From d92983393405df680555951eece93184ca90d333 Mon Sep 17 00:00:00 2001 From: ashisgreat22 Date: Fri, 6 Mar 2026 20:16:16 +0100 Subject: [PATCH] Cleanup --- .gitignore | 8 + README.md | 401 +--- flake.lock | 453 ++-- flake.nix | 34 +- flaresolverr_test.json | 1 - hosts/nixbsd/configuration.nix | 47 - hosts/nixos/configuration.nix | 17 +- hosts/nixos/default.nix | 5 +- hosts/nixos/home.nix | 17 +- hosts/nixos/home/steam.nix | 23 +- hosts/nixos/home/vscode.nix | 100 +- hosts/nixos/kafka.nix | 96 + hosts/nixos/system/authelia.nix | 7 + hosts/nixos/system/game-drive.nix | 2 +- hosts/nixos/system/kernel.nix | 7 +- hosts/nixos/system/networking.nix | 15 +- hosts/nixos/system/nix-settings.nix | 3 +- hosts/nixos/system/packages.nix | 2 +- hosts/nixos/system/secrets.nix | 23 +- hosts/nixos/system/services.nix | 47 + hosts/nixos/system/users.nix | 3 + hosts/nixos/system/website/index.html | 191 ++ hosts/nixos/system/website/profile.png | Bin 0 -> 124401 bytes modules/home-manager/antigravity2api.nix | 42 +- modules/home-manager/gluetun-user.nix | 2 +- modules/home-manager/niri.nix | 37 +- modules/nixos/bla.sh | 4 + modules/nixos/brave-sandboxed.nix | 159 +- modules/nixos/cloudflare-firewall.nix | 7 + modules/nixos/default.nix | 3 + modules/nixos/dns-over-tls.nix | 14 +- modules/nixos/firefox-sandboxed.nix | 104 +- modules/nixos/impermanence.nix | 4 + modules/nixos/lutris-sandboxed.nix | 6 +- modules/nixos/media.nix | 68 +- modules/nixos/nginx.nix | 12 + modules/nixos/ollama-rocm.nix | 2 +- modules/nixos/openclaw.nix | 199 ++ modules/nixos/searxng.nix | 10 +- modules/nixos/wireproxy.nix | 104 + proxy_enable.json | 13 - result | 1 - scripts/cleanup_steam_migration.sh | 38 - scripts/convert-kernel-config-full.sh | 84 - scripts/data_generator/README.md | 61 - .../data_generator/generate_training_data.py | 310 --- scripts/data_generator/requirements.txt | 2 - scripts/data_generator/test_api.py | 28 - scripts/data_generator/test_url.py | 18 - scripts/data_generator/training_data.json | 2102 ----------------- scripts/migrate-game-header.sh | 65 - scripts/migrate_steam.sh | 71 - scripts/run-nixbsd-vm.sh | 10 - secrets/secrets.yaml | 11 +- 54 files changed, 1420 insertions(+), 3673 deletions(-) delete mode 100644 flaresolverr_test.json delete mode 100644 hosts/nixbsd/configuration.nix create mode 100644 hosts/nixos/kafka.nix create mode 100644 hosts/nixos/system/website/index.html create mode 100644 hosts/nixos/system/website/profile.png create mode 100644 modules/nixos/bla.sh create mode 100644 modules/nixos/openclaw.nix create mode 100644 modules/nixos/wireproxy.nix delete mode 100644 proxy_enable.json delete mode 120000 result delete mode 100755 scripts/cleanup_steam_migration.sh delete mode 100755 scripts/convert-kernel-config-full.sh delete mode 100644 scripts/data_generator/README.md delete mode 100644 scripts/data_generator/generate_training_data.py delete mode 100644 scripts/data_generator/requirements.txt delete mode 100644 scripts/data_generator/test_api.py delete mode 100644 scripts/data_generator/test_url.py delete mode 100644 scripts/data_generator/training_data.json delete mode 100755 scripts/migrate-game-header.sh delete mode 100755 scripts/migrate_steam.sh delete mode 100755 scripts/run-nixbsd-vm.sh diff --git a/.gitignore b/.gitignore index 24f5739..8369981 100644 --- a/.gitignore +++ b/.gitignore @@ -16,3 +16,11 @@ unified-router/ unified_router-nodejs/ .agent/ old/ +openclaw/ + +# Nix build outputs +result +result-* + +# AI assistant artifacts +CLAUDE.md diff --git a/README.md b/README.md index 5718aab..49fe700 100644 --- a/README.md +++ b/README.md @@ -1,319 +1,116 @@ # NixOS Configuration -Personal NixOS configuration with Hyprland, containerized services, and security hardening. +A modular, security-hardened NixOS flake featuring multiple desktop environments (Niri, Cosmic), sophisticated application sandboxing via `nix-bwrapper`, and a containerized service ecosystem. -> **Note:** Parts of this configuration were created with the assistance of AI tools. +## 🛡️ Core Pillars -## Quick Start +- **Security Hardening**: Aggressive kernel parameters, DNS-over-TLS, AppArmor, and an `nftables` firewall with Cloudflare-specific rules. +- **Application Sandboxing**: Granular isolation for browsers, games, and proprietary apps using `bubblewrap` via a custom `nix-bwrapper` framework. +- **Modular Architecture**: A clean `myModules` namespace that decouples configuration logic from host-specific implementation. +- **Modern Desktop**: Support for **Niri** (scrollable tiling) and **Cosmic** (Epoch), with **Noctalia** shell integration. + +--- + +## 🚀 Quick Start ```bash -# Apply configuration -doas nixos-rebuild switch --flake ~/nixos#nixos +# Apply system configuration +doas nixos-rebuild switch --flake .#nixos -# Update flake inputs +# Update all flake inputs nix flake update -# Test configuration without applying -doas nixos-rebuild dry-run --flake ~/nixos#nixos -``` - -## Using These Modules - -Others can import individual modules from this flake: - -```nix -{ - inputs.ashie-nixos.url = "github:ashisgreat22/nixos"; - - outputs = { nixpkgs, ashie-nixos, ... }: { - nixosConfigurations.myhost = nixpkgs.lib.nixosSystem { - modules = [ - ashie-nixos.nixosModules.security - ashie-nixos.nixosModules.kernelHardening - { - myModules.security.enable = true; - myModules.kernelHardening.enable = true; - } - ]; - }; - }; -} -``` - -### Available Modules - -| Module | Description | -| --------------------------------------- | ------------------------------ | -| `nixosModules.security` | doas, audit logging, AppArmor | -| `nixosModules.kernelHardening` | Boot params, sysctl, ZRAM | -| `nixosModules.dnsOverTls` | DNSSEC + DNS-over-TLS | -| `nixosModules.cloudflareFirewall` | nftables Cloudflare-only rules | -| `nixosModules.caddyCloudflare` | Caddy with DNS-01 ACME | -| `nixosModules.podman` | Podman container runtime | -| `nixosModules.browserVpn` | VPN-isolated browsers | -| `homeManagerModules.hyprlandCatppuccin` | Themed Hyprland config | -| `homeManagerModules.gluetunUser` | Rootless VPN container | -| `homeManagerModules.qbittorrentVpn` | qBittorrent through VPN | - -## Structure - -``` -~/nixos/ -├── configuration.nix # Main config (enables modules via myModules.*) -├── flake.nix # Flake inputs, outputs, and module exports -├── hardware-configuration.nix -├── home.nix # Home Manager entry point -├── modules/ # Reusable NixOS modules -│ ├── default.nix # Imports all system modules -│ ├── system/ # System-level modules -│ │ ├── security.nix # doas, audit, AppArmor -│ │ ├── kernel-hardening.nix # Boot params, sysctl, ZRAM -│ │ ├── dns-over-tls.nix # DNSSEC + DoT -│ │ ├── cloudflare-firewall.nix # nftables rules -│ │ ├── caddy-cloudflare.nix # Caddy + DNS-01 -│ │ ├── podman.nix # Container runtime -│ │ └── browser-vpn.nix # VPN-isolated browsers -│ └── home/ # Home Manager modules -│ ├── hyprland-catppuccin.nix -│ ├── gluetun-user.nix -│ ├── qbittorrent-vpn.nix -│ └── browser-container-update.nix -├── system/ # Host-specific system config -│ ├── boot.nix # Bootloader -│ ├── hardware.nix # GPU, USBGuard, fonts -│ ├── networking.nix # Hostname, ddclient -│ ├── packages.nix # System packages -│ ├── services.nix # Steam, Caddy vhosts -│ └── secrets.nix # SOPS secrets -├── home/ # Host-specific Home Manager config -│ ├── fastfetch.nix, kitty.nix, steam.nix, vscode.nix -├── containers/ # Container Dockerfiles -│ ├── firefox-wayland/ # Isolated Firefox -│ ├── thorium-wayland/ # Isolated Thorium -│ └── tor-browser-wayland/ -├── unified_router/ # API routing service -├── codex2api/ # Codex API proxy -├── antigravity-src/ # Antigravity2API source -└── secrets/ # SOPS-encrypted secrets -``` - -## Integrated Services - -### API Ecosystem - -A microservices architecture for managing LLM interactions: - -- **Unified Router** (`unified_router/`) -- **Codex2API** (`codex2api/`) -- **Antigravity2API** (`antigravity-src/`) -- **Data Generator** (`scripts/data_generator/`): Tool for generating synthetic training data. - -### Web Services (via Caddy) - -| Service | URL | Port | -| --------------- | --------------------- | ----------- | -| Open WebUI | `chat.ashisgreat.xyz` | 3000 → 8080 | -| Unified Router | `api.ashisgreat.xyz` | 6767 | -| Antigravity2API | (Internal) | 8045 | - -### Containers - -```bash -# View running containers -podman ps - -# View container logs -podman logs open-webui -podman logs antigravity2api -``` - -## Isolated Browsers (VPN) - -Browsers running in containers routed through WireGuard VPN. - -### Firefox - -```bash -# Launch isolated Firefox -firefox-vpn-podman - -# Or use commands directly -firefox-vpn-podman run # Start Firefox -firefox-vpn-podman stop # Stop containers -firefox-vpn-podman status # Check status -firefox-vpn-podman build # Rebuild container image -``` - -### Tor Browser - -```bash -# Launch isolated Tor Browser -tor-browser-vpn-podman - -# Or use commands directly -tor-browser-vpn-podman run # Start Tor Browser -tor-browser-vpn-podman stop # Stop containers -tor-browser-vpn-podman status # Check status -tor-browser-vpn-podman build # Rebuild container image -``` - -> **Note:** Traffic flows through both the VPN and Tor network for double isolation. - -### Thorium Browser - -```bash -# Launch isolated Thorium Browser -thorium-vpn-podman - -# Or use commands directly -thorium-vpn-podman run # Start Thorium -thorium-vpn-podman stop # Stop containers -thorium-vpn-podman status # Check status -thorium-vpn-podman build # Rebuild container image -``` - -### Auto-Updates - -Browser containers are automatically rebuilt weekly via systemd timer. - -```bash -# Check timer status -systemctl --user status browser-containers-update.timer - -# Manually trigger update -systemctl --user start browser-containers-update - -# View update logs -journalctl --user -u browser-containers-update -n 50 -``` - -## qBittorrent (VPN) - -User service running through gluetun VPN container. - -```bash -# Start/stop -systemctl --user start qbittorrent -systemctl --user stop qbittorrent - -# View status -systemctl --user status gluetun -systemctl --user status qbittorrent - -# Access WebUI (through VPN container) -# http://127.0.0.1:8080 -``` - -## Secrets Management (SOPS) - -Secrets are encrypted with AGE and decrypted at activation time. - -```bash -# Edit secrets -sops secrets/secrets.yaml - -# Add new secret to secrets.nix, then re-encrypt -sops updatekeys secrets/secrets.yaml -``` - -## Security Features & Hardening - -### Kernel Hardening - -**Boot Parameters** (runtime protection): - -- `slab_nomerge` - Prevents slab cache merging -- `init_on_alloc/free=1` - Zeros memory (use-after-free mitigation) -- `page_alloc.shuffle=1` - Randomizes page allocator -- `randomize_kstack_offset=on` - Randomizes kernel stack -- `vsyscall=none` - Disables legacy vsyscall -- `oops=panic` - Panics on kernel oops - -**Sysctl Settings**: - -- `kptr_restrict=2` - Hide kernel pointers -- `dmesg_restrict=1` - Restrict kernel logs -- `ptrace_scope=1` - Restrict debugging -- `unprivileged_bpf_disabled=1` - Disable BPF for users - -```bash -# Verify boot params after reboot +# Check active security parameters cat /proc/cmdline +sudo nft list ruleset ``` -### Network Security +--- -- **DNS-over-TLS (DoT)**: Enabled via `systemd-resolved`. Encrypts all DNS queries to Quad9 and Cloudflare. -- **Firewall**: `nftables` with Cloudflare-only access on ports 80/443. Direct connections are blocked. -- **Caddy**: Uses DNS-01 ACME challenge (via Cloudflare API) for SSL certs. Configured with security headers (HSTS, CSP, etc.). +## 🏗️ Repository Structure -### Audit Logging +```text +/home/ashie/nixos/ +├── flake.nix # Entry point & input management +├── hosts/nixos/ # Host-specific configurations +│ ├── configuration.nix # System entry point +│ ├── default.nix # Enabled system modules (myModules.*) +│ ├── home-modules.nix # Enabled HM modules (myModules.*) +│ └── home.nix # Home Manager entry point +├── modules/ # Reusable logic +│ ├── nixos/ # System modules (Hardening, Podman, etc.) +│ └── home-manager/ # User modules (DEs, Tools, Services) +├── containers/ # Dockerfiles for isolated environments +└── secrets/ # SOPS-encrypted secrets (AGE) +``` + +--- + +## 📦 Modular System (`myModules`) + +This flake uses a unified module system. You can toggle features in `hosts/nixos/default.nix` (system) and `hosts/nixos/home-modules.nix` (user). + +### Key System Modules +| Module | Description | Status | +| :--- | :--- | :--- | +| `security` | AppArmor, doas, and system audit | Enabled | +| `kernelHardening` | Sysctl & boot-time mitigations | Enabled | +| `dnsOverTls` | Encrypted DNS via systemd-resolved | Enabled | +| `cloudflareFirewall` | nftables rules restricted to CF IPs | Enabled | +| `podman` | OCI container runtime | Enabled | +| `ollamaRocm` | Local LLM acceleration for AMD GPUs | Enabled | + +### Key User Modules +| Module | Description | Status | +| :--- | :--- | :--- | +| `niri` | Scrollable tiling window manager | **Active** | +| `cosmic` | System76's modern desktop environment | Available | +| `noctalia` | Custom shell and UI components | Enabled | +| `protonCachyos` | Auto-updating gaming runtime | Enabled | + +--- + +## 🔒 Application Sandboxing + +Applications are wrapped in `bubblewrap` namespaces using the `mkSandboxedApp` utility (see `modules/nixos/sandbox-utils.nix`). This ensures: +- **No Home Access**: Apps only see specific, required directories. +- **D-Bus Isolation**: Access to the system/session bus is filtered via `xdg-dbus-proxy`. +- **Resource Limiting**: Isolated `/proc`, `/dev`, and `/sys` nodes. + +### Sandboxed Applications +- **Browsers**: Firefox, Brave, Tor Browser, Thorium. +- **Gaming**: Steam, Prism Launcher, Lutris. +- **Social**: Vesktop (Discord), Spotify, Tutanota. + +--- + +## 🛠️ Integrated Services + +- **SearXNG**: Privacy-focused search engine at `search.ashisgreat.xyz`. +- **Antigravity2API**: High-performance LLM API proxy. +- **Ollama**: Local AI inference backend with ROCm support. +- **Redlib**: Privacy-friendly Reddit front-end. +- **OpenClaw**: Modern engine for Captain Claw. + +--- + +## 🔐 Secrets Management + +Secrets are managed via **SOPS** and encrypted with **AGE**. +- **Edit secrets**: `sops secrets/secrets.yaml` +- **Key location**: `~/.config/sops/age/keys.txt` + +--- + +## 🧹 Maintenance ```bash -# View audit logs -sudo ausearch -ts today # Today's events -sudo ausearch -k sudoers # Sudoers changes -sudo aureport --summary # Summary report -``` - -### Automatic Updates - -- Runs daily at 4 AM -- Downloads updates but doesn't auto-reboot -- Apply manually: `sudo nixos-rebuild switch --flake ~/nixos#nixos` - -### Known Security Considerations - -- **Secrets**: `cloudflare.key` is currently a raw file, not managed by SOPS. -- **Containers**: Custom service containers may run as root internally. - -## Useful Commands - -```bash -# System -sudo nixos-rebuild switch --flake ~/nixos#nixos # Apply config -sudo nixos-rebuild boot --flake ~/nixos#nixos # Apply on next boot -nix flake update # Update all inputs -nix-collect-garbage -d # Clean old generations - -# Containers -podman system prune -a # Clean unused images -podman volume ls # List volumes - -# Firewall -sudo nft list ruleset # View nftables -sudo nft list set inet cloudflare cloudflare_ipv4 # View Cloudflare IPs - -# Logs -journalctl -u caddy -f # Caddy logs -journalctl --user -u gluetun -f # VPN logs -``` - -## Troubleshooting - -### Container network issues - -```bash -# Recreate podman network -podman network rm antigravity-net -sudo systemctl restart podman-network-antigravity-net -``` - -### Firefox VPN not starting - -```bash -# Check gluetun status first -systemctl --user status gluetun -journalctl --user -u gluetun -n 50 - -# Rebuild image if needed -firefox-vpn-podman build -``` - -### Secrets not decrypting - -```bash -# Check SOPS key -ls -la ~/.config/sops/age/keys.txt -sops -d secrets/secrets.yaml # Test decryption +# Clean old system generations +nix-collect-garbage -d + +# Optimize the nix store +nix store optimise + +# View container status +podman ps -a ``` diff --git a/flake.lock b/flake.lock index 3bb8804..a3d9dbc 100644 --- a/flake.lock +++ b/flake.lock @@ -25,11 +25,11 @@ "cachyos-kernel": { "flake": false, "locked": { - "lastModified": 1771517207, - "narHash": "sha256-+zDtnmXNyMd3hMepErdPDZzqYS0PiZA0Anbbx9Pvs4g=", + "lastModified": 1772644657, + "narHash": "sha256-7zQSBFv9gFeYhe65NchqLLste7mJ396jA1OnNcf+OQQ=", "owner": "CachyOS", "repo": "linux-cachyos", - "rev": "39737576a25091a3c4ca00729b769a1f92ec98d5", + "rev": "ff5ccc4fa26d5272d929fb9c1838593a6347ca10", "type": "github" }, "original": { @@ -41,11 +41,11 @@ "cachyos-kernel-patches": { "flake": false, "locked": { - "lastModified": 1771516433, - "narHash": "sha256-SuockPZgd2bfjWGmdT8AUBTnBZWvxdA+b8Ss98lNC6c=", + "lastModified": 1772731186, + "narHash": "sha256-y70pS9Cma7+WCsni3VTacHh9g/udulmBS6zrYE2Fz64=", "owner": "CachyOS", "repo": "kernel-patches", - "rev": "505aef2086e584ba683a5ac1cb8ed8252fea2cfd", + "rev": "eac8168ee15f742547d4d20ba5c7fea283f23019", "type": "github" }, "original": { @@ -59,11 +59,11 @@ "nixpkgs": "nixpkgs" }, "locked": { - "lastModified": 1771508520, - "narHash": "sha256-srt94sUlkaGEJHQg7k6gVrBF1QZcHUY/VBESjCgZmKI=", + "lastModified": 1772757591, + "narHash": "sha256-+DyPJcUBXOVu1YiM0mYkEtqYIB9RR0k22NoCaJJ7K2g=", "owner": "catppuccin", "repo": "nix", - "rev": "ec35c21e843e4748e60822cd5543983eb61dc87a", + "rev": "4910a6461a3c4d7ffa56feb4aa4945f3e953f8ec", "type": "github" }, "original": { @@ -75,11 +75,11 @@ "catppuccin-userstyles": { "flake": false, "locked": { - "lastModified": 1771459037, - "narHash": "sha256-QjS/R1ADaWMuRTOR+W8Ppx/HgGlUlXWjbt3iAkd5vSs=", + "lastModified": 1772749300, + "narHash": "sha256-bfFjDcJuUDAjG1+n2a/K6vQlR8LppYGxjT4WmtqAwYw=", "owner": "catppuccin", "repo": "userstyles", - "rev": "9a0dd8c2d0dd87f2962be310ad882762e4ec7074", + "rev": "e61a1c025b75e89f8e7673c024ccd79f80d3d6f0", "type": "github" }, "original": { @@ -112,40 +112,13 @@ "type": "github" } }, - "cppnix": { - "inputs": { - "flake-compat": "flake-compat_4", - "flake-parts": "flake-parts_4", - "git-hooks-nix": "git-hooks-nix", - "nixpkgs": [ - "nixbsd", - "nixpkgs" - ], - "nixpkgs-23-11": "nixpkgs-23-11", - "nixpkgs-regression": "nixpkgs-regression" - }, - "locked": { - "lastModified": 1767672747, - "narHash": "sha256-MqjbAkIYgJge5QSjx2b7hivVHkAVWuquN90HV789E1M=", - "owner": "rhelmot", - "repo": "nix", - "rev": "595d3e984f91237a0ecef84567b461c26a9bf8a9", - "type": "github" - }, - "original": { - "owner": "rhelmot", - "ref": "freebsd", - "repo": "nix", - "type": "github" - } - }, "crane": { "locked": { - "lastModified": 1771121070, - "narHash": "sha256-aIlv7FRXF9q70DNJPI237dEDAznSKaXmL5lfK/Id/bI=", + "lastModified": 1771796463, + "narHash": "sha256-9bCDuUzpwJXcHMQYMS1yNuzYMmKO/CCwCexpjWOl62I=", "owner": "ipetkov", "repo": "crane", - "rev": "a2812c19f1ed2e5ed5ce2ef7109798b575c180e1", + "rev": "3d3de3313e263e04894f284ac18177bd26169bad", "type": "github" }, "original": { @@ -161,11 +134,11 @@ ] }, "locked": { - "lastModified": 1771494902, - "narHash": "sha256-G2yfLhPTuW4nSQCWdXzqknm9uop7OR+zQuoGll5rxLA=", + "lastModified": 1772683386, + "narHash": "sha256-uiYArwJv6pBDuWgmbAJx2+TYFrufn2MdLio5nn0sdRQ=", "owner": "rycee", "repo": "nur-expressions", - "rev": "07b71eb895d1f977c763899b985ee4980412dc57", + "rev": "a992662e5a78c82423a1a58d28ad00d49548ff80", "type": "gitlab" }, "original": { @@ -222,36 +195,6 @@ "type": "github" } }, - "flake-compat_4": { - "flake": false, - "locked": { - "lastModified": 1733328505, - "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=", - "owner": "edolstra", - "repo": "flake-compat", - "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec", - "type": "github" - }, - "original": { - "owner": "edolstra", - "repo": "flake-compat", - "type": "github" - } - }, - "flake-compat_5": { - "locked": { - "lastModified": 1733328505, - "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=", - "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec", - "revCount": 69, - "type": "tarball", - "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.1.0/01948eb7-9cba-704f-bbf3-3fa956735b52/source.tar.gz" - }, - "original": { - "type": "tarball", - "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz" - } - }, "flake-parts": { "inputs": { "nixpkgs-lib": [ @@ -296,11 +239,11 @@ "nixpkgs-lib": "nixpkgs-lib_2" }, "locked": { - "lastModified": 1769996383, - "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=", + "lastModified": 1772408722, + "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "57928607ea566b5db3ad13af0e57e921e6b12381", + "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3", "type": "github" }, "original": { @@ -310,28 +253,6 @@ } }, "flake-parts_4": { - "inputs": { - "nixpkgs-lib": [ - "nixbsd", - "cppnix", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1733312601, - "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=", - "owner": "hercules-ci", - "repo": "flake-parts", - "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9", - "type": "github" - }, - "original": { - "owner": "hercules-ci", - "repo": "flake-parts", - "type": "github" - } - }, - "flake-parts_5": { "inputs": { "nixpkgs-lib": [ "nixvim", @@ -352,7 +273,7 @@ "type": "github" } }, - "flake-parts_6": { + "flake-parts_5": { "inputs": { "nixpkgs-lib": [ "steam-config-nix", @@ -391,38 +312,21 @@ "type": "github" } }, - "git-hooks-nix": { + "flake-utils_2": { "inputs": { - "flake-compat": [ - "nixbsd", - "cppnix" - ], - "gitignore": [ - "nixbsd", - "cppnix" - ], - "nixpkgs": [ - "nixbsd", - "cppnix", - "nixpkgs" - ], - "nixpkgs-stable": [ - "nixbsd", - "cppnix", - "nixpkgs" - ] + "systems": "systems_2" }, "locked": { - "lastModified": 1734279981, - "narHash": "sha256-NdaCraHPp8iYMWzdXAt5Nv6sA3MUzlCiGiR586TCwo0=", - "owner": "cachix", - "repo": "git-hooks.nix", - "rev": "aa9f40c906904ebd83da78e7f328cd8aeaeae785", + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", "type": "github" }, "original": { - "owner": "cachix", - "repo": "git-hooks.nix", + "owner": "numtide", + "repo": "flake-utils", "type": "github" } }, @@ -477,11 +381,11 @@ ] }, "locked": { - "lastModified": 1771531206, - "narHash": "sha256-1R3Wx6KUkMb4x4E5UOhW9p6rqiexzSGGWxZqSHqW5n0=", + "lastModified": 1772633327, + "narHash": "sha256-jl+DJB2DUx7EbWLRng+6HNWW/1/VQOnf0NsQB4PlA7I=", "owner": "nix-community", "repo": "home-manager", - "rev": "91be7cce763fa4022c7cf025a71b0c366d1b6e77", + "rev": "5a75730e6f21ee624cbf86f4915c6e7489c74acc", "type": "github" }, "original": { @@ -511,6 +415,27 @@ "type": "github" } }, + "home-manager_3": { + "inputs": { + "nixpkgs": [ + "nix-openclaw", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1767909183, + "narHash": "sha256-u/bcU0xePi5bgNoRsiqSIwaGBwDilKKFTz3g0hqOBAo=", + "owner": "nix-community", + "repo": "home-manager", + "rev": "cd6e96d56ed4b2a779ac73a1227e0bb1519b3509", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "home-manager", + "type": "github" + } + }, "impermanence": { "inputs": { "home-manager": "home-manager_2", @@ -570,11 +495,11 @@ "rust-overlay": "rust-overlay" }, "locked": { - "lastModified": 