Oqy=--cY%hwEkR8GeZD zX3gFt{_BfPn%)(n5Ax?10p+h;^4a&g7KWOnXc~vHs`wTy&})*!73GW6kq@?r4-T#l zHicf1FuD3aRJpJMjkj^P6MmgVe{Mwc+?uFur<6mAmHpj>!vK2bqM}WfL(`mcw}AIK zSoaYpmB0K8C}n3cvVvcfuoh?%bB5ACiqqfvWLMI1CLk62@Mpz6Kr9=WrGzIzuAa+exZV zS;18gF*MrI$Yn2-f+{d?gxj;I^*NA)ohw#w#^W&-{qtvR$8eG%j)EXe>NG$&1n)U4 zvo~}WxuV+&CWZ`lT_tb6%tsCju{(y_fA@C|yZZQW?BeS1Nk#N`vy?Vy-HzjbL3YYm zxfE;LsV|ea@?P6@G@pCL$Famj;){s9D80Hh(7RP=7U#5eYA zM`n1H^_poHB7bk<1fq(V4+ntku>XMU8BG9?eTc56;?a>*p18vt0J6)h@!$bBF;zE6LbP|tnA1#lBD)0?YCv#!9{+dGdXHsH%fT4V~!_OpkYbnwQA*Jr&8OX z{uu9VNj-7JyP)J=dKIzX?BzQl%JUQXP_V^B45AB`S?5Y=Ao-7R!$VMTrb~(q{{l>` z91QcPZgv#}R9z@$4HB1|lyB1CFe~j?eaaK0md&epMk|$Tr}Y)rkoY>y_nMF5&@zoN zuP19$LyCA3J?81}Q>m|%5f$KrqPvb1lZ8~v8w%^^=@{I>?-HUHc{2vB@OoZ#LNCJ( zmY1tr{1*|{etMAqZl1( z>ZPLP3l^kXm=tEdCb_sN)M-2=mJxF`59i%pF|8my8{;53Er{eEl&oW24yZ4GbIK0I#vPJR!{Y$`xNqhnNKl3+weV2vV8v=w{GUjnu^_`_skIW~S zDtXP?E5U9U^3P~YuE%CdcpP?2q-78wX8t5JD1O&0uq<@p_v@uoR zB1kd;L9A9Hcf85QHU8O)eb^e_8b1Egee{6j+MR+g1q+kagZy4-zOan3M{8VpcC<$9 z{3?qu((hJCpAjSz1gib5_R9{hNUtT10OV)|y6?E|8A851c$-dWP=MtCMq~1a{sJrWYgmPM5aH;t->zle$5YeQFQ) zAJkDrrO!*OYSJwNHtE`wN)2{bUfr@M*zEX~z0ge#=$rNmM)@roUJl+!@@2in1o-OS zqtL-8dD61+0x!SR?Li@=6t6Ce*9$~)gr>fbHUjM5X7J}s!{f&uNxKPAWOvzCxmDexugTY|PW?FI=b&stK$jS>5*-Xv>K7mXM$ zOE<|qTowP4m9uLm7E4}X2QzH$+Dlvs{_@r=s$3RIkY#Zp4Iev?;LnB&`1LLCq^F*@ ztu5DS>)tc@LS%O(i0zt6EfjIiv^5}UqQ_GK7r{|RQw-{v!yPl_G6G~J`eO@LoJHss zs9>MKIe?~AwHd7iXA<;LhridX!xw8uGL;OPkZSZfc|Q}XL0NX7LCr)E*@gg~)5*pwtSoz7 z7cHc@Doh7hTE~#l+8=Qa75FG7o-Nk|Z(y#+y_}oI=0v7=C?qSl8j~{fflD5?fN3G4 zCfsO?nmrR~2xslj#}5<7s=5f&B3@r7pBL{C6BE9;Gisof(ur~GIPMkB;Z+oDgkio~ zV}_QCA0-zDcF_wHIyC9FW7fu#IJ}~>re8MS+-~8d8W~36?e$cm8J#z4}+pRYHfKWV3=>hZSZ| zRBjsd!oH+*0UHteWjbcE6ulAaM!{p2kPh%$U9qQLfVa5Q8=h_Ik!TJ@_F%JT{PpiB z5v43y;n4Z+vYYuHgwF*{tZ68Zg6Tq_Q2e@?tup8(FJHH$^b>%KTciRb-A3HUI#;EkFo=UmJ|VFiN3P#!3KnWKk+Wb zn|1_IC)AX&s{)HYXd12gs!@C##;{UK=V%wQgF3MYte@GzZp`FTLLE<4SCQ(_MlC{zs zTTU)-AK874dy;kcnQtA2ojR^t*UB<~7>qv51c>aYv;dJkNjyA}*9!8a%g0mYb2~7% zpGk#JFj`yKyU0GygA5B0*}t3UXWarsb|`?zzP%uyG4?uKysAsZ*4X-jdu=)XcLJ&R zlRP}Os!aDRSl<8j{_R(Gk2Qxl61R#3BkbeUM*?YBzxbX&t{(iAKrT1DJx)Sa4+i%7 z!egVLszG(W+3qDZJ>e*%{Z&9(oK!7cijJm0_ZrzgAWl1n5P_opSwrgMsNfIj%PCmz zpa_|1$mFoFcm;J`jY-46_S{TU{I*TVec#Vb20rO-`R&4FzZ@#PmU5CQ_NZGtBA1^x z#FA$uvC+_DAh!c@KI%*E154~CiZia@uR*E?YTUr=8><1tfwCsRN%kEt#0+3DFQmpx zf83n7ta17!_S_J+ll(c1BZ~~t3gk#Fu`2rtiTwTaHhfB3gFHo65vAhmFNmn2iHsoOnniZ~H# zI%)~aH8Hi0pl#a7tpd%Nh-1N?ao4puRb+^CY&db&Ffa{Ue;Gr#@44I$TWR%?zBA+H z82YkmANot53rU63f11cQihnneW)~wN?Bzgu0j)NV-O^Y(SOgJRwMtoBJJj``YX3&xpy3lY#sH zr-_{ThUJf`YP5XxLv8Y{xh&H#vo)hu3(!Pbe!YNi@vfOw4K8w9zBl|MThKSEsR6oP zaOXn7DW_z?mP<)6Pk@Sm8VK2ntlY}?m6hD`w?A2{ouWyH1AD~2gHi+x6#^ljNkEzn z_zX9M?w8!Qlr<@M@G*XgPvLoOIIU2KuTN6#$QPfNqtt6Ls~kCqb$_1(KB}!Ch)I$L z(4*yuSk2558KHnz6R@CZMD$e5MrMZ{3B5OwyVC!^CK6n&i|X^=O(c5kdlT6;^>-5) z8AvDk-b6x>{;P>3jmwA;{)UN<9jnFwCQNNX;%r52W2H4%4c!c4woC3EUSo`{gVzIq z*3n0*k=0qiR!TJCylMB0krR$s0nh%cp!^nPTlgZ>9}w+wO1N z6Lam{2z``bs`2P@ZhWe_uAA#TCtjq~ma&@De262?!k3e+8BKWWMmH!VDy7@%O9cKD zfeg8!*Xee9DzNcqXYZ>o2N34V=JT=IAiZn&X;;lesnHfRwfghe=(%dLdHrM?m+pEk zimVGVM|L(RP=B!YfUCiM;z@5mJPuZ!WHB`2Bw@kupO@yqJ3K&5lC}(_$?DlO)XR|Fbu5N zDh|R3+_dWoyb6mp&LLZ%Gg$rGB#jmwEDv>76U17OYwKQptYyJ9AsUL+NzbwNOey z!!Y^Yyj_G=6Y-_f511%%N+tTp1}xzsMCSs{IbF~Xes$rqSKbv&#)U(Q5%q68tsMsX zOhGBmWw1OzEtK_c%!;WF zAIOpZ|5&@rpg8*gU(+~2f(CbY2~Kc#cXxMphv4oI+}(p~aCdhnxI1i6x=e+{)wumOr3Uod&nV> zjrh?v|G$lOOKysf#(MbFKJu>@=GcD`Zc(dJciHxW{3MFx$ziD zF9sD2uJq6a&rGpy71)Up^2Wl@y@b2@VSjw43}A`Y^CyBn4TsI=MUM;Y`Q;R#L=A5N z??N>&PAl_0+iUrIF^K(0y5L?M6;9_diPJ68Pg5V_-~f+2NxU28gc|$0p9v_xua#@5 z>*4$F?e6tF@&6E^7m7-t6aXR=TPqKtntO&nfvHkHpC#K~PoW+#hD2T-2gmw%3>k{} zXADV34j4nmU>X;C{vAWQZ)yL>81iQDKgW;|G;ko~iq`1`y9GH2ptTXU-VZvToP-^c zLRT{zK@rc|dN=HHak)LpfWn3B(vytl=oKhG&4RXZw>F*CnE0)H2%)O4I^t4^g2Ko} zPcicF6!tB^zM6uR(Hb{Y%f+yFq+T14(zMzpH{~5nO75@USS(=w2%)Hov;ZNr9Uz1v zUuVY8qb1C9%cNF{CcVm=A2hg&p1PM?ru*{yzH0MTewQO{GMLqH}M-8%H<^A5VGo0M|Ug=;Glbl6IL3nI% zSD39ZE6Yb=U1ebAqp)s2Dm)xSe8E(B!-%$&2$K|2qbF1vq=#2EL8Tq;wS&BpXWDEC zSde?HDh_CV+pmR{*ZJxIrP=CXLU9Ijyqz%emG{g}EdmLH52txdn=@lL!RB(EBX+{I zr7xUEyR$C%(}l(JlcE{Xc9s&Qa)VQO)aRV_O^fKOL`po*1R37B-P0z5pKX*JWXYU) z;~0@LF!vZTvc;q*gzG#8flpB@FzV+CX~h0v)ZCvb!b_FT)nu3VF_rM2yo^A8S02f) zVdn)PsKydAleIZUvWz$YO+fr75vmRfAVPbo8Lx%@5TT}}38)ctG<~bsSnG`6{uI_( zX#Op%L;WeNL+NBLw1DA81!O!yd84d1w6-C#DXX$Xk3$vIr)}89EkS zHy8CPAda?L=GB7&6xQ3?*sXZ~B|@R)bpS-D8nO{MfCz>5>s8qZ%GKBYTUa0H7SS{S z-p{tVTc4}>m_qKZhWsT$JO8X9HO@N#g>{8hk28k$BJ7XCI@w2I9V$_>{l5^Q&NWRs zve(^>!^4~wxRHB;n3=_*7pNWeL4c3vr7r_AwnJ6*M~w-B(xWF94jPeh7a3vk|acR`r64HseBd7Dvh=7Qkq7`7(M?+BtJk?k<^BeJhRg4OtoTT8G*_T*KnWCE zCdFlqKj-~d2yFno?aFKmpoz5GS6L#@Y!*(SObxuma_o}IuUN2YfB$@aeJ z{SiVf!{7cVOUN;l|3gd20^XHY;3u5%V&H$ z#Q>1JCra7YPCFt8W|&_%r)xnFMH-r$15oiLCq^oIRd8uK;j><-lnY`Rb5mj&8hpR0 z62IZ~nwHM46?PC8;Tv>+24J5do zwxwZs9j2X;Tl2aQ*na}+>kJe`b|Fd-M;4QuNvI$Z@sxG~K5_>#>YGgNWmmNu1h-+O z&c^=;q571%Hy{y?pAp%e&?A%-AN~Z^KYs+)odqA;(Z4K8+4x4*Ql9=+jvO-n`u_R9 z38Az;O&xws?!kP?o|)vhkXlViIk*5JwCsGQuZFu|LZf(Rav9Y1OHD^U@N;#W8>X7+ zR3iszy7~$Z;RUZP%XI{QFI31@@anS{1Z$}ZgmvY~=gzMQ)Q~SqR4a0SgwX6Pox=Jg z*&TbaB|-2oQS3|3!nBA(M*@AvXQ{<6uXpsaELa(zKQkrCnkUou6IXpZ zz-*8dY%D_oL};a4fF0Ao-@-bELdO`plzLo1wL1yk_Ccq^ z&Heke!$ikI8C}@`1BwEQ^tSGO9Oh}Hc?rtob*9KnoN;p-Y)=Df+!0YfrU;acgC|uq z!oF=z|KQfz5fi+jS&qCfDHv4%f-I<8!%t&)?xnimjk@H*h2pJOK;WIllgL=DXN)Cq z>0=Pd$fUAZ9VV!&Q}EM{YIQ`rxl$)fL|&S80Y91fL4*4vu4 z3Jl$YUA&ii5i9BlU#`Y=m>dGuA(Fwzg(>I3;+e^JZ2wMAO|pg2KR)b8PieTFFJ4a{ z7s!sn?iBA(RurV7y`;#vw%N6)9BeF7y&)seWB~Bth*iKJOsuuuQ`! z-S)azlQp`9UJ@3>2nehn?9@mWq^|sj5Gr2$PheeD zakp7iiUF?{S;D)^MpCAQQr14Ml!j9}EBFNg-MI>Z+5DrFrM z?mRjjSyAJ|p}VMexob$3T@BuTkf#}yjb}&ASuD`CD$xTtx5xPC}gw1md0qN zS>?qzrUVGAhXitKIxT4sT3{%B(}Qek1|1MOb)4lzx2x8y*T76I% zntWu&``|YW7km;}5Y*{V#vMb+!y_dKUh$%-app>9A8as_lD3bI049jp5Z<813Dx61 z0_9A!W)0UEetKX^EZgHWw+>2srPg^uf>&=+xvn4B_fxg|E&#()#@1+(qd`2$IlThd zXaTko`V=}AZ)|HJleEDEZL^k3w#EKL@Orog=@LX%m)tZoE=fsVF!XL8Z2YXZEt;Cb z2otS~<#Z?YH*6UDv8xt=F0qHdYX0CFW;Dlrt<; z&7QY8VC^ev31T*GmjRrg?SNZzwkEfqVw#Zkf&(D{~6o$B*k z3if-;6?<17!k|d?{4XDI^3;UCgsX4}vuCSvdncMM2Gj3`x3{Q$5W~tIh zRkCaYL97iQpX|_j)a4_vPVymy z%6}gV)LT`A-L@xf`&S4}DM|PvgsxQJBWbph+c!cp*Xbmd*d?#i^0BGPN%Lvy#2dZIX9JfOkQGf{bi! zNbOvXTr+Cy|Ms(pmAN@^S|_Jn7@r{8tDa`!9j@(?#HBMwD|dAyS3QFjx%A!2*a- ze-k$7Xu>SSYS;$i@NHs+~tmIefAY_PPSfmjqoo`aW1@a#uRO~|t zt!3R%Jj^Y#?ITMTufwZw?1KFpSm(U^6IjP~dj1nwKj+_d81$h-A=1$+IHyV#)(oc+ zhh`eUl|p=;oxMM0Hgs}b;PJg9G|~H2r)sLNvH1~L_fXyQMhWIB{R}g8JCwS<*a4VJ zO^~wv6k)_(siKHFUBe!@GmA5DB5wZ$2&^+|94x+#iCCU1e^Z7`>hyp7R|wT%Xu3D6 zF>un2FM&x%;YNI3t1^`|h}M-gcxEZB@%j)#@qPk?P*}&i8$%BmKww>TjGC(LAoN2BO(;ipzH6DBGl5qqh#h*?_J(xP_nx%LKJ9jM z_r2l=m20;Jj!cK!Yz&wnDms-4Sri$oRDxLpmF5?_iV$g~EB6oEt6!HqJdy2|$qdzD zU1IUrw@8udOVl(`DE{%Y)v4qh#*@Ay{ltbs3CsQY3@tyicT z13Z?=(Cny#R-9xqah*aO>`O?p$N3V&iH!pAVk!*KT)Ak(sJIKOQmd4#DPH_aMcDbB z1!vm)CGI}xeG`N|eO%;xShtGJ`ty(>nYnt!@)7+-BdVseabjU{XBzbpRek)qjf_kR+J{=3XC~JlH zmIxKr$#2~ZpZV4ShsKANvEt1cbhxTB^!dWk-!ZHF=)DB&$a()QvVQ@SLj%Wy>D;C8 zm1{)NL+>rxV0r`Q?Q|gFT`BeQUcm8=*Zj`D%Y$LXh4h(j#jw+WP{e!}K!gSswNvK> zY*1m;mD7KjST}O=98$wcL_U@0P%m(%4p0MZAPqg)qXGfL#~HxTks9|O6!gz7asUpX zf~wL3@Xu4gSaQnz?^x2w5iV;@81REThd+4#>?8p{Xvrp*ym6^vhgt*hMb{q24qOzm z(K@x`2KGP9&%cYuk( z{oP-MR~-KpJB}&Bo};c-_?wAxFH^!bGI4hbHul%|t)QI_^k^Z&w;t%z#l!IY$@gOt_swN#!^-b=jlK|(dh7o#` znKDU^VO4ko{}KihlsWmi1U4#zxQ50`4JD?7jz;BEde~lRTSm^QIf>P0>S62 zSl?+~84OMIN5gx8UJhk$WCgmtW5fXeGlKXqLT8{qj8H@wE)psk42K!jeg~pF!Y%f? zd%N7LM-!fSB%vyy{OMEo4do*bul|b!Ux!f5I6Q@M!Pi{Qvf%>r6VrIIFJ6*F-ZAQd zU%})VLxE9)fv+!E9R}aNHMRtEt#HTp4?UT5{6Vx|oA&rm-yg^de!2~ps0RY?1zpUdSi0;1UVE9%I@;Uz{S6UGG8imD5nZq+J`KFnORp`7n&(jZfCXQ^U|x2%)@~ zA@^{gCuG4l6+nz6QLhxM9y>)xSuH85o8aPa)Epv6JuTW463RBmQ^w?q*|9B9Ys)2F zepU2IiQ*+VL_uZJA2;yDy6S5Tvp^w=M(avBBRRn^6x5(@4UnyGh|(V8_zj6`rs$TH zi7u1XXvSR!T%Y!s=qu#18Va1*%jxrmVjuD?cT;2$G&;ll`J1sI`l zS$2ui*z5a1#q{cQlx~`If-m3D1lZIw?A9rl^@v(~f9{VY@`P`-buA;ey5W{wNHEMKx zv&}p)^`H8@_6WlFx*^N;IgzN-!Vbp~@rnSA^{&S7#$ta8h*El(`@FvC;>24;YQ;h6(>>>iiPnfh}Z`fy3zsKm*T2TS-8R_Z16piG)qbU@$ zW)reNlzY@Q6MCTCtM%=!jFe{@Vf>f{6hA8JdBH~OaE&Fc@+*BMTn+mQ=?U84;^;g# z*jVF|k_)@4xpt+YdHp?^yOIjFk$X*+Zv>m{36zlR(Iv-{)2?qm+Zq#u|21Dlw zpoF4fI?w;3gi?$$fo&*q{iB3V86Ytr8aH*!J=Dn4n&q`$QMbwui3f-|Nj$vdChn9< zs5{0Pjq;2b6Q*4${st(aCY6HxIxM!wBXcg=98w?Tf25q78SVl?`?6b+&M`=Ahs<~BodW||gy8|Vsb#12!eTQ-af6a)_Qt6IAta6J9tB86?PLbzn9Zki;<5{72H^icFTVZI*!xTX8Iz$T* z`4tG4;O5I=i7=IT#BNAj+TLVeaimH^pqfC2s6Bo1KZ^2(e>X#3n}vqkvsZVR^_`+I zDh1#iO?N+TTaYGyMYPl&8GBSwk>L;h$k6^*$y>l;f ziX{hjf*}8#q^{@fKw^k{kka&S?l8fONJpc3So|Uie-1^(K4eOxC z0Hsb)JdZhk6Bjp@SS%*$9!R}W=3%DG2AW#o6>8Fclz|KO^N_uzZsvlOwFS)=GEXb! zgZ@uAZ7mng6N3&5nz=vGiu?B5w$X}i3(Oq!G8c{1TJJ;N8$@^ZEZb@~Mp*GuMTt^8Tqe^*6 zQKn%i_`6!PW?j7S-a$V^3Yomem~ycaZf@TE10tmqdZj4IQ-mS^?Z#F_!1P>TQ6!1# zLbJ((;N>c6I5bJ`Z8<>I$Vfw1%YqUT?CSettI1JDQv6L)C=*20_qxil{rAMRp?80= zs1qWQy2mc@3DDM@fUWuTZi#to4#$Oji=Zvpv`e<}AX?;@p66rdO*kkxa@Zc%S3rkv zqH(pmUG!14(ggs8YPeAy&ZUn?6x!eW6opdiE5h#o3x%@$FHq-@0DLqpz z21nDTX0LL)eRF`1emg9qE@!-woCTSVh*jmCcJ#<~T9?Q!5-|qV;e#lO4;Mf6w`R_B z;!f!+5C6C<9HGqm4hrJDrO(k#s2A@$m~s`Q{;q}HjO>EyJYdU?fWN-gZyn{TtwXiW zmk`Oxz@cqJFjk93m9SqsMgp;@61^_#8R)mmYqQ}_{LXlV7brl>F*3f>;ZMQNfySf- zOhVNbt8c0A+H=D1!kj?|1u;+I2??>3i}LE(M5zbIyOW`p^IajD z(isItwj?{B-Vu%PZ-dqhr7GIh;`eAP3IHdSU~{YiVOuCcv&}*O+gW#;vl3J6H14IT zA0+sILi-!MWfM;K#sglE7c1ZoeB*OMQ`}@@EEi0;Sk>T-kDHI&Wun)dISc!elD}e1 z+6k5Ka8zlyag~3$T;n=7SP@W^2ifa0R4Z=5-ijDWOjh=&kMpK7zNs@Jt|ctd$%O;y zL-_ykz%11}iP# zo&27j>-R7RB{CPq}_(ATH!1mjl!u&;#THxq3$ zObjIzJ|1B)dekixswCTN7RdLTVHGQ&O&_m^e_&YQ350S>c0|)FG>; zHDGuIW7g+Q<#%DM;6CHOxH_G&XyspR1kw4)L1gdKerDOG*a=nEgO;Y1r0w&1RHueb z4(;Dm3{m7-GKL5Ah%ofFa_B~}2t8>xz+m&!AWYG37ZT_`k>b|gm$-|LK= zvXcJQ5I?Q)I5HD{3vRR4o#+Q9=%N|@euX3$+yGrX&cl@GR-X>hB$gxu#I9^-WTlhO%RO}N{*q6Gf6fYC{pwJGu(_PgD8=o<6D!Sw1gSChs1m$!`D_ zvI`X+?w#EdK~WR`<*hZ5WBs>-peg1?YbD(;qnb|R0W2B=QrPI`ErG#l0)JS+2N#Kp z?fN(TY5zFa=QMojIp^tol3VyiTLJTJixWSKVT7>YlhuVYKx6Qr1hGdYwGPR0xR7&1 zuoRN$>-W1G{E|y@m1XfGjNmI=)o&n1+cSdxGLy`o_|VE`EA3%FXh6cFJy^3d?6ZdTQSUOVQMjaB@D5dnwjr6S1oq}TGKAId<{s_rWN+i#M&to z*xvYie&2^o(N2VlKJ(a3Z(d zzW&MzoS51!k!0`ZJDn7yfq~=?3uyF{?vdZKK#kU9<-pRkaLbHAa13$J1Zi ztxlL*8>%M=Qr3Ib-e%rToL-UAx4YecBBe%>mk+zbP3ZdR8+W7{!`xFwz5W8S3M1-k zg!KVN7SaR2NVngT^^=-|NI3}^SE-`X&DxrM_F35w;6}RL3%H9>#tXn5iaON`#(PIU zpgt31B~gTyA{v@4&*Y`ECwWXm{WeYg(&rKSljqcA{5UGF?yG1X@EbDrDkmpuP4(GZ!`>?F`p zx#S)Lv>;%;Z}NB$o`FA!k}UhFNXKW z!&X5Rl?V^B7vvJYd_|QQGK9-Tdo#!Q$f#EltB@e-^$!T|qQC+}Nn%2At%<{|&c|AV zRCZywDQxKXE(s?GS7XzS1~Hs~p?)TCD@8q;A-BQgV6B{~?g0`sajq2X);J0y6En@8 z`|n;Pf<20|H)*JbB6aJ(UL?8B#(F!aN;B2=Z2(Hcy@w2U&aS`*7&*%I7mQrL^S}6VG`c_KETLACjb~ZK8FA7S_A$Rn{flUjerAYS1_XwT=OK)qzPR6@e8j~^7dzx#fHPTR|4 zvhm&ZaSacS7lP;E?P=~Ze2tLTw!H3D)wKs207YK4&IMtgGFC+;v$6y!tbvUmn80-% zm~`0oi8XwwYz;rjC!Qnv^g~N)qgadIz}F<5x($^=Ofxi%-b~ z?|If-N@C>{!X7Nhq{*=ZT>dhkxPloymL?#jk_MMU6oQrgiv4`3_l`Z%k!59qHGFFz zv&>=vH6V<-kNzr=s6$N?*<}LMJtj#s$x&I+31yS0-?5bAxXgq$JQ)EI^?fYe-6Q-R zJL+xjroqlvP_`kh)z7Lw=5za#QL(0i2%j!BV3CJbzsVG7{+y|EPfm34ROEPpe_S>C z4=)mv?T;6^EE-_%@V|JG+Q5IjNabp!@8w_A!eZ~TOcq#SsmljBV$rqI}v@J7MyA~sSp75tbQ#*_$plRsn zq3R`!uFmHqLMtd`17uATmg|XEP;e;nRN8Vi6ZwCMYYXW7U`xHnAVXD#rwy_JvN39d zl{5Qttg4C*ly5VEVF4VuS`=0GwUs#(wEq<$Oi*tHLN z8#y}V$gqz{hn6g?3rx`nCQ16%y=IipGvnSpUCzPk0SuOb`?ySc$_w9<2^rMg)As$P zFUG_^*jXJZ(qK!ox?6M|A8d?(Jqw_gKrkpUaO{wo(54@juX$?b{j zT)1y(wFd$c>O)(b>*VpUUIj+w=jAj;L6jYdny{w=cV3R(=t82jAz^$7oJw=H5^a5q zA`9fQ6vha*B93Y=Q`N`NT^rS5dCOQSJ!b}_%W^rYLiq^-zWa%_kvkPF+(Q1 zQg{l!*zGbbph2Pht0p0pyvQ&kn`s>H&E0J$;fdc83Iz*Q26cCOw@&qLCVXCbVWF!M z$L#=WhTY7I5BTgl;V8^-iLSs|yDV+Ca%Z^TYJuhSXrnX=K5Fc_$!gZ*1Zw1Qu0}|u z^rw_@-8%uXH`|dlBLH=l^V|&nmA+Vd)!`*LK?fX{bM(*kxUU?ODnb zY`-!J7lSmnXWvSfh!GZl*_nx{EiSyx1TV0vlmpM*P$A96{Xsi7_VwE*KNK-}haQQA zs5(x_3rksSYw!mI_Au-^YB74@8lh1JMx6v`MX17vLUFV1hiU(@v6?NeJR)~&2063+ z=~UuxB{lJwS=F`3vCs-N$+xI&ctm3nA|bmqVQxxmxB~FX>I^3`%PISUQRO3udPZs&bL~3; zSL5NMIb(bFGAEhAwOE{M;e=BUR!WUWrqnlK&!t?3$4A?&w%+2t8X>U#cPmmu>Azc% ztDP@(lkG|?@+PTA67iRHa3pD(V!`M&C46;oYIt69^-btY!}1oX09{zmsKK?CTTG?GR_R>!{dPV@p|k%1a}n+Los~_3R(P`$xLP z!2*t>3$Vf^aWzjOc+>R|sQ)GeK0D**|0EE)Ml z&>Y4PPTm>(V*Wzh(~9DqB48qm@Q?)`&4by(XO z64~}0OlZwLzwOE9d!Ks1 zXNHW2xT_14qis?SK`+*Xl`n7x&D&Q9{&JD0MPG-za_czQGR0I>#>LV2m}xQt*o-m0 zx1Z}8g*Vx-54m#3ksdt$cs;mKLePZ2{vo`jz!qZ1Wy@Km+LcJP( zB)up$2o;b}uPtdQfyR&zYWyX=Sw@N@!PyxYdqwQ*yh#Rws9K{txR)K3a>5M$eCc`ZGDKiE`GE5w>D| z1#fqr66lvecG(feEuz>%T-7@FNjgL*&uGjLcc$Ds%LmQ?h=VshRq-Cih>XM|UB$s( zu|!inVkien``@Go$}%ujZM7xFE!}=K6>wuwx}E85^QN!r{1v3Ld=e;R6>?FSxf~g~ zC<`l~p;j>D%E$F>pBERM??54}4rwY+f&RbANC)HpA7o@ypc{hTbK|uHwZGhkmxSjM z6Qg3^^JYzISmRC={@Ux$)UqJ00acZ#qF<_LQy$?vI&?KIJ1WMdIy^CG%)8p$r8GH; zo*AKotmQUHIY!EUl6?f1L-r;1X8T3T6m8YNb+c~eQD95}0riOigH%9q;=NKC(w8;H z9wSlqpMZLG@t{L&njyC#S<;K|MoOlmQuZ#fl7{OKZumz6`V(7{@c}&bUQB)@A8I8A~(0+X zzPI55M`g5_8YYvEvl%iab>NQNC0?$Kn|&g_Q^B$XO}>cT!@pLs(4 zg*LJyb}Za-$?Tyc=TTT@*Bfq>B0~~~x(4Mw+@tz!NuXjKM_pUFO}xG>A&@tHglwQx_Zy}aTtNnUA?#AsD-NV)WNEBrLs2} zZsBGI#7YqGsR3Odg^f_Z+wVA*A}v~Y)+p)sa!}cUJCyC-=Hke~K8p?8G9aHj-hdRuWQdyDr&7a_#Npo6IJK4E=rL)DF_B63UFyx(XMFK?Uq3jLFRZ z*L?E6uGw$4f|AHaGT!-fp6a@4AP5D66i#SpVk2-HaGu<9gM`1UON#_R zmt6w@Czb%LM5!ag4C(o$QciBQ0n<|FLi*=)xuzs$!#A(D(o$+B!0OU{%>5K*loSjH zJ}Nrur%Jw>;c_nC^)%1T&B+nOE0Y>A?r4jlOew4D7vfO}&{!y}ZRoKOepQq&+m6C* zd`$2dczdMf=yt}ZIPMC;>0|hWs^94BSz)+m^5hFwa~2fv;gnel@y8|OIKDFs#x>X& zQxVXis{!wvzGFNFy z*Q&H%!`@CYM8fjYaH(E!W7@9`E&Uqj|$bYMIrNGh0d;|Qgzo`4I-P=lJ032Rg4W37XUU|X%4S%WCi$4PbpdF8IeUdw+~rek znFO)s)sGzOg=L&3-Zu^+ec;RU$G$-mRrZTiNh0bY2nz60qu|mIt@T+KD`r6>*JMcg zC&D5t2M^Qqf-h4vh+vW>|oC0o;AbGCX7CG6$qZ*Zsb zB*DX??k4LvvUsW-!Om6O{2U9@ISkb=h+p6fY6BcJCzrX5ZO`Qmf`_|)meO9UZjt47 zK8Fl5-2g!