From c71db854a9b17d2be99f6ff42cff5b3ab8a7a2c3 Mon Sep 17 00:00:00 2001 From: John Peterson Date: Mon, 9 Mar 2020 15:23:31 -0700 Subject: [PATCH] updates to helm chart to subchart latest GA ha chart version 2.0.25 w/ redhat init container fix --- Openshift4/.gitignore | 2 + .../openshift-artifactory-ha/Chart.yaml | 4 +- .../openshift-artifactory-ha/README.md | 1268 +--------------- .../charts/artifactory-ha-2.0.25.tgz | Bin 0 -> 111438 bytes .../openshift-artifactory-ha/helminstall.sh | 39 +- .../openshift-artifactory-ha/hostpathscc.yaml | 18 + .../requirements.lock | 10 +- .../requirements.yaml | 7 +- .../openshift-artifactory-ha/values.yaml | 1350 +---------------- 9 files changed, 75 insertions(+), 2623 deletions(-) mode change 100755 => 100644 Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/README.md create mode 100644 Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/charts/artifactory-ha-2.0.25.tgz create mode 100644 Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/hostpathscc.yaml mode change 100755 => 100644 Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/requirements.lock mode change 100755 => 100644 Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/requirements.yaml diff --git a/Openshift4/.gitignore b/Openshift4/.gitignore index bcacc76..29f94fa 100644 --- a/Openshift4/.gitignore +++ b/Openshift4/.gitignore @@ -1 +1,3 @@ artifactory.cluster.license +jfrog.team.crt +jfrog.team.key diff --git a/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/Chart.yaml b/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/Chart.yaml index af5ff44..0c34ad8 100755 --- a/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/Chart.yaml +++ b/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v1 -appVersion: 7.0.7 +appVersion: 7.2.1 description: Universal Repository Manager supporting all major packaging formats, build tools and CI servers. home: https://www.jfrog.com/artifactory/ @@ -21,4 +21,4 @@ name: openshift-artifactory-ha sources: - https://bintray.com/jfrog/product/JFrog-Artifactory-Pro/view - https://github.com/jfrog/charts -version: 2.0.4 +version: 2.0.25 diff --git a/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/README.md b/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/README.md old mode 100755 new mode 100644 index 76bd6af..5e69a31 --- a/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/README.md +++ b/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/README.md @@ -1,1266 +1,2 @@ -# JFrog Artifactory High Availability Helm Chart - -## Prerequisites Details - -* Kubernetes 1.8+ -* Artifactory HA license - -## Chart Details -This chart will do the following: - -* Deploy Artifactory highly available cluster. 1 primary node and 2 member nodes. -* Deploy a PostgreSQL database -* Deploy an Nginx server - -## Artifactory HA architecture -The Artifactory HA cluster in this chart is made up of -- A single primary node -- Two member nodes, which can be resized at will - -Load balancing is done to the member nodes only. -This leaves the primary node free to handle jobs and tasks and not be interrupted by inbound traffic. -> This can be controlled by the parameter `artifactory.service.pool`. - -## Installing the Chart - -### Add JFrog Helm repository -Before installing JFrog helm charts, you need to add the [JFrog helm repository](https://charts.jfrog.io/) to your helm client -```bash -helm repo add jfrog https://charts.jfrog.io -``` - -### Install Chart -To install the chart with the release name `artifactory-ha`: -```bash -helm install --name artifactory-ha --set postgresql.postgresqlPassword= jfrog/artifactory-ha -``` - -### System Configuration -Artifactory uses a common system configuration file - `system.yaml`. See [official documentation](https://www.jfrog.com/confluence/display/JFROG/System+YAML+Configuration+File) on its usage. -In order to override the default `system.yaml` configuration, do the following: -```bash -artifactory: - systemYaml: | - -``` - -### Accessing Artifactory -**NOTE:** It might take a few minutes for Artifactory's public IP to become available, and the nodes to complete initial setup. -Follow the instructions outputted by the install command to get the Artifactory IP and URL to access it. - -### Updating Artifactory -Once you have a new chart version, you can update your deployment with -```bash -helm upgrade artifactory-ha jfrog/artifactory-ha -``` - -If artifactory was installed without providing a value to postgresql.postgresqlPassword (a password was autogenerated), follow these instructions: -1. Get the current password by running: -```bash -POSTGRES_PASSWORD=$(kubectl get secret -n -postgresql -o jsonpath="{.data.postgresql-password}" | base64 --decode) -``` -2. Upgrade the release by passing the previously auto-generated secret: -```bash -helm upgrade jfrog/artifactory-ha --set postgresql.postgresqlPassword=${POSTGRES_PASSWORD} -``` - -This will apply any configuration changes on your existing deployment. - -### Artifactory memory and CPU resources -The Artifactory HA Helm chart comes with support for configured resource requests and limits to all pods. By default, these settings are commented out. -It is **highly** recommended to set these so you have full control of the allocated resources and limits. - -See more information on [setting resources for your Artifactory based on planned usage](https://www.jfrog.com/confluence/display/RTF/System+Requirements#SystemRequirements-RecommendedHardware). - -```bash -# Example of setting resource requests and limits to all pods (including passing java memory settings to Artifactory) -helm install --name artifactory-ha \ - --set artifactory.primary.resources.requests.cpu="500m" \ - --set artifactory.primary.resources.limits.cpu="2" \ - --set artifactory.primary.resources.requests.memory="1Gi" \ - --set artifactory.primary.resources.limits.memory="4Gi" \ - --set artifactory.primary.javaOpts.xms="1g" \ - --set artifactory.primary.javaOpts.xmx="4g" \ - --set artifactory.node.resources.requests.cpu="500m" \ - --set artifactory.node.resources.limits.cpu="2" \ - --set artifactory.node.resources.requests.memory="1Gi" \ - --set artifactory.node.resources.limits.memory="4Gi" \ - --set artifactory.node.javaOpts.xms="1g" \ - --set artifactory.node.javaOpts.xmx="4g" \ - --set initContainers.resources.requests.cpu="10m" \ - --set initContainers.resources.limits.cpu="250m" \ - --set initContainers.resources.requests.memory="64Mi" \ - --set initContainers.resources.limits.memory="128Mi" \ - --set postgresql.resources.requests.cpu="200m" \ - --set postgresql.resources.limits.cpu="1" \ - --set postgresql.resources.requests.memory="500Mi" \ - --set postgresql.resources.limits.memory="1Gi" \ - --set nginx.resources.requests.cpu="100m" \ - --set nginx.resources.limits.cpu="250m" \ - --set nginx.resources.requests.memory="250Mi" \ - --set nginx.resources.limits.memory="500Mi" \ - jfrog/artifactory-ha -``` -> Artifactory java memory parameters can (and should) also be set to match the allocated resources with `artifactory.[primary|node].javaOpts.xms` and `artifactory.[primary|node].javaOpts.xmx`. - -Get more details on configuring Artifactory in the [official documentation](https://www.jfrog.com/confluence/). - -Although it is possible to set resources limits and requests this way, it is recommended to use the pre-built values files -for small, medium and large installation and change them according to your needs (if necessary), as described [here](#Deploying-Artifactory-for-small/medium/large-installations) - -### Deploying Artifactory for small/medium/large installations -In the chart directory, we have added three values files, one for each installation type - small/medium/large. These values files are recommendations for setting resources requests and limits for your installation. The values are derived from the following [documentation](https://www.jfrog.com/confluence/display/EP/Installing+on+Kubernetes#InstallingonKubernetes-Systemrequirements). You can find them in the corresponding chart directory - values-small.yaml, values-medium.yaml and values-large.yaml - -### Artifactory storage -Artifactory HA support a wide range of storage back ends. You can see more details on [Artifactory HA storage options](https://www.jfrog.com/confluence/display/RTF/HA+Installation+and+Setup#HAInstallationandSetup-SettingUpYourStorageConfiguration) - -In this chart, you set the type of storage you want with `artifactory.persistence.type` and pass the required configuration settings. -The default storage in this chart is the `file-system` replication, where the data is replicated to all nodes. - -> **IMPORTANT:** All storage configurations (except NFS) come with a default `artifactory.persistence.redundancy` parameter. -This is used to set how many replicas of a binary should be stored in the cluster's nodes. -Once this value is set on initial deployment, you can not update it using helm. -It is recommended to set this to a number greater than half of your cluster's size, and never scale your cluster down to a size smaller than this number. - -#### Existing volume claim - -###### Primary node -In order to use an existing volume claim for the Artifactory primary storage, you need to: -- Create a persistent volume claim by the name `volume--artifactory-ha-primary-0` e.g `volume-myrelease-artifactory-ha-primary-0` -- Pass a parameter to `helm install` and `helm upgrade` -```bash -... ---set artifactory.primary.persistence.existingClaim=true -``` - -###### Member nodes -In order to use an existing volume claim for the Artifactory member nodes storage, you need to: -- Create persistent volume claims according to the number of replicas defined at `artifactory.node.replicaCount` by the names `volume--artifactory-ha-member-`, e.g `volume-myrelease-artifactory-ha-member-0` and `volume-myrelease-artifactory-ha-primary-1`. -- Pass a parameter to `helm install` and `helm upgrade` -```bash -... ---set artifactory.node.persistence.existingClaim=true -``` - -#### Existing shared volume claim - -In order to use an existing claim (for data and backup) that is to be shared across all nodes, you need to: - -- Create PVCs with ReadWriteMany that match the naming conventions: -``` - {{ template "artifactory-ha.fullname" . }}-data-pvc- - {{ template "artifactory-ha.fullname" . }}-backup-pvc- -``` -An example that shows 2 existing claims to be used: -``` - myexample-artifactory-ha-data-pvc-0 - myexample-artifactory-ha-backup-pvc-0 - myexample-artifactory-ha-data-pvc-1 - myexample-artifactory-ha-backup-pvc-1 -``` -- Set the artifactory.persistence.fileSystem.existingSharedClaim.enabled in values.yaml to true: -``` --- set artifactory.persistence.fileSystem.existingSharedClaim.enabled=true --- set artifactory.persistence.fileSystem.existingSharedClaim.numberOfExistingClaims=2 -``` - -#### NFS -To use an NFS server as your cluster's storage, you need to -- Setup an NFS server. Get its IP as `NFS_IP` -- Create a `data` and `backup` directories on the NFS exported directory with write permissions to all -- Pass NFS parameters to `helm install` and `helm upgrade` -```bash -... ---set artifactory.persistence.type=nfs \ ---set artifactory.persistence.nfs.ip=${NFS_IP} \ -... -``` - -#### Google Storage -To use a Google Storage bucket as the cluster's filestore. See [Google Storage Binary Provider](https://www.jfrog.com/confluence/display/RTF/Configuring+the+Filestore#ConfiguringtheFilestore-GoogleStorageBinaryProvider) -- Pass Google Storage parameters to `helm install` and `helm upgrade` -```bash -... ---set artifactory.persistence.type=google-storage \ ---set artifactory.persistence.googleStorage.identity=${GCP_ID} \ ---set artifactory.persistence.googleStorage.credential=${GCP_KEY} \ -... -``` - -#### AWS S3 -**NOTE** Keep in mind that when using the `aws-s3` persistence type, you will not be able to provide an IAM on the pod level. -In order to grant permissions to Artifactory using an IAM role, you will have to attach the IAM role to the machine(s) on which Artifactory is running. -This is due to the fact that the `aws-s3` template uses the `JetS3t` library to interact with AWS. If you want to grant an IAM role at the pod level, see the `AWS S3 Vs` section. - -To use an AWS S3 bucket as the cluster's filestore. See [S3 Binary Provider](https://www.jfrog.com/confluence/display/RTF/Configuring+the+Filestore#ConfiguringtheFilestore-S3BinaryProvider) -- Pass AWS S3 parameters to `helm install` and `helm upgrade` -```bash -... -# With explicit credentials: ---set