1771492583, - "narHash": "sha256-nQzvnU4BGu8dA6BsPPCqmVcab/3ebVmHtX3ZWbW3Hxc=", + "lastModified": 1772216104, + "narHash": "sha256-1TnGN26vnCEQk5m4AavJZxGZTb/6aZyphemRPRwFUfs=", "owner": "nix-community", "repo": "lanzaboote", - "rev": "5e9380994665ef66c87ab8e22c913ff837174ce4", + "rev": "dbe5112de965bbbbff9f0729a9789c20a65ab047", "type": "github" }, "original": { @@ -586,11 +511,11 @@ "libnbtplusplus": { "flake": false, "locked": { - "lastModified": 1744811532, - "narHash": "sha256-qhmjaRkt+O7A+gu6HjUkl7QzOEb4r8y8vWZMG2R/C6o=", + "lastModified": 1772016279, + "narHash": "sha256-7itkptyjoRcXfGLwg1/jxajetZ3a4mDc66+w4X6yW8s=", "owner": "PrismLauncher", "repo": "libnbtplusplus", - "rev": "531449ba1c930c98e0bcf5d332b237a8566f9d78", + "rev": "687e43031df0dc641984b4256bcca50d5b3f7de3", "type": "github" }, "original": { @@ -607,11 +532,11 @@ ] }, "locked": { - "lastModified": 1769804089, - "narHash": "sha256-Wkot1j0cTx64xxjmLXzPubTckaZBSUJFhESEdOzPYas=", + "lastModified": 1772763717, + "narHash": "sha256-GaAyeUcsib5mw7YZvba/J0xixrW//m/Ehf//6kSw/UU=", "owner": "utensils", "repo": "mcp-nixos", - "rev": "37a691ea4ea9c8bdcccfe174c6127847b8213fd3", + "rev": "99ab8204aec4497942107c7c1efb76d1b1ed445b", "type": "github" }, "original": { @@ -620,27 +545,6 @@ "type": "github" } }, - "mini-tmpfiles": { - "inputs": { - "nixpkgs": [ - "nixbsd", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1742754557, - "narHash": "sha256-nGxgiNhA94eSl8jcQwCboJ5Ed132z8yrFdOoT+rf8bE=", - "owner": "nixos-bsd", - "repo": "mini-tmpfiles", - "rev": "534ee577692c7092fdcd035f89bc29b663c6f9ca", - "type": "github" - }, - "original": { - "owner": "nixos-bsd", - "repo": "mini-tmpfiles", - "type": "github" - } - }, "mkdocs-catppuccin": { "flake": false, "locked": { @@ -665,11 +569,11 @@ "rust-overlay": "rust-overlay_2" }, "locked": { - "lastModified": 1771305475, - "narHash": "sha256-lqweVTwHhYc+9T33cysp38gVwxaibGJHriOPZXWyhCY=", + "lastModified": 1772207631, + "narHash": "sha256-Jkkg+KqshFO3CbTszVVpkKN2AOObYz+wMsM3ONo1z5g=", "owner": "YaLTeR", "repo": "niri", - "rev": "a2a52911757cb3b497db9407592f9b4c439571ea", + "rev": "e708f546153f74acf33eb183b3b2992587a701e5", "type": "github" }, "original": { @@ -687,11 +591,11 @@ "treefmt-nix": "treefmt-nix" }, "locked": { - "lastModified": 1770308099, - "narHash": "sha256-VxuIePns4c+qpsHpLXW0CwovpKUx1xnvVIUuJwPO6fQ=", + "lastModified": 1772136788, + "narHash": "sha256-5M9aiuBAm1nQd/8UAGrgnr2untzliTiWQIo1sHrGEMY=", "owner": "Naxdy", "repo": "nix-bwrapper", - "rev": "1248b52f2bd4fe5690c1a36836a1798be21d953b", + "rev": "49749a10842ebcc7ff0d2daea660d3b29ca5abb5", "type": "github" }, "original": { @@ -709,11 +613,11 @@ "nixpkgs": "nixpkgs_4" }, "locked": { - "lastModified": 1771525883, - "narHash": "sha256-XqDuaRbxLGno5HcWRE5lQrgMBeXXs6ncGq+R6eCvsq8=", + "lastModified": 1772737222, + "narHash": "sha256-VQ0i0rB4wI9EEoMybDNFzgC/hzcwxEMPmxrq/Ce0JkI=", "owner": "xddxdd", "repo": "nix-cachyos-kernel", - "rev": "15fb6039dd248d478a8f3f7f6c067b206da2bf54", + "rev": "1c0e0cd60713026a6517f31890278d9d5e51de9b", "type": "github" }, "original": { @@ -737,26 +641,44 @@ "type": "github" } }, - "nixbsd": { + "nix-openclaw": { "inputs": { - "cppnix": "cppnix", - "flake-compat": "flake-compat_5", - "mini-tmpfiles": "mini-tmpfiles", + "flake-utils": "flake-utils_2", + "home-manager": "home-manager_3", + "nix-steipete-tools": "nix-steipete-tools", "nixpkgs": [ "nixpkgs" ] }, "locked": { - "lastModified": 1768417153, - "narHash": "sha256-2Vu3Yocs45HGVEYokRvN3DdBtaft37H4Z6rw4rAQ1gk=", - "owner": "nixos-bsd", - "repo": "nixbsd", - "rev": "e393e147e3c30f6424c2a32c5362241c004b5156", + "lastModified": 1772765409, + "narHash": "sha256-hN6Q3uoYKAW5A1B1Tllvk+FUyhNPl8aj1M9WVu7JOpg=", + "owner": "openclaw", + "repo": "nix-openclaw", + "rev": "58c4cae97ce8dde2e314b80017635ee557654df5", "type": "github" }, "original": { - "owner": "nixos-bsd", - "repo": "nixbsd", + "owner": "openclaw", + "repo": "nix-openclaw", + "type": "github" + } + }, + "nix-steipete-tools": { + "inputs": { + "nixpkgs": "nixpkgs_5" + }, + "locked": { + "lastModified": 1772109967, + "narHash": "sha256-0oWZtmVJcI7Mc6nAXf7XM4FHLJv+H1X/8Gh31uJCyJ0=", + "owner": "openclaw", + "repo": "nix-steipete-tools", + "rev": "2b97c49e03657af1574aee5a34f57b38fba90035", + "type": "github" + }, + "original": { + "owner": "openclaw", + "repo": "nix-steipete-tools", "type": "github" } }, @@ -769,11 +691,11 @@ "treefmt-nix": "treefmt-nix_2" }, "locked": { - "lastModified": 1771514873, - "narHash": "sha256-sEAorIUS2IA1VG4mUVYWi+6LEnYmmn1f+3h6sNOqhso=", + "lastModified": 1772488460, + "narHash": "sha256-TZuI5NyeWK0DAJdBfK92X3XbasqkIoGPId9B/Q7euQA=", "owner": "kiriwalawren", "repo": "nixflix", - "rev": "078f61c04340c0365fd5a6772e08cd432d1123a3", + "rev": "1745d0c78c0463e9108db04659848a2df5b44d12", "type": "github" }, "original": { @@ -784,11 +706,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1770197578, - "narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=", + "lastModified": 1772624091, + "narHash": "sha256-QKyJ0QGWBn6r0invrMAK8dmJoBYWoOWy7lN+UHzW1jc=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2", + "rev": "80bdc1e5ce51f56b19791b52b2901187931f5353", "type": "github" }, "original": { @@ -798,22 +720,6 @@ "type": "github" } }, - "nixpkgs-23-11": { - "locked": { - "lastModified": 1717159533, - "narHash": "sha256-oamiKNfr2MS6yH64rUn99mIZjc45nGJlj9eGth/3Xuw=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446", - "type": "github" - }, - "original": { - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446", - "type": "github" - } - }, "nixpkgs-lib": { "locked": { "lastModified": 1765674936, @@ -831,11 +737,11 @@ }, "nixpkgs-lib_2": { "locked": { - "lastModified": 1769909678, - "narHash": "sha256-cBEymOf4/o3FD5AZnzC3J9hLbiZ+QDT/KDuyHXVJOpM=", + "lastModified": 1772328832, + "narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=", "owner": "nix-community", "repo": "nixpkgs.lib", - "rev": "72716169fe93074c333e8d0173151350670b824c", + "rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742", "type": "github" }, "original": { @@ -844,22 +750,6 @@ "type": "github" } }, - "nixpkgs-regression": { - "locked": { - "lastModified": 1643052045, - "narHash": "sha256-uGJ0VXIhWKGXxkeNnq4TvV3CIOkUJ3PAoLZ3HMzNVMw=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2", - "type": "github" - }, - "original": { - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2", - "type": "github" - } - }, "nixpkgs_2": { "locked": { "lastModified": 1767892417, @@ -894,11 +784,11 @@ }, "nixpkgs_4": { "locked": { - "lastModified": 1771482645, - "narHash": "sha256-MpAKyXfJRDTgRU33Hja+G+3h9ywLAJJNRq4Pjbb4dQs=", + "lastModified": 1772691005, + "narHash": "sha256-TCamkDXY0G84Se5Kio6BbqtWfWfPXg9on9ZsX19tnNo=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "724cf38d99ba81fbb4a347081db93e2e3a9bc2ae", + "rev": "be4f549ba12cd3e2b66d24fa7e39cd871111bdb3", "type": "github" }, "original": { @@ -910,11 +800,27 @@ }, "nixpkgs_5": { "locked": { - "lastModified": 1771369470, - "narHash": "sha256-0NBlEBKkN3lufyvFegY4TYv5mCNHbi5OmBDrzihbBMQ=", + "lastModified": 1767364772, + "narHash": "sha256-fFUnEYMla8b7UKjijLnMe+oVFOz6HjijGGNS1l7dYaQ=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "0182a361324364ae3f436a63005877674cf45efb", + "rev": "16c7794d0a28b5a37904d55bcca36003b9109aaa", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixpkgs-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_6": { + "locked": { + "lastModified": 1772624091, + "narHash": "sha256-QKyJ0QGWBn6r0invrMAK8dmJoBYWoOWy7lN+UHzW1jc=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "80bdc1e5ce51f56b19791b52b2901187931f5353", "type": "github" }, "original": { @@ -925,18 +831,18 @@ }, "nixvim": { "inputs": { - "flake-parts": "flake-parts_5", + "flake-parts": "flake-parts_4", "nixpkgs": [ "nixpkgs" ], - "systems": "systems_2" + "systems": "systems_3" }, "locked": { - "lastModified": 1771135771, - "narHash": "sha256-wyvBIhDuyCRyjB3yPg77qoyxrlgQtBR1rVW3c9knV3E=", + "lastModified": 1772402258, + "narHash": "sha256-3DmCFOdmbkFML1/G9gj8Wb+rCCZFPOQtNoMCpqOF8SA=", "owner": "nix-community", "repo": "nixvim", - "rev": "ed0424f0b08d303a7348f52f7850ad1b2704f9ba", + "rev": "21ae25e13b01d3b4cdc750b5f9e7bad68b150c10", "type": "github" }, "original": { @@ -949,14 +855,15 @@ "inputs": { "nixpkgs": [ "nixpkgs" - ] + ], + "noctalia-qs": "noctalia-qs" }, "locked": { - "lastModified": 1771554771, - "narHash": "sha256-atFYM8h8fgnXW/i/zM3yZnhsbVxlsIQ6eq/FcC6uZ6k=", + "lastModified": 1772755279, + "narHash": "sha256-vDeyLhCqy2weSYD/5LtX4kXXc/pBwd1rUqcPkzCGTKs=", "owner": "noctalia-dev", "repo": "noctalia-shell", - "rev": "8eef8ef71d64a7ad0144eb79221cdfcc568848cf", + "rev": "52a7165b46117ac7dcf41be1f9df6f1e1a538b13", "type": "github" }, "original": { @@ -965,6 +872,27 @@ "type": "github" } }, + "noctalia-qs": { + "inputs": { + "nixpkgs": [ + "noctalia", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1772673824, + "narHash": "sha256-TLHXPoELZA6VeuzC1Zpx+MnSsYzrJs+DSieMgfjAOJc=", + "owner": "noctalia-dev", + "repo": "noctalia-qs", + "rev": "f8531192cd09b9ea2e78d18e9cfc9d3dba498690", + "type": "github" + }, + "original": { + "owner": "noctalia-dev", + "repo": "noctalia-qs", + "type": "github" + } + }, "nuschtosSearch": { "inputs": { "flake-utils": "flake-utils", @@ -1041,11 +969,11 @@ ] }, "locked": { - "lastModified": 1770726378, - "narHash": "sha256-kck+vIbGOaM/dHea7aTBxdFYpeUl/jHOy5W3eyRvVx8=", + "lastModified": 1771858127, + "narHash": "sha256-Gtre9YoYl3n25tJH2AoSdjuwcqij5CPxL3U3xysYD08=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "5eaaedde414f6eb1aea8b8525c466dc37bba95ae", + "rev": "49bbbfc218bf3856dfa631cead3b052d78248b83", "type": "github" }, "original": { @@ -1062,11 +990,11 @@ ] }, "locked": { - "lastModified": 1771507368, - "narHash": "sha256-Q7cDybjd7GjYsN9SHd/fBSNdgieM5bX23gErJ9QE5xc=", + "lastModified": 1772470402, + "narHash": "sha256-bC61/pe4YDXtOQh66wf2QObCA10efl7mSRwrN6MjRYQ=", "owner": "PrismLauncher", "repo": "PrismLauncher", - "rev": "eac55d849c7ab44a3310a9c5c822a850331c3160", + "rev": "b114d043f638e30d421b8a299fdfed4b3230ba3d", "type": "github" }, "original": { @@ -1090,9 +1018,9 @@ "nix-bwrapper": "nix-bwrapper", "nix-cachyos-kernel": "nix-cachyos-kernel", "nix-flatpak": "nix-flatpak", - "nixbsd": "nixbsd", + "nix-openclaw": "nix-openclaw", "nixflix": "nixflix", - "nixpkgs": "nixpkgs_5", + "nixpkgs": "nixpkgs_6", "nixvim": "nixvim", "noctalia": "noctalia", "opencode-flake": "opencode-flake", @@ -1109,11 +1037,11 @@ ] }, "locked": { - "lastModified": 1771125043, - "narHash": "sha256-ldf/s49n6rOAxl7pYLJGGS1N/assoHkCOWdEdLyNZkc=", + "lastModified": 1771988922, + "narHash": "sha256-Fc6FHXtfEkLtuVJzd0B6tFYMhmcPLuxr90rWfb/2jtQ=", "owner": "oxalica", "repo": "rust-overlay", - "rev": "4912f951a26dc8142b176be2c2ad834319dc06e8", + "rev": "f4443dc3f0b6c5e6b77d923156943ce816d1fcb9", "type": "github" }, "original": { @@ -1150,11 +1078,11 @@ ] }, "locked": { - "lastModified": 1771524872, - "narHash": "sha256-eksVUcUsfS9mQx4D9DrYu88u9w70bAf+n6KmTDuIGEE=", + "lastModified": 1772495394, + "narHash": "sha256-hmIvE/slLKEFKNEJz27IZ8BKlAaZDcjIHmkZ7GCEjfw=", "owner": "Mic92", "repo": "sops-nix", - "rev": "e85540ffe97322dc1fea14dd11cdc2f59d540ac7", + "rev": "1d9b98a29a45abe9c4d3174bd36de9f28755e3ff", "type": "github" }, "original": { @@ -1165,18 +1093,18 @@ }, "steam-config-nix": { "inputs": { - "flake-parts": "flake-parts_6", + "flake-parts": "flake-parts_5", "nixpkgs": [ "nixpkgs" ], - "systems": "systems_3" + "systems": "systems_4" }, "locked": { - "lastModified": 1770296756, - "narHash": "sha256-3jBIUXJu+Pc2MPu1KaHqhTS1z6KospVbDlBPvggATqs=", + "lastModified": 1771641886, + "narHash": "sha256-+mchQJE30NiI66DUMwXW+dBrKJeF240n4v45TcXmkIc=", "owner": "different-name", "repo": "steam-config-nix", - "rev": "e409b3bac9412513ff95fe293eb6ad42f985c60b", + "rev": "5b24ff543683b62663adbc3b54942929ca0d4d91", "type": "github" }, "original": { @@ -1230,6 +1158,21 @@ "type": "github" } }, + "systems_4": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, "treefmt-nix": { "inputs": { "nixpkgs": "nixpkgs_3" diff --git a/flake.nix b/flake.nix index 73a8806..9e4c3aa 100644 --- a/flake.nix +++ b/flake.nix @@ -1,11 +1,6 @@ { description = "Modular NixOS Configuration with Hyprland"; - nixConfig = { - extra-substituters = [ "https://attic.mildlyfunctional.gay/nixbsd" ]; - extra-trusted-public-keys = [ "nixbsd:gwcQlsUONBLrrGCOdEboIAeFq9eLaDqfhfXmHZs1mgc=" ]; - }; - inputs = { nixpkgs.url = "nixpkgs/nixos-unstable"; @@ -103,10 +98,11 @@ inputs.nixpkgs.follows = "nixpkgs"; }; - nixbsd = { - url = "github:nixos-bsd/nixbsd"; + nix-openclaw = { + url = "github:openclaw/nix-openclaw"; inputs.nixpkgs.follows = "nixpkgs"; }; + }; outputs = @@ -121,7 +117,7 @@ nixflix, arkenfox, firefox-addons, - nixbsd, + ... }@inputs: { @@ -147,24 +143,6 @@ default = import ./modules/home-manager; }; - nixosConfigurations.nixbsd = nixbsd.lib.nixbsdSystem { - specialArgs = { inherit inputs; }; - modules = [ - ./hosts/nixbsd/configuration.nix - ]; - }; - - nixosConfigurations.nixbsd-vm = nixbsd.lib.nixbsdSystem { - specialArgs = { inherit inputs; }; - modules = [ - ./hosts/nixbsd/configuration.nix - ({ config, ... }: { - # Enable VM variant - # This is already in configuration.nix but we can make it explicit here if we want. - }) - ]; - }; - nixosConfigurations.nixos = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; specialArgs = { inherit inputs; }; @@ -188,9 +166,9 @@ useUserPackages = true; backupFileExtension = "backup"; users.ashie = import ./hosts/nixos/home.nix; + }; } - ./modules/nixos/impermanence.nix ]; }; @@ -216,9 +194,9 @@ useUserPackages = true; backupFileExtension = "backup"; users.ashie = import ./hosts/nixos/home.nix; + }; } - ./modules/nixos/impermanence.nix ]; }; }; diff --git a/flaresolverr_test.json b/flaresolverr_test.json deleted file mode 100644 index aac331b..0000000 --- a/flaresolverr_test.json +++ /dev/null @@ -1 +0,0 @@ -{"status": "ok", "message": "Challenge solved!", "solution": {"url": "https://1337x.to/", "status": 200, "cookies": [{"domain": ".1337x.to", "expiry": 1800392887, "httpOnly": true, "name": "cf_clearance", "path": "/", "sameSite": "None", "secure": true, "value": "Hppe3HHGqJQSvfeLipKrf9nn.IZO1L2b73ABvWOlr04-1768856887-1.2.1.1-g4KpGkeQcFK8YxEHGOnDwNGDswkXCjmqjnNWsfVN0bKKR1Ck_0CMie8_SB9aK.VhT9qQ9keJmCNKXVv0QDWmqqzPH.2.3IA6lStvUhYpQ3sccVKvFNfvdpsywn8RZYIpX5fuZQxxl80NhPXHNHQSQn11r3AdYRg_EIwtfiD8m1GXrBmVK726kmeTnHNiTfBkvDMaRwsV8DKIVYl4g2kzvLyrSUzOGQq59h1I3ApK6qTSOKtBEti_5oOJOBWvkhvD"}], "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36", "headers": {}, "response": "\n\n\nTorrent Search Engine | 1337x.to\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n \n \n
\n \n
\n \n
\n
\n
\n
\n \n
\n \n
\n
\n \n
\n
\n \n \n
\n
\n \n \n
\n
\n
\n
\"logo\"
\n\n
\n
\n \n \n
\n
    \n \n
    \n
    \n
    \n \n \n \n\n\n \n\n \n\n\n"}, "startTimestamp": 1768856883767, "endTimestamp": 1768856894907, "version": "3.4.6"} \ No newline at end of file diff --git a/hosts/nixbsd/configuration.nix b/hosts/nixbsd/configuration.nix deleted file mode 100644 index 91253bc..0000000 --- a/hosts/nixbsd/configuration.nix +++ /dev/null @@ -1,47 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -{ - nixpkgs.hostPlatform = "x86_64-freebsd"; - - # NixBSD doesn't have systemd, it uses FreeBSD's init or similar. - # The NixBSD modules handle the specific FreeBSD configuration. - - networking.hostName = "nixbsd"; - - # Default user configuration - users.users.ashie = { - isNormalUser = true; - description = "Ashie"; - extraGroups = [ "wheel" ]; - initialPassword = "nixbsd"; - }; - - # SSH service for access - services.sshd.enable = true; - - # FreeBSD loader configuration - boot.loader.stand-freebsd.enable = true; - - # File system layout - fileSystems."/" = { - device = "/dev/gpt/nixos"; - fsType = "ufs"; - }; - - fileSystems."/boot" = { - device = "/dev/msdosfs/ESP"; - fsType = "msdosfs"; - }; - - # VM variant for running in QEMU - virtualisation.vmVariant = { - virtualisation = { - memorySize = 2048; # 2GB RAM - cores = 2; - }; - }; -} diff --git a/hosts/nixos/configuration.nix b/hosts/nixos/configuration.nix index 6382229..1407edf 100644 --- a/hosts/nixos/configuration.nix +++ b/hosts/nixos/configuration.nix @@ -33,18 +33,29 @@ # Enable performance optimizations myModules.performance.enable = true; - + services.resolved.dnssec = "false"; # Enable modularized components myModules.desktop.cosmic.enable = true; myModules.media.enable = true; myModules.gaming.gamemode.enable = true; myModules.redlib.enable = true; + services.openclaw-service.enable = true; # Enable sandboxed applications + myModules.wireproxy = { + enable = true; + endpointIP = "94.228.209.212"; + }; myModules.steamSandboxed.enable = true; myModules.lutrisSandboxed.enable = true; - myModules.firefoxSandboxed.enable = true; - myModules.braveSandboxed.enable = true; + myModules.firefoxSandboxed = { + enable = true; + useProxy = true; + }; + myModules.braveSandboxed = { + enable = true; + useProxy = true; + }; myModules.azaharSandboxed.enable = true; myModules.faugusSandboxed.enable = true; myModules.citronSandboxed.enable = true; diff --git a/hosts/nixos/default.nix b/hosts/nixos/default.nix index 51dedd4..5b26cc7 100644 --- a/hosts/nixos/default.nix +++ b/hosts/nixos/default.nix @@ -40,7 +40,7 @@ dnsOverTls = { enable = true; - dnssec = true; + dnssec = false; }; cloudflareFirewall = { @@ -51,6 +51,7 @@ # Ports that are public 443 80 + 1080 ]; restrictedPorts = [ ]; # Ports that are Cloudflare only }; @@ -69,7 +70,7 @@ }; ollamaRocm = { - enable = false; # Disabled temporarily to unblock install (namespace issues) + enable = true; }; openWebUI = { diff --git a/hosts/nixos/home.nix b/hosts/nixos/home.nix index ccbc532..7210ab2 100644 --- a/hosts/nixos/home.nix +++ b/hosts/nixos/home.nix @@ -9,7 +9,7 @@ ../../modules/home-manager/gluetun-user.nix ../../modules/home-manager/cosmic.nix inputs.sops-nix.homeManagerModules.sops - inputs.steam-config-nix.homeModules.default + # inputs.steam-config-nix.homeModules.default inputs.catppuccin.homeManagerModules.catppuccin inputs.nixvim.homeManagerModules.nixvim # inputs.unified-router-mcp.homeManagerModules.default @@ -41,6 +41,9 @@ sops.age.keyFile = "/home/ashie/.config/sops/age/keys.txt"; sops.secrets.master_api_key = { }; + sops.secrets.discord_bot_token = { }; + sops.secrets.searxng_brave_api_key = { }; + sops.secrets.github_token = { }; # Unified Router MCP Servers # services.unified-router-mcp = { @@ -60,6 +63,7 @@ username = "ashie"; password = "AshieAntigravity2024!"; apiKey = "sk-antigravity-local-key"; + glmApiKeyPath = "/run/secrets/glm_api_key"; }; }; @@ -111,6 +115,17 @@ updateInterval = 24 * 60 * 60 * 1000; # every day definedAliases = [ "@ag" ]; }; + "Brave Search" = { + urls = [{ + template = "https://search.brave.com/search"; + params = [ + { name = "q"; value = "{searchTerms}"; } + ]; + }]; + iconUpdateURL = "https://search.brave.com/favicon.ico"; + updateInterval = 24 * 60 * 60 * 1000; # every day + definedAliases = [ "@b" ]; + }; }; }; arkenfox = { diff --git a/hosts/nixos/home/steam.nix b/hosts/nixos/home/steam.nix index 7a11e6d..c915eb0 100644 --- a/hosts/nixos/home/steam.nix +++ b/hosts/nixos/home/steam.nix @@ -1,22 +1 @@ -{ - config, - pkgs, - inputs, - ... -}: -{ - programs.steam.config = { - enable = true; - closeSteam = true; # Closes Steam on rebuild, to prevent data loss - defaultCompatTool = "proton-cachyos-latest"; - - apps = { - overwatch2 = { - id = 2357570; - compatTool = "proton-cachyos-latest"; - launchOptions = "gamemoderun mangohud PROTON_USE_NTSYNC=1 ENABLE_LAYER_MESA_ANTI_LAG=1 PROTON_LOCAL_SHADER_CACHE=1 %command%"; - }; - }; - }; - -} +{ ... }: { } diff --git a/hosts/nixos/home/vscode.nix b/hosts/nixos/home/vscode.nix index e18a0e7..54c1930 100644 --- a/hosts/nixos/home/vscode.nix +++ b/hosts/nixos/home/vscode.nix @@ -51,6 +51,10 @@ let # Run antigravity binary when the FHS env is invoked runScript = pkgs.writeShellScript "antigravity-wrapper" '' unset LD_PRELOAD + + # Use a wrapper for bash that ignores user configuration + export SHELL=${pkgs.writeShellScript "bash-sandboxed" ''exec ${pkgs.bash}/bin/bash --noprofile --norc "$@"''} + exec ${pkgs.antigravity}/bin/antigravity "$@" ''; @@ -59,6 +63,11 @@ let export LD_LIBRARY_PATH=/usr/lib:/usr/lib64:$LD_LIBRARY_PATH ''; + extraBwrapArgs = [ + "--tmpfs" + "/home/ashie/.config/fish" + ]; + extraBindMounts = [ "/etc/subuid" "/etc/subgid" @@ -93,16 +102,18 @@ let # Helper to adapt VS Code extensions for Antigravity # Home Manager expects extensions to be in share/antigravity/extensions based on the package name, # but standard extensions are in share/vscode/extensions. - adaptToAntigravity = ext: pkgs.symlinkJoin { - name = "${ext.name}-antigravity"; - paths = [ ext ]; - # Ensure passthru attributes are preserved (though symlinkJoin usually handles this, specific ones might help) - inherit (ext) meta; - postBuild = '' - mkdir -p $out/share/antigravity - ln -sf ${ext}/share/vscode/extensions $out/share/antigravity/extensions - ''; - }; + adaptToAntigravity = + ext: + pkgs.symlinkJoin { + name = "${ext.name}-antigravity"; + paths = [ ext ]; + # Ensure passthru attributes are preserved (though symlinkJoin usually handles this, specific ones might help) + inherit (ext) meta; + postBuild = '' + mkdir -p $out/share/antigravity + ln -sf ${ext}/share/vscode/extensions $out/share/antigravity/extensions + ''; + }; in { home.packages = [ @@ -132,49 +143,52 @@ in enableExtensionUpdateCheck = false; # Extensions from nixpkgs - extensions = map adaptToAntigravity (with pkgs.vscode-extensions; [ - # Theme & Icons - catppuccin.catppuccin-vsc - catppuccin.catppuccin-vsc-icons + extensions = map adaptToAntigravity ( + with pkgs.vscode-extensions; + [ + # Theme & Icons + catppuccin.catppuccin-vsc + catppuccin.catppuccin-vsc-icons - # Git - eamodio.gitlens + # Git + eamodio.gitlens - # C/C++ - llvm-vs-code-extensions.vscode-clangd + # C/C++ + llvm-vs-code-extensions.vscode-clangd - # Nix - jnoortheen.nix-ide + # Nix + jnoortheen.nix-ide - # Python - ms-python.python - ms-python.debugpy + # Python + ms-python.python + ms-python.debugpy - # Go - golang.go + # Go + golang.go - # Java (RedHat + vscjava) - redhat.java - vscjava.vscode-java-debug - vscjava.vscode-java-dependency - vscjava.vscode-java-pack - vscjava.vscode-java-test - vscjava.vscode-gradle - vscjava.vscode-maven + # Java (RedHat + vscjava) + redhat.java + vscjava.vscode-java-debug + vscjava.vscode-java-dependency + vscjava.vscode-java-pack + vscjava.vscode-java-test + vscjava.vscode-gradle + vscjava.vscode-maven - # PHP - bmewburn.vscode-intelephense-client - xdebug.php-debug + # PHP + bmewburn.vscode-intelephense-client + xdebug.php-debug - # Ruby - shopify.ruby-lsp + # Ruby + shopify.ruby-lsp - # Docker & Containers - ms-azuretools.vscode-docker + # Docker & Containers + ms-azuretools.vscode-docker - # Formatters - esbenp.prettier-vscode - ]); + # Formatters + esbenp.prettier-vscode + ] + ); # User settings (settings.json equivalent) userSettings = { diff --git a/hosts/nixos/kafka.nix b/hosts/nixos/kafka.nix new file mode 100644 index 0000000..ec5c1fb --- /dev/null +++ b/hosts/nixos/kafka.nix @@ -0,0 +1,96 @@ +{ + config, + pkgs, + inputs, + ... +}: +{ + imports = [ + inputs.sops-nix.homeManagerModules.sops + inputs.nix-openclaw.homeManagerModules.openclaw + ]; + + home.username = "kafka"; + home.homeDirectory = "/home/kafka"; + home.stateVersion = "25.05"; + + sops.defaultSopsFile = ../../secrets/secrets.yaml; + sops.defaultSopsFormat = "yaml"; + sops.age.keyFile = "/home/kafka/.config/sops/age/keys.txt"; + + sops.secrets.openai_api_key = { }; + sops.secrets.github_token = { }; + + programs.openclaw = { + enable = true; + stateDir = "/home/kafka/openclaw"; + workspaceDir = "/home/kafka/openclaw/workspace"; + config = { + gateway = { + port = 18789; + bind = "loopback"; + trustedProxies = [ "::1" "127.0.0.1" "10.88.0.0/16" "10.89.0.0/16" ]; + auth = { + mode = "none"; + }; + controlUi = { + dangerouslyAllowHostHeaderOriginFallback = true; + allowedOrigins = [ "*" ]; + }; + }; + channels = { + discord = { + enabled = true; + token = "/run/secrets/openclaw-discord-token"; + allowFrom = [ "1178286690750693419" "*" ]; + groupPolicy = "open"; + dmPolicy = "open"; + }; + }; + agents = { + defaults = { + workspace = "/home/kafka/openclaw/workspace"; + model = { + primary = "zai/glm-4.7"; + }; + }; + }; + commands = { + native = true; + nativeSkills = "auto"; + restart = true; + ownerDisplay = "raw"; + }; + tools = { + exec = { + security = "full"; + ask = "off"; + }; + }; + models = { + mode = "merge"; + providers.zai = { + baseUrl = "https://api.z.ai/api/coding/paas/v4"; + apiKey = "e77f2c392cb942eca9d0407eebc75549.XG7ikxT2kBEQUPYx"; + models = [ + { + id = "glm-4.7"; + name = "GLM 4.7"; + reasoning = true; + contextWindow = 128000; + maxTokens = 128000; + } + { + id = "glm-5"; + name = "GLM 5"; + reasoning = true; + contextWindow = 128000; + maxTokens = 128000; + } + ]; + }; + }; + skills.entries.mcporter.enabled = true; + }; + }; +} diff --git a/hosts/nixos/system/authelia.nix b/hosts/nixos/system/authelia.nix index 742019a..b36cd70 100644 --- a/hosts/nixos/system/authelia.nix +++ b/hosts/nixos/system/authelia.nix @@ -48,6 +48,12 @@ domain = "auth.ashisgreat.xyz"; policy = "bypass"; } + # Bypass for local network (service-to-service communication) + { + domain = "*.ashisgreat.xyz"; + networks = [ "10.89.0.0/24" ]; + policy = "bypass"; + } # Bypass for Jellyfin (handles its own auth) { domain = "jellyfin.ashisgreat.xyz"; @@ -61,6 +67,7 @@ "prowlarr.ashisgreat.xyz" "torrent.ashisgreat.xyz" "jellyseer.ashisgreat.xyz" + "openclaw.ashisgreat.xyz" ]; policy = "two_factor"; } diff --git a/hosts/nixos/system/game-drive.nix b/hosts/nixos/system/game-drive.nix index 0124645..ec8e04d 100644 --- a/hosts/nixos/system/game-drive.nix +++ b/hosts/nixos/system/game-drive.nix @@ -21,7 +21,7 @@ device = "/games"; fsType = "none"; options = [ - "bind" + "rbind" "x-systemd.after=games.mount" ]; }; diff --git a/hosts/nixos/system/kernel.nix b/hosts/nixos/system/kernel.nix index 2bc69bd..fcba9fd 100644 --- a/hosts/nixos/system/kernel.nix +++ b/hosts/nixos/system/kernel.nix @@ -10,9 +10,9 @@ # inputs.nix-cachyos-kernel.overlays.default # ]; # Use CachyOS Kernel - boot.kernelPackages = - pkgs.linuxPackagesFor - inputs.nix-cachyos-kernel.packages.