|*IN`|E;Hl$hg`V_lq=m9P`)h&DtA?yu+5PJ%3Z_0;OBB-B{5H=`nQ1H zrSd(hbDl>wl9@8wKxh(Zgipzw^x^sl{{nDJmc3a@o6ks;%QY`}&)p0M;vDnd>853Lc>7SJDo3A+?gKeJSUQLe4q(Ns?%?sx=aTFy7E%>RlqQ+(T7!Om}XBi?R*_~2Qx<&XvrD{p!Y5V)u>8C7T`JWfl z*1{etMSe}yN8C^1r3{e7AX_Z=i0S|0_z`Gx;!=?%PM$nqki_2jDDe6*yhN5dAP^`n zT$Df$Y(5wdWsH|P{89Zwf;0B{S=y&s;p`TF^a0N z*_i*~a6e!}A$uy135~NwW8grK@UYEcC0VAMY*|O-A|ly@c(^`S)AH@WF2m z4QdX>bC=RroDoG1y*K#0=?$p2Q{lvSwUSF00Y_(EbLZM_4*3-q%IATK+6{)70E#F2 zZtN{+O@p|m^)S_;C?i|GIt zanpS+j+Z!qE7XrKQ2;LX0T-r9fG5*-UaWN#&IUXVKR?{&m_I2FKYwUP z50^#Tn5uj^+u?xz9v+RhTl2=$A{tFQofm#{NXYf~(#!4Tdw__``vYeLxK_T%^R$pV zQ_|n3e0fh#pq(}to2Gbd6^(8XM>~?E06azNDB(U@!>yB`GSCL9Di{|$@GuyDHmTBa zzF>9u3m^}|d6EJ5r7csbgIT~)YX-@=YyR*#S$za2F`?hMQ?kg0&6IcG1xzYYd~axL zON)ijA5myG=IU39$QAuIHDQTAPrqXvRE#TpO@d<&1VwbW!gF;eYCelGajPyC*0vBO zIhrEPI1=@q1}BjQ{y-laPlNW%M)KU(`Csp!RY*fqW;O#cG632`)k&7lIf}n@~#>%YTZ@d`^JqY6Z=wrHS zVFy)X^#9J`J8~&VG^9qDMI1CdjoA;3b8b>0qR*FsZp$#5k)(6LgBBwwne~2EZtv@CS4T>LRx{W#)CeOo)a@ zbqg&TQzu(jkWhb#pzjNSdSZdA0srQy%z?W`n|Bvd&3<*iJ%=R|aFp(6llam#;cY~v zM7wy;6iP&`AL9c1$`_aZ%G%%ZiBV?gN{gk&jJ%J3id>?a_lZ-wN!9a$Ye?=UP4I`+ z-JMlzN3sX33ltj~;_UL*qlg6f;rLw5;ejX?H-06Zix3MA=<$2f)DWoZFzBoN&Bg-qEkI~ zWchfhR-K|Ik#`JvO&F0B%0+7zS*;PqrSz`HHdYTvE}YyRJx}kdS1Z2mn>3xF3>G&7 zC&~VD@a_xc=^NU`f3z{j+G7ca+ZKv|H?I*d5Q$sVMOS`Y{2re3#qJ!Uiwz3T9o{< zg;6$5*-Un}#V<3=BK*`31GqApLgTu=0{L1{7A%=O5pw_ZcNIS~@%NlAbhS!apy5 zqt>1?qoURx8Ejnj>Nomk=Sl@6o71SBaNXn`@?b=3yjgr65w5%rXK_TrqNGC$ZXS5t zLf&ScmWw(xwn7_WP8aiBu9J zJSR4ckSI=LB@7q%N1>F}#Sz&xKS|_XH_($lCn0%S+{f_J1&b=%&xck!FAVDIW@@Qc zG$8p-RaP+3)9-k%xj}&YW;;ZJx)^RHqx$s14}WTI!h)`-HB z*o$LnRQXY;!l_nDPeD60Tb16N>LeX5J@e(U#Z)+#!dP(}?#c<;ng%6_Jh(?B+lgX? zKw^JcUftp#r47vEiqicv+GUuyv6qTrTfVl2RzT*AxRqeH!WL3l$t_yRN%)$8)YZu& z6BIaO;i&YBWqpew8#^D@k3#qMcBOTo3OXnVcMBR3nb&Pj9%XKx{Zgm30I|rF-840G zkl&cRx(n^U-6!2MaDnGFC^3+MT`X+5A<~ubQ_zSYq4CMZ*tg6+!<98ZY^=xjRm|Ny zXE*szkcpE2eL~`i?=47gDb3{)jZw#v%D<+8HLka5L8FF zaLDDz&IKHGOMfEah-DD8)`2dA_j!(>WnaD4NL~*$)*fOML;EmI`3PDsdX(HKUxMq~ z)mdJ}YSsL7PhHYD35iN6FZaDF6Cvqb@fc*u!!oXvr*!X+xaVIUv}fe$uuS7{u*O3I zwuKxoAa52sAH&N>$3MeMW`?;bkOEcrad$1-L%y&Lv*G>JqSmY4#CWsFpH{mt^&Zxx zpQ*O(x#GWvcssfDhy%&iwvDIRJ{oW%%3Tn8nZvh!NQF$xB z9xrpOec1M2?z&d-7|c?bVHJz*QZAs38YPCF`p}Ka4GU|CyQ5aFwf4zZsEUJK`k#BD zA8TvDi*WNaVOzHV!^^QdpsX3*7>4v%f^Wb9ae>y z=Vcf|*z)++uLIIs*ZA?YWe0zS?_3K{>6akn@aE3(Cy4qx3}~}i)<_rUmW9=rIGmjG za4m1l$Nzwr^46p1lr~LS&bUbU&MrnRNF&Y~cz>FpN(Xmd29V^>MCT5Byp2Q64pvFu zm!bwIZ8~Z;$2IJcjZk8xqX68_)wNI+A8;H6a{^>2=@aPzV#F;4)5nqAzQghN%ts~p`= z^*=i69bJgL>jS!m5qH2oyXr^pgRoE~M}fb0-oqp>)}Lk%2ONa=&>?VIMa@;&u9d$U zKTzUf_i)2(p<^2aQ8`KiS<&K3ThIvZji$hb?d!y50!ZNNEtwlu$tYsIAWv?>ENI}9 z>;Jl5n=hXU?agB1D=v>lSF|Oy4z~4l_6Tor$OWM03?3TSe6vV_ zV$waf<7BQpDQjGnuMgv+K<5B}!uryP`LwQ;HLzh3{DWPlbj^{qm={u?0wYq z5!yN{JTg9w&7QjYN#Fvqz&`s-V9b;1%`oY}pSkhKfBWnTinnv*Xwqki#%64t+bAjE z05%d#)6=iS)5ZNSj`j~8S}bnK#TV}g42)o?9;7T~(?#23EM4Q^wDigR zp4!+{jwx1(P@baAL^}wnwT=Q_)E9#fwR$vlj7&TFVL=;;?2sU2CR!Jo}e^rUN(p4KJ2T0d$Y zVeYhZPrzJD^z~e_1o5Juuw=K+K#tvNTYJJcwiiic#CI6?P?xR14EUaFBu<(|mfQm%hw@sX9#HxirPT)qY<7(OCM(Q#`MchqMWD-3 z1Ixl09hJy~uoOa6wcK8_Y&$p+W5}=*k@=xFirnO~@S{dm!&Ib*BygbGJdJ~3$hbqg zF93n;^!|! zbfR~cUppAt%&%7yB|RhfiotNdqnSjx;`!ivQN&FyO8OKEefPC`~6g#?4E9?E@yemEUY-VGF}=LBVik!{Z( z9|#%Cr{}o8>2;AP?5l6cFxtS=Edzp=@e`du@G=vkN?qAMQPrekL`b0||1e4_oYGd~ zeQ2Je?}RPWCmeN$=zQJA8vFQO^Ki{IKl%?tQiCpCV{_+8>>^oZ2gw}f*_aew zg|wD}kfpG0V8|$)4X7FJ^F>TL$N2ZF*(oi3&reNBbCviFLd8Mv*Sy};u%MuJj4b#@ z&50>-^8BO$J-l!Ta&JZeH{Tb(ocFE#oCnUWd&6Iy9|oc5+CL8=yRYc=&L#S_a8$6b z+V~JKdwc_9mNJH-sPIgJLy_}LteB^_Iw6y|Xf@bOiAvT4@Wa~8c!iZ!UcBxWA(K;z z^1bM69TfS*Fa>Of$@)QA#lsYsfZ~XdVlFwD#NQ~`{p0sUg*#FXWf1q@Ma_{C+55u! zEnpy=^Sp2eG&Raxq)jH`d;voqz(=$77E?JND4HN6@85T={o1&3)th!3YWN{{Gk*P} zp)|z+SGY~80e&~-=IW*TQo+5*(@|0M!l0|k2M4jT2Tvk_^R?(|AwY8pmuULC|FUMV z)-bhU-<<6glHhC1S!JNDY&HT#CR&+Hf`;?-Du)iiroSyg6xp(YwgJ$0p*yG*W_qTZ ze@o2)on3;X;wlnEBeo{kqSoJe5J>anIM!NSo$d_zecMJTf7 zGa$nx2u`cHd|>x<;Xy8qkgVkU3-?GsC5ZS+nx=SAccuFz91{Z(NQUi1X+mp=$PF=1 z|AdvrjvldG5Ef5AYeJThR&I||YFK4~5_n6C)2-klW>F^>^10+(ae3PnJ>YvK%AX>k&0(Fc}YT3S(h2>QfG66y7errHgG*Xuqe2X(lk}Kf z$tPUDR*Fv9Sx9K)fa0V+xkXyI4A)utm_TuGHvnN_$wC2|LHDzYu(7mr&G{A}C6E&J zksMfDvOzGGdo5 z2DIHA*_YtN?W}}R{}J(?aH`996AZiK>Ej`CuVjteFRf1IqF@JxRa5I|Wog`* z>y(EvCUc7|SWgcMfO&-2gLx!iF=)jMSH&B7%tpCDdY!J9vs$W02ZS!qest`USxkNj z#zDYtX0W;RAv@43{?6#8zTH}{Ea3|;`Zbj^8HUPs+hVb!5)fJ>Z>56P1Oaj5kas@a^n*{K$~dje#@IQ9B$bc9Q2S2Uh zw-QWh2=KGR2ngbAzi2Bp=)NDWfJlBPTBeZ=9Vbz*Py@r{a!Wu3Kk=giWT) z%rI^DCT-n|=%&Ifnq~@Lnm!_z$AE&?!BBss4QBRlCdu+DQN4AUKLr1FvgSOLz)1S2 zwC5dVr$!R0SSy$I9AkP&{$5ZNwc|R zSMvIi28(Qf`SIyFuS>%R5*&r}Orzp*1x7eI(xXl|5u1bPC=&{!l%RYZr(GY5;kV;4<8<;wzE2G+vXtUA!*X$z*4>Y zz!oeF`AZva0h=m(P|C8j{4f5K%YmURR)5e$8J#89&VSRsVGKxEm|^?;>kmt2n*hg}_Yfm;Y-zztG2iCD<#==mGcdZxE-<+qyk%yN7nr!y zJzYG^)S5^jR+X>Is_SB}ZQL7E#Kxp<*=6J@a@l4i97Txi)fR=ZE`1IE0aykolid6A zBBv)GJ@d*xe?a-k3YpBjtevqtn}3e?fc;6w@7`Ct%a2Re0n<>PO1b?T|UqvSB-Ldf;31;;!I}<*@y!jEk{yK(fcQ*_O2_CdM6=xKb8mU0(q_8Y2f zmEyT9V1BO)#RdXfj$l>TEIQ@}7@8dd=0E3WFH|h?1hVsCSi(|(;3b7}Q^Y(Y2OFYD z@gxO3C)RA&rpr+Jgt=JOZ}(O&b)^7cq&p?`-$-|DU8FY40{-zq5%2UyfbTj~o5}Qs z$0gwI$RWo%_;thJ`ZF<{Ue(#&lB{LlBv}5Jq{EWeyBlvP)fP-n5khr^n$D=rK5@-J z_Du2vbV&Z@_{Yhu@-iHc1nH$NDpRCwQpVjmDmb}mh2jvI((&Yjc<;|zYi|+W@ASAB zu8v*(;{S4&a&fOw>9U5a8{D#vq!qU+fbkxO*m0YrX=v2R%B5=?8SKrx4L7j~rnS5s zg{7?%Iq>I3TY&@R_-Debc(W@3jPVS`YM>VyyJ!T8&=gv#yaSt)%^vu&F6|Lt!31`4 zEWs0sLfmKw3hGr3vk2(OBt+#ES1#FrxzRhY(VYqK91fhN7%u%ba|MULe8j0&nrY&) z4Jw;ZXc|;z$`2V8UaBzp}HL9E6=WeW#UT`Xx zH$bP`ZHJ_@1nUn`eq&w zeWZap%d)vsx{ z$H(0@vE7*TJ;}RC9in-8-TCj}+AqXvF<& zMm`QImv8wQIDbT=d-Ee6bBY6@;BAe)jfLME)J;y9B1!Pa^$JosD&k?$ShT_&LmzmI zS)=^3-7CMaNfy~}l$gsX?BPPb^a5^-+i#=Pi_chxdw6p}mW!oN=Y8E>mMS)wiHw%; z_`6=*1FY|a0HP$lA-CVmn7?5Jvj_=Sb@9aDDX^o%rzY}HG>6>!%QDCf_Ny3v8?sRmiG9?bzj;wKt`eUNx@)IHa1w42eaw(aesdq` z1_e40im3XeZ;3iqx8EuL#_kg^7Wx%#-K!`HLu!@>7%m5YJqly=rwRtG)+Eth=7pf8-_{G_i^ZAVr`?49IF|RKS$O$du~q(*E=B%y9a=fJY~DjbLIrTO*ht0MFCT;e8t^k-8`BYPz=3G# z^ILED=}}CkEMcqxu1p4)@BD--N4o)aqu%wo!B|mY++H2AElFsk6rK^vT2|E1v2pm! zMe0uZN%LE;Sv|{Rl$gpyX_n9Rx@VFccs#wk0tCOU?D#ybY#p%HtuflmrJYs^iGVD{ zhP~#V3Abh?kJxvf>>xcgmvf4LOo(_TodEBDnoj5Io7La_H6{4krq|6^DInuvQ}3XS z$Wii`->F3107@`8Ji}I^#lXo$T4&rfF9+bA`keJMC-{>W&YKB5x{jOMgKYL4ID4KbK zgxn!i?Pv>U*v&Dr+S}UIurx!5USt(sfWD2eGHY$gLFL?VPfRS^#uUp+ix|5Afht1^ z<9u~|(C22(uT28@OlBUjy@XCU7^66+xQRVm0V*oP@H8JG#d30d=L7ZGZP3p3r^9;2$c=JRx#%x;SeR+p> z(h{bZ0UwH2dBwH2e$Nfsz4;|W@@43g49#u@p-d1uK#86N_ZP$BRry)n018Pl_a=?2 zvEnmo*kr6!`?x!D1tc#xUpIpC@#ZAU34PO3ScwAMh(-&3ri?<+kh6(h4}*%w$Qvwj zE|gdh16~I&Jks&GIN1!t2PWd2OSa)1*^wf7x=)g1Ig&c=Fvxj~x{3I~GBR{G%D&#;B8}~g)&#!>Doy=!=RIx18*W8I!Tc@m z1DIobVKg(sR!8;A4zD|7rOhZAwmszoWS3a86T5e?VhUq@8nXKI%ln+^QPoi}@GDvm zIpfWXC}i>-dfSp?B*jTAsvQvW`vC)uir2dyT&8g^Ex0N$F;%v8!EcpjkoGfY+%Xto zG*63N8L&BW6Eaf9Pz)L8?C}dx5ps%CbX7+!rI!E!BA7F{T&&m@WU=D)jzie)j));D=M;Y&)f$wk2u|(h26@xsJBmBNsj#FE9-uAd-2O3T1zFx+K?Ea zLE;zQwx_(zHJdfRFQl5!`YVm^1ZY5#9CVAC{n40tN464>ax55fjKL!1YC$g`S*K&R zBepN*Nwik0nqiYROdP~5F~i<1LAoD{Iv;JobQ{2AQd27}_4QLo^uNLG!DbW`nkO$7 zhm6HUO)o2qt#>glgLsZ7e_k!{(liQr1H!$>(Y^8hTqSW2S2yocdaN*q zO|BAr>nWK~v_KGI)j^WPB{&#_g`HmU&s3DIrM?)i2*61g`q0QAC(3GQFkYoeQOk>F!474?kqOGzu;f=7^oP z0$vVkS<4`Eu^-Sf>|dMYpXY&&8Fi$OR%3uTT<{$G=z?v@q+e0DmH&`@7STYs&sLW5 zj4fGyv5fj(d8JPBFy$GR+ydacxgRU+QeDVI_mqKJa&Ykku41)TwNJoGP~Kke&CJYW z1Y6_}oqH4g*U+3C{*Am`ipT+=@aweVCOOX9uvgdOM|8~Q$wF6}g|2&q-~IB7$^KL{F$ ziFuuy(}Wr)kTC(Hg58o8&mEm)KsdmmViuLXmZscn)nGH zQDQ$OH$fuI$#(#gOV@`FPPOl->L5EVp$wWw_a+gpXl1g}#XpI?q*0DV-@x@(c#v!k>->dw zI~eAOpM@A5(Ilt7|Y5cvvGkx=8gB6{t3=4(}DNGbf)?KcU7eKs3&#-D07 z>?zyppdG)pE+2Pm`mIIj+kBn=ayD2$;I7ufB3>vWgu0eTi1KO-=j;95SHzaSnrH_* z1+zYyzFd&BJksV-g-j6)+|5^Yb%=q}ZXbrf)cbj^h`p@7U`9auE_UxmsFWT;Ae0~C zTB$19J|v2)q;DVB__s@SkT7!^cKHFm1P8)zP8Yjon_q?*U3p8a;*YsSg{hOu!KX2VPCm`CVIg#jV)$^PZxa^#PjqVU=##2L0neqgD7i+^aQ=e5pN z|A-YY8i{Lsz4eNin}1?l0^i`wBN}a<@n)q48V~<}0^Vv((K*lS6ll>!kx%_|80p4d21SGt4L#9!51m>}UJkC|qo4J6#!&6|x!!R8`79SrqtzNZP0-M?~MM=J4@{QW@?c0@8Cl0+81l8x#_jggW&)C|eJfTp1}h1g~Is zE#OYZaynenHtwN`*U=wU4=OMRx9$@xM;v~o-FcuOK7UU5OraOPd%^r>dRpgpG_Qln zMoV!Hr*!h$Ize(B>m&$zd*|Lp^|R{tGZfANJJ=q7nJTgMTir~mfjd|N{D3Ch@V@qf zW%Eor43u;`d*=HAp6zD$c1!JkgAl#FvrkD{pW2M(M2}E&Hck7ywafQl7(I^5>hp*;k9&qYk7KlQkG#@s26B=QKo(L{`9EwVkc#{R z+{FG59@zmLRLTGk9(4OIYjM3&1zguj0YK0Hm#)mf|8;}kjcI~%y34zoyyfF9+3Rp~ z6UeuiD}i}3Bkt)EPXJ^e{~b0k#%?)WA72vYhSugq-dh>~Ny;H0Hwio>d)F@!II7U% zA@{>PsZ~EA;ioBzyf3BBzWsEhz2Y25zNX)Km@e=~{0$d&{Ub1_ax_P zUT9G*wOmO_ftXQ>8LiAlr90+POMN9U^*T8r(ZH@LnpAkTgNBooD~3VKQYu z;dGbtu{#FF>CcsqhtyxxZy0q)9G+P9rE&v7p!){GoMClo68fALMAj11|K__b$+%^K zrbKJv`{MLS3Q8sTRO+!3Sf`c4|F|mI ze2vIPzyZ13{Dj;0S}^w#%|F?-!>`l5LNQGrj)i=DuTv?=JpRNls9Uj1jf;<{bI$ff zeH6_!Am9lCw)Cy34Km<}g)OxIEqEjBa^!8;lhV;Y_GO!UsbrA_$(`GSGJyepDd{!| zm2s!NE_IQ^e*ocNKg$3}5#Pz|5uRhk0&Audc$-9ONVTf2snuH2-~S}Md(z36|NNi{ z)Hp`h9?!TSA5ZJ`se*`RJm0al7JK4N@mfymfh|{A_vWWt*N!?iB1e^L@EB?sIi^In zq@ZFN;|)|6CP78RKsjPYVSPaY1ghO<9mJ9xNk z>RLz7vC;BzGko?AbUo*^T&YzkySe0OS1W4h!DoRMKDQs;s*}}QJXNcDJz+ZIa%w>kowOxlpzRwnCh1n*79Kq z8AM5fi>sh+aPRKfnLw~zPYqhDG804csWhI&7tUClu_tQ@>!>RydHd;Hj5k(aG6?+m zy0BIApU(j~?RUfw85HUFm@(+#*6w-^X_ZZgsy+!?FtO80X;w?c+wZzWHeavioyz-$ z>{8{p9YgnyN{T!(ju}9kSTUN@h9Ga|R&)DXt#r|$0svqPJruB;H-WUmQ42=$syKX= zX+ov-TWsXmrQ0&$F0#-qY>FKxWSEAQbPHM-qt{{imQ`leuRv}0F1@vDjm}%nq=WQN zz?+pF81O!Lg3yQNw*m&dmtoT(&CPwsZ%oQ`XAd7E=I$dXWzi`H$WtDBq0aPuC> zdxh*P501+WvW|wwj)rv`tGt-XP!e@nW#xqQz@X3DH1v?PtLI32JY~sENVe?|0K{3&G_+-o4*Ud(amaYe}0M9Mt!5Izt&sD0^xNLVUvQOe$*DF!xRh@_EFT zbY+`<&`gjh1N^!B;q>Nc^oY;nv5TTy$|NN>eHxPA7PPh97iU`w_hryWjtC+p1`2T+ zUx?5R)(XO>!qZfo{M@Go@y!wghE@W4={%qTE};fJezqN%+P%cN^42jpOl=ayJlc8R zWv8^N;Sl+yZg}NZ`0iXZa$1~NDrbNN?*P{+Id&A_1?!)JciX=O?`BRO1+UZ~`v4eg zOY;OQpsW&=gL-<|zSV(d9Bj(3roP|N#fwW&VEzJWIBSa_?M;*dp*|!4mK_mIAphKz zTB{qYAS!u+Ero2^(W`45&&&(r;Tqtct4VC2-n2b$k`!sg$p^^qUI7-oaiEpWSy{wN z4l_~AYU##fgZDuFZ<|==w8qeIW)?tPkS4CdmVEu(X^AwOn!Y~QqIWt?7*clj6;Pq= z2&W{Hn1V@!x0|BSR-O*u=;T^0^Q|tqT!(7~wPFw^?%F1;=v#M#CR3d4_VP_)7~r2k zJT4ynwbXo!%^R)Ao#CfivV=# zg8BD2q=qgJDA9WkB>94Xujw>H2v}LKQBIwQ2x<~#;G|J4!cP37WZ$8xgE=TFx?A6G zf%9~tW4RP69>pLd4EhlD%z=H!DI$J?n;*gXPU;JYIdl^5u9Ult;N!#ZoWW{(QDRN4l^Hu(-avGxco_7!E3zKCYM7lbM+i+BCF~ zVVA~Q(7(2(l{Iqq42&q4mvdTu^~<{O7~2!K-$LLvE+~rG`5V>OtT5t-3;Tw&gnAW% zOBvmGlT#r3McGWCFy~Uu%0Hc2gMEw};aP>aio}(yX>}yasvp&3$0HMZEJn$tShS~a za%eu?gEU<{J!YhRv-h81WPIC9NvwR7E24@q`T7!ijvT{FF~EfR=6a~{asE|RatU5m z3NXqZR?RkKcmJo~Ek=Rf_FY$N$SvKlsHjd-ffkG$z=CipWPgld>at+=O|5h82bd^Z z{~3tXWWZU_Lg~+)3}_yG@Y_(AF>3@PNvx2f<4GaA)Zl@PAp)~R8_W2fwodM!_^zkX zhD=Zqk`7*@{5H>7r>$qg8M^7TLs^Z=G);@XaoZQT4{tLg>r7u_}< z1o>UpZqhJh?TlF*hRJKAuHHAsw)&k=wzBWQ?#}aD3&B${lZ$s24yNyyy*;cNCFoC@ zjU~ROqk=HV9%P-N0u1Pa*~%Z5GKqQQP@g{kh_T`wH3`f~o~ET0NCqCS1jcqoC$Un9 zI;?Rv6O^moF#DH-|CJz;3RY7We*XhTrs~*kmd()FUrPon-*iVkl)lSaVHuQIh`QXm zZ^+0S%=K5$V=%I3B~!yAE~p_YCg)PwZPAT0pKy;*)n`}pQ4aeclml@a z^=j~#OGUOp8xf}l#Eez-MldZY`@d|XVwHe=(4gEZhV?(J5?|Rb-?3W3{yG@dpqN8b zCWI1m1yTu*^4Vjc1zV9sJJY!T&9SQs31dZzQfxnIbQHzNy-V>A;3x@Dih4DPu+9n( zJ%$>((%J->n6?BayrE+-nvkII*Nwl%Fn> zQTu3C3=MY{p6dzn^*>sab*C*JB@8KytTy{^^tva+iXnCPu9XZE~3On9dN%liCu23BY-AOBw9ZC9%yS7<2B7HQewO;t?`6 z%^7v)YKsd5XGRte!6Gm>58v5t6zmhiyw7H?`0HVXbNR%i&jd1eySIsB zp*=Vm;%?>@RiuLAln{v=O90v%^ES_Ms=-s-FWI+r=#y?dct|gz3$=*ry39AU5RfYG%)IJpuw>!$}G|tSRh*r<)nIP86!0fQw-apjtXJj4Ef+Q!N`K zHp`erBH^2^a5KEjqAdMdvzLlbPsxKh-AJ5Cx@$KIsvcp)pUXSHrwaF=@lrj}J1G4sp=2u``1>@3mC=Y4H)|Jx48VF3QaxRjjFM zsG3GI@8G=fryg=v?3#{W7=d?iEbXyiQ}a1XvCMa*doDp11O@@NM?f$ISjh8O9<;@^1N2|uHB!uV1xuB;$4?(X$eUR;te1nq`hC$H%M}f7ai6{ z8I%t_&Fz=klcmi$8;-jM7<6?{QS6(?UdQaqOnb0;noBxfZ0ZhvL!}qLLKYPD6XcL_ z>qK=%o6xW{H^=4rlU#iqF+tsmgy?GTyUr`r`EnCR<-Pv4&O#ZloiS)I=Y}jZ81?zvhpZE%ewn4^YCq6CR&zGn+-Os^tS9p)UkO?_{-&ldo~2X$ zQjFna2!==Bo{80sv|Tl%mBz30gehhOi8x{gwt}b-awCa7VK72MeJoffmvyv^WFuhl z&vmCqT$l{)Qvncp1vmQ#d2OEg5Ar(IS7!eVFXxznN&!X6au~RrNf!g2iYlF8Eahja ze1?@Bz`Z&vm}jc1Sn87A_%HC<|Mp+tb>GZ+ni!^6fzzUYOg&5fujcooQt|@obO@9~ zKJxSX+ub9Jr6R(y7binA$OdiYfXs^Q!s75lw>@i}>7S|;Dy@bK2IY_=J0c*Jr&rPe z?zKP8=9g$2!FigdD6z>&fXFHwf#1xH?7h;Tv{q#8vtqLB%i#npGN}Q|sL$aiiaT8N zQW5WOos+yqYM%XK{S+n;@%wNSZZ)`M?c`{F>jeDoD=Y5c(4so zCS4MLPBbp`uclj|MPi{As6erH=3%-r__3+5@; z6fhmIh&txlSH)_!QS7Xg+?_Zp8i4|t!wBWU&|~<0k?E11JM-5xR+kV9GVZzaqkLfm znuGvI124nSKlY8n(L;TsdX+ScDmL(nWaTuCAh$La2+`$`_!e@GAL4&5%MWv;Uvbe^ zWBZS;YyjnV8XB#byANtB%4vz3CaO-_+>*UiqRkBDGxWQl8?*QG?m{RYI*JdFD;a7B zdJ-x{M)J{ZH5AD?6~A_AL}-{w+TIB;wtBxoNA)RyC%E)$!=?xL!^Ked!+gZ@ru2;c zg=?;us+v~ScGIK%ku>gPjc(B6tknREq?+B`$x&yfD~Ae;&G52*jzD|3rkmr*8OF`-?(7TO=ci(S;@QHsGrMzr7v!J(vr!T@>FT$fpnC~jtB4(6)|O{z>P3X5*lz*Rat@p>F0T2UYV?5>Z` zZ&fEE4k)g1Fc>YtT;U7veEqwC^DnHq!p-B>q9=>r<2^JR-80z@%yK>@)=k$4%kyID zly?jA;9}jOnZqn4;eCACuQC<9v7Y45#jeLc_e@KA}A@{7ya|vyL z1Gpj*!m^PqEqmD0BVGJt5SMdgkyU?lGo3-=q1BUjJD%-YC(vrPq~C01*MT#O5e-S! zh7ZZhBR*9~mVuHS{s5bgO>gik6GJ2`I7CxYLPXx4eBQJUjdJ_JPu$$KIniM(#<-;jeAYUqr$z(yzzi6MxD!+n2;1$UO&1 zYNgQmf(G{{xJG!zFMNq%F%g|&6n)ASxUTgrhq9rZ{J7A5$V{NG6^c%2=%T_9tS5pu znOh+&_ZP9BYo{#TH18HIQ0ed!-!d%Vd3oUb_}Ep{Crww9ITi+;JoG(t;2seqS#ghc zw?0|iS|G3(>$;E64;QXuLLbF0a_KbOHG0-#!)X-hL~@&X5H-G;OYHL6t!S2U0vmKge|u;|XwCM> zeoN)TV36|7Sg=d$_HacKAN%wS@6ltdp2MAT>;rEL%QZ5W=#QPst#?Vo7-+yFylhyu zw><|{58QXD=U2~c9zQDXUiTk?Vy2zl>2nj%e2e<{XQsAX22gJ{0#FB^si1Gx#}Zgn znczhcC6v^M#dPpz2Q3M!z#LMky+Tg%F})WHi4WmpCj*WJgao_ur5T?WcC$X9M8oO$ zpu>Y(!|rexA*-eDw{;9ioCNJyMi2VkW5YuPaWG!4M8rcEGiP*QDQN>l*PiFSFIh1! z9J7K=1X(7)JROwKLbPsD$K)jlcXqz|}vqH=Z>xKF8^=G|2pRX4i$k1x<+1h^e%!r93eEB*8cY_3ya79bC!xb$nqor zE?xD^zkjBZa`WG1rq^%b5LS&^XUMaxULK1Y$s>5klT;N{bf(HXq_g*ap0An%3!9Qp zBe@(yi3HG|DkFpo?}5MN`j_`}+_Jv_%Hm-z0OhrOi6gp&f7jcyLV<-!PK!f;Ld6~0 z+4}&GVC_TC>Pz@9U*qgt%_GXi|2I@Go%vrY)WF^P1^<3VTcP9MCC3w*^DiFET7YCnz<-CdN&jwnBm40G@23B?