artifactory.persistence.type=aws-s3 \ ---set artifactory.persistence.awsS3.endpoint=${AWS_S3_ENDPOINT} \ ---set artifactory.persistence.awsS3.region=${AWS_REGION} \ ---set artifactory.persistence.awsS3.identity=${AWS_ACCESS_KEY_ID} \ ---set artifactory.persistence.awsS3.credential=${AWS_SECRET_ACCESS_KEY} \ -... - -... -# With using existing IAM role ---set artifactory.persistence.type=aws-s3 \ ---set artifactory.persistence.awsS3.endpoint=${AWS_S3_ENDPOINT} \ ---set artifactory.persistence.awsS3.region=${AWS_REGION} \ ---set artifactory.persistence.awsS3.roleName=${AWS_ROLE_NAME} \ -... -``` -**NOTE:** Make sure S3 `endpoint` and `region` match. See [AWS documentation on endpoint](https://docs.aws.amazon.com/general/latest/gr/rande.html) - -#### AWS S3 V3 -To use an AWS S3 bucket as the cluster's filestore and access it with the official AWS SDK, See [S3 Official SDK Binary Provider](https://www.jfrog.com/confluence/display/RTF/Configuring+the+Filestore#ConfiguringtheFilestore-AmazonS3OfficialSDKTemplate). -This filestore template uses the official AWS SDK, unlike the `aws-s3` implementation that uses the `JetS3t` library. -Use this template if you want to attach an IAM role to the Artifactory pod directly (as opposed to attaching it to the machine/s that Artifactory will run on). - -**NOTE** This will have to be combined with a k8s mechanism for attaching IAM roles to pods, like [kube2iam](https://github.com/helm/charts/tree/master/stable/kube2iam) or anything similar. - -- Pass AWS S3 V3 parameters and the annotation pointing to the IAM role (when using an IAM role. this is kube2iam specific and may vary depending on the implementation) to `helm install` and `helm upgrade` - -```bash -# With explicit credentials: ---set artifactory.persistence.type=aws-s3-v3 \ ---set artifactory.persistence.awsS3V3.region=${AWS_REGION} \ ---set artifactory.persistence.awsS3V3.bucketName=${AWS_S3_BUCKET_NAME} \ ---set artifactory.persistence.awsS3V3.identity=${AWS_ACCESS_KEY_ID} \ ---set artifactory.persistence.awsS3V3.credential=${AWS_SECRET_ACCESS_KEY} \ -... -``` - -```bash -# With using existing IAM role ---set artifactory.persistence.type=aws-s3-v3 \ ---set artifactory.persistence.awsS3V3.region=${AWS_REGION} \ ---set artifactory.persistence.awsS3V3.bucketName=${AWS_S3_BUCKET_NAME} \ ---set artifactory.annotations.'iam\.amazonaws\.com/role'=${AWS_IAM_ROLE_ARN} -... -``` - -#### Microsoft Azure Blob Storage -To use Azure Blob Storage as the cluster's filestore. See [Azure Blob Storage Binary Provider](https://www.jfrog.com/confluence/display/RTF/Configuring+the+Filestore#ConfiguringtheFilestore-AzureBlobStorageClusterBinaryProvider) -- Pass Azure Blob Storage parameters to `helm install` and `helm upgrade` -```bash -... ---set artifactory.persistence.type=azure-blob \ ---set artifactory.persistence.azureBlob.accountName=${AZURE_ACCOUNT_NAME} \ ---set artifactory.persistence.azureBlob.accountKey=${AZURE_ACCOUNT_KEY} \ ---set artifactory.persistence.azureBlob.endpoint=${AZURE_ENDPOINT} \ ---set artifactory.persistence.azureBlob.containerName=${AZURE_CONTAINER_NAME} \ -... -``` - -#### Custom binarystore.xml -You have an option to provide a custom [binarystore.xml](https://www.jfrog.com/confluence/display/RTF/Configuring+the+Filestore).
-There are two options for this - -1. Editing directly in [values.yaml](values.yaml) -```yaml -artifactory: - persistence: - binarystoreXml: | - - - - - -``` - -2. Create your own [Secret](https://kubernetes.io/docs/concepts/configuration/secret/) and pass it to your `helm install` command -```yaml -# Prepare your custom Secret file (custom-binarystore.yaml) -kind: Secret -apiVersion: v1 -metadata: - name: custom-binarystore - labels: - app: artifactory - chart: artifactory -stringData: - binarystore.xml: |- - - - - -``` - -```bash -# Create a secret from the file -kubectl apply -n artifactory -f ./custom-binarystore.yaml - -# Pass it to your helm install command: -helm install --name artifactory-ha --set artifactory.persistence.customBinarystoreXmlSecret=custom-binarystore jfrog/artifactory-ha -``` - -### Create a unique Master Key -Artifactory HA cluster requires a unique master key. By default the chart has one set in values.yaml (`artifactory.masterKey`). - -**This key is for demo purpose and should not be used in a production environment!** - -You should generate a unique one and pass it to the template at install/upgrade time. -```bash -# Create a key -export MASTER_KEY=$(openssl rand -hex 32) -echo ${MASTER_KEY} - -# Pass the created master key to helm -helm install --name artifactory-ha --set artifactory.masterKey=${MASTER_KEY} jfrog/artifactory-ha -``` - -Alternatively, you can create a secret containing the master key manually and pass it to the template at install/upgrade time. -```bash -# Create a key -export MASTER_KEY=$(openssl rand -hex 32) -echo ${MASTER_KEY} - -# Create a secret containing the key. The key in the secret must be named master-key -kubectl create secret generic my-secret --from-literal=master-key=${MASTER_KEY} - -# Pass the created secret to helm -helm install --name artifactory-ha --set artifactory.masterKeySecretName=my-secret jfrog/artifactory-ha -``` -**NOTE:** In either case, make sure to pass the same master key on all future calls to `helm install` and `helm upgrade`! In the first case, this means always passing `--set artifactory.masterKey=${MASTER_KEY}`. In the second, this means always passing `--set artifactory.masterKeySecretName=my-secret` and ensuring the contents of the secret remain unchanged. - -### Create a unique Join Key -Artifactory requires a unique join key. By default the chart has one set in values.yaml (`artifactory.joinKey`). - -**This key is for demo purpose and should not be used in a production environment!** - -You should generate a unique key and pass it to the template at install/upgrade time. -```bash -# Create a key -export JOIN_KEY=$(openssl rand -hex 16) -echo ${JOIN_KEY} - -# Pass the created master key to helm -helm install --name artifactory --set artifactory.joinKey=${JOIN_KEY} jfrog/artifactory -``` - -**NOTE:** In either case, make sure to pass the same join key on all future calls to `helm install` and `helm upgrade`! This means always passing `--set artifactory.joinKey=${JOIN_KEY}`. - -### Install Artifactory HA license -For activating Artifactory HA, you must install an appropriate license. There are three ways to manage the license. **Artifactory UI**, **REST API**, or a **Kubernetes Secret**. - -The easier and recommended way is the **Artifactory UI**. Using the **Kubernetes Secret** or **REST API** is for advanced users and is better suited for automation. - -**IMPORTANT:** You should use only one of the following methods. Switching between them while a cluster is running might disable your Artifactory HA cluster! - -##### Artifactory UI -Once primary cluster is running, open Artifactory UI and insert the license(s) in the UI. See [HA installation and setup](https://www.jfrog.com/confluence/display/RTF/HA+Installation+and+Setup) for more details. **Note that you should enter all licenses at once, with each license is separated by a newline.** If you add the licenses one at a time, you may get redirected to a node without a license and the UI won't load for that node. - -##### REST API -You can add licenses via REST API (https://www.jfrog.com/confluence/display/RTF/Artifactory+REST+API#ArtifactoryRESTAPI-InstallHAClusterLicenses). Note that the REST API expects "\n" for the newlines in the licenses. - -##### Kubernetes Secret -You can deploy the Artifactory license(s) as a [Kubernetes secret](https://kubernetes.io/docs/concepts/configuration/secret/). -Prepare a text file with the license(s) written in it. If writing multiple licenses (must be in the same file), it's important to put **two new lines between each license block**! -```bash -# Create the Kubernetes secret (assuming the local license file is 'art.lic') -kubectl create secret generic artifactory-cluster-license --from-file=./art.lic - -# Pass the license to helm -helm install --name artifactory-ha --set artifactory.license.secret=artifactory-cluster-license,artifactory.license.dataKey=art.lic jfrog/artifactory-ha -``` -**NOTE:** This method is relevant for initial deployment only! Once Artifactory is deployed, you should not keep passing these parameters as the license is already persisted into Artifactory's storage (they will be ignored). -Updating the license should be done via Artifactory UI or REST API. - -##### Create the secret as part of the helm release -values.yaml -```yaml -artifactory: - license: - licenseKey: |- - - - - - - - -``` - -```bash -helm install --name artifactory-ha -f values.yaml jfrog/artifactory-ha -``` -**NOTE:** This method is relevant for initial deployment only! Once Artifactory is deployed, you should not keep passing these parameters as the license is already persisted into Artifactory's storage (they will be ignored). -Updating the license should be done via Artifactory UI or REST API. -If you want to keep managing the artifactory license using the same method, you can use the copyOnEveryStartup example shown in the values.yaml file - - -### copyOnEveryStartup feature -Files stored in the `/artifactory-extra-conf` directory are only copied to the `ARTIFACTORY_HOME/etc` directory upon the first startup. -In some cases, you want your configuration files to be copied to the `ARTIFACTORY_HOME/etc` directory on every startup. -Two examples for that would be: - -1. the binarstore.xml file. If you use the default behaviour, your binarystore.xml configuration will only be copied on the first startup, -which means that changes you make over time to the `binaryStoreXml` configuration will not be applied. In order to make sure your changes are applied on every startup, do the following: -Create a values file with the following values: -```yaml -artifactory: - copyOnEveryStartup: - - source: /artifactory_extra_conf/binarystore.xml - target: etc/ -``` - -Install the helm chart with the values file you created: -```bash -helm upgrade --install artifactory-ha jfrog/artifactory-ha -f values.yaml -``` - -2. Any custom configuration file you have to configure artifactory, such as `logabck.xml`: -Create a config map with your `logback.xml` configuration. - -Create a values file with the following values: -```yaml -artifactory: - ## Create a volume pointing to the config map with your configuration file - customVolumes: | - - name: logback-xml-configmap - configMap: - name: logback-xml-configmap - customVolumeMounts: | - - name: logback-xml-configmap - mountPath: /tmp/artifactory-logback/ - copyOnEveryStartup: - - source: /tmp/artifactory-logback/* - target: etc/ -``` - -Install the helm chart with the values file you created: -```bash -helm upgrade --install artifactory-ha jfrog/artifactory-ha -f values.yaml -``` - -### Configure NetworkPolicy - -NetworkPolicy specifies what ingress and egress is allowed in this namespace. It is encouraged to be more specific whenever possible to increase security of the system. - -In the `networkpolicy` section of values.yaml you can specify a list of NetworkPolicy objects. - -For podSelector, ingress and egress, if nothing is provided then a default `- {}` is applied which is to allow everything. - -A full (but very wide open) example that results in 2 NetworkPolicy objects being created: -```yaml -networkpolicy: - # Allows all ingress and egress to/from artifactory primary and member pods. - - name: artifactory - podSelector: - matchLabels: - app: artifactory-ha - egress: - - {} - ingress: - - {} - # Allows connectivity from artifactory-ha pods to postgresql pods, but no traffic leaving postgresql pod. - - name: postgresql - podSelector: - matchLabels: - app: postgresql - ingress: - - from: - - podSelector: - matchLabels: - app: artifactory-ha -``` - -### Artifactory JMX Configuration -** You can see some information about the exposed MBeans here - https://www.jfrog.com/confluence/display/RTF/Artifactory+JMX+MBeans - -Enable JMX in your deployment: -```bash -helm install --name artifactory \ - --set artifactory.primary.javaOpts.jmx.enabled=true \ - --set artifactory.node.javaOpts.jmx.enabled=true \ - jfrog/artifactory-ha -``` -This will enable access to Artifactory with JMX on the default port (9010). -** You have the option to change the port by setting ```artifactory.primary.javaOpts.jmx.port``` and ```artifactory.node.javaOpts.jmx.port``` -to your choice of port - -In order to connect to Artifactory using JMX