${pkgs.system}.linux-cachyos-bore-lto; + # boot.kernelPackages = + # pkgs.linuxPackagesFor + # inputs.nix-cachyos-kernel.packages.${pkgs.system}.linux-cachyos-bore-lto; # ============================================================================= # DEFAULT BOOT: Linux Desktop Mode (GPU for Host) @@ -44,5 +44,6 @@ "net.ipv4.tcp_congestion_control" = "bbr"; "net.core.default_qdisc" = "fq"; "vm.max_map_count" = 1048576; + "user.max_user_namespaces" = 10000; }; } diff --git a/hosts/nixos/system/networking.nix b/hosts/nixos/system/networking.nix index 2f40cc5..7535a54 100644 --- a/hosts/nixos/system/networking.nix +++ b/hosts/nixos/system/networking.nix @@ -96,11 +96,22 @@ "jellyseer.ashisgreat.xyz" "jellyseerr.ashisgreat.xyz" "search.ashisgreat.xyz" + "openclaw.ashisgreat.xyz" ]; interval = "10min"; usev6 = "disabled"; usev4 = "cmdv4"; - extraConfig = "cmdv4='${pkgs.curl}/bin/curl -s https://api.ipify.org'"; + extraConfig = '' + cmdv4='${pkgs.curl}/bin/curl -s https://api.ipify.org' + + # Update IPv4 and IPv6 for root domain + usev6=cmdv6 + cmdv6='${pkgs.curl}/bin/curl -s https://api64.ipify.org' + ashisgreat.xyz + + # Revert to IPv4 only for subdomains appended below + usev6=disabled + ''; }; # Make ddclient use a static user for UID-based routing @@ -125,6 +136,7 @@ # Ensures the host can reach these domains even if VPN routing prevents public IP loopback networking.hosts = { "127.0.0.1" = [ + "ashisgreat.xyz" "api.ashisgreat.xyz" "search.ashisgreat.xyz" "chat.ashisgreat.xyz" @@ -138,6 +150,7 @@ "jellyfin.ashisgreat.xyz" "jellyseer.ashisgreat.xyz" "jellyseerr.ashisgreat.xyz" + "openclaw.ashisgreat.xyz" ]; }; } diff --git a/hosts/nixos/system/nix-settings.nix b/hosts/nixos/system/nix-settings.nix index 24744a2..8be297d 100644 --- a/hosts/nixos/system/nix-settings.nix +++ b/hosts/nixos/system/nix-settings.nix @@ -6,6 +6,7 @@ }: { nixpkgs.overlays = [ + inputs.nix-openclaw.overlays.default (final: prev: { antigravity = prev.antigravity.overrideAttrs (oldAttrs: rec { version = "1.18.3"; @@ -46,7 +47,7 @@ "nix-command" "flakes" ]; - nix.settings.allowed-users = [ "ashie" ]; + nix.settings.allowed-users = [ "ashie" "kafka" ]; nix.settings.sandbox = true; # Automatic Garbage Collection diff --git a/hosts/nixos/system/packages.nix b/hosts/nixos/system/packages.nix index b1a9b05..fb7392f 100644 --- a/hosts/nixos/system/packages.nix +++ b/hosts/nixos/system/packages.nix @@ -98,7 +98,7 @@ stress-ng kdePackages.kleopatra kdePackages.ark - + qdirstat dysk zstd podman diff --git a/hosts/nixos/system/secrets.nix b/hosts/nixos/system/secrets.nix index 1b4b835..1069b60 100644 --- a/hosts/nixos/system/secrets.nix +++ b/hosts/nixos/system/secrets.nix @@ -75,7 +75,8 @@ # Unified API Key sops.secrets.master_api_key = { - owner = "ashie"; + group = "media"; + mode = "0440"; }; sops.templates."api_key.env" = { @@ -92,6 +93,26 @@ owner = "ashie"; }; + sops.secrets.github_token = { + group = "media"; + mode = "0440"; + }; + + sops.secrets.searxng_brave_api_key = { + group = "media"; + mode = "0440"; + }; + + sops.secrets.discord_bot_token = { + group = "media"; + mode = "0440"; + }; + + sops.secrets.glm_api_key = { + group = "media"; + mode = "0440"; + }; + sops.secrets.hashed_password = { neededForUsers = true; }; diff --git a/hosts/nixos/system/services.nix b/hosts/nixos/system/services.nix index 4656aec..1422686 100644 --- a/hosts/nixos/system/services.nix +++ b/hosts/nixos/system/services.nix @@ -14,6 +14,11 @@ let proxy_pass_request_body off; proxy_set_header Content-Length ""; proxy_set_header X-Original-URI $request_uri; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $http_host; + proxy_set_header X-Original-Method $request_method; ''; }; @@ -23,8 +28,12 @@ let auth_request_set $target_url $scheme://$http_host$request_uri; auth_request_set $user $upstream_http_remote_user; auth_request_set $groups $upstream_http_remote_groups; + auth_request_set $name $upstream_http_remote_name; + auth_request_set $email $upstream_http_remote_email; proxy_set_header Remote-User $user; proxy_set_header Remote-Groups $groups; + proxy_set_header Remote-Name $name; + proxy_set_header Remote-Email $email; error_page 401 =302 https://auth.ashisgreat.xyz/?rd=$target_url; ''; in @@ -101,6 +110,22 @@ in myModules.nginx.enable = true; services.nginx.virtualHosts = { + "ashisgreat.xyz" = { + useACMEHost = "ashisgreat.xyz"; + forceSSL = true; + root = pkgs.stdenv.mkDerivation { + name = "ashisgreat-website"; + src = ./website; + installPhase = '' + mkdir -p $out + cp -r * $out/ + ''; + }; + locations."/" = { + tryFiles = "$uri $uri/ =404"; + }; + }; + "_" = { default = true; useACMEHost = "ashisgreat.xyz"; @@ -295,6 +320,28 @@ in ''; }; }; + + "openclaw.ashisgreat.xyz" = { + useACMEHost = "ashisgreat.xyz"; + forceSSL = true; + extraConfig = autheliaProtect; + locations."/authelia" = autheliaLocation; + locations."/" = { + proxyPass = "http://127.0.0.1:18789"; + proxyWebsockets = true; + extraConfig = '' + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + proxy_buffering off; + ''; + }; + }; }; # Hardening for Chrony diff --git a/hosts/nixos/system/users.nix b/hosts/nixos/system/users.nix index 24aa903..788fe5e 100644 --- a/hosts/nixos/system/users.nix +++ b/hosts/nixos/system/users.nix @@ -51,6 +51,9 @@ ]; }; + + users.groups.media = { }; + # Disable root password login users.users.root = { hashedPassword = "!"; diff --git a/hosts/nixos/system/website/index.html b/hosts/nixos/system/website/index.html new file mode 100644 index 0000000..e1aaafe --- /dev/null +++ b/hosts/nixos/system/website/index.html @@ -0,0 +1,191 @@ + + + + + + Ash (Phil) B. | Python Developer & Data Engineer + + + +
    +
    + Ash B. +
    +

    Ash (Phil) B. | Python Developer & Data Engineer

    +

    I build custom Python scripts that replace hours of manual data entry.

    +
    +
    + +
    +
    +
    +

    Web Scraping & Data Extraction

    +
    +
    +

    Workflow & Excel Automation

    +
    +
    +

    Discord / Telegram Chatbots

    +
    +
    +
    + +
    + Hire me on Fiverr + View my GitHub + Contact via Email +
    +
    + + diff --git a/hosts/nixos/system/website/profile.png b/hosts/nixos/system/website/profile.png new file mode 100644 index 0000000000000000000000000000000000000000..9ef85614fea08635856b850d0657aed648347192 GIT binary patch literal 124401 zcmeAS@N?(olHy`uVBq!ia0y~yU}R%pV07SMV_;y2Gr8o;z`&r8>=ES4z)+>ez|hdb z!0?NKfuZ3A14F3+1H-EX1_rAc3=HB0b9M#VFfcH%C3(BMF#HF>1$&oIW?*1oFY)ws zWq-xY%xi6S_1wA+1_lPz64!{5l*E!$tK_28#FA77BLgEdT?1oX1EUZ_V=H4rD^p8t z0|P4qgNtk-s2XzfQ!>*kacfu*{l+oZUI7%F~|~AODj_oh$V+7 zZ|7xTU=T=7^ecnoBrBItlJcl8ou&WxK{j+b5FS=w|Fm92~x>W zV_ZTJ4(^6CeltW9gb)qNKZ`*HNWzRt%NH#?8k zvrMQHOwe`m_`mi*6hpIsQ1;s0NA9b)JouIV;mDWWA{=e?LQV;5SrrYgDgE7=C(-nw z!d|F;y7cT`fANpyg73rs-8|NRF=?$U*UR;1*7GN`tVyg+TqCN$bHgCcUQE&RvUr2% z`H$I}YtAmq-kkl{VtZKDj=HkfmH(vwZ{4c2uJdS%aYjKwn zV9Ivj>J&8F=c07?7wfJM%3?RAFa2gzeso30tWWsiF`4w_%ce)3bLK5t@>;%I^pLH! z-7B@K;uNKv8@~-&4fySav)Mm;R=;4^WD?~0e*EIpBT~ZGi*_t`es$=VYsEYD54RJR zSv;HE_s)PL*|09d$fm5DU6(26M!5Mt2Xm#}ZVcC?zE{t9w>VwhJZNck`<})Le_f7V zGvlgePUSv-qin;mBfP%)=k7O1==I&GN=wL7-?Az7#1i*C(OfOO=cTzeYux!$t2CMA z+N~dV-j*NV`LmLf#cfHd-;wRL=f8d8VH4KhUidg~SNV>#qykT+77f0lnMyXSi68Dv z+N*6haiPdIj@RqNA3UG=zH6_Y(d@S~{ug;{p4sum>Do!-(`K3RiyI7%{0N`8q~~sw z{=|!`mtXskzWsfjW`WQ1Df8q{`!b~|u)X~@fz3(Xuz1_~X3jfD^b=*wFL!_a-+8+t zcjlj8kq=*LTnvfG-ovotpPYHx_NUVh8U5KU;b8>FTk~Ic%RJM6oYirJ?RuwK?36k=5B=SxogWTq=5~oDy6PV4Vmzzj`gp!3&kdC$ zt?~A+J=Ma`qW+I!GH4(tag4lea+g0Lnl3A9TlSN@27k_ z8ojoozF+NCLwasV@6MMQpSM?EF8OhDo51J!sd_uxTxJWd>19bVPMpN^UPl`{ z%g!qzDp7kBJlqUrQc}1d#?RQzt~B|MqtEhsqnA~8GxnTJ?U*cnyIxwT{)*Pj)SbT9 zuYXNC*K$+X{xt8IV>M@s&d!^iJ@2{S+hfa@ef8V_RQRLQ8R4f5{&P+4UV3*s`K*~r zw1!}7!H>Ef3z9w@*-+wX5&t{-$Gux~Lbq+xi{_cQfk#l~7ccizw@G1{FIt}XB;@aq zJHS1k@iA-bq?wEo{i#b{uQ?kyyGJ``-}5}}o)ayT_L^;(t$E21wkOe$yHjS{N#OaC;_QB}FzE%_qGt={xxM+Ane^Lkdzo4F@}nxcdV9(~O=~kf_Pf8%x20!`Li2~C zZrsM1cAiO-O^*Kf-cac>i|hVrMdk`dC6|52&1<*SCjXqX|8_;|hRoQt@$B2((h6#g z*n|Rkr?z+$f3JR5H@)u8$y*(_TNOS}v#ZT&d7k>_vCqjK_qJ0?r=(`DoxNZGPrt|V z+v~+ReC~*w>w8W#Fq`eGr?s^4+{u=OzYlV)G4Q)AVV#mNapI1Ez?nDCnDg`dOZXfuimxLui*TL_vdQY6s)cNC;Vv2p{O6vPd#riIk~@>TYqDOw()cqm#1}i<>e)2 zJ99su6~_13OUTy8jc1|?vk?2hR-CLPo$fgtlYlR`_752Wgot0 z7#=U>E9Q6My?E*DO{E_AIA{tC$e8nyr?a z)Mz$*ls;L)zF3+$vZG}Rd-m01`7TNeE$)1gEwd16Jlk+KM)Jw^lW+DN$ttw5v~{gI zA6e9Gs66?`L*u^@ck8;h+Q`J+^Sm8m}N!|Ngjht%1bnt^K{ucl++SR-MUF zXb(+U_~{PsIUQq7<21>J`j_@Q_bMEn7A%$-v_z&cW9g6AIc_S~*mCaGPxTa%eqj?h zm!qMejgd$8@WKz<1XI3kK6O@f_F4Co?c8kLQqQFw`MWpF`!@N%$ngLdrtSxcpFCTq zNM4L!J2h{i;A9Tl+}t~VBqp8lQJLr%dGC|JJrVJ+1#53s#lNfX($$>tU#I<&{;a?v z4Od2v9Vf(?Sq=$E>blrho?y7RXsT5Vd6+D|QEt&Y@ z<&t=r0E;uTJ(`p<*a~|M))}ri`%c_jlR$4r7Q|6(c9?5Y|zXr8pzUR z@!{Y%E^!8)YNL*t6z%C#vZFeVTrt}1_^YNP(Jpq5kIBzv1dqzAh!y(Vz1 z7i9jte8NZ5RkA-8-L}75a`@Y>Wm^S1->qL;^W#)Z^|BogZ~m(^+EH}S*ZYgw9#+i_ z8vdJ%-prof)e|=v43v%#|M-H^gP4kmX zybtoX$=ocy9OeDNZQBWx>|+v^4@CahX|g=}rB{_WfkW}d;~6OvdFu>17icmqWHI@A z%k(GHt&+XlBU?VWr88{#wB^|buS0zM`J?xUp5t0@N8s$#kF`qI+vf zIbWv(amjaP-)UGF=T$APGvlDi=g{ruf~jBP_FkRV`k~2z|8z!MwYX@TtWgq-I5T;1g%+2#fK391&vPo=#lpT`SB>%$i#~C(;6Y`V zmssILV_}_^8#!u;&Up^+_|%%j@AZERfBvlR?3VDd@O6Q%(_}>Fxi71|^mQixG{wg$ ziJLTdmzF4A>Ct+m-SmFOLv7DMwjL*;MO>Uyzt`?^MKrzMZR59tzk*kG{6yZF?e6$|~uEQ?j936*J!dfdo)&vX6K0>&|bqdXGwKdOqkp5u91vuAm#3xwHJVV~4Su_olu4Kc;`x z*U8(I<+RT6OYw;rO6I|jl)8H^d`|W5o^)o0jip*m`X|w|92qlK+x6T}YfAW#H{U8Z z=wXP_);%kyEe~hcQ4N^uyX1h_!6U9`Idf-wUpm3Q?9~C+ZkIWpeI~z5?pw4ytodAW zPsL?(`j1y3+AbU-%Rc@NEtpxzl*n}I?XxtcL-TyTro6~+3^((B$oF_dB-_&oDoTa! zlSJa&qtXjo`X^?VWK`zGtOWDo7@zv^OBZ@9)=>99(K3r#jzaKfoFa-P?R;7ym_ZP>BS z?8uMuE*+0q*Oab3`}xsJ`0d0Ud`2#5E;E*$`DXuN!ui*ePqyBQns`Dau$${cXhYnN z6pPS1W)C;6T(iYmxIvNM@yD0XF`AJe|Ut&g5^5AnKjsMMf^Bf6>oc_tJtYuEyk>A;cSD3n547?9UfI_r(Ms= zu4$g|JAbjKv51tCm*4KM=jL=?E`K;z(_i^bH}7imgt*x!cd8f!e@)dZW|ex(lAh=6 z_Uy|v0lQ8ufnGtsfM2ftl>!sFbBa_sniM{jE1AuX44HXz=8W(Ke0BW|*O{5spsUk=I0bT2HO zc*K9n%?-{w4PPv+f4@!)zWSZ9RBHuI4Qo20B9Ez_*HG8>?s8jl zt5fB7ak1uS#nfXZWhYX8-g}-l^Ml%kDT!$Z-<;lZd78j2zTZ#P)_d!4woK0cvT&*3 z-<=AvQZ z^Mqr5@J&i(x%jF3WOCyZW480Ln|r4J$%^ogJ@|;{xA>y;CC{J#PTiz&)!`nufYvpy zi0nn7DTPG}E+I^p+g!?Cwoc?b6}YU{`5vnHuqczjj=N*!G8cV6Jo&ogQnx3|bgBpU{$IL!Vo`tjXl-nFlcuAkyInQW^aS?GBC*E?s+ z&J$;BPq4Of?!W1A_m;#K)?D7!0?v>imKsl&C^I+Z6i1&ApM*Ep?U(uTU}k*E%!!Iu ztqmScd&ZyFdiI;9$}Z0R$1b(4x?mzbdHJI1qq=L0C#?JZGMZ=7-_i{8U*%Db1{F(v znxulVd=AAM>6w^aa`uVsYuL8?Sj(LS2j%$g+oxQ+vq?eg?T$FJa=yG%iYK4XiENCM zY+Wb+&?vj`>eR|5itNu9?c>>T=)jWGCLU8>nK7m^o9$5(Uc}bZq+^oX`FTf~`=|Sh z7ZlCO=w&|7^27D~Tlr0k<`@({T>3xko#UVQ4O|TY-idn{&OXy&`(D{_P3`inNXxD% zOJ*_1yPK#j=2Ab=!&9xe=zV(goXsce{al1<>SyY(uXeOP#A~J5}xYR7rb&6 zElyrufo{1^pCoC0xwx(W(5+h!ejT~`sZ>tst0iY%g4>myg|cQUYrEd-i0<)m*xEYZ!DxY|;O3Zi&+2Fu(=Q@>MJGLJKY8ZEfn>!j;f&LNk6ug>xT1O3?5y!$ z=^v-{!xpeQaa_A+ac;@sPhZcNow>p2d+f-v1rORcUM`WH`TODV*dr?{bi7VE2i;zJ z?cnoImrl0tnbdD8!c}s=dQHGX{u%`RCqq+aZ7J7TguwJp6BTAO^!k8^=F0t zlqIb&QFC|upm|e5>C<-U?S~|fx9kAHTvtoXpvFX65ISc2`Ou41^tg`z70 zC%2bvHa)4t$?9^m>&A@scdXMqeHK2t+S$P(md$f3>Fk0UJ zVcwGyNA@i@+d0py`uI&H*e$Bbb;Lz6^5he4#+kfBX3D^7i zZYG1|mR>171*0zC`rhq#1t#!5=6o`LtBj{ziip<9aPNtYEN61tTa&o;B*knPjW=qS z8n73+$gTI#H76*|UGXXNzFy&3 z&hqR@4qcs2K^MMC&$FpI!C(Kuw(iqo`3+I)e!h6jKT}`KrtZ&--{0dGt;#;N=~40g z`tIv-)y>U^o!u52mcQTcVk;HAiYvEjNyrqhqc#GnBFCiGOgVX__rlKJ;!pdl>TS-) zP31egVd3|M2d8$mPvwrC=vp#sjswRdi|v0pWN-fI4?J=IK@3mepM#6ry8OCkT;J>*PQPuLX<^HK`J+_6Y~VS0x^mk=g_ozL%wCJ$|99E`A^*SU`JdeP|M$1F ztZXxEyIOU2S@uMyATieJ-PUWSX&-wm=o%Q*>vpI9rD|O5-_IvjEzt1JlfVD;=x_bP zlA7+D_v|L06k)mYwZmy@-TatjvFj5;gEU*eH61Xl6?k$lNmyZXS*FsB*OI+18+<%^ zE_wtu6l|TY#c|>JTW5u;{Hsq&7rGq@J^iHd!7R)7cQYTpG*a!o{o>Qai$y;y_r8Ai zQ8h_azkPS})_v|sN0IsKsB6Amgp?Rmd+ z+5=;|o$)j4=jw0S^YHz{?>?`(pZw zmD^X!T4A=z=IvkWCH%4uY-TS$@{$Tze|N7bP{Bj?b-~T0cw(4+&(bJ{j@lUs2kAHsl{N9t*_P^xj z@A=LcbRcbW(%#IBYTwIc8IKqF?|ms4w5Y{Nt5wT8@BY5ibF0fM9=3|Fd?mQs+B#yT zK#=0ng!26P=JzTl-!6Y27-D+)B#WwQXryaFaGKz3gW#7(n~R?Xn`rJ(Jl8vUBYTrE zL$RJ`iABPO1v`v{P9`k$x!ExzLA2}^$MZWZpA2tac8FHu+R4N9-djY$t@qG@0E1rWN!A}q+=<5(Idz-!YXg^rmpiVX5?;bWc1#k zp`sQcZ0XG{`S-QJxuVyF%n4s?B9Xwq3sNOw!)8^8Eho`@f{xegC;VVtu$x^{^G{$B zJ1v@f-7r2sVy(4V?&BFsYf4{;yjwdhF8h_!#{I^L=~hqg&9x2*bzNT_w%YXQie*y$ zGvB`X_)C1>f$a5rPaeFesK57*RQdZmsb(_`*SVid5@1R`kRmqg<4L|#D)a46{uMbt z-EpBL$4%~oy+U%?8NTF0exBJgQ>W|Hp{^Znjcutv z-pvy55{q9|f5KvFN~wApM{>!Qd6(maf|%Rx9a2BEwakFc+{V6pa<{g1N`>G|>r_>? zb7vT5#uVf@>pWa~-84%spm6euEl%I=I5y8x(PH!TxLx~kQs}eK8Z375N-+;r*Rdq} zX54*ben~LJKv4CafMh0nwV=3R&Ve%Rmc(N59iDnQ-Mqraj}QHtdE<@q@oU`IW?z>3 zzfCMxCv0cB$=O-`c0Xrye=fHBb+Z4*-1-mFHDCU*+f;m+5q5a}U+Mkl#P@w*-S_|8 z{7>)t>(2bVsd@S1j9pS2qt?${AHHVRG~dgW^^q68&k~qD{g6_NlW5m29nGnWG(?xZ zH$1kWK;iA$#m;g2>gTVT!V$Wtcj;SeGvC8WJD03;zq6~n|9tJk(|dmY++OkfbbRvv z4;@t@!J(#0gERsKgmyM{Ypyx+L~`NG)skf%d4?V*VkaD2{=FxC(as4I`+O6hED&Im zXe}?FboAw#t|d=5Py23`$fx+*pu)}Yl+aD(r~fVPc->i%aw*!livOoxT#-vR*ZU3L z50h8lJ~HEI)|+h~K6HKl@Kh&@(fviuL|1+rHTax*iRfcwo`p{f^1(PMdD)IX`pm zvQbyupTeDR>fQd6y+zWhdqst=-DT`J7R?mVY-~pszU1tmH`n;??We2b|7z*)Dd?B4`z|}rw)#xk%?;bFof*=n7hm)B zzg+$?K&`njF(@vwZ~2Q)x{Yv|1s+C{b%X+*l_)xk5=}dx8@hT2bDO6mp^uF zTC<09y}+sVm9}zQY9mffSXq-XS-@7oFw4#R;=C>A?=N0)s-+;z<;1EjKNUMWJzXsp z@wa>PmTo!T-gNu<{_dX=&YMnLIc|Dtr=G>8^tkD@mft4&e_^v>?XD=RdwJlI2G6$X zD#x9Lz8@1_{fNWm%ldY;prmOFHWmj6O5_ww;cNbNMZs{5|81XVE?4gC{PL9{_`}2E z8wWca6xQ9d|FPL{j^%@!vx8RU2{ARzPkTJcGx?ECi~EDQPX!7pq`B8sC10pKxps?9 z-Jc2ff4;q+a=GkJcKy%m8Z8g__x+sx=h*#!@)f^+7#=$?d9!g#h>Yx;;OnNb*Nf|Z z_1xVnId#fW>Xby4Uu_s zZjW?gME*1l#htaUJLbNev1oaKM4q&t{2D{1TBC=n}5|X}w z%RZgg*5z~NhX{q9a1>p!AwYz0*;FsXRbIzJPp(*}(XwC_cSvC1bR%*M~V=S7##bdvw3=sA0aNb0gBhZ4`ZFeU^>`gMI-utZeP zIgHD2gT>bUdMz7T`7QYix!4vwZJ6d9a!3BEfrrtJqU^~|{CQ5Bq}rO)B6wb|zZP}m z<d&=|b`V6LUniQDJGtjdbdIZTYndM>=%a{e3^AGgg0Pi`+4x%B3h z|NjamBgM}FDQa=s3e4}ADa=dww{h!(!&i@FZ@cp4=#M9>9gRcgBpg`oD4jiLW~OQP z>f(Eq&u{;^{{QNK*~{PF_@(n*6rXf@bNZhr?)HmTWf_RA6glndoXwNFJW}UbNa)eO zyURCR`*5(C{fpa$%*R{0#5s0d-X}c4L38?*l%9n;bB`|Ax=>5>x3%%H#e&DaB2ocj|wd##Mj*yywHA?muU)|7X(Q`^D&SQOnkIUpLnICNYUb zcG}39pPKRG7u)lHYkFr{*GyMTKB>FW^WEv5$4#xWuRV`^_}IDj&u1656gD5tU5l+(CESTo0ru8jujX2NFvvQXTQyVgk`W5Z}C|_@Tw{OC1 z`NvC|tG*^!Jr7cgUu)7Ltvlh#HTUF<-{0SD ziqNh6@}(tAx@vLq&TSXl)?Hq4=xuM%DbZlb=AcO*Gg`J7tmOJuo)(gNaMjHV-(+K# zXPWWuy{0#1Ws7*tIoC_arn_>7A6wnvr1@%>ljn`QHy>VmXjg3=+|&BGTYKHK>=uDF z*Rw+uBiCK$V7z>jWv%YxlT(@(EAzeIbK?5Hsrygp|9iCl)1_{GgO%AVT9@Jilp0xE zwtw?k!QWx4`zAp@`B%M<`hL9^$sfbSOucg-7|&AvTFfChamJM=nQE#&f*bjltFjnP znH0Ifi22FpI}+9s5|Js&#<{sdB5EQ&ReKC#MS}kPu{pQrXaYO`*^kW+UgR(q2pXyx z`g}=rxif>|#GM&EGiE;bEMqHH%UM_IvKjc3&m;dYe zJbC$<^cn8m^zpUK8 zscc)wZ)#w4?0N9jysks8yyiD9p6EHxJU4&IG>41x{~6y_9bK`i;?EDk&sV!n=Cp6W z_mAuH%@+B+pVMEgd;aCi8BW&4nq5q}y356jcddK=;zh^ydo|7M^KBk9_uC)yI{GxJ zF@$TSOxcATtB}YAPW_yUFMrQFS#jjwxhaK9C8mnjUcXc}>-5u0S3^8nMVfZ4GK{+X z`d*~gJzLJSppx$`4nIHJHk)1E`%SDX#b}-73}1^ovklj2_3?k-==AB|@%aj&C$laq zEM1@#GvmvT7Zc{*wS9GR%Ic?Gr@zkH{XPEC{a@SvY3=`WdjFw&Ir_Wy8eLd1KYoi8 z^ZRPQiAvV>##$$Qn&TGVnVrBiIN%Ms7;lf=< zn#*|8)9;`8cgOjD!h!`1^6N|`K#*R&}J91-JY-TuT_%;ebe zxx3D7SE`aT^PYY7jN0}8jQW*(Rko`L1hMQ^ln?**NBWqPo56MSDh^M(_p=)RPOHsd zbMD#ePrB#M`~UpdUw`8MZ|nN*^7>D5_TPK+KluMYY5w!cL*^|T_k8*_`;Yqn*Z*}l z-;J$%F8`O=?#ILL6+b=*=H3pve$IcsZ+S&o-LYkFZ_f1l`D*&UBSjmZ+~v1R*?F^| zsbI+5PM^)>euK&CH&nNxATE8dH zy)nn!aBI&_X2;`4|BBChnseZ=5R<`@+4KK>&TLZIuJ_Q&*V6xv+i69~Kli>)aM@t* z$98|ELHZNTL zy1Fq%>KI$eiPptSw$6O{_C43*Z70unpY)h%El}P0>{)_B)9h_;gME&i7vgeeI(1Rr zyi9mmm&144V`XceiT`Q-fByfG`~R!=I|feu)BgWs{gL|5=Ktsad7%D&Q)cwPtMR`} z{~i1P$o|onCoT5Bp4T6Exww7Jb?prXv;891n%~*`UCI96$?6Ek%_m#7->>3MG~t)G zS&(bK#!PxjkcOmFO~Tq`a#O#=zCYlSEqPV+@~%Z2+PpaR#EZjxk0)JCSeg*KBVsfi!XUy?g9gk~& zw66cpbN|=D{>n1D`2WAcf1ca_<9W~O zuJ~WA@o6!=iwjN&FAmc03UGh?wp>w|@hQ)2!x#Vk=ikxV`z%>#>Kc8U@-05k{8CD` z$G(&3Ubg8(Q?r2)k3sVPJr``F+zv9I*rbtKQ+mdmL%h0L;g?oQ{q#J+y_Fe90@V30 za7>(G&Qy4D{m1uHP8JleYw7*aCd~El-I3kLo@=}cFtil-e^Z00zDj^+;xEq}@siqK z>Cw#{{yVcOQh$U$u8Ga9(wTPjs%8E6`akb~y#If{e)4bq{io_b*8kN1xwigK|Ic&f z`_5n8^e}zj$KpSC&j06{Z&Pz>{-2NXpFcEz-(h9FG}c^3UM^rolXzUs#B}xLUk+4+ zeBK!zzc`51-`~$5;#zFG;IvIThGJ@yIb)YgUNt?$r8Zgfnv~Yk8?$>XZ_G86>))|s z*Q271X&dtbS|5E#kY6o(_}jG&FRelX6{Z#`q};w}I&0h2lDP*n?suN@>Y4h*c1!QV z_m>>^M@i3Gmb^7Da;>?}HEFZCX&c{J#;>v1zbj?ujz`k*Ro!!U9m#6G)@EHE|KP`u z86Q)+CUo69@c!Ss_aArf|9ktwx}W#<|53L4^@G{0_OV3JjGXT>*`AVqKPCxs`1#Dx zT)SY6U9ZuR^b3a!Vz2){JNx5F^S+heciuKSaN^VZ&95%D?B8j4oa@b#iXWDFE8qM% zcu+=wZ@qR~U{lKv^&I0rcjud^I{n^uW{)7_9G^22yz(!9U#F$3TQwzPpZS6bGdWI3 zJ>O;6sbb(_A$NY!wk**#$F-Bb&y_aQ*`nm_yQfYnxbXJOP3CuAJj-q_6}}e4vEKLh zj=I-ZMeqM<-+%D_&*=ZmzuU`y-v2NEulV1+`+u$fY`*`$Hf*)1{=P3<|DWyuZT@3v z{2$eSxBp+SKl+&8-a+zkk)b=s!5wlNW7fRfJ@4}8VuPl`dzpXjTmCj$>@;il)uv_d zCu}+p<+zZ`Y_{*5`uo{S-e@j))I0rMa;f*`Ov~Lnj&Ph@_IBm#u0=XC;$s4*ihA_> zYPeo5d2vs$++&62DJ8S%g%^3HMH@faHC#N`I&t6GJr^%*<#qDjb?L%-^Nhs@v$zyz z`lkPRGkyPw>iISgUp^J>{wbsBpxHTfQdsnRBqX@$jb7hk}B?Ci9=^ z@>vn}`uB(2#+HMBPCuRTe?~^=4%Xi})(I=F=ifS$n{*;!=9len+cq9tE6Di2V828U z|9{a0o?Y*MUbg?I{O_XukKa=kYyQ9a|L6V(*7yJN)&H*l^FBgnorM4LKg<8$tUtFZ z^T+ zzHVx0;55^-%Tm+Jr>CEv7dXYwVa1{aH@DP0JsrOwtn2EswU$wGDfQW_Sb}k>$pM!7cA-U%}sfDXolj?)jBb& zibLOQj#+>4*4^DvxdIVhp+=Q|TAG`k-`%rI*%?<@ROWR1Yee$ORb4-`&OX0i)qPuk zpU+B`_y2#i|M{2yH<{tztNq{Qjb^_Im|kjhc5!5VuWFl0(qg&4K3$KD*L68OF@5A; zGJngTvqv=9&P%&_B|UMBNUuyuJdo13Ga zJ`X4GR7vmP{&&CNP5Cqll{K!B`cHji&Kl?|_?!F0?|RzVQGbD9{){v;BU&+rGawPJgB9mfXW1FB-o7%GR8^Iqved>@qdw zcX#*s-Y@6Kjy)0Jv8C~4M$@(p`}g}_-x|TQto-ryz0aQS{}_5qXwAiv*yAPJ4p&`P zTACWvC*Z``^!Tvzym|9B12Q`Exf# zoXgzJr=74luCT7~pX#J(F0N@PmY=D{^Carw zrG|6s>enUu&g|p(c6e*dtTSw#ca%QKGx_q*m#$E}n8`8yR^xP~O-Tn7+MIqE+Z$-9 zm`BcceEGw)dcViCDk+yA;g3#NdQR;>A2}tFZIdjA zze3=YJO36cDn0thG_zIBK3YRSTsQvD+ub@Yy%leTb(?cv>M13%G?;#o3AmRUwSL`? zz4`x??f$%A=F7kT=HL51@-J@7?ztFo`EibgZ06Hh0TNrp_xM?}bX-t*o2op+H6-A$f5Bv3#pz0S z#GR(B~B=0A=4Nz0as3tbGA;0fRHMC1SG2lb6%$@S;HtUL7oXssZZ>m!Y# z<>?&tG3!~S9|`}o+VzivadyG=Qy*@1u=1RhNepHz@!4}~X)+%N>)Cm>?>8@E-#Jy` zlYEkea?FE2Ox>RExs&Y9ADZG>(KR7DKlWbJr&{6P`<_PE|7rj8(f)sW&oSeBHII4M ztrPq6_0_KE-|QuGy<6k-uIcRw*V5D1U%6`5 z$BHwTSF68y>l0xvt<$zFQ__E##De!`>yj@Q^#-wCi`e&V>G{vkPV0YoFqwUYS7F)4 zB$Jtib!EraK31M~T6Fqn%k}#{8FgRn`fgw6vc7uNsztA>^aWTp-<;9>*LI2Fma}T# zv?W4CgLdh7G%tN^WtQ7*X1muoa}JFJ24c zsNQ_0zo*Ff?~+-H(z5>^W@eb%8%M6ZcZzrJf=_d#*Kb+BUD)Gnb&*qlS^EvS{71(t z?l>-c+~hFPBYyAeUP;^=s|UynfzX zI=S~3uYGv;`@OGvQy*S6k9%5P_uG7@mG#n_IR_&0WMw{ld8j_erp{w?r13iKo|h|6 zcdc4AQ-AuF+~X&Ivd-T3_}W21b#?!nGy87ZTRb>!Upf6`%Au642N}Ab&RV2lX=&-s z;d#4s&!0oF_x}BnwyFBUnHrkVvvi%d-}!Sl?%rIODP?tc|*G=~Pzv#ScpSzap zee28e**E6CHJE+HV>RR16q{q;X8Dy&DRsSEl5-wJE9I#NVYT0?E1}}|4!3Ww0$vJ-=7daI=$U`uW!r>RXZXsv zIOC2!Sa37v)Xw_);G_jNnu3*IX)3i$d@At3Xm#@HmI-G>T0A2}^Oy1d+PmDtWslkU zjr+dc^h!U)aA-ru%tEsR)^}z-$@Bac{BK`?av}4^C0se?^_oky-Lypfx z{P_2ZUr!`=z5V&(uKea5B@M~<%f8eezj;|*=b5;~<<0xIw@;e1Yu%2Rn2W#4vR7Ya zTWjij`+})%{+@4Iv6mBD7rd^X(DbwDaY7G$97|`@6YS?FP~dferi$o zKUeX)d;as6Cpka=oOH9KDWK`=uEdQIpAK>V-t+q+vsr9A>#udiJxaRm?$t7H-YRWL zGm~t7H=}2HM0RBEwK;L;B6Y$W95tU7S@dZ06+ciG@p5{&h`Tg0K*V*G-&Q@zGg7CQ zy^Y9^N;voOsA_p1f92PuziXbZyqDyfhV%9 zQvHR8b)y)&f4}&WBG&xgDm8yAt&c%Xr-b_ib=p7pJl19LjEjG=e(JlMu3xerS*+{V z+d9qPBmL9w;x`TpbD|_gH|!+plfR%uN; zt$J+7ivzndBXy?dM1{Yts4MlnyyeQ$NBVys#XorUXG*#Kj~V)P4|S(?tDe5fwUq1K z{vS&B|9|waD5^U4_ObK4Idcl@DqSs1uSIEa9ju56)^uIV#mC2Yq4xN@ivDfyE5H2U z3}3BkD-?PBNPcLt`>I7^$AmzNg+OFou zjPBLman&zf_x(Dm|6!~C-lOGpf8?Hb^STBm_b$w|e)gI5TE>yaq>m4e-`Q7t#{OUL ze&64(dFvmh{})}NVKaBej9t7Zubks~A$_E&=UVnNf4+4mH#bi{s^an7OXZdn)8vU4 zIJu2Jlx^3UbK|q(1a&>}6O%HmPR+e@di%*RKiSJ`j!SI&`I#-oJ~R9OqZfHO=1v<| zMjZ9O{Nulh{)zu8E@m4nl=pKi{OQJ^z@)QVlY zw3J!vc|-9F#u$*WJ3=2!mi zu6cX*`j2n@_nu#TsT%&7^;(qLV#CLUXP+iD3bFm&k-jnRV!5pP^7B8Y#{V@&FER0Y1P;Nt@8EOaEr=M zQ`-Cef9#z9+j5>=?XjB6LD$xOzU1C7xA9%H+GEc2>D(t;m7LdE%xt7u$kE;6cc+^vfpjZ?6zgOvAt~qJ?hFO_b-2y%8luDSzY?Z zP@ySVe~I;y)9DAfxNUWvxNfamti>%M?(?ne#+NqxU)Rca6u)lRe*YiWBlY*2&hb%U zL4w9C7aiw-ce5^ZuG_TZ-}bksnKe&d=rGE9{={*Klxq8H*6!<(FIGt@E*7EQZo-DeNr#T5<;*=Ned5gV4|mSI+R^rh?^vets~q1Op)YRt zJ$=+QS-n4SYSPs;7u<@={)sF$Ee$o6>Wz&mOrNPQzUG?rEZ@UR#6iSiEFRbcJT-8N?CgMuAzJTZ6c@&6PGXfq>vZk{=CeCF{sL^ zRCn27>iu-hT7ven_wX!v5#%|5yJHw)5M4c(LaoSF_;1I~#qL9t*y;XaUD{mOq-$ry9KQ z|DChAGU@gIzG7CTrsn7#g96328l`pi7nf~soxhc1+U^@!#p#D{PR+DCd3nRjsfIk$ z&)Uw4EaN_6cyH0Yr28`xr&@|K{5dvWZBhQT8XPh0iHCneP9 z>t^R^KCxD8Ij`l-mOd+P-@$utK0n=e`s$>sRcFurW1QP|F@x(+QDKqS?JW_H*UXKR zuDW|E`gGCOwu=%=xk~O|HqrIHeQ6t8GHYq9@oc}Bx7*gej?9l*x9-`S+IOY%=FPjf zWo^9NVQu|=Cr+3b{`~MTxbErm|Dw}Qvwr?6^!D_}dw*XjM$A2ZJ6 zL~S;f49+;qt$+9VgAWtr|36Wm6My#QnujMh7u)^6b@~cdS-SDOxpO}qntQt>_V}us z2JverxOQH-)ovYZRTZh#;-hZG`l#>a(|@Nb_O)!