_x~S`6*;3=Hy;DUZRo$bF&N8YthI*yVld8*)U=KM zU+0xM(H*$O0d74aS@hif&k`UG-!=ZLjVnUxuM}RIf$&kRC;xLCMS4&82hj6#X?P3% zaeJ0?l02}uGT_aP1^?*#W}8QDaR2G^eB{?iza#gk7_SA(Kpx60jnyVxKuJ^yvJa+Gw%Kf!K=&D4-*xo-#zBxXPXbR#2NW6 zS-fx^K?W|%;(gX7@fG=*?I`}^0z6jA7zs*#&WsdYB4D+@-9`+YG{WCv@^4wyxj#!8 zQ+cL`Gwz%R9~ON?WfjnOVJR&-`N~cDBRfxD{u$mZEy0u{X|CTgB3QeLtaN*+5C#;# zU}tLR2xws_iE=cnWK%>tGRQhVxqSKB)~fq+@I^A#;1Zj2)UWlrw;l{GjfP`nWoYD8 zZ;*2nMLjore9@}*;QJ)Q2H~?)(_3A+c~YD>UgY#rFN$D-{0)Ob5YpI)A4Y~b)#~as!n}VAuCt`rMrDx zJMt~|Thh_R>I-$wYED99?mBw}PVXh8gLfup92Pb}GV{Ql?~W%Xzl*FWIvr&%`h=k@;W@SR^5 zkhVU3y}dtQ_^e~k0H6k%kU$R57@ZxR`9u9OSotfu$ae9~X+InFS@j1FS?Rll-)c;( z`nlZ3juD!0VMoraR%3Ba^q}S5qBegt4sz3257!GQ-ZyaC3=a7k7P=PaDjfB#(ei%v z%qGI7zVAPWA)b~`d)T9KCGE0eHVT=0Y0&n0rtFmSX9s!6- zW>Sejf5Oz{-N`~|@a>Mmv~joFw*rX~>7BU}y%@0{7S zg!#F{IC(zRG@)RY$&JjxD6)Co3o1?11Lkejh2HVU42s^avVi~HxKGIEdnu)uY}qs| zhk;1Yef8OFo?%d#@`<2I?-u=7sjcDlKl8GJjMcvHZ(ph)iiTlw_>I{?y6ll>i*uzH ze<%5{3^>A@1)DO2eJC6Ip@f$gfD>qo#LmHqOazJ63L zF?%DWLwL+pEtb#v&PTk49gwo-7ZZ~!z{{}W*X8;0-ctYN9X6X6xLb?HI}z}J6Y+Fa z>2W-vujVfDC_M zD)M8V{?0We!6d{wCO-|t(Bjqb0N1=>J;!jdI6`ELnY85E`xX?@|HnExlb z8%5;rWL)R8v4hTbE3-84e~*hv|Id$}9#{DP^W&!-|NjuBp2ouV+mPSE`}ce6 z-ud8WusPE|F%AXJ_n_)TzK;7rCqC>{WvDsJPtxY1Fpx)Xqg<+yd^lhQp^mZF`*p8q znnSCR8Hl zg$9(@QFpr;nk(2p4^3!hnb=$IQNuLW7^R*uB~-%y_v^4FbE|6C zU^c*@jkw3QH2k4t^E^BHqodS09(UCGfeb17j2oN{(qH@RXoe8)gb)>o?rI8etvre& z!2X)a?Pgl-h46;?$OHTS4rEU#ko;v+T~A}Uq3+-d^frI<5z@_tS+-49XQTZF_YaK( zcVywRxNH7^3PXzc>L8@FJ3--IsPM# za6Eece2kwz9T75mKK|;(=;@0WFP=R;Oz$R#f@caIAT)VubN+v5=kibg&2YlMc>VSB z!RzDaUsqud9S!}A8crY7l7|K;0}Yf$t86DhZA5$9Nl{;*^S9UT;G!pS2FcqX+wq9c z$^Ju-B_|tM#2UycojpG3D4bm^8dI z)$yaoVRc>(kI&g>tFWw^4K4cpJghfQDMewePtoH-`_8T4^ThtrzIKP8Gu{90jzGAp z-2v!qnZF;@xBJ;4ePeIb6ZrycTlTEE{L`WJTfb2|XrVE&wv`wq=_n1lf>**rX% z2r_|p3OPXj1of22NN=5XB&KSUb~uKhbKCHNweTOs7t1@iwKYS1%!8-5u{(GlQ{SWJj2yr5Bh&GB)- zz6pfCckZ*C{#)nNE!n_I`v0s<|G#>1{8dN)KSZfKXcsCT!W2-;c!1MW)F+ej&wO1Q zA3%N9%HJ8LQGC;(sd@eY&eKv3*L7IY60Oa8Oldg;@tQB~E@{5xx!sO6?us@3-uS_C z`tKfieNg)U^sARIEA;g`w|)Y+d|R+TQ#Kh!To5iH7@^ER-k4h3TqTAJcc|FVp^rZ%RBLmHkbr_5RM!nJGS^{~sSefBLla z{>xF9|NjG(kXhq2l{s%d_glXrm8iv)2UYI5F*aa;t($%{-e+gHlJU8f6nS2WRk=#} z$vs{33c9?9CAUz=wgiC?!6FBCz1knoAn18(hP7&!ABI&08&-L2(@jJwffbq9XEEI; zvn1VUi2m0BK38be-RvDvw%`elqAp1RQteO9)^ObvvRj;@HBZt8r>WsAr96JUM9!;L zYkYy!%&K{q%2|aqw>z(;=GAvxD=)>m0}Fpw^kF55&?ELTcc;cjI|SwMh;@RcEFwhZ zrvlk%Y+v%5s(Asp0m`L^xPA4?1KrJ#mX#;DSAx26I>EabdELTe8A@cNsZ;+-ct8RI zkG0{MM()Z9Ttc=$+ghv(U!9@rT%)XFMosPF{6e~*IkdZp!6UW4|E z7PLg8V0U8YE-_)c}udQ9X0Nn+k9vP%usBdcK zZ+;FhEP2y-!SIYm1318JGKlcNMCA{>p!Urlo)jKs-(RbXZ))j9+2<0k=rd;0OsGwF z2QBIhn=Xi3H6F@&wAX+Lt}A#z{!~m>@Qu9MIuFeUrrP4UhtTQZ`+!PRuD+}ACZTh} zh?JLtk4W*+eLc)~M3rCSHy7kX-S9u%#mPBI@Zy?8 zoW=D*Wnr4bnpVYCA(Rq9;T@@#T^8z>J5%P4-M+VCgK~E=gRu6SsUUL7lek5PNmA!qm zU$#)Mn522vHZ=6EfY>*1U$3}Ktr#ZM5gGOS8+-EpX6AkduZCr&-KGlpPQ|{NioNn~ zZW-Mu`xl9nz7CHCpV>Pxs7&fFkB9AU%Draw{%i?)l$40gazoormgxN5(F#K)JrIjf z0?7HO7$aHb(Iy3fs}dwr{IxbLB~TH&V^{9=%e)d#bI~BIb9VLW^yXFJtDi2$-SR6`lUBN?j4|>B|kQjro~O7{_0Q?qO9cZv|!(2nt0MK z$!t!<8K0$C5Y+q2H^;-{r-P#&D$?m6vJtV<9eziZ{d3=q@CEvjB@2J5`jW=v)p$%I zCHqG5MUcK?(s|Vr^p-PH)}BWRB}^GqJ!zWvpEsMgNua7wg#Vhc*ktR4 zCy(_Xc+P2Dms&NaI^mybmL!K?9UVXW+IL-DGx%MNNW$-jPN8duhS&8fw-c*-&oQsY zbEA>^=PlL=NJjb99moawoe9XFd08R?;xj0aog|9|||%d-6c?5Okq_#mb2 z8~cHOXEn;Xb%68=2hRpUD3xg^ylyDGT6wD&*V|8FQ~ST}72|mODUY4<4XRKgp^^>a z)#aCdCP|^CcgGvFVnjJpLmeym=w&_nKQftg)?@>#=>M}9Mn%mG_w6VKCPQWi|cZJ_p3A_^+4G%kf_?zk1%q z|9+6NCH*&oq}P+1Q+`=)y&1vpi2d#q){;cJckj74#7R2ErSWl+@Ou(p3O=TZ73)zy z=FuGyht?Ud-@ZHBBIxb})pyqx2{TDf)AUr#a)UKaQ>;JdQ_+~%YGEQ{iq1%JDy{mf zUs-K`HSY1LpmUm#35idPaZPWSp5dkY;gyVV0^3)rLE=!Id4hiV6`?P@pQI!T@iB^m zD)4p`ou&FNr;>&1MPKQ7lKFdEKLUN~8=UsdXV7|{Q(-@*f@@w*V*A+`IP8a*-?Mux z;?v6u{Y}Al)y-aid2xAG{NnQBJpV#u>{R|Fi46nL_tq2Cf0IddrGGKd6qrqj&rbr` zwvLaEoX^k)!d=i>_ws^tIqs?+~`kg`o`&o1!)BXXz~IXtTYVJ6Jx`SWMSp{za~N>fbO`e{8M zbO&ky`LU1FCs*3h|LyXCuA=|XpH=*Sj$gd&=>LZ(jY0C;lc6_Z}3XTt(Lv~R5`(vNZhc7GW{~RYY-Zlbk1^s{i{HwD6&+%7JyZrwjq;&CL zk2L=4XMgg#2(XXMlOAOR*nBC1w2lF5-^~uAz#6i9+U#$y-lc-bLIBqQ-I2vfB`)kR zrV@`5;`tP33<5NY8E&9R_7lTeeg39`&&xVLwq z&^=8OM3~G3DK^zq4UQj-lBIec`Y76bO*FzuvN(VrvC_0a?J14~VdTElk)EfP76nfQ zg;mfQK_fEef*|rPrD8GM+xy}RbSdDyMJlNxa&K=?qFu-T2Wmmy_$1LQ(cpkwg?oG7 zW=Vpm`N^<6{Xt~#{GvRtoIy8=iNZ9Ih%+?h_j*~86~Xjul)!uAj6pM;P^EcFVb4&6 z85$8Z<{1N~q9^f7VdR)c^4BMhZdYU|9?8S7en`XjhkJW}HISjjb%KC=fEGMMvrH;9 zra~%L$2_R>7AW0wCSN-7-P6*l5f7%n6aV}8#Pj^o4m@$h(f zRNSse#1b?xd&LR;SdEtMFICFnGhj)!lT#IrtOTn^+Zp#Pg|7Y)Nd)vs3@OS-+>7~HgfhAwAy#rdH zAKcj2q)i;b_5lry!!5l_Nkmr5?UIsXRQ>P83}2SqS8b9*fg<{ptjTA{<#6U1F3H)y zNC+iVo4dHtG+E5mRrp`~Zi$INvVEG{2g#pF;Zj*BnR7HQ7gF!mX z{hoqZdV=;D++g~FCedo)o?{3WSgrO%B{-_&uw6&ybT22=&9zSqX^KEPRm$kb>jEf2 zERO2~UyH)~fzV2ywUt0|jb@+ukDZkMb|xz@|EdT7WF;%$AKA9d`58Ps0e!zP%J*%~ zwce{VkYOx@hd)8dHb%#~4p(ENUiJD_)_K(@!N=sCPF1E~!Y%a_bG> z&YGtA9?eZA(;aO*M)(o4oQAiFzs@6YABVp+rK-j+NSEXP-YQIxw8Zp)r<7~EE1S6`Jn|NQyV%%*h1ao+OElM(9(QHZI-)$g7^H~lX} zC-1nEwJSU~X`kuOp_PI9YX8{a*a>f|)iun_y+czWw_D?2w{nkU%9@bCru$Vl1xzWK zBE`yT+h zpcJAz?>|ma8s>S35?EpXI|}eyHK51kKYIr83N@+AN+MMw6-9SS^VbZxw`}+r`Q4Ul zG^Wmy%)Bhlsq62@MX1H3Xxy3wy519bH2&xDq+KdRX2ryI)(* zS;ng?n=`+@pB3@n?Riy+%$Sp!1<}AGS<%vv06Qz*vXb7efdp@N1 zl3w0iD%%xo+ZnvPxeUgi4BP_`3>Z^5leC*dwNG0hh8>kN>;6Lj(G6@YNCqjh%)O3i zJ7OiP`IlF3uI{cbo5N-<)~|Uh^^0;11UUi@ko;@Mp3rG_8mM`lBP@c|Y+d7NwniXh zxuRnAwf=Q!d}dFvVy)M!YpItNSG>@+ZkVtp0XV?*Zu`J1I%yY96_@n}izF{>W$Te{ z!lM$CH0bjB)(|$-nzZ5>FSKB}0L#%v9XqQf8)+E6((;;(tRL zhz)y*K7Q_^?u?8!cGs4JHSt9Zy-A}SL#_wMKtp0*g1_IMdR>~83|QrCt=bkRG>}yB zs@O;Mc(E6iENH!H&nkgU7{Te>&D3L^px}>gks0j1w}y3Sz~LK4u-itZ+7r<9!+;Y* z7_@(VEfUJNhZ&136s&o{%|MuGi0|61Y}bq42k2~E@Zl2M7=F*wCScT(5Zhfgc=nuV zGz9k9@Jly^-Xd66ZP?OZhB3T0lUgo+KHu^!8VVojA*JU^tMgoJ1?}re{{0_6Owldi zQ5)RfNNM>;y#Qn@$Y$Unm+1#k8@bCfU>VVI`;P9L7mKTsr#10!91=#_UpcyP?nf~w zHfNC6D>Gr6y>A-pzKhh2 zmN)7eHK()3Ej!>tfjR|6)SvLOaRk4X8Mk{BNHNfkFr~!WO!u&=yFuJn^OuZ|R19tf z_jSYT!@H|{m9$~&?M7@DmWLYCdu`2t*D=RZ%`ySLCmfd*#qW(U+t0RM^nZvV8$$me zitIB*&{yao8EY(XoRD@7VFb47xAcDu@&h+)>}aOpZoGH)BYh*Ya6?Y0>qn&eHPdS) ziqM-rI>TUMY0~_LP;aFUaMG-Z5h|@NP;F7HPsf_mPE?ES3i|Hz*Vb#F*jYP>qus4f z12k|=B2hX!fOvoU<9FYWf|X2fdSIB|Ak6ue>q?|*6w2j7?S}K2QV)>)_}w^~F)ri^ zGtXhI#nG}kf`>7D%v$;tZod*2{eVL$jqFD{K=%!66aA=R9n53dhdef}DKkfF;+3B}xnAd7!Q%#l?aH!lS2D0G z)?h}T$xi%6kU_G7wxjtyHE7L|@kr3Bu8<@EoU|rTqqf*V3^^qzh*A4MKV`|G2JVRt z!eO35mOBSMBoYDe7o*I5Lc0}ZB602nAL7pAJ^TXnxnIa^YsNfcF<~-vI5Fp@2k@Y+-lqnN3)Jvatubk2ZAKJ+O8YLk5o0l)`khK)fMOCtvy}* g-<)du`uqC(`uqC(`WyTGHvj/ to match the name of the +service generated. +Users can provide an override for an explicit service they want bound via `.Values.providers.kubernetesIngress.publishedService.pathOverride` +*/}} +{{- define "providers.kubernetesIngress.publishedServicePath" -}} +{{- $defServiceName := printf "%s/%s" .Release.Namespace (include "traefik.fullname" .) -}} +{{- $servicePath := default $defServiceName .Values.providers.kubernetesIngress.publishedService.pathOverride }} +{{- print $servicePath | trimSuffix "-" -}} +{{- end -}} + +{{/* +Construct a comma-separated list of whitelisted namespaces +*/}} +{{- define "providers.kubernetesIngress.namespaces" -}} +{{- default .Release.Namespace (join "," .Values.providers.kubernetesIngress.namespaces) }} +{{- end -}} +{{- define "providers.kubernetesCRD.namespaces" -}} +{{- default .Release.Namespace (join "," .Values.providers.kubernetesCRD.namespaces) }} +{{- end -}} \ No newline at end of file diff --git a/charts/traefik/0.1.1/templates/_podtemplate.tpl b/charts/traefik/0.1.1/templates/_podtemplate.tpl new file mode 100644 index 00000000000..ec657303545 --- /dev/null +++ b/charts/traefik/0.1.1/templates/_podtemplate.tpl @@ -0,0 +1,257 @@ +{{- define "traefik.podTemplate" }} + metadata: + annotations: + {{- with .Values.deployment.podAnnotations }} + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + helm.sh/chart: {{ template "traefik.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} + {{- with .Values.deployment.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- with .Values.deployment.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "traefik.serviceAccountName" . }} + terminationGracePeriodSeconds: 60 + hostNetwork: {{ .Values.hostNetwork }} + {{- with .Values.deployment.dnsPolicy }} + dnsPolicy: {{ . }} + {{- end }} + {{- with .Values.deployment.initContainers }} + initContainers: + {{- toYaml . | nindent 6 }} + {{- end }} + containers: + - image: "{{ .Values.image.name }}:{{ default .Chart.AppVersion .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + name: {{ template "traefik.fullname" . }} + resources: + {{- with .Values.resources }} + {{- toYaml . | nindent 10 }} + {{- end }} + readinessProbe: + httpGet: + path: /ping + port: {{ .Values.ports.traefik.port }} + failureThreshold: 1 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 2 + livenessProbe: + httpGet: + path: /ping + port: {{ .Values.ports.traefik.port }} + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 2 + ports: + {{- range $name, $config := .Values.ports }} + {{- if $config }} + - name: {{ $name | quote }} + containerPort: {{ $config.port }} + {{- if $config.hostPort }} + hostPort: {{ $config.hostPort }} + {{- end }} + {{- if $config.hostIP }} + hostIP: {{ $config.hostIP }} + {{- end }} + protocol: {{ default "TCP" $config.protocol | quote }} + {{- end }} + {{- end }} + {{- with .Values.securityContext }} + securityContext: + {{- toYaml . | nindent 10 }} + {{- end }} + volumeMounts: + {{- include "configuredAppVolumeMounts" . | indent 10 }} + #- name: data + # mountPath: {{ .Values.persistence.path }} + # {{- if .Values.persistence.subPath }} + # subPath: {{ .Values.persistence.subPath }} + # {{- end }} + - name: tmp + mountPath: /tmp + {{- $root := . }} + {{- range .Values.volumes }} + - name: {{ tpl (.name) $root }} + mountPath: {{ .mountPath }} + readOnly: true + {{- end }} + {{- if .Values.experimental.plugins.enabled }} + - name: plugins + mountPath: "/plugins-storage" + {{- end }} + {{- if .Values.additionalVolumeMounts }} + {{- toYaml .Values.additionalVolumeMounts | nindent 10 }} + {{- end }} + args: + {{- with .Values.globalArguments }} + {{- range . }} + - {{ . | quote }} + {{- end }} + {{- end }} + {{- range $name, $config := .Values.ports }} + {{- if $config }} + - "--entryPoints.{{$name}}.address=:{{ $config.port }}/{{ default "tcp" $config.protocol | lower }}" + {{- end }} + {{- end }} + - "--api.dashboard=true" + - "--ping=true" + {{- if .Values.providers.kubernetesCRD.enabled }} + - "--providers.kubernetescrd" + {{- end }} + {{- if .Values.providers.kubernetesIngress.enabled }} + - "--providers.kubernetesingress" + {{- if and .Values.service.enabled .Values.providers.kubernetesIngress.publishedService.enabled }} + - "--providers.kubernetesingress.ingressendpoint.publishedservice={{ template "providers.kubernetesIngress.publishedServicePath" . }}" + {{- end }} + {{- end }} + {{- if .Values.experimental.kubernetesGateway.enabled }} + - "--providers.kubernetesgateway" + - "--experimental.kubernetesgateway" + {{- end }} + {{- if and .Values.rbac.enabled .Values.rbac.namespaced }} + - "--providers.kubernetescrd.namespaces={{ template "providers.kubernetesCRD.namespaces" . }}" + - "--providers.kubernetesingress.namespaces={{ template "providers.kubernetesIngress.namespaces" . }}" + {{- end }} + {{- range $entrypoint, $config := $.Values.ports }} + {{- if $config.redirectTo }} + {{- $toPort := index $.Values.ports $config.redirectTo }} + - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.to=:{{ $toPort.exposedPort }}" + - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.scheme=https" + {{- end }} + {{- if $config.tls }} + {{- if $config.tls.enabled }} + - "--entrypoints.{{ $entrypoint }}.http.tls=true" + {{- if $config.tls.options }} + - "--entrypoints.{{ $entrypoint }}.http.tls.options={{ $config.tls.options }}" + {{- end }} + {{- if $config.tls.certResolver }} + - "--entrypoints.{{ $entrypoint }}.http.tls.certResolver={{ $config.tls.certResolver }}" + {{- end }} + {{- if $config.tls.domains }} + {{- range $index, $domain := $config.tls.domains }} + {{- if $domain.main }} + - "--entrypoints.{{ $entrypoint }}.http.tls.domains[{{ $index }}].main={{ $domain.main }}" + {{- end }} + {{- if $domain.sans }} + - "--entrypoints.{{ $entrypoint }}.http.tls.domains[{{ $index }}].sans={{ join "," $domain.sans }}" + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- with .Values.logs }} + {{- if .general.format }} + - "--log.format={{ .general.format }}" + {{- end }} + {{- if ne .general.level "ERROR" }} + - "--log.level={{ .general.level | upper }}" + {{- end }} + {{- if .access.enabled }} + - "--accesslog=true" + {{- if .access.format }} + - "--accesslog.format={{ .access.format }}" + {{- end }} + {{- if .access.bufferingsize }} + - "--accesslog.bufferingsize={{ .access.bufferingsize }}" + {{- end }} + {{- if .access.filters }} + {{- if .access.filters.statuscodes }} + - "--accesslog.filters.statuscodes={{ .access.filters.statuscodes }}" + {{- end }} + {{- if .access.filters.retryattempts }} + - "--accesslog.filters.retryattempts" + {{- end }} + {{- if .access.filters.minduration }} + - "--accesslog.filters.minduration={{ .access.filters.minduration }}" + {{- end }} + {{- end }} + - "--accesslog.fields.defaultmode={{ .access.fields.general.defaultmode }}" + {{- range $fieldname, $fieldaction := .access.fields.general.names }} + - "--accesslog.fields.names.