with jconsole (or any similar tool) installed on your computer, follow the following steps: -1. Enable JMX as described above and Change the Artifactory service to be of type LoadBalancer: -```bash -helm install --name artifactory \ - --set artifactory.primary.javaOpts.jmx.enabled=true \ - --set artifactory.node.javaOpts.jmx.enabled=true \ - --set artifactory.service.type=LoadBalancer \ - jfrog/artifactory-ha -``` -2. The default setting for java.rmi.server.hostname is the service name (this is also configurable with -```artifactory.primary.javaOpts.jmx.host``` and ```artifactory.node.javaOpts.jmx.host```), So in order to connect to Artifactory -with jconsole you should map the Artifactory kuberentes service IP to the service name using your hosts file as such: -``` - artifactory-ha--primary - -``` -3. Launch jconsole with the service address and port: -```bash -jconsole artifactory-ha--primary: -jconsole : -``` - -### Access creds. bootstraping -**IMPORTANT:** Bootsrapping access creds. will allow access for the user access-admin from certain IP's. - -* User guide to [bootstrap Artifactory Access credentials](https://www.jfrog.com/confluence/display/ACC/Configuring+Access) - -1. Create `access-creds-values.yaml` and provide the IP (By default 127.0.0.1) and password: -```yaml -artifactory: - accessAdmin: - ip: "" #Example: "*" - password: "" -``` - -2. Apply the `access-creds-values.yaml` file: -```bash -helm upgrade --install artifactory-ha jfrog/artifactory-ha -f access-creds-values.yaml -``` - -### Bootstrapping Artifactory -**IMPORTANT:** Bootstrapping Artifactory needs license. Pass license as shown in above section. - -* User guide to [bootstrap Artifactory Global Configuration](https://www.jfrog.com/confluence/display/RTF/Configuration+Files#ConfigurationFiles-BootstrappingtheGlobalConfiguration) -* User guide to [bootstrap Artifactory Security Configuration](https://www.jfrog.com/confluence/display/RTF/Configuration+Files#ConfigurationFiles-BootstrappingtheSecurityConfiguration) - -1. Create `bootstrap-config.yaml` with artifactory.config.import.xml and security.import.xml as shown below: -```yaml -apiVersion: v1 -kind: ConfigMap -metadata: - name: my-release-bootstrap-config -data: - artifactory.config.import.xml: | - - security.import.xml: | - -``` - -2. Create configMap in Kubernetes: -```bash -kubectl apply -f bootstrap-config.yaml -``` -3. Pass the configMap to helm -```bash -helm install --name artifactory-ha --set artifactory.license.secret=artifactory-cluster-license,artifactory.license.dataKey=art.lic,artifactory.configMapName=my-release-bootstrap-config jfrog/artifactory-ha -``` - -### Use custom nginx.conf with Nginx - -Steps to create configMap with nginx.conf -* Create `nginx.conf` file. -```bash -kubectl create configmap nginx-config --from-file=nginx.conf -``` -* Pass configMap to helm install -```bash -helm install --name artifactory-ha --set nginx.customConfigMap=nginx-config jfrog/artifactory-ha -``` - -### Scaling your Artifactory cluster -A key feature in Artifactory HA is the ability to set an initial cluster size with `--set artifactory.node.replicaCount=${CLUSTER_SIZE}` and if needed, resize it. - -##### Before scaling -**IMPORTANT:** When scaling, you need to explicitly pass the database password if it's an auto generated one (this is the default with the enclosed PostgreSQL helm chart). - -Get the current database password -```bash -export DB_PASSWORD=$(kubectl get $(kubectl get secret -o name | grep postgresql) -o jsonpath="{.data.postgresql-password}" | base64 --decode) -``` -Use `--set postgresql.postgresqlPassword=${DB_PASSWORD}` with every scale action to prevent a miss configured cluster! - -##### Scale up -Let's assume you have a cluster with **2** member nodes, and you want to scale up to **3** member nodes (a total of 4 nodes). -```bash -# Scale to 4 nodes (1 primary and 3 member nodes) -helm upgrade --install artifactory-ha --set artifactory.node.replicaCount=3 --set postgresql.postgresqlPassword=${DB_PASSWORD} jfrog/artifactory-ha -``` - -##### Scale down -Let's assume you have a cluster with **3** member nodes, and you want to scale down to **2** member node. - -```bash -# Scale down to 2 member nodes -helm upgrade --install artifactory-ha --set artifactory.node.replicaCount=2 --set postgresql.postgresqlPassword=${DB_PASSWORD} jfrog/artifactory-ha -``` -- **NOTE:** Since Artifactory is running as a Kubernetes Stateful Set, the removal of the node will **not** remove the persistent volume. You need to explicitly remove it -```bash -# List PVCs -kubectl get pvc - -# Remove the PVC with highest ordinal! -# In this example, the highest node ordinal was 2, so need to remove its storage. -kubectl delete pvc volume-artifactory-node-2 -``` - -### Use an external Database - -#### PostgreSQL -There are cases where you will want to use external PostgreSQL with a different database name e.g. `my-artifactory-db`, then you need set a custom PostgreSQL connection URL, where `my-artifactory-db` is the database name. - -This can be done with the following parameters -```bash -... ---set postgresql.enabled=false \ ---set database.type=postgresql \ ---set database.driver=org.postgresql.Driver \ ---set database.url='jdbc:postgresql://${DB_HOST}:${DB_PORT}/my-artifactory-db' \ ---set database.user=${DB_USER} \ ---set database.password=${DB_PASSWORD} \ -... -``` -**NOTE:** You must set `postgresql.enabled=false` in order for the chart to use the `database.*` parameters. Without it, they will be ignored! - -#### Other DB type -There are cases where you will want to use a different database and not the enclosed **PostgreSQL**. -See more details on [configuring the database](https://www.jfrog.com/confluence/display/RTF/Configuring+the+Database) -> The official Artifactory Docker images include the PostgreSQL database driver. -> For other database types, you will have to add the relevant database driver to Artifactory's tomcat/lib - -This can be done with the following parameters -```bash -# Make sure your Artifactory Docker image has the MySQL database driver in it -... ---set postgresql.enabled=false \ ---set artifactory.preStartCommand="wget -O /opt/jfrog/artifactory/tomcat/lib/mysql-connector-java-5.1.41.jar https://jcenter.bintray.com/mysql/mysql-connector-java/5.1.41/mysql-connector-java-5.1.41.jar" \ ---set database.type=mysql \ ---set database.driver=com.mysql.jdbc.Driver \ ---set database.url=${DB_URL} \ ---set database.user=${DB_USER} \ ---set database.password=${DB_PASSWORD} \ -... -``` -**NOTE:** You must set `postgresql.enabled=false` in order for the chart to use the `database.*` parameters. Without it, they will be ignored! - -#### Using pre-existing Kubernetes Secret -If you store your database credentials in a pre-existing Kubernetes `Secret`, you can specify them via `database.secrets` instead of `database.user` and `database.password`: -```bash -# Create a secret containing the database credentials -kubectl create secret generic my-secret --from-literal=user=${DB_USER} --from-literal=password=${DB_PASSWORD} -... ---set postgresql.enabled=false \ ---set database.secrets.user.name=my-secret \ ---set database.secrets.user.key=user \ ---set database.secrets.password.name=my-secret \ ---set database.secrets.password.key=password \ -... -``` - -### Deleting Artifactory -To delete the Artifactory HA cluster -```bash -helm delete --purge artifactory-ha -``` -This will completely delete your Artifactory HA cluster. -**NOTE:** Since Artifactory is running as Kubernetes Stateful Sets, the removal of the helm release will **not** remove the persistent volumes. You need to explicitly remove them -```bash -kubectl delete pvc -l release=artifactory-ha -``` -See more details in the official [Kubernetes Stateful Set removal page](https://kubernetes.io/docs/tasks/run-application/delete-stateful-set/) - -### Custom Docker registry for your images -If you need to pull your Docker images from a private registry (for example, when you have a custom image with a MySQL database driver), you need to create a -[Kubernetes Docker registry secret](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) and pass it to helm -```bash -# Create a Docker registry secret called 'regsecret' -kubectl create secret docker-registry regsecret --docker-server=${DOCKER_REGISTRY} --docker-username=${DOCKER_USER} --docker-password=${DOCKER_PASS} --docker-email=${DOCKER_EMAIL} -``` -Once created, you pass it to `helm` -```bash -helm install --name artifactory-ha --set imagePullSecrets=regsecret jfrog/artifactory-ha -``` - -### Logger sidecars -This chart provides the option to add sidecars to tail various logs from Artifactory. See the available values in [values.yaml](values.yaml) - -Get list of containers in the pod -```bash -kubectl get pods -n -o jsonpath='{.spec.containers[*].name}' | tr ' ' '\n' -``` - -View specific log -```bash -kubectl logs -n -c -``` - - -### Custom init containers -There are cases where a special, unsupported init processes is needed like checking something on the file system or testing something before spinning up the main container. - -For this, there is a section for writing custom init containers before and after the predefined init containers in the [values.yaml](values.yaml) . By default it's commented out -```yaml -artifactory: - ## Add custom init containers executed before predefined init containers - customInitContainersBegin: | - ## Init containers template goes here ## - ## Add custom init containers executed after predefined init containers - customInitContainers: | - ## Init containers template goes here ## -``` - -### Custom sidecar containers -There are cases where an extra sidecar container is needed. For example monitoring agents or log collection. - -For this, there is a section for writing a custom sidecar container in the [values.yaml](values.yaml). By default it's commented out -```yaml -artifactory: - ## Add custom sidecar containers - customSidecarContainers: | - ## Sidecar containers template goes here ## -``` - -You can configure the sidecar to run as a custom user if needed by setting the following in the container template -```yaml - # Example of running container as root (id 0) - securityContext: - runAsUser: 0 - fsGroup: 0 -``` - -### Custom volumes -If you need to use a custom volume in a custom init or sidecar container, you can use this option. - -For this, there is a section for defining custom volumes in the [values.yaml](values.yaml). By default it's commented out -```yaml -artifactory: - ## Add custom volumes - customVolumes: | - ## Custom volume comes here ## -``` - -### Add Artifactory User Plugin during installation -If you need to add [Artifactory User Plugin](https://github.com/jfrog/artifactory-user-plugins), you can use this option. - -Create a secret with [Artifactory User Plugin](https://github.com/jfrog/artifactory-user-plugins) by following command: -```bash -# Secret with single user plugin -kubectl create secret generic archive-old-artifacts --from-file=archiveOldArtifacts.groovy --namespace=artifactory-ha - -# Secret with single user plugin with configuration file -kubectl create secret generic webhook --from-file=webhook.groovy --from-file=webhook.config.json.sample --namespace=artifactory-ha -``` - -Add plugin secret names to `plugins.yaml` as following: -```yaml -artifactory: - userPluginSecrets: - - archive-old-artifacts - - webhook -``` - -You can now pass the created `plugins.yaml` file to helm install command to deploy Artifactory with user plugins as follows: -```bash -helm install --name artifactory-ha -f plugins.yaml jfrog/artifactory-ha -``` - -Alternatively, you may be in a situation in which you would like to create a secret in a Helm chart that depends on this chart. In this scenario, the name of the secret is likely dynamically generated via template functions, so passing a statically named secret isn't possible. In this case, the chart supports evaluating strings as templates via the [`tpl`](https://helm.sh/docs/charts_tips_and_tricks/#using-the-tpl-function) function - simply pass the raw string containing the templating language used to name your secret as a value instead by adding the following to your chart's `values.yaml` file: -```yaml -artifactory-ha: # Name of the artifactory-ha dependency - artifactory: - userPluginSecrets: - - '{{ template "my-chart.fullname" . }}' -``` -NOTE: By defining userPluginSecrets, this overrides any pre-defined plugins from the container image that are stored in /tmp/plugins. At this time [artifactory-pro:6.9.0](https://bintray.com/jfrog/artifactory-pro) is distributed with `internalUser.groovy` plugin. If you need this plugin in addition to your user plugins, you should include these additional plugins as part of your userPluginSecrets. - -### Provide custom configMaps to Artifactory -If you want to mount a custom file to Artifactory, either an init shell script or a custom configuration file (such as `logback.xml`), you can use this option. - -Create a `configmaps.yaml` file with the following content: -```yaml -artifactory: - configMaps: | - logback.xml: | - - - - - %date [%-5level] \(%-20c{3}:%L\) %message%n - - - - - - - - - - - - - - - my-custom-post-start-hook.sh: | - echo "This is my custom post start hook" - - customVolumeMounts: | - - name: artifactory-configmaps - mountPath: /tmp/my-config-map - - postStartCommand: | - chmod +x /tmp/my-config-map/my-custom-post-start-hook.sh; - /tmp/my-config-map/my-custom-post-start-hook.sh; - - copyOnEveryStartup: - - source: /tmp/my-config-map/logback.xml - target: etc/ - -``` - -and use it with you helm install/upgrade: -```bash -helm install --name artifactory-ha -f configmaps.yaml jfrog/artifactory-ha -``` - -This will, in turn: -* create a configMap with the files you specified above -* create a volume pointing to the configMap with the name `artifactory-configmaps` -* Mount said configMap onto `/tmp/my-config-map` using a `customVolumeMounts` -* Set the shell script we mounted as the `postStartCommand` -* Copy the `logback.xml` file to its proper location in the `$ARTIFACTORY_HOME/etc` directory. - - -### Artifactory filebeat -If you want to collect logs from your Artifactory installation and send them to a central log collection solution like ELK, you can use this option. - -Create a `filebeat.yaml` values file with the following content: -```yaml -filebeat: - enabled: true - logstashUrl: - resources: - requests: - memory: "100Mi" - cpu: "100m" - limits: - memory: "100Mi" - cpu: "100m" -``` - -You can optionally customize the `filebeat.yaml` to send output to a different location like so: -```yaml -filebeat: - enabled: true - filebeatYml: | - -``` - -and use it with you helm install/upgrade: -```bash -helm install --name artifactory -f filebeat.yaml jfrog/artifactory -``` - -This will start sending your Artifactory logs to the log aggregator of your choice, based on your configuration in the `filebeatYml` - -## Configuration -The following table lists the configurable parameters of the artifactory chart and their default values. - -| Parameter | Description | Default | -|------------------------------|-----------------------------------|-------------------------------------------------------| -| `imagePullSecrets` | Docker registry pull secret | | -| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | -| `serviceAccount.name` | The name of the ServiceAccount to create | Generated using the fullname template | -| `serviceAccount.annotations` | Artifactory service account annotations | `` | -| `rbac.create` | Specifies whether RBAC resources should be created | `true` | -| `rbac.role.rules` | Rules to create | `[]` | -| `logger.image.repository` | repository for logger image | `busybox` | -| `logger.image.tag` | tag for logger image | `1.30` | -| `artifactory.name` | Artifactory name | `artifactory` | -| `artifactory.image.pullPolicy` | Container pull policy | `IfNotPresent` | -| `artifactory.image.repository` | Container image | `docker.bintray.io/jfrog/artifactory-pro` | -| `artifactory.image.version` | Container image tag | `.Chart.AppVersion` | -| `artifactory.priorityClass.create` | Create a PriorityClass object | `false` | -| `artifactory.priorityClass.value` | Priority Class value | `1000000000` | -| `artifactory.priorityClass.name` | Priority Class name | `{{ template "artifactory-ha.fullname" . }}` | -| `artifactory.priorityClass.existingPriorityClass` | Use existing priority class | `` | -| `artifactory.loggers` | Artifactory loggers (see values.yaml for possible values) | `[]` | -| `artifactory.catalinaLoggers` | Artifactory Tomcat loggers (see values.yaml for possible values) | `[]` | -| `artifactory.customInitContainersBegin`| Custom init containers to run before existing init containers | | -| `artifactory.customInitContainers`| Custom init containers to run after existing init containers | | -| `artifactory.customSidecarContainers`| Custom sidecar containers | | -| `artifactory.customVolumes` | Custom volumes | | -| `artifactory.customVolumeMounts` | Custom Artifactory volumeMounts | | -| `artifactory.customPersistentPodVolumeClaim` | Custom PVC spec to create and attach a unique PVC for each pod on startup with the volumeClaimTemplates feature in StatefulSet | | -| `artifactory.customPersistentVolumeClaim` | Custom PVC spec to be mounted to the all artifactory containers using a volume | | -| `artifactory.userPluginSecrets` | Array of secret names for Artifactory user plugins | | -| `artifactory.masterKey` | Artifactory master key. A 128-Bit key size (hexadecimal encoded) string (32 hex characters). Can be generated with `openssl rand -hex 16`. NOTE: This key can be generated only once and cannot be updated once created |`FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF`| -| `artifactory.masterKeySecretName` | Artifactory Master Key secret name | | -| `artifactory.joinKey` | Join Key to connect other services to Artifactory. Can be generated with `openssl rand -hex 16` | `EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE` | -| `artifactory.accessAdmin.ip` | Artifactory access-admin ip to be set upon startup, can use (*) for 0.0.0.0| 127.0.0.1 | -| `artifactory.accessAdmin.password` | Artifactory access-admin password to be set upon startup| | -| `artifactory.accessAdmin.secret` | Artifactory access-admin secret name | | -| `artifactory.accessAdmin.dataKey` | Artifactory access-admin secret data key | | -| `artifactory.preStartCommand` | Command to run before entrypoint starts | | -| `artifactory.postStartCommand` | Command to run after container starts | | -| `artifactory.license.licenseKey` | Artifactory license key. Providing the license key as a parameter will cause a secret containing the license key to be created as part of the release. Use either this setting or the license.secret and license.dataKey. If you use both, the latter will be used. | | -| `artifactory.configMaps` | configMaps to be created as volume by the name `artifactory-configmaps`. In order to use these configMaps, you will need to add `customVolumeMounts` to point to the created volume and mount it onto a container | | -| `artifactory.license.secret` | Artifactory license secret name | | -| `artifactory.license.dataKey`| Artifactory license secret data key | | -| `artifactory.service.name` | Artifactory service name to be set in Nginx configuration | `artifactory` | -| `artifactory.service.type` | Artifactory service type | `ClusterIP` | -| `artifactory.service.clusterIP`| Specific cluster IP or `None` for headless services | `nil` | -| `artifactory.service.loadBalancerSourceRanges`| Artifactory service array of IP CIDR ranges to whitelist (only when service type is LoadBalancer) | | -| `artifactory.service.annotations` | Artifactory service annotations | `{}` | -| `artifactory.service.pool` | Artifactory instances to be in the load balancing pool. `members` or `all` | `members` | -| `artifactory.externalPort` | Artifactory service external port | `8082` | -| `artifactory.internalPort` | Artifactory service internal port (**DO NOT** use port lower than 1024) | `8082` | -| `artifactory.internalArtifactoryPort` | Artifactory service internal port (**DO NOT** use port lower than 1024) | `8081` | -| `artifactory.externalArtifactoryPort` | Artifactory service external port | `8081` | -| `artifactory.extraEnvironmentVariables` | Extra environment variables to pass to Artifactory. Supports evaluating strings as templates via the [`tpl`](https://helm.sh/docs/charts_tips_and_tricks/#using-the-tpl-function) function. See [documentation](https://www.jfrog.com/confluence/display/RTF/Installing+with+Docker#InstallingwithDocker-SupportedEnvironmentVariables) | | -| `artifactory.livenessProbe.enabled` | Enable liveness probe | `true` | -| `artifactory.livenessProbe.path` | liveness probe HTTP Get path | `/router/api/v1/system/health` | -| `artifactory.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 180 | -| `artifactory.livenessProbe.periodSeconds` | How often to perform the probe | 10 | -| `artifactory.livenessProbe.timeoutSeconds` | When the probe times out | 10 | -| `artifactory.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | 1 | -| `artifactory.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 10 | -| `artifactory.readinessProbe.enabled` | would you like a readinessProbe to be enabled | `true` | -| `artifactory.readinessProbe.path` | readiness probe HTTP Get path | `/router/api/v1/system/health` | -| `artifactory.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | 60 | -| `artifactory.readinessProbe.periodSeconds` | How often to perform the probe | 10 | -| `artifactory.readinessProbe.timeoutSeconds` | When the probe times out | 10 | -| `artifactory.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | 1 | -| `artifactory.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 10 | -| `artifactory.copyOnEveryStartup` | List of files to copy on startup from source (which is absolute) to target (which is relative to ARTIFACTORY_HOME | | -| `artifactory.deleteDBPropertiesOnStartup` | Whether to delete the ARTIFACTORY_HOME/etc/db.properties file on startup. Disabling this will remove the ability for the db.properties to be updated with any DB-related environment variables change (e.g. DB_HOST, DB_URL) | `true` | -| `artifactory.database.maxOpenConnections` | Maximum amount of open connections from Artifactory to the DB | `80` | -| `artifactory.haDataDir.enabled` | Enable haDataDir for eventual storage in the HA cluster | `false` | -| `artifactory.haDataDir.path` | Path to the directory intended for use with NFS eventual configuration for HA | | -| `artifactory.persistence.mountPath` | Artifactory persistence volume mount path | `"/var/opt/jfrog/artifactory"` | -| `artifactory.persistence.enabled` | Artifactory persistence volume enabled | `true` | -| `artifactory.persistence.accessMode` | Artifactory persistence volume access mode | `ReadWriteOnce` | -| `artifactory.persistence.size` | Artifactory persistence or local volume size | `200Gi` | -| `artifactory.persistence.binarystore.enabled` | whether you want to mount the binarystore.xml file from a secret created by the chart. If `false` you will need need to get the binarystore.xml file into the file-system from either an `initContainer` or using a `preStartCommand` | `true` | -| `artifactory.persistence.binarystoreXml` | Artifactory binarystore.xml template | See `values.yaml` | -| `artifactory.persistence.customBinarystoreXmlSecret` | A custom Secret for binarystore.xml | `` | -| `artifactory.persistence.maxCacheSize` | Artifactory cache-fs provider maxCacheSize in bytes | `50000000000` | -| `artifactory.persistence.cacheProviderDir` | the root folder of binaries for the filestore cache. If the value specified starts with a forward slash ("/") it is considered the fully qualified path to the filestore folder. Otherwise, it is considered relative to the *baseDataDir*. | `cache` | -| `artifactory.persistence.type` | Artifactory HA storage type | `file-system` | -| `artifactory.persistence.redundancy` | Artifactory HA storage redundancy | `3` | -| `artifactory.persistence.nfs.ip` | NFS server IP | | -| `artifactory.persistence.nfs.haDataMount` | NFS data directory | `/data` | -| `artifactory.persistence.nfs.haBackupMount` | NFS backup directory | `/backup` | -| `artifactory.persistence.nfs.dataDir` | HA data directory | `/var/opt/jfrog/artifactory-ha` | -| `artifactory.persistence.nfs.backupDir` | HA backup directory | `/var/opt/jfrog/artifactory-backup` | -| `artifactory.persistence.nfs.capacity` | NFS PVC size | `200Gi` | -| `artifactory.persistence.nfs.mountOptions` | NFS mount options | `[]` | -| `artifactory.persistence.eventual.numberOfThreads` | Eventual number of threads | `10` | -| `artifactory.persistence.googleStorage.endpoint` | Google Storage API endpoint| `storage.googleapis.com` | -| `artifactory.persistence.googleStorage.httpsOnly` | Google Storage API has to be consumed https only| `false` | -| `artifactory.persistence.googleStorage.bucketName` | Google Storage bucket name | `artifactory-ha` | -| `artifactory.persistence.googleStorage.identity` | Google Storage service account id | | -| `artifactory.persistence.googleStorage.credential` | Google Storage service account key | | -| `artifactory.persistence.googleStorage.path` | Google Storage path in bucket | `artifactory-ha/filestore` | -| `artifactory.persistence.googleStorage.bucketExists`| Google Storage bucket exists therefore does not need to be created.