(2)(dn*5z*PlIuk~wx9o5b8!2= zH~v3A-Om5~Vh%uJ!U9q|=ZS%8}kKIe|wtfCw9M&!R|J?l_{69X4 z-z&@gv$TgxH=?o8G3onfo-2LIBF?IYDK~Y$-96WH+OYMiTl$#_zg>Z?}0CaQ_u>`Lcd-&1YZbo^+wk54Lek z&ji>~9y4y?ynWi|XV1f&v|IVvFW%}2Fiz=YTxc^{hbzXv=iU=Rb3L=V%sru#f15-< zixJ4nv^lB&?ReOtwP}~l=FFX6`2L*iuWgB&qb{xqTNCEJ=jXMA~M}UDwxK%NCz|VcOHGvlTXle@$$-)-HMSb^80wH+61) z2?#R{jV#!D^TU&ymYZ+(96#?DxjpuXo7H8(H)k(a9Qk1gh)ithu=5q^<`@fr2@)ohD2>g2@_q|#$ zdQJ4~37+$XUsgErZC!SM!3Asmt?u3@)}1)lpBY_++S(XarCvY&e8(>T+*qf}RhKv1 z%CWGveR^~Aa*4~vl2d!sw|c7{+cm3onX^au*Yq{kJo$TX23$2=zI-{~M)P+qnvF}> zaot+y=;4~JBOYGN!xXwB)2E-A?!7B+anAzt zb^Xa-KD$0E^Ln|F|Mdnl%@?|J=FBbLvHkGj_Wp{mOT~Zi|NpiBp#1*Nw)g(O5Wcm| zb@iq1lTD^v?TFr<|M9`(_Br$CHkWGNuK&6I&+I*A|3#7W?R{( zBfGch-j|Mftn+1_R^4A=nU9K2mmgoaZP?7i>W-S8y-*o>{B?_O+Mo6&l7 ze#%p=V=s2~eZTixaQ4+n{&qiSJWV>7WA*rMdA-l=tqq?yb}w46LQDMq_k7b^3%0ss zUk|t%aa~RKLQtq!$=d2;KaX0jK6~t; z6SHqfZJD)vt;!C?FN@#&vOD%YmbZ;LN`L*ckjI?z^`978pQi8sCHn3Aw~SlUd~a`x zSYP?$%M{<+m$&d^;8%>uvYVDUuO1pUY!=K0}H~pTd z9#*ms53G3mda2hGlfyMk*LPa@mb@scowc*1w&=Ey{vQ2|e;RwYn`xZ?v#XC~LZ6Ge zaMi{Q+MX%1ReWpQY%)(+>qKRzTXqyQO^XJb!7}ooCbxzvOlzlr2 zI%+O2__Vf1-47#*cw)Xw)vzh%zB`mD09$fp!C!VhR z_*Q9BU0L0!$LZ>8%y^l8{CTZ!9CV>%UC3>w?fG{f9(;WK%=GMi|GuvO^jH3Gi~l^E z#p|*InkIL1%h^`C1@5@ldrYF|8V7gx)l;0|Z_i))a9e-s7vH$HceBk_PFudhi-m7_ z-xv`52pTJzaUAk>#16vxTJC2Gj;RV+gqLaa`^A`g@lyK9{-hjPm*Q&3C9-3 zdIvT?uIbC-RE&Lj+@)PTHaz@ue&OsOj_MmNSC7f@D!u%l?K*A#r_LVz!w0u_dbZ2X zExvPAo>hJkm*U|!J6}%`yZX$Zd!9?$E#5_58yQ-+#CbeFt*x}-rBG>=nQ!x!w&neD z#f5dps_lO7P~4`}tS?JZi0TJ$v8R z^!v|F$5+ml|NA6XZhlm}~zx_}FF5{~zl=?SGW8YkI-zTGIF{tKcEHNrIE((8J4XdUUick1McUU1at#$?iz@gZ=-_WO^f9$~La#Y&lrEr1!a5 z#QpX8+|nJK9uEa>D!gEd5Wd^-T>n8UGYkk-Wg2;3Kw`u|?g>>f)doe}pwu5s^f#_nlPi=O`0>DjSo*CDQlyIq|xn`-Lh-;vt;>r(8l-tGtv zZHxUok}j9$+?p3B{VHf-OZETe<;&;9#Tl*gimQBT`tPLtpW=6ScAjPDw|iE!FJ<42 z3h|Q{kC&J^aUHDM%BHhkbbvbz6|x%dC7)&IT!r`#!@iGR-TwoTXmmAHN2U63rq6|I||92CE- z=W(%-msn%x=j$$;l`ei%s4x;SQu?i_`igTs!`m=+_1Th~W}K}Gp>0=1Tnv(Dua4Q= zZgSKAH;=E@eO*0gMJLy^FA_};IJ@mQzQ+9Lv9?YVGUaN0{kW4=>t?w#x6Tb?KZdN! zn9MA`*+~_)nhw0Wn{nXEwh!Bx~_bYDTwRYY0=v2$3MP`+ngC? zb@%eNwcT|ht@edpJC12^gmY%{vF`v(JFmAq{qtwaa{u`s9!%!{dGP!G)9&*7 zj^8}&u91B)w*8yxsW7klcZ(LimY(*RwN*>P|JatdZ5LCH?aJKw|B_dC>FGVMx-M-G)IN2oorTvU{Ls4H(>4XI`|l(l zo;`|phSm62hppN}?e{_O2{{`}1K*Vf!V_ce7&<1!{r&oyuV zM2Kw4mp$uoaK}1{P}9jTTh?9uvX_lzdmq2V-uT3|3s-o>uUVS8HSw;Af{L}ZaomlY zPyhY>z2-Xa{mSRN@9e6cZU0NW{>=Wr;s0{oR((lzR7^jn9Az$Y{plWq1)m+<=J_3c zP$hW%hOHJySHPX6m(MmbxgO#(iWIs(jVY_CqV8Df%?TFnEaw@z81h=OPENSHQ&)sl zY^r?fRF<0)F6VDqpLgw9X2Bu#q#u)u-h6Ww{vy%Ra#qaHH%EKU=B*PV@x3_f4UuEn)MM-}XQB>YwNT)%~^Y;nwhY=SauRk(+nyVR?9|;`F9v@2h%@dREO^ zmTPIf|4Bi;d}B(;)GfK~lP2xUwY0nQ_*0Uf?W)MN(?PB0>Dp^T`2>t7o!xcxi|(bU zSC@V=)m{(i%l6XTu*=yyy#GS>>8iU4Ys;2Toh^{KF{D*kXz3&$H&y@nc8gzDU4LD; zZ-ItL?rmk(DXSLbMlG3QlG`rO^s)rhoWCsTe6h?V_dVA#r3miHCuc04D>=XVson3* zlFQG}+wpJ0q6b;~9$efkeC~O;&vM~Ys~Db2{gHUfwY=)F(}8OeD(hTpm&ZnxE@Wv9 zDhXQLvLN5OtSrssZ5zM+pN{o)Z&&a6cS^hF!^7im-oM|peS7;h+to*#mVG|{in09t zoy7e24Ri0>-rASAGvY&Y`MrnP@xLYG_Wn0&6**G3&^$5nQJUASZC#UvPTjQJJc<2U zrAF|HcN}@u9PuqHjvmn89=Mb5vue;3_Z-9g7Kc{-MMc-WOqeo#S$-QGxUZ_y>SvsC zt?8`#kKj6{1L8BT&vsOLBy@d;vBbN7b=DlI%ijAi3FY6Kdgn~lK9!E`(%je5UwBIP zz4%ZD!lH^v%o;v_rcRx#l^+%?5sU=^rz(9tA5VXHo!I_HOEvGxT z1&B>mHqw;+r_fT~o3QUzgGi3lbg#94JA<7fPAy6a607;iJ^%Tem%?^`J}_TT2@{Q2 zSW#5fXg2HcU*?vpA(J`xmb07riZAxPCZVw)NHzBQ#UEKd*;CGM*;-QD?GSL)v^4hO zcUgY9nnU6Hewp4{_uTsaf5q;nLfNK|FCJ0viPY26v#_|4URUX9yXxnm+xf+Xg$H-P z|2N}(-FMlzx}T})9$TND_kADzM54$}cCFN>jN2QIE)rL~_Jhs+@Ps6*@FvEHnIdIn zLbpwm-D2b;zN}|ul`H6)+NZQKr1JvvlX1o}Voc`N%8lgpd=1V^ZF3 zS;xE2`vUhhIPU0RWcZzV?cnnKjsEL{>^=z;ak>be?f+SG&bGY)&}-+B7-rRM3cx0v&@mtEGJe6nR*?#o_B&JDHgM*>zgtut2O`E9-XOYPwj ztA&?uMboZ3pUZ3xoFs1d;)#>j)>+k=%T;r+Glyza@YogC)?M*b1D%`UFa7u`=o~RSowAZ}h z-K?7eG#J@>wX&|w=IuUv>S}{Xt9|0pi&@WapPj2e?aQ@IyRDhI)t4`~srbOT|3k6; z=?bf-fBEemJ^D1~YgX^4zwF=2%2zCT^61Z$xbin|-+w&ydi}>o+WMQbq|#5Go^!RW zq$HL(Kkzcck8=!rIc`0F@VD&C8RMD*jEj1t}Qm)TC!5_j$@`B!ecYR@!d9Wn3nKT)AYpWaBeyR(Oco-DCRvYWqo`}X61 zUQMblf4?bieXO(i+P&V13$M%cr02{s-SvJ#s%Na`siGrCpWe}wy=yGpoB4~6bzO(& zcc0_QVyk&)Kka&XM7Df6i-)Sg+ND$0Rd{-MFXeK{zsQ#3k$LQ?qQ=vP2<;`wW^aXB zxD+kz?mT6;|0C!cxM;$f>Dsr>ZOAhTUAm+E`HY)8(hTQc?$grKTbI$>{q4oQ_Qex* z%=P|8S4dqrwj*wqWL}DZL~i7o>sJ=fI(ed?uI%9Dx`o4;svL08DH;9Yhp zo?JntpQibp`f<|Dyq>$)qe){mC)ZzzPfPZ-WT&WKz0Gs@yt3Fo`LFZ;$^YN{U-%l2 z^oo=-bBormH@@T>Ww~*oeUq<7l7;YmE!`BGUwZA{N3Oj;-2Ti~&h?FdX8wdLhYjz1 zI5}zBwsIB5MK|vozd4jNG3e8qFOv8FyuF{YH|E3M_jToFF+OU- zYcBq~t7p!XtjXOup(#jI#4EAUi*tQy@9OLq)>A%}D8}8AJ^5*7iaGliFzn8rC-iHSdg`d4P4PUMLdfVccysK8-xP5c6&Xm>jU&OMwYI@pS zFx8U1zvsG@j#GBIR9NiwJzpMmM=+nSalRS7z3*l3>+YR#yPF%AZ=U%&L02>=qHJ04 zmWwt&o(QiI*z@t&bBXJv$0TQJzpfW`j-LCxHt28bhX)m_zMtgz#>lo^_8NbEe_?NS zmzB)2%}ZUjS3H|_Rpwh@gfYwSH)nh5go`_$|BZc8p67YZg0WkoEIC0#WlzXmueUth z5^Cy8&-_!{cI@Bt@2swNIfhd%Eo^TPXofk)FeFA16y7-+C6 z*8AJKY|9(>)6=aUCzvJYn-pDT=CRC=D{AyE5xyhoicRVLgo(NTWcP5P^ThrjoG1JzP*cQ=QUL0AW zMw%kZD_2ZeB4D7!^=+B*u4RrA&*LUp~C8BBfg} z+5f1{(z@C0NldYB+gY?(f}-2s+{?arvf=#AlBV)=-F|<6dAJ-fvgvsFL%pLWG3 zR;8H=KO@VpM`lHDdh(*a>ug%u?)B~-j;$9I&G)=#TX%;o;L(z!8=lCn+dq4@PRpH{ zmH(3X<=@T@{`HaN|HZki8jg`YZ$aym&p!RBs=xP#(BhzvZyq}T+E&=<+WLCJn%#X@ zi(DhcB<@}|>lJ3X7Al?e!)xYHHK%Nhu^WYayZp=wCZfu#IIV$MjQ5C&esV0|p$e0- z=P^5)W;HAf^mypJM)mBn#LYJiBzK>??8V8YYI)=C=Vj}PMdSAVR}!Bdt}|V`Dm&(U zr$R)jxO0x;k@Oz7sBpn;ucG|)^?v?%-2d~>?EFh*(q^-HQzJJ==*@Wh=EIAR$@9dSz_V9&c{%U=r>sx7}$tGF%Z z{*3mWxti6C6K`m&R&;XF*4}l(iEmBMpG?<)ch_boDw&_(_Geahjg8FJ39-o@h1M<) zk{7b9K6qE0@!~>Wd1b|mK_^>-z~EU1Zzws$z$$(m7=_?h3RlRr>OOdW`P6itl&J zEp4ol((C8j|9if_-)wHQwWefm*0E6END({D6S+~b;XbRn_FXrrJ^%8jWKxJiYf{Mc zb;4V;0yx9;+l(w7|G8oSmVlq#R__TWFh(^tC|X#@mqD*ioVU%9Esrh*$M z?tRSF(>t%ZWPy(NtTLy~c^X``I(|*n1!5zlc zbM1@WpEwac+g+K~e&_Wn%8Cw2=kGhYc{BI9=l(k__9tvDxi%+AXtnOzml@t?GfW=7 z`7$LdqD+S7%rHh}K2s4@S8cp?T zf2elASk1)M``DyDvD1$?St@+V{C4o0`kvQTm*#lobw1v9tf;K&*w34i;o{RdvVZ)T z+#h-V`5h~(G^@FrBJ(5Gnro=e>^a84{M&kW!_vsL5hc2O+LvxMGl=7K zQeES$b2I#o`M8OG{wXuzN@(wtuB!4=Ra=*dFhz=sTr1k}+^_D|Oy7eUdegO^tVqhQ z>i&FL*ln_8`t#>^tZbI8$vUU6x6&;++-FO~g5Q0I|JFY1W?d@u=FGAlcV&SKU)!!$ zxh`ZmUcK8Sw|T;(xhENqGG;7Zd0hBd=+UH&3pAEpNp)Rc{mi>j$Uuwx`tm^OS^JJ= zcsn2W*!8_5nrU}(yOwU%Uo}Xv?_}bj)p5vm6Z^~A2*MD)ZX9)_rY8o25(@rqebtRXa&EJ;W z+us%J*?%6?a=sm3A+4c2*Y)g~vt7nq%=H^DKU15xVXnBrtuwZ}#9{AR=Oz#x_VA_AUs;B1oHpj_7Gzw)O-*8GlEcnV#VU|R3-M2TA&zGm4N$c}0eO)AY z?%Z5^YboEG_ir!M;o?%woW*99dd;`_8hINnT#=C5hTHlr@mn~Ob zb5&$j!t)mswq+Ye1&6A-MlLG*elzFVl%s zqr2zC#ci^e{ru#~l<4Z}H$BHAxM!#NUZ27d8sKs8;XA&?7iR>9E?SaMpWpvAt@qab zrTNkaSRJpuHucg>n=H6$Ldo8=Wh!^?O}V9Bw00Kn;-I9POJ7%;?M>U8sUh9HMl>n? zRk3+YThjW(t2q~H&nI0js;XlR+fnf5Am8k5%imgc9Ws^Xe7Sesq0oS7tb5C9b*2=t z|B=XzIj+sD{(RlnfA9Xut>62T?H0$qn#aCwk2&xEy0-nrZZS>nS=(GUB-WXh*K&rO zJb6-6e0lnsYuc+m#w}WZNA(2v45rY0)jN?fO!1GVG^|v8`N`(Yr(K_Zz5KBGbrXaA zyA_M_TmEnh>a-dhv2lE4wZR}|k%q!H)tjY_6J{M~vGANwcCX}CpI(Q`&q+sx=Gjh} zb^XKDKWDlR3bBTWIaR-XzS~3T*BZX1p%O9N-{1fL@O#d@dAlkzuPbJ3j966KKVg#Z zcDLDvt+N8eSZjAD=BGbvIhb@ZYj06{nb!)g3CBPQ?clkdpop@vv^PG>C9)&dU0Y** ziIXLA)9%g8*DjPLA6q=@@69VSuey5P-+oS3lRIulY4^{XbIT$>pSqhoYun?SKUvkq zi(kE*vU;^;dbjqm(zClVXZ9ZNaTATbz0p{Jdo_mGX z>a33geP8l#ep`L^YR$P7a)m{8=dM<{T$WxUvgKI8)`-Nlshcw$cR8n8yIyc z`{Q!?KL5b}8E3y$B))GrnR4jk+vu3N^O*y#EA#Pxx3siOyqs%cW4A1ztNU~DJe#^R z_g?S5xiVAo{S%FPJ%Md8ah4xKjDP)J`NL-CgY&yHt*r`qBfeCgpSXXmKG$uh*IkWY z-`;MFoauQ$cbm}8{UZ7v&w{ERCv2I=YU}mtVPLw~%*G>oe@Ef6ty2P+$|MMc< z>D|qG*Lae5RQ4V>@RKiS_syxDHbK=#qHEF_CYa`cOGl}gtRGzgj-Bxa6On!{1W>e_p0MSV= zGo~NSI$E?h(Prj_ud^2awGCUX%2d8;o0*)Bn4Z3AN}AN;UB&%w?>@vTF1%{1Ef?e8`ypd9(2?-{bG@>3u$}T~_w}#jG~_KZorf zOr0K|s*-(Zr;2kKS0HQ zNj|qN+sP*pA3iSnQk%Cac!NaDwZ%t2Etdb^u@O#?c%(LP5YNoE=|CQ~xweYTW zuD^wHv_+U&CmPH=H{(p1qZfOV)Y%H7g>wCxuecU2$zHzvPNQDb_ZRCHN3ON7uv;e8 zd!hDtvTdjC!guz0ZN{&8L7MURdcEh0 zt&8lNGHKPi7tPX2cNQLazwbNa)sn7VI~GXwYP{y!D3)WU8~#~!@yHhl~B~9`#PY?=aEuGXu|lJ%b`SF40*Z1(w_i-8XTetD2$GbA_backJ)0r?I)K zzBnfELq$Yhq*2lJ8TZqd)0opl9_^f@^{ViE>$Syeu07Ffa^WalTx!rG|KyC`wtEu_ z_sX7lmFSdgpypC`^uQs7+Y1s5QlBRu+Y&6l>Pu9H-Tcq5RthvTruh#PH-d$^(iXRMXtIM)aK7V)rp?=+4Z<%**71nrn ztU7(^Ywj1x`Y_Q9MFTg3nLaCD-C8OaJ)w2c3b!wAi%%Uo>(m&+6*@)aE63&US1xm& ziZVOR>wEjdEpPpghwh43eE6Wa`fS@OfjtE^$G65@pXOwFn)Tr)Uaxwl!q90N3k{B4 z$cfq@7CHS(?D-`#cJSPC`XRiHb?qyOP}ar!60TkUvNzF8^JdAd)Piqqg`oy>duFVc zzLx8KIcnPMUTxv`RVC|Jdb>tXkKnAX4t}pfBgb_c^=0}ljSn}jm%e-Te9}wZzqyAE{W|YW?h`*>`E7!^(-OmL z4zatHTn!kyD!A62^O1Y4_Qq(r(DJ)eQfKt5+aFL$V!6mFd?#XCWv=49Y!$(Yr=|Uu zY`QM;zx1+>?3sL-ZGwTNuUGqb7uG$Xp*eNVxEyYusG63qgqT>84UL-oAt z(Pfz$Q!nJ=t*|@+9zK1tq-nN>wlPD_wV_R(hbK`tWvEcFP7R~`~74U+Y+Z~ zri(OI92ag0(BqBJ)T%Gpvu)ZY9f5y)6c$GzxZ12YU!Sj z$FkR$N%vgaa<=W}JH6CErKw9bM8mR6?*FRdl=TeuY@Kzbu(u@D$n;U))zz)q3Y(7w z%V%?=!b9o#7+n zw=iLAmcX?m&$c^xbOl|^oG!nJF;r7MXX%5}@xPet|9q_e5~aN4!QJoopJwfI@H~0( zqGD>~rwbv*(LTD&82K=vj7o?`n}PZBL7i<|s{^%o!xHAl*i5N0iQ; zkFQrHtkJRmzg53zhjn6pdHctl<5x8zR=BGMXRo;rS)st}bDk zu9Vk%^vmA-U5~=n$n>ssXS%#q;;wRbqmjaHzHF1lcV%atWxM@7fhRT4Vmb@AQ}S=7 zElbV!CJW_m;NvP#&)}S1{P362524cJ39X01rtQmqxl3%N)~Q8Hrf}_y4EAUgnzTvh zritwAZA*2$)=kUavT;l8*-e>|>&>q$U6Qfjqbr;HZecyKYx2h~CeNPc`?xAtfpzgJ zIfFyHZdyDtpQc~?Qdcb8``K&N*xR38X|E5M(sefL=+&#L&(oj3dHY6TV@T-9x6#`{ zi|AfnUf#oX^yo?Be^2HA8-9O(Z@JE&hxtx?o7-L8u2s6&{;AN7G7G6XEPP#Pb3C(< z@^4-x7H7tfb1EFp&0iQ{v_!BWUp}9OPtR1(UEx`LwW(C`^h23felFR@Hq~#hn(1er zPiOBXh{jz0WZuzsVTJM$3#H-Eq898P`S0Hr0_2i4Xb?DLwi;pUbrrL8$qt5zjknQ~@&c1i56DH*W_tF&(g zx^B+YxH`#A+KPGZ)-ADb4|Vn~(DTxZyqMAa&U6#cu|0+CEQ*4zC%@N!P>!p98>;r$ z@bX>B$0u8kCLOHWn^ISLv}$i+dV2fC6=~_^?W>C3+tq&SdATDkx0;WyEcQp`){ z%4hj2F13BwS;4n5ed?rU`>yQkcaLyezU3;symh|pBM&d@IsYG7-maXmF0lKJULe+lIj`S`{-3veyr!pJNwtII_bMv!$EA_ z(b*s8EpLzRxw!Ar#rd5AMUG2K8m1OKFWCLgYnId0by+uerJvqZFkxC*jQ*06vHIb!7m0Yc^oqUQ5-g@(O zU1FT>w&7(Im*$Eo+DGHI^3FcDK?r+|ojaYMS&U~B1yE+?X6kCf*`4n^He=FOxTkd7paZT+aUv15wn|commY3YP za$%9bLghU!MfEqY&mC{Lwz=fZABWk89!2fgdF9iE+{)|;iCm5Tj}_Vj+s@>j|D@2w zslUF}AwTJ4OHbOezov-^j~iTSZu)w-?yzTeI8th%;qT;me`zs`K;GTgfxfoue(b&f zTioQWRHVkW-o%|Z14O%at#RO(XIp*j;k};2f0@O)wRH-LiVhvjIip|qmivz7t@QNz z`{iv$S6o@I$@VVGZ5MhshcB9g|JpCp@O3NaZ4~=cDYDMb;YU%6L3MdXZxG)>GrJzi zup<(0`BTjdyHpB)v|N&xrW!C3wPg}zvhi~c(%KB)c1E=LSCM_+U6&2&5jYfSy83Ec^U0Qd<~paI}37uR{LJJR4CmT6L8(MG<0X_k)UhJa<)}xO43hVd?@((?5ywis^_Pl_Y*jv z|MyV*lAx~ldq4BV|9liaVUw4L8N>Z`m&<-xX1<(rZrl3%dB@F4#QxmhWGwwjXYQVc zF8`&KZ11^BLLwH|#>Bg+-9D8iv4iuPRa(E0TJh3HCPi=O-6-w;dCAnAJ$90`V9TP8 z_L^no$5^F9R_#<-_{Zh#>}@aFp5By-x9GhbzL4|e=E=tA&Yyc(+P|$WFw$U_pX2v6 zVcG|Z{=bu5r}zBLdAA<7WWV$0cUD&%IRE!d_|5w_7p}>^uH|Pbe1GQudtbG@1TOvj ztd_IOWtynkj8~gJ{M%d7n>KZI%GF~^Tu)<|St4dOIRpiDe9$X5b6x1AGVR{B2-S;o z%idp=x|`j#=|G0~+@kb5Ru2;yLw84UC2!4t@Y>^QYou=O^<5u1p67QLc+C_Q2@2E@ z|MsT3JZ)LXp|1@`7W9^0YtYeLvOqv6G5X1g`5dZNJyXwI=S_{=u-!T}CVWn8jNwWx zok^*WSLyfn^=15KOOA00dFZ@yr>5@G=>4ZxYfmXUet&Hk_q%(0PiL>+<8-^krsm58 z(0ZM@cP00KIKAH?bn2E^Z(FT{PoA=vTb!IJ`C4eh2P=!sQ(8ZW?rGdsEUvKpbV-PF zz`c#>t9>h??>+iZ>1Ap8#`4C?!&CKKjjzAE-mK2)b8?nf7mL;{4PE2YieBf>C+$;Q zCBXY=t;ySmzjAiU?>xF?s!&#Q=UmzIUtg-Tr#|MER>@^iFwZ@F@uTAD)y3D{&PLr@ zmU?%MW`NAQ_ZQ1~A8$%3&+lKZe%|8F{l~@Y_Z||r``?yd_UiUBQC5z|pwwx_?+w{R z+;;F?4B8nI-|Q-?8YH67`#U^CynK7ZBnicd|2|xLu&k}Qa7lrMe?E^>n!5E(q1>3~ z%MX|=d#!P}u+C06?Bpfe?d6##IUXK3Ub8=^eFIad*o}3c*ItiFPoF&V{JM0ebFV(+ zes(f(jw)|+3)PDMmo2y{Nkw(ji#ey29YR@OFI#@MWXh?lUM9CLL^m&8@|Jh@*RHuQ zdsZK1QWcGoo)R)q%x&?kv&#zKKH)xEwe{J(xzTs_)^=a5I?G+2Z}@lS`h>L)U!4*y z`MUSv)9|>D&(phd-ko2#qTrm`K_;=txrvJ&7d%P2*P`YzO~rZJx%{I`m+{|HWZQ0g z`shy189w)Unx^|1?9h5qQnEIAS?$&{&anWyiEAd- zEMPu4gS++h?hiKJ3jE5EA6jId5IPSM!gAh2?Q zx0QjvMB_BE$9Lsamu!Aet8JFed&}P~s`F*E&-La>D;5>p-SL-k=OM2t0xz}|E|2BZ zICbfv(6t?RxSz)GWVdMFzV>cHtfJ^Gr$7((9IcmCd>Py8ZvE)!WC--QwM^B7OY=07 zGS3&gEm2qhy+71yI@KY1LT&q$bB82EReQX6noczd$!3d$pSFB_vE${E#h2Msxldi% zbkpSD8@|qfrhCzew=$LleEAph(aAGh`_lF~^X41MU6qlQOZeS)e(yi7?yFtp_kQZF zzS_0if8K(WMj=6SjV;?iv4H*z!;AkM+zphc@oKc!R?!QNeJtW6iGk z0_D~D>eFrhKUR(BxcTe(nPbAcwx#cj*c7oo;})OG!4*ZG?y;8*=3aU8_FYkF>Ct6x ze>{4v4?3)9sb0#Lhf6~o8n>Rx=91LTSz~xkRe&jZX}U`PhusZ(jBh(93uS*~_pf?> z{JZp&OQ|0sA8S2Y>cH)-7!#sA?H^b7l-6vg2E-vY@5d)arG^r@fn8 zn1j|_xMr|bc-=JZS6MEh-(UD1ju6#Qyz#|0cKyUt4>^{Zd#vBoTj=D-+4<7?*ksOQ zQFecxF#6s$mg@y=|JL94(`x#2@io)9r+sFfF8=(-?Qi(%>FE3dHOZOk13be z%BGoY5NDG6X-e|*@5_(7e%pBX zQosMxmjO(#wx$|z9Z5IbyW{6-#|6gP-CO5tvNvg**M43z#qGuny}RXmUq^^IRk0m& zJ-I{Y#ja^pHjmC-6ii(hp(if$?)}H7=j$6E@15zbyG<-oghMl6Q;AQ%qi5qpg(Xg% zOxdh%R%f-=Y-SO-c``<>zu@W12D5~!7A={>RgM}{&ij8{UZSnI;n3XM2|4`+c8f1c zwM;r^8z^>ryF~Kblk4srG;fJw>E4{ACEm*Euw?c;N2z8V?di*OVp5b;k~}s4th~!~ zclU=?Ti3l0QDohu7dzu>dVbW)HR6}6ud{lGPM@-gUXW2GnW<(SKD`S;~XOSJoMkHndN$M^jGdA;KO zU;dSDQ-$X|Vl&+yS|@wwk-$-JcC+30mr6wO%-7=iv-!~H?RV28E6jpFofqb@+^=#y zvO+O^BD22wm+(Dl`9B`N+H~Ayuk@11TlLD4-tszgycfM4&$Djp&!07kq4`l;&d(_M zWA5UT^Y70>_o=H6Os<~zEUn{Z_B91v8F~5Q@8@i{n7vqc{0rZi+a|nD9>+@0-aE&$ zy842x{vEqV#q0OI$l~LAu4HlALGawgfK^|7UhfvDR?t*2j%4)coWRw1#H%w@HB3Ze z;f6&=PB1O@a+kB)$k}cDy>M2b2B%zf!R1m*K_`!%{u>sPW0jY5MctNo9whNtXk*W$ z01b0K#R;hoXKrJ7xJG0Rv(noBjEeO7jkheToEF9e({u3jT4=AZOKd2 z4Sl%FTGC;v>f)Cyp&@VHzB82V*WkX+ziAy8JBK*y<&!Lnt&f#@E)`k4>eKT0NUnO@ zW2RfzYF*!_`=tEM`!^py{S|-ltM6sWu_DX#bgO6Q-X_P@zAb%sr}p5^uz3w^q8!mo z&Mvn;DdetMcE)ehFQ2oebFXb@^;#3Z^JkZEIVP1OM zeS_uF-tM1r4(HmRG+uggUcqN~p7ejufBu+v(^H_zKx0j}aifxhh_i(pe?U;-?`yJg zb$?6W-PwIS#Uw4??6B19{)NpqOMF&}d|vJS?vCA~x99hty!eoBlHBnL`-F^kh@6^z zuS4P#_tff3yMm{O1SU-tXL99yDxsLoQCSpUX~ev1`tsb7L!7Dfz8yaO%1eTJYH#my@>*8v z8avfPbB2%F0^Z-7C7IZ5qH-Vq6pwv=XI5PHwbi`7*EeKJm)tMhvj2RJ)z_H^xsqAj z-QDk0KXlELy|-*ip6}X%wahIg@1o8e;;i-GenZ8+(<-^if8p)(*Zx^n+pO1fvUx69 zR?z<2JJ#5{KdgK=xxdQg$79Q+{OEVK>;KhA zvz&EuY%W>0XJxDEw(auA(*OLt?PM_f%#ZK?ZtXw6|MT^KvBxGGu9~oBmMF)H)lDxe zjvPH|nYz;A#?6Nb>EekzVc#X*ZdoVruG4Gh;p~uyS&BXCYO`HSx4djV)SGO+&$ILM z?}IbMT1qXM?L==$tbf_s+}B&W+`09M+Vgo?YviSGW%?7> zHoUhsklJD$?)0E;+g`S}yVMyuR3|LW-kz4z|3$rYIdct*)6V9`=GI5su3D7yzIN_V zRnRyc7^AGpU3EElYHM=Ed^wG&+RIkGp0uc7d9kME&D%Fi&wsh)@OYEc=~YX<>Lmq= z=uG35v#&k%^r`ChzP`w{VLiu^!)BXmxJLGS?9@}6wAb|CmNhF}+8LfSSQiPk98A1+ zJLO-DsHCUO46Y}0WaNt{7uuvdoBTu65yGr(a zbhxwD^-i2@;o*2)HLe{G`aRb>Ixm_wneo!)lOGn$oKW{_wXl-$)zp)BZ*QOIwUfi; zvPF!8m)q5jr!{_&THngcCk7eJ?vWIo%5S);SYcBEWJica5j@I0OH&tFw`EE|Vr1&B#JD)$=U_hs!3;Zs>IvAr=(GeoY0_FiRMx^ui0L4 zyLI=S6qj!Pvn9<+u6WD-{vcLE-i`Lr|?G`vMYIUjQ56kPI#fO90 z_qkU@@U6(%`>!(e`NrjYjr;6FHF)yx33-{vZfaFLA~4~@S)CLP!Ok7E4la9_dMwJ{ zU1d@g(9z>?w|4HuIrHpXD--;F2~P+=EgIzct^E6qHP`O!tnGe$*!kGvQ$Oz&EQ(8FK2V)@YY;8;hrc*?7X$H(H@iLTLyh`YL=jp5V5xGKa z$vU;`H|}uK%DrRwb=T{~2h6TrFy*a%z9m0UBYiPv;}`b3BB_l!ULj9UU8sJ$$l#d7 z7E_;P!mk3)X2e)?ALDXcEa)1#E5)R~=I+6FdP}(iCAZ(py?%L{?)P_hmc6%L(y(`~ z?5Rx;-h2^BT&U$Gc3QQXo&C=K|3;5@^);;eP%)7smDSM5@Cj@6+u1TL=l`n-B}nRg z*WKlx9>LP~wMHkTCWfc4qHW(X@A*yHCkj4ApAq7j70S~$QP!Y$$HVQjXZaqL$ltQ{ z#~J^w{Zab5n^`#$=U2S_kZ>pQjoIX`Lur|}&E(Ffu08o@FVBpgpTdzA0_>sO4=4OR z`bTJu^H%Qr@{XF0q0`n}(_Xe&a`MHNn>!9k^iDcgULMHdm=P==HIcREuvEEIXcSv{ zME8`u%_%(GyG)J#1&A$PTW;JDIZG^EFFXGcS2z2=s_?Y6cWZA&?b_!0U3ORQhP`Dy zceA-d7oO_MvT>azx@eu?R}O7%9iis#lpFh;OLTYT->D5swCa7!dq`eBK1?}1cIvx3 zz3Z;8`*fL`d1cJMrVVwnoA#RT{klBstHj+TpZA}Y&A%-bYhn znm4>#Aiwm&u4FU0z;IJ0&%hl`o0q-5k#kMv-CKio-f?vg<@E2?H@-aA!`?4vEY&~v zsKv|;^#vlrM`X@EZ8xk={W_B?;MsKknWf$L)^BA$;WTfdbmWnJwrWG)C}Di7#bKnT^vKo&DyVB z2|c-E-OgF(Z*nvzPhl(N4_?eyg7tGoN}PRd*FnoC_bW}Wg~*gL!a{Ef59 zi~JVdd@U^W?b!2t>8QhOzDi8Fj3PXNh1*U4$$9rNFD>ub;Es*40coB+;xRdUc1B*uKcshKA{iBC$$$ zUIzPFTQw?fU1-46>LlUre{7fXyER{HE2d zwe{+#B!n9Q(e9AlrYZL`er5Z{-K6hx! zCFSowgwkXT)M}5bwV!Y8X#LW#x@^y^@@2QM-vL~iGeIDGV{9iAT+N9+tKg?p(Jbg{TU;X4Ev3)H6e!0i|J}c@_ z5$sZP>Zp0Wd}F{R6*gh+$f)zNDuT7ELU^Zbox1sEQ{{ow4(&f*^ ztoEzQjdjj19vEBSS(Gp3av)+#!NTCTS<)@#sy%$R;+HNm7>Rt8@V)=Fr1p7{Sk1>t zAHQwaQgL1QsPFdNdx6GOj*1lh)a)^0mtCoOW=gG#x zy!`8{O|7l1C6X;{N{;3QalQJ;(!Jnq%=ER*hn=T=R(*VN#^2`JU*|*{OlMC!efsp8 z*^56vzI)KU-y`lBSy^zpgR^}47%s^u3xJ$H5c@=~e!)aK_6*5-STCmVd6F3pf! zpDiSn^t-ao?_l9Zrf>cHE7X&>m}cBHnt5eKP|=3^14SE?wnhbus@C4#rM6!0MZ-Bi z<85}fQPUP~Z&Kd0XiaVC;`~cVJ=uq^ZBMA~@vN0ydt9pI{TiO|7fWjYwiy5KWtgJB z?vvu78$X;q`J=K-tbXpXQ@-%R?%VT@yhTEFdk*$oGc0$QcF8n->yKr+dOX_QOrfFy zJBmIpDp~0N(78>B{Z76I z=cUv(Yx>^4^p!0%#OGKrS0qE*&6FO7XWgn!TE{L+p1#_)d;5C}#mBon)|$Uwu|?>> zgsip`N$D#CT7up7JrUZdYm2#J48Q6JsAczDt~V>FkR` z-ySGs$gi~dQ*rojv`>xisxIASXZ|ePb0X)*QQkMT%^Pm)d$a8GhT@%5_82L+2plkP zEjSdAeKyDD;ZgCp1?#k0M0>KsC2xF@-D@WDufi&OpHASvK-1Y@; z?drMS4_>FnT)Fb&d&9fCiHD+gTb9p#?R)e4Ug_OhE8Vwt|Hyj1h@Z{OSNibDL+Yt3 zg93ZK*G=R8_C3aGtD)_!5+Ai>KEA$+KTjkt-;F)BDrIw2@s92Of>EEQn;y%#xOK1R zO`f$)4&8nBBDZ6g^qw?1*6Xt8ZIFewYf6vsxsDFS%LZ=sfjx04H6LsiD!1<7tf}}X z5qw0+)2ilM%9}Xh!@B02Q(kMhwxrnHGkkN&Mdil)U&51Z*17j@w~w4ro}Ci;sEfC_ zB+7|te)U)0x`*QRN59q{xm2S2_+-o1G~rg~&5?nkey^n#C%?EVF*jw#r=U2`AilPv zv*Zl+ZBg8EcY55z9V}9px36QJZ93zgszBnF-Pa?^RT|80tYf_V>srpSr!ERLRkM{h z?7Kc=-}h3XB!>hiu8@ZYoOiP)2(6sL&bW4cy@7`BzvXH!O);}wrBQQS^ZJsj zKb#YmtUp~4yInUbI-Rld;ey`HS~?HEXv)`x>78G=Dtn8l$kC3E8BhEktn=zxRrK~- zt#tL01-a4Bvp55mE?URUZs(W2W8W;k?iuIxSGtLwJ~}Dw@`lZuo2PW0tPtBc<@v>m zyz*aB*H0{2*LKt;ZfD;7^smAn3(qs3U$@^z?R{+Zk!_yFXFP8`6XHC=GWWUhMS+B# zjQ?Rt7X!RHrRPuQ`Sd}6pZnSM^o2+4mwW8^wyq{{zP6H6k;gWljkz)w547iOeCXWs zHRDlj#EMf~$+2tpytjU}iskNR>$#WArFWG*W|?Ep>G?}#iHF9ebS<_8nkSUGcfGze z>-QViIxY8uDywIo?*ad`P`%r;@orB-PVa(t1On)rQb)-eZ@_k4K^WdOR(^Au-Gx<8Dp~2y-OD9d4n!Pvdx@qj?;1!cr z|D3c*!|+;=|FJjk&mE9hwWvhB$W*s`wdL8YvsHW3Or#o3-^j}r)jaPzJlW{Y-L9O= zMqZmai!C3!bR;GTi#%$N0>6*}6TQs130Ww(f0W?qmt&1C8g(~rf+Oq+ur z-4L_Ctuysf<@Qg!^NtstcMK_hqI89K$qC097KSaKZwB_hy?*abO18q>;+1cL_}RIw zwkWyqNbeN8J*jl_!!Lh&cCC`QYRYuoG%DL$F?MU*{p}nt`?AW_4SpX|ei}XH=QZzz z8@o=0U-?pZx+eaZz_Jk4bw-n4^s|4smNel|Lg{k`|JVQflOtA}E_*$}W4hW~L-z3a z0Hsh->0>JvxlCJn`Xz^pNYtcW(oDt^#?{$ZgP2jep*(JQ6B zTH5SQQR#(W-IP}!DqStMqhLdSjzs=jmSa)d*Xp;HORjT`44NX;oUIeQa?-91 zf57B8F(oLL(qqwM(W1^+~F^)g#@232j z(qGbAf9!R2VeG2EQ&JamYI8KXR>a%wPS8&J@V~$R#=m;D3p{INjhfvn%+=ETf1TYt zEl9JEk6+L!;JRvQj%%&qW!mV-8tAS37ad*WBlwfgFmetr{9jQcR?R#ag@9MM!@XY)sf2Wpw*? z>dvUbiY@1pHZRlQ+VXB@Pu8^4s*_)~?8~>bvPjt*8SH!P%3?u&d3!gHqj$yM8PD}o z`rIZpJGcAR&;Ksjz7wqGsTvC1Q2Xq@?ar?`;qy+r*XOyNI6Ql2lK-{+sxrSntUO<+ zJk7~%vgWo%X&0lsj=-}?X8)ZEjTtT)~_Io)#m+l|*opVOA= zJB!T>z3OV_YkDHDGl03MAu5BB_itd69E%AHhrpK$3v^T#O6PDcxuLV^rmNWMOE?H0;MLQ zJ<3&uMtkj=yV86Lt0jL9-gsn6fu@l1C2Jv7)lZ6P_u4Zd*U`Ur5(TdQ*wUo$EK?%y`nCe?pSx)xn5}YSFvPov)i)i;{6$AvZ;Yj zzpk^~y<>siYQ{6KJ7byezGM7Q-BB%n!$#O=$)D7<$2zy2G*sIxwM6Xuw146Im$_a0 zY|FQ3rre}|uO2tN$(q@*MZWEOy{}>G9EN4h$rqL@PiC7K=kr-YY{UP9ClAX7_bOg_ zyI=d#i=)3eR@OiG@-TjmMXNKg^DdvU3FwxDGzL6q2;l(+MnR9fx^YZd%Toui|TvS=;7aDpe*UZRj!moE>)_!V zH)e-kx>xhAcJ}Mbi{f&BIUYAK{P=K9=Bf`SG8@jXk+rk# z6)%19^6FHVN&5~QpO>f7>!Fy+8xx(TeAd#MEthMG?g9B}?7UL7 zX!;5Ds{Z#eW;}t*rrn&i=vB)$l~{pEr$l>vUInp*PD$Xldf#d;@!26X+0d2EBw5YR zQEz3}s?ay9L#tTwx^15BE{|IMbkZuVm0eA{)@bxBDRh&J+f#AyvHSEr`*yiWKeV}0 z>g#mT#QNR4yqCMCZPLoT-FCOkJy3MPl%A!xb5(^L_cc#h%y%*B%J*w8OEz8p@cp2k zy+m2u@>?%DCGWmpGv|{SU%%|l?YGS*e*4u^TXoh}-}TL_1J`*<|LoCz^O60^!`5Z( zdsEL%Pby=%%spdS>dSw}zx{hB|KUPb)tkT7PgeE(`o_0Z|2hBvug5#8&qw&4yL#Nd zyk?<&@^8$om(C8)IG+Xr9=zBBu1Er=^g@3Z0qLz6yQ1nbcu4 zd*S-n=M#cHumna2ZBzK7m~dXiWY&t*e=S;CC4tFZRreo!3J}fJU6d@TcJAJSEk}3v zi8!$xGCF#LyDZVjHd?jSRMoLjEA2+syw((xK+UF06L>T=Cb7R)bp5&A=`r(>C55q5 zeqUr-@oULZ$;@Ugo^2XME29?FFAZ5&#_?`q0E;?bblWkBQ=6Xs`O|bXsqeMb%-IjE zJOZYQo-4gldNgl)qe@K2|M`C9GvwZnzZ>)PMMzZTf@J!mI8 zTM@_7HYXuV3%_uYH_uUj8IT=nR~c1Oe2;%m<7u``E7I^Atoxjg%Gf+Qn%>A$|q3_Qzp z&aMl5AbQc$d&kL=j0txmi)vjj1)cTakT%Hjy`=QB&1_S!boVw@LEkHEOTC1q%`iFH z%;n`Kq&4*?qoFagqhz;cw#TJkcb@;vXx4L|s@Ze4s$Xq&Wb~fmiswtpl^q>~ryNW! za5UlfsC~8K;!&Q|rM0(@w_N%=CAY9lWA?_WHg}`@YX!VCLoz$uCi*C)#4JB2)3!=y z#`*LsrAODS(a3dGGFqShfd^%mf=-}~3i-dpc|VC%!UYd%676OM|!TQfCjtH`xFv>V|{rXO3qow<{?y46n5}AB}BSX3J zi-JhD=P98@Jo7wv?PrXXGGv`3#vI&w^1FI(q~c~{L)$n79qY9s`*JtkDi*k-7`%w} zyQjutk8LVx4WZ(yCsW*0x_SaTs(Ta{ZCWF}EL}M(D9A$oBVz#De8;;2%IDN;d@AHS zy^>!``7~}4W#nBo<=wdq7Jbi2ZC^}lB2PH2G}|_1i@Qj&>dHW^|LRY#9j);U6q&L# z)o%65QfWm8LA{pUT+Iy&XRh4#Db z0yp(j*Q{Kh@Wk}S^MB4-8^S-GkD0yDRDoCUU4nhE-4Wa7>IX{S>+X4L_1>s;dwTXs zZ}5bVs|(Lh(RcfLTuLu!@6^e`!tGb&GrZotntSlx!f&T~KK-wnc8_u=0DHEGF#vH$IW-S@_$dz|RX7s9Er@C+QtYk@HvFlZS7SwTg zuRB9>;IauTueq`=o1l8J+=9Ex{n90$sYQNrvE8m#dai2c61E(a@V#`Yd0~%|>(4cs zOLDEBX)L|oVdC0oHq}K*a!QY8s;YM34=uJ`cl}OH(_EOtxlAF+Wsx<SIRy(yhlle|< z(wTWS?ab?0yVgaVOFy%UiFHjFx6=of_mO(yEYDZ0p0%zt=X&&-OChd}UK920e)k+r zI=XuL`r_x>YyA9|&Tl_}(OJ+LC_KrcQDDxMFLTeoJ;60MM9k0em&z}*vZXVAO`7tN z!-#k1^;RFlM|0&l0v4q!_{M0SKF|KV;~sarqRXvqOXZhLa*~)E6Q`xfvc>Gj43-Z) zm)}FRS?liW@VnqU1R}1-BjzD_u83VvXRR1=Ej5pYhMI_KysmQtBId zUSrjyP3taR3lI@4jom!wY^0vpnrFq&QeAgPe}3|D@xmik(K;T1O09SE+;5ku=vx1{ zdsp`J(Vnl*_@3KN@0UyNN)lM`^7;XZC;NYvN>uv)pO+-;-dh!Mx%QRax06d$Y%YJC z@i@L-_4|bPC%>tgraabK{LDR4^rho-1D^7U^}PMczT1A3@MO%mv!^NX&D|3H>zOh+ zx2s?8O>pbIUhsYvTjZp|7iSz;Z4>O5$!L6k;mlvr%Puo9wN>JJ`TozfdUE!T*6r_Y zToa3nyBF-SIz4~!SB>fGTCS~GG%f7qBBd{u78iEOE}PXTcUd6!iNxMbMw*>A(epPh zWm)KNDzr^w=~b)4DvHasn{-c{Fk8#&yFE;4ra;PdQ`dK$6Zq7c-nU#AI9k}UO|?WW zI5XzDLB{q4A2b`yc8Dw~S;ceDx>I5o-}97xtt;A^i{)}nZeP1-#(U24*0zT!TNiCm zYRuo_s#&>h*Q|xP(`IX*KC^kk%J6%oA+Da&Wi}sW3fM9?dGFnV%DO}8@pT7l43lqK zmieAO`BL)rS+{N7`&J33h-Kd1x@X_MW$U`m9N@XKGi&khP2V?cQQy~gqXX}N9Ewn{&mEn|BI}s@!Z>YX~e4yej&6*Rq>$Eo?2HK0Td%p=;H;i(bEsSFK9f zKJl0~Yf0?sn>ShK*Z*XFU;lo0$-30tvD_E6>)RK_OkMn9`9?=aZzoxygZEZVyw(W_{y4;SqsHNrQ*=4V-7wua#DW_M>Uw?aBZ;Xz^_+Geem!e@pq#rqd22+#d9NgnHP@q~-e=4?{`17!cYM*O z_J*gz1!}xlLU0YS!_7xy4hGwr3X@7VfTdeeOE@V4A_M z3$qSM<>kGzh+La7OZNGB{h8NIuSs-mdM17UkLa}3!Y^7&1DtoC-jMBo=EDoW+AEz) zI_LV79cOkZ$eI#->Ou)m^8UD^GHP31|9QSQ=}_Zc-|cSJF}DN--tRbR^JmsJuYR{9 z;rsZE{^qp*Y&0xnz1ghsWyUm>vmNq1p`t&hPpD|)|Ni!});r&Wa`BV*ozKjuaELhh z-{DsWm)(zF?Ge!%a%JtRoaB~YE0^FoT(vo)^MfRlzTN+xuU~ajO_h^Aa;|#H`LxEc zrzbqjZ9BVa%JNGRd1cZ`*C#bSe)NdvIrFwPAHGhi+UOwYy3q1ufV8V-R9EeZX`;z{ zvfDY1X?4sMk5OVtx_)V^td**je8m0SioZY8ZL0tEoc%Rz+s%(J#piFfv3@>Te0@c2 zwe#g|HNT#6=b2l-Iyy&ueZ27G6^`bT6LfPOLq#Oku6WI~Iw5RoGlSl-N6tytOSj}6 zPS;=mVWzm|njHQ|7(Mds5LS0`)y?p1>Sha7#8m*kb3#GEF zuQpxVdS!FdyLE|%@ei7Lc4pp|y%tf!le6u$k1&7DhkMo~xrcu~m6Wf09X)66+{@=% z=jSMXUwmJry(L7m?Zh{U*2=EVuiuO$KBzF+Wlac<4z0caNhDuFi_zKo@PxDWESyh@ zZ~vRDv{v-Ew8fd;zP~yA;Wu{Q{wUAB@l3#4ivqUeOl|+}ee<6X__2B4g~uPxZ&@)j z-%7UX``=SX?lr%EpI`Le^X17uysTQEUR+e|e%ds9`lK19_dJ;|EC^m;XtmJCGicT| z>wSN|80W2DpE;}VU7B;?*%!CO{{NhAaxPeR`io5qN*iCVmbUx-$oS^mJn~^&6D1iIY)+F3AGeh_f4TS@w(jgvl}YEygc?X z)NJAR{+BsYW*gh>N}qi833_mECr`z~Kh|n1FBoQKPyh0DgTGZ`JEx_lEQ3V5*|NU) zka|Jel^S=a&k3(?4;5A~OlYq@-geShw#oSAuUS>IFKYJq?aWVo*MCP|XSvkN4?AS$ z)c&tx<4LW0Rb#i<^!}e)?KV}vTJ-JyX%w@vRG8S7nyXqpUvWw@Q1aiK^Yv%WuD)&| zzw@@~nP=WwmUi3YW{r^6<^KT zfBxK$hxh;Z{(Iy9zr|gAdV=n1SKn0KE>W}Rhwa?fsQS<7i%4C{G*N-AoonLTucF&@ zKCWAQGq2-7+U0`U+OszwAFuh<9lzk+wLN=wE#mDIzkdBrZuGvIuTsI`d+yy?`1_&N zt$=BwdRt~}N{Wn#i@(2M@}s=#K~c?-Q@412{Pc|P`zO)OH+!ZCoZRYkaZ6wL_3c}7 zPp_UW4Z0uays?2U)g)y_qm4yPxrTa&Xb`c+liYZ=$Tf}bx8yKg%2g!#|tVs5BN&~vZ*v7nNF zXUYDp&o!Ud?tRRg@NnM2FI)cAF;(eZ{r=R6HCg%dkNPJ$gn$i?j@|A zrT_2Ka-A^legE&u7nGN4uL`PDWYJ14%+(HF)icHJ_r{ua#YWyjAAGyZmCgtSr)-Wa zt}Z|R_HNte&B0qP-pRS9bN>8|+-(}s8}6<7`ROa~?sI|Xvhub?$L-tantk->P05q& z>+ll^}#w*TW?_c#BaZ5?{yNv8R1Jmlmsfb*jX0o|0hHea_u;@yCP6b7EWK zdg3yby)Nk)uFkIEiHW^yF#oJ&q;BN8urse%uZb*~!8^U~aQEY1H<%gvbJrClFjb%a z7LaT8HuBaJgI5K$-{;R~n0eEnTI+womb%A2zb71g82P3^z|_O+PW95m-IfOLES3n@ zUNO+T@AKcT=uY)>Mcx;u1b%4?_%`hI`=;1+Lx1AFpQbiSrc!?ti>hU|ozy%tA!x$f z$p^($&)=_~Ulq4G?!K2MpRTXB#!CaAHv1pV_D}ljz9{R=y1Q=a3a+U6H*(5U*1lxg zaxy{dY|_S*>!vLCFYf9)`;PCu%a)@WuGhENSnYps^mO`M6n(Dq%=p!&BVx0*m7469y}eA)mBVV&jH!!UCoVEjne5^x|M$=HoY~Ws-TW9` z|NDK?=}9+Vu|!Mkddn8=u_S5hArZ0JI^92o);_Vz)qk6|Wb3|lUb~hhKQ`A`Jmaj` z5rwPsZx$Uq`O3-G-i-`(!V5W;rceYdp8tgAbis{a(OIqlo? zqjBCs=BguqPd#9HzTEHjYXr^ag>5rKvb5i8b*laVFcjNx+9QvkS zu7yo!;ROzXWp*{cx~@+Ul5yb(KKK0IbjzIq&P&(q(!9=bz$?92~c&=A?h!N6y^Mk9XhyGvV&DY1hN`HMY3z z?z<#qwYDSnz`3j`o0O6!orvm{wcE02XNQSgY2NW7%f~;h&sTnYnP&F!!HiH=_0y{2%a_N@nQOG(>s6$0rNzV^&B zT-_c}FJz(Bm$$lo_PGsHdHot?Og&~6tVmzsdBmXi#eEk^iH6fE3;s+p5NJ@Ek?G=F^!MPWZ#-p5FDL(&+xzmtiC;o#?;}gox)&ag zdDXbQETUz`F{yU`^7)(ZE%z{tf3(D@X^YvE)RU8s`|qsz(s6x$ZQJ)n+m`fhQTqQv zzy6f`|CjTN>UJGEc4W`Gitjg7!^79N^rUe4-K%du=bo3BpD|mqJMwJ0{=Oq6(M@_U zYZ5j_1%#O{4Lq`K;TrFnV)xB~HdfZpub$<#|NA02<~rz#fv;)DA8#(+Q#_^hSh?;s zF(V_tlN-eDS9;7#+pQ?