{{ $fieldname }}={{ $fieldaction }}" + {{- end }} + - "--accesslog.fields.headers.defaultmode={{ .access.fields.headers.defaultmode }}" + {{- range $fieldname, $fieldaction := .access.fields.headers.names }} + - "--accesslog.fields.headers.names.{{ $fieldname }}={{ $fieldaction }}" + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.pilot.enabled }} + - "--pilot.token={{ .Values.pilot.token }}" + {{- end }} + {{- with .Values.additionalArguments }} + {{- range . }} + - {{ . | quote }} + {{- end }} + {{- end }} + {{- with .Values.env }} + env: + {{- toYaml . | nindent 10 }} + {{- end }} + {{- with .Values.envFrom }} + envFrom: + {{- toYaml . | nindent 10 }} + {{- end }} + {{- if .Values.deployment.additionalContainers }} + {{- toYaml .Values.deployment.additionalContainers | nindent 6 }} + {{- end }} + volumes: + {{- include "configuredAppVolumes" . | indent 8 }} + #- name: data + # {{- if .Values.persistence.enabled }} + # persistentVolumeClaim: + # claimName: {{ default (include "traefik.fullname" .) .Values.persistence.existingClaim }} + # {{- else }} + # emptyDir: {} + # {{- end }} + - name: tmp + emptyDir: {} + #{{- $root := . }} + #{{- range .Values.volumes }} + #- name: {{ tpl (.name) $root }} + # {{- if eq .type "secret" }} + # secret: + # secretName: {{ tpl (.name) $root }} + # {{- else if eq .type "configMap" }} + # configMap: + # name: {{ tpl (.name) $root }} + # {{- end }} + #{{- end }} + {{- if .Values.deployment.additionalVolumes }} + {{- toYaml .Values.deployment.additionalVolumes | nindent 8 }} + {{- end }} + {{- if .Values.experimental.plugins.enabled }} + - name: plugins + emptyDir: {} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName }} + {{- end }} + {{- with .Values.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} +{{ end -}} diff --git a/charts/traefik/0.1.1/templates/custom/_appStorage.tpl b/charts/traefik/0.1.1/templates/custom/_appStorage.tpl new file mode 100644 index 00000000000..1908fe0552d --- /dev/null +++ b/charts/traefik/0.1.1/templates/custom/_appStorage.tpl @@ -0,0 +1,52 @@ +{{/* +Retrieve host path from ix volumes based on dataset name +*/}} +{{- define "retrieveHostPathFromiXVolume" -}} +{{- range $index, $hostPathConfiguration := $.ixVolumes }} +{{- $dsName := base $hostPathConfiguration.hostPath -}} +{{- if eq $.datasetName $dsName -}} +{{- $hostPathConfiguration.hostPath -}} +{{- end }} +{{- end }} +{{- end -}} + +{{/* +Define appVolumeMounts for container +*/}} +{{- define "configuredAppVolumeMounts" -}} +{{- if and .Values.appVolumesEnabled .Values.appVolumeMounts }} +{{- range $name, $avm := .Values.appVolumeMounts -}} +{{- if $avm.enabled }} +- name: {{ $name }} + mountPath: {{ $avm.mountPath }} + {{- if $avm.subPath }} + subPath: {{ $avm.subPath }} + {{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end -}} + +{{/* +Define hostPath for appVolumes +*/}} +{{- define "configuredAppVolumes" -}} +{{- if and .Values.appVolumesEnabled .Values.appVolumeMounts }} +{{- range $name, $av := .Values.appVolumeMounts -}} +{{- if $av.enabled }} +- name: {{ $name }} + {{- if or $av.emptyDir $.Values.emptyDirVolumes }} + emptyDir: {} + {{- else }} + hostPath: + {{ if $av.hostPathEnabled }} + path: {{ required "hostPath not set" $av.hostPath }} + {{- else }} + {{- $volDict := dict "datasetName" $av.datasetName "ixVolumes" $.Values.ixVolumes -}} + path: {{ include "retrieveHostPathFromiXVolume" $volDict }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end -}} diff --git a/charts/traefik/0.1.1/templates/custom/appingress.yaml b/charts/traefik/0.1.1/templates/custom/appingress.yaml new file mode 100644 index 00000000000..92766f2146a --- /dev/null +++ b/charts/traefik/0.1.1/templates/custom/appingress.yaml @@ -0,0 +1,69 @@ +{{- if .Values.appIngress.webui.enabled -}} +{{- if .Values.appIngress.webui.host -}} +{{- if or (eq .Values.appIngress.webui.certType "letsencrypt-prod") (eq .Values.appIngress.webui.certType "letsencrypt-staging") }} +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ .Release.Name }} + annotations: + # hooks are defined here + "helm.sh/hook": post-install,post-upgrade + "helm.sh/hook-weight": "10" + "helm.sh/hook-delete-policy": before-hook-creation +spec: + commonName: {{ .Values.appIngress.webui.host }} + secretName: {{ .Release.Name }} + dnsNames: + - {{ .Values.appIngress.webui.host }} + issuerRef: + name: letsencrypt-prod + kind: ClusterIssuer + group: cert-manager.io +--- +{{- end }} +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: {{ .Release.Name }} +spec: + entryPoints: + - {{ .Values.appIngress.webui.entrypoint }} + routes: + - kind: Rule + match: Host(`{{ .Values.appIngress.webui.host }}`) + services: + - name: api@internal # The internal name of the Dashboard for Traefik + kind: TraefikService + middlewares: + - name: traefik-middlewares-chain-public@kubernetescrd + {{- if .Values.appIngress.webui.authForwardUrl -}} + - name: {{ .Release.Name }}-auth-forward + {{- end }} + {{- if .Values.appIngress.webui.certType }} + tls: {{- if eq .Values.appIngress.webui.certType "selfsigned" -}}[]{{ else if eq .Values.appIngress.webui.certType "existingcert" }} + secretName: {{ .Values.appIngress.webui.existingCert }} + {{- else if eq .Values.appIngress.webui.certType "wildcard" -}} + secretName: wildcardcert + {{ else }} + secretName: {{ .Release.Name }} + {{- end }} + {{- end }} +{{- if .Values.appIngress.webui.authForwardUrl -}} +--- +# Forward authentication +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ .Release.Name }}-auth-forward +spec: + forwardAuth: + address: '{{ .Values.appIngress.webui.authForwardUrl }}' + trustForwardHeader: true + authResponseHeaders: + - Remote-User + - Remote-Groups + - Remote-Name + - Remote-Email +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/traefik/0.1.1/templates/custom/clusterissuer.yaml b/charts/traefik/0.1.1/templates/custom/clusterissuer.yaml new file mode 100644 index 00000000000..fb4a85608ce --- /dev/null +++ b/charts/traefik/0.1.1/templates/custom/clusterissuer.yaml @@ -0,0 +1,197 @@ +apiVersion: v1 +kind: Secret +metadata: + name: dns-secrets + #namespace: cert-manager +type: Opaque +stringData: + {{- if eq .Values.certmanager.provider "cloudflare" }} + api-key: {{ .Values.certmanager.cloudflare.apikey}} + {{- else if eq .Values.certmanager.provider "cloudDNS" }} + key-json: {{ .Values.certmanager.cloudDNS.keyjson}} + {{- else if eq .Values.certmanager.provider "route53" }} + secret-access-key: {{ .Values.certmanager.route53.secretaccesskey}} + {{- else if eq .Values.certmanager.provider "digitalocean" }} + access-token: {{ .Values.certmanager.digitalocean.accesstoken}} + {{- else if eq .Values.certmanager.provider "rfc2136" }} + rfc2136: + tsig-secret-key: {{ .Values.certmanager.rfc2136.tsigsecretkey}} + {{- else if eq .Values.certmanager.provider "akamai" }} + clientToken: {{ .Values.certmanager.akamai.clientToken}} + clientSecret: {{ .Values.certmanager.akamai.clientSecret}} + accessToken: {{ .Values.certmanager.akamai.accessToken}} + {{- else if eq .Values.certmanager.provider "acmeDNS" }} + acmedns-json: {{ .Values.certmanager.acmeDNS.acmednsjson}} + {{- end }} +--- +{{- if .Values.certmanager.email -}} +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-prod + #namespace: default + annotations: + # hooks are defined here + "helm.sh/hook": post-install,post-upgrade + #"helm.sh/hook-weight": "0" + "helm.sh/hook-delete-policy": before-hook-creation +spec: + acme: + # You must replace this email address with your own. + # Let's Encrypt will use this to contact you about expiring + # certificates, and issues related to your account. + email: {{ .Values.certmanager.email }} + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + # Secret resource used to store the account's private key. + name: prod-issuer-account-key + # Add a single challenge solver, DNS01 + solvers: + - dns01: + {{- if eq .Values.certmanager.provider "cloudflare" }} + cloudflare: + email: {{ .Values.certmanager.email }} + apiKeySecretRef: + name: dns-secrets + key: api-key + {{- else if eq .Values.certmanager.provider "cloudDNS" }} + cloudDNS: + # The ID of the GCP project + project: {{ .Values.certmanager.cloudDNS.project }} + # This is the secret used to access the service account + serviceAccountSecretRef: + name: dns-secrets + key: key-json + {{- else if eq .Values.certmanager.provider "route53" }} + route53: + region: {{ .Values.certmanager.route53.region }} + accessKeyID: {{ .Values.certmanager.route53.accessKeyID }} + secretAccessKeySecretRef: + name: dns-secrets + key: secret-access-key + # you can also assume a role with these credentials + role: {{ .Values.certmanager.route53.role }} + {{- else if eq .Values.certmanager.provider "digitalocean" }} + digitalocean: + tokenSecretRef: + name: dns-secrets + key: access-token + {{- else if eq .Values.certmanager.provider "rfc2136" }} + rfc2136: + nameserver: {{ .Values.certmanager.rfc2136.nameserver }} + tsigKeyName: {{ .Values.certmanager.rfc2136.tsigKeyName }} + tsigAlgorithm: {{ .Values.certmanager.rfc2136.tsigAlgorithm }} + tsigSecretSecretRef: + name: dns-secrets + key: tsig-secret-key + {{- else if eq .Values.certmanager.provider "azureDNS" }} + azureDNS: + subscriptionID: {{ .Values.certmanager.azureDNS.subscriptionID }} + resourceGroupName: {{ .Values.certmanager.azureDNS.resourceGroupName }} + hostedZoneName: {{ .Values.certmanager.azureDNS.hostedZoneName }} + environment: {{ .Values.certmanager.azureDNS.environment }} + {{- else if eq .Values.certmanager.provider "akamai" }} + akamai: + serviceConsumerDomain: {{ .Values.certmanager.akamai.serviceConsumerDomain }} + clientTokenSecretRef: + name: dns-secrets + key: clientToken + clientSecretSecretRef: + name: dns-secrets + key: clientSecret + accessTokenSecretRef: + name: dns-secrets + key: akamaiaccessToken + {{- else if eq .Values.certmanager.provider "acmeDNS" }} + acmeDNS: + host: {{ .Values.certmanager.acmeDNS.region }} + accountSecretRef: + name: dns-secrets + key: acmedns-json + {{- end }} +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-staging + #namespace: default + annotations: + # hooks are defined here + "helm.sh/hook": post-install,post-upgrade + #"helm.sh/hook-weight": "0" + "helm.sh/hook-delete-policy": before-hook-creation +spec: + acme: + # You must replace this email address with your own. + # Let's Encrypt will use this to contact you about expiring + # certificates, and issues related to your account. + email: {{ .Values.certmanager.email }} + server: https://acme-staging-v02.api.letsencrypt.org/directory + privateKeySecretRef: + # Secret resource used to store the account's private key. + name: staging-issuer-account-key + # Add a single challenge solver, DNS01 + solvers: + - dns01: + {{- if eq .Values.certmanager.provider "cloudflare" }} + cloudflare: + email: {{ .Values.certmanager.email }} + apiKeySecretRef: + name: dns-secrets + key: api-key + {{- else if eq .Values.certmanager.provider "cloudDNS" }} + cloudDNS: + # The ID of the GCP project + project: {{ .Values.certmanager.cloudDNS.project }} + # This is the secret used to access the service account + serviceAccountSecretRef: + name: dns-secrets + key: key-json + {{- else if eq .Values.certmanager.provider "route53" }} + route53: + region: {{ .Values.certmanager.route53.region }} + accessKeyID: {{ .Values.certmanager.route53.accessKeyID }} + secretAccessKeySecretRef: + name: dns-secrets + key: secret-access-key + # you can also assume a role with these credentials + role: arn:aws:iam::YYYYYYYYYYYY:role/dns-manager + {{- else if eq .Values.certmanager.provider "digitalocean" }} + digitalocean: + tokenSecretRef: + name: dns-secrets + key: access-token + {{- else if eq .Values.certmanager.provider "rfc2136" }} + rfc2136: + nameserver: {{ .Values.certmanager.rfc2136.nameserver }} + tsigKeyName: {{ .Values.certmanager.rfc2136.tsigKeyName }} + tsigAlgorithm: {{ .Values.certmanager.rfc2136.tsigAlgorithm }} + tsigSecretSecretRef: + name: dns-secrets + key: tsig-secret-key + {{- else if eq .Values.certmanager.provider "azureDNS" }} + azureDNS: + subscriptionID: {{ .Values.certmanager.azureDNS.subscriptionID }} + resourceGroupName: {{ .Values.certmanager.azureDNS.resourceGroupName }} + hostedZoneName: {{ .Values.certmanager.azureDNS.hostedZoneName }} + environment: {{ .Values.certmanager.azureDNS.environment }} + {{- else if eq .Values.certmanager.provider "akamai" }} + akamai: + serviceConsumerDomain: {{ .Values.certmanager.akamai.serviceConsumerDomain }} + clientTokenSecretRef: + name: dns-secrets + key: clientToken + clientSecretSecretRef: + name: dns-secrets + key: clientSecret + accessTokenSecretRef: + name: dns-secrets + key: akamaiaccessToken + {{- else if eq .Values.certmanager.provider "acmeDNS" }} + acmeDNS: + host: {{ .Values.certmanager.acmeDNS.region }} + accountSecretRef: + name: dns-secrets + key: acmedns-json + {{- end }} +{{- end }} diff --git a/charts/traefik/0.1.1/templates/custom/delay_postinstall.yaml b/charts/traefik/0.1.1/templates/custom/delay_postinstall.yaml new file mode 100644 index 00000000000..dd6821ad0ec --- /dev/null +++ b/charts/traefik/0.1.1/templates/custom/delay_postinstall.yaml @@ -0,0 +1,28 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: "{{ .Release.Name }}-wait" + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + annotations: + # hooks are defined here + "helm.sh/hook": post-install + "helm.sh/hook-weight": "-10" + "helm.sh/hook-delete-policy": hook-succeeded +spec: + template: + metadata: + name: "{{ .Release.Name }}" + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + spec: + restartPolicy: Never + containers: + - name: wait-30s + image: "alpine:3.3" + command: ["/bin/sleep","30"] diff --git a/charts/traefik/0.1.1/templates/custom/middlewares.yaml b/charts/traefik/0.1.1/templates/custom/middlewares.yaml new file mode 100644 index 00000000000..524e9df143e --- /dev/null +++ b/charts/traefik/0.1.1/templates/custom/middlewares.yaml @@ -0,0 +1,74 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: traefik-middlewares + namespace: traefik-middlewares +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: compress + namespace: traefik-middlewares +spec: + compress: {} +--- +# Here, an average of 300 requests per second is allowed. +# In addition, a burst of 200 requests is allowed. +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: basic-ratelimit + namespace: traefik-middlewares +spec: + rateLimit: + average: 300 + burst: 200 +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: basic-secure-headers + namespace: traefik-middlewares +spec: + headers: + accessControlAllowMethods: + - GET + - OPTIONS + - HEAD + - PUT + accessControlMaxAge: 100 + sslRedirect: true + stsSeconds: 63072000 + stsIncludeSubdomains: false + stsPreload: false + forceSTSHeader: true + contentTypeNosniff: true + browserXssFilter: true + sslForceHost: true + referrerPolicy: same-origin + customResponseHeaders: + X-Robots-Tag: 'none' + server: '' +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: bouncer + namespace: traefik-middlewares +spec: + redirectRegex: + regex: .