| `false` | -| `artifactory.persistence.awsS3.bucketName` | AWS S3 bucket name | `artifactory-ha` | -| `artifactory.persistence.awsS3.endpoint` | AWS S3 bucket endpoint | See https://docs.aws.amazon.com/general/latest/gr/rande.html | -| `artifactory.persistence.awsS3.region` | AWS S3 bucket region | | -| `artifactory.persistence.awsS3.roleName` | AWS S3 IAM role name | | -| `artifactory.persistence.awsS3.identity` | AWS S3 AWS_ACCESS_KEY_ID | | -| `artifactory.persistence.awsS3.credential` | AWS S3 AWS_SECRET_ACCESS_KEY | | -| `artifactory.persistence.awsS3.properties` | AWS S3 additional properties | | -| `artifactory.persistence.awsS3.path` | AWS S3 path in bucket | `artifactory-ha/filestore` | -| `artifactory.persistence.awsS3.refreshCredentials` | AWS S3 renew credentials on expiration | `true` (When roleName is used, this parameter will be set to true) | -| `artifactory.persistence.awsS3.httpsOnly` | AWS S3 https access to the bucket only | `true` | -| `artifactory.persistence.awsS3.testConnection` | AWS S3 test connection on start up | `false` | -| `artifactory.persistence.awsS3.s3AwsVersion` | AWS S3 signature version | `AWS4-HMAC-SHA256` | -| `artifactory.persistence.awsS3V3.testConnection` | AWS S3 test connection on start up | `false` | -| `artifactory.persistence.awsS3V3.identity` | AWS S3 AWS_ACCESS_KEY_ID | | -| `artifactory.persistence.awsS3V3.credential` | AWS S3 AWS_SECRET_ACCESS_KEY | | -| `artifactory.persistence.awsS3V3.region` | AWS S3 bucket region | | -| `artifactory.persistence.awsS3V3.bucketName` | AWS S3 bucket name | `artifactory-aws` | -| `artifactory.persistence.awsS3V3.path` | AWS S3 path in bucket | `artifactory/filestore` | -| `artifactory.persistence.awsS3V3.endpoint` | AWS S3 bucket endpoint | See https://docs.aws.amazon.com/general/latest/gr/rande.html | -| `artifactory.persistence.awsS3V3.kmsServerSideEncryptionKeyId` | AWS S3 encryption key ID or alias | | -| `artifactory.persistence.awsS3V3.kmsKeyRegion` | AWS S3 KMS Key region | | -| `artifactory.persistence.awsS3V3.kmsCryptoMode` | AWS S3 KMS encryption mode | See https://www.jfrog.com/confluence/display/RTF/Configuring+the+Filestore#ConfiguringtheFilestore-AmazonS3OfficialSDKTemplate | -| `artifactory.persistence.awsS3V3.useInstanceCredentials` | AWS S3 Use default authentication mechanism | See https://www.jfrog.com/confluence/display/RTF/Configuring+the+Filestore#ConfiguringtheFilestore-authentication | -| `artifactory.persistence.awsS3V3.usePresigning` | AWS S3 Use URL signing | `false` | -| `artifactory.persistence.awsS3V3.signatureExpirySeconds` | AWS S3 Validity period in seconds for signed URLs | `300` | -| `artifactory.persistence.awsS3V3.cloudFrontDomainName` | AWS CloudFront domain name | See https://www.jfrog.com/confluence/display/RTF/Direct+Cloud+Storage+Download#DirectCloudStorageDownload-UsingCloudFront(Optional)| -| `artifactory.persistence.awsS3V3.cloudFrontKeyPairId` | AWS CloudFront key pair ID | See https://www.jfrog.com/confluence/display/RTF/Direct+Cloud+Storage+Download#DirectCloudStorageDownload-UsingCloudFront(Optional)| -| `artifactory.persistence.awsS3V3.cloudFrontPrivateKey` | AWS CloudFront private key | See https://www.jfrog.com/confluence/display/RTF/Direct+Cloud+Storage+Download#DirectCloudStorageDownload-UsingCloudFront(Optional)| -| `artifactory.persistence.azureBlob.accountName` | Azure Blob Storage account name | `` | -| `artifactory.persistence.azureBlob.accountKey` | Azure Blob Storage account key | `` | -| `artifactory.persistence.azureBlob.endpoint` | Azure Blob Storage endpoint | `` | -| `artifactory.persistence.azureBlob.containerName` | Azure Blob Storage container name | `` | -| `artifactory.persistence.azureBlob.testConnection` | Azure Blob Storage test connection | `false` | -| `artifactory.persistence.fileSystem.existingSharedClaim` | Enable using an existing shared pvc | `false` | -| `artifactory.persistence.fileStorage.dataDir` | HA data directory | `/var/opt/jfrog/artifactory/artifactory-data` | -| `artifactory.persistence.fileStorage.backupDir` | HA backup directory | `/var/opt/jfrog/artifactory-backup` | -| `artifactory.javaOpts.other` | Artifactory additional java options (for all nodes) | | -| `artifactory.primary.labels` | Artifactory primary node labels | `{}` | -| `artifactory.primary.resources.requests.memory` | Artifactory primary node initial memory request | | -| `artifactory.primary.resources.requests.cpu` | Artifactory primary node initial cpu request | | -| `artifactory.primary.resources.limits.memory` | Artifactory primary node memory limit | | -| `artifactory.primary.resources.limits.cpu` | Artifactory primary node cpu limit | | -| `artifactory.primary.javaOpts.xms` | Artifactory primary node java Xms size | | -| `artifactory.primary.javaOpts.xmx` | Artifactory primary node java Xms size | | -| `artifactory.primary.javaOpts.corePoolSize` | The number of async processes that can run in parallel in the primary node - https://jfrog.com/knowledge-base/how-do-i-tune-artifactory-for-heavy-loads/ | `16` | -| `artifactory.primary.javaOpts.jmx.enabled` | Enable JMX monitoring | `false` | -| `artifactory.primary.javaOpts.jmx.port` | JMX Port number | `9010` | -| `artifactory.primary.javaOpts.jmx.host` | JMX hostname (parsed as a helm template) | `{{ template "artifactory-ha.primary.name" $ }}` | -| `artifactory.primary.javaOpts.jmx.ssl` | Enable SSL | `false` | -| `artifactory.primary.javaOpts.jmx.authenticate` | Enable JMX authentication | `false` | -| `artifactory.primary.javaOpts.jmx.accessFile` | The path to the JMX access file, when JMX authentication is enabled | | -| `artifactory.primary.javaOpts.jmx.passwordFile` | The path to the JMX password file, when JMX authentication is enabled | | -| `artifactory.primary.javaOpts.other` | Artifactory primary node additional java options | | -| `artifactory.primary.persistence.existingClaim` | Whether to use an existing pvc for the primary node | `false` | -| `artifactory.node.labels` | Artifactory member node labels | `{}` | -| `artifactory.node.replicaCount` | Artifactory member node replica count | `2` | -| `artifactory.node.minAvailable` | Artifactory member node min available count | `1` | -| `artifactory.node.resources.requests.memory` | Artifactory member node initial memory request | | -| `artifactory.node.resources.requests.cpu` | Artifactory member node initial cpu request | | -| `artifactory.node.resources.limits.memory` | Artifactory member node memory limit | | -| `artifactory.node.resources.limits.cpu` | Artifactory member node cpu limit | | -| `artifactory.node.javaOpts.xms` | Artifactory member node java Xms size | | -| `artifactory.node.javaOpts.xmx` | Artifactory member node java Xms size | | -| `artifactory.node.javaOpts.corePoolSize` | The number of async processes that can run in parallel in the member nodes - https://jfrog.com/knowledge-base/how-do-i-tune-artifactory-for-heavy-loads/ | `16` | -| `artifactory.node.javaOpts.jmx.enabled` | Enable JMX monitoring | `false` | -| `artifactory.node.javaOpts.jmx.port` | JMX Port number | `9010` | -| `artifactory.node.javaOpts.jmx.host` | JMX hostname (parsed as a helm template) | `{{ template "artifactory-ha.fullname" $ }}` | -| `artifactory.node.javaOpts.jmx.ssl` | Enable SSL | `false` | -| `artifactory.node.javaOpts.jmx.authenticate` | Enable JMX authentication | `false` | -| `artifactory.node.javaOpts.jmx.accessFile` | The path to the JMX access file, when JMX authentication is enabled | | -| `artifactory.node.javaOpts.jmx.passwordFile` | The path to the JMX password file, when JMX authentication is enabled | | -| `artifactory.node.javaOpts.other` | Artifactory member node additional java options | | -| `artifactory.node.persistence.existingClaim` | Whether to use existing PVCs for the member nodes | `false` | -| `artifactory.node.waitForPrimaryStartup.enabled` | Whether to wait for the primary node to start before starting up the member nodes | `false` | -| `artifactory.node.waitForPrimaryStartup.time` | The amount of time to wait for the primary node to start before starting up the member nodes | `60` | -| `artifactory.systemYaml` | Artifactory system configuration (`system.yaml`) as described here - https://www.jfrog.com/confluence/display/JFROG/Artifactory+System+YAML | `see values.yaml` | -| `access.database.maxOpenConnections` | Maximum amount of open connections from Access to the DB | `80` | -| `initContainers.resources.requests.memory` | Init containers initial memory request | | -| `initContainers.resources.requests.cpu` | Init containers initial cpu request | | -| `initContainers.resources.limits.memory` | Init containers memory limit | | -| `initContainers.resources.limits.cpu` | Init containers cpu limit | | -| `ingress.enabled` | If true, Artifactory Ingress will be created | `false` | -| `ingress.annotations` | Artifactory Ingress annotations | `{}` | -| `ingress.labels` | Artifactory Ingress labels | `{}` | -| `ingress.hosts` | Artifactory Ingress hostnames | `[]` | -| `ingress.routerPath` | Router Ingress path | `/` | -| `ingress.artifactoryPath` | Artifactory Ingress path | `/artifactory` | -| `ingress.tls` | Artifactory Ingress TLS configuration (YAML) | `[]` | -| `ingress.defaultBackend.enabled` | If true, the default `backend` will be added using serviceName and servicePort | `true` | -| `ingress.annotations` | Ingress annotations, which are written out if annotations section exists in values. Everything inside of the annotations section will appear verbatim inside the resulting manifest. See `Ingress annotations` section below for examples of how to leverage the annotations, specifically for how to enable docker authentication. | | -| `ingress.additionalRules` | Ingress additional rules to be added to the Artifactory ingress. | `[]` | -| `nginx.enabled` | Deploy nginx server | `true` | -| `nginx.name` | Nginx name | `nginx` | -| `nginx.replicaCount` | Nginx replica count | `1` | -| `nginx.uid` | Nginx User Id | `104` | -| `nginx.gid` | Nginx Group Id | `107` | -| `nginx.image.repository` | Container image | `docker.bintray.io/jfrog/nginx-artifactory-pro` | -| `nginx.image.version` | Container version | `.Chart.AppVersion` | -| `nginx.image.pullPolicy` | Container pull policy | `IfNotPresent` | -| `nginx.labels` | Nginx deployment labels | `{}` | -| `nginx.loggers` | Artifactory loggers (see values.yaml for possible values) | `[]` | -| `nginx.mainConf` | Content of the Artifactory nginx main nginx.conf config file | `see values.yaml` | -| `nginx.artifactoryConf` | Content of Artifactory nginx artifactory.conf config file | `see values.yaml` | -| `nginx.service.type` | Nginx service type | `LoadBalancer` | -| `nginx.service.clusterIP` | Specific cluster IP or `None` for headless services | `nil` | -| `nginx.service.loadBalancerSourceRanges`| Nginx service array of IP CIDR ranges to whitelist (only when service type is LoadBalancer) | | -| `nginx.service.labels` | Nginx service labels | `{}` | -| `nginx.service.annotations` | Nginx service annotations | `{}` | -| `nginx.service.externalTrafficPolicy`| Nginx service desires to route external traffic to node-local or cluster-wide endpoints. | `Cluster` | -| `nginx.loadBalancerIP`| Provide Static IP to configure with Nginx | | -| `nginx.http.enabled` | Nginx http service enabled/disabled | true | -| `nginx.http.externalPort` | Nginx service external port | `80` | -| `nginx.http.internalPort` | Nginx service internal port | `80` | -| `nginx.https.enabled` | Nginx http service enabled/disabled | true | -| `nginx.https.externalPort` | Nginx service external port | `443` | -| `nginx.https.internalPort` | Nginx service internal port | `443` | -| `nginx.externalPortHttp` | DEPRECATED: Nginx service external port | `80` | -| `nginx.internalPortHttp` | DEPRECATED: Nginx service internal port | `80` | -| `nginx.externalPortHttps` | DEPRECATED: Nginx service external port | `443` | -| `nginx.internalPortHttps` | DEPRECATED: Nginx service internal port | `443` | -| `nginx.livenessProbe.enabled` | would you like a liveness Probe to be enabled | `true` | -| `nginx.livenessProbe.path` | liveness probe HTTP Get path | `/router/api/v1/system/health` | -| `nginx.