*^2C&L;z})@_hRaA*{60Luyns}x@gv#0~0mY zK73SSI%P_4Sj6heqJKTd)3xPdV~WbEoMNYiq&g;Q_k>wIznQnaeP0KXYCdJ?m)46!tSxxk z7xy+&-0j%$_4zl~MC)`--+sO1Y~L!qz}BO0qq;6#+Sb=SS@rg|#5mCwk%D`Hp{Cut zk^)87Oe>x@Xa1)jpC`P}sL760#kcbVtkE6d_McXhZ&_;H6fhIaDTzuV5J{qsFQ(5B|} z1b=y*H-fh*X0c*I#=of8*n&{;OW!S2`rWFmX-(I^(DO?hob# zO2>{bVSBG>zM!rB#%A&3c5NHa7`e&i`!uyJx3Orhy%k~SCU=8TgU9phq_;j+M#ipI zM|l$ZcHT}ZJ;g3x*Iob9|37EzMx)~!HFoaZEm)9i`S|Yf`%mVkzb~pRJed<#TvT-G zfuPwK2Q+Mx7zFwAN7JW1Edij>KZekf;Q(S##&)%jtoqM7; z_qOn}7Da-W@$9 ztU_P++QD)qe)k327L;_xo?Ur*($$<}S#cYq^mbU-CR)x9o+g?a>g4pSYL`b3-=?mx zYsH79oS)AP*fLe6Xzgnb#h@8ZN>ev2xS4x1_npStN6)^3uT4qx_TklYE1PY4HOF=7 zlAF03Z5FQ43R^8KS$uuVmU|1QEX%dta#3fx_o_t#SzptRAFuy7{m=b>-~U_JeSiO# zz2S;t>fuRrDtuF3s1EwH^X|LVKkJwJck z>5uxx^vxu1*UI}Z+C1OeemgkBOQxFl%}UM}W^u>kj+H#Hxt!rOIaj?B|+MHdc z^QviE_Q%g%Z-dzVkTjn^+}3t3-0rL)TG1JBxu zuScK%$=UYc=5P6epD#KErWO5n?eLtkwZt*d<=naRD_>8#yg7K=ZrRi>li6aqy639X zQs)|WNQo+Gv0iyAI{)A8`m_6Q+$s9~iFNu|nLP0&p_DBABo^JGN#w}$-kE2XYneK)rL zuyNiz-|=olH9zjNu+RQmG0#&sqEZ_Nj_}V!H0G? zyq1Z5u8||QH}H~g)|5pCQrmYgy?sxpdGV?zH*QCF8oc=JoZ}cc^~|eT57sNHJ^L(K zzFXI>Vx~r0()Qb4l3!oVTE4mKc{gi+y6E|5rZ0c7%KyJ9|M}tit7oRAH{8=+*uOfQ zclNb;AHPdh@Xz{w%qGVn-`qVlOLEg^|84uL-#m5>eq&xV^Z&xnFPcuOGE_@A+dZAI zdig^e&BF5=mRmU7`h91kb>)vT{>^$H6(<@Vv`G4q^zad#8LL_ zo#(?t&+k8PTyuFv@)6r3nQO(o_0G!|e?Iy==6>!6#ZAS2EB5%$E2yk&JZUVtHRusf zRG`{7!w0e68L|g0oeH+(y5BZ=Qx<*gwdw6;iM#JzGK&u3s8CNmx=1JW+G4h~Iww^% zS5BRFPV1D@vlxw~GtNGn5!pNUY=B#d7PtN4+j$yO&OE%cOLm@%w9V_YeXDmz=jC0` znI)^JvZvhQx#rrQiSbvAb-M1B9q+z=z2?u$=`$8R_&C}7UiJIhdw+kKTkfs#Idx=F z-sWeg&)Yx!^{Op=ecZ)uylfHYv@&OG5(}27;b0Lju++K~#kQ?$hv$_2i;urG+w<>{ z@xF+;g&*Ho-jdk!eTr-A>!?*feF{1@Ez)>xBdHTKRrK^xrPaBSP5ctE8+Pw~yhm&2 z3NE?zVRQ7;?$rL{TyOW6RsR3cc!T&gKW?r6S9{x;>)gei zdi?zpkFC8VwnSv-zMCJq{r9I_uBdxzegEO@`~T(oHp)+{eOo0e|+K& z;yBaQ6q#xntGi%M_mSv=J-62V{Bl*aH7sV1UgVi9myIVA8YN`8Udmo{TRf>`liU4; ziyyyxCfa>D*iTPyhHm(dWs9?=_k5m`sw#MRjT)ofsXM3BZg0rkw&NV<&y~eGt7n~l zI%jg^!Jj`lU%%G2`+M`ep<%(tKa%!;A28qh|LwcsX07!XEgmYKaPlf#GtW0T(zJ6M z`^x<vuO_|6?#^TKgXU(yXei7ZQ);-^R`sGgIeJYEn*_;40XD@#*0;Cp<-yGM1g1 zzFu^KVc);we~l-$&+9ll>#n-}(yZ-AUVILS*53MSQ`*-zJGW@LPYf&GJ?%#6kqOd0 zdmg`f)n)%{v3=5OCHb1)>^A@3#VaqY`1nb5{krv)wWY1)^WNT-Rqy87Z1w!+<>zm% zW$)Xu?@@Pn{HH%3mG#b@pK)GH#O?HwrJEA=Sxq&2y68yA)(kx{)nn79T)e!>LwfF& zcfG2LOOKo_^PU{N@V0=o2#A>+0%f#JykLWO5SX^LQ0HVXKDC zRo1nyRf>#fZA*{PY7L!u`sy4fRX>0Ki2HXx-8^6CwqxhP6&>|UE5Ba0Uwk(v_{?l^TX1d((ugrga+~bA+7p{@Jv_I3IF)?bL%@IDf#*W55 zo3{6tSDk8R`!D+U#do{KYOhR%&s$erSZVQXVr+F0TkAZFPERI7lUxHPvub{e=RKO2 z=c%te^mnoE{v{o|t9`5fO1__?x1y^l(pLG$v&+q@Jd+m1H|6l+A`v074|GPNu?z+NLM%MK{fgyi>xYv91rmquK z-#jaS&-a$^^7A*&n)+ke!>g~gE!rnP<(hw>)#G}Zk*rmDuvYd(*UoLC2b;Hw`bn4Ju^uI@o`z!zbXgdCU`I&U%993CQ{i&&YPo*mh@c-PuoHCjERRlC0b6 z)pF%^s7BAlGp{D)US80fxO3L#Of#4HE4Cae)74I{{FHIDXyb$K`Ts@cEDq`HYRKC5 zCa%V9`#wk8%6ta#%MUn$@=8xgG)rak*lzTk*e16!Zl3+BlUe83zAbnyG2>Lc>_UJ3 zqCFF=Y?tIr5ZqARdT#I4`F9UYSmeJfz+W%N=6~IT{p=@vR!RL%J$3Q$BDeO-$2oZ1 zs+K$|{POJ^x9#z~IvuC)_iBE{rl{=fm$+2n|MJ96HmY|Idf_|J%-*@uU9F^#7vvzc$-H|GMn) z$?Ev$kLUmM{&%qckNwl@|E}3TdAj=gpY8Quly6-K)aTxI@Uy!8Z=UC}@8jltcxZiI zqj%vJvFMN+i(FEVE|%N+avBqt=duRL=}^_IEo(imQ&FlU|!k^6tX znMY0)o&WETa@@T&k$XNX{_p<(wEocL{F?UJx2>Eq-&ZurBXz z`uUXedb#fTd;hKC>%Liruh0Ma=d=FGG*SO^=Ph^dNZETkP{Oxh-XfiVYe82;167;Y zgEN}SE3R*hy+5I5dhnkq>B(FXv0j<=foX%FXnCMdHSWU)TfKDaD__O(eED*ZFEpfy%cr1I3;(xm*Pp7^81&zvE$D3B%HsEI zFDEy>%-A7lDSKK&IPd4g+qe6jmbqT|C%3FO$@X}xq3oo|YPSmiinG*4EoE78(mCPx zDkpitETO#J&t4r(SGgW2-5V&iTEs1TlHk4=j(H92HgBIzJ8$<(vi{Fv`Q&NKYkvHF z|M7YKKk+}8@Bg2^XUFXid-wl)|Iz;E@Bb5C@3yY{HQoN%x6kuG{Qn73^Jubu$KAe7 z+idE$Jh{0zc-=dj{l5<1e|oyV?vTIz&pF4Rr`P=7egE0d&C5kx6;m&7TCgHLBR5c@ z<5KF%UW1kI6#gl$M^~+jIG5!o&b`K{=HJisKQAVqH*h_h z|L@)Xr`!J>tUvNN{wLqnPg8!@99;kR0sEgH{Ppus9WbA_=7NUY+;cl)bUz4+eKy|r z?cMG(rhDpsPU^S+Jx5$WFJl|;^VO{4%eig3j#=+|qPggSnrmoMuHv2!fy{F2Ntf=# z?OihG{O594KWhoAyzWbvet29qE!mf9xBB9`XE(DBUcTD&H0Rvcuc9kgS=w4JulzY{ z!#>fOmYW3fu6tfu`TG^~f~zKpGuA8&{1*4!Vs26hU%Jn%-&eNjC+^v(a$ooxAMgJK zmajHcnP<%WI{*B|ke{o>!B(qBxsU%uz=hkK_AjPxtEXlyk6bkO>J;C1eMzaK=G zTwlMD&F<$L*7x-vOz-_acAewk#=X0zesMhAVcmRYdVpY4|B{XqXVc%uT@{_GyYX1k z8ntakBHOjN!n#@SSNyk}+Vua|{6E1pA!q!~{kT?Mci_7HAGVj@xV}FU_Ie)?>izHX z|C{xv{=e$(&)jCNlV;p8?^M*gylWDvKMwNm^UW1`dQ{SNdve%sJZyZPMflM z*5#i)?$6U}eqB6X;_JOLXo@=bsj6eKJ}$BswH9>#*mm=Be1K;g=U2CD`9WQpV&*ru z{JK_9C1C%*W|Hpeg9m=y__gn@%y;qpZMzwHXWrP7(b-p$Z~aQcr)XYHuyVfQYWKx* zlRD?dye>QtC>wWUL9YRm`Qi8O`jgkI6s^Dc@Zfck9GT=clbS|{Q!%ZzJ9e~B{3iFS zPOC`b@0U2&%{yuiy*#QMSM#qaGWPdVJX!QvCaIX4&!ut0=#P|Q# z|M})AufLvu<^Q|u3*)k`{AzpjrRDoPn`im|=l*ZF|9|~I!_PsV-z-VVR61ShyHfXT z)$#KEUuP`M?%cO9BE+V$=;X;Fx9v9ruBu*rGiA}1AM2zonG`1!NSLU(?kS!SG_U39 zMMkZ~6L;R4wQIwQ5X044=gx=C(S4p{ZvN-n`#;MzaG#!aYMRJd*}K~3)vw2Iu&Q;r zUE$>ONB#fb|BUv(pNQA|d?l*o>JjG>^(s=V^X-P#V>Y`Ml&Z5R-QKpa*vR*klxOUg z#0g2W#izN3CUN-&31$nmxqRw-VtdMI_icmtc~481X>MJ5p>5skh9fomRLW%2yDg_L zSHH7o-=lZGX06f+RFO>H9#hbqBh<<^S!rSR=9bP`6W(9hv68ntac zHr20OZ?n#GNX%)s+Qs%?OW*R=mJS1fjYd8Rzi&Mi_~u`@*Kv}TdH_#u_d$Y zWRlBxk4-CIrm3)Fd#|>d^`9fx_wn8i^j)N`n*8a@1A$)&>-($JG~NFdzPEiZA1*s5 zelf=alc%5N9G9<|eD-Q~-NXGyH0C~6e4-e5a`GZ)R`n~BL?ZL^ZrqFeJeU9e)BL~Z z_$&WDGX4Bivy^eW{a?fGCx+?$KX%tY-mbArcmCf$`Wvh+=9bS{BW6?mrDL*J&+1EE zH=kOnuV&q*Gh_aof^Sbe*Zp?3jPLl7nfdvV$RUx7>B|+WCLD|CX?ijD!m86vx1vhI z9;`nV6fsxpZv{}W=+l6rfaAvw>C{DXu*Z9>EYLJ*vQ%(@dymjna&-Te=4-+K6hAW$>iFSEr76o1Z`|69!+od5~H$SSp zdjFhn+1@|-EOE>J*FD&@{JRxLo?1xg=BiI~-23GUKYeODw<59pT2yj}1oIJx+h#h` zx$XX(EC0DoSL1Zo1fJN2O)&-AZ!Rk7d@c0yn`rs=?0^6G>$~6O|CzA)a`3(%KmAv3 zT^@b^(e`o)o720}c19I^{35yea`BlpZa0OZr!COYs_NS0pC2^OQ<48fgzt+Kl^7$V z6gN$09!>wRW-Ay%RnMs&J&|{Pla=MeUuC{rvr^}YW?tA4CbDRY(VR6dkuQ&gnS7qK z`KEHz`(t@NV^QI>42xNPpB2*gs zIBA}17Oz|5dnv7RF4D>s6E|&cTcl%QZ@>JwsvF^R-*WP>@BH~u`^M#d>3%ESNz4B37u-16@L!kk z@(c10bx#=`UVN|q`vtYT*1KeW`5)f5^ApodV{Z$V zXFm&byghN2?o`tWN?&vOHmR1+W=oga(!MGzd5IrMrirU`jxaba$hD5!ziZ(NzsNKGI|`#Gy;dk$ArYXNv^Lc)-cx;XsLd{$ z{bp8dy%vVbzf?(ViKLe1^rzx|UQ>@oi7<5&Nr*6?>s z?@axf@pftZess+3H~L}Py&-FDK&tCXk%bzJGks*6ByzmCg2OVRgAz6#jR{$teregA zwga9`H*!`So;F+D{KYAunC@%S&c2n+k$x5Is}Xg|=2V@VZ#FE!K(5N+EuVPavb;^SAn6Q`UMGgVZpx%^<8bkGZz&k1Tq zKU_m6_9(SDyx7RI^izgCqm=pXzGay=%x>=~R^`fGxw>i7rYoVWT7fT;7^WqAR5tiY zh3u&HkVp=QO7>NJ{Es2mTlbhGBFo}%jvHtmQ*X`|X zFZY}}cuhX2Qfe<}HE(Fobt?@E+3!xtnrTI>Heam5#Ad3g{1&&hyz^ok+j=XZ9yf-M z9r82oaWzkWd)j`l>gr5R&wKV9r~L|AKJNCc=KD6I=&Hx;clJupO*gY{{_K9`vt`-s zl$RSOyxh&TROgmjfMq-HqaRKsJKx@D&JK`}oScwDiR;g&T}U z5!*t#yrNef3KCJ>yz0;t)*o!E!$ew_nW(d@&Fod(H7#%Z({JDO`X5ie8zQYM^xN=~ ziSD_|S?4aY`QNtEoGW#7jn0Nt*T{|y-l5__vs6+Koa+$U&h;XN~$kLEaO&$`>z{nUUn3>$Ch>nLmNqVx?pn)3=8||0;hK-&Q{L`#(AP z2|{0X_Y1seJZupYeE#GNu8==QITJU&j7f`rk=3_SJR&+kO7itG@2mH>*i__dPEk`z z+_Hfq^;B?`|X8DzYC7{JvN7%-!8Yov6uCYRXhU?-nB z^X3Fiy0N#;ccGG}`;>B)>w>Y3!Cl+5GI#Y=**%ZSzLazDr1kq?-LT5po*Job1@ShH za?01O8#s5^t(ddC?r(1{M=kqDj)-L^wSs>~?)bHI+N+6MtLr!Vo0nTNNL}9cN_pAO zZR_{`{XM~a?)?cN0s=V>uFQ)??&$x%H2KrHCHE$%U2WqL=v;nn<_wW`Nyfj^3p)Du z{B&C$6xVP`BiLh=h|)#&Mdd3N2|NtdZVo7!bkNY#F)+mF@xq=GKdHq@k3Z~|Wf2T4 zJohlleRKAWw^6tBF8p+`w10f^@pGMX`b(oXtEE*`t_*|E7{cm#c+^KQ^4Snpmd9p#CcBP=jFo8ZHA8| zW_-M{_qX(%L$hNJKgmpabGYYe<`zv4ugwv99pTrF zDx*&GxHdT@yKZqgeIarwkCqCL+G{J7CVm(3!g~+rB=3H0bSge*-rT~MdRo z+Rc@@Fbv)T&`+iGCvXn26+-#;@IxC-XGxA!u zZ*|)IE!I78t7q*tn75DWL)#R4^cj>5u!$r$>J+C#}g4FyrO>X9Sog3>N z7~1lpRZ{rq!7IzvO`^Qk>=Rw=J6Ac%TPJ1O((iu99-qxRb^Ltg|KIzyG*2z@u~bNQ z7MbN5V5GKS%9+UNy^TJ#Qr>*d`L6taJh~k1ozC*VKdZ(Ogo_W01x@Ybnw z-XE1`8#8WZBuTCNV?>qI^cb&4YT<)|vlRs+)1x{EsYx32u7k4;jXYfYx$5bVAi-gIr zCT+PT^~$wVch#C*D$Kz#Jwa|hY$c3tVs-k?;n^Fa0xGkg{5IxVsdc1-E2!|ITa{_j z7pKZTrw?9+oiDmSFS*P2Hp=Px6Sf70t4&*vF7VL0;O4(DWl8jh#tdew)w-cx51qSp zz0y)0z4+oK7>zbsJZEfw>mqeFs&}()>qZsTrN>`b2kz72+O_O#7Q?hf6JFjp;?cG9 zwy9HS*qdv8DHHec&%NA!cUsZD1uMAbyyjST!1a92#swPL_v+ur*8Rxde@edQqvqW5 zErvoNN=N&ia3u-0+!JKX)$r4={I)kf{p*WJInxJq6E`k+So_m>*Zgjy+@Ej%9%HOCII6*x9aO7wY5hwRH^oO1Oq|Lr3+5fT z{9Dvi=O_D_XZswNHh)Mxf1Ow7wBdZAZP!h-cD--9^zgp(l?#h^C2vh`5&v!OKgsaw zaw-x*vNcJWhTF%l4k$N)?*9=hBNKSGWnzRX!%PmZz~}UDnLQFKrJxe`$QMWaH`IE&hT{ z$HPQViAnA;5ee-yG%Me9O5xTD*;`^WHa)oh|5yGd4W7+qr(gbL-F{nFq*2dBhHGg{ z+}+dX*T){17x&@q{(sRolFTGtObMAVX@$~7_mx>&uHKu(XWURbS+-PZxxwKJXJ*77 zF8P%if7zt{{r~i?#1(dZ@79*>nUHuVS-xO-i`vV*$NKH|&*ZyRb0g={zq$SQ5`R>S zbhRqZwEFe!FiYBhlj>)ye=U1acjvF;l#9<7;={&ctxh`mB9x^$}CnVH0G{oq@wlx~P3pIF3Ba=)-!aALqFSeSn zx*FYBaDmb1(vfqH9TJ_v0k=-vY2SACe$l)YOLgr$Zf??l-m2hS7tC+=ykx~DsmbPR z`R)HqNVQEau0H!I$1_N%a%G~|jwN&4w0lf&98j)$H$V|G2WjCrM+` zlLrX}c6-BLdbd^aZ?Twm_=&&lGsB+`{?7F?{+?{|_+O*USC+~5xo1@VSg09oly=yE zr-#ABw$uI*1-*eQx7)vKUZ32vv1W~-fZ>W1g-j7KWBb%^Ut;I&`QP{^%{D$+WB;j1 zLAOqPI@dO*sa@dHghyf|wcH)OC`jtmh zQs3)eoR@EG(PH=K1^aEIKXqA|?ShqYYbVzq`*(!B@Q~u_tfm8fm1p){^q(2=d)u|= zsfPNS&RETfc_Z-A|6GAYh);XQg!b$&hx2|tG|v3Q`qkq@!GcW9mkX~O-a953KQVTP zjePK?nlC-a-|ta>VXt9#7%z5 zE(>!S^|F(Mrp@az(r}aU6_Ie{e6V~{Nr;-bp_`Vfmb;&!%PE~FQp!hEo=;rjStc;K zl(BmGg)+Za{}d-IlCRQUvsEHBBi8%GX2nxgZI{@RTbKjGjo0WZepk-Wt!Z8&l+oKg zZ^fi9Av>l$SbBKUl7gSVqMmzdtkjcy$+ykTdsgb2GmRJ6-n+ELA8q+=qi-{PjNTa>6n?h+xsJY`;qBEmzEa7$E*d?KuVcQS<4dZz z7q%hczR3y!gQ*tL@&`qx`b_L&@|v~kl(vD;UialLU3`m010y>agGD!KI6G+1eR(J? z!PHCN-6h)jx|@@SWb=iFWqR4O1aAJ6HSAcjo1ZmIJ#DG0_Dj!>QqKb2xa?bJ#Y~w~ zb<)xb?xicnCcc-{t(vk-$C&Y?V8@CT2d1rf5g_LD#mMe_D-XNotQfam%|H>=Mvso9 zx~S)w_d;E}xaJ?cGI?{b(}$8+Zw{k~WdTxC(rb&4mhDdc{7ckMZI-|XFOe0mH!YcW z)*^E4j@|pxetyw>e*V6!*ntx{b3(Y531;vcd`ql}d+e=u-XS#E1KeGB^1*bnJB7eLZ2)uMv!>&Iw$+_05J`QkHQcLZwHh zIOn-@#W^J&F_(m|?c96x?Y2EX{urCR6`RiF zsO=MK6s>D%ZNFGY$K3q7&EIF+EqB)FOqE^s;Qzm>SF;yBdG2{?x@YfS%^rrIau4i0 zcekG{-^BU7hVP(gQs1QCmwr!7{k=`!G;iPK>j#o0mdE+O|D_#wS^9+fPVvky=Y4zw zVybq1-FREFc;iO7qCaKrkA0)|wHGg4sgVAD>#~QpO}H$B*8N%PaI*RL)>&CQQ@%$% zZ&R{;b3@ZB>*1}oRTJD+Ur0}k67F@BT%+ktcw`Ez|Vk-4{FYEoTX-t-1&IzwB)cY)) zlKMl;bs5D{1mSltJ%!|Vw zTgiQBs@ptoiP+v*hc@!Y_^x{$acy`0Y<~SBYu%@NOD+Gu&21?>&?@z(L#pn7z{U;t zYnN*tsC%+OeS_tKZMIJ>?Kjyiy%B!S;>YL4+4qX8CKu#rxUOWkV@_Bhrf#xL<)_#b zg{N+rAyYPNn4#+s?KI;@jp~^bQ-n@QTrg_A>Gn{UMcznHNTuhy-t)BkE{JU|6keymiU}BPY==C=->WA}_kL+~lXf$KlqrIXh zZD;1iQvp|HuT8n(B)Is^y=7YMWmSuNYvy0`uy4L*aor(olNyWDgx4>(KY5XS%y!A! zThqkkMJ|>~WOr&cZelsXV%U4qH}3Y?wk*w0d5Wbwr7b_p|;1q1icLv^eJPScR-Hi ze)l#W-J6%#?oYq(J~gxSPDinc+RC4`H1WHI+tmHD3lraBzWq(y{%3DK3BLdH;QGw@@r$NRjB<&87Z@ba=~12< zqIr4U@zT}b)%?Ca{Wzn%j`1*i>x-UU@}Z8>UR{foX5LyYE3;%<{KsEfvBI}MZ*Bjh zzI6RJo!}*(I~MX*SJrVn(L9*^a%sOvTh7~k8{ZYK<>%J=SzcJ;cDaAmN|C>Y$^TX3 z^B=1$6ZMrfD!4&6ebI!sdyl)H zUla9U?($io8LZ*@@j`nZzxmX2G^tOs=fa%c#NzVy+h%k0#Mj)b?tlO1-2G*9)~cL+ zwSBSUiO?H;8}p~XJNR{qN7W|rr7xqTu9w}pEhDV_^L@h0Q#V!^^1ghV<}tlLw~Bwi zoRIRXwHLoVJTu|?e$Dw3MT}pM-Iu>%@9ApN_E%e8bXH%?x0Z@4`V;CLdMtW3&N1F} z^jP~5xo;oCubs5k`0AmmF>%YS$00I{PGq!hGrjt1%G8~0bnU-p_Do?V^#sdJlq{^^~!Y*)DWU(cSC zbA|bQ=k#F_%hQyW zy_(#ME{W`7;n8eb=^fLxC^{lkXxg%-h|Um6>(+~6$y`lc8LJC?+c&Ci)0lB}>XeVK zCT-H_(ERl2tLgUb*?D5d(>71qeOtO@THy7l;1^oLGmgyIJ9%T}la7PC`I1yvJiB)- zbCfiVm=(0(VvB}zW=#*vrU%{rGa?l;XKXnW6vn!3%am;icIzEAquzT;o!YhRtKiz! zJ0a7G;tkCmbFWF8%=&Kk!^&KLf6BKfg7^P@|5tnJD5vuEwEE2#*k^w=k$Y!*AYogk zmFd>^=ia6=RK3$o&TpBOAXzBYxw`uGr`-7XulMdH<=nrp@IwAuUpc#z5~W{exXO#I zuCwC*t+VE@Nn+NvTFKH6D<@xGak6>7()P*9EB`*WZ@J>vzw*kGoT>{IM)w|mu~Iwy zrE2+t5EcudgWna_zCGXIYV`a*IoetY*my6%~!^ zd7Za))mUO~3v6Z5UD>f#%SyhuO6g)$5bG+9i;-;S%&mRaNvv?Hn|?#Uc&p_R4}}MN z&Qxx>6);t`Ro9?Zt?kI!yR+Wro!<6x$K5w8R+*+|Zg7)v_TsYcp0P=7a?r<!mGkZ(A*28`Qk=n|Q$o>r#Ov{`EP%E6p#x;i=-<$h7duz1>q^?*Ep$s&5%%?bTw9 zjn6WkoN%5ot>%~hyMT*U^S@$fbcO^gPmXZ>PJ5NVC>c&X!u{}QLTHHbja;Zk@p|eI$Ss16(sU?j)wBG zW4kZ7mHo?7lVZ_K3R0=GjC*l3cu(@)+Z&4;)!4SJdtA0Vb$j-PRL_Z(0+-VAX6TFM zY?F?QjSZg0>Kd8Qdu;cCpG%isndNmp@I*;!Dwoyu&I#G;T0~qs`E@r6zbd}|uHneK zOb@M#TV>C&?_qjw8_S`R+^HtSDdKvt#%_78RFa1Z^Vz)Sxsd^v?mtXAkg;$^{(Cc( z_nTezFwBn1u6h0A(d7QXTOZEx*UdeC|Ce2=Wx9m%eeJ&F@6|bNQzEa;@tfr$;ps8y zH19bFt<=R=9+brLwtHVTWl!ADY{IsAugsMzPudqO>)-Hw@zd>9nytR=eu+WBGTu#p z=gKem)4smsK}b={h2S}=C$2x9-5zbFv-8dL#Ba<0`x&rGOsQR#cx|FYazW8?k+ty;nF5`9jtIG3;Gt)1bKe7#bG402>joIZD$vY~3o!fCw zpvU9;YduaifzWx@mY(X1xqjAmEu3iZoP(`XD_PB+ch;igzlwhOniz8I|KgYBud<@w zV%ffj33LB#(!RS&@yN^a?{7Gk9jiES=+~<2D{h>4z)@Aa*M4&PCxy1_vnMueEMBAT z`Bm`1L+j&@-<&Lvw|{l}F+cyDw1z_Aoi=G2U9ezKFT|Mb(^AwBJr|h9`}`zzZkBdLK*>D4tt^7s2QrSX*57|*yKHEn zLl8^uidB-XQ}|+x=LgT5lW=O&cB4%iF8Qzj$}?#^Z`*8_CEK&nJY=Ha^mSJhUC&8B zpLkYtQjzdujxFC-*Q9)uJ9yyI->=p#clNjZbxO1Qmi+XI_a)~|c5n9N2OpA|T=nw1 z|4cUC$E|N8-z#RmjMy<>{@lG{2~*i1E@g?G->35UyIy#_eT|n)P+-4hSM}M%%s*zo z9%a7Cw(;WBwd_q@F(rsiajATx=j!|yQ8#-hE3rs!nAGIn?vN$BD)&b2JC57DZ=bb& zEo<(cc=V=a;7N&~iE-jVL0y9Hqsm^J#$Gp^eSXDs?w+XvyY8;xT(|gUZsdCNJ$rUN zT6}*0lgr`jEB8ijE^KO_;mTs*2gBN$pn&+LhEbsHZ9JFTP zmPZe!eQXKger(LJY|WBJJ(eERisu)iLZ&h}@$AruaDHwx_wx>c4~Cbj*u4amSfoGB zw)U}gj_xg&oBuqYE8bblHbdEI(=L@|C$6p*FUfUYDDwGcPlorZO(|hh-!v_*`!b{4 z{*PZ?=lkhp^2gFuG~VAh%lCSk#sMPje! z70WDQ*}7i!qI~%&Ip>qpEhK&hto4|D-p6asuEIb?!vJgs!Fuyw_Nq zdjj3Azf=+FzcF#rL;(}mpf5W=8w%bMdup>U_v3BTg}DW1`|_$!=WR~A{BD89imh(p zmt-^79?ac-NV%i&ZrS0o%@e;p^{Wfh5C0*+v2W?koEy2@YyLguw)^`@)c*II;&t1k zcS%HSZ``%cxQO3Q<(*md%G=fcXFki9#de>raC~ePb^T)H>AP+f{Hc+FH>8r4V{Zp0 z8niC$?z>=>Xe6aPC3Wr1ymucAAJiT=+Th=Kt#r}z6)IZ`E(*_e(qun(!9*!P{sz;_ z`JF)zH?mDx+CA~;nq%8}&sO<n4R(lWdTxzb|n`Tw4 z|K*nZRjqu#y=!Lg`7)#I$=3`2*IgH~e4^_&>5k{;rLR7JU}TrxaE{Z>tkm%E`CnQu z9hlcOjW_nEtlD+)dhUI&&T=D<%tp7PH-5tI#@b&s9>j-vUzUMC9 zUjAq5jHFk*D?KO4I!jJsi$1Ty9=hn|jqOK|Nu((LRA}0G$-F0sYy0h!Ys}>X*C}tC zo4|YSVvhNp*!aToYUk-p>iu$wX~wIT`pgUCS{Jux!CkXA+pOdERGd_wU)Sj0x%|D& z^XB#9TRbn8@?GC%a$7h2`ud+g)8juqdes&_TX${o4i59zvhuaxW=#=#e%kW+Y0KrO zyCMUFGy=E1oAdbT>FE*CPggaq(9Ye)yL4+#neVkOgBF&}Kbs!h>Y2@v>8jkr=Bq3^X+lx-mStzB%Eh?17D(;!SK^aqTD7htP%ZYgliTT|6K<@# zekV3Q*rNUNtYw)Rt0pDrTwSdG=WYEL`zO-(fAgMNbZW1tRe5>emAapD$Ai8$XntLw zRQoicr{njDqz<*>U2>tbjtD>gb*p>XW0!_Ht}XJ6V#~8XO`jQ7`a|l;^(U|2 zXfgHN@%zs{bsgTrw#V=H&QDh{@Xa@Mw90C-^l5TbtIPj<{qN4NPpT}c-kIOM{P+5g zsV8}+C!h1ZQyUa;=9v+%rWZ%flygc79-D)oyI6X7&b(M%$l~T2GRbQH`zWW|7jn#V zwwJFdm%g@J_vxCnx=l%Sn-ihG%ZKo|StzZS%9MXHE6jt>2j|6>}+Oee}K`pICPvyUbc}u=wjQDd!|Z z?Vk_ss?X7XK7mO;KIY<9S@qMxGdWU^SW0Gd1iIvI-)${8{UmcI*V|9qG<*C!O3v}$ zkBto7c{Ivv+O>$9jLh48Y8D1YI%--5uAYK6hCla&izIw%m~Xo!uCXn4bMoGs0n0q5 zGx;4%+W6$}`~On)|Kw#sACuRG7zze?q6FMsFU zJDFQnFN29^Ra{=Kiczhogr(2(xp&??=r&@qIU^=x&?dMoH2>kBZ(g>SFFj*ysCr*~ zcz)EWsn>+09xBY(r1ZpX;US5aq9;nv3nZugbY1lR!a?B}=k2#I<(X}{+jlnaaNc&+ zNfws&>6J>slU;;^0)G5Fs=V+2VfjrFb2r^CoinGNbF<{>?qa7F{rEkLa?4_3?{0`& zf3sB9`Z=fP<&wVHyLne%?Yb;Hw>-&Ha@MtpANK6qyZGkTB`+>Y_?_2FJ$9tVEmS1K zW$vj6?Vyi*yTaH$WUM{l7Ba;%P{sH5R-=!nq=W?J_h^{7`rr1PU4FT$hG)l};7cX3 zV!I1B+zdLOeQKAKl5zBuO|R7z+a;AZYs%GsDE;^F{~!D0+Ujn@Huv-MKK_mW@2fX& zpSNkWkK6sP$&b`yk9Rmq7j;=*6;Sj(xq8cbxoz7sp7t}=pRn(X+*loR{O^;Mf(IqO zZ!@`BemOwt?)Ht!-Jd*yuO)=OGLQ|w5qJ07i-Ub%TI*XidByj~&!5ZG&m3ay`C0x{ z&ApJBGvea^2TRT|nirk^;hDk(FaDiZKmN9Ed$;f9_s8#lb>8}l7VW!BHSS-%#!hMqONwZO>i zO81dlRp)-+|6{hf>fG}Ab;n{aUt-v%vvTdym~|CDUzwKQUVA5+Z9%fnnRMfejUjHo zgp8~=YnW(?Zc6Yy`0}J?sp6eBC+E!mH;**)^(u9n8WH-$tYm}N z#jUcj&ogedEz7?7_5U}y`9jw3ZZ;TtO*#3fRySggLAFWS?(Dlo#y zr{?YK`_J|xJZA?{iw$s0Db^4W&;FTa{e#OvABHZJA{D~bcr()by zwOv)WJ{MWG@{owQ^ukkrdq4l5Uh?pT`{u(F;yRb`ANup>;Jwv*7&EL*x&>=x&)=IK z`R&i?X7er6Rc(Jr@7!l7EuGvJ7d=r?*K=k5lUZA)$=|u~WmDBcU)#WkviD8@em874 z3w-O(xm4$A&Pl&oMi-~qn&-lLblq4C-s~~>JxAO%`8wC^i`ILJ@7%jnw0qyun|Uwx zBnOIJ=@#9)B<_T&W0Q;Af%ryGC_51zhTc(Atk1wp< zp1Akkrn@;G_D#NhX=l1~qn_^PRVi`TuedtSefp4BXxsGG#4yR8z{3XjC%6Q~WjbH3 zy7g_^*>#CKZ4!4{9JExo-f3tO>wS648?)%9pe>-{>Y(eYY0kBji|OsnS5}5h;$0jsuhna|)xNyQ%H7o0Y-4+YB_Gdg?SMnuZ#-%JX;HD` z_qSDbH<|kk9u!Qz{37xHUjDsT!v8&+m%BX9>UG5_!zo5rnV-L4?%aFd@AQH<;jwDp z%TLtZC|34ryfmd-wOnz*9Ce{htAaF3Qd2o4dwSL>r+&G+o!73p`St5;v)9&UucP1P z)aoeL3rETUZ7gh&x1z(+W#WeMHz?t+dx$f7uZdrG@RCe{#NfI*K zXPb5%sR;|d8act`bz;?2vo@z}uWZfUrQ2ASnnuhu@UlzqU8dE`({u8WiJnu@qZMx{?_y^@g{;P&*CuS(X9ZPo`RoEGp3ip%c4c6poJ7EwFr%bOT{5?5|rWVSV6 z>E5J`vmWnJmhxRHUUHT%R?R0c=&G?oXGD(I3K6v(H+CF*zt(@L(FTdnRu?88y)>Qo zSiSZyjm^`gUx;4*y~Cw0y;z%Rukwl4nI1}4zC`d#9%E^?NOL@{m4Cd>+;X05#~Z13^gQf)`~{M;&^Bg5eRB_+kQM$);?gFoxr``JsR zfA-hr6g`pQ=}vm@`0Am@s|Q(ak9~GXY<_BK*YHX9V)r89$nQ*|oqS4+l5Ua(zRY$T zcHZ8wZ+B{S`SH8I`lhdsyZCdO`{(0l#8&$hu5+Ekda)uvWuiB8)3qPR61lt=ibQyO zWKS`CvFb?cflY5S%A@DS#B7R~v*Gh4>5FCa^xT+~#G)g-GkK?ORr5CsiEV+@o;1?%&jJcI9hs6g~NISiar-iuC@Z_fM+h zbN)HMZO?O;W%~Uf<$U}MCzZ?JZ@igXQTlb(>)oaq7W*sCteLlP%hUo%UoWXvwI3cqJKsh{=X5fZwXXPa z*6+OM#mhTn=YGF3Tle(MIjiP93|{oL@oN?Hv4UFl151Lq)(WR8Hg`^0cj1K9ncikCrz4jA-SgJvdPZHW zboaPWrP-Y))y`ch;2+8-+8gJ+Wlh$pO@~Pm8En_&a;p4ljr!H-n;r2rNUAIzy&HujSznbdD$A5nHHGALZx$le0zIAMxB^bQq0-J&5uL~KAGj6$QF=;+ZQuyZd z%&o;^%{tDxY44cTR6;yTE-vnxw5?c2-22uxS(oHnW$ac-TaHC}Key#_4V`u=eS+#M zj|IIQ*R*mC!Y;lki%9K=*fOmwW36b}vYVxS)5EXNnadd_w8z3JByF{n_vO5g2QPnh zE;AKzTena{;aPS0y})b6F+58aY&;fp)9Cz{m=2kJW*Ny7Cw|Sk!SQX|E9LBBE#(!P z3f|pwcZk?gyTr#SQ8KvgGAs>yuAFp=EK(f4HmYlQ(0GTNLa$I@T6+j zHLKUITo;z+PAbehII(BS+d1EjSdLBG5*2twG<2s+xT>AYEnnx&`xbAIde5Awr*$s( z`oiACL|)(LfithgTrt&BGka}%s`At(6_pPfTXb2RIT?e)e{gKmFpOHv?S0)eXS;OT zXUkh!YqSb{oxeEBtoZ(@L?mOff#Ft+W`-RsO&3q}h%20Fb zoBv;aBs&?}?|pD;ip1L`VR<}yrU5 znQp#1Y1vByyTYJwo$_MO^gWXW_7_FQmF`x^J>R$W195sOS? z3nGFaIVEk3D5x%W&eV?Ex9`#4T}$-1FG#)Dy?tdt$f6UEAJzypigxnZ96PaOod~n$ z7w7a%k5VQz?z89xsXgK@q=CYK$&(ix2Gb`JCl5+oH7+Y~D?rnJsXMf^^hS%3O zUOLnwbGyb;Rp_PlhssIIVarI+OFbf(RdRqs`ct!BM_cUtV_P4{v&xVya?1r};CX}TR` zb~;quzS1ke&Fy%gLx)Lh!p;>hcTIbHE--v&^G0TQ=GJLH#n-Q2_v6Fs_mgK$JE!t& zs_N2~e#UGQ*DXw1TFv2Ii%bM2Rti?Wb9FM9QyI#4xWplFnvwG1h?mP`me1c`c-#6{ zmzP&RGef7)!fAVZm7e{-x_FWC;|ntlrQTW!8W^d4jT62iz<8Wl**?L5FW~8hdzTxk zWvrUp-$nWM?G`t@Q@`Bm-$V9(F6U&=f5uBqg6u!@dTILTRZZA<%lZnV#m|HZ=3)G8 z(el?0?|9A6-}(Dq(f?n@^B>=MU**?4OC+WJMZy27?-!=tnY8-!teY=Y-#+78Jc%LQ zN-+B7)6#iawyU$blzRg-t;}xAPCq~I)4$*EgU`QSczDC6X=ls4V?$T0;mzDS@nd;c z;tcLC8=hrunZ3H)O~oSTf4~SyaUoAD&WyjIu245;CFx@^IwV~C?YuY{b zNuOOrFGl^cjp^7Saq~^t7Qa=}x3?)OO=aC28JuHKm7Ps5Ax5ph1 ziVN-f& z_4~Q&&No-Ti7(62iJxh;=V*3L;9K+Ht@7)54|GV`%ska|bmPP?0sr1^$TH--e_7() zYCGQx$(yEy*b90*{qp!n?6;yU{`)t+tn{DrG2F&@=6?<^(KT|mOMgBRueg88Pjczg zC~fYIlXp&aa~9D%uxH-JIoEBf{;kugd453RR$BXOnaxkRu9wXSV!OReg2S;hVa++N zfNMb_qMD7GryZX!T#Y2a0&fb*`jhrCBb4aRLk89g)-PUUYb1Zg0 zaQ!Uwu)0OyyUL@aB~;Ss|n5~YcBs?b;C||e|`R}Ips-)e^d9JEqb;? zdCTPNyWWc5q&kj$zI*;Ge~H*TQS)UB(&A6q@azp{Q~sTiF{zE`{=)*r_SD%Q6Fs+F z{T`$8t8wS|N{-+B3)y}8_f>7#v0rKG(!;-hKU^L6xO%#H|Ib5W56YLQ1W$CyJF}qV zTzf3L;-)Cw53z?oKc60Bw=*G3yhS4Ne%_9oYcx-FZQl0u$&(hnup1JA%T5HZdK&j@ z>+DGd(!XBoo#MJ`%_YB7ddqFkh;>t6SZvYNE4@&;YeGPv@p`cx7aF}R#5?`I2;~HB zx|g%`&P_|J_e9i;azR1xf;*8v!au`EGHhQ+2;^>HfdwR^|FXy zfyaF__7un@Ey}e%ae2RE&)pPRkDP;5o0rZy`%y1Jo3XC?T5@EF(8gK&m<)KPES7&@ zln{TI&8+v9y4n=JIZVPA{xT+8*Sut&-RHdj;*O2)+ULJ{@09GBXA@xc?V$PozS!k& zCw^`eC^_SCY2sy>(o4U53yO@xnLkV9lgUP}2FP{Z^Gy}q1l7twY z7MQp_i^)(ndS^GOOm=p7_?t58J*Q;4d78HNPXCrO|HYgS+-1J*uVr$de>iyZ$(k75 zEa#NnxtV6!yMjLdsd3#IWw@H_*;2(>8hk7`@S=KehOS&EZ8wp`bhy`WKg=gG3&JFLEa zzPIgCMsikC%leZd&TF#Rz-XVVMJCFC*4f{SG_*M5H^>?Y=mPvLGQtqAlUgOH= z?A09gMS^e1Vt0A@XUw7f|2EnMJeHO7OOur4{>^T5S^C}6+&}B89;81uJ~4UUmS>-S z{;v7>id#Wo(RmgR)>{EnOx+s!1Sf6yHBabfuJuIS;CUj}x9-lmzJA>gbN%&}duvXu zulxVoruLIXd1Tzerk2y^DwWux&t}YKTV2v8C2~s2C)3a{VbUUvo|add7uQ_R$$Nj} z-rAkJ_bvT6Pp#tClhgxiKId%HT`L~7_0p`l+&Qz`j#)2^c2Cs3mnRjMUv?*N2~&~f z<(jwQ_D}9E@2~iNGx*tN$*@LS+lBLVQ})!hNKAcUz~b-Y7-Z|!j@K>z-L(H3{%3Oir{6I# zF`xd-Ri9&Tl^%L^idK+B??%?t&|pzjLzc4Jy0;>BUGq#&&bW9gX)8m#@9j;o_b*zW zUsqf)Kcm?_@?vDkxsAnrU)LQy>hM8stx4<`lXIKD&YSzWrfl=mwCf9l4l%7h_2Ey> z!R_`H$J*oT=P&Qqi#(To>X5;F{fIN-N_oPv3qB|cO**tx<<`{5+Y9p>w79xI9}+jH zdh#+-#5K`))!Lcs{XWAOXH?Q93Nzf~A%ge_tN+T|J|M%K&T`9u;;Of1?s_=y? z#njK}$z81dSllyh?repaHi=f(jDQ)Nj)h(7N%6jz(G%;QC?ftm-KP52l=z?D%75HbbP2cYS zjMw4edw#$B?PMC4eWN*AWCq!!3xy{k}2UYas><_7NY|q~J^<0sYE$F(bqT8->iMg5!7BR^ShXw|Sn4Wr~dCPH5 zWFq$zqc5MGe{Fi8aCLeWpUZl-Wqr4gDE_-PUGcGt5cBM!UFk{jKdp*-7FNdXRm{J~taiWRz+ZNYToo@ZzMZpfyj=2Z0l!NC zTbmMl`rI((zSy@LD+<0mtgU`~uVL0dM|+mX`)u1ji}ouq2k(0Dad-UVc}Z zCe505@zb^qDvKQ?Pi;~WQ*G&cAmuUfftJ{3OV`-Nr!7;rJ~+(3|0KKr{7)DC?H*ar zuRXRObf#Ok{a@~X-}3)T-TyH)-$+|`e(fK_{`q?kKYG-ZR(o9C{&&ZB`#)-*e{x-a zyJPRZM^DA)fBroGUrYY~SL+wAmgMxkowIXq<=N-+>zrc4=fuTqxR+D;^_A%L+p^QA zr=NMvbggUlZQb(OvIkk`O=VTz+~t0n^}W6I^Je~e#dZ6hT>Lr7U0ge@v@=L^b->&O z-CZ+U7Vf-jnzOsl_wt6j|c`V zGrwf<=8o2>yj7~dq$_#3mib01?YZ=RUwd8Quh0Lq{g_IY$t?-V__AZSzn4$&&Na5n zXY6=C^ZubopK>nCvI(8R8DahN7f)9&Szj)3)?h=3WVd?K7?1zR-Me+s<6<)cIM}IyZa;8YMt|YZewMi z7#4ZTOJw%cjfdGTZL{9x#uAm6XMQKQJm*%}4nez38d|4TP5M|pcZ$K}AQj=4Guv9X z{&*4SIHPy>+gVwKPLZ7b&P%RVS%yXGUve;g_vLYwcXP+tj62FdEY|MgEnD38Anvm1 zl1EFANb=AN3Xg3a{qh5Ielw?nk&C^zckq&i^~xpOJI){}21$d=a`&15*!X zc!&jG51F$mCwkRSp*4qD`J)6EJzvMWW&L%VeKx7POaENl|C@W(Y}0W2zcYS)n=)DN zL-qZiV#~WFw;7da7F87<%dt$hGu9Co^_Pn;+7y*AwPW{*k}OI0=ds?qZ(lG2<(u2f zlCPI-nR~q5Au#IYohxlmQm>`nvor`x<~sc+rBO@APHo!hof&CmvR|D7MUH-$%I`d_ zoz+Th&*DeZPkqWuzMI3v=a+ip8+Wn$oI@-rQ}%8+E^&;a=o;q4SlDYKn{qg_vx4AC=`(anPR5Q=_3JG5RC8C$*Q=4z^ zUeL)bQ6+b5U#H`NrSD6_7Ykk4yW8I8ss8M!CI9?>r7x`fbME?&FZ%zd?AUiqwcnJh z$5DEr$o9F5P09oURL@U-BR~BTTlBOe4BIpggv{Bu`@oH^uie^a;n(*Re`FC>uBkb? zey+{q&tG-t|2epSv9?M5pT+VYcklmRZBzA6Wbu?UYkMZ1OASl(|GkZM?aCi7`|A(Q z|MS8>LWK3*x~DH|j@JKaeqR(cJtVbp(=;=dlECC=VyBvpzT^o>DGmDk;!Dfr$)c%& z4{z(PD~^ah@j>dnC(Et3ZLeQzm(2|^-}S(Fs)R?ChPl_5m7I!;e4So11&E|}ov{D%{%wG2%>wSCS#B$;_n)Y^ zl~VrBJmfE1-yL5o4dxK=cO!@^1cn?fo~?Nss-0qM`c=- zT@$?GshP?+WlOp4qn2ZRoA=5lRLKe(JU7^LYxnUzerRfrp<4Eym{3%dH1yW|32S;{`qt8Ed}48b)Wxq*MGbJ;cR|g^XbpU*S4G2{5$zP zXIdpx^7+mj(yRa@4bsKw~qOek!!GQ!pR4>E|nU!Y%A5ZbM*=i&N`d4 zbIH8(uJ)T&Xs%g$^G=XR>lCKVHpTKQS2=dB^w&7VIA!Uv(ix5)_MNday_J09PP3U& ziCf?06#-Q~k!%+}o<03){Ued86>nGD-Tr@%Pkht$+4CxS;|m3kx81&1&h=Qdcj-mW zs@bg3OW&ICs;HDkSV^tR5xG7^_?yY~e}DhZs51WfLt}-}+GhUvV+`qucj7gI0V{(mrg&ySn&m-hZ@x+Sqt(0tw{t(nK3Sg%=^Qnjfi65x>gTVYJ#%VCQS8Yq{Pgv-(`NMlJC6 z4GcF~xLAXCsgPQ7=-Gm`hqqe`OmkuAFv8`Et-O2SH#&U-&f1S18|MK8@bv}_f?+Vx5FW4Ag z`r&c^iuRc0Y?hhR)v7-nQPDb`U$a4Y-TCW$lNQ--J7Lk5|9-VyN;mIuiPI6k51jGX zUMGCu^HhJ;K8*uGCubOf}8UInwvFRoAHisk2#e!BbU#HY{r$-o48Z0p1nKs@|*f=6{Uw~UvP%3li^up|JP_vn9zfRzA3+AmwV1y zXtXn{XPW$vKZ*u*KX#kX{d8hi2>X277RD!4$IkcWUVr)E{k_6(-#$;6{_3FHFN3!i z68HjkSKGO#CaCeo?ffsll&5oozqPOMqrJ}Zt^WM8x3|UjZoQW%QW^4i*9mSd*{|P^ ziyxMlBUA6!zV+3V_s{>l+->vk*Y+KMkH%jr?K>qU(s{1hOEs$Pm`BMnpQ*oPgtXk8 zt}l9J<*msz!@XyLX_;m6*Mr5oUR&Rq%{%+7tea-UyrB5F4K@FFp18W4Wu3B#?AvF2 zsXSM2a>bWlu;iI|_N}hoX36q*(`LVIn_ez$w$k~$)|)*?^s?qO>2)wob`6g5ovV7o zsmJ2_!({ta`ib7NpFXwqy}T(eYTb5gGhc5HPqxe7=1#I(u=U_^8<%YxL|hM^e5rXY zYKz{=Q(cj<4`aJ;=LWQ%nG~S)@zq!FRYx^f@0@mUziqy1ul0{Da}CrO&0Bvv=o_8; zAnM;!V3k;#H1}_w^}E2#Q-%{XL#ksss~hhB|39JSFw36{cN!ggJRHv_-`G9NFs~`m zy#9ld`s{agl}`nhRs=U~{$EffqqM9etg8Q|YQ684Usqj@Y&N%Uq0Fh)N% zd+iJBD*YMGpBgW9JaaS=d@8Hq{i!j-#542F$vG)Hj?%Nj!%bf6-hLh3b#&6z%f~Od zh}z_BKk9b&U0Sb^)N|%iQ)c;qi<|fDe*Ef}>Fc-CR?p7P+a7IpF?jCU3!9m|4(nM> zTzmSEz9HMItX5qwM()W0(|dITB6h7i`?AR-?yc4F*SDh=x@fy5sv@p_EXL~Zl;%> z!BKTX;x=@eLA~D;;g|$`4pvjbAlr}^_K14DYfT9_(Q(x^~(A8%DE(){NK1= zbWVOE$hzEaO8w$Mn-8}>+iCurYIAQ(#TN0}C5#m_?!2vAe5HVYa?T?A7Yqh|>r15k zzgh{Z{Cc=Fc)^!@m*tX9z1e!D;%okI)m1AxxmG>3jQ@Wx|HEYaAGJZ76=!Me?hKO9 z?N-k!%vLI%=6?5QhpC_w1CQnwiQorC8gjmjOPAS1PwF^w>O$Q8jkoUCuGVnf*D=Je}Z_w3ubn0w+3rE3{AQ&wI#RN1oi$GM9~JziT) zEA)x# z?Y>gLeD<^V7lS8eeSfAsO#4-K?Q%l>?$>g2u2;kz(muKMCA+z}rTJUaH*IWY4liFi z_g3qDdv_$P{POl)8xq$aT*b@pwCUhg={E~sUASw1_}i-Uhuat1m%lJz3zDOdp{095PwK*2NhNXl4|eajaE4pt-k$blm4^F{MJYB?54qY4SyMw3Cnav%?!DPY z!OZk%iSzNxp0@<1ap%SCJ8@N8+;UqjQ#NbOmYFrv(u1CrrnULkl}`Nn>cYlobL|-s z%cbTTZVf$PQzknjbA#QroWxwy{iX}{{`$V1z2P|H1TF5{QXR*#Zg15~30xR`b?ez3 zjNgAOIJfax(Q~PSjZ$vwnKi5Q``4s7q)j`j6R~=C_47Du*0cYL`QLwRX3+a@Y;xz# zGUJ_E$*!`=L3Y;s8{f*@pKxq$NXD@>anCREpI9?z>A?o=%IEC$z4CW=o%?jI)GPOU zFUumqqbbtD$4=IqN>Mq|w{M|FN?Nn0QtPvvMq@GgMK1iF8LmZ~cK>h9ikOlYN>>f}R)S}rlF zY~GhuxO^Y;7=c3FnBP^FMR0eW|l<@4FQpi^OkUsn6Y> z|J^X4zN-CZx}|;0K_)i6RaY*zy8gA{Q~|d= z*KvC;$=H+pznBw)rbPC8mYte%y#M>t2It*h7rtjd{_b?Z%IfuV_Bn3(b%m2B&+)qO z{jXsu7gjuvF9|8Ay?pnpn<}eh*Clru^>@`B?(_Z_Y`yk8_u(#??JI3HRU}`h$tJXZ z5mDNh%c|qkX?EgB&ZOlYoO_O|`LD_TQ{%TeLSXOlsEOtBxqdTq@-8ry`p9gVmuj?R z)1nzZH|>fit$lnvWt!@=)XNvH@M>1hX?&S+X2~iI?oRWyt%0F|BCR1jCb3c1czw0C zuGzW1l32NSOLn!6qU5Bhg5P_;FPiqY*8JcpvA$JnX80{v;R%g&^m+6C&4n}RS2pi- zne4gEZt^6)KU?42*|T)1Sv_k-D8&D)O4rJ!ZFG+ZF}|lyVDMTGwKiuyYL_`;IhcO!#M0Zg`mm%w^LxG~K z(>glmol?yZYx&8z#dKNj#w?Gu{3?%G?r3|xyq%F+Gmn#TGSlV2lN(=75tf#gxjmz+ z?Qx1rqK@DE_N@kT{jSv;*QAIo74K!8uQ1_*;)P!g{hiwcwaU(1pSI+o4@XQ;>P(;I zIX=giNUV(MG~Q7CTWoW)?X=I9-AA2*`mcHGw_079u^?