* + replacement: 'https://auth.test.org/' + +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: chain-public + namespace: traefik-middlewares +spec: + chain: + middlewares: + - name: basic-ratelimit + - name: basic-secure-headers + - name: compress diff --git a/charts/traefik/0.1.1/templates/custom/tlsoptions.yaml b/charts/traefik/0.1.1/templates/custom/tlsoptions.yaml new file mode 100644 index 00000000000..bd47cf8ab66 --- /dev/null +++ b/charts/traefik/0.1.1/templates/custom/tlsoptions.yaml @@ -0,0 +1,18 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: TLSOption +metadata: + name: default + namespace: default +spec: + minVersion: VersionTLS12 + cipherSuites: + - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_CHACHA20_POLY1305_SHA256 + curvePreferences: + - CurveP521 + - CurveP384 + #sniStrict: true diff --git a/charts/traefik/0.1.1/templates/custom/wildcard.yaml b/charts/traefik/0.1.1/templates/custom/wildcard.yaml new file mode 100644 index 00000000000..df35e4a18de --- /dev/null +++ b/charts/traefik/0.1.1/templates/custom/wildcard.yaml @@ -0,0 +1,21 @@ +{{- if .Values.certmanager.wildcardDomain -}} +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: wildcardcert + annotations: + # hooks are defined here + "helm.sh/hook": post-install,post-upgrade + "helm.sh/hook-weight": "10" + "helm.sh/hook-delete-policy": before-hook-creation +spec: + commonName: {{ .Values.certmanager.wildcardDomain }} + secretName: wildcardcert + dnsNames: + - {{ .Values.certmanager.wildcardDomain }} + - '*.{{ .Values.certmanager.wildcardDomain }}' + issuerRef: + name: letsencrypt-prod + kind: ClusterIssuer + group: cert-manager.io +{{- end }} diff --git a/charts/traefik/0.1.1/templates/daemonset.yaml b/charts/traefik/0.1.1/templates/daemonset.yaml new file mode 100644 index 00000000000..c5d4d23730a --- /dev/null +++ b/charts/traefik/0.1.1/templates/daemonset.yaml @@ -0,0 +1,37 @@ +{{- if and .Values.deployment.enabled (eq .Values.deployment.kind "DaemonSet") -}} + {{- with .Values.additionalArguments -}} + {{- range . -}} + {{- if contains ".acme." . -}} + {{- fail (printf "ACME functionality is not supported when running Traefik as a DaemonSet") -}} + {{- end -}} + {{- end -}} + {{- end -}} + +--- +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: {{ template "traefik.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + helm.sh/chart: {{ template "traefik.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} + {{- with .Values.deployment.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + annotations: + {{- with .Values.deployment.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }} + template: {{ template "traefik.podTemplate" . }} +{{- end -}} diff --git a/charts/traefik/0.1.1/templates/dashboard-hook-ingressroute.yaml b/charts/traefik/0.1.1/templates/dashboard-hook-ingressroute.yaml new file mode 100644 index 00000000000..ec278c26910 --- /dev/null +++ b/charts/traefik/0.1.1/templates/dashboard-hook-ingressroute.yaml @@ -0,0 +1,28 @@ +{{- if .Values.ingressRoute.dashboard.enabled -}} +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: {{ template "traefik.fullname" . }}-dashboard + annotations: + helm.sh/hook: "post-install,post-upgrade" + {{- with .Values.ingressRoute.dashboard.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + helm.sh/chart: {{ template "traefik.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} + {{- with .Values.ingressRoute.dashboard.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + entryPoints: + - traefik + routes: + - match: PathPrefix(`/dashboard`) || PathPrefix(`/api`) + kind: Rule + services: + - name: api@internal + kind: TraefikService +{{- end -}} diff --git a/charts/traefik/0.1.1/templates/deployment.yaml b/charts/traefik/0.1.1/templates/deployment.yaml new file mode 100644 index 00000000000..28e10e85e85 --- /dev/null +++ b/charts/traefik/0.1.1/templates/deployment.yaml @@ -0,0 +1,41 @@ +{{- if and .Values.deployment.enabled (eq .Values.deployment.kind "Deployment") -}} + {{- if gt (int .Values.deployment.replicas) 1 -}} + {{- with .Values.additionalArguments -}} + {{- range . -}} + {{- if contains ".acme." . -}} + {{- fail (printf "You can not enabled acme if you set more than one traefik replica") -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ template "traefik.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + helm.sh/chart: {{ template "traefik.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} + annotations: + {{- with .Values.deployment.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ default 1 .Values.deployment.replicas }} + {{- end }} + selector: + matchLabels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + strategy: + type: RollingUpdate + rollingUpdate: + {{- with .Values.rollingUpdate }} + {{- toYaml . | nindent 6 }} + {{- end }} + template: {{ template "traefik.podTemplate" . }} +{{- end -}} diff --git a/charts/traefik/0.1.1/templates/gateway.yaml b/charts/traefik/0.1.1/templates/gateway.yaml new file mode 100644 index 00000000000..0fcaa399889 --- /dev/null +++ b/charts/traefik/0.1.1/templates/gateway.yaml @@ -0,0 +1,33 @@ +{{- if .Values.experimental.kubernetesGateway.enabled }} +--- +apiVersion: networking.x-k8s.io/v1alpha1 +kind: Gateway +metadata: + name: traefik-gateway + namespace: default +spec: + gatewayClassName: traefik + listeners: + - port: {{ .Values.ports.web.port }} + protocol: HTTP + routes: + kind: HTTPRoute + selector: + matchLabels: + app: {{ .Values.experimental.kubernetesGateway.appLabelSelector }} + + {{- range $index, $cert:= .Values.experimental.kubernetesGateway.certificates }} + - port: {{ $.Values.ports.websecure.port }} + protocol: HTTPS + tls: + certificateRef: + name: {{ $cert.name }} + group: {{ $cert.group }} + kind: {{ $cert.kind }} + routes: + kind: HTTPRoute + selector: + matchLabels: + app: {{ $.Values.experimental.kubernetesGateway.appLabelSelector }} + {{- end }} +{{- end }} diff --git a/charts/traefik/0.1.1/templates/gatewayclass.yaml b/charts/traefik/0.1.1/templates/gatewayclass.yaml new file mode 100644 index 00000000000..61bf007db1e --- /dev/null +++ b/charts/traefik/0.1.1/templates/gatewayclass.yaml @@ -0,0 +1,9 @@ +{{- if .Values.experimental.kubernetesGateway.enabled }} +--- +kind: GatewayClass +apiVersion: networking.x-k8s.io/v1alpha1 +metadata: + name: traefik +spec: + controller: traefik.io/gateway-controller +{{- end }} diff --git a/charts/traefik/0.1.1/templates/hpa.yaml b/charts/traefik/0.1.1/templates/hpa.yaml new file mode 100644 index 00000000000..bf37117de6a --- /dev/null +++ b/charts/traefik/0.1.1/templates/hpa.yaml @@ -0,0 +1,20 @@ +{{- if .Values.autoscaling.enabled }} +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: {{ template "traefik.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + helm.sh/chart: {{ template "traefik.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ template "traefik.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: +{{ toYaml .Values.autoscaling.metrics | indent 4 }} +{{- end }} diff --git a/charts/traefik/0.1.1/templates/ingressclass.yaml b/charts/traefik/0.1.1/templates/ingressclass.yaml new file mode 100644 index 00000000000..f2c6e9ecf27 --- /dev/null +++ b/charts/traefik/0.1.1/templates/ingressclass.yaml @@ -0,0 +1,21 @@ +{{- if and .Values.ingressClass.enabled (semverCompare ">=2.3.0" (default .Chart.AppVersion .Values.image.tag)) -}} + {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1/IngressClass" }} +apiVersion: networking.k8s.io/v1 + {{- else if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/IngressClass" }} +apiVersion: networking.k8s.io/v1beta1 + {{- else }} + {{- fail "\n\n ERROR: You must have atleast networking.k8s.io/v1beta1 to use ingressClass" }} + {{- end }} +kind: IngressClass +metadata: + annotations: + ingressclass.kubernetes.io/is-default-class: {{ .Values.ingressClass.isDefaultClass | quote }} + labels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + helm.sh/chart: {{ template "traefik.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} + name: {{ template "traefik.fullname" . }} +spec: + controller: traefik.io/ingress-controller +{{- end }} diff --git a/charts/traefik/0.1.1/templates/poddisruptionbudget.yaml b/charts/traefik/0.1.1/templates/poddisruptionbudget.yaml new file mode 100644 index 00000000000..9893e521759 --- /dev/null +++ b/charts/traefik/0.1.1/templates/poddisruptionbudget.yaml @@ -0,0 +1,22 @@ +{{- if .Values.podDisruptionBudget.enabled -}} +apiVersion: policy/v1beta1 +kind: PodDisruptionBudget +metadata: + name: {{ template "traefik.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + helm.sh/chart: {{ template "traefik.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +spec: + selector: + matchLabels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + {{- if .Values.podDisruptionBudget.minAvailable }} + minAvailable: {{ .Values.podDisruptionBudget.minAvailable | int }} + {{- end }} + {{- if .Values.podDisruptionBudget.maxUnavailable }} + maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable | int }} + {{- end }} +{{- end -}} diff --git a/charts/traefik/0.1.1/templates/pvc.yaml b/charts/traefik/0.1.1/templates/pvc.yaml new file mode 100644 index 00000000000..51f6eed2154 --- /dev/null +++ b/charts/traefik/0.1.1/templates/pvc.yaml @@ -0,0 +1,25 @@ +{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) -}} +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ template "traefik.fullname" . }} + annotations: + {{- with .Values.persistence.annotations }} + {{ toYaml . | indent 4 }} + {{- end }} + labels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + helm.sh/chart: {{ template "traefik.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +spec: + accessModes: + - {{ .Values.persistence.accessMode | quote }} + resources: + requests: + storage: {{ .Values.persistence.size | quote }} + {{- if .Values.persistence.storageClass }} + storageClassName: {{ .Values.persistence.storageClass | quote }} + {{- end }} +{{- end -}} + diff --git a/charts/traefik/0.1.1/templates/rbac/clusterrole.yaml b/charts/traefik/0.1.1/templates/rbac/clusterrole.yaml new file mode 100644 index 00000000000..2c63e006414 --- /dev/null +++ b/charts/traefik/0.1.1/templates/rbac/clusterrole.yaml @@ -0,0 +1,112 @@ +{{- if and .Values.rbac.enabled (not .Values.rbac.namespaced) -}} +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "traefik.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + helm.sh/chart: {{ template "traefik.