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 100 | -| `nginx.livenessProbe.periodSeconds` | How often to perform the probe | 10 | -| `nginx.livenessProbe.timeoutSeconds` | When the probe times out | 10 | -| `nginx.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | 1 | -| `nginx.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 10 | -| `nginx.readinessProbe.enabled` | would you like a readinessProbe to be enabled | `true` | -| `nginx.readinessProbe.path` | Readiness probe HTTP Get path | `/router/api/v1/system/health` | -| `nginx.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | 60 | -| `nginx.readinessProbe.periodSeconds` | How often to perform the probe | 10 | -| `nginx.readinessProbe.timeoutSeconds` | When the probe times out | 10 | -| `nginx.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | 1 | -| `nginx.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 10 | -| `nginx.tlsSecretName` | SSL secret that will be used by the Nginx pod | | -| `nginx.customConfigMap` | Nginx CustomeConfigMap name for `nginx.conf` | ` ` | -| `nginx.customArtifactoryConfigMap`| Nginx CustomeConfigMap name for `artifactory-ha.conf` | ` ` | -| `nginx.resources.requests.memory` | Nginx initial memory request | `250Mi` | -| `nginx.resources.requests.cpu` | Nginx initial cpu request | `100m` | -| `nginx.resources.limits.memory` | Nginx memory limit | `250Mi` | -| `nginx.resources.limits.cpu` | Nginx cpu limit | `500m` | -| `nginx.persistence.mountPath` | Nginx persistence volume mount path | `"/var/opt/jfrog/nginx"` | -| `nginx.persistence.enabled` | Nginx persistence volume enabled. This is only available when the nginx.replicaCount is set to 1 | `false` | -| `nginx.persistence.accessMode` | Nginx persistence volume access mode | `ReadWriteOnce` | -| `nginx.persistence.size` | Nginx persistence volume size | `5Gi` | -| `waitForDatabase` | Wait for database (using wait-for-db init container) | `true` | -| `postgresql.enabled` | Use enclosed PostgreSQL as database | `true` | -| `postgresql.imageTag` | PostgreSQL version | `9.6.11` | -| `postgresql.postgresqlDatabase` | PostgreSQL database name | `artifactory` | -| `postgresql.postgresqlUsername` | PostgreSQL database user | `artifactory` | -| `postgresql.postgresqlPassword` | PostgreSQL database password | | -| `postgresql.persistence.enabled` | PostgreSQL use persistent storage | `true` | -| `postgresql.persistence.size` | PostgreSQL persistent storage size | `50Gi` | -| `postgresql.service.port` | PostgreSQL database port | `5432` | -| `postgresql.resources.requests.memory` | PostgreSQL initial memory request | | -| `postgresql.resources.requests.cpu` | PostgreSQL initial cpu request | | -| `postgresql.resources.limits.memory` | PostgreSQL memory limit | | -| `postgresql.resources.limits.cpu` | PostgreSQL cpu limit | | -| `database.type` | External database type (`postgresql`, `mysql`, `oracle` or `mssql`) | | -| `database.driver` | External database driver e.g. `org.postgresql.Driver` | | -| `database.url` | External database connection URL | | -| `database.user` | External database username | | -| `database.password` | External database password | | -| `database.secrets.user.name` | External database username `Secret` name | | -| `database.secrets.user.key` | External database username `Secret` key | | -| `database.secrets.password.name` | External database password `Secret` name | | -| `database.secrets.password.key` | External database password `Secret` key | | -| `database.secrets.url.name ` | External database url `Secret` name | | -| `database.secrets.url.key` | External database url `Secret` key | | -| `networkpolicy.name` | Becomes part of the NetworkPolicy object name | `artifactory` | -| `networkpolicy.podselector` | Contains the YAML that specifies how to match pods. Usually using matchLabels. | | -| `networkpolicy.ingress` | YAML snippet containing to & from rules applied to incoming traffic | `- {}` (open to all inbound traffic) | -| `networkpolicy.egress` | YAML snippet containing to & from rules applied to outgoing traffic | `- {}` (open to all outbound traffic) | -| `filebeat.enabled` | Enable a filebeat container to send your logs to a log management solution like ELK | `false` | -| `filebeat.name` | filebeat container name | `artifactory-filebeat` | -| `filebeat.image.repository` | filebeat Docker image repository | `docker.elastic.co/beats/filebeat` | -| `filebeat.image.version` | filebeat Docker image version | `7.5.1` | -| `filebeat.logstashUrl` | The URL to the central Logstash service, if you have one | `logstash:5044` | -| `filebeat.livenessProbe.exec.command` | liveness probe exec command | see [values.yaml](stable/artifactory-ha/values.yaml) | -| `filebeat.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 10 | -| `filebeat.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 180 | -| `filebeat.livenessProbe.periodSeconds` | How often to perform the probe | 10 | -| `filebeat.readinessProbe.exec.command` | readiness probe exec command | see [values.yaml](stable/artifactory-ha/values.yaml) | -| `filebeat.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 10 | -| `filebeat.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | 180 | -| `filebeat.readinessProbe.periodSeconds` | How often to perform the probe | 10 | -| `filebeat.resources.requests.memory` | Filebeat initial memory request | | -| `filebeat.resources.requests.cpu` | Filebeat initial cpu request | | -| `filebeat.resources.limits.memory` | Filebeat memory limit | | -| `filebeat.resources.limits.cpu` | Filebeat cpu limit | | -| `filebeat.filebeatYml` | Filebeat yaml configuration file | see [values.yaml](stable/artifactory-ha/values.yaml) | - -Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. - -### Ingress and TLS -To get Helm to create an ingress object with a hostname, add these two lines to your Helm command: -```bash -helm install --name artifactory-ha \ - --set ingress.enabled=true \ - --set ingress.hosts[0]="artifactory.company.com" \ - --set artifactory.service.type=NodePort \ - --set nginx.enabled=false \ - jfrog/artifactory-ha -``` - -If your cluster allows automatic creation/retrieval of TLS certificates (e.g. [cert-manager](https://github.com/jetstack/cert-manager)), please refer to the documentation for that mechanism. - -To manually configure TLS, first create/retrieve a key & certificate pair for the address(es) you wish to protect. Then create a TLS secret in the namespace: - -```bash -kubectl create secret tls artifactory-tls --cert=path/to/tls.cert --key=path/to/tls.key -``` - -Include the secret's name, along with the desired hostnames, in the Artifactory Ingress TLS section of your custom `values.yaml` file: - -```yaml - ingress: - ## If true, Artifactory Ingress will be created - ## - enabled: true - - ## Artifactory Ingress hostnames - ## Must be provided if Ingress is enabled - ## - hosts: - - artifactory.domain.com - annotations: - kubernetes.io/tls-acme: "true" - ## Artifactory Ingress TLS configuration - ## Secrets must be manually created in the namespace - ## - tls: - - secretName: artifactory-tls - hosts: - - artifactory.domain.com -``` - -### Ingress annotations - -This example specifically enables Artifactory to work as a Docker Registry using the Repository Path method. See [Artifactory as Docker Registry](https://www.jfrog.com/confluence/display/RTF/Getting+Started+with+Artifactory+as+a+Docker+Registry) documentation for more information about this setup. - -```yaml -ingress: - enabled: true - defaultBackend: - enabled: false - hosts: - - myhost.example.com - annotations: - ingress.kubernetes.io/force-ssl-redirect: "true" - ingress.kubernetes.io/proxy-body-size: "0" - ingress.kubernetes.io/proxy-read-timeout: "600" - ingress.kubernetes.io/proxy-send-timeout: "600" - kubernetes.io/ingress.class: nginx - nginx.ingress.kubernetes.io/configuration-snippet: | - rewrite ^/(v2)/token /artifactory/api/docker/null/v2/token; - rewrite ^/(v2)/([^\/]*)/(.*) /artifactory/api/docker/$2/$1/$3; - nginx.ingress.kubernetes.io/proxy-body-size: "0" - tls: - - hosts: - - "myhost.example.com" -``` - -### Ingress additional rules - -You have the option to add additional ingress rules to the Artifactory ingress. An example for this use case can be routing the /xray path to Xray. -In order to do that, simply add the following to a `artifactory-ha-values.yaml` file: -```yaml -ingress: - enabled: true - - defaultBackend: - enabled: false - - annotations: - kubernetes.io/ingress.class: nginx - nginx.ingress.kubernetes.io/configuration-snippet: | - rewrite "(?i)/xray(/|$)(.*)" /$2 break; - - additionalRules: | - - host: - http: - paths: - - path: / - backend: - serviceName: - servicePort: - - path: /xray - backend: - serviceName: - servicePort: - - path: /artifactory - backend: - serviceName: {{ template "artifactory.nginx.fullname" . }} - servicePort: {{ .Values.nginx.externalPortHttp }} -``` - -and running: -```bash -helm upgrade --install artifactory-ha jfrog/artifactory-ha -f artifactory-ha-values.yaml -``` - - - -## Useful links -- https://www.jfrog.com/confluence/display/EP/Getting+Started -- https://www.jfrog.com/confluence/display/RTF/Installing+Artifactory -- https://www.jfrog.com/confluence/ +# Openshift artifactory ha helm chart +This chart extends the base artifactory-ha chart to make it compatiable with openshift 4 clusters diff --git a/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/charts/artifactory-ha-2.0.25.tgz b/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/charts/artifactory-ha-2.0.25.tgz new file mode 100644 index 0000000000000000000000000000000000000000..a3f1ca8e4c7dc27e8fb38ab147312454df6bbdba GIT binary patch literal 111438 zcmV)oK%BoHiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMZ}dfT>=Fn<2lRiLzbZ1;rvu;a8<;_R!~a-!B>D>-TNYkO3P zge24y!4jZt)%8AmA@6&0dnLaI1AqiSB+E{k?%A!{CzeQHFc<)XnZaNN$AV6A@I3h2$NRKet=5-&d+@i_Y8C&scXport-bqfx7~i$e!A2CTdV!F-ERF2 zwLT&aOFs!0IR0DfgWD>0?qB4CBl?cSoU*WkuG%#mMd{Bk8#|45%_rQ8X(Zs$+mK$7 znBxEqNW?gm(*~X35Kl>rcoIb{7Brk990X{Ne_=6-uy={4^4WyNb1e9i8bafQ20jvu z1svhfM+bexNh~2ZYBM$`9W)an;+B))Bn{&(siJM&DaX^}d$se#O%RQ418c{f{U6RE$i+$dyxyUL| za}hwVxyUD1EaJ5}rlG(zBr%jFb4-H{!gDHSm;Wd2NDZM7%WlF88uF~Dk3&iVQc+gF z`HjR`X%hI@#}$Rui>zQw=a|nc3dVGv@ZV}0og6)CoF%bGpd*INV;YJWFD$}FG4m5o zG`~5D+0^Y?5YA)PyrSgVs;)+;G%U3%Gv{_1t;Wt??ay8n|9d`#C2)m1VYK z)b%{VITABsYF|?^L$|l6@lMUnOR{M2WPC{$=FhSzEvHtaAs09ZNZhF*Bo+~of1>~k*`JPtb;NS}Sd;_->|HUNqbR0VSP&GG zDdi%jgx9ES<~#|4A@O1&xP-BR1}q@x73Rb@-H~|3EP$6}lI>cT$(Y0;5rj7=Yx>ON zP3+HU*u;sLv6%jb<-XgD$JlGu+#`U)nBiN|7Jc4@}A;2reCPcXj{LE>{PW*yX&C}qq+Kg@|` zWt?TB`9ad1Xm|nUyn`gOxTz>60`6i@3MP)k-l-uJ;4uj@up-8j3H4l9%ZS_v5{Edb zctykXl?Y7FsR?8lm)zia z6cASg9Lg9X>L0MMGCDPUCPl@Du2q9lUEimYY&byF42fKrlBVe^SmDrtS}i2vn#Gq9 z3#hkHEp^pemjbwfA!j6kuQiE9Nz{XR5;1>B0wN!n)j5~z@mLXDKSBscQAtjOd6rH~ z*#-;`Le^wWpKhSHp~vQPqSg?W_#zet3mYnM449;BK2Ji)s)*VMBF2RT`fGr;=*0Tj z&@d z6FN;|wZP=7x17Kvy~b3?o!RxrNN$F*sM-x1Xh?wCz$xSxeo3R6tZ>9)16uP43G%>h z#Fh+XJJt~RBqE_tLT@2!#Wq{EMEz`48#QbkuyH{b%b+#~z3$;juQB%}tInS1c%Eiw zumP+2rMKlp2l>pqByq#&DwOH>Mq}-uF%==6(`If^5fXUXL0>nXHQIZwPsS97?$>Vo zbz4daY00--a+2~I%1WGL&ZWB8L5`Dqkx_bC)g0kfzvMz167^9_Ra})%wsP~BucH;Tt5ovoK{t9zb;nV)0INzlXMNi{--wE)3Xa} z13g#d8~*#T;@6Zbo{YB2>|r04!1fafND7}PZ-*CJAX*?V;eySPZ`PVm1g3!!U=fRv zrQM=y8U%oc)E`96)UhQ?Kc-ho)>K%__N0g)aZcjk2?_|lBCt;Yla_=>WF84QCz3eG z*SrSNIiQ!s?qar)OQ>pFG7I0(#~&*|k)D@Nq~s#sa3f^P_P9dT6v{U~lZcWV%0Vpt zHeJxVMQ%6gk0nYz2?fOghsG4FLW{a;Hn9u}FcH)eb7G&n)?!KL$t969#~-`0l75;) z{UI<+Mg7K*{y}KOfm5pmY&una$T6mj@obJ0z8JHc&5Yk{wi~;xO{siX)2n7R*2&C8 z#eH{4D^7_6YIBPXAc~pdA{*$G!TiAjjTc6WMArnSNoEn0b8Sk5YEtUlHc?*%gUn z>XVdga-=k2j1Uh6-xj)&r+}_u-k#@ig8m+ofaqoJj~h|UA`%NK_hlLo$@sd1i~dpf z;NooXe)Q(-q}L?EYvziAjv%2NzB*4Io`pln!ICK59Bf_&o6K26!rVslRZHOnW&xkZ zL=73`AZUj^@nJ~i(1Fx;dNf4jii9G;L0*D^a&Nj)=fHA%Jfv}9$I1pFlIn(P_=p-k zmqiQtx72yWLPW4P%grgSdMfoj7A?-g-W7=#ru%A5Z=mj&vmg-!+EWi*q;|o)vNIYp zCb)=k)Ev_g#|ti4Od2olD^iK0DJF0{C8C4mfEARfM`L6w8v*q`7Dh^K zqCW9(oC%nE1!D@<5}V=yo62dY7-Ob*xkid;1Z=9Gzyz^=+ceFd>Utv)OLZ)Jj=|Dm zKd=dq0ZnM&k7zhyqdA?bIS8-e{joyR?pP`SWxW_YL?(Lnv?LPk?AzQ3jv4tuOrbTKN z(D}2edSa%7F#sy7-?PSzTq$2RZfXdnQ)Zb|E$E!EL=1_?LZ5fg?z5I+m7v`l0W+_i zaYSy2mq62FGGQ@6k(8g*zEvnI=>|ahwz-qPB2yZ6(C>yhXt6~VbvY49ly;nI+o)wz zE!$4f-Ce%IxwWy|RqbU41sj}N$)qSW|YR?4Ja2b5#FCXt2przke^v7$c?ZDG)}@Ue=8MD z)XJVtIGlJ`&mJ`|`3yCcw*=RJ8&;K1&3P)}m+`9rVO9tfv0w9Ktl*@z&D-3;kfC*P z`_ApgySA;Uupy^U3tRb$?Hm;>PNgNL=#nu>y--SXxw7+0XF0);=tGl=1e@dD}AP#dCwB$;V?Z*MJ&{223f~2ZnViF5^^4(7>7P`XXFO8pKU4- z=a_Ru!FoC)!CckebX_>Wwb-s|`&+Wuuiu_@hZnuU=-b}=I}N29z@eg4rh~;3u#-x> zz+fe(tD72ov|SdO!LlpJ!