{S9E-wf7b}{VWm<0Bd2pHb z&-j1U|E2$}|Nq1O+1J_T9}~ac{KB&2s&4TOE#2nMIR$sO}^Fa1SXU(%$9xh93}xMZlsZMI5KI`rhVV^ba<-)2#pGdcOOkdrfG#N-0E zQ}gv))lyHog&G-kzV$pg^DXbWoZP~s>SoW#O_u9!NO*UDEs1&M<9&LC)`~CouX%D` zmtL9k{>hu$3VS6Z3yvx`=?Dd?Fip#FIl8&%(VbI8M~*#HOHI6acjwuA=lB+89$neu z@#RwRqcsPuyaTx`q@14IIB6U***9p??!PPh|4Hdh1r09j{&WBT{r~cDyX)qLd9Rr1 zD$OtXbb`nH;M0FzY!%4+^?Y9V^s|=#3{IRqozIaazp?B7xjQ%PBCfsFOD=ETf4t_+ zxx+7i-dZSoqEsaRXJ_-*`Sw3fOqP1$q&>g(%1Qn+X+MhpJ8foCle>4+clu*hXYqBi zlH1gO3EY3uvEV(YWQ1L9lZLr2-<w3ExtYtCOx`+Kao3-Y6!+3| zMsocujb&|zqGp*r$WiiB+j1}2BPZw7oUXNjo%~LrdaEX-?tP+ACFr$L>@iRG(Wayj zBQ0;UWx;NjyF`S2g;TP&G0r)9+~IB&UmAB{Cl}K!z3FSWy_9BhYkMEny>;5f5+}n| zE8IlSS$z9eeq(Q?bo0Sw9p;aEYB)d#FtBsxy?^r{IO+Eh&s861v@|T}xA~wT|L;Tl z&r{R?&9VP`*nV-Y@c)1Nzwdu`XyxRPZv}UjdmcF;_NMD_eD9p!^&TZ>qn(4_MhM-# z@O-iP>BS94{u%SHZku^9Q|9Z{=^m^(?-w;6}RJllMM_2sGjyT8lX*Z7_)SG{{X za?QO9U+=F|$;)1ULEzpkIUSX?d-d<1-nx9trMSIi;_U4fPc|3@SRAmMimU`1fXLeNZCXXwVQtxj2F(V^s0dM0I zna#_Vx~7>`P5q+pu6%5=;Nw8oNU=LNcOHE!ZT?}Q;t#hVj`xbHd%l-sW=;4hv3}1V zuI1P6wt5);HSzhG|FS~Vh&13ERkLLgD{@=BFcXd#BMD(QQEqkM1 zx6dm-RqVsp{&Dr};|@I;JIdY({kV7e*{AQ8*`9~j?DEenT9x?a&Kg6h#c9>AuICiK zU=EWqyR@+Xec}1U@+7{qFMHMn@0VTl^?S}g35m4tAJaZmy6-ux^0x8C`DZT&}892c!O>Nxso%cDex3(x1bH{KF$pZ&?!>ean(@#^n(AF#Inr5X3* z;dX;MzwQUNC%20fs_^Xhnv-mDBBpC%KyR?{hII!*`QA$>y)JZhw48Kvk{kO8HKB`B zLxN|{o*CmAI^~CkgW|=>Ned*xg>p@J*Xd-unkAsx^da|biczAKoblZmN!-Ub#a%Mt zUHiR7gu`&soQ1hITR(|S%k_TkYHB03!EegEwNuqrFDmJAQ(ktN*XhHZow_fbH_w^8 zh-t+#g;iVrWY`21&ER^ZH~r0?Q{Qc&Pk{3=zS7yHd>-GPTVA_UlFRuHi zntq9kEM{)F&vSx9N>|47>9zHbF0ig`sQYVn*SIfu`-b)(&gsGKGo1EI-aD(A(%7|l zef{4j;YDBiep>8k+kGOo-0MdBe*=qSub%U#So~(6?&$H?_4^6qwNpjwx9oD;6}|h> zwdw<*k$XM@0DEGvC`@asR@qH-9#*%bc9PF(<-ISFwZ5U0B(!BPP15X_mOKyXh*4 z-s4KUl7!f+cfYxFuki)vKE?yH7HRMQDWI7=C2)md;+m(YzP`S(De3nU$z#&TcYP}C zY0{i)QPyMp{M@GE&#q$K%z5$qkIMhKDE{*U`@Qq-_kXg4-t)bt9qazH!CCi4d-9Vy z;Yim-VezH?y(V9$_FY}?=rnO9>#fQ;&sUecWq$E%x4YyQj+dQVMQsn95A)Y}?!nAB zNpFsP%(Lhg*PmCyf+Ts5Cp9f}d3}oaicrL{$}m@xO%snjblmCw#?Yg(O`v4o$>uj7 z0#;o2Kftv3Q{u8>xxeY_|L(3jC~I*0Wuip0VVF^B@P`N1^PlWfpO-RGhW+%k)W7sONak_P#)$ za5ct9W_!y2bYghjV1C7Yc8hEOfYOiL7Q})o+Ow1&3UYE1Rd)e{PR|^z7chTZ`q^ zz0}dMxv}Kh^=}JhZSu4JR<~#WyYO6QmBt392g@JIw=JEV*B|A3G=q>eaO6iYtkjP$D5d$O~2bb(3-I`=%R=0&-B0V_->s2TX1tllFVz5rxRJ0 zEAQL&%(wW2{<;O$*{N6l#HwvNa$~jgSLy#z5}WvT%N^7?TbUKK{{5YnOY%BiMd`ZV@uAH793W*y%6Xv}2Ua~V%!?A-ie9DrL(-wOq zGG2=QZZCe;ZP}Zj8Kk{g!$~12Q}{;;tG=PY zq|}>N8Wh_+9?G1Qj0p^ws%q$#7qkE5zjwK_QhR*`lUvVd$4(WR8?sbjaaRyWXy=h^ zas6cX*>iS(&^VgneQB!1mq3YE*No?%U9$JK!w21a*LBjl=hc2o-S=Z_{zv;??e+bg zZ#BQx?x+`8vv1pxYtwFVo$GBhk$7Rl^ZNazy}SRVUaNbt=+?Who<{z$>t?O}Ex*uEbaSQirhNlYWYOh$;6==Fl zM@EgULw9m7r^NElhPtKE+>EO-KiYLY+&=G?ds=V$HI;AEd4G4$x*4>g%WHY??n6SJ zJ?_bU^DWwRz4GqtIobRAdc>LMM{WpYmio+d35ncx*J|?ie5TII%SEpf=5zboIPToo zsu{XLbx}>f$L%UUzO*X~RhN2n=;q#j)Vw^hYTuu$?>}5lpMQLEn9;TEoBMv5?)vv# zaaV4b+0*UamVDv<=2FU&r(V03fBo;2^VSD1UfcJ}uR5Pq>ads3gbR8ugm6v6~)BD@^cxPVyUb=+0ub{2j21dv4mjYuQJo&G*>u^G@jP3Y19wE!rwIqcBNZY>>=M1wPi&%heAcSX?*1;1;X6tntDSz@vuv*L zVu`gpOlC)3cxrmAG@I#Hw02#zUhLk3&hIPum&@1moV@mNPf4eu(4G@l^rshpD=UvY z_xzWSPUW=2NoJ3aZI%6ZR($`V*VprfIujPz?K*ru|3vJB<2E-INm_9k|0(^xeSha# zp4IiW?1fe(F$|YK)|*V-cY9a-@2{~2Z4b5Ns%AK5CA{dgb3b=2YJcY8um8+@)ZSH9 z?aa)MSa;^$#}%i%{(pG4vS@RiT>av2g_X6(Jc~Lq+U6-PxBtGwz1)7+(cWV2nva(K>dS^O~jX zPv$Vz=;-&J=Y)Jzyt2h5yj3o3(LH$L!1SMs(%vVW+cdE=l>2>VQd0fC1L_ebg7PnC z_PR}(>~^)|?OEMzW@a<>#bfqVbl$bL-ttu_NWt|WFAvAIhOh=NZkIWe9k*+`<-L1j zbj$AS&h~i;pPyLfSRPVw&ROiYW75j7&qwF{JlK<_c~!i-amf)wA(r!>_4l0G|L;=# z#?3ijVy=I0XXHyTGMjSwgyYu6!{-tuWL(qxa9bp)!dTYTEBDKBfP@ z)?KITV7N?L)4oT&&&sF2`wwr=1CJwL->rXZ#A2K?bE@=)rmuIqWh=L9zxOl#Sf)H9 zPRQ?^nzKzNhlXt7nv#;ZvMa918>T$gwfosx?{LTJ;2r6-t?4^+BF;@;qG8qb`DW9N zRes4FTYPnUowhBQ<;SV1#i-Tj>hx2jLo;Za>OuAz;g!=(4ZFe?mG))G`u3ce#{Dgw z-9#<$_mP}^51zffedor_hYRu|S`O^_`bKZs6_sbc&cUZI+!hda4SW!Dvcf1eIl1}e zF}2^nt7CSS%)I$e&Uf#EucnG#^L;uRSLqy#aQYOx-|PIh%{s596@8X?|M$i5n>Mxb zuBHbg7@dQK4s7I|=X%-T_U&}T*&FK%7&h0XqvJ`a!vG)yK$0{x^j13udc98Ji}!+ zOJG@8)ZOmSoa?nk*D{p3D|~F{QIXHDNYd6hdSu~^?0}#y&C>28GdPyXKU&DRudd$W zl%+@;ua(|pL+$I^>()pM>fzM;Xg zcw3yoEWe{WkDOTaHHy`oelT@6J3s}Bo|ON0 zGu)!?l}P=2QSi%&0CFE?EIQ~ zfpJ}0 -+H`d60nRc|}UEa^5x9{8Y>qluzJ$R&1QgHf}lH8r1uj@-66!OkI|9w~e z{{zxX97_x=?inf$kv#010H57!*+J9gzO zQ#Nyx&dUnT^=o-x zxJ*Ds)9TbB1-6+?aTe@>mm*&a-E%K{tt$WL%X7=$50a-`P8PZ95j0JqqI+ZC17<_D zXTOc#y?Oibmh|)pomcCkFIh!iUc25?L38HhRY&*#`u~?Ry-)UWuzZES^76@-KN-hp z#(tZ-tvvesYwN#VPSxA>HpzY!{Pn|e_d)Mb-?su;> z^Dh13(|lMM{#H7K<6ar3$$y)Q^9#Q}S1*|USg!TMtaX<6zL;@qpW3U<|5o6p_Wb7$ z=e)~%ZouOBnYnLQ!kU+kC;#+`q&hAuWw)?dUtNwz zlGLt5Yx^A9w4!C{jP&3Z51z)fjZ5a8-*7G9I`8FP52XoF{vLus2Xp>6NZ9) zc+$Zz=e&4b-#__tG|R*ch;@iQ~@9>wDe{&wse_du>bBV+oPgB?Vr} z=4>1foEPOreJlUIqc*$!`n^3jUgkutIj1H#K`1-oiucKj&P%?U{(rOoSM9cK|CZN$ z=xmoP4c(~7F#qz6?Hc{^iR{|_H9z7u@4Lk&ePRRmEEdf#p~qs*`+J@~!@PT`yvkh8 zfW!LME*AISg-h*Gz26{up|0V`zNgn`vCF=jdH46{jb|@>34izMK|xWA#T)k%?%vHa z9>ras!x!)Hyz=Zq`?aQIxZm8TkN5w) z{YFQ)JdOL+uEg)>_}Htf&!iWNbzA)JT5UqkHmp7*8+!zWv+xn>XV(Y~FwVUed|AHz(b_$+(sO z#-b%sp(+csT5VF-K7KVdJ7#}X@7=l4S58YBcKujm8Wd#Wrg86Dms;yZOOc(YCfC7R3&Z!%8Ti+}uTtMsh0TYNL7KHN1= zz-C{r>#lW?kHop})x6c(|D8Sl(bd)Fp4(nH{RmA;VUxfAi?b~E_bSW66|xHt8}vm< zzPwO=jOQkg+nhZw4;~k7oFN)?;Z^0%|9}5K{Qsl=)d|sOdffjsY!0lE%D*l-?M!rT zf%f$BkP?GA7S~(7)T%Eo4mkJq{#WaNTy{x(_16NAzq+!DFLrZe?X~uN&*^nv>f?MT zFH!D4H=DoJA?)(v>M7GCo-B2HxHe_Qs;;B|zZF~6jq6z&=czGzW6_vz0$E0MRA)g zEFS#omHzW!rTph(uh$Dl&&*HEZPa!vTFaRv5LM3g^AC^9;heDIzu$D{Ra{Tb={fFX zY`(_rLjFUMqOVGPO3xPG+iE0H`QbZbkeWSz)1$nX%XX9<5lwN9zh1tOPrSsC#hEYu zv_ZUG&8xfTX74?9V7I5=-m(j(?8ZDR&pvoR_uQ)oZ(pzF|8Dfo@1r^I?bzRQa{n4W z`S$W*=;H1Y)2TbHqh>yyJWtTd$9s#@LOw-pPH(A+;*;O@U1|*eo?#{JRjit8xb4`d z1I+xJ_EdI;$5qVx`AtpT%>3qzkSabQA@gp_ubULx8aDRr%8STyo}#Ujswvu@A7 zm$Wb9!j-KOv0OJq4yZVtQCufg;$@MnG53RhkLbKc#fP;?^*f(D{9fO}U;m8T$E;t_ z*D+*)?y?SVKUrUuElOX*^u^Ak7q7d2=i$`wc;%lf?(i+|8M=#?_$^8}8u6|w%KiTyp|ItA60iSWQP}^y!&UBj z-n4z2oU8i(L^=QeoX`G#BlD51lhdtJ5}4f!rk|H`GjN_ecZI_14c2Sd$EO5n+;7b5 za<%_&VBK4@S;FGk!CR*$PuO)g$-#a4)=T{-y-z0P9^5Fr{N}w|&mOYBdwz6!T$dRw4M}Z_X2Gg$1vb+pUT^T5vTAbUA{~QsA0Es9?+UbhbpNmW{=+-h z^2Xeoz<2d^#7dVEz7*CSyKd`T*{W;67Qp%jU}mzv{ejY|XL;_YaQ0W`-T| z+~9h$WS3{KrJP;;v~d0ShsVy!o||KJ@K{Pu@wQ^Vz~>e%8oR%4T4#7HAkb~YZS!|Qs znvFHDqwSfP|4;t^?*8*P$7WoT=@tL_+VNFt*!B49yXvRES-g5{>CSz2>64#EwHtkL zj#(=%VzozVt5@T>?z1c3B=GCE$=gL7O8HSI@kqY((B1QgUGMv{nf>+TVf=0v7VoQD zVI9wW;azTn^~%$8*~~Q*E4LJutU3E`kI||}SgPI0ruz=$M{BN-YoD|c~tE`+icq1Nw=m9N{H zQx7kGUpI-r{u_7B91GtA9_cGLPVqEgP+oNYm57j{+pKK|w>NI%-BbCKOI$zhjh5V@ zHnC?*LcR(4u5mRFI(^r%cVljp#f(5p_e8Itj++0!{WovidGP;-_w|jzm${5N&h|&` zx7;by*17t8iN%gIfzTJTHposk<-HbQcP%mD(}vX2lk1Y2{_c>i+!@-#80Iwhu=c$* zvIe~CSMpbjKG`UHN?mpS6r+V(AAXoa%1aJ%R+<2o081pyO<^$ zE=kGMh-B+8RSjgcYfeozI;bxmv%9$4?I*`V(T`Efd&7+sPYZUex{=diClGXcg-qgx z9V#q(**dM8r?@tLZ%p;5`C+{OsIdGWiOb392OD=xcnRa!??)WDY3`_r=SRS+}63) zcdRTD%;F!#99)#Q6HcKGr&@+T$zobVdgjkPU_U615t;Q0)yR8AGiA*ZS(J6 zeDao^Yqc)xCWI)-6$q(v6e?==Mzz2EVv=y>Wau+oa&;JHwwB1Ztao zJ<}SaHuAQs9&7nNt##uL=9zqPy~lOFKm7jxh4-EEXDaWjpD@i1-O03O{e`dXyR*vP z+}-7Ev3c8f?R5_3wYsH;*Yd4DwdLFUyJD{xgkJ1R`ab>8jIU*#yQ^m_7G}0S%VB$V z_3694#V?ogJrS36-T7H}ud$_-v9v_}bipbl(VaoEmON+L-py0VoZKhalWa0epw?T$ySq@KAg%h$%(dKS zUjN=v_M1<9{re4@?T@?rhxT?jL{2ereDdh{)sB}XXEwzN-D=xZvSgR)wPHTLsG7?G zQ&soHdYyYGbFE>s5vO)5hfB{yw)Fxkb2Ypb6)bfYZ#;9}gYnd+gpj@!T}>=HuNrRK z980fz%x&}INA(J|=pQ1Pi+iRPpE{#6=XJsS70GPEMn|>SI%UL8tJ?oM=|A(We8S|Z zZ;oEvDsfVW?_u7N7lw)@fivE`5b9OU{?MCfCw{kMk%l7Mx>%n-?Em}g54F#$X{!HV z9sl6r=jS)1LT4OYHe=H9jO5^WzY|-h#cY&XHhJ1BD@G}E+WD&`cDWmFudm;`mPc*xQ||t64{Kc*lnVD1ZJEOQM)iqt z$Ex+dobp?n8X2=Y6_ZvAb%ccU{B1ebt&o$cdv(VGo2_SW99-M^_)3~ z>N1T7bup37`A>z|O1rjRPfNe-{!R89qlorl)ibZ&oZ4=~n9R0&Rn=S>t>^rgWU4*p zUD~m5yKM5V?j(<`A zZ?^B=H}3vFQrmLY+ci6`T7LcN>X7I)x{7LfclVro#{As%G7@$&ZuS5=eLkefR; zD7{Nc-6e92Q&96%!n`{VGkhI84&D3n^Zfk8jpYlNOafQ4pZJ}8uZCGsLqdvuV$^my z)gxOBlbjCeOV6t8?G<8u^ZuQ|?YmD~qs@0#z2vh0`SJYEGwF46@BewDUh(9Q<+4=A zi>?p0yd8NvZQGRut6aKv2c=wIIf%_eVUvvOhLlk%fe*7`p+g`^8kAiMO^NY1v|QxyvLtU+xUL8)A6$Y|*Znq8mR=%j;1Uh`i=q(__^et!2qxU4G;C z?!*7y>4mS4d3@adx9I%8U(|nmIc|4E`T2Q+!muRf%et5Bre0{h_CM#>mt@w(5wY%v zzi!5E3!N1O)HRC^JbQp)rOR>Gw$XZGA}RszJ6cDre8Cz$=~|5ROakm zk2U6DogR5d+7f5tvfzb~h&seoGLQgtEC-Xy3jOz!1p5u|;Jd0Q# zb2k?+T_SU_droa&kmB4aPO{VPv1bdn3aj6#^3PE2K9+nuy5^O+{rSc3e=1x}5e}as zdwr2X>!kT}LM*rFX=XO(7zH{;E)IEdt$JGN*w_ z%k}w$uNRL@F?qTm`06pqJ?mZh)@5p(ZhDYC_m9}j_wpG_nCmWnI6dF~@NxTZigkaL zLHj0zebyX|I{2(gT{ZCSf}c_5D;Lgrbis?Ad%b?rnk9mF&uhP|&tL95M<7`<=nRwn zU!^x<-=e38?KX~zzudl|W1+a5jP<&&qCAJ6J9>Y*-S?2a=F?XJgZnp1AD<8I3GbPB zaKprRY2P)^*j7ut`}n(h=hVf)TkptetL~h^lp9@a5MS{08K3>nr^Yqk-R+OHpZNdt z{{Q|NP&^K85QCknF3FUfgcdZF8W$_(@E=8<|?tHM}(PHkGE zAR((nY6xiaH(uJ{cZSp`N0W?MQ}_&OM_IxTdPN&fF0af|N{l2xKt*)_S$zGl^R$dh^c#vMWITh)1wH^29q62^YBO(5e{ zo4H=>BX;{AdTfzz6jP)&tSL(t4LP5^sXH%lkE8RuoXDNx%#2pE)A)`B-VpqJ)9!4N zJkO3rNgHD>{Ak-1YjoTG!L6ynF*|FT-~aoNUi0R<-HH6VPmAZ+?{iHoDzgxXluIhe zw4EB!{cy9f!G-g+k*;4qZ45t>+P2b0^7)01h5i4om)%w_yW?zqcki1m+;LUQ6WWfS z|IhcEdl&yJecQjiQk&0ADqG33DLLo8q8BU4H-0YCXD@r9@4n|x zz^sKAL+_frc_&}+_L=Uys$bJdeM1?zUN0XO_rbu zC!cOF`}Xsue%u4@`M+8Ae|utWxzkkiQ249kk8VvB-Mj5Kf9}fY+01tibQr&|?hQZm zZR*zh-xE&gbM5-z!dqeSy*78^x1Faa2p8lBNANCrpLVu6#lwDudhCqqT8H`H%YP)5 zWw_U#dv)^Jl_U*8w^xeC6RlE>#GQBRhx6ZPUSGd>eWU!FeAidItZOqeZ%zAqbkg

    B3e6yn|xMDMRINzW=pm`y=|G6_N-&UmhHZ=)%#oSY6{9um=e<} z$n4Q)^FevLn)-sT8@anzuT8G`pgjMHtbZL(bWdjO1lgMslP0b>EXtSe&9(gTcaaBX zQD0xoZv6dAa=Pfk{dKW`<_@n$MHFsv_};lVwjxUF%kX#q%b+ zxbEEYa87WjZb#gQc_AW?R``f45^sE3baL(#4!aF8=WfoJtFYyR{{OG@Ki`%AJLUer zwdX$_RF_NKto0=(wRDMJxMKY>yEl6pS51DiD*Kwjf}JnSZ}u74m4-yEmYD6S^mdv2 zem0|Je>%c>JFmQ7u=l0hIkg?_w(GCN6|cG1-|9V=+xyF1hQo7r)n{8>QtOpl&%d(j z@ax4bavxk+taeG;J(yAc|A^e;2*tvs&hmHX-}v?O1*7k`e>W#SZ5P}9CGncs88KtM zxV`82>pyDm`*!yIr`7Rx&eZ|Jdzb6Dg`_%WL{0nJbd0-xp^lfD^zn)>8_PevU0*YC z_V&Dw7ml%+xz1@V3|-+;y&!MT6w9?2k1d$AEmJc_GkAXQWs_rB7Y#j@FEsA)@$?FE z)W~Tx>}$#JW|M7Ix8C{oixbbG79WSnJj>77ADKM=pUv_2)e_NtQ)Z;@@^E^l-4$GL zE^*FV*4!3p9o<_8I~{UG9(SDR+Y_;^=J)RVsbw4V`xUz^dOyeroLSuMW&QqAaw%v{ZoCZp#^Gg$n=2*;)E2Ti!laul%`G z`_Jdu@sE_{E5-N!JlX%@#LUSd=N^8NT$j)n|mzy+I=x^TSOM>$YpRn^ETJ_JS z{o~mQO}mQb#Ow<>>^t!wgY@O)Gw!ZjXJ((;o_6h>|8jN(XOb(g2-v7N0a z?k##awLAaQ>h$;r()a(#o!|e*>T@$|qGqpC>cbVQ1lJXunO!3pr?|mYjx3U z!cOBu-X4J-E)va!(=PQIYV4RXL1;PO3}1&5)&9NTl|fCO+%u}eCo)mjd zE8wQ@-ZCp+t&)s=rUFR}$s1ay8l_BV+hDF2|7`mH3aNIkg;E`66Bm7OSn}rMcb{KP@B}S!*+H-n{$xY4`LW?}Gh5i^uJ}3bhv!w(!v!Fl001ldn`)dIm*>O+WY5A`2I)E?<>{S{pL^#MNU(LsD5!Y4sQi?s>E5q*96dva98+b?yuO8gx_6}?(@yLR;jJ+ve5o3 zu#?j#d~W`4((z=NrUq*Qod{`~Jf=ZzI#n zQ|lJbXo!5<`)Zv^eU{%14@ZIDBAK@joXa^UJzf9f+xPZIukZUQ8&~~y(uA~vkZmfi zKTWcEQ#F@bJ?9d1@YGyfe9ElliOy|xzt5fif7$-O{Oi7P&)N0gFevci5016R7x*|F6ZVw~)-gL}{Bf0G z;m=c{aWxNFxuQEZO9x%O^lH+JCEwNrUd>ci=xRy4YcMCpDr-_ix6-eR5)&Od=ZP?- znH;m~-t2m>(S!5WwyW8jCDxug^XP(uSl%Y)3{a5p9%z5%PmR+izTk4^_ zwr=+JH(wXa{R;j6L}^?88K%%^t6xf=onIe3@lU2|O8oh&e5%(j+&xj&mwCbSDr0nI z`}E=$&RuinrMN%ndAai1UG>!umKD95op$nI(aEE)&3}CBuRj&O|6^|5*Ujk}ufh&J zSDEPQ!#3gWcAZsvIXw3+Z)@~O+O%__()vd-Ih#ZtYre1jblB!oU-`%G=kuO-w#y~F zev&!UH&aMebY|Gxo}T5=deb*m^aj;MOL_=9B}86l+833m(`UYH%DPtttjRns5A{7( zZctU5%Nd#X@x|_W5BARgVRQAF<}3k|{_7JfPsyIRJMr4AclWQXl)hcJxy!MF%S^-qUPS7mcDQCrN%h}S$XUb2h zseZ0*^SAr?&nxTeJI>erVZKxUiDl~2%OwWdud_Sizh=G-w0Mv>`+a5!YFSt9qiK`(n!iB#EDsf=hwzO}kD`j(5dDlgU8#eVJ4osQ(?=RS4%*Y@fE zeP{pl+gjPaxi-#5Zcb5BQSt?1T?w9g59ch6b93U_QtEvB+7`PDX1toLJsW%6l8>d{ zT%Dq7Ahni7dS%b$G-b}8(=G1(eI5Vcp}M_KiSjLlyOT9tcm%V*R_Pjfo%h(DV&>7j zjKgsKmh_$vhqR|0a3%lN;~`YWEbhX45Ce*e6>{g*huT%Q#sO<~*4uS?n?6ej;v ziIXvo&H(OFyCtVmARJ$ z7f!N#)xKqx|Jo(|uQ+%A-tg}Ei@BlCWqkS6w-!y>o5}Zn7qetjzRTPlUt@M|J$?DS z?Qu|XRrl%fd}Hf~OV@JQWujbnm1?zp;N&V4Qgn0tU8*Q@?IO#Kd$*Qoap$T{k~Oeg zVYcn(k#xKBm+${o+h6lf^7swlJY)X-ldpAjtU364PnQla|24O{ zcXX#JrpJU&W$KjbY@1+nNpIqHwJpAK4Z^Lj4QGE$um3syN_Xoyk&R2PbZr)T`bTfm zn-jjf*yh+>mS8?6_IKaHC&)wvkxui%BkcE& zfAl#Ehq=ygWo9j5TxGvu&pC~%{Tm;- zpSk6E=eFvFjXY-`6dNlWb)QKyc$ar>q4l*Wy~-=!|5o1nySg|~^1XzC@#1f@UA|tr z`SOUy;mB9Zo;_Q8+vfYL*MF{F-+#Ej{u6gu`L`9~-ZHJ{t}j;xYGSOIarK zvC_Tlc8wdwJzvE&w zA8mLX=<2-aqwZ3_aIR2SiGIUGHT_{vnA(<-WxseA_SP<*oD|O_=GE`^;gb5t z?(}(2A06#hlAfQ^(PtBrYtp^)b+t$H*1Ky90}5}nT>PTb(xC0Nu}4HQW#SPLQ!Wpc z!0xMFK0yX1ljgj3_#$`aO^mQ&)g;pvk;rRXzigQB;UAx`@~6sZ>Ejk9wh~{~q}7JElLsvUC6E?RF=B%k4dIBC;!o+wjZB0~0MCWNn#{Ev4yM`RhcZaqYDU zk6&Ebx=QVAEq@|c_O|)8r?_5NFj&2RDRb?~s!b=d_AxZ;TyfSqr`@)WKS>}^HOy?0 za{krW^Sa4=X;(c@%&$5zWk!UVZmG8LeEs`-PIl|>KXZNm&+9hdAHBY_r?6cmIJQva z$)fJJr)D1dzx`N}ti^2CJd^O=L$U{^sPN?S^sMqKyEiBImCdOMJbAm$3d{duk^gsR z^Pf*Mms^(JubpF6A6GWzQs9iP8&Wlw10)WwC|R;frB^E`qeHAlku6BX@6ee|N2Jt^ zRh?g$NIGxYQg%jJ{)efa%}>Kg(hrkWwqAN8%B!_JT~mhT^-)a`RWnV63ez~ zk9&QT?Pp}$Bd^E}D^;^*=t}MTclLb(lhbv-gqn3K3#E91@}^2(Ek9q@+JDZ|qGQsk zh+qw|WRqDN?@nP@-LS+bv71Zl+iQ=g)4caOro=7Nx$UII!`9q+^CW|rV6FGt=u?}T zwkTArKNT}^Tcp9f90SSxfF7-R_3ujWRs1!Q|9|86&m+g}4lMpYH#J1Uw~=o;Uz^pU z)!!Cn--__*iTqrcaXa?mCjR-mFGb}?%I?^h7V9pqb@k0Ivq#m=ijr*;>d$6H%-q=f zPHnwZ@uk&g-fz%WpL*|A^7V5T7yGBZF23}qi|_aagQ7_DCiypSKEGOe`p>7C&wn25 zuRF5TT)+7BFW)t*ISk{2`Tia_!k8d+(875k_nK_3OR>v7>S{`IG23zeu#oka^zh>r z5H~qr&N?}H`OhQI>)Z9?_aDp7-*fWVHM6TFN)P6mhNLR);>z{r(!J(oGVziNhvUK1 zE395y9hXU3vSLmF(EjDzW_I1w1lv6wIBpBUIFp=AAv*FLz^7><&*Y7#FzW&MInor8_pTD^_ zMTz-qdFQO_Yly-77a_>S@4K5oOA4C3Y{Vf1k~NygC@eICo3YQ`7b-$!hutNlN& z7XSH@zW>RutFv{|iXGnuH-5MLbV{~1@)=*M@aa;|nciEzJAJTfJozYE|6;RnSmNzd z9Xonox;VwWP~JVmgJoy;(+=V9_J`8{{j-0xa{V7k{r$hB`t84ITuo^zzGM|6!m6gK zc9la|`AE~n6sNAvLtGoCFZw1qVS}Sfth1NN$&ID=5AXRNJU_kUkB;w&M_U5RT?<#~ z*=sYaXe+-6Shjd-arvp&23$F=vFw_^4&ItDEq|uK(~oPPUwbEa|IamZ&V7;#KL4^X zWjgtwpl^@Cq(dz)s#)$w9&|S`IWxPznD6FhWi_u|$#Y-$mBh|9bg&G3o+uh}^>J29 z?$%YI5vyfqF=p%D^ES`=>^j@@(((87bYer&(e5v8J8vmU{_gbs zIaPA0&+6lq)yGy;mt2w+U7UQ1jic3ywQ`wd)`_Rbc-X!vERuBL*!aI=YqxB}vb&|< z!?(_A?^>+DHfvkr#x*60t>^6%WYNO9SM z87W;-5<5!#e&^*W{8Z{nedry?)DF86SpKa1~YPULkX)`KcZ z=FEqf8U+@_p1ScXzy5voogHlQV^pjWFnjx`wj$tK?Cl}y@S>}{Yr zWldUSa(9Cv#|i6|D^?jAnrzv3aOb2=GKJ5t$;Q?G^p&gs!!-Zz75ASPg!?yyP7TU@ zab|OWNzS!NK27&seCB(t5fOTqwA=YqzIYP<+@lNDWEfrkkZav8SMcWE!VAUyTY$`lPa#+N^l@jly{ z;*iB%0tqH^<@~p!a&5ett!D~d6Ybf4zTjQq;oo+Dw^#nNj!%pUonukz6gBg!+w+MW zS2J1)`R-SEstZJI_U$N{t<8C~#eM!C(|6T>?gr#4uzKvx_v$|vDwe!tPsZlQ=jTt& zzG&FJ=Zog*&S_Je%xA0!K5J09N4jOojoG?CAM)?(H|^Bvc;0hZ*t&44PWALPs+xOm zFPPZ%?O00LV$WN@CrsI#u=R1!^#rFYt0!B{nUOLl_SmB!kx4U(k1|~G^V+=qZq?N( z`z9|tZB)Xx_~JAdce~0tg)H%pwGw@zk~ueC?BH>llRYaeu+MD*&w2abR_pgxb-uU# z#<2hMcKgG-)qnUr9kjE2vi+WEuy6dd zd#XI!Iko>QZ*To|bhDjy!Hm=sz2V1A|HPV|Te0|LkXUqV_FFTDPXfYg`E_2Y?q+A- zQ~6bEf6c$teV_lze|qJ;zIcQA^2luyczi!(U1(ENBxOqQcESNH3w@zq{Dr*wUe4UjNpKq|+o&3lyubOaFv*li)^<#}q zCcBv@i|Pam&2g=EopjExrz6jq?V(VcK(m(l(!68Im!3;a)-sJeef|Hh^*f8J!w-E3 zDk~4n3QEmwK6husuCS#)wN^EsC=Ph?e%t(ish_O2H`QlY?wB3c`sZv?rqkkzuAa-A z@4BqnvoPwVVPKC^_u?nn+H)2gOcQvzPa;|LvJmIaCnEaXM%BqXW3+VdUD(FE_~VS1 zC9_3rHaDwwADy$Ppyzn-yvS{Pe*IFl`?c`gqfxh zF>2S1+FhrrR90TnGktGcdb=py?DSO7*_cABWP2VIhz!V(E za%tKc7xlZ0Do0LcIZDb-d*!@vw;M;Ck}~s2FW>v_meW%v@udhp*pwSBq`P?46xYSh zKAUHYq+i@@!rPW*vnbNd?(6OU6W0Ix_x{tV)$2dL_?v#yu1@Chs>a9S?8<-nIqz>< z!r{wO{YK>d-xJFv=34Z-R|+R;%v3vfVpY?M!1TnVywq#Ir&etUIpRMlXztOI74mF9 z8}c?XPAw4scXUr)#jBO_##(MVx2L^e7Fjy!j8TB3)pH$gZ|A@3Ed8$cZCs*q>1)cI z17C!X`z(^K$nFVdm9%y3&5DWCTsCo6sY*ins~tSHg}#?lUG{{#q#L!VFs$F|mU&Z9 zo>{DY{d5t-fa|7DH!aif7CX(F`}pRK8_U*c9k`$~UFRA1tEV#I(`tTx)7xM1Ew%3V z=lRbr%l}n4?#4G=dYzT>gwNV-6^9IdN0f3fD=go+e4h*WYtu z`@dh+F?FB0ewTmCl-56M;VD(HTOh*u@VeT#&kvXA-ksZIc56+uiQ!EhDWRo1ExWJG zQt4J+qH#cEnglDy6t9luyj$BIJ`y>VvFW*-&GdOsBQ4sutCl@hk^lYY{fF!SpT!q^ zyc8l55Y{%xO-U*2CB7~pFbp)-Ak z0z;fi0=N5@MaSmMuRiC@`^e-%#zKF~CpK$>KU_}nv|{a>${o1klX2FAB>6?X57zi> z^6|XnrI_Do#Qb8XhJ>cS$Hwjzf+1zIHa4>zH9Vrx73o;^}`zP~O#n!)( zujsn0gt3fTvg-S-lODH8e6TxFbm?R6BzJaSf#l~txiS_X*4?@0zjD*9*vLMunq!8@=YEtTFOSw#u_K2I8UB_F0nYX%|-3li9emqtuk2m?7U2R-;sIAYpB}PQx0q=4?S^HK z!@iXS$w|0DVCnqHbo;;xOJ3z_4cJhn)f$ych2+x>X` zK@@EIrPl5>vFA5FYE#dFb;6>ps6U3bMUT5>02>iR}M*V{Xr z4vE(MjE+yXoF6ErY7`&Tuw;`~q|URRRfb^`?c^7~dlV&jvhT8@?8F;-Ql1h`g0ZJO zMAo%=N3^VxO}>;8kfX-p@5R{tHi&n^q*Z~dHWjlPs?0t7vL$iGreeWG5rH8^Yi1Of zl~*?DE~yH7v8Qi|sC4tfOxtS`P5g^q&pa^mgw2^5=bwj!9?Y;gXw}Yd8u}sRY2l$w z%RZ{!|Nlta^}g=Y z9`1kE&TqQPZua;7`?}7`m|dl_m)CvN{`W|K|FK~EKaxjO zR_qs5&`_50blf2F+39+o&+0i}R(#i&-sQ$Bl*G;HQ6eX!#@RGCY01~dLz)?@Sr&LG zRYjgr^oqRk>Swghv95#1Bnn!WZfGs}ytMJ_(_3pC4ZE+{K6hE9BYUs;rp39x@Bc|$ zt>|99|F5Xt{X0)f407`FlDOTYeJsD;sNVViuK%Oh)_GPluP061V0Zf7$>%D2(^$)N zxhz&G?BYBAQM0+1X~(YxT;6eqs;4ka1afc*0kIQr{n)x={cH&Rq2-ml?L{C zaMnb7n`atXL~}j9XjQmxmfw?7p+#J`qIOMD{JtzAyLIDCqjPEpmd3PSn%8{&AOH2z zo?99ct)5{rn@%#6U#gU!)Yj>;S0iD0hGA=--L8L5w;#RpGAYUDuUmY>ZuNaumXP|EB{aGGs`EvM@ba4K8%GVQPEPHJ z+vWG~QpNeLbFFK>?zVq&|Ib75%EwEuTbbA|bNP__{bu0dM^_j-b{=V*)*YfBU@c&L zZep&9T4l$PI(H@4i`oh+=j?i2c1Pw@tB1L{quBDPc^|J_+`r*mfSBKEvs$}b;%YwM zWmKm4$M(feQ&nWy<~JwJM$Xu_tV_K9pGawjfh(t8(LdSukMBHwuexK?@yaQcGqhdv z447`XC~)abEdI)K$CAfx(Wk6eHtaf~lP}gk*9a0xoGv3NSvaY6tHtvl2g~O@x*8t0 z*hnmWjnJ-5TdJ36xtnMjvuzG*oS1pTZEl6$?%Pwo^VOQY`f|$2G2-PspH&TSdm1)t zy1qPmp>YUv?o$;t!RX9i2$r%p2Gc>yGrV=u>bpKT`eJdwWqw!%-o&Z}*K>!&Fj*?Q+Cbz}wnU3dH9 zlU}bBm&FUW6>u*3lkRaY!E`=9XWjewzuGyIgtEMrT@MXN_wbtXwBu)u-mz)y+E2Fy zl%5M}3rPsRynY2&TG(ZV*D>)$AqnoDB6?HDT%7Nmi>Rf}T%m=AXf_uHeTm#UmZxb=T%^aCHow(z1

    R3+L9nf8wslUS2M;v%J=#UQxP#>m=*r zegBl+?R00nWNY_1civ&e^v&PuL{($WOs#*j*Zj1;|MdI6r}72QkLk6B9-P>7X<~?i z>hrC&E|ag;?Gn2+rPn^=)vT(+FYhh2Sa|K)+6j*~hJEsrkLnWH7$`DjseFUn#dmXN z2PQYRsJBe}{C#e+(Yz<8W(JfP&p*hpYep>N_PqNKrSJa`+yA}#zpB2?e;M&}bDw`a zE|+W={o&{RU%GO;3L3LQyp}G}C}=%1amt~_rRn>$(iXltsdg%FT6+8QyY}5zzbIeZ zvSijL9$^uVmP51FsXMN+_B-Jgu}ILCwdN4>dE5U=)AeG-9$dB3mG+)BP5R~}--yR6 zjtS4Iy61bq>jLjA!wmhl^XE^l;@T3XD{|S;D%<#JhKIJMCR?iCH_;Uu{JWSH=W4$= zlIC>f1pm(RiG5aliylv$RB~+6$Jqj$bFH@IcwA&Jc*J2V=P^aW=iG(x1ukL!m-^jg zxx+ThRhq(bUnqFVI`N)k!n3w5n{^(v`uB;3?b??AHwEq=QeZE6q$l+5*tdes}Y+davDBXjNk{0Rrw`(7?8E}y=#1jj80_JTlYd&ZmR~(lc{Hi5msq)1aYg*17 ze6jp~`9C`~<%>x!|I@5RlMh79x>o$L*Za@o`ak_Ye@)+iXs)&S4B0aaGAsXVEH8Ms zuXxJiu8ucGzq?t@^Y17|KsYmZGlA1z( z0+ox=9-J|O9GzMoCP{OAb`<&T3QuKNf3ZWmY_@9`r+kx}PsvjEADphTKwuy*2&nOC{|~UQ8cOX^w*7B+&QIE z(Cyjuu*Dl=emgFb>EF;=_H~&{q{YRWnD^p4u7{r&H&`v&!&tatzFh0I?$3N_Rwi3_ zbMD-&n(yMgeB&dTf7!cQW#rh-zpFWS`TYI^@Bf{)e{f3r`bLX8J6_y<;J|7z{b3uE z9Ov6Y|82p+ubf`J2`RbwJZk&NDBj8sIZjTwf1{82IbE9eMCOr}yF&LSt2s~3OC)WH zl|MT3@^Xz+Nd>bv?O6LK%PjiC)Ae<8*Vnw%U-|ycr|tItG{5n`D|q=SHLdh)y4~-{ zeIN4w%1X&symI$1eEUlD)v`px`NmTIKdS$Kxc}_T%FCZ(*eV*1U9dEK^+8(qR;Fpg zyx9vZcY1p5EoGa{ex&5sV#j@6w?u!w>a|$b)HMCxjuXN5wNYhGYdKPnrFR8diq}>e zsyc^;v9#1YogAi~^lDCQpPI3~QsUA}6PM(?37Ff&!?WBYQPxi1fGu`Om1EfLr^POr zYds#azqg*z*Y`{BoW5FraccYNCo?5;XMfbW|L|0l#ns(%yYJ1qapKN}8A=;_?|zV7 zxX-2O?9?q%mrq^Um~zBXi1*qQnK$nPOInuBQ8wIi`S7O8mF6})0?YE$&z=pnTzKN< zjZ+*pMZ7kdEBz%S?(*HW?%6#}ZTFmC9^bFlN(XztW}cpZ=Sg?{&(OMWkK-q$9^{RR z>k?D9J#TBa=;6YO0?T979rz~ARrTUG9wPMT&F{Vk3A-;e(PQ|x~)wtpBb|3g81-XDdt zn-X`%d}!VOHy^Y@V%?r^Z2v#a|3CeT-Grb8k$Q&LHf`U1I%(&FYj1D=+5P`<{q)W0 z=ed*xp1L|L*T1m)o!zOfm&{hrm!qr*Vv)!_Q+<^mdM*8o{Aa{8A~I*PMMFV3bU zFDl45#&Ydn?d|AK3XeQ~?Y>cHUn>6k)9x$9H#Sf9-23^&&vbVdsg&1;RcF-OMX{Q% z-D6jA{@gvr`?ass|NNZ(uj^=yr?ky70i!@U2PNBo7jm7u;uimK_F>EJ%3J3ye(Uwp zV^em2cdFN#X*AnudS2>>OHqj@B4wA$G(G8dx-R-^!=LnBeivsb*|{b0nzILD1m2V6T-ShLAt6uzmH`AE~A3upMyQ~>~+4s?+ zhx?L`ORAp!egAKqU%u?~Hy?#_4Ay>j&E>hK@0!uPG?^E6lAD}FK} ziq*WiEZ5RDPS3Q@J^9wIg_~MWT#j_-=;{@5GclQa_?A$ztYh?E#qXXek0zZtw#6ms zw!p2Wj~tCmPg}j5aWqPHPclbTFXz6gVO5i-o=>Tr+L~a!h;3f-&H?d_!=HGTe9 zW^B&6RkfwyNqD%iyhYcYi_op?0qoc{cO zs`h_g=NA|4YUG`meLY_wILSt?_~|XvZT>RqQZK_TN?(bvv;VgFbio;Pz5u&?MT5J1 z?Uc{Y&waB0k^ldD#iPddpQr8rD6#)G?yOoP`r-7tPZ6wJUTZT;?k>tYaV*U(V}8}q zJ&`Z!FS^|2J(`*JV5^4vpNr!E_ZZ71r&K;SQEORXy}_*ErBt!syTS`{Ef-6i?p`yh z^)BTXDq0^KXfV&Guyu`NIFHJ=ua=TbeGVDlIJ;vHCADACGu(Eh*WBP1$JDut`U4qb z`p-5um9QvudEZ#{!tC({SB6d666vK08xqtbUVbwPdsgX@z5S)kBty>EI;o+hzDbdV zx@t>jsUMt_^jg$@(u?(R=Vr>j*%wBAg`_9d~ zPtUwGzO$on?&I6H@9Zj_ylRC;&(m{nqiyOQD!$rVyYHWP{n2}KV_!0uSnhwn^ztvQ zUN_!bmbZ*U*v>Dn-dFgc{O@(gK#ugoGh6~A^4`Avcy)b!w+PGe4;zoC3%NPHT~I2h z{aLlx)zj@Rr(Hs>XXF$WU2d^;6E-cGII+l%wB$C9@D7|2%QGe{$*d z`bj}4f%*pLHf-O2yvFkRmz|s6+`0Mi$w}cUp$BU=KDcw!c+byc(sL|p+io80xn#vx zRzB0u?8c274_@_V+k8By9`Q!@gZ{sh^#`-{_i9;hxtC+;v~!!z_IoeOmf0CkJ{_3L ze0HmG-6NAnMaP1k?O(Yk)>7_s{J($l8+UJB{q`DX`o)ts{pR*B)zA*&`B8S$^5F{Z zvonHD_}I-ecIj4}h)AgGyP`9q^3u^cpN{-$XucgjhCcy{Jt6cT^J5xl!XV-#)sd3)NX0goP z_~r2*A+N5>Qyg!7S`?Q2r1Hp$$tRtUw1*u{Nnz$PeBk`TI&gQ+lenv$j+-wZaN=Js zyn4OGr_*a>Hm|?@?d=8UOOum$WpAnPf2kqyW&PQdSt(3w^KaPB_&8VoPe*rt+%;L3 zA`3yYP!{FRBo?6#^GVYxpu zu2S=u#<_+yCOYx+R($<<jBpPEWeU{*8|> zW!aO8BU4w0SAJO7zN5Cfebbs7_wGIWc8-tVuB7pLTy5{??{g0`EzF$x_O0Qpo||@s zbLQLrHQBv;cgV4iyZ`^Re;jWAU)5K7*E+w>2oaalSAI>o9%?3b`Jv^`JvY|cUtZ7n zGIPR=0+Urc_HI8t|KG>?oP|EThuduotv&MQ+IUt+afNfF3A=_Y-926HVQH?Vs_@Zk z!8?P@xO9I?KJI+mb93(LH?g(7H`jXqc)D+zvHFgWg{$6fo^m@~!`$z|Db91#j4bc$ zn^DYxG6U zu-B&6M+;pRYL_X0+_cZNXOYmoE4*vFUL}=i{g@bbhjC(a+*`f-zt;aZJ#*)2g8LN_ zwuTo5LMIQcc9$;=P%~|tqSJls^Q)()Yo1rzt89s5kV@8!X*FHivB6FM$`g^+%JfNZ zLhe3TY-fK?BuqrY+0pRvBL;&lwmkk}+(oxuKQPez8ob9uxA4}!+2s!&NH68R-M2+} z>R0jP1skUI2A$A3>=OfqY3x^Jw){3(E;@HzlHbc+t-1`Uks>0G zyY~NjWo~gJR8cIMrNLX_7wgK|4Z6D~O!Bf&zLJ^zSxxE6W0`fo1vHNf7s_c0-kNpe zT&7t0js2Aqo2BzN+}ZET)$8%Gf18Hcxq#ex$Nc(&`?ePx^>BZwxir@COWtBH&*w2# zJySVsrh9$nn_Im8keBIF9j=#i9amgYnB5<&t}%DoBv;FH>jQx%mRk?3^}8mzN;-0T zQ>Et3&M8Z7>Sstz|7z1HqO>oQJ!?YyTI2f5Pt|$KpY4{Y+dlc(`|JPhY)aUR)>$nv zvGChu`);CiPXy<Atxty!wh|k%1V5`t{SkU%I&GVTv3&YdJU*eme*VvU zdjF5s|C;}4^76VhlV=}IysZ;-$u)S{em>S|o9{&NO`rU7<^(4JuPNt(dcB^Vp0&Q_ zZ*;7lY_iCogPtj>Z;sk+<+;hY;?O#u8-7etS(b58aa;zh2UT8`IqtrZy0d!f)48j+ zuv@FhZ^-j8v~}EC+II0{agUk*Be&U89WuJHbbS>|eG7_3E@kYiy|HIvl;eDw_Z>HH!XmhpH zmwxgsR%lYy#`9+!KkR$>>#gj*|9|Hj+_qnkSsSiqwC=!*7p08lDz+Q0bve9P?d?MMX{TAk_2ZwNJ1Z>`c3{WJ3}?4fzROH}Pan)Vw)6A%jhl;SCm-)O zp6g>dp z#X_B@#q~eU|Kt8&|KFSbe=WQ6IHTN7U!J?@Wf_OnUzNX8eOFw5Jw0KQkaa}%44>r^ z&wrfbpZDmfc-*w=eBXA-l-5>()|A#|X=<-y9;jp)bS0Gtx2Nj4h4wNyhxTkZ`9PdI zDB8O;bCc^<-E#+W=Pi+tKP(zNsqn_4H+K3Ho<2;;=sB+y7PhR!`swUI{_rImRoU$?k}e$dZP}N3*Pg^g%FStL zciX;jpQQ$Krp5;0sZ+&+Ux=()A^ zZ{M(e`|+jMa$9>i(PRH~3%PHbLlY z(n)828x4jhH;r{(wRMND`>=R<-63gl{mm<~pLMI2-u>`vc79Np=x=uRIaY;2QRk=s z|I%Ia_;mcj%vtLWy8mKuQC|4o{G@+R-n?ed<}F$;CH8GPV(Bie^#AJn|As6RcXZ1M z=6rN}mM7&M84}ee>@=z4ycbKdRpZ@B6G}~E6yLrpb?#BRo8B#W`SJ1%Pg#O{R;Z~L zTuxRAPmEpao3i5I7vUW~r&h%T-PPb)7<}9zJWFl=`K}Xv8~skW#_bflb?<(b`TEjD zqMBPoGB+>IQ8&1Ffe{cVT_`lutez#4YY&ei+5UG9t*f*zDJLjvta_XD) z*(zPK-#tOszV?}AT*W`vPATW}`i7D_d?xI%SagWfQDdgh9HG125=w?g_}D!RR~??l z8X_jj<{p`6WK|~Sp~Ve2X`bHEBwymWi}v z(3GHK!RsOqs z*%Pxn=H0!?c;4pw9)q(<+O{vG)FhJ&EO}q>7_&PzPLXYLd~z(*SKZvE^tnpSTo;pj^d|#I(;#eU9F{@!;Co=qag3D@+pe%clz;?q$;}Cx!g@N*({x?L z8U7#7uJ1o3|No-=#u&YniP6r>_jlgmpZz}A-FH&@^T`^azUsocT21zUH}78%*~O82 z;fl_}+>bkj7FoC@dcWcyZ`pv<=-|BR8;%&F@p1l;EMsdI}dJkQ{sm1d^n-X#|- zXStp9Xqr1i@9B{f5;j|8vgb}<`J{J0vp9n@TxsSN)2yea$}MYFJat;@@?^`Y8*$1v zXV|e8-&%83G9m49RIk;hShcI=7q*Hm>N?|HD#>l`ay^m6)w`3+SZ+>CouCuH_}RTx8X}8N z%vZl3)T_N})q@)!ABTjxa&+FzIVQb+pI6{in?L8uKOXsg?|8Dm&AFey&wo77%04qE zH*kvR_WXNkyS8?24C1?e@7|+tYh~qX9x(EKOFts8^T#n)zd1H%{pbA?{k-hivvaa; zj}61u$0i%Cn$e@ZZJBh-jZM`Xj=#(4PgeIY`nHd~;(WEeL!?i|w{U%f*=KjZ>gl!p zHf5u-@bBYuUVaXZ^jg8cr|_rN{lEA6SyaVaB{Lno{{Hox<>p$dRZ=CoX#Rub3vr?g z4W4&}c?Gg=kYE*>8S#j?e2)rq*4H-Ym=qYKYeoa_mfV?H|*ScboToF z2d(e_)!X-fuY7^Q{Nj(NO3%%+KD;`A&#{e!AH={HEaKDfw8m}s4C7gT8}+ttOP?5iRr279igjz&pE27K79{vO==jAG zQ>BBa1Q~jCZrbo`@5>EBnPK6D3Z_ww+g*RCxy^JF+p;_KNAW4fi&~urH78`aDA}Eo zIF$D?>g8)e(E>%sr&F>`W?kUD{p!%S#XQ9mjCktb@l*v^dbqm^zXn>S}UG!3H7{`~nV&Y4&$u(rp0v&Gc9^IP7p6PfuvNBN@5yW;nL_S%lhtLzs& zd$T2Ik+b)wO1^)FDRR~GzNkEC`k*m|nelFu+WDF-vx=31KB}pjt?D{^vc-7$xgafn zMYi)Zf4_U&EdQ6|yM4jDv%Q>?KXzn=7)nj`QA>__xufo}l)B%XG^@J`jHSVwS4{6Y zro8Xh)b$@fEbcEz&ljKb@YdPcb8Kp7WrwdX`gh0jSnAPl$HaUu7o@*8yPg-9o}4^e z{oda=zd5$Yll}M1{`}qkz{ce0oV=c!H)d?uzy0*Ve|5`0&T!5?xwV>ILXa{1X6nON zZ*Tv3IRDR1pLIdLY=!S8-TQgtQK*Dka>}Jm^R^f*Of;Q!NL6KOk5ZeGwDY?#osv7Y zTv}QV>D+FUHScZL5ocHWn$CJ=%K6t%@49SU^Wuc_waBhTDsKIkdo?nar+Q6XRB)>; z*Hy~TxiXz~hfd7O9SwoL>~A?w$_TQa%AIk?|_&J?xq z*D@Usn74obUh!<^bI-Uh|7rwWKN47S9 zP9(Q*e82yn;kds{da~7|lV>}OSBQH%`Q+s1l|9{k=b{#Gsghif$h2)Aw{Y(Jb2WcM zakhJp;jVd&S=_fS1WZ#dREqm0xoIL_CDS6cWnce^Xcny6_BLd@;;YZX%ax1uHp#UI ztmV!