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +rules: + - apiGroups: + - "" + resources: + - services + - endpoints + - secrets + verbs: + - get + - list + - watch + - apiGroups: + - extensions + - networking.k8s.io + resources: + - ingresses + - ingressclasses + verbs: + - get + - list + - watch + - apiGroups: + - extensions + - networking.k8s.io + resources: + - ingresses/status + verbs: + - update + - apiGroups: + - traefik.containo.us + resources: + - ingressroutes + - ingressroutetcps + - ingressrouteudps + - middlewares + - tlsoptions + - tlsstores + - traefikservices + - serverstransports + verbs: + - get + - list + - watch +{{- if .Values.podSecurityPolicy.enabled }} + - apiGroups: + - policy + resourceNames: + - {{ template "traefik.fullname" . }} + resources: + - podsecuritypolicies + verbs: + - use +{{- end -}} +{{- if .Values.experimental.kubernetesGateway.enabled }} + - apiGroups: + - networking.x-k8s.io + resources: + - gatewayclasses + - gatewayclasses/status + - gateways + verbs: + - get + - list + - watch + - apiGroups: + - networking.x-k8s.io + resources: + - gatewayclasses/status + verbs: + - get + - patch + - update + - apiGroups: + - networking.x-k8s.io + resources: + - gateways/status + verbs: + - get + - patch + - update + - apiGroups: + - networking.x-k8s.io + resources: + - httproutes + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - networking.x-k8s.io + resources: + - httproutes/status + verbs: + - get + - patch + - update +{{- end -}} +{{- end -}} diff --git a/charts/traefik/0.1.1/templates/rbac/clusterrolebinding.yaml b/charts/traefik/0.1.1/templates/rbac/clusterrolebinding.yaml new file mode 100644 index 00000000000..509e92ff2b7 --- /dev/null +++ b/charts/traefik/0.1.1/templates/rbac/clusterrolebinding.yaml @@ -0,0 +1,19 @@ +{{- if and .Values.rbac.enabled (not .Values.rbac.namespaced) }} +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "traefik.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + helm.sh/chart: {{ template "traefik.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "traefik.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ include "traefik.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end -}} diff --git a/charts/traefik/0.1.1/templates/rbac/podsecuritypolicy.yaml b/charts/traefik/0.1.1/templates/rbac/podsecuritypolicy.yaml new file mode 100644 index 00000000000..eec3f0a633c --- /dev/null +++ b/charts/traefik/0.1.1/templates/rbac/podsecuritypolicy.yaml @@ -0,0 +1,69 @@ +{{- if .Values.podSecurityPolicy.enabled }} +--- +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: runtime/default + seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default + name: {{ template "traefik.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + helm.sh/chart: {{ template "traefik.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +spec: + privileged: false + allowPrivilegeEscalation: false + requiredDropCapabilities: + - ALL +{{- if not .Values.securityContext.runAsNonRoot }} + allowedCapabilities: + - NET_BIND_SERVICE +{{- end }} + hostNetwork: {{ .Values.hostNetwork }} + hostIPC: false + hostPID: false + fsGroup: +{{- if .Values.securityContext.runAsNonRoot }} + ranges: + - max: 65535 + min: 1 + rule: MustRunAs +{{- else }} + rule: RunAsAny +{{- end }} +{{- if .Values.hostNetwork }} + hostPorts: + - max: 65535 + min: 1 +{{- end }} + readOnlyRootFilesystem: true + runAsUser: +{{- if .Values.securityContext.runAsNonRoot }} + rule: MustRunAsNonRoot +{{- else }} + rule: RunAsAny +{{- end }} + seLinux: + rule: RunAsAny + supplementalGroups: +{{- if .Values.securityContext.runAsNonRoot }} + ranges: + - max: 65535 + min: 1 + rule: MustRunAs +{{- else }} + rule: RunAsAny +{{- end }} + volumes: + - configMap + - downwardAPI + - secret + - emptyDir + - projected + - allowedHostPaths +{{- if .Values.persistence.enabled }} + - persistentVolumeClaim +{{- end -}} +{{- end -}} \ No newline at end of file diff --git a/charts/traefik/0.1.1/templates/rbac/role.yaml b/charts/traefik/0.1.1/templates/rbac/role.yaml new file mode 100644 index 00000000000..6c763065d6f --- /dev/null +++ b/charts/traefik/0.1.1/templates/rbac/role.yaml @@ -0,0 +1,61 @@ +{{- if and .Values.rbac.enabled .Values.rbac.namespaced }} +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "traefik.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + helm.sh/chart: {{ template "traefik.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +rules: + - apiGroups: + - "" + resources: + - services + - endpoints + - secrets + verbs: + - get + - list + - watch + - apiGroups: + - extensions + resources: + - ingresses + verbs: + - get + - list + - watch + - apiGroups: + - extensions + resources: + - ingresses/status + verbs: + - update + - apiGroups: + - traefik.containo.us + resources: + - ingressroutes + - ingressroutetcps + - ingressrouteudps + - middlewares + - tlsoptions + - tlsstores + - traefikservices + - serverstransports + verbs: + - get + - list + - watch +{{- if .Values.podSecurityPolicy.enabled }} + - apiGroups: + - extensions + resourceNames: + - {{ template "traefik.fullname" . }} + resources: + - podsecuritypolicies + verbs: + - use +{{- end -}} +{{- end -}} diff --git a/charts/traefik/0.1.1/templates/rbac/rolebinding.yaml b/charts/traefik/0.1.1/templates/rbac/rolebinding.yaml new file mode 100644 index 00000000000..10416401867 --- /dev/null +++ b/charts/traefik/0.1.1/templates/rbac/rolebinding.yaml @@ -0,0 +1,19 @@ +{{- if and .Values.rbac.enabled .Values.rbac.namespaced }} +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "traefik.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + helm.sh/chart: {{ template "traefik.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "traefik.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ include "traefik.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end -}} diff --git a/charts/traefik/0.1.1/templates/rbac/serviceaccount.yaml b/charts/traefik/0.1.1/templates/rbac/serviceaccount.yaml new file mode 100644 index 00000000000..bcc941eec95 --- /dev/null +++ b/charts/traefik/0.1.1/templates/rbac/serviceaccount.yaml @@ -0,0 +1,15 @@ +{{- if not .Values.serviceAccount.name -}} +kind: ServiceAccount +apiVersion: v1 +metadata: + name: {{ include "traefik.serviceAccountName" . }} + labels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + helm.sh/chart: {{ template "traefik.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} + annotations: + {{- with .Values.serviceAccountAnnotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end -}} diff --git a/charts/traefik/0.1.1/templates/service.yaml b/charts/traefik/0.1.1/templates/service.yaml new file mode 100644 index 00000000000..aa9f418ae06 --- /dev/null +++ b/charts/traefik/0.1.1/templates/service.yaml @@ -0,0 +1,112 @@ +{{- if .Values.service.enabled -}} + +{{ $tcpPorts := dict }} +{{ $udpPorts := dict }} +{{- range $name, $config := .Values.ports }} + {{- if eq (toString $config.protocol) "UDP" }} + {{ $_ := set $udpPorts $name $config }} + {{- else }} + {{ $_ := set $tcpPorts $name $config }} + {{- end }} +{{- end }} + +apiVersion: v1 +kind: List +items: +{{- if $tcpPorts }} + - apiVersion: v1 + kind: Service + metadata: + name: {{ template "traefik.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + helm.sh/chart: {{ template "traefik.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} + {{- with .Values.service.labels }} + {{- toYaml . | nindent 8 }} + {{- end }} + annotations: + {{- with .Values.service.annotations }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- $type := default "LoadBalancer" .Values.service.type }} + type: {{ $type }} + {{- with .Values.service.spec }} + {{- toYaml . | nindent 6 }} + {{- end }} + selector: + app.kubernetes.io/name: {{ template "traefik.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + ports: + {{- range $name, $config := $tcpPorts }} + {{- if $config.expose }} + - port: {{ default $config.port $config.exposedPort }} + name: {{ $name }} + targetPort: {{ $name | quote }} + protocol: {{ default "TCP" $config.protocol | quote }} + {{- if $config.nodePort }} + nodePort: {{ $config.nodePort }} + {{- end }} + {{- end }} + {{- end }} + {{- if eq $type "LoadBalancer" }} + {{- with .Values.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: + {{- toYaml . | nindent 6 }} + {{- end -}} + {{- end -}} + {{- with .Values.service.externalIPs }} + externalIPs: + {{- toYaml . | nindent 6 }} + {{- end -}} +{{- end }} + +{{- if $udpPorts }} + - apiVersion: v1 + kind: Service + metadata: + name: {{ template "traefik.fullname" . }}-udp + labels: + app.kubernetes.io/name: {{ template "traefik.name" . }} + helm.sh/chart: {{ template "traefik.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} + annotations: + {{- with .Values.service.annotations }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- $type := default "LoadBalancer" .Values.service.type }} + type: {{ $type }} + {{- with .Values.service.spec }} + {{- toYaml . | nindent 6 }} + {{- end }} + selector: + app.kubernetes.io/name: {{ template "traefik.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + ports: + {{- range $name, $config := $udpPorts }} + {{- if $config.expose }} + - port: {{ default $config.port $config.exposedPort }} + name: {{ $name }} + targetPort: {{ $name | quote }} + protocol: {{ default "UDP" $config.protocol | quote }} + {{- if $config.nodePort }} + nodePort: {{ $config.nodePort }} + {{- end }} + {{- end }} + {{- end }} + {{- if eq $type "LoadBalancer" }} + {{- with .Values.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: + {{- toYaml . | nindent 6 }} + {{- end -}} + {{- end -}} + {{- with .Values.service.externalIPs }} + externalIPs: + {{- toYaml . | nindent 6 }} + {{- end -}} +{{- end }} +{{- end -}} diff --git a/charts/traefik/0.1.1/templates/tlsoption.yaml b/charts/traefik/0.1.1/templates/tlsoption.yaml new file mode 100644 index 00000000000..ec46e8bbc94 --- /dev/null +++ b/charts/traefik/0.1.1/templates/tlsoption.yaml @@ -0,0 +1,14 @@ +{{- range $name, $config := .Values.tlsOptions }} +apiVersion: traefik.containo.us/v1alpha1 +kind: TLSOption +metadata: + name: {{ $name }} + labels: + app.kubernetes.io/name: {{ template "traefik.name" $ }} + helm.sh/chart: {{ template "traefik.chart" $ }} + app.kubernetes.io/managed-by: {{ $.Release.Service }} + app.kubernetes.io/instance: {{ $.Release.Name }} +spec: + {{- toYaml $config | nindent 2 }} +--- +{{- end -}} diff --git a/charts/traefik/0.1.1/test_values.yaml b/charts/traefik/0.1.1/test_values.yaml new file mode 100644 index 00000000000..7a0f470f8d6 --- /dev/null +++ b/charts/traefik/0.1.1/test_values.yaml @@ -0,0 +1,558 @@ +# Default values for Traefik +image: + name: traefik + # defaults to appVersion + tag: "" + pullPolicy: IfNotPresent + +# +# Configure the deployment +# +deployment: + enabled: true + # Can be either Deployment or DaemonSet + kind: Deployment + # Number of pods of the deployment (only applies when kind == Deployment) + replicas: 1 + # Additional deployment annotations (e.g. for jaeger-operator sidecar injection) + annotations: {} + # Additional pod annotations (e.g. for mesh injection or prometheus scraping) + podAnnotations: {} + # Additional Pod labels (e.g. for filtering Pod by custom labels) + podLabels: {} + # Additional containers (e.g. for metric offloading sidecars) + additionalContainers: [] + # https://docs.datadoghq.com/developers/dogstatsd/unix_socket/?tab=host + # - name: socat-proxy + # image: alpine/socat:1.0.5 + # args: ["-s", "-u", "udp-recv:8125", "unix-sendto:/socket/socket"] + # volumeMounts: + # - name: dsdsocket + # mountPath: /socket + # Additional volumes available for use with initContainers and additionalContainers + additionalVolumes: [] + # - name: dsdsocket + # hostPath: + # path: /var/run/statsd-exporter + # Additional initContainers (e.g. for setting file permission as shown below) + initContainers: [] + # The "volume-permissions" init container is required if you run into permission issues. + # Related issue: https://github.com/traefik/traefik/issues/6972 + # - name: volume-permissions + # image: busybox:1.31.1 + # command: ["sh", "-c", "chmod -Rv 600 /data/*"] + # volumeMounts: + # - name: data + # mountPath: /data + # Custom pod DNS policy. Apply if `hostNetwork: true` + # dnsPolicy: ClusterFirstWithHostNet + # Additional imagePullSecrets + imagePullSecrets: [] + # - name: myRegistryKeySecretName + +# Pod disruption budget +podDisruptionBudget: + enabled: false + # maxUnavailable: 1 + # minAvailable: 0 + +# Use ingressClass. Ignored if Traefik version < 2.3 / kubernetes < 1.18.x +ingressClass: + # true is not unit-testable yet, pending https://github.com/rancher/helm-unittest/pull/12 + enabled: false + isDefaultClass: false + +# Activate Pilot integration +pilot: + enabled: false + token: "" + +# Enable experimental features +experimental: + plugins: + enabled: false + kubernetesGateway: + enabled: false + appLabelSelector: "traefik" + certificates: [] + # - group: "core" + # kind: "Secret" + # name: "mysecret" + +# Create an IngressRoute for the dashboard +ingressRoute: + dashboard: + enabled: true + # Additional ingressRoute annotations (e.g. for kubernetes.io/ingress.class) + annotations: {} + # Additional ingressRoute labels (e.g. for filtering IngressRoute by custom labels) + labels: {} + +rollingUpdate: + maxUnavailable: 1 + maxSurge: 1 + + +# +# Configure providers +# +providers: + kubernetesCRD: + enabled: true + namespaces: [] + # - "default" + kubernetesIngress: + enabled: true + namespaces: [] + # - "default" + # IP used for Kubernetes Ingress endpoints + publishedService: + enabled: false + # Published Kubernetes Service to copy status from. Format: namespace/servicename + # By default this Traefik service + # pathOverride: "" + +# +# Add volumes to the traefik pod. The volume name will be passed to tpl. +# This can be used to mount a cert pair or a configmap that holds a config.toml file. +# After the volume has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg: +# additionalArguments: +# - "--providers.file.filename=/config/dynamic.toml" +volumes: [] +# - name: public-cert +# mountPath: "/certs" +# type: secret +# - name: '{{ printf "%s-configs" .Release.Name }}' +# mountPath: "/config" +# type: configMap + +# Additional volumeMounts to add to the Traefik container +additionalVolumeMounts: [] + # For instance when using a logshipper for access logs + # - name: traefik-logs + # mountPath: /var/log/traefik + +# Logs +# https://docs.traefik.io/observability/logs/ +logs: + # Traefik logs concern everything that happens to Traefik itself (startup, configuration, events, shutdown, and so on). + general: + # By default, the logs use a text format (common), but you can + # also ask for the json format in the format option + # format: json + # By default, the level is set to ERROR. Alternative logging levels are DEBUG, PANIC, FATAL, ERROR, WARN, and INFO. + level: ERROR + access: + # To enable access logs + enabled: false + # By default, logs are written using the Common Log Format (CLF). + # To write logs in JSON, use json in the format option. + # If the given format is unsupported, the default (CLF) is used instead. + # format: json + # To write the logs in an asynchronous fashion, specify a bufferingSize option. + # This option represents the number of log lines Traefik will keep in memory before writing + # them to the selected output. In some cases, this option can greatly help performances. + # bufferingSize: 100 + # Filtering https://docs.traefik.io/observability/access-logs/#filtering + filters: {} + # statuscodes: "200,300-302" + # retryattempts: true + # minduration: 10ms + # Fields + # https://docs.traefik.io/observability/access-logs/#limiting-the-fieldsincluding-headers + fields: + general: + defaultmode: keep + names: {} + # Examples: + # ClientUsername: drop + headers: + defaultmode: drop + names: {} + # Examples: + # User-Agent: redact + # Authorization: drop + # Content-Type: keep + +globalArguments: + - "--global.checknewversion" + +# +# Configure Traefik static configuration +# Additional arguments to be passed at Traefik's binary +# All available options available on https://docs.traefik.io/reference/static-configuration/cli/ +## Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"` +additionalArguments: +# - "--providers.kubernetesingress.ingressclass=traefik-internal" + - "--providers.kubernetesIngress.ingressClass=traefik-cert-manager" +# - "--log.level=DEBUG" +# - "--metrics.prometheus" + - "--entrypoints.websecure.http.tls" + - "--ping" + - "--serverstransport.insecureskipverify=true" + +# Environment variables to be passed to Traefik's binary +env: [] +# - name: SOME_VAR +# value: some-var-value +# - name: SOME_VAR_FROM_CONFIG_MAP +# valueFrom: +# configMapRef: +# name: configmap-name +# key: config-key +# - name: SOME_SECRET +# valueFrom: +# secretKeyRef: +# name: secret-name +# key: secret-key + +envFrom: [] +# - configMapRef: +# name: config-map-name +# - secretRef: +# name: secret-name + +# Configure ports +ports: + # The name of this one can't be changed as it is used for the readiness and + # liveness probes, but you can adjust its config to your liking + traefik: + port: 9000 + # Use hostPort if set. + # hostPort: 9000 + # + # Use hostIP if set. If not set, Kubernetes will default to 0.0.0.0, which + # means it's listening on all your interfaces and all your IPs. You may want + # to set this value if you need traefik to listen on specific interface + # only. + # hostIP: 192.168.100.10 + + # Defines whether the port is exposed if service.type is LoadBalancer or + # NodePort. + # + # You SHOULD NOT expose the traefik port on production deployments. + # If you want to access it from outside of your cluster, + # use `kubectl port-forward` or create a secure ingress + expose: false + # The exposed port for this service + exposedPort: 9000 + # The port protocol (TCP/UDP) + protocol: TCP + web: + port: 8000 + # hostPort: 8000 + expose: true + exposedPort: 80 + # The port protocol (TCP/UDP) + protocol: TCP + # Use nodeport if set. This is useful if you have configured Traefik in a + # LoadBalancer + # nodePort: 32080 + # Port Redirections + # Added in 2.2, you can make permanent redirects via entrypoints. + # https://docs.traefik.io/routing/entrypoints/#redirection + redirectTo: websecure + websecure: + port: 8443 + # hostPort: 8443 + expose: true + exposedPort: 443 + # The port protocol (TCP/UDP) + protocol: TCP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + plex: + port: 32400 + # hostPort: 8443 + expose: true + exposedPort: 32400 + # The port protocol (TCP/UDP) + protocol: TCP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + kms: + port: 51688 + # hostPort: 8443 + expose: true + exposedPort: 1688 + # The port protocol (TCP/UDP) + protocol: TCP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + dns-tcp: + port: 5353 + # hostPort: 8443 + expose: true + exposedPort: 5353 + # The port protocol (TCP/UDP) + protocol: TCP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + dns-udp: + port: 5353 + # hostPort: 8443 + expose: true + exposedPort: 5353 + # The port protocol (TCP/UDP) + protocol: UDP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + torrent-tcp: + port: 51413 + # hostPort: 8443 + expose: true + exposedPort: 51413 + # The port protocol (TCP/UDP) + protocol: TCP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + torrent-udp: + port: 51413 + # hostPort: 8443 + expose: true + exposedPort: 51413 + # The port protocol (TCP/UDP) + protocol: UDP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + radius: + port: 51812 + # hostPort: 8443 + expose: true + exposedPort: 1812 + # The port protocol (TCP/UDP) + protocol: UDP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + radius-acc: + port: 51813 + # hostPort: 8443 + expose: true + exposedPort: 1813 + # The port protocol (TCP/UDP) + protocol: UDP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + ldaps: + port: 50636 + # hostPort: 8443 + expose: true + exposedPort: 636 + # The port protocol (TCP/UDP) + protocol: TCP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + unificom: + port: 8081 + # hostPort: 8443 + expose: true + exposedPort: 8081 + # The port protocol (TCP/UDP) + protocol: TCP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + +# TLS Options are created as TLSOption CRDs +# https://doc.traefik.io/traefik/https/tls/#tls-options +# Example: +# tlsOptions: +# default: +# sniStrict: true +# preferServerCipherSuites: true +# foobar: +# curvePreferences: +# - CurveP521 +# - CurveP384 +tlsOptions: {} + +# Options for the main traefik service, where the entrypoints traffic comes +# from. +service: + enabled: true + type: LoadBalancer + # Additional annotations (e.g. for cloud provider specific config) + annotations: {} + # Additional service labels (e.g. for filtering Service by custom labels) + labels: {} + # Additional entries here will be added to the service spec. Cannot contains + # type, selector or ports entries. + spec: {} + # externalTrafficPolicy: Cluster + # loadBalancerIP: "1.2.3.4" + # clusterIP: "2.3.4.5" + loadBalancerSourceRanges: [] + # - 192.168.0.1/32 + # - 172.16.0.0/16 + externalIPs: + - 192.168.66.6 + +## Create HorizontalPodAutoscaler object. +## +autoscaling: + enabled: false +# minReplicas: 1 +# maxReplicas: 10 +# metrics: +# - type: Resource +# resource: +# name: cpu +# targetAverageUtilization: 60 +# - type: Resource +# resource: +# name: memory +# targetAverageUtilization: 60 + +# Enable persistence using Persistent Volume Claims +# ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ +# After the pvc has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg: +# additionalArguments: +# - "--certificatesresolvers.le.acme.storage=/data/acme.json" +# It will persist TLS certificates. +persistence: + enabled: false +# existingClaim: "" + accessMode: ReadWriteOnce + size: 128Mi + # storageClass: "" + path: /data + annotations: {} + # subPath: "" # only mount a subpath of the Volume into the pod + +# If hostNetwork is true, runs traefik in the host network namespace +# To prevent unschedulabel pods due to port collisions, if hostNetwork=true +# and replicas>1, a pod anti-affinity is recommended and will be set if the +# affinity is left as default. +hostNetwork: false + +# Whether Role Based Access Control objects like roles and rolebindings should be created +rbac: + enabled: true + + # If set to false, installs ClusterRole and ClusterRoleBinding so Traefik can be used across namespaces. + # If set to true, installs namespace-specific Role and RoleBinding and requires provider configuration be set to that same namespace + namespaced: false + +# Enable to create a PodSecurityPolicy and assign it to the Service Account via RoleBindin or ClusterRoleBinding +podSecurityPolicy: + enabled: false + +# The service account the pods will use to interact with the Kubernetes API +serviceAccount: + # If set, an existing service account is used + # If not set, a service account is created automatically using the fullname template + name: "" + +# Additional serviceAccount annotations (e.g. for oidc authentication) +serviceAccountAnnotations: {} + +resources: {} + # requests: + # cpu: "100m" + # memory: "50Mi" + # limits: + # cpu: "300m" + # memory: "150Mi" +affinity: {} +# # This example pod anti-affinity forces the scheduler to put traefik pods +# # on nodes where no other traefik pods are scheduled. +# # It should be used when hostNetwork: true to prevent port conflicts +# podAntiAffinity: +# requiredDuringSchedulingIgnoredDuringExecution: +# - labelSelector: +# matchExpressions: +# - key: app +# operator: In +# values: +# - {{ template "traefik.name" . }} +# topologyKey: failure-domain.beta.kubernetes.io/zone +nodeSelector: {} +tolerations: [] + +# Pods can have priority. +# Priority indicates the importance of a Pod relative to other Pods. +priorityClassName: "" + +# Set the container security context +# To run the container with ports below 1024 this will need to be adjust to run as root +securityContext: + capabilities: + drop: [ALL] + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + +podSecurityContext: + fsGroup: 65532 + +appVolumesEnabled: false +appVolumeMounts: + data: + enabled: false + emptyDir: true + datasetName: "data" + mountPath: "/data" + +emptyDirVolumes: true + +appIngress: + webui: + enabled: false + entrypoint: "websecure" + certType: "letsencrypt-prod" + existingcert: "" + authForwardURL: "" + host: "traefik.example.truecharts.org" + +certmanager: + # general + provider: "" + email: "" + wildcardDomain: "" + # provider specific + cloudflare: + apikey: "placeholder" + cloudDNS: + project: "" + keyjson: "placeholder" + route53: + region: "" + accessKeyID: "" + secretaccesskey: "placeholder" + digitalocean: + accesstoken: "placeholder" + rfc2136: + nameserver: "" + tsigKeyName: "" + tsigAlgorithm: "" + tsigsecretkey: "placeholder" + azureDNS: + environment: "" + subscriptionID: "" + resourceGroupName: "" + hostedZoneName: "" + akamai: + serviceConsumerDomain: "" + clientToken: "placeholder" + clientSecret: "placeholder" + accessToken: "placeholder" + acmeDNS: + host: "" + acmednsjson: "placeholder" + +cert-manager: + installCRDs: true + extraArgs: + - --dns01-recursive-nameservers-only + - --dns01-recursive-nameservers=1.1.1.1:53 diff --git a/charts/traefik/0.1.1/values.yaml b/charts/traefik/0.1.1/values.yaml new file mode 100644 index 00000000000..e751eb705c5 --- /dev/null +++ b/charts/traefik/0.1.1/values.yaml @@ -0,0 +1,555 @@ +# Default values for Traefik +image: + name: traefik + # defaults to appVersion + tag: "" + pullPolicy: IfNotPresent + +# +# Configure the deployment +# +deployment: + enabled: true + # Can be either Deployment or DaemonSet + kind: Deployment + # Number of pods of the deployment (only applies when kind == Deployment) + replicas: 1 + # Additional deployment annotations (e.g. for jaeger-operator sidecar injection) + annotations: {} + # Additional pod annotations (e.g. for mesh injection or prometheus scraping) + podAnnotations: {} + # Additional Pod labels (e.g. for filtering Pod by custom labels) + podLabels: {} + # Additional containers (e.g. for metric offloading sidecars) + additionalContainers: [] + # https://docs.datadoghq.com/developers/dogstatsd/unix_socket/?tab=host + # - name: socat-proxy + # image: alpine/socat:1.0.5 + # args: ["-s", "-u", "udp-recv:8125", "unix-sendto:/socket/socket"] + # volumeMounts: + # - name: dsdsocket + # mountPath: /socket + # Additional volumes available for use with initContainers and additionalContainers + additionalVolumes: [] + # - name: dsdsocket + # hostPath: + # path: /var/run/statsd-exporter + # Additional initContainers (e.g. for setting file permission as shown below) + initContainers: [] + # The "volume-permissions" init container is required if you run into permission issues. + # Related issue: https://github.com/traefik/traefik/issues/6972 + # - name: volume-permissions + # image: busybox:1.31.1 + # command: ["sh", "-c", "chmod -Rv 600 /data/*"] + # volumeMounts: + # - name: data + # mountPath: /data + # Custom pod DNS policy. Apply if `hostNetwork: true` + # dnsPolicy: ClusterFirstWithHostNet + # Additional