$ClN-8ol2883_-TGmKg9;PRas?q+*`Pty2dwS8aJt~wz zTv5&J@+k=A(}A?7mXsuY5(R8AC!vruO$&C=(FcBDf>hvcrpPyphDf3WrW>#*$*)Yz zNSt~SfMvoOg;K|dLlFX5@^Ez!f5y{Sv-_aG)t0CKNQl+NW%u4V2 zbE*|t8o_@0Wuw(-HQJ80wq@3IW2{%-eJrr-bj7j{s7FHO7NNhU22lN5l9j4a(obML z&=5rdrXiB@S_7=5gu<+VLDpQ`fYnP<^a9 zF7XlOsqR)~RxQAVSbWOO*E3SpyC(GA)!$< z0NSda$|#!8SSYGj4LXllEE+fS01!4(a`Cw&ONvYem4@1t2+Y?w#&aS_T(g9u!nTIP z1)N@HVCFa~u5P=2CJW`|lm?%5(C@Ah35Yji$jMyNWMO66)nboR076249S}s)L<3Ni zJ=WNpQ?5zj5D-onq9B>lkZU$|7831NBKLFsa#LC9p^U6^4o_33F)cIU*qhNS;pdxn}U z66M3ErT`0JGoa(N!0yJN^s(`DHHO*@{_s-s4 zl7+VXpBbV|c%=A~xIMd>q34q9Sl$!ejyJ6#W!&o{a+9rRK^ zzP)wTE?a4=Q5|ZeBuJqlYJwVP_zy?Mh_=qMna(+D%YovU2Q)->{_RyI+c~ePfB3*?1%;r!N6!Ec~ItQ9#}Pn z*Y9BFaj=A%mE=`AtktAMvheVJXnEg@47z4B75=VPi^|uz;M6ETNgQ<0<}d!(>sbDj z&89?gKmvj}X-MH6-QBrX0gF#s4Qs8{tg&Wwsj}B2$esoxIlnvEy@J$P4zYM@gE@r9 zSw~Xm%gy_mHGY~_v$waUd7(&V12ZGgkgsw$D=JnMP2wO|(sZV>uokFukSn{Df#jDY)>voS7VE4%drOV+LbcSu zw6dBhRXzVphQ0p8m;&J*vVC5tuYjDhSZL?g!?V=-2h1#B*I;nMA!@gFo=QE+R>9&V zr1#uh`ZKwr@J!Peuz_DKFEsUuu zpjRX`7foV;o>Jpl~}_P>j%AZMXx-$K}FwO-R& z&QsQ$iD^@sV0q)LvW1krE&;&l*+s9Td{e=!OQ#`=iMF`wsXZnEyH=K$Ild$)i7KHf zEM8@AzMt#6o}F5H1p|9CGSt^8@(#kDe08qeFJjmO;fbQW_J=h)OqfU=`D`MG3|k|) zv5~tO1s37#kPoR-J~UKka_AuQCI$nzb`^S3KD0wG>_;!HI$ROlahbH+0`FzzDZPzYY?=y_Ab5g8R%#B8#1Kt;BxN1( z1bH*Y((50_^Ez#v#0`YDrqK>!A?kiNl)b>Ak7FO{`>p`#^|!qz@-_N9k{k6^2`qbOKFX}J9*aWBlbf?Zs5-Lx&`lSq7k46Hdl zQIIN;tC$ShGSoFM!%0fKDPvPvQlXemu50e{-SpRQNle^vz{a&q>aZHftU+;C70kO!jy5MAD)r-$u7ktUJ zi3!Cd3iQQj;~C>{N>H6=19S=u z_z9{L)Y(T#C}@DTK5)zpQ}5|_@Ra{fL$QrqOS&&~jVEKbOqtu;3VhMsT}m#21#$5; zj)~J;)%ToUm20?ZS}o0t$~P~XdK%T14e9bZRBXWBNnftx24|H=cXuzEIRHiI#hrMa z7K(MCl@g#@HIb~x%_bV^8-@^rfnXoj?6nky5En5PWV+Devyrt@Po;EXD^{4!@1-PP zzKV)Ok(j(9Gkir^{4!=q=nvSKhA*1A7sXnDcKS9Vu}4CIr{pLmWEf$OylCc&l$$l3 ze7PgrN`Ku?%Kwflx7j>mvAS!NTen*vu5Ld`ua|=MlrlsqXQu%;mX6~?)_jT3&_&sp zoTq8a%Rs(p=E^S_jQm*SILV8q+H+nmwZoP+rJawsDXqP|xL%NOLE_>9NuMv{o%sdh z#f0Kfp!zm~($mnj!;K)Ubz z#zMj!b+Eecfa?5Y6^y?&*gs-}1yN8kZ=WOV`^tooQ;SlPCnQ>(%X_3q(2=?86xA7d;0INRVKxdnc-ovgfz8S`I}`laWq zwjz5Oi+GW(V)*B0l>NP`q- zfx2I+tLS)++NP(uhfC!;bgyiO){^hgJu+Udi=WbT@=<2RhblrJt_1y23eaQa>IaBo z<)QxrM5hl~osYNAJX%wD5Ucwit2L~?U|}_fulaEI-ERIo^TAB8LaOB=bKQh~=O010 z3Z-&DjMIQ61g(^;))1DKoZXt1a>CF(Qr4P+)6&!87crR{!l$)aD?>s7^}acFd9sdYy*#SboLX$n{1 zlfKTipFMqWdj}F-cEWs8-C*`U*P``!%_)>{(hs@7p+^p~fUz${oRAmIB`+&roX3RI zX-LB<;FEg-$mPqF%++)nVv)q8cN5XrxMKpS>Q?}BNv$PR1+DZbW}!HQxbJ%Em)2-S zv5dx*Zyz?g8HjJm;vCbsa*|h+Qaq!wwvAX;{;_zSt0WuhTEcR~vSL;AvEJT~N0s!r z-qCjIf{q@oaV=4|KANtzwu1Gi9H)PLqj(w1kE2CpQp2CGFMTp)=`V}-Ul#8_&*J@P z_VSlT{wR$+$K*c9S`I4N{bKlHA_4cShekhK^8tF)a%dHA{?fDl(z7b5StOmF+gXB{3Pxd)h?={i zFbb>PfB$EwA4@OTK*5|he|xoe|0g&O{PbsmfA~RQX>yv~XVu($5T7hzs`K5hEnrHJ za6De0!@vR)NkDvslZ9Pa4 zdXQ`ePc~G(>y`4Def3+`$!^V=xCJ^Q_Z%+}4me~*&f+htduGUk%X8_KMu=g6Lm!Q? zcbP=SyV5dp#aAOaXe8ePbDe{ z13yLcBoH(TNG`Mj#2ajsyJhb0RbL5I0aJYyQf# z+gal}sPFl^1Dygr4W4l#;p@m1!kd}U!8(=46;ZK?GDr~jYK<6j4Rm+s%As+iE6;ra zh`LN}c9~A}P;hF1CBO_oPY2oFQW-p}soFt1+jg7tg-PF%V%WOpeY^U76-uW}kPiB8 zMgsz2+(SZqB(9kxKbpiWRN=7UC1w2-oMA*`ZFIN=Q%?bmNlkA|cEc^aLIMy53t*bTCr$g!}8 zX@(WEPG6egD9(!&BRET;J#ffXB@ai~qhevg52>dx$<87j-whJvtv5R=f~(}*eGO5J zOwvhrJyi@xls7y!Hv}>U$^3FvL1)s08p;lseb&v&>b-JgoM1v7&N8k<5!FPmXG5ln&Z$nLV<~ccfE#m%4A1Uu7;8 zorjKZ$~3bmeJA*mATG7^;V$~wQ1)k#;(k^`_p_32K0`x7(ireQ^LPVa^9G*d-&hDS z;8hx!pee->E}GN08RO6=jhWElhG1TGKE?vV*W6h$8}jqboGEoa_Hrv9_vGe?#Wk#_ zt5%YIfYU)v_q*X!_svQ7z#YEn?(98tED5CR`&0tJ0kW*lQhp%IIa9qA|xeCPKeryX`E$^8IrxAFwJ_o(y3vCARP=O%+le&74YiA4AF|&o3qF zhNmiw)`8l=`{#D&bh1&oVPDUvASz)-SW1U&a>Z;VoJ^7c(TNFWXI=q4_Kz9%U*SM< zk~j?lrXrP5u2RXEoE-ggbkIK>sPl(Z&d}m{2lAO1NJB{OHh_X1^uuPm)lmQMHFtM5 zpCEY9P9LP(CX1D@0jX3W)so4q5YUj6nuHQ2`$VJBKuQb=r!>4t;|?#wYk%`Lht`uE zPFg-$(J6&Ag!9BEn(UoH@jK8bRRDXcM#l(bSrQlh!UXVy#?V-|h9brSw52oY>k=Zy zlL_?@1dKGg!#o?eH0m2vPE+T@OBGZ<{fPs`?qtbM`m!p%=QsEYBc@~=P?1$09HY7X zB40-_lQL;4wU+ZSWwGtXHUv3xhB6w720GUv{^h{ixd0@nU((?EhT19}6r@d%%ZtyJ zW(3d2Pi^n+eyvL0lpfd0Bdfb1nTXQxsh5wNz|)?Rn5ZaYKAlWR43YlEL|hZ1Mm)0m z2QmH%eU$n<#KWT|Y9WoYl!;JHQQc(KfuLqS3ki~KH&mK>*~AhqBX=iVLesF2k|pb+ z9%X~F#PNwXslo ztD#)p%WV4Q5?_{*P`{>5_SodSR7o!j*{h3HcPgstWL+P7jpsU=Dw|f;G_GP_&S5iE z@yRskY+6G$y)nB|luFlmDg)fix$MEzv7X$>ex^_CL>L{^ex@J)GQYXktP#Q5|GL#~ zrH>%yeEN&?pr~7YHzOg+rAUxlCd@!9X@N?nrifbxEJMeJn2{*s zgh)qLACds^Xm`&*fIi`doJ4xn|Sm^D;?}mbQ zP5o>&zQY0a^&SL$b~u{|N3L6EhGXA(4jI2x$^+$8VCjywgR-W{hyj~I7Gu7W6)OI_CMUF*_5UJ9sCvByAJidH50s^52cFGo zm}Vq3mcmMYX>Wx8qxofV$N!68{x{&48>m1tcwm!k1Fgkkr2>GdC`IM9MXqa1#Sx3O zs0&OXi82MVkb*N~0_tdi&WRGHO(Ij68{>oq0@Mn^Rk{Hv^NZvFvOS$DQb2vfL#a-} zxMXLLvM7`4mdNB@6(&r_^S5>e{luQ!&*kPJblBaHg)VFzPYh_MuzxuAh7mFW`%k01 zMg5Q4qq1}&`BWlRX+*wi)oL54A5xK79(XO6Cm$f?nWxUXZdj*I&6aY%XHQS4W1gDK z=yUzVFwJ5mol`wmYX?%YOAJq?9$o`&T%uFV9dJoQzk?3b6uC9CJ420HVPDMeD{>FX z?<%bQ{vN%VPads9AO^HxVBY|~XcH?fSkcpBYIA;O%79G@|oHB796E5kXa^nrDPdsep zjnvyDrU9G_Nh~1+a7|^jlY_3T5*x_XJW%KTl@CZ9vlxEEgJV_0hMrEB4B()!{ccob z=`YNn-1fP%XR`AbGV?FV%5UZLheXpAo1^W3g|33>jg62R5qlDT1pJ1=D`&S1y4Jo=Zj@eMv#N&xdmb-M3h!ANb9jD z!ZReNb7fQI1`W*~Mqqe`ln#39Y%)&};VKfF(rJR%(G2t1XpV12;MAF6Q!1klA5^ht zX(2UKBgpk%fc3QX^|R&0Y;f(Jubx{QS`pAr>uJ^dYJ}9N#{~N$eg6yXJZ-g7Iw`yU zNCn?qS!B%oMRftyh91VW$d`MC0-S_PkWlZ($z(!e)q&le%c_?gJ#AIJ<7olY|3VQ# z=Fvzpsu8$jYC`U{=J{fBwvF^gf!d9B6$xxK+dE&S4FzmEny`3|h2owFZPt|oXH;Aa8vvVId#q39b^vYH|tzrk#JO3%`ODtl7<2~b-*(w6B3iys-a&< z_#-?ep>Ryu8;ROAj(y_GZ_Z`~)`Eg#(k6}2KFXnMSyRl&;1FtMW6UV?=HS5LcR9<>vSwBBf@D)_cdgW~E4%Y>0$762L;C)( zt}m16?(elFXQ2Ps`nMNS2YcE0$M%nnwMD@7g+&VqbxqFngoe{tav#a=c`hS|CXiNy zIC2^ilv}uZh#Uv~E|q`D(pwUzQePUV09BH~EfL1eh({-AtGqV?mqGhzb9390w>c4L zSy@!)-i*viUj9{H7@5?WS+cd(sEb%E9lYTJqXXx>;VkZ*XWkndmTt8IK&nNViZM|c zZT@K&YyMjuHBn5Izo<(wqgT^tzmqn_1vn0GE{z$|)Df*AXT9fOfo?A#LISuJ$GA2*-nU3+4}e_1+CIK26<|NOtlQf>XO z|NMXI2*k|M3*`o8jK>;)!Xtl{yrG}Cmt@h=U*R01rdN)FTgvKNOg{||i|MB|489(a zr%!h)ps1%C=&*M_=pA$~dWW6DQLFJ8i%AqAlj`DQ}>@K$!DnP9Sx@xsxd03Cw3k7$Yh%ZMs+a z`uaw&Xw*!Lxs!jh-pgKiruhBm^(4StP_N;!rmVo5rmEsC=7=4A+1P8e)loJe{WcCd z$T7b1MxZ58*py`@|4 zC+T-OQ^ALcB_c}1r|IznoMqarR)x3B{q8bLtJSiOzt8g42W&c};j|HuD-v`N4JRxW zc^Y!-=sff)HQ45?wRX=^MCjLqB&5OBEs_7I*(21TVU!q$Lsx66%HgD1QiBVEoQw#Y zbWr{F;P`CV>i|nIy0q*V&n6XeAJxAv8W|Q7N&?>kX;gIN{4$A!W7$)tBkj3mwWHpv zN!Uqkdzyn}Xo69>gMP5DrKeP~_z$|fbAGD*?O*s)xNvCVI`HP{*+p;I5I5q(+i0~~ ztuOcX;BTwdD*SCfeYX4bZ|&V@yY2R~_S2pA-&*axXFKh`q1MOf;C-Kj3mpHg^}%fw zJNGa0Ibh*5#v%#yjVJI~2I&BtOnq?XBR&G7Z%(dw)BUVg(`PMGXxIvws9f4}%mskUglb=``$6Az2dDkh*J$k;U(~*k1j`Ftstf3nETlNb zg;Y1RAT4YWju>;;l8*#lNt*o+rHlsthkZ0zjPJWQgOfXBnS}Tj>^em1=C;(-z?k&_ z;B`c9z=!UnJG|%(M&I_{@7K3jL_*F36wB%8&d3eg-PwLP=5<888AJ8k4EWt6h)@mu z5Bo^q=a{QlB$)=BPDR0#+0_p3Q9ZkI9pC&kn0Es(stI~Uf`z)~;^9y^;i4!eZWcyK z*<7F-7<%R@#YJ_%l~3Sh27Fa-GoG|xza91t2EB{XY4@b3JANYZI&6Q?)UzE-CldP{$Za_$2h+^>z^)Vo9$;0WSa%X zX@Gwmw)x+jahlm>b$j!ZVg3hxZ1!Vwq9QAb7#Gu+@LvPl0jYM_z39H`4tt&21w-UU z#Ml#Q@V_zUB)!4)1g=}=VprAlEIoWRI`0mL-<=H(_v>4i$(VQ|fQuNe3x3WK_6Vqy z19ec;I8C44-JyIHy>qNp(`D)^-xlFKH0A61!DCpPuyYe;_Z2-)^4EJ>cU`-LH5r<(tbNQ1`Bn`(a9V_J4F|M zD?o_$Y0?BfJv;1;&d&xHk0Eb?5%Y8kalAsOWrU;6R0G{%C)@h-v@4 zfTs$`@fd8WAag)e`TaKZ*)M@-`p2E4Fpz_$-4f~=k4`-$T{9gF@YKtVh<#eW#;8c8 zyMy`y!cGc&DW#tYxkhsuCc?T_n{xt)l5s#iIXTqj<@8YcGeGRUmZh%KV3FF>S)V+b zz%t`Sda-pgw`{IF^7~j8}3uLs^OmC+FCpH0o;(=|vc*CS6ru(*P`Xhmxo@9SZ2mU}5V zytysT5k^;V!`JjH7ai{U`nmx}(-0TVW8ox7Na&HKPk9vJMRRa*)O^$ZM_(OwfyL_| zIQ0K9BqC7<=5rPk_`>mdg=tskBGZF$asF8iMEKE~))qFWm4d$G+A+)7L(mp{fy=w*E1 zg9vVbJdm2p{Cq2$i}10ebIzD+5Do`yNOJE zLtx5Ue*{0qMopJGQY@SW!^_I4aEdGpK}vf(D{IFn0tQmM;%Dq z+0XCEDV&|Jt8lQexao$n`Y zs_9p(s|V^c>DDfE3rtWwADbxkcj?pw+_q)E3NK6HuDy&oHY0?wxLRyUMlx*^{fa!bM706`Iq41XB z;d=GL3F!a%obSUvch3OOXzelDu4Iw zJL^p22JQvAQj-!;KbyiVOK;?%erl^RKvh zo30lYz%N{qM_uVRq4u08W`5#{zVCF9^M(ZTQDJRWF(BuOsXif)!IwK7^n-quMe#Fl z6>!T{PD5&1)>z#}H_Kg7#gQN;N8>6(M7MSKA6Zbz}ja`fXYj4}f z=zf1&NB-L>+W&TTzI^r<|Nj&psWyO%?<((c{a0TytrP{d;`iA7qAvFf-OS@Qiu%Jh zihAWnQD0}LsF$`16>H=y!oMaY-8TxvRGUm@JNq5|nlM2=z1Ls%S!?~z=~OwPyWERu zBp#>+u3Z0nyRDtwy`uf6wfC3&_enl0jPvQJ+upE$q#jtBX8+0}qv{N4@L8Je>NALv zHO73V)7_z?0PDc*N5|dQqxbucj!*bSS>j83~F^&0*;csm&MPA^99dV^vA>~z20&fa}D=$@bV2BYD@pnrZbx_E!y8x77+ z4tuZm9rf2)TJG@d;M?9{bZ~ZZem3mwJLoeujK{dc|5x4rkHcirQ+62}oI zA*X^~K@N=3jQTzaMz{txd!N?g#7kl-(u>`zYpYNhmG#pY6E+d@VAN&O z!?Z5=OH#kG$#1&vx^K=-dRh1I6@J6!WI1?q2O9<|t(TLxE1SyIQ$sa6KO0`W9`uI$ zPA1;3u6#J?zv~Uk&H6FDBJt|F_AsUulO;o$)f)B&aIdmlm6KQ{W?WT2y=z{oZw|he z)4F%u9bWVghQ03K;7tyH9p8`>9DB2+ohZ~V_M`x0Rd@1`N`1;h%6Dufq=VzPa<0P_ z^(D}B;(xeLw@xol`v=|O#ZmuwX-7lqVJ?nnuuflX3=M~Q-y7z5$)WPKQ5j4_q_y@e zm4@1S8fd6Pa3~)&6@mnd88~l+R7k9{B!wz;XX>CtLk_nmb;2CMkV~zPoc!8Qh+1yk z_XFymuLeV-+;B*`!5uWUk4elWDx=~1;YIIc^uBu{7ZNaj5IUVgxipT6BiVK1(s0|X zgcTynQ7pNtRR45%(LFxy4Rn*4jUa1Pqx?ExV;snt!37S5_DiE78Yf&u?GD(Ks(6_| z65yi4i|*-R_xS8ok{RON1}xMB%}VJR45Zw5B*BU$471vI40FmM*VEC-w^Z=o?KIp5 zS0yrDm-2J-&B+(YO|5+=_p?ycOoV;Me6w&e;77;ZSH0tX=Ui-L#GGW4x&9@WI*XMYn${_dv5}R(07bMpks&Di-Iu zKIk3xbB)Esr`(n>FJr&P%HuabUSbI=IbZnIgNQEZ$vg~5#gR_(K3z*-d!~S4& ze0I>4W3cbo_qEZXsjWIF`A|ibZ28J2M?Q`35yIYdd#6%tF34gt+*7)bW8>I8JRDt| znZ+t68G(z@SkpO#ZxUS`sM|7v$){-$GqdaH4dLIiz7#=c9hqTO>RtD^f2i2|uvEOB zY6@0=PkO^)_jR`94YS*KE@mXNZ9|k0la&LbdVb-ijN}PoaT=ga=jSZ;&tvll3px(S zQZPS;TUM!*OLf-2%@6W^a|nCGKXlaiISB>dP|xf~uKnW#i2IT=?3^3SGJwkA+(4Rza+GDcH9-p$M>szj9rj*j0HxkAI_w>F-yUD= z7vuQnd6TJYCQY_)W#Ht3+joj1J7XreKEw}&wT?p{QNi<}4Dt=>0a)J7#UdieC!9(h zu(DCZNAiGSi7$m}9Rg%$7_+=OWoVFBOHAIFTrjKhNH|5VW*}^BTS=Fhhl3Q#+d-gn z&=lY4h7Im64x{wwz!5vDeAS&}lYb^v@-48T5w3 zmz@{qXM>BE%~BX;`}6#H8KZ2gT_2Tuv6xexN-9wYM%3AGq2YU+BfPMtiyCl+M+ER?Nm9 z>-Kc)4F+d}QT3kG4^>>GswI|_ld~%I6}C53XCn(SNh{Zw+Ls|q=nXBLqmKD2d zPB_O?0x|5y1SylQloa>{VdY!9j(1V+l!l&2&9Ip+bSrzhH$gFftCboi?2s&t>Z z+%}+8Hk~c=s`kqaVrliY4Da`$W38(ybjk~RY4x?N_Z3TgDZtV?-!KU!Q&SA2!J#b7 zPa$J`v@HOFKz+Za_WaS-icM~XM~2K&a&?ahny@7FjghEe>d{xBCp6|NYAd82i&e}i zb7a;m+GjQCs}MU;D5S@0l7v;|iu5g?+*Q!F63|lqnc1KvpZvy(VyvzPz;0lU9--T$xUe*M#J``ME_BkJUZ zoUDQoaPsKt>1|BG>HIbaEi{yb%WRAW?usK2GvRS)j%n(*dDHV<767M#20C=L$#?q$ zgk_udgkcIgtoV>fpUgSbtd23psm2VjH7kNgz}7W6_|U^h#pLL zv=tIhicXRVguw#BY^uy}E`+e;$Rh z4r^4(fH(-)HAnSZTj9IYxnEPsr?99I7`H=@RIlz7_?pZ6F1N^2hlmu8waU|%#Z_+J z0vO#-34j25ar;!a|fp(-`~2aGSU1 zuLs>jnDxr>E4W!DXKpfGle<+q)6jbK+er~vn4{niF|m$&PErYw7 z(vxc`Mea(xVbD8DXa1aWuQ3VOlyWu^F#X4v&zgcpBaa0v<|7>XBee?&lke6$2nde% zogc{$D!(g2-m4%X@MQO^=X=keeQll(h<}&_0laEI-))=c?}=pd=JBpo{8db+Gm*h+ zfBj|J2n&2wWnScYqkv7PBz{fA3G>MSU*}euS_~)P4Nz}8dDCKDKDP~u{nMkfy!pz+ z1ITJx#;C*ItGBPK%YV)t~J)dfr0TEIT)nd0c-4#b!J*^mM7SkyWabWf)r*2twRS{_BV20!U z`WDE8PW`q}t<&nXAqxz?zC@e1iWo?+B#KD9Rc~!0opizi8xu~%*(7VY1hjqUZ~5|ByrG(;?k zVGT6UcLe!N^7)uxon{0g=QRpMhcw<7G4}Fw&-l*g?rw`K_9N#+yHnrEX2f09YQ31n z1p7eM%lt9?*$}W?KCO4>(icLjXhhNWvKLB#Kxph`+CrKLcRbHCGv{ z#JO_Sw$UYCpT0FKxLzu@T{+$8oN$5XQI7l|J~{PU1@bNv4_6$B*0&Vy3Hrz9M;D)8 zG(O)w{r@tKKvZh=HR`omEvufE!*U~FYYZ@dwVSIFnRt^&Gz>}HRDG4dwiLjuhq}nV z)BOF%A6@t-8~W=R4G79IDEll!hsB6WX7Mv8zoHiU^5?2jD0gmqs~hXoX^!D#rAUaJ zA6xBK{v8hpiBQ{WASC4<7G?O1T@O`Tx#8SELxE$JnL@wMItTPYf42&ss8mfM6A<)~ z3XaZW23a-whiL1(f4H4hAD;J5N9X;+{rYDXh;L~SD0`u5&RC8(orXAgq66VcjmKmG zBsYe=%8!U~gq%wW#r+!9O(TvWdwcI^^mlu4fSMx(c+@IUMX;!fDtdSHyd;jLp2_#? zTMe_v5pQ+9ORKka2=VmcT`FjR73y=_Z_Wgu`# zVi^$k$Z0wmsMDh&tOt=j-Ql*8{n!$d@-O5t=`qSZ*OE;EN-6-Ny4|gR{EhlP=5)AodoJ>>k;es8}V5weNzisE1arRo^cuL?3%znk{8uSkP138*!r#3t7 zA8BnUAc%6=xd?Mk{3i&HSu85nZPv`gtv%3MrX!4r+^6D15(iz8c+5CKbLJ~=F8D&Z zq7Gs)3fMJ?D-m<*x9@s`S7*cCNb825?W6Q$3H^lr{`aM&M4XU&iU0=Hz17Xj!b+9{ z)my^*{rAF~VgLB}eKnK{x)o?wpWPs$U>X9PwOPLT3M`V6@snP&rdx7G-% z<^)T;8L~#dQi7JmtR8wT{7}&Re5vYKFTL5E`RLix*7^-twU613Sya= zK`x{Ge6}0ND?ZbLh@;27w9HO>-vMJ%L!QmRW#YY4$&9LYeB{*s&srP%n!V2&OL>l& zt`+@1luN)CI_zb#pIw@WHT|=?oUfdE}Q)C(*Ir@v;0z8-ltrPU^aB_ZGuSny&Edf$8H3mOTg`7 zo7XrFAJyD<-NEVoT>^FSG2l+d;t^{gH^~l&ctI zD_(sVVL1^4;-d;FmxfUy_RIE2m!KbEa_!2=2Bq$P)U(Zk&WU&(6B0fS^v*q?)v4a& zVDGMiZOIuU?EA+wB;%OiOH?-AO5(e&`(s$zr_}^W^_A6gM4>%aCyr_j7sZQ^9k75U zu`W=#steOa!n@m8^Mm>)=Vyb9?&$?uw@UriAXPOdb^B)4u2p#5mLKt1+J5!G^}_t= z#Ky(h;Th;-2&?e}y~x9Xmq3)7fP_;qL;fPfb1HX&1>#H@#yFTIWpNVvQsulvIG~qg z#Q@&Bq962Gr^Bl!s21t>>pSTqYpYtxo9epmk~0RlcMq;V*Jwt9h@*s~m?$sQ^q}jS zZ2Bl<@f-*{qkfuSR;v9{=W1A5NcIhVN7T(mPOeA{5dgsFkE81u^=8Nm5;$~J?tm(1 zD0uNOaHxSnTt zX2}il(6g5Xi>+z)m`!QaPjXetpZQ>L#31 zmzACEV)2|2U{bCAZ@|AlAlH|L6ljCS{L-f}awC+!kWYUs)ZNm3mZEL{^fl_B12``Z z8D!*_Y%9XCTwj^f_f`sVTMnMR5@D$2;B`=n^z)P=XxnPNY$DlshC+6YB1S{Oi;LGP zXNFd{U_*!roIQG3_V^^EHw`YZcS&wkdVFvzN?qlf?WcRs_S(%vt_@d$c5&#tf)H0Q z*YwQ|*p$l$T=*;zPz1||u0+A5p(|#@<#J;Gd$kx)le8p(J z0%K^p#xf3+VO>6?ni6py(@>8Ba)M#Gm>7CMKwXSA1~zydm@3Y z8jS5a8i}4;;NX+m=3&Fo_WP-v@NhV&@;oLXxrx+1VgvzwTBs&^uJQCFdL3`eLT9hk zRIcw>-CcM7*DHeLl~;pfmP1iO3Q^rISRBfc;?oC;`yR8L-Orlk-yDsM3;Ub1liqsP zWXnoaacoh72{9-FHf`#?pb@ZX)}3@qT2a#}*`>3MFlP*}#Qwv~-jA?r=UBILu~xE= z_7ReM%qE16Qh7%s8d+IK&Dm35AWyP=sX63gYGe+zaPA~XJf|TsSvCv)T~Zwd*cu%p zqOlNJ!;$T#W^>agfE6-PVeBitw>`68!O=z%s!NAcB2>5*n6m18BeVABJ+}*GAM3gO z*$U5XF!?zk+N55~;FSUGzQ^<64dlgdpy4Hr;I@Dym7!1?ge1R8EN6it(6&VLLy zVYjEDl$c+>%rPKKr$8I%5YDvC1!zeP94-W0nsCt^0uvM`95c!{~OV(2UU8wQ4! zG!0sv!t4DdAM^g3Bh;(v$(r>uFolS&sQl@`l$tSpe4DGK?