&veybfJR-&B?kWlPjx<^35jtgy zBWs8Ea)#wD9+h8WAFh$wy){z z0)-x-u2Q8+X8nApS317R`FL;dR9S|T3fJXbxNUhkJtuv>&wlRNJ3q!SW!BxlmMb?) zSw_8PzMl84;OnPSx1%15>T^9?Vve6Eak-woTyBl)$wPMP13ewng3EY4Xzl zg`L6l{xc4Vn#%>*3R{!e1^Y{Ii3a?(v6nD*{Ym?A~OH!v+9g#YIb8~v-+pE_t zN}uVN=iN)nFFP=My57eV)^d-R@2`-0%yWI+{RfABvMZ>`RsIm1c3Snu5$WmoQ*34y zJ)C&_$A#l{bA{FY3*Wtw+}59OG`CNp*S%*|m#1lx$)xv-^RKQvvTmX0Lz_99d)%gK zDXFfD+kZ6v@73!DhNV+p>U_U;Y}zU*&R~C2?iOc-pL>lf83Mvn!rb3l`7Ae>wo2or zOVgrF!rbkJL2or;JVQfO7U*cZP1e-hdgZfi)B2}-xUX|RX$V+2_j1;hm)CN=g0iMu z%M9J=wR6?e4^g*Dt)3febo#zH^>%^QR1u9*mz2%SHy<`{N}OAI>8zxrOT?zOxw=(G zGm4UpTJJ|4&#*ZtGSy`H(j}8uusvCjccwahmgSMS?Y{1OPpz5dr-`&b_5FKym#{<< zb8P*uiSeuV$Mfgx^1S0BR(iI3{hnk0-Zf5`Jn2HmQkmchSErt+vwJGyqRsEN{J)aN zI+hZrt-V?ouLf^hT6t#HLyN**#=BdGf*~chvlnjpPiq z++}Xto%{ApOj=s`R916Y@u@9R-;cjrWO>qXySaJg-&3V>bx#7nmA~ImzTtc`zugJ_ zx_{hqI|~}Y+aYf5KK!QWZ1uh0a&5l;;?nA>;b&aIS~(4c=?!b)@n3oj{o%`%v;ud=p~>C-HghH#%w z0j2Jvlk#i-&ffFy)N3Io_MOU(-WSeUi5eDG)iO>_2`cfs+9NpA;(nD=*C`2~O%IBb zXZIc4>?V~pIZLCd>$uBOdGT8nsj|uGE1t8Pe3pF7%f8ftFTHfm{8Edzt|uNDI^WS& zDpusOJ)dIwHDJ#IE!k4xj*AzBwyJ2JO?nitX4!%XkAikN2^w75DYRx6y;yy=K#SUpVcIF?0Fd|HjuqV~tIL!rf=Hdi^4svUvk* z)#l%?Hos62(kOj)&%0cs3S8jdPt3`#s&|IZv5>`G%|DyM4&QK6w{DkM zIs3%x^?Oc*@B3ydR@%#CF*n$E+4{@ReHEI{6&A!w=w9UxEe|KBCr^^+yFL~jYb|#TKo9FaRxr};WpGOu&*VDT;D#xCjbx}@gsl#@~3`tY%f4}19 zo|IbSY4P{GLP^^4T8)gX$cW{u9=iRm2tNMW;O?zy*Tr2sjW4;%1Phg=EjjMI=I~9X zNjx%VX3t8^l|MhxdE3c4k2cGk-oy7Lf4y?ni{kH_>KSM$fBxINi!YTOPygZ6mN#A^ z@2TqWJ+dZaXR*QKsn_p`_|GrOpU)S?Az zv<`;s5wAJfS!AO1UcBh_7BhR-g=s>`{-3x`&7M$lZH2OkpGU`{_X!4bQ{ttj6u&+2 zC+yp+CHwuFFI{-W&6fD_LXR=GYN~yrmEgrcyXVQL>^iEu`=!EMiAgKME=}6adl#pHAJXzh}XlBn6lk2AC zU;8YdhGq25_*V99$A<%dWvus|T@+_<^Ui{G*-jZdYn~d(|NFqcv+%Rk%pVNQzY6)3D~+ zlP@#BsqFH&Y!SfA9}wY{_Sl)X2( zeM7?|R<@;l$KOecE}a~dl%~3?>DcxtrKttGG)zQ&1k;5pzl5bpN6lU^H(378!6O<6 zmZr#OtvKX4F^)AbOYEdoVOg$p#%!@g9(nkGR^H+p!73a(Z&_%Gbk0MrIoobW zr@R%(Shb)m{6*FGgWk)Ro?I*=v^dKrtgL9+l}kG$8n!K4n}2cd0}ns$PkFQI)2+(9 z^x0;GmVMswfakyr#=8|uvu1uKQf;5;+K$`X%PM{xI;=9k;>*PL0yZ=ARDqLc=SEL? z+*QnPbHMukS2?+=7fj3j<}E3hwn}Sjq({(~J=&=cOgI1gq|>wD@#~L`HxDviUl+SP zFKbrS$sEJyKf~kIpK1m5Xj@CTt#VatS@%R*)Z(z{CFaQ~%^z}oFY6p-X2z_#QY{#~WR1$!kB;pBo~0Y!YAm=BVBw(U)ZC~JfG38$VnB9ewpXRKyuC>oRk#T(Cl<8M~oHTkbrS;0m z*wUnbQ}B^@atmsTLgEEN)xByt7GIxW$;&k5n?_BTv)H4h6JNTtmb_Z35ER=wS*~+N zl;S&;8xs99`n3DxtcKIf!WRA$EF0a{=&6-?$Htx9eaj$&ceEUC_?GxWk z|8sEuAG^~5o2~CZKUXvV?oB)P(=$IvZBes}KGUJnmplJS?E5Nte%mh^%l+r38ObGk z^mr}*T7LWK!NdPJdRn%g?ApkF|Iu{QeP5?^am&0pzhZXV+@Ev2ujiG;w*IwSdLXYy zWzU-@$G+qqHgufi)#S0SdXD#$)&%3w$e;}MB?-GGy^=V)v%0`I{6-G@rH*$?E^bO& zvX(#M-TQ{p9`pWWu7#q~Z>P90UfQIi(PMFB&0CI%n>0>_yjvs?TCjM^^F!aRJYT_E z8OG`T;_I>*C!sqb2y@lo!PQ*JD}a9!+`Lg|IPYwU*Gn7tSKg_@s; z=@NbRc;Y$5>90N=vTm}w+rB|cEqzAf0pk;z&SqcutUV+ZO>2)V5J-KqvbY&m+g}55D=uYi6#t=l90bdwyK<-t+yh|EKHs|A`&uhQ1m|Z0k->%g)I~M#+yn0IN(V3f{TU5WZ+tx3io?P5~aYc$*w#MmI^@r5Dw|`5> zUNV2Zg5~z*aaXqZIzN;N4c)YJr=#V}4`<*1k1*j_badyWZEIC+&Rgy;JtEMe)-&bp zq^Ty`bzGShS^ar>&vo_u*rs-4TFX+6V>|s6o@eu#dF)bbh*SJ4s`!fURf~#(YWNw>y{E3I%Stmpr%W#<2wF_@kYU?oTy+chBnCsAjA@HE#Ka#xEkS zI9$D+#*WYZM#jP5+`FR)mx>U(**G5gbPU%ghIto$UT(_L_Dl_D#D>PJh@`+M@2PRr$a9C)(ACh7N&!c&{xyz{Kv5p_WMwbL?{ zsZ*`X%YOcgub*8OnVkIS%D2LQ@9zJ!_UZ2W|Mvf*`lBz`CjVJ`zNU};z4iIdgbU7#XsE1w1_n-3U0VF*bHJJzd|y$9G6+XK>Y?cyl?ne@gs^Yc;L+4lcQBKij6#y{_-el^Zeq;t#YxvloTTo*VY+ z^BO&?3F4}6&nYL1&r+729NgIvn0WSGeyntv*!!Lthe~R{-ZgLzx-OBt_S@HN<>{^+ ze&?n>;OfyW;hB}dcP{GKaf-=j;0B|NA1o=e_OwrIBVizS|Wg<@OXb3NSxEcfVbiYgzQ|Id;|d z(YMtl{f~vT26LM3bl-Vva=KC1=1I@hXU>+0_z+k9kF|9Ds!1nHoC2r)c^O|5**DQT zy!WVu`>9R4)RIC!Y|}4VozhD4)-z}JEcTwvmDZ{yWn|5wISrKBWr8Q@(iEnf1PUZ_Gm1X{`PVL@c@L|t)6W_~ICAv2) zkP6+gDdFMXFRm_;XYMXgjD6B{P5X-6=O=o1Cx+T9d|!9sJnJzFCj*^m|H#lq6(O%Y zel8Npao@;4$HaH(8qWlmzZ%Oty5?1FJYDpkZHbGerJvGm)C$C=r!qYCg>5E|A zgAd`;6~4S#bucgE*QRC1RNXE2rg_ z!cT2Kr}5A=KgB2Z#q7Nm=acb?{r;AF?_;0(h7&u?7IIrZl#x8VY30(GYnF%CgkN0W*dyqX)W5Z*Xbsw%=-t+0z?70#vul!67=R9p}zqjpDYnXu1#8X-Z;Z{2ro;$EY zLvm`eSGb_m`4W>uY8tDXQi~Os!`3wPSI$^_;-2@H3npuqP3?SokC#Jt+Z>}?HhsFM z>$c3(HW9k8aqC@|%}b80I1&10ciz%KA2Z1{i#22nPhQDOeebo((d|Ao8URiQw(Uyfrk6X;J7o2MDwBLIDtmnHf zK6AY<{e5ASo76S=D-Zf?rbQOpkyxVo3Ba}6()sa}lH;n*h{n!IHDftzDwzpj=L5qNOih! zt*x-=&;h`q^vZ$ez$#{c=CZ3lXF?M z^ViM3Eb(FG{Pu+0cQ-wnH@?}l!~A%%*|A_V^X;0aHZ87d5wW)2|1U4%>Y6EYOLoQ> z+0U4mlvJEOJNx=NL8pYmf&-t=+n(My`S{Ml$5#Bde+0tU$32_tzi0B_zqN9eUjk2U zVq#vKA8K?aLn3eMooS+Lf|p;Kd$?qh&YNwSE2n!4@^9>0wQ7Z%YHH}mV@I|B{8(-u z&RNo*AD#5cD$sM6^5-+b*|F{OjtjV?9O?3j3P}pw$1Lewa4e{IiDiaaw9(u=0p|o0 ztpiH3{WBvob+1kRvEb_DX6qk6`(j>Kbice-$SSb(($!xVc&Bq}-M`0nf2G^W8V>#Q zlj_7=9(s9&mwi)CW?JO8K`Zsx(yaPpDt8b0&E6b!|AdCE_Tlo+HD{Jh-B=trbE+cS zt29p&#`jCBQa(#X?PLnj&wI3w3 z|FT?**pol8&sWpaeeIbP(^r3+C0zpzm;ZubybzrRU=I zAk@fjCts2MTpy3~hbNm%of0YXsAX1_XW*&I?RNgR#JGhVr#twpP2%xXUc2Jd_2!qo zbE_@}Chqh6a?v&Jdac)l*&bDoW7qnYH0j+`=4u_R$if?(0Um8UmY&2f4E zIms~n`?cJjjdymG&i*Z5(-3W*|M3yG{>LBI^B?TK|CjIowfBF_&f9&~ng8d>@``se zpI1C+q|YoVROzUp;MlTC*(oaML_-*NdTwOI}SVn6)Z3z=W;;yRPr*%X1qS z74)p)3b)96FaJTk{#&@pdu!V>IyIAa-Q@OUd~)Gz&6`T0NsqTHX6$!)F=wlWrDy_o zDZ?Qxoz;ehPNBZ6Jm=09MZN4YoZxi2=)c&;*o2&;8J|_QNp!ArpW@}R>DJd7o5~hl z_Hgo=cQQ)l#m3m{=`UqMBUcsv`)^%+InTH6vCo^%Giz3r@6OJ@(K%OvV*-;$)VGCe z{pIExe_}s>{>zC;YmO?pW|>IvxfU@nvT!!skYbVA`~B|q@|CB~d}!}DvFf&h#isX` zwHJ2OPXE4k)tR1(N0BWNPjoJ`JYB|DakdD$IM+z#;^eOmD*w1O zS91kB_k|=M(y{59lY3^J&*ddoXQ^zO$?SOl`QL>T7vK4?-e?7Td%U88uu<<*0uCSzJ+3H|MolX00{|dc6z3>&sktoK7 zsy_#JFie}n^3~Hr#m8{<}Xa#sue z)%!~7@=J-wCt2(`g85#xomny^VX2F?>odm|mjicqTVHYxXY7yJ+s4lSE_rL#$6K%O zA6;Mf)%(wH`~Ss%PM@#ulmGXj{l}y4`;Q0v+iFHm>$mOtn9;NOa_|~4Zk^}a2TwV? z*d^fHe^J(;tPtRhHNTgmaE82f+ zN6_2mya{naQ~w;8Aim~+vP{!Yo(a81bGM1DVbf{hVSPTQrdD#}B>nT^mY$zGx`TE6 zTkYN*m;Uh8Wf}9TGSPtZ)4zFogEJ%os6{ePY!iwy%{f|LrnKx@cfrT)k{eH1eRziN z->(|$=2|{JCLW&<(!VikElczZtC;F1TK`T<=RdIj)Bc}%|DU7lKfM3{r~df+`u~#K zwwpWhe5_cZWgv0+q{!)~t0E2w3+^)W@{Bht+Z&gXx{7h5XV8@7u-{cv6T*38R(zOV z|FL|<-ebF#wycX*+~%Fyq?Lc^s*;S;|9dqn4p#kLd&^8PX{!*`IT88DE*Kdm#HpZePL)P3;9aQ+!UOOmz#g$$as1;jFeZ ztm0jUyix9~vr2;wT1Dwd3Z7Y@b5qd8>A@z`X;*HC+~}H>=^13}`P4yaXPMTP<{3)m zhFWP$f?cg$ieJ4~k1sG>yl+n9IjjG@^0opu>W_KNI+T8$VbZ;j)CT7pKb}9zyZl*o z-zRQ)CLh^_zJlfQZ%*}^C-7Ax`z+?F2nSa5bhx4_pKXW%GUk9 zxV+;1;r@w}V!WTTXlyA6d%u_K{G=+=Wpb-EuRV7>>RM#Ae2!qv()HSh!<}}jeGNNv zvO;5#X+kdV<|5^!?MEJ^h_9U6{rymmw6C%2)8>|oRvl0Ge13MeHD%epq!)_a_ueVH z%zs$B^vC2d(=)8sPi$;H-Sa^Dpn^w%$l+BiI_yb(sa(gGv~Bl$&US9<#a+jA7r&0$ z*bsave!6kcwlE*ZpI4NYiZ(2C2)ZRyB$v124;Lp#WkJ>d|B~8#H!4!|{FiQe;a{ca z{NBz#$>34Vj;%X>X#cwI#uuCP#^#1|*TtBNCU0EDHLDt~98}{;>o5uk(PB%qwHAFY zzhJ&;+Ts6Gzj-%*cX0Y??APbV?sMR9^Y@@lGN${3F66AfkivMzE%~Boi0P_blUBA! z?U~`&Id$IAZE`Kq@%N6M+gmNsd;A2$s#OQyz0+G4ySK~V?w^Ey{qJZC3!4Miu8A>d zhBpTlKmS~u;>QuHp`_`~cX}K1&a436pqa~V>^-aHns+-aXc9+iFh?kBMgRW47wtVO z&!n}TwyNY<8mh2B;(A2%L@U+6GFhqhR!kO*lU-Hx|4fC)Cb^VEPtNyO?}RQr zQ`lHm$D-sUu|C=4wo8he(zK&5zBDLW^1RyRxOTyEb$zu}-|V_}ZkWYB**7f2D?R9! zLeH@|i{uh6iCtSLw3kO><{Y2)DU%b_jC_&=9$(=-?GZ9_X_kS`D(}E`bGPzDot50Z zDMIPSV`cH%o3!=yZ1gnj>X+{Mzde`xSFxAq0owqN+S3UoGjfgzOuJ>7A)E8+`+gcs)QToZ0#FAG%DoZ3| zr>$}CjI546tYTbWJLBY>+9l?GosB9_gc;jd&PexbEfg>}eYH$%zT?vCv(7npOzrY! zcrfMT>+ScLmba{nO*E2IeAW`+nOgMoQ>u*oTn2_)q1|7%mR87bFq@rNSJt++*LTi* z{R^eFA9w{XY%5I2@4x5aw*4HB;o09T* zYrFYVzT8(+#O9W+7fo9-_ruikQ=$`v_WUr{+PT7oEu&TIV^w9m!wF!CkspJhSw|#f2fZelu4Y zy0S94GJ5)CRi2O7s?ET&eC3-bGBqC_NC+NSwRWOmN^HN&PR>aaGhey%EIXuIq;W27 zPFusSqQ(FlZ?@h0rhaJtv}OM5{~s^?d-(NriKFPJjlEx1Jl`|>h)MhbQ#OW-iLue0 zWgov!+PCxaPZ|C)xf7qZz1X}&?`&i?^DA%7*H;}MWh7tAIk~EF)8o?;ubFI-Sp- z{+)x(&(H7U!{71>6Aq_X3Gy)tu3B~|YwMvDEx(JAo7v8tJNMznyu@2aXclD}eQ zSJvvlwn>vApj}Grfl{~4sphpVvi@;*r|iw!Qe+z()^dE48Kyea1KZt-(|z}%e0qQSPh zQ?mW|@*B6UTXw2;-a3D9&-Y*Vy>~5q@kr^m!j`QXk3??Y{Uz3XMIq=1@82I&FDwsV z$`l~9XLX73M)pIePBhB7xX*hsm*v^4*CFR5+PM}h@TY}_FVg48I=*xsZ`;`&2Y-C~ z``ymrosyZ^HAAUhgV|>dB>M|X3OY{abp8EX+jA`WN@?@ny|y*qx4wVy@9*x4w_C4& zIO#tB!OrLNj<1TH)_bi?Fj}Rw++plySL~?X8xS8YSX8<8M8fYl!K;x$zWsIY zmIiH;munbO&q;D#XzmhKp6GLGjuq#xQn3Q%I4;9diO|x8$4HD#ouOM zY!b!(oUM&r9q_>Rwt(IXrILx?l7F=S`^0YdPr)x?>M4i6v1?8}Ss19p_oZN`!H;Sm z!SCP83u|gtIZU{<`Sl_(NnOz`GZv<<(Q~-{QU6Jj#mbyLeV)Rve|Vd-+*q<`h5A#b z32(RNG)J>G&N;K4_XmrP*qZZ4zI;&NQa!$QolA(YR)5-+1*@9EjAG1eKQnBR{GPP$ z!0!CLtv54t$_jjy7j9=~uXuD)edF%Ui?6p8{Jti;=hLb35C5v=AJqTcY=7AL{U53O zRX8?8u3YVPY|1{aA8+5=9ech# z@1B6S2MNN4Im;5;N zCOOJ%w6b;R(>-CnBK>v(i%M*Y#H;u#@A%U`OfIo`v$u_JqMw?`@lT9;EHe|1w1^Zx zG-0^lVe1jK%kIKA83)hUIgQJ*zNGKse&}g7Ys-zNQ;wD&)K;D{;hplKJ?bYhZ z|Msn1Jn?mWzTq@YgQ==&i*xp9x*yb;V3?<+kX~^=!A5N7R-fRW;)NGWcLl1R`|;)1 z@*9;O7`|q(6v=(wY}xd^;?qj?g3qUC-?(w-(63`wWpZyGU46f&tKa^o!2SORzkmF8 zJOA<0>G6mDJ=`~Aw^jS%$I1IN9dsnIFt;tJgN>9Ex=jPnJX_2}NPaRKLoh*Je>1lJriY04h7tCl6OP5@dl_0Iu zQP+Os*rbg&WM`$s7qBl+-0gR`UH%#0pNU_igO+}MZB&2P&*8_bYoGG(OP?xp-fME} zl+5kWv&s6+8{b&f)ICnqoS4(Dd*7eo!33|T4}U2HNEQ6eZCPsJ5Vo-IWKHXzC7oei zud4q3^kXzyF5U8d;T?k;Qy4w?M;(5BIeFs( zuR!L5x%IWug{n@oo^EoDWslig#koE2-jS=T!wsZ*3mzYv{^MPF{L$z0>)YPf{{LO^ zfA9AXUyRQ`__z1>j2^cYtGJdgUmkJ$MnkdOZ(43ro~?vL~g>iE>Yv5E|CHKqSM{J+o@D zUQII1U*@9aa+%lBBRTSR`j=pi>WZlb>Hoipo_DXT{c_d*TmG&No{Rd+?}1k2lF2U>1r#z8k zmoITq_c^%WCg)C5(WMqTI|T%?1idGI|MAiOFOU20;~&;Jg@h_k+@Y|1j>?Z~N^hN2 zSNa4#x;bZCbnKfirXj6&SkqQ6DQR9VknnJuOF+^j4Y9dV8q2RF7FKb*6Kmj?Sev^z zZ`lJLmT<-6YfkzK_#9$y2{;(i8)o=JAmH~d8IB}p^=a?o%oUZUtaO_mr09@(w!A=O zLH}%~l|iOkVwbmfCh!~Wo5H-lNbU@0XsF_|j-N^EVuY7VOqH1zd!5fLKh;#~p3`2p zu9C&=UiW7zNHhnQ?f>`X->k{|wkX!B7BVg{aroH(XU#wHkIwrS9v3ls^U!_2;!9~S z%f~<7$nckyP4$_Y@Jw^f)TSp=Uu0N~Q#>`fB2L64Fx}MN6Sa2Zu`3(1eysI-k`xie zWVa=iA${pq z_x<_97WVvkL7$13Zw15UnlBsp)7+Nve0?i)Kvr!#c=2l4;c;}J>Z-=uF_hJAK6Xt<;sHqPZ~h)&vDMh*_Yb?Izec4E6li(Va& zxmqk_t7^NAVfEbF>t4SZX21C;;LR{moOM&}ewmJ-s)B8oe?I#3_txcmJ>F|9Bp&cO zZ+#~JJ5s!W`Ek#qN6X(Fz0H}o?x35!-^{|AqPC+oaZT}WSlD$AMyzJ)H8XzKrXD|O zY3nSl|5I`m`OS1TX|{y2uF`YSToH3nI^|x^BzI2r1&dZ>s(zgj(c``+Ts`5vi2Ve^ zmJKl2&2WCP~h=?1gU3Y7Bg+qqS7nfAPbva+r; z8z=GBTh*D_-0tn}KfayTe|*;b{*i0n#GZX-ZTh~W<|kKC80+GqUk|rTEnYJ1gKX0B zkmS1&uiZEzAAgj{-~Ze0-QBx_uMC0~&I%7*>#(rrlh*U6@9h*8PS;>p7j8IZ&SX)h zn{_%uA>-Q;*1awtRVLhX{v=)UN-?-OY|7-7u2gsi#emZ{dOJa5t4 zswC*YGNi3)vh=SRCXkp6j|&y-K#f^{d3ygo0oE)7~FmzC%{Lxs~gw zya2zrV8YslT!#7!(Vr3@6bF=k+3oY+`jr1x&dyI~{LlGqj9QyeSanovZNQw=i_0V$ zb$%5uZW8)_?lNEV_7_Jxnol?#_+q=HLnheq;%^o0!|W}U(;}O4CWSGa&0wr-pw#7yX~BNyR*WO@4!A zvPqT~-x9{~2A`HBb^ZlQm00x;#DAF7_@V#*hhW=U&!fJF&Ul|x*_U?q*rE5~Zt15a z4O2t?SDjP!o{^is>y-)fmhCq`A3Q8HP2z7$SFuyfTqRw6?mwM=n+;&M)T zg{QWp>CIzLtVAcWYT2;9T%@9U_uc-V(pN&4?%`spbc!|Ilz44wQ_ZJhWA5N9P9;ro z$?ON%6VD#inK#p}gLltoM`g~*vkru4ttql%>^$mpVd5#~5L2HeIsVn>cpqPA?g_CD zoY9|lph!^r$E(8gQ@EK9JUzwv=wGRdhE(08-&@zYe`>W)k#>7|owc{Eke#i9?e$^f z`TA4NEOA)+EVyb>lbW>Q34xqsO(9M1iC5QpE(vh6^(ee6UXV1>~S37fO zbV9EEv$vMqZ)60Te(+Y=){3fh-72`YkV#^O-|`t}(^kA%(4@cjm-rXK1ADE@3#)3B zrUtCouyJGO*51-3b2jeV#wPIa+uGX|FPBa)c>XNbM=kiwwd)0+uj&5j|9^S@qy7Kh zr2m+FeP4HZ-Cwh`$DAE4O16^zf=;n2_qVy^wj9<}cHfwH+SC8vE+-DB#(S0)$MpYw z-5&I;`hexNMOg_C!{n4d?qN~SZNHM;pv&R*f!BSX&FVJBr!yWz`jszMoNl5$Eq!tB z^9Y&u%?C5oqB$08p5Sg%y1F#H`lQVYg`)X7&#K>bDz~5Fmgy}K zBIqjb_;=aDRQ}nI1AksW$aXksPG#M`DgV_Q&V-7u^N2aU(rChRKF84Cu`{1AuuojH zy>`*0K+lD2EBF|m#+)*_(Q@!!d!nROiSPz@x9)4VBKRi+>2M#`TCZl&^1vWE{&0?& zqbSpvsWWGKT|J73dyXl` z?EfbjSO2$k&*yX2KfY6MQVC?2}Nz&X)0-|_R>>qcUXht zh9dE-gC#Ww?*IA1J7>^9TJ|*F(JYZ3NuqG;ybL4@Xguu zL9WJO`l6!XCuvKK91BjYbd8#;RPNo9)|OT#`6S!&XK7PvPNatAi6~FT_Qh5c7QcV0 zs2nbNo=Z|cz2R#^#%>O8{r<@CnR#K8R!j}Zib;QF)O3A<-UA8cq%H${k;D8+;)2O7 zpQrjP%duK?zTC6Ie6qmbJ-(7PeW+<@xBp+Yg7B-XmN^nrIDKOq8RpEL|8V8< zc?YJ)*ED)hU%zOTw2Yk0qgL_x$J^!WI*!ZL^6ZOyi;`n?Q+j$CU3nY6V zG+lm@uPS_Uwp*9%t+G%*>BqW1b~&XSi~lpfo|WCLXIG`hY13zXE|NyMOCB|Bjai%E z!~a}s<&iB;Cw2Boe{xZAId|gCg`+%|)}#q0Rr(&imadk*B(Lx3OT`nFJ=gWQ>lVy5 z(OmAq;l1p@mx5cfmgyW@_iWBlom;Ikk6SbL72cKj?N;mYG&?ph^;E5?OyZ5z8`9!V zEnHakvBfFF+c4>-ZtCQO%*egP5?7}hSZ+OK&=?k$&$^jMKt3esYC(Kqtcm8N=k`Z6 z;#QOy@%KIAK9KNJntx)GUDMfDO%Ep=`Xk-3Hq`J)$p_=pEeRVkydsqsAKBD<<6+#s z_y6B2|Xe~GPY@2^MheJ$lX{yl_v#!wA^wj;m$(=pfJlz|V_a6K9HssC{ zk4Bg9V~#9Z=iF0f_k}*}`Sjt&GEHk+MCaGbPuGh*bn~U;yZgJ_S6^S3v^6TxMreQA8Oi7A z&n>KNkEWO%{>yHC1mV|)Hx z#-LZLJ=G_(OUgRwKGh9zb1MkFu&RI0t(Bc+suhYArGY$IbITR2 zQB`lvYXA0mx#q#Ba`Bq`K`S<#npgh0U`ucB)f|hZ>ndz!EG`L}p1yL%qCTDA{WDAs zoqO~AO-s4dot&F%PF}N3-_f16;;)iiolT5t%pdz*A56vH+&*2u!+_^^;o`Lg%5NlU zD-+t&uC_lum|yhtw*_;qkA;n;WRGC*`S|5J5>0O}tU7bL(xWD5xtheoBh$;gv^o!l zIN$ew78kF7nYZ-2=HGq|gM-sTmh!e%y$)R`v^^!)yJb`Mb$6}STh%?sgV(IhU$jbF zjJ0PC=6TI7C@Sk(Jzc-?;EwwLc5aIW#kws|Fu$HHt)L_$ zE0<(7J85G?Q}MB5&)Dkz|16b}ef#jI`26EJ+ZdY;XV^4_M{eGlbf#xrcha#*DJ2o% zqO*1d%CofZ|NC2h`X9IDCONCO96589`v;qz`X1H?Y~m`sHs7Zz*-V|baYBE@ULzCr zt6S6*uPhZk_g1E`v@4+hf{*#bnx#g$$xF2S*^G{UihKI(o}$I2G9UlUBooC2pIVl! za!{Gq&-1k=L@_kh$m8jj)6Z1aJxF*zHEr3>wLc8f3b{V76M7Ub&X`g$*X_xaQ&$#q zO-j^U8P#LO;eSkAT|fMUcY)mAV>5rBxuzp37&MLd&MfJP%C`mXADLzw`YEwE;uqKL z!Un?y>CV$0CH~m^OFe#tTh4T^ry*{SgdWVC+1TRLz3tOn54Y-A@xp=v3kKP%+waGj zfBn!O z%M;Q}7IP+v7)~md+kBHJ{?3lZfr%Ox9pLkuF z<1tm4i7|KgC7bp&g*A(IE7V>)(UPw<{rfex7kk$`@ve~U51E>_eZ5a~Y3Dm$cE;mL ztp0ulQkmw$LF&iMXDY8+=EyNMCU}F_I_rsn>THGc4KLkR`ew##VzEO~LsIwJ>s|Xa z_U~Xk@tt?lD)vXcpO`ZroLuqW?P<1No`kbRQA1$eR-=da6gJP8&38;HMo3Q8<8jT# z1AphrJ~^_~Uo=4d>p_Kcn(?vMO;7Xb@ZF5#^j)*7?xccAVfaDz3+MfKj-;fd2*rE; zY;iqz(o^uu_epHKZ}}SCUcV`DR$jc}%v0XcM$xkqt!9hJvq~gyvf$|MzHs+;`Nf_m zjrqrv1x`v778f&Xs`VUKKB*V8^~S9m$KKoj<~eWkm*?G`UCl2`n!Km$KVIB#cQE^Y zwXFT$ll=uxKdG)+yY?`9|HU2GSX2sCl+hpOMLTB1@fF4@x<^GDh>^PI;{<`YTJ zWP&CME`FJ?gzMa-gf!)MIz<^petvcO$pO+oQh28`nw-<)`fGKxL&kW{`jpL^vchIA z{v>gVOIcr7Mn%|1Qhag#LJh+SPYQITJ7qR*s?ck@I$boNpkaLh51Z(LR-wcVg*B;9 z<1@VWJu`03H-E6yLV2U+0iF-ceSUr$_wUZ{EPR@BZra-gO4^RIdt){36kc-CFiVvS zyy^31ZP)KoE&jEE3p*DoU%HduxXaT@cdKrR>GMZ-6dD(*JkkpPj#b$70;&F4GDKi)h(|DkvJykqw+3f8EeI&g8t#lpF2^^-M% zliyrex2veAdw#O+@`BLE>;M09U-4?0j?3QKD%;|fd|hr1cLW2DR58bJ-by+;$6NIF zYu}Pn&MGQ8NA>0uzqqA3Z8^Jwyg}T4o}xG-u|o#GgDn{CzRVDtDHX2y+{k9)HA8K^ zpzy6BIhxuXmLH}vO!qQUn{EAN)|@42Ith%a$!{){a&~SNGSy)_CG0tO*0WP0E^*tN zIS)@Tb-uzr;giFOiw7iQZ_TJtTySE;k$tvGs5u9!J@5N2`2(8JpKp# zTi4yb|CfGq)x+1@I{szOIk-l7A!dL3d^WvDjC8Cc{ifFnTF5r!G@tu`1x5(}K z)`-&8ho-EaEfpHv>~vuH{JRI-=hx`=o{>J=Ppqaff$@X6A#|3EZI;EezaM zroFBof_fta`bC)c<+$aFGj^Oi%98MOW!lG&U-Ud0Hcsj}voUIJwYllf^x z#M~2e?+Cwt_;BK`kQsBEPO6Ch|62CL?b9Z+@L7%fayR_%DzbY0@L0p;LWR_5v1?{L zVsBbIS=dTV_2$hu{PIWxL(9RY|H<;=P9J*ODiSNQ)Z3kzk*t zu|2HT9EaW+?=sbSch7<^>B}jr_@1^4n_bqkvWj-fgnbU)l75`ytjOc7-d)N8oE%Mg z1q~A(6rGw?rYij>Y3mU!*NcKYGd9KbW<+{=9nF+Xy5hv;_FTs-TWs}lg_KVnvCEY# z`Ijq)z37-UQBdpT8IetMUuo~z5wd&-OOTuGEY7}%PiIaQi!h75c6fz>RHb_1fM6UeZorC53e#h2)xp@4> zjT;Ak{o@e@P>tDFBbmSNuiCY=;LMp8-is#r`XA8|kSUd# z*!x=l>5mGVLqC%`>;IgT{={I#cuwZD(kpd?A|rQGDb9P18k+J44qHytxBeVl;OCUv zo3tkLtYXU{Yfin4H&HHr+H217F)*n~Pk*?|O=gkP3v-L7j5lmQ?_*n#=lzSr)VF!v zh^HuA*cIa#Oh03pny!-Ma=lCp?n!4z8ircYGa~jvh9&8l29agxU z@1{@KF0sCr`TEE7kqWnb;5P? z?(8Z~e6D?g$>ef?yQSJ?we=}dn~VH))GaM1xZjjuX#2cGB#t>^=LX$Q)*B~h1v4I1 zj_|eU5)^fetrD$JRj;a-S8-rj^)}(_tP(yui!;~E4Ps|^K3x7#E@eyZfv8o@cVm5K zNxhbSy<^MXUI8Y*^XEQ3ne6}Q#RrbJtBw|*w{0)4`>S{Dnt4H0Ra^M}&sz5?f5-0m z@yLAR=H1-xE%`QoRsP*xU)R`smiNkJPN(4JIX_$`Wywo4tzL7>&rESzwn$UN`Bb)h zKW?rs*s#6(fwt~P*T@-DJ6J`T1=B0^B`18!T>rP)<&@Dm@2sxuAN^aDo8&FyZ%$SU z?SAIA<*v|k_39VT)FsZE1@>M$!hX^E$PKTj3zQQd3pQ}9zACiwwaaP6pA8-54%953BQ!^;yWRDR1l(DTPct;U0ancK2%yLlOlrdWy@2qs)*$#}ZBIN3esmTH*l z>@UY1IaP`(ZoCN2*psB5HZAW>>SmF)s4J^hUrvy^SboJWp}3fN^GTP6GfUp~&b!rC zsxysSM&@0TiDaV5yhk;5$BQ-|IrdDAkDo8#y6LjblAykmzwJ+zXP=90K7YCV&X$JaFG@B3pkty^_n%-*gGEEet=v!Z&PSt4F19a)uo+GEG6 zBYSWCY~XmH|Noi1fD^BpTd1kmyO%0ze!)vt3zW<|&#{ovB-$`UG=`(#9JkoQN2}KG zote6R;w}xjPE94ZiH6~!x}vSh0q-u%l~)WAUG{o9cdA8Z=(8q{B}Y7Gd3y^qg&)na zmu<|`SSQ5ash6s=d+IM%zQ5KYcggA`}u0l4Dy)P!r|C-kP`}usutAJyh&aOC^ zU;kO})v|-vzNwb17Q1JCP|r!jbIC+t(d^Gj-4Lv)11~K3jj^O*&l4P@nts zYN-v~fu=06CmTIl&p%Mvn#B<3-TnG%w9_WRIjNclHppr5T#^WnnD?&nvC!F^VBgqC zjXNx^uWg0Af9A3`h3M~lQedSY+$CZCWQO2XuK5ZJjUA5$8+Iv|t(KdZv+j~#LEoi+ zk&9+>EnTx&bk`>BP_OITP6U3OJ>_@0<;mxC(o(3lyh2&bhfT@aMDj4Si3;FS0HQ;*b7T#df3ni2M%;on42n zZtMDc=)~o?g}G%-yd{PYzxz2Cgn;S8F`1bJnlJF z84|araY_Gmqxn_mk9V}JxxrZT{t3%Trm0=c66aWF>b~wS*Gf3pAU1EpSE*-3{52mk z+)T~3Z!-wwXM1_MG-V~fpz*_k{}PYWSkw|~i`m}WJnOcUtNdc9^Q?Hz{P~Y>J@xL0 zJ#y@q)w=p$l5y34P4Dcg6khz1kPb_?x2s4_>)ou`1^{SklErB$UYo;TeVT@X9Gi2KV0_2s%-#HX&mygyo@ zUpL?q`;^dxDJ%GI{n)kealxYthg(8|O7xd_#U9X;`=|H&)gBnrTX?3{Z#ES3O?@`!nQuYi)k3=k{n8V58hguZZJ5M$z%Vp6c@V zNmla?TDCua99$CHt{uKEAw8Y_$v&nz5V0b>HAy#?SG1t#wPEKd30;* z>K`x4_aFXV|ABeW-*2}qtgVk8`(@?yVa9p!j9Hwkb_v!ye@%UJE38KMz=~H|U_=hTpp4HxHWK-yZcg zJk}u*Id|HZeLEI7t=H)`Je8*S?(w=0W-cmMU$#A|viB;^y7u&dSJ`>ZretX26=rO4T;+2TfszO0=RTX&unxpBwsT5tnY7^PC4c>UyWI2yS95;O~|G zUoF3BDE84GkA$ zUbFn3<-Ty0aMJZdNo>V_t;-MUFz${MzEH~{^fT;g1J}(nUh`^{+k1V##W-A7WjV_v z_-U&C8<%a*gE&2TgzP!oTlMA@hr~6>F?hatal*3acyOw#+TDtXrsRk(jz=~I%+}p} zl+VV$ky5*tJ zQn6zN6%aM2Y8s{C;xh#-ouxAVJk*dOE!$VWnPi)m%ns+5+F;7{K z&#O!MQzvPibyyP^m$f2NOZKSln`6?IOY}>&XcaEouGJ#p&t!5)u9P+1J@i11)v*i{ zt({#<)F)kxn%Qu4)6qXUjf*b}$J9QN+O_U*(#8Wzy{B)TKKImIRa!N>6WuiH8NDmgb!-Ke*kbLG|QwA|wkp{#R=w|HH4>C|f(&V3g4H+$~A!m(zGmapWKR28W?yC0~$J-M)V zZib4@!naW?g@W3B7R{VcSlaeI^q|0%CCJwgtmv?JnUhCqLuss7Xmlv zOV8ijK7&zK@Kn*1zh`GgM=kvMMg2$kE7sTAYw=|)ORK7BaZcIwzNw`VPSrAv9r zYNOU(QF94eo2n&o;KG5UFD|%>a#?OYp~>lXJixFF%4$0tP=e{^vU(~*t5?YdTn z4>T%L(xW|n{es||A9BnNH?#8xTo1h&V7|?);QzhaoZOs;U%rUw*S?Ofcs{rM}Rake%(w${5TUr0v z1xr_@L>-#5!RDTG)VYg3*92d!4B2ZH$iP^tdUf*k-`edi{vyKXPl>I}HoY4iIwJ>uc`?KOz8H=M<-hPy< zARJrLtNUbW_wt8FYZt1&FR(1lwVpUN%V%Q{C(n)gYtK)dvHCu{xk&9-MBrTsG3__< zGNQN5l-S!Bq)!%kd2V7<|5BqS)1xes4KG$OBz`kJqw+b9!}pG*-ejT9ZO${bIHJzG z8Z&IWulOm?vDbLhRw+-Xm{#s(K@quzbA)>w|A-umk}Z5#ezIHGdHU@5drqP!9VQYJIalc(xdHr9#xZ1Cxcm8~0JGPkfTlx2o zz03DC^53tQ|Gk_4!=2CPAH4a)bB{e{SBg7+XF+Dd0!TKxxIehYhmXaFwM8=X3U}meYb*=xPNvENEI$RWw}!2 zK1;l$?^8#ukK$!3ZhR??Rc|v{Vp4AObN?gBzOEHLqRa)Se5O1MJ@3BZK%7$3`eV#< zd9*KwJ7sg9bz9B0a*v5w;KrHrf}d2~@r!=IGuv&ItDj%NIk(wMuBC1JlM&$gLfy#Q zXtJi3+`KTJ|MtzNZUi$dZ|u74*1v5bkHmDdUCoR&->SXh^+T@xEb5#*S@>>&NI}UZ zZ>dfW$7hdRbCUQY&voeh`|s(kKczijyMovnSG^6KdA~Z0y19eT`7+9#{M}@7_^U+K zxnFtG8ht5~`ubQ|j>7whOC-(n&LKg^am=)v}^r?5w zmL*r0$VkjHNl=p%c4N?Aq?36rKv5>deBx#wk1w;zH(s4EoA2!(fjQP!F6;itTC{xg zsR_5k)L0T`E?dH9$sM^eJG>(|Tx9FEo$9=-U0LS(Nm>(IqaRFInqgSZaZo!_V|u6a z2f03{z&BP;CW$MGvRz@^6*@U#+DT>>bq39hJh3nPgtGS7a-Z6zJ2m9o-gAsGt3GVf z+x)?FPCi40s*&YU*#$PTwo5|8UI{JOTRQEckW2?>oOAp_YhHfyUL(aFKOA?>j?G}a zke{An-RJoBoAZ`Q3bu3KPTA1TDe$lH=IW(qEG+GhzkHd=7_~;r@X$nM*~*_@i*I`_ z?>ZE8VNFo8E;nIm*FzoxL`wl!vp4N-K^KHUk?ZuEqiBw;A-~uf`WpE zv^xp4waoGN_Vm8I#k2kWonx=>|Ch_Vzia866UKY~yq*5>;BWZ{U*FgAzu)tj&uy{b zy12bvKWqBVzSUi`KA*!&UO8#ER*Ej?4bh}a$FJ`{@cVu361(0IKd-||lY|bYtXjA+ zm(Nz-vCrYCf=T$DlZUmvTxMRZ<~n3@cF}wfO{J~RUx=xH_$smZrrDnLg1y|rGOt#( zsjpYkOqJKV;P&L<9u3#M;-8~lZ$26t!`GsxY7yV8aOuOk?jqZymSAI1?jSy|ozwoX zTQ&%(msoQDwN|g-a*aQ%Gu!$0Hl_o|#4L}-)vmn77T^11r#EM8&ew!QgXpBKw&$ak zN!mp)oMU(|9oZhYG!Z}@6x*)Le3 z5q+UYeP`D2JGqJ4yjpdr#LPLCRl;@GnR1buH@o=QcmIAc$8c89#dT3<#JO#LJxShC z{$6j}wrv-Wb?m(>n-jmQrMcO;=DGhr7WvvQhOa(KJU`7USNX(n&+m8DKMv0S$MF8| zx7wUF>ywRUJ^1m3XJdE8vzf~;_GCu{cwhH4b6T-y*5R-Zp{@IW&)y&YIY`}(ccXCs z;edtfvMg4mlt?r!YvS}ivO1$)0+=udc60j zl-P74$m_urZndPq&U@@E@thxCPPwu~@5VXd2W(D;v(0!k&hR)%oGnqBbineI@l2~u zCkF9zEmN;ISz8^rTCk9@CiY16Jyw=)4ALcdNeUBT|9 z7Pr4Zl1J_94Ski=m2N#MSKZI^cG!m5yogw;Zg=x}F3ag>Ee-2>Ev&4LCGFEVb>zrK zjkhj7N(UwtzA%0s)aAYNM1$MeoA1@a8CAHW=PYAAXtrtzXBo#WwHG~i1U>ImU*_0) zt;#g?@l6ZU&0qVh?rq6l_q6P-tXpaC%U`?FlrxSpCMM5%eEH=~%X8=b1f5#fWnVnT zH(Pr4j_TifX6ELF6%`EbE$(u)Ebi{@6>l~k2W_)RNG=vGy!z;(yWBx{`MRFx^Qzh8 z>%SOYGrv|?Rn)b0tLc@6Y?bZL=he&2Thg8z?j1UT$?-4eNx?q<^B@2JdEx$GMM<>K z1238RPfLU)+&|0_#7D2HELqbIw11G3keR$ihoThKq|-zGYga ziEUfT_VX3v#bq7qgx9q+v`f179DgOyy5v)BhSju7kBim2ZKT%5A1a@9(MNQ_${)=N z?uhx}^&eJRBdd_l+w)w8mnp|}MyLi#+IXlE`^|r+>i}OjHvZG7( z-P?CbH@8XMP~5FPbHPb7xx06J=Dv_wxqWri-pr+mi%r)1STWaeZD={@;;hckxA4O& z)iS@9AWb(GrH=R=GfLFfmdyFg^hD$Ok{M+$-q~hpU0G~+Y_aFVx848q`%f;JQ~3Ox ztN_R9t3rw)H}36gVdpQ~ux(%C|5q;+Ta|>(x<4aG6Z``|gZMQI!%`px?&U@7l^;r71 z->c<6{(SG{2}l1iJ~N$o)o_LGlFjR)8x<-i6g~2quf6W#BtuU9IF8a#(Oi$NxfaWeInM;#D@+Ey= z9n6+nc*G?_J;X2hMUYnZ5uYBH-wzqMT(4@gIciu;l{MRB`BLM)OHGtU#`EmUEZ6m67An>{$Cyjg=R6IloYQkifHg-k;)wX*1V$ZO}SuCZOf8;LSeUw2cv4 zmA3mmTXV!}+mlDSj1f~4maSomN!9+jaJGb{YiVkGpXRHc7~Op)aXd$lZ)DGCxv=EQ z>odC?B~3-2E;L*I;mw=Bg@w;2&hJlRu+Eb5QJZ|JSv*>7Zk_=1@7>i8L<-;D3SG1I zY{C0?u`zqASf8ga-%;~ai|;%C0fu#UpE%y#+1-XkK(Y8@Kn&Qw9UA_ogSpVkb=6@NLakZFP;{#OPUq-QN#sN1W{!3@^Si znb+rPu#!JU;o_iOB1pYbp`**d3OIQG$}*0nHh*4eDWG_Qiny-N3lidA`6F;1O4 zVaNYkvoPI1m168lZuh@kSu8l~(@5y-pssya_`~C%4_o1Jbdv)V)Ir_vFF7(`T2?aW-RX3UA9?rUd1QRJzuZQuK3sb zys$o9{E2N`<=3f2N=GG3Wn3?OOS5rW!6avM<8XcT=j*N4ML?Lwd3_6^=IZprgPgutq(_RTiavs)z1BB!=96y z=l;+W`r1D2JL9?Q9h@D@dJ7!47zA)xEq-C5@<;Wn*{5^Lp7EV}%kBlOw z^2EfYSq}0>#!sS7y?@MPXV|HJFKO$MhZiRb#Dy$A*5>}=q^{b5E2oqmEp!h&#FM$4OIRr6$tJUzKv0xxxW|p+jliDb`A+`y*pQSO@2@0t97xv+t#ktwfXkranP$( zA2Wk;jI@hRZV z)t^%P=4ouTYmV5!Ds{y1kQs~q`jylDolERbT{siD!}wa*^Z=>nB|*j-;t{KQ4)(;a z=lJSqlv18MK}wZ>f9RWEAA;&Xeea&F_kgQ){es04FR@CzxVd@mn+?}HI}W-OCFzC9 z`kgzk$jbZr^>nRcYjy{DJ&;)I9Db`vG3>>QOFsTFFZ0+;w754+y6)BDBI#-QW!aI* zPts1zu{hy+uFreg^1ml<9pi||x~?R?aMn&u|8!%YW6F2mZcQ@uw->YCz4xwdPF^l( za%D&PbG~ic%nSC-cr1P1E|$Y=@=K2N^z#A2>6`fCCanwByTfovKwN!GsKu!dv*xK~MvGl_JG$GsNG9gu{s~#!d!o*t zZklA~I%9p>xy0<%Ue3 zJ*;EFZ~Uor*)x_Ye^_7#O6j!G;wn85JtQ_&=WR_v7$O`57G`1kPD*~e32UWk8bv7I~ragAMj!4+SbOYsvvJ-ke7#m(M$LRzJT}IM8c` ze)x{6w^Dg^mE8WeKSh$n3o9yE{3a#1+)Ff!SNy?dX&e^YeuPuM?zL)wL4o(=8L8<< zS4bXYZ|}F;*(YtD&v@p=6q6~XMN_W$gm9FtoD$(x{>8_95VTTk!Y+<&W*RPwK` z3{K4vS>GxWXqx@utIOH&CkNwn#8r#-b+7et-6eKHR>mkP>g1hx_hP@xs}2at&7E^h z;C9)?EDcSs;|+1lqHnZCEiI=75yAItRn+#bW;j8iivnHjk zaeFOzs&m}~hL^9lZ;3fI>(;SFoC@5@8#No=l^xrx@i|a8@Ck##+oriQX5GlRl74oM ziC^QbBeNhXe*QV4wV{Qu8cS zvEuc|Hn6B3T5(h+TK=SJ{h^BIwWm|f46XF8Zc$m>w7E!q)v4s)pHf3g7u#;kTXARe zPrp8Y2Ob&uc?mW%lQzzIe9>M0==AyZjjOM(Td<0$L*nvDp7Ol=$F6FJZ`{7U`wZvp z=;#@K>Jp~BWpZy4sWlxUjbc=0^iG6JU|IPG{ z*#4yDYZ}&m3SRT5*y`cR8s^lZDS|t;pA_b1p0ahSz{6NAy>m?0wq`s({z6P$LEPZp z9+h2kN?#8qe2fd&ZQCAqMQyE0cK>|tIH9ZG_~!&x_CMG&Q*t3^T%r8(JJS`^Tb{Me z2%h{s?#hBE558t6y}B~r>FJHEv+9CX8f@#G(q2ut%w^e`&~>%4$JoIy=ST3nBP*6# z^k|wrZRwNCs+4u&4d^s4UU)Nov0wDG)VztCjqIkjIe3~eeO{vQ=|?@|+=(H+T9<2f RGB7YOc)I$ztaD0e0s!|3RwV!c literal 0 HcmV?d00001 diff --git a/modules/home-manager/antigravity2api.nix b/modules/home-manager/antigravity2api.nix index 6dcae5f..4b802b4 100644 --- a/modules/home-manager/antigravity2api.nix +++ b/modules/home-manager/antigravity2api.nix @@ -29,6 +29,11 @@ in default = ""; description = "API Key for client access"; }; + glmApiKeyPath = lib.mkOption { + type = lib.types.str; + default = ""; + description = "Path to Z.AI (GLM) API Key file"; + }; }; }; @@ -46,33 +51,38 @@ in export PATH="${pkgs.coreutils}/bin:${pkgs.iputils}/bin:$PATH" mkdir -p "${workDir}" - # Ensure network exists (Not needed for host network) - # ${pkgs.podman}/bin/podman network create antigravity-net --ignore >/dev/null 2>&1 || true + # Ensure network exists + ${pkgs.podman}/bin/podman network create antigravity-net --ignore >/dev/null 2>&1 || true - # Wait for connectivity to 8.8.8.8 (Google DNS) used by the container - echo "Waiting for internet connectivity..." - until ping -c1 -W1 8.8.8.8 >/dev/null 2>&1; do - sleep 2 - done - echo "Connectivity check passed." + # Wait for connectivity + until ping -c1 -W1 8.8.8.8 >/dev/null 2>&1; do sleep 2; done + # Generate .env file using a temporary script to capture secret correctly + GLM_VAL=$(cat /run/secrets/glm_api_key) + cat > "${workDir}/.env" <> /tmp/noctalia.log 2>&1" binds { + Print { spawn "sh" "-c" "grim - | wl-copy"; } + Mod+Shift+S { spawn "sh" "-c" "grim - | satty --filename - --fullscreen --initial-tool crop --output-filename ~/Pictures/satty-$(date '+%Y%m%d-%H%M%S').png --early-exit"; } Mod+Return { spawn "${cfg.terminal}"; } Mod+D { spawn "sh" "-c" "${cfg.launcher}"; } Mod+Q { close-window; } @@ -260,9 +236,6 @@ in Mod+Equal { set-column-width "+10%"; } Mod+Shift+E { spawn "bemoji" "-t"; } - - Print { spawn "freeze-shot"; } - // Browsers Mod+W { spawn "firefox"; } Mod+Alt+W { spawn "tor-browser-vpn-podman"; } diff --git a/modules/nixos/bla.sh b/modules/nixos/bla.sh new file mode 100644 index 0000000..1270050 --- /dev/null +++ b/modules/nixos/bla.sh @@ -0,0 +1,4 @@ +#!