imagePullSecrets + imagePullSecrets: [] + # - name: myRegistryKeySecretName + +# Pod disruption budget +podDisruptionBudget: + enabled: false + # maxUnavailable: 1 + # minAvailable: 0 + +# Use ingressClass. Ignored if Traefik version < 2.3 / kubernetes < 1.18.x +ingressClass: + # true is not unit-testable yet, pending https://github.com/rancher/helm-unittest/pull/12 + enabled: false + isDefaultClass: false + +# Activate Pilot integration +pilot: + enabled: false + token: "" + +# Enable experimental features +experimental: + plugins: + enabled: false + kubernetesGateway: + enabled: false + appLabelSelector: "traefik" + certificates: [] + # - group: "core" + # kind: "Secret" + # name: "mysecret" + +# Create an IngressRoute for the dashboard +ingressRoute: + dashboard: + enabled: true + # Additional ingressRoute annotations (e.g. for kubernetes.io/ingress.class) + annotations: {} + # Additional ingressRoute labels (e.g. for filtering IngressRoute by custom labels) + labels: {} + +rollingUpdate: + maxUnavailable: 1 + maxSurge: 1 + + +# +# Configure providers +# +providers: + kubernetesCRD: + enabled: true + namespaces: [] + # - "default" + kubernetesIngress: + enabled: true + namespaces: [] + # - "default" + # IP used for Kubernetes Ingress endpoints + publishedService: + enabled: false + # Published Kubernetes Service to copy status from. Format: namespace/servicename + # By default this Traefik service + # pathOverride: "" + +# +# Add volumes to the traefik pod. The volume name will be passed to tpl. +# This can be used to mount a cert pair or a configmap that holds a config.toml file. +# After the volume has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg: +# additionalArguments: +# - "--providers.file.filename=/config/dynamic.toml" +volumes: [] +# - name: public-cert +# mountPath: "/certs" +# type: secret +# - name: '{{ printf "%s-configs" .Release.Name }}' +# mountPath: "/config" +# type: configMap + +# Additional volumeMounts to add to the Traefik container +additionalVolumeMounts: [] + # For instance when using a logshipper for access logs + # - name: traefik-logs + # mountPath: /var/log/traefik + +# Logs +# https://docs.traefik.io/observability/logs/ +logs: + # Traefik logs concern everything that happens to Traefik itself (startup, configuration, events, shutdown, and so on). + general: + # By default, the logs use a text format (common), but you can + # also ask for the json format in the format option + # format: json + # By default, the level is set to ERROR. Alternative logging levels are DEBUG, PANIC, FATAL, ERROR, WARN, and INFO. + level: ERROR + access: + # To enable access logs + enabled: false + # By default, logs are written using the Common Log Format (CLF). + # To write logs in JSON, use json in the format option. + # If the given format is unsupported, the default (CLF) is used instead. + # format: json + # To write the logs in an asynchronous fashion, specify a bufferingSize option. + # This option represents the number of log lines Traefik will keep in memory before writing + # them to the selected output. In some cases, this option can greatly help performances. + # bufferingSize: 100 + # Filtering https://docs.traefik.io/observability/access-logs/#filtering + filters: {} + # statuscodes: "200,300-302" + # retryattempts: true + # minduration: 10ms + # Fields + # https://docs.traefik.io/observability/access-logs/#limiting-the-fieldsincluding-headers + fields: + general: + defaultmode: keep + names: {} + # Examples: + # ClientUsername: drop + headers: + defaultmode: drop + names: {} + # Examples: + # User-Agent: redact + # Authorization: drop + # Content-Type: keep + +globalArguments: + - "--global.checknewversion" +# - "--global.sendanonymoususage" + +# +# Configure Traefik static configuration +# Additional arguments to be passed at Traefik's binary +# All available options available on https://docs.traefik.io/reference/static-configuration/cli/ +## Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"` +additionalArguments: +# - "--providers.kubernetesingress.ingressclass=traefik-internal" +# - "--log.level=DEBUG" + - "--entrypoints.websecure.http.tls" + - "--ping" + - "--serverstransport.insecureskipverify=true" + +# Environment variables to be passed to Traefik's binary +env: [] +# - name: SOME_VAR +# value: some-var-value +# - name: SOME_VAR_FROM_CONFIG_MAP +# valueFrom: +# configMapRef: +# name: configmap-name +# key: config-key +# - name: SOME_SECRET +# valueFrom: +# secretKeyRef: +# name: secret-name +# key: secret-key + +envFrom: [] +# - configMapRef: +# name: config-map-name +# - secretRef: +# name: secret-name + +# Configure ports +ports: + # The name of this one can't be changed as it is used for the readiness and + # liveness probes, but you can adjust its config to your liking + traefik: + port: 9000 + # Use hostPort if set. + # hostPort: 9000 + # + # Use hostIP if set. If not set, Kubernetes will default to 0.0.0.0, which + # means it's listening on all your interfaces and all your IPs. You may want + # to set this value if you need traefik to listen on specific interface + # only. + # hostIP: 192.168.100.10 + + # Defines whether the port is exposed if service.type is LoadBalancer or + # NodePort. + # + # You SHOULD NOT expose the traefik port on production deployments. + # If you want to access it from outside of your cluster, + # use `kubectl port-forward` or create a secure ingress + expose: false + # The exposed port for this service + exposedPort: 9000 + # The port protocol (TCP/UDP) + protocol: TCP + web: + port: 8000 + # hostPort: 8000 + expose: true + exposedPort: 80 + # The port protocol (TCP/UDP) + protocol: TCP + # Use nodeport if set. This is useful if you have configured Traefik in a + # LoadBalancer + # nodePort: 32080 + # Port Redirections + # Added in 2.2, you can make permanent redirects via entrypoints. + # https://docs.traefik.io/routing/entrypoints/#redirection + redirectTo: websecure + websecure: + port: 8443 + # hostPort: 8443 + expose: true + exposedPort: 443 + # The port protocol (TCP/UDP) + protocol: TCP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + plex: + port: 32400 + # hostPort: 8443 + expose: true + exposedPort: 32400 + # The port protocol (TCP/UDP) + protocol: TCP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + kms: + port: 51688 + # hostPort: 8443 + expose: true + exposedPort: 1688 + # The port protocol (TCP/UDP) + protocol: TCP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + dns-tcp: + port: 5353 + # hostPort: 8443 + expose: true + exposedPort: 53 + # The port protocol (TCP/UDP) + protocol: TCP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + dns-udp: + port: 5353 + # hostPort: 8443 + expose: true + exposedPort: 53 + # The port protocol (TCP/UDP) + protocol: UDP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + torrent-tcp: + port: 51413 + # hostPort: 8443 + expose: true + exposedPort: 51413 + # The port protocol (TCP/UDP) + protocol: TCP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + torrent-udp: + port: 51413 + # hostPort: 8443 + expose: true + exposedPort: 51413 + # The port protocol (TCP/UDP) + protocol: UDP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + radius: + port: 51812 + # hostPort: 8443 + expose: true + exposedPort: 1812 + # The port protocol (TCP/UDP) + protocol: UDP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + radius-acc: + port: 51813 + # hostPort: 8443 + expose: true + exposedPort: 1813 + # The port protocol (TCP/UDP) + protocol: UDP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + ldaps: + port: 50636 + # hostPort: 8443 + expose: true + exposedPort: 636 + # The port protocol (TCP/UDP) + protocol: TCP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + unificom: + port: 8081 + # hostPort: 8443 + expose: true + exposedPort: 8081 + # The port protocol (TCP/UDP) + protocol: TCP + # nodePort: 32443 + # Set TLS at the entrypoint + # https://doc.traefik.io/traefik/routing/entrypoints/#tls + +# TLS Options are created as TLSOption CRDs +# https://doc.traefik.io/traefik/https/tls/#tls-options +# Example: +# tlsOptions: +# default: +# sniStrict: true +# preferServerCipherSuites: true +# foobar: +# curvePreferences: +# - CurveP521 +# - CurveP384 +tlsOptions: {} + +# Options for the main traefik service, where the entrypoints traffic comes +# from. +service: + enabled: true + type: LoadBalancer + # Additional annotations (e.g. for cloud provider specific config) + annotations: {} + # Additional service labels (e.g. for filtering Service by custom labels) + labels: {} + # Additional entries here will be added to the service spec. Cannot contains + # type, selector or ports entries. + spec: {} + # externalTrafficPolicy: Cluster + # loadBalancerIP: "1.2.3.4" + # clusterIP: "2.3.4.5" + loadBalancerSourceRanges: [] + # - 192.168.0.1/32 + # - 172.16.0.0/16 + externalIPs: [] + # - 1.2.3.4 + +## Create HorizontalPodAutoscaler object. +## +autoscaling: + enabled: false +# minReplicas: 1 +# maxReplicas: 10 +# metrics: +# - type: Resource +# resource: +# name: cpu +# targetAverageUtilization: 60 +# - type: Resource +# resource: +# name: memory +# targetAverageUtilization: 60 + +# Enable persistence using Persistent Volume Claims +# ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ +# After the pvc has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg: +# additionalArguments: +# - "--certificatesresolvers.le.acme.storage=/data/acme.json" +# It will persist TLS certificates. +persistence: + enabled: false +# existingClaim: "" + accessMode: ReadWriteOnce + size: 128Mi + # storageClass: "" + path: /data + annotations: {} + # subPath: "" # only mount a subpath of the Volume into the pod + +# If hostNetwork is true, runs traefik in the host network namespace +# To prevent unschedulabel pods due to port collisions, if hostNetwork=true +# and replicas>1, a pod anti-affinity is recommended and will be set if the +# affinity is left as default. +hostNetwork: false + +# Whether Role Based Access Control objects like roles and rolebindings should be created +rbac: + enabled: true + + # If set to false, installs ClusterRole and ClusterRoleBinding so Traefik can be used across namespaces. + # If set to true, installs namespace-specific Role and RoleBinding and requires provider configuration be set to that same namespace + namespaced: false + +# Enable to create a PodSecurityPolicy and assign it to the Service Account via RoleBindin or ClusterRoleBinding +podSecurityPolicy: + enabled: false + +# The service account the pods will use to interact with the Kubernetes API +serviceAccount: + # If set, an existing service account is used + # If not set, a service account is created automatically using the fullname template + name: "" + +# Additional serviceAccount annotations (e.g. for oidc authentication) +serviceAccountAnnotations: {} + +resources: {} + # requests: + # cpu: "100m" + # memory: "50Mi" + # limits: + # cpu: "300m" + # memory: "150Mi" +affinity: {} +# # This example pod anti-affinity forces the scheduler to put traefik pods +# # on nodes where no other traefik pods are scheduled. +# # It should be used when hostNetwork: true to prevent port conflicts +# podAntiAffinity: +# requiredDuringSchedulingIgnoredDuringExecution: +# - labelSelector: +# matchExpressions: +# - key: app +# operator: In +# values: +# - {{ template "traefik.name" . }} +# topologyKey: failure-domain.beta.kubernetes.io/zone +nodeSelector: {} +tolerations: [] + +# Pods can have priority. +# Priority indicates the importance of a Pod relative to other Pods. +priorityClassName: "" + +# Set the container security context +# To run the container with ports below 1024 this will need to be adjust to run as root +securityContext: + capabilities: + drop: [ALL] + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + +podSecurityContext: + fsGroup: 65532 + +appVolumesEnabled: true +appVolumeMounts: + data: + enabled: true + emptyDir: false + datasetName: "data" + mountPath: "/data" + +appIngress: + webui: + enabled: false + entrypoint: "websecure" + certType: "letsencrypt-prod" + existingcert: "" + authForwardURL: "" + host: "traefik.example.truecharts.org" + +certmanager: + # general + provider: "" + email: "" + wildcardDomain: "" + # provider specific + cloudflare: + apikey: "" + cloudDNS: + project: "" + keyjson: "" + route53: + region: "" + accessKeyID: "" + secretaccesskey: "" + digitalocean: + accesstoken: "" + rfc2136: + nameserver: "" + tsigKeyName: "" + tsigsecretkey: "" + tsigAlgorithm: "" + azureDNS: + environment: "" + subscriptionID: "" + resourceGroupName: "" + hostedZoneName: "" + akamai: + serviceConsumerDomain: "" + clientToken: "" + clientSecret: "" + accessToken: "" + acmeDNS: + host: "" + acmednsjson: "" + +cert-manager: + installCRDs: true + extraArgs: + - --dns01-recursive-nameservers-only + - --dns01-recursive-nameservers=1.1.1.1:53 diff --git a/charts/traefik/item.yaml b/charts/traefik/item.yaml new file mode 100644 index 00000000000..7439526df23 --- /dev/null +++ b/charts/traefik/item.yaml @@ -0,0 +1,3 @@ +categories: + - network +icon_url: https://raw.githubusercontent.com/traefik/traefik/v2.3/docs/content/assets/img/traefik.logo.png