^9ORQvJ?12!Awrdf`=t z+47sCUU;=%R|x@0cx4>4{wW8gQk2X@wMv0z#p>>bR}YdAvTYO#^x_5ToxU3lFS>(^ z+(jbzXC?ht4&KU|D_TU_Ws!tJ`8b;%mKNn@PJ)N>cbP-Z=Kkgi-yTKNHEZvf+Bpy_ zgvzUuHg#22qs*s@(KtVbpS!!-=h*;uKvyqHo;epw*`4Plu@n3LF`EvUP)slrS_<=4 z9Y!NZT|-0l+oQLq2dCYW-Vd#x?rce7jzb@Vg#qmDyf9&ZRKfDtJc@n|lg+uy+2j@WE|W;No5%anEe`2# zwD_TJR@_geHP!X~ zLVYP}+Ge_J%^sM8fi1l;9G|@&oLzJ;dIx8xM^M4EYw?YGI#o0Ek#bJMDZ5Oc=$_OI zBai_p&WZF*$ON5`c_cFMEbygzTFMQ(&-(kw)B>~h7FSsuBczjr^M zyPs$A&E%+|`fWCNcNSAEQ)L_FI51q($ml8MM5LZ5eYm*vZC=d`v+MI$iy@wqx4hB` zTuGhsWfhlIe%A21f4E=YqCRqyqNrgNI>mEhiiO)1qDDOjQ7-U$hJjHh>II0UVylAF zEeOy1$P~B6v}DLiY@)E+9mFjBhK-L{d~6oc_^bS#r$=~&~QeOSk}c*EwETd}oG@08vt z3Z7lVjg$IriLZP|Qq3me1nxxW%SCj8BE~rdWw0+yyskNmrIO`INm0zOGX1fT7%Sk} zuq-JkI;)Jg`%c~JPZLK`Q_N`WyAh7XqM4S?zBv{1SRd0AU{?#zB?JnP?-}j1^s@0@ zK9S0Uj;btt-rV0W^(Dt?T$d}pYm-hY%|v)rBvZv5v;p_I#*7zyLV-b`x;;B8C7WB_ zMOgOv;yxp)w_s^%sCBhszsu3$Il8M_n*%auS0o?dMQZ5T_5%fs5G?nC+-#CUwvD8- z%p-P?gchD4m?13C&TeOK56xH-mqg*1h5b;F_zDO6&fXr{*+pN#e|2wOEv;q2=}(w1 zxpMWMP(-Ci6W}VqwUt7u%L*j>rwlQ_RwrpPL=lrmVA#en%;QVr@6K ztt@TzVU4WVfi^af(Xxm&Tcq5E4No=&k1!2nF^`2RU^zDy6ghsTG6lo1Iqe;rkR{+U zz~*4P;yS|8#s)gaF`g4a;tW>3-2n#;6X__#^VAAd-^st5vFzO;iAd;k#6mQMtP33! z8hvwP1HFx;6vZpw4PeRg4m#~-q%kYoUWyOfnIF9SfoM~C_*J(`tgv_X^G99{)Xk9* zn0LAuCMuRLbTYMp>W<#a)mLucJIgyDOFXUv5WRZ>^7BXP$5M6w)v*(>syJW z@3y-Af#Yi$-eXrkwva5UNi%G&#*i?ZhJFL(f&k5N2uGdk*{Uo0n<$Apm6&qFrCvU4 zq;#D>WN@Z2OCqTs+&=BN8oT1+oa zb&bnUPqN5Fz--Z5RUwbZPZc7%j%yUhEKb8WSS~VUj+~Bt?p=m$8ZuD@t4^m?HeiPQz@$x9M8I4LT*hDpIWiMb?-I*ClnsiTcUD&>J(gHonZRF>Z~c^z9gtKZth zx?3t}Ep0;f=@T`h4xB$(Q_a+#_R-q>cq413l7l`GL2}d9QRD>@7DM@rI?oX|_{#n@H!J|GV`0||5uy7jy6@sT_<(A(G zEyja-CF_7YV;WWk{a`_|Ls^+m(FGOd1%s+)&SR-dkq|;7g`Q4Y6syDMg^pAyXqb?S z=q^a7dqOTp-i%SNA~;F;)??1?<%87VQsu{))E*(+X~3sUAUcl%NFqd3EI(DXvA(>v zo@Fd={VG|NqBW%PA3~vv?^+ulgn7HW+W@bvU` z|MYwHsNH&MJ$gMjdwag$ZhZ;QOtp5arS@Kx88Zj!r1}AwS1HQFvXws<7OMBb}QP;i!TcANmg+`^9y5Mn94DXOM zcSDa76NyOfv&DM=T_dCVX7^qZoW!InON;V|V^iit2?7pZF^4|I*aG7iG;RfAED2aL zRflIW!J2TM0l|3_vQTe6ho`&*!7hS|gWw66CCJfytZmY|cJ#m~6>3#njMCgu5zt~6 zQ~wf%RDgs>XE^>n&HRukS^Nu8m7;s*l^+mn&leeqIz8!+0AD8BV_$&ALQ~1v=aIA0 zbPdlWK0S&044y&yld&%P2zy=dB_Ts(L1)hM-6j__HGYV4DVE(d850AW{E0@ev201m zCOIO!94Oxgwt^HiyMTQD*rvyj*8zc>`Ip#ha_VL?bE>sGu32m&o4Zj$RhAGmws5RI z86Gro4BSMDbOl-jCtKgdzl0nsQsy0Tt(#>oPBf_UlmQ5>*amh@Uy>iR*ll>7CGHuq z1FS7E2Pjoqg_?fIEVK5-FHogn+T@?s^*pfl(w3w`A7z1x@hw6^8=O3PY?HNYFSQQJ z$dsWQw<@5e&N4vpHVUt6WvI?$-Q~iBT6kzH<=w(#I>^{P6ZU%bghaxt_*JAJ+KJDx zmi9sbi05_}{Caq@-~V+8{+E5T$1Tjcdkvx(hIG@!tJL-tv@<*=gK9+imV_Kl@&7oWhK~ z@O-}8LjV_MtbkkXcJuzb5 zWK#>-NKv&QAf=qDhw)QfX(oyg+PHQMQV$YZC`x$l_l?zgYrZd)hZ4A)v)-Zt>*XA- zvmb}4u%OCSdAo{iD0EO+QTS?2?6{EGkq_{>SW-m5&Xz)}dtprue{Jk3Y_0rAO$}#< z8^`-@=HhG?`n!DWRU`qxs?JNilxfE~$06I`Jc_auC%VSf1z|QOPNl0TxllH0wh;N) znD~f01=@8(al(QTp_z)rUxp4xJan2Ri*dF{paV3EiYwju)R>+u4$U2^EQ-f8AZw!y zN`H)Tf>7(+$zYldpzHmLbhlHO(3;jpoyhZ(vn)Ep zs*|C@6+*CsU)5@?iR=`y_mb=j!kjjh2AkX=n{%mAH$f9PBWY-42yOIDGtQ?Z_uc?_ z%JSO`e?oH^!!*N>2srd5*ii#-jY%8`&~z~#L+C-T1xAp>$0pGATCJAKPGdKdhY?1x zCD@(QC;z-t#r?A*iLJsRx*t>TVl@f3t(lu*y0)?9 z0feSftb|j3~CxdOskuuaDaoXTE29U*dabX_j;xA0dDmsvZ)yA2F8938^An zLRcIm(zqo98vHQd*tZpBB$KPXBHyu~3F3gYavr}y&d$)G(rIj=-$C?l2yWrdK zsW{DD@U8n4N5&+(;M+GeZf+NR`^r(LpeC^=G`>T&J=Hlx6QL?gwBPRyvHK2(h{s73 z!=%ze>3}(LEG>?s1r7kn`DKn%s=1f2E|=UJnFQh5FJ$X;*Q<=F6vsdiK2^G^L%0b9 z(cbvz_Ki?&bay5%sq#B|CF0{=sYJq-CVgq=$?{{f{Yn^_@QTGKw_gc*T2J3<= zm(f26aR!VI*bOK64QUJtjqS`eeiql@pF6-ov^c|6je&zFc$Swq*5T`Z_aurkqd9_B z5m_<1ErN#ZG@dJ;;=ySE^DSz!R6SFZMG#;wrFt&1do_wnaZ*4jKr-*)&_VHU7#H>Q z$;V++D;|iWn-8NK7f2(=mIa5Yxz+_Z>{nz-cnqF#V!UO+%z!O7Nu~YdK{g8ME{b#( zw}Mp!`T6G+WZA|yC4WowcP=c{%@0|rmQEOn2M8??YYdhFes~#OK#%PA?;3OjA@H7= z+4LJ`Vk`Go;&|+RdzQg@j5R*dWaMyo7t!?0N3mXe5o!~OOv@-%~$b|J?iel#GzNf$5jS==x6)X`6Q46r#DU(ZbfpX8JEQ~b6O zTwx}pN)Mtr^uP`c9-3f_yai68EA%H$xO(L#VcG%;U}I#Pbu^^kokLP%lH9)LljWgG zICc$92l(Uk2PI!khG~jUof{E5x_OJ@+XA3ZjGuSp zU^?7i?$U$laDS=OLXcPzxIBy|*^wV!bVF~CpLu3G+qRXK?-|m&FO7~)IhLxFC%tNV^L!3^c1uCmQo`q?`-J1d#aF7D4Ycw$R3b z#->3%ysO!k#m~KYSnSOl_Y}E>WG1Eu%sX~NjK*3j_1=l^%1C@;I1Ik$%?&!dHLwf@ zF-szZO|N}Fp_u^8#G_6h99qFhn4hgI#zShjWN}M8q>m)oK_?>ngybJoF)!E9gh*to za%R)Fa0rN^YTb+OV-Dd%!<$65SigDKVEtsBhG+5Cl^VerNYahR>1l9V+UIRw=%a}yrP zWE3~P?stWJ7<`Ld5aNvg=VG(RcbWdapU{j$b@m(}9O5{HY{#_kd;(Wv z&$)q(=Yyi_JpjkRtO2!q51TWp-7nax9REZd;Q8uYctZI*%5Ak~K^rJSzaK^9F{E-P z&D?ZG9%9O^mW~)GsenwfPUC;&ecfp!8J^EJ+q~sGT0fHnT4KhmpN+g?pxq(~$n2!7 zMR%YW2Pi*vP?yO;4b6&+ADzwI^w`bDGxfbs(GjomBu!1dE%v7_3Ho$3oPu|R>72&S zdxyP9d+#)!z1Lz_1hs)?i`n5l5aXL-T__4Wf)#+zOqv?Iioz~s@uqbph&BMW7AZ~C zk2cJZzGqt`!DE2)N~CdwG%~(U?s$fCl;a0wcI6M8v1EhFx^xP>r>#~(p!NcL% zQGc&{^twMB5j&OCyg;1TX1U)iYN8*VO<{JJ9-#%FMQOGgzlbPw^mjAD7B|Eb*ECPc zR;O-)A4$Dy2#r5Tt9S+R6^#eofah&Ctd4s8^;~>nYFDC?`*0!_r?8nx2YrC~0I0OX@6mTpBulVuOQOP5vgwNl|D!p{R z{?!ixrnX@fY!)RM-k?Yz>DD4`f~rJQ#d7^Hb_WzHlDP|4d65Un{YfUr@lYQ*^7+&-FMO_FJ)pFbrfMvP56-^ zZBc0Qh1fQv(F#OZ)2uSAoibQKby!UUFeR5);q#li+sE@4|L?~ieqy^vmiY7L)y&Tz z4mxa3l4#y^@$S%6Jh;e~iGdpgAb>6|6M@4e64%G>1KdBogUX-ybA#G_=_*wQSSm4& zMUFif&)mcvqr;XrC;e|P-DHFO^X<3qzInHc+wXq(@MP&M4Y2vFssjI(jPNN-|NM&7#P7$)3O|yf*uo$k!a0>0WU{(u%3c`{la};nFNGc3XOJVb>Sx z=66e>hxGoOXiN9wEfSvKzOni?Gn;s3a-in_cWxw(tdPC zcN)TMrln-{xD9KWr1=G!o@5n{qtN5uYk`&2u#OU%Vy&&ER$E}_jZzW4?qZ5Sa^E7Y z!U#TLvO8(xmZP&obmKEy%HN2SlD-mrDB8+CJPM+FH+PK+c<7$dvxy&iZ~q}Nz(%R- z3v3%n>uIBJ}krBV|C${qTyg~gM>UwMd%ck}Y-`C(LJrw%V z0Zr^j6-rXk99W+A^x)=WhbGIa3gWRcGu-p$v|AD{Mz zJtKPRcg48Ltxbs0S_Hr1a!}mvp7|*_52En}a3>jl*b&f7upUm7kwBga!)w)=+i-7i zcxtA+@>TK7q{dc?%Lf&S0AF11`$)Mx*E7{09iF`T?QH*WI2s(je1p@<%38(-ICd`} zzzKEPdz2^y7%FeX&lb>3A7h<^U4$vGqXe)AXfucw8MvCc8G#2p0ZkSq5-B~$ZU%62 zw|OSp(!m6ve|h#xZ_sgmv{ruW55Z3YQe^y(2nB~>^^-&JOrSS&GmdN}+{o}h z6%GGm$?!kkdHBNFzbG00#hr(LVHv)Z%k#fB>9t7b$IW`IxB^uQ(emKA?}im|*e8wa zkFq#lgxR9vC~rt(aTK{|oh{Zd;;#Ur2}=ouGuQJf{k9h)^y|Zk{F>C~Wv)o!HqZnI z-BI^Q=|eJ$6173E3G#^oK1lyzt`~Yr+V1)18@~FUMfO7v! z(4sBpF))YWr5pGj=GQSV14dT01&&EwYpwF2rh+K5A}JE2Y4N8%;>W51i$6T$$rh-g z8%B=3^cqX6DZX!wnE#It^dV0(@=n9z1CuRQmQDK7mb}`ii_srdPcIMfPfoj}IwJ?pFgO&h}3P2h{)1e$}o`#@=r`da}jbLA%< zATDisRC5oaQrGx2O0#KFE~-@Ia3)(q`#f<-lmItP{b^`S^kR}iQ9_t3@piN%(m#&Q z_Pe9**`VJa-Ce{?Idf8O8Dg?AQs9hFtCTro?pV_djF}A#L!9D7jv3Ymjc`6t+*<%A zxP~6DgO+obn8w5ir0uzxE8O2G*#`@%p*4Bd?44KdA+|M1lZi6yV?myzzpKfUiCjdY1Yo<;U-y1!xaa47cKnYo zN2quq-v>TAC?W2CdT98sbb#nkYM&tnM2e3Q6XxRQ!eOF(RPj79O^O~V62M*c1G^Z2 zuIC{RWUn7wS~ViO0X{C1cIkW2V;}l3l_JOc34H>=Xm1ETX7EVr5G~g{{gwvSstM=w zaY-I^HTAp)NzpYHf80@TWf|KeR(8W17XD6s$Zi4woX6Qs&W0>zRlwRIHKz0rJ00M# zB!!BjRE2}*=O}R4ht=UwLO2o}{-Fg92SyTS{IhW@PGtE$ebTt)gj}|sG#tR2P}oul zA{^i%2yWwlK{JG48wlANA#mP@%0S{M`B$u<-CzEqkIDxTpZR<$pTMUYBY&FyY?!Yu zC_|X#vJr*Bjac_Mh1sKgUtrQe${r`aXGoZO4`T6^>8msSZY>@sHLWc!0EgF5Qj;)o~Mfnxf-F>-b6v6b*+*cnibFW zJc3eV2mOh&1Ag~HUg)u#@hd0{l4lca9ss8yAmV`L)khrwn#XyD(yCu0-2H z8wkm%>V_VF>g;+R^b9C+ZWFP=JSCv5XcT#Jd%C{T6osV(<}_FK1c)w847f$|?8Hb* z&0zAFDqDy(-4M7*;@*I*XQ4-0AU&2PwAo?Z(1*Yw;Iatk<6?ORrH;Ts>M8-5MeM<( zAGW|LiOr1NGzBhuK8bISp*vAt7geb44)F0)&8Cshefb#OcG5t}I(&mx}{cv2Ywhv6f! zO)q%Bsf8bKQvwTT)^x{X7-vrnOPw+Z&l4SjpOR8CaN;fk1`upz5gMD>LO5P8_2+SL z1LB0#5blMDpA|L&n^Ty*Nnx@_;5gj`f}3aoCJ^F`3c+H0ar3|6bP-;BgZV22Z@~%r z%^~?*r2e7?L5%iA0*|6;A1CD%R>SqqGJg)EMb>HDihu4lw_88x(Txar#|d52+hDZ2 zczzlO?v2jDl;FB{LJ4?AVGBw-B3{ZqmyhX1nE8P&c@5Io;lHJhR%VGj#&dpV|4Lt` z0faGVh=c$exZny5(?x=_f|IxsY{=kIslLQgg~;_e5hT#WCZ9qguetOSPLQ*Q>_*+5mHuxCV?Lpeu4~KH=Ctwn%y`ig-P<+(Z^2v zhl5UI%kvZbxTvxHSZ(mSf86Uhjjb`77;oq_ZgIk>VgJowk2pRaMw7SbvW7bA09fOPkLB9iEbGjLv_2nof+pI3pjAqj?;$wC1mSN5}N@84PH`rNJrt zEQ#qy`@NU+Bl3nq@RN|d>O)c&$dcjTl--{{KckDQRzD>QiS*upW>iLJJRX!Pl7?sJ zQf4;G%Qayv#w6lk`1mS%*-cQ8xYJkyi#DX~o`RStB~r?0T3ZtPW^e&Y(e0N-ENYG> z1H>tCEU!j4z>ti`Ie7+yn5E|NLqB^>{x+&8H)#gvZ{2x78g-n;E#<*wTm7vtGVA~Z(6e2R8Q_@0xT5BM4ebJV$o#YqV#;twz)U=ILnB^3Z$9Ib1XysfOL2hxQU%E$c#O0-2`5!T1LtrOC4y{9 za87!^lB+bVb2ql6N;{7Dtpglo0Ozq|U<(@EDD}@Dx7tu|gZ=2_I1Tv56>nx}VW+F{twzo*LXuj`e z?!KSk6pe+b^pExh(pO(0oCMSDlK5{VWmp&>7aj%3`PnD7biesy{xxVnrK>> zf6(vegH_^wagsXsi{BFNmqt+8e{ERRmB~V^exFO8({xn47yTQ3oRF=Nwr%S%e;3T|J?kY1Ova_jw{U`Uy^@mL*{G z-R>feVY2&S6a5}USLAo0GR0$^4|5>jbb#X~nLlx{#L(p4N&_*wkGaKl;@;S*2Id=q zM&b&zVuv~PxpFrV-XPtSyuD=L+!S;Nqr-#l-l#u#3!(&wNkxo;e3xVQZwEMPs3VfY z=6%{DS>T+y4KFqpx3ykZOF%Za#;UBK(3%Y2Sld}qg? z(bbuYx+Zs_ixrlIF6V9-!ep4aNd}yKn89%dJ&_pNI8U+T)OYa}!CXJEtzi^YA>ZoT@VNC>W zqr>&t{|;}&5F;WH5=x2+Y-Csa7$p9s6rw>}rBrv)#TackW>*Cvp};&vB&(Z};8|2ECIJD+jdH2j*6&cAycvNBdX|YGhm}94g9)f@cWpv1Kf!7o)is z*}S_C%b|8kLj@8%DrfT?4#C@RmUdwCDCSSy0t=Xp70A>X}TK3Lbitmkh{1zZ6wC z{@v9KQRDDn*xBrC(txW3TtMcWAjx9z>@MI9j`!ewmDsR%@4z>CyUzay-fy&?pv7R} zDC7&_gZ%bK0(1e<#I|UCCf?KNam>f-D7%hT^e^+{gdy_u z!{)cmR-a>jdv3jOc$31U8+xyjXb~SI(foitcgklxk1pXbnq)_Qc+m~LJt?h(cHGM=89`eW~d|fYbis-3i(NXdO!))9ZhA3IvZ>lXCI~qmY*+U3|JU%7y zEZ;S5RV=Ns6jXGeaevw87b*r};T=rJ8IPgR4m8u|t3+4i_eNs{H_*7{zu!mXpuBaV zg~^A@Tg@*#KLO2H`Cd7XK7BIIwe|sWw|EL$WWxF)8mP?hr@k-U6ng#eFibNy2#8&# zQc(_?ws)=0cAx*)6SC9Er`fJ{mZ^-R#c>M{n?umZ*LXi z4UCO_n#qwR`5|BL`)W`)y(n3n4g)}A-O=I6D=_H&BJ-B?ATR4tHTk^z0?QE<+zdxIWe5g5<>OX%I-C|6N(aevThk^5Tk4coC2 zx>LR**W<~8NXdH4(2i-c(5e|R_1POe|Gy7g7iQzCw(cF-N)zw_!3^B0}~SZq;w zQld}2>^emcS@%OcATz^Pk6kyJj+)JuTbo7xMQUiOoDoFRy(qpJVrRVZ@f*F}(PSiZ2nE-7BD>ygVC6@eO`R4Z|!Y;e_-}Vio}p zrkNk+akr@P-rO@12zN4;jmB>^jd4|x2aR=Ng_sN=m)1h|!yFeiRBFD4{ztJwCGQb~ zCQ+jaf=j3U1pP&jS~_h+CH3kK$*29IQRf$N1)L!PGFb!xB5dpny0uE_cN{I2nv3G~ z!4b>+;x$?UMv+~R#&GOU{IQv2@kAuq!xM~Ma8;&GS%)H0#BP?sBt-g5T7?{+fq`)C zHh@b3;d%ianJ3jqQ?YLml_pXYtwfz<@>RejdgVs9bfj~*{DB|cY5<`?Ucc!h2ZRPo zrGS3#hkK+4uC9AOyRK%IlY;Exz^S;pw7PFWRd#krST+#sPK~_6!sx=?H>VkAXJt)_ z6+T=Z*M6X(uh)2>Sr4xHC5=llQlyrIR1Zv$1O?4hl#?o4T}ipfr3lly`UuiGr8o1y z4=*Tf^UMhNYx?Cn7m7d}F3w3Ma!my>shqk8O9I0e&!xz+ZI}Mp z57)ZoTG(yMcwqWWQ=+$&B}-g-p{Fhtc#A$QSyz@mLS;d|a4c-E zQ?Lv092B&%og}Q~mc(y)&&P#(fCygNDoG$B4HK&%X~5)!)HX`=9nNE1LG4n$7W|i6 z^6r!i?BjyBL0ih^VeF*@5*G$z5`Bc{lJ`@RE1CJ0-!b?fSmGw;r>O4yw8u<}h)Ste ztcZ$9R|ujL61mOi`JuLR){ftQVPNi^U&L@prt#TSnD=3Fj`yq_DWh~(0QDN}ud9M0 z34vLe!#7DV#A$QSUPsXd&@%4Wff@q+4K&Bf-gVYmB(}^>?1xCY9}92983VBMyPcoj z&zGCv6V4L9nYMRZPulHG-LnP6@JD(8rZYEzUMq||*z(D}lpmA1YC(o(N^*mV1~aS_;i~o3TzSR z^8KK2D@A`NDaWgtlWeZ1<~igqScEqhd=%Y{k;3e?+rzmXJ)Ac}J~L^?S+y4x&r=>Y zgdNegtGy#X&D1xn{Is>5w94mmH#YdF%F;n#s$kq&*rn_Mhau$9JW|3bKryY7L5npm z&_pdK42?lz0Z6BV{$6i5JUn@o$904L0XQA>PkV#WTX1lABt|0PYScc-swkjgJ%#j; zCtMtc6b{ZG(nk}}kW;1CBropWVyjB&On)`%*MhobSFl$?fYfntgkP-)P@T?>faxmv zyYGb0XuSX;n`ra*!-eVbA#;=qsQl+SlfTxr>fE@?YcXqaU=V6fM5Q z0CP7kUT46P*t1BD#@vm6)|x2tY333h%^_<0RhWSNsD_Z>9FUpWF`hx!D(b7(e8hxk*^dQ{`{qw_t8avALPiHRu;o>T&Co3gqX?P342NT#oSN0wKQD zX~^*sO?4buG{Wvii^p#sEy9erCQALekJQ-_$by$UpVzy_Ed!0_!hGLP^T1nQ$Th6I zFd4w{B1!#ANbbrg7{w7QNuoAs1FSpF9#qH)`a65iVpt)~|HfZfj_awkTd6knlt$4izDm-Elfa)R${)kU| zL=lVPn?ApLy60dhyG+qF5Iw}|mx$BVZ;%DA_>(u-y@-_Ok?SM$#tbJA4crWECOiQ- z;1>_r|CnE|D3?C+D+cjSOJ|uCywx%-v@q~TR(?=AQa`cW+mO&t;19$NM?5yq5ZP$~y>Q3JHMSi^-I=eLpeYdwx@_u5qUYA+b0e)9FmLj(Uz(0mVIb z3%L@K^`cs8qLx!n;%xDVE5}q-oHS_Wdt5~*l<+0vEwBMSMS_%lcSz$Ftxl5l?7d&N z#s}FNi|qN8rC*B$)f4OAN&3Ga5wk{D)RwDL5(Ilp!$j{{ytI%Br*Zqen$CYMqQ|Za zP2!iE?Pd|way|Wbh@s&OW|Ua<9Hw^sdd}iNMXW8xX78wVSqp59^@=oDU95rbY|+G9 zooXFnH!@b?wyBKvq80#x_%1{@c{e!*!$*6ZSDxQgrZPq%F zi5dLxGP;0>D-RYS9;FsHaAinSdAKs9hWf6;D!ScM{cVMT+QocRcs z-`UFVhfEq@;boCkDJ`A5F|O4@3(Kn}$-#FgVp|_3u4f4SrBM|7xH_w0XU#WWH}u%X zs^q$g;v2fdvTPtGfylYQm=s*wAPsQ`k_4Hh$F}zxTU-2~Ii{GI6~||FX2)wG|1F0+ zr~_4rd{Fw-4}jn#$!{m946wo&ycmX9B*R!3!*DQ4B4s!+YU~w-m&iqz$G=mXtKjxp zxz}0KZFTNxsuJWXPqbn@E&Jj8EBL7M*Ew{vp*aAQK-20M+D>6`07rpul_CmsYr9_* zOuB>N3@WhrjF(dn7zIEVpWs<&jB3TwP1o&&Aji=qEL5gedO(Hy6kc_`bW<2g!ES5u zAF(l4a^OCa#f+mU)%xZR24PyXHVe6^$&YQ-LSnX%VkoJR6uO;M>hR(2it0X}ef{NU zj-MX!K_85+!3%4iE+h7e&R9K-lnPdYz#bCo1hivVbO6TrLsqM*j@9%O1wo{xXrIWcp7MPqRZr=2=UCU{{x3aqe!V)A zU0p5vs^9!~=r{6l{>Ra3Drq#>8aC}+lF_8v%MP}CScv>02%PffZ?Kzybs|oK3f&~H zkOLg%L#oi#Ne#q9E}@Npy7tG$TX*nd zS&(CK93zmU1^`X{A=!8?z~YM3R4*zFyt7iUb|7B4U1(lIA!2St^I-$zfzvq+WNqC* zh7u;V2P##$8ec6&Pe}A(e99tf%RqNr6o&4tXFg&$A4mP275ayDOIP-8yYtA+xP zf*KT%MJ%kJ&d~DUf&B;y#mcHBIuS?)x}tNVTG%_Nnt~|LdPReKISY`*x1iECya}sG z1Ka-0ikAp+#YBLbV5l1FSp=?T{&>b>fX}1AACnD|)_}o5z%51TE3)BH6Rb2opykfT zbburNE?et4W>xHT-uliK`ta@X(c#J8S1{5!4qwf4Qzw3qP%f{wQ{`F5Y#Z}eM}Qdx zP3imNcmY6FPXI}Lu@{9Q5pRw&QO6-ODeFuY>hJJIJr-tB znjOX+oU;X)NQ?8pAHPN)o~lpoP*VwlZs@PIGLUF=3}76%V+j7r$i4gYuXyI(`R>!d zvPDC`B3kaE?dY$!WNyn{u(cP><0yrIKeCf;1U570uMOTwF-vh=QJ&yO-=Q0~A}1^@ z8Bh2!IQdNUjS=vqFnC=OGI=T#a+VPek^D(#q8dR!kDMVmbIGWHFr)Y9#8(v03Mg~N z_^dcHfv07Xhg_9BsaAUd})=nVrhXQxposx1H zk*b=V3rUHHvoW2R?&qc1HV{wgRs8bgQkt<}HxrexM-{mZ3aw={7bzo^?gE%pHvcDU zG5w|NQ)tY>%u{&G&yaKq6YewQno`F7!ct60$7bDpbD+|jRasMTJlR_?u_1a2DcqG`(UVgyC zuO8U5GS5%i@7ryQ(awJKVeZM{j`>d_g0;4@LJniQ`!1iXp{ka%Ex}kVb!%D!VQVX@ zu*-RooM#ed%13y3t*)-Z(lkAy1i3AEZ|b5&^B}H>T)jb9?!>zgf}|_llY((N#_$~5 z=%#>F6Vzp;(tCQ=Eit&YkO*?DvhEck#O(*(>YE+Ytt&+U@?T0`a?$hA_K-{8PnEY^ zf>Ec&2H1*3_C7By$zoQAyG~VY|3P$f!BPGFSH1nK-d?1) zf7RK)>g;)*KPjoZa9dSK1^vlif#SaME=Y!@+uEH<`hf>j>?Op_3ck{$NYT%)@;c_* zJs%qlA>&D=Vj&RGUlVW>bn^!Fh&Z3p<5c- z!SGAy`+G~maZpbY5s}>5yJu_^ov6}TXNmYRz90eW9-n4zlH~zg(iX2i9UFBABdLs` zcIyN~uNtg877ZD2N4-&R9}M5@?e&JkgEvPtQFBznu@IE+Bd?Q?ijn4Kn(w-{%3