/usr/bin/env bash + +git clone https://github.com/liuw1535/antigravity2api-nodejs && cd antigravity2api-nodejs && cp .env.example .env && chmod +x start.sh + diff --git a/modules/nixos/brave-sandboxed.nix b/modules/nixos/brave-sandboxed.nix index ac1bab3..e435729 100644 --- a/modules/nixos/brave-sandboxed.nix +++ b/modules/nixos/brave-sandboxed.nix @@ -38,9 +38,27 @@ in extraBindMounts = lib.mkOption { type = lib.types.listOf lib.types.str; - default = []; + default = [ ]; description = "Extra paths to bind mount (read-write) into the sandbox"; }; + + useProxy = lib.mkOption { + type = lib.types.bool; + default = false; + description = "Whether to use the wireproxy SOCKS5 proxy"; + }; + + proxyAddress = lib.mkOption { + type = lib.types.str; + default = "127.0.0.1"; + description = "The address of the SOCKS5 proxy"; + }; + + proxyPort = lib.mkOption { + type = lib.types.int; + default = 1080; + description = "The port of the SOCKS5 proxy"; + }; }; config = lib.mkIf cfg.enable { @@ -48,14 +66,39 @@ in (final: prev: { brave-sandboxed = bwrapperPkgs.mkBwrapper { app = { - package = pkgs.symlinkJoin { - name = "brave-single-desktop"; - paths = [ prev.brave ]; - inherit (prev.brave) pname version meta; - postBuild = '' - rm $out/share/applications/com.brave.Browser.desktop - ''; - }; + package = + let + braveExe = lib.getExe prev.brave; + binName = builtins.baseNameOf braveExe; + in + pkgs.symlinkJoin { + name = "brave-wrapped"; + inherit (prev.brave) pname version meta; + paths = [ prev.brave ]; + nativeBuildInputs = [ pkgs.makeWrapper ]; + postBuild = '' + ${lib.optionalString cfg.useProxy '' + rm -f $out/bin/${binName} + makeWrapper ${braveExe} $out/bin/${binName} \ + --add-flags "--proxy-server=socks5://127.0.0.1:${toString cfg.proxyPort}" \ + --run ' + ( + SOCKET="/run/user/${toString config.users.users.${config.myModules.system.mainUser}.uid}/brave-proxy.sock" + for i in $(seq 1 50); do + if [ -S "$SOCKET" ]; then + ${pkgs.socat}/bin/socat TCP-LISTEN:${toString cfg.proxyPort},fork UNIX-CLIENT:"$SOCKET" + exit 0 + fi + sleep 0.1 + done + echo "Error: Brave proxy socket not found at $SOCKET" >&2 + exit 1 + ) & + ' + ''} + rm -f $out/share/applications/com.brave.Browser.desktop + ''; + }; # id = "brave-browser"; # Omit app.id to avoid potential bind errors (like Firefox) env = { # Propagate XDG_DATA_DIRS so GTK can find themes in user profile/system @@ -75,35 +118,31 @@ in unshareUser = true; unshareUts = false; unshareCgroup = false; - unsharePid = false; - unshareNet = false; - unshareIpc = false; + unsharePid = true; + unshareNet = cfg.useProxy; + unshareIpc = true; }; - fhsenv.bwrap.baseArgs = lib.mkForce [ - "--new-session" - "--proc /proc" - "--dev /dev" - "--dev-bind /dev/dri /dev/dri" - "--tmpfs /home" - "--tmpfs /mnt" - "--tmpfs /run" - "--ro-bind-try /run/current-system /run/current-system" - "--ro-bind-try /run/booted-system /run/booted-system" - "--ro-bind-try /run/opengl-driver /run/opengl-driver" - "--ro-bind-try /run/opengl-driver-32 /run/opengl-driver-32" - # Brave flags - "--setenv NIXOS_OZONE_WL \"1\"" - "--setenv NOTIFY_IGNORE_PORTAL 1" - # Bind policies for Theme - "--dir /etc/brave/policies/managed" - "--ro-bind ${bravePolicies} /etc/brave/policies/managed/policies.json" - # Fallback paths for Chromium/Chrome base - "--dir /etc/chromium/policies/managed" - "--ro-bind ${bravePolicies} /etc/chromium/policies/managed/policies.json" - "--dir /etc/opt/chrome/policies/managed" - "--ro-bind ${bravePolicies} /etc/opt/chrome/policies/managed/policies.json" - ]; + fhsenv.bwrap.baseArgs = lib.mkForce ( + sandboxUtils.mkCommonBindArgs { inherit config lib; } + ++ sandboxUtils.mkGamingBindArgs { } + ++ [ + "--tmpfs /mnt" + "--ro-bind-try /run/booted-system /run/booted-system" + "--setenv NIXOS_OZONE_WL \"1\"" + "--setenv NOTIFY_IGNORE_PORTAL 1" + # Bind policies for Theme + "--dir /etc/brave/policies/managed" + "--ro-bind ${bravePolicies} /etc/brave/policies/managed/policies.json" + # Fallback paths for Chromium/Chrome base + "--dir /etc/chromium/policies/managed" + "--ro-bind ${bravePolicies} /etc/chromium/policies/managed/policies.json" + "--dir /etc/opt/chrome/policies/managed" + "--ro-bind ${bravePolicies} /etc/opt/chrome/policies/managed/policies.json" + # Expose GPU device nodes + "--dev-bind /dev/dri /dev/dri" + ] + ); # Filesystem: Limited to Brave directories and Downloads mounts = { @@ -152,31 +191,35 @@ in ]; }; - fhsenv.bwrap.additionalArgs = [ - ''--bind "$XDG_RUNTIME_DIR/app/nix.bwrapper.brave/bus" "$XDG_RUNTIME_DIR/bus"'' - ''--bind "$XDG_RUNTIME_DIR/app/nix.bwrapper.brave/bus_system" /run/dbus/system_bus_socket'' - "--dir /run/systemd/resolve" - "--ro-bind-try /run/systemd/resolve /run/systemd/resolve" - "--bind-try /run/user/${toString config.users.users.${config.myModules.system.mainUser}.uid}/dconf /run/user/${toString config.users.users.${config.myModules.system.mainUser}.uid}/dconf" - ]; + fhsenv.bwrap.additionalArgs = + sandboxUtils.mkGuiBindArgs { } + ++ [ + ''--bind "$XDG_RUNTIME_DIR/app/nix.bwrapper.brave/bus" "$XDG_RUNTIME_DIR/bus"'' + ''--bind "$XDG_RUNTIME_DIR/app/nix.bwrapper.brave/bus_system" /run/dbus/system_bus_socket'' + "--bind-try /run/user/${ + toString config.users.users.${config.myModules.system.mainUser}.uid + }/dconf /run/user/${toString config.users.users.${config.myModules.system.mainUser}.uid}/dconf" + ] + ++ lib.optionals cfg.useProxy [ + "--bind-try /run/user/${ + toString config.users.users.${config.myModules.system.mainUser}.uid + }/brave-proxy.sock /run/user/${ + toString config.users.users.${config.myModules.system.mainUser}.uid + }/brave-proxy.sock" + ]; }; }) ]; - environment.systemPackages = [ - (pkgs.writeShellScriptBin "brave" '' - exec ${config.myModules.system.repoPath}/scripts/launch-vpn-app.sh ${pkgs.brave-sandboxed}/bin/brave "$@" - '') - (pkgs.makeDesktopItem { - name = "brave-vpn"; - desktopName = "Brave Web Browser"; - exec = "brave %U"; - icon = "brave-browser"; - categories = [ - "Network" - "WebBrowser" - ]; - }) - ]; + environment.systemPackages = [ pkgs.brave-sandboxed ]; + + systemd.user.services.brave-proxy-bridge = lib.mkIf cfg.useProxy { + description = "Bridge SOCKS5 proxy to UNIX socket for Brave Sandbox"; + wantedBy = [ "default.target" ]; + serviceConfig = { + ExecStart = "${pkgs.socat}/bin/socat UNIX-LISTEN:%t/brave-proxy.sock,fork TCP:${cfg.proxyAddress}:${toString cfg.proxyPort}"; + Restart = "always"; + }; + }; }; } \ No newline at end of file diff --git a/modules/nixos/cloudflare-firewall.nix b/modules/nixos/cloudflare-firewall.nix index 749624c..3e6760d 100644 --- a/modules/nixos/cloudflare-firewall.nix +++ b/modules/nixos/cloudflare-firewall.nix @@ -107,6 +107,9 @@ in # Allow established and related connections ct state established,related accept + + # Allow UDP for VPN handshakes (common ports) + udp dport { 51820, 1637, 1320 } accept # Allow ICMP (Ping) ip protocol icmp accept @@ -161,6 +164,10 @@ in # Allow established/related forwarding ct state established,related accept } + + chain output { + type filter hook output priority 0; policy accept; + } ''; }; diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix index bf17a67..1b2bd58 100644 --- a/modules/nixos/default.nix +++ b/modules/nixos/default.nix @@ -19,6 +19,7 @@ ./nginx.nix ./podman.nix ./browser-vpn.nix + ./wireproxy.nix ./ollama-rocm.nix ./open-webui.nix ./lutris-sandboxed.nix @@ -40,6 +41,8 @@ ./cosmic.nix ./steam-gamemode.nix ./redlib.nix + ./impermanence.nix ./auto-update.nix + ./openclaw.nix ]; } \ No newline at end of file diff --git a/modules/nixos/dns-over-tls.nix b/modules/nixos/dns-over-tls.nix index 8505ee6..6596254 100644 --- a/modules/nixos/dns-over-tls.nix +++ b/modules/nixos/dns-over-tls.nix @@ -5,8 +5,8 @@ # myModules.dnsOverTls = { # enable = true; # dnssec = true; # default: true -# primaryDns = [ "9.9.9.9" "1.1.1.1" ]; # default: Quad9 + Cloudflare -# fallbackDns = [ "1.1.1.1" "1.0.0.1" ]; # default: Cloudflare +# primaryDns = [ "9.9.9.9" "149.112.112.112" ]; # default: Quad9 +# fallbackDns = [ "9.9.9.9" "149.112.112.112" ]; # default: Quad9 # }; { @@ -34,19 +34,17 @@ in default = [ "9.9.9.9" "149.112.112.112" - "1.1.1.1" - "1.0.0.1" ]; - description = "Primary DNS servers (Quad9 + Cloudflare by default)"; + description = "Primary DNS servers (Quad9 by default)"; }; fallbackDns = lib.mkOption { type = lib.types.listOf lib.types.str; default = [ - "1.1.1.1" - "1.0.0.1" + "9.9.9.9" + "149.112.112.112" ]; - description = "Fallback DNS servers"; + description = "Fallback DNS servers (Quad9 by default)"; }; }; diff --git a/modules/nixos/firefox-sandboxed.nix b/modules/nixos/firefox-sandboxed.nix index d8292c7..e10a501 100644 --- a/modules/nixos/firefox-sandboxed.nix +++ b/modules/nixos/firefox-sandboxed.nix @@ -16,7 +16,26 @@ let policies = { Preferences = { "xpinstall.signatures.required" = false; - }; + "network.manage-offline-status" = false; + "network.captive-portal-service.enabled" = false; + "widget.use-xdg-desktop-portal.file-picker" = 1; + } + // ( + if cfg.useProxy then + { + # Always 127.0.0.1: the internal socat listener binds locally + # inside the sandbox regardless of where cfg.proxyAddress lives + # on the host. Pointing Firefox at cfg.proxyAddress would fail + # when it isn't 127.0.0.1 because that address doesn't exist + # inside the isolated network namespace. + "network.proxy.socks" = "127.0.0.1"; + "network.proxy.socks_port" = cfg.proxyPort; + "network.proxy.type" = 1; + "network.proxy.socks_remote_dns" = true; + } + else + { } + ); }; } ); @@ -30,6 +49,24 @@ in default = [ ]; description = "Extra paths to bind mount (read-write) into the sandbox"; }; + + useProxy = lib.mkOption { + type = lib.types.bool; + default = false; + description = "Whether to use the wireproxy SOCKS5 proxy"; + }; + + proxyAddress = lib.mkOption { + type = lib.types.str; + default = "127.0.0.1"; + description = "The address of the SOCKS5 proxy"; + }; + + proxyPort = lib.mkOption { + type = lib.types.int; + default = 1080; + description = "The port of the SOCKS5 proxy"; + }; }; config = lib.mkIf cfg.enable { @@ -37,7 +74,28 @@ in (final: prev: { firefox-sandboxed = bwrapperPkgs.mkBwrapper { app = { - package = prev.firefox-esr; + package = + if cfg.useProxy then + pkgs.symlinkJoin { + name = "firefox-esr-proxy-wrapped"; + inherit (prev.firefox-esr) pname version meta; + paths = [ prev.firefox-esr ]; + nativeBuildInputs = [ pkgs.makeWrapper ]; + postBuild = + let + firefoxExe = lib.getExe prev.firefox-esr; + binName = builtins.baseNameOf firefoxExe; + in + '' + rm -f $out/bin/${binName} + makeWrapper ${firefoxExe} $out/bin/${binName} \ + --run '${pkgs.socat}/bin/socat TCP-LISTEN:${toString cfg.proxyPort},fork UNIX-CLIENT:/run/user/${ + toString config.users.users.${config.myModules.system.mainUser}.uid + }/firefox-proxy.sock &' + ''; + } + else + prev.firefox-esr; # Omit app.id to avoid document portal bind that fails on FUSE env = { MOZ_ENABLE_WAYLAND = "1"; @@ -57,9 +115,9 @@ in unshareUser = true; unshareUts = false; unshareCgroup = false; - unsharePid = false; - unshareNet = false; - unshareIpc = false; + unsharePid = true; + unshareNet = cfg.useProxy; + unshareIpc = true; }; fhsenv.bwrap.baseArgs = lib.mkForce ( @@ -74,6 +132,10 @@ in "--dir /etc/firefox" "--dir /etc/firefox/policies" "--ro-bind ${firefoxPolicies} /etc/firefox/policies/policies.json" + # Expose GPU device nodes so Firefox can use hardware acceleration + # (VA-API / VDPAU / WebGL). Without this it falls back to software + # rendering on pure-Wayland sessions. + "--dev-bind /dev/dri /dev/dri" ] ); @@ -117,17 +179,35 @@ in ]; }; - fhsenv.bwrap.additionalArgs = sandboxUtils.mkGuiBindArgs { } ++ [ - ''--bind "$XDG_RUNTIME_DIR/app/nix.bwrapper.firefox/bus" "$XDG_RUNTIME_DIR/bus"'' - ''--bind "$XDG_RUNTIME_DIR/app/nix.bwrapper.firefox/bus_system" /run/dbus/system_bus_socket'' - "--bind-try /run/user/${ - toString config.users.users.${config.myModules.system.mainUser}.uid - }/dconf /run/user/${toString config.users.users.${config.myModules.system.mainUser}.uid}/dconf" - ]; + fhsenv.bwrap.additionalArgs = + sandboxUtils.mkGuiBindArgs { } + ++ [ + ''--bind "$XDG_RUNTIME_DIR/app/nix.bwrapper.firefox/bus" "$XDG_RUNTIME_DIR/bus"'' + ''--bind "$XDG_RUNTIME_DIR/app/nix.bwrapper.firefox/bus_system" /run/dbus/system_bus_socket'' + "--bind-try /run/user/${ + toString config.users.users.${config.myModules.system.mainUser}.uid + }/dconf /run/user/${toString config.users.users.${config.myModules.system.mainUser}.uid}/dconf" + ] + ++ lib.optionals cfg.useProxy [ + "--bind-try /run/user/${ + toString config.users.users.${config.myModules.system.mainUser}.uid + }/firefox-proxy.sock /run/user/${ + toString config.users.users.${config.myModules.system.mainUser}.uid + }/firefox-proxy.sock" + ]; }; }) ]; environment.systemPackages = [ pkgs.firefox-sandboxed ]; + + systemd.user.services.firefox-proxy-bridge = lib.mkIf cfg.useProxy { + description = "Bridge SOCKS5 proxy to UNIX socket for Firefox Sandbox"; + wantedBy = [ "default.target" ]; + serviceConfig = { + ExecStart = "${pkgs.socat}/bin/socat UNIX-LISTEN:%t/firefox-proxy.sock,fork TCP:${cfg.proxyAddress}:${toString cfg.proxyPort}"; + Restart = "always"; + }; + }; }; } diff --git a/modules/nixos/impermanence.nix b/modules/nixos/impermanence.nix index 7cebe49..331216e 100644 --- a/modules/nixos/impermanence.nix +++ b/modules/nixos/impermanence.nix @@ -44,6 +44,7 @@ "/var/lib/nixarr" "/var/lib/nixflix" "/var/lib/authelia-main" + "/var/lib/openclaw" ]; files = [ @@ -101,6 +102,7 @@ ".local/share/icons" # Application icons ".local/bin" # User scripts ".local/share/qBittorrent" + ".local/share/openclaw" ".local/share/jellyfin-desktop" ".cache/jellyfin-desktop" ".local/share/zoxide" @@ -110,5 +112,7 @@ files = [ ]; }; + + }; } diff --git a/modules/nixos/lutris-sandboxed.nix b/modules/nixos/lutris-sandboxed.nix index 734d032..10f7f6f 100644 --- a/modules/nixos/lutris-sandboxed.nix +++ b/modules/nixos/lutris-sandboxed.nix @@ -29,6 +29,8 @@ in (final: prev: { lutris-sandboxed = bwrapperPkgs.mkBwrapper { app = { + id = "net.lutris.Lutris"; + renameDesktopFile = false; package = prev.lutris.override { extraPkgs = pkgs: [ pkgs.curl @@ -38,6 +40,9 @@ in pkgs.zstd pkgs.xz pkgs.p7zip + pkgs.libadwaita + pkgs.zenity + pkgs.gamescope pkgs.which pkgs.file pkgs.zenity @@ -53,7 +58,6 @@ in ]; }; isFhsenv = true; - id = "net.lutris.Lutris"; env = { WEBKIT_DISABLE_DMABUF_RENDERER = 1; APPIMAGE_EXTRACT_AND_RUN = 1; diff --git a/modules/nixos/media.nix b/modules/nixos/media.nix index ab0db95..d2dc9a8 100644 --- a/modules/nixos/media.nix +++ b/modules/nixos/media.nix @@ -18,6 +18,17 @@ let PGID = pgid; TZ = "Europe/Berlin"; }; + + # Host aliases so containers can communicate using public domain names locally (routes traffic to Nginx) + localAddHosts = [ + "--add-host=sonarr.ashisgreat.xyz:10.89.0.1" + "--add-host=radarr.ashisgreat.xyz:10.89.0.1" + "--add-host=prowlarr.ashisgreat.xyz:10.89.0.1" + "--add-host=torrent.ashisgreat.xyz:10.89.0.1" + "--add-host=jellyfin.ashisgreat.xyz:10.89.0.1" + "--add-host=jellyseer.ashisgreat.xyz:10.89.0.1" + "--add-host=auth.ashisgreat.xyz:10.89.0.1" + ]; in { options.myModules.media = { @@ -34,8 +45,8 @@ in # --- VPN Gateway --- vpn = { - image = "docker.io/qmcgaw/gluetun"; - labels = { "io.containers.autoupdate" = "registry"; }; + image = "docker.io/qmcgaw/gluetun:v3.41.1"; # Pinned: v3.42+ breaks on kernels without nfnetlink_conntrack (conntrack flush via netlink fails) + # No auto-update label — pinned to specific version intentionally # The VPN manages the ports for the attached containers ports = [ "127.0.0.1:8080:8080" # qBittorrent WebUI (Localhost only) @@ -58,16 +69,16 @@ in "--network=media" # It joins the bridge so others can talk to it "--ip=10.89.0.5" # Static IP for VPN/Flaresolverr "--network-alias=flaresolverr" # Allow other containers to reach Flaresolverr via VPN - "--add-host=sonarr:10.89.0.50" # Allow Prowlarr to reach Sonarr - "--add-host=radarr:10.89.0.51" # Allow Prowlarr to reach Radarr - "--add-host=prowlarr:127.0.0.1" # Prowlarr matches VPN IP for self-reference if needed - ]; + ] + ++ localAddHosts; }; # --- Torrent Client (Routed via VPN) --- torrent = { image = "lscr.io/linuxserver/qbittorrent:latest"; - labels = { "io.containers.autoupdate" = "registry"; }; + labels = { + "io.containers.autoupdate" = "registry"; + }; # VITAL: Reuse the VPN container's network stack extraOptions = [ "--network=container:vpn" ]; dependsOn = [ "vpn" ]; @@ -83,7 +94,9 @@ in # --- The Arr Stack --- prowlarr = { image = "lscr.io/linuxserver/prowlarr:latest"; - labels = { "io.containers.autoupdate" = "registry"; }; + labels = { + "io.containers.autoupdate" = "registry"; + }; extraOptions = [ "--network=container:vpn" ]; @@ -94,14 +107,15 @@ in sonarr = { image = "lscr.io/linuxserver/sonarr:latest"; - labels = { "io.containers.autoupdate" = "registry"; }; + labels = { + "io.containers.autoupdate" = "registry"; + }; extraOptions = [ "--network=media" "--ip=10.89.0.50" "--dns=8.8.8.8" - "--add-host=qbittorrent:10.89.0.5" - "--add-host=prowlarr:10.89.0.5" - ]; + ] + ++ localAddHosts; ports = [ "127.0.0.1:8989:8989" ]; environment = commonEnv; volumes = [ @@ -112,14 +126,15 @@ in radarr = { image = "lscr.io/linuxserver/radarr:latest"; - labels = { "io.containers.autoupdate" = "registry"; }; + labels = { + "io.containers.autoupdate" = "registry"; + }; extraOptions = [ "--network=media" "--ip=10.89.0.51" "--dns=8.8.8.8" - "--add-host=qbittorrent:10.89.0.5" - "--add-host=prowlarr:10.89.0.5" - ]; + ] + ++ localAddHosts; ports = [ "127.0.0.1:7878:7878" ]; environment = commonEnv; volumes = [ @@ -131,13 +146,16 @@ in # --- Media Server --- jellyfin = { image = "lscr.io/linuxserver/jellyfin:latest"; - labels = { "io.containers.autoupdate" = "registry"; }; + labels = { + "io.containers.autoupdate" = "registry"; + }; extraOptions = [ "--network=media" "--device=/dev/dri:/dev/dri" "--dns=8.8.8.8" "--ip=10.89.0.4" - ]; + ] + ++ localAddHosts; ports = [ "127.0.0.1:8096:8096" ]; environment = commonEnv; volumes = [ @@ -148,16 +166,16 @@ in jellyseerr = { image = "ghcr.io/seerr-team/seerr:latest"; # Migrated from jellyseerr (stale) to seerr (v3+) - labels = { "io.containers.autoupdate" = "registry"; }; + labels = { + "io.containers.autoupdate" = "registry"; + }; extraOptions = [ "--init" # Required for Seerr "--network=media" "--dns=8.8.8.8" "--ip=10.89.0.3" - "--add-host=sonarr:10.89.0.50" - "--add-host=radarr:10.89.0.51" - "--add-host=jellyfin:10.89.0.4" - ]; + ] + ++ localAddHosts; ports = [ "127.0.0.1:5055:5055" ]; environment = commonEnv; volumes = [ "/var/lib/nixarr/jellyseerr:/app/config" ]; @@ -165,7 +183,9 @@ in flaresolverr = { image = "ghcr.io/flaresolverr/flaresolverr:latest"; - labels = { "io.containers.autoupdate" = "registry"; }; + labels = { + "io.containers.autoupdate" = "registry"; + }; extraOptions = [ "--network=container:vpn" ]; dependsOn = [ "vpn" ]; environment = { diff --git a/modules/nixos/nginx.nix b/modules/nixos/nginx.nix index cfb9fac..0363369 100644 --- a/modules/nixos/nginx.nix +++ b/modules/nixos/nginx.nix @@ -45,8 +45,20 @@ in # Use the wildcard cert by default for these domains commonHttpConfig = '' + # WebSocket Upgrade Map + map $http_upgrade $connection_upgrade { + default upgrade; + "" close; + } + # HSTS 1 year add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; + + # Real IP configuration + set_real_ip_from 127.0.0.1; + set_real_ip_from 10.89.0.0/24; + real_ip_header X-Forwarded-For; + real_ip_recursive on; ''; }; }; diff --git a/modules/nixos/ollama-rocm.nix b/modules/nixos/ollama-rocm.nix index c6e5226..3415b65 100644 --- a/modules/nixos/ollama-rocm.nix +++ b/modules/nixos/ollama-rocm.nix @@ -164,7 +164,7 @@ in lib.optionalString (cfg.numThreads != null) "-e OLLAMA_NUM_THREADS=${toString cfg.numThreads}" } \ -v ${cfg.dataDir}:/root/.ollama:U \ - -p 127.0.0.1:${toString cfg.port}:11434 \ + -p ${toString cfg.port}:11434 \ ${cfg.image} ''; ExecStop = "${pkgs.podman}/bin/podman stop ollama"; diff --git a/modules/nixos/openclaw.nix b/modules/nixos/openclaw.nix new file mode 100644 index 0000000..f281700 --- /dev/null +++ b/modules/nixos/openclaw.nix @@ -0,0 +1,199 @@ +{ config, lib, pkgs, inputs, ... }: + +with lib; + +let + cfg = config.services.openclaw-service; + openclawPkg = inputs.nix-openclaw.packages.${pkgs.system}.default; +in +{ + options.services.openclaw-service = { + enable = mkEnableOption "OpenClaw AI Agent Service"; + + user = mkOption { + type = types.str; + default = "kafka"; + description = "User to run OpenClaw as"; + }; + + group = mkOption { + type = types.str; + default = "kafka"; + description = "Group to run OpenClaw as"; + }; + + port = mkOption { + type = types.int; + default = 18789; + description = "Port to listen on"; + }; + + dataDir = mkOption { + type = types.str; + default = "/var/lib/openclaw"; + description = "Directory for OpenClaw data and workspace"; + }; + }; + + config = mkIf cfg.enable { + users.users.${cfg.user} = { + isNormalUser = true; + linger = true; + uid = 1001; + group = cfg.group; + description = "OpenClaw Service User"; + home = cfg.dataDir; + createHome = true; + }; + + users.groups.${cfg.group} = { + gid = 1001; + }; + + sops.secrets."openclaw/discord_token" = { + owner = cfg.user; + group = cfg.group; + key = "discord_bot_token"; + }; + + sops.secrets."openclaw/glm_api_key" = { + owner = cfg.user; + group = cfg.group; + key = "glm_api_key"; + }; + + sops.secrets."openclaw/brave_api_key" = { + owner = cfg.user; + group = cfg.group; + key = "searxng_brave_api_key"; + }; + + # Ensure secrets exist in sops config, if not user needs to add them. + # We assume secrets.yaml has these keys or user will map them. + # The user had /run/secrets/openclaw-discord-token before. + + systemd.services.openclaw = { + description = "OpenClaw AI Agent"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + + serviceConfig = { + User = cfg.user; + Group = cfg.group; + StateDirectory = "openclaw"; # Creates /var/lib/openclaw + WorkingDirectory = cfg.dataDir; + Restart = "always"; + RestartSec = "10s"; + + # Environment variables or config file generation + # OpenClaw seems to take config via a file or env vars. + # Based on previous flake, it used a config file. + # We can generate the config file in the ExecStartPre or rely on env vars if supported. + # The previous flake copied a config file. + + # Let's verify how openclaw takes config. + # It used OPENCLAW_CONFIG_DIR, OPENCLAW_DATA_DIR, OPENCLAW_WORKSPACE_DIR env vars. + }; + + environment = { + OPENCLAW_CONFIG_PATH = "${cfg.dataDir}/config/openclaw.json"; + OPENCLAW_HOME = "${cfg.dataDir}"; + OPENCLAW_DATA_DIR = "${cfg.dataDir}/data"; + OPENCLAW_WORKSPACE_DIR = "${cfg.dataDir}/workspace"; + OPENCLAW_GATEWAY_TOKEN = "openclaw-local-token"; + XDG_RUNTIME_DIR = "/run/user/1001"; + DBUS_SESSION_BUS_ADDRESS = "unix:path=/run/user/1001/bus"; + # We need to ensure these directories exist. + }; + + preStart = '' + mkdir -p ${cfg.dataDir}/config + mkdir -p ${cfg.dataDir}/data + mkdir -p ${cfg.dataDir}/workspace + + # Generate config.json + cat > ${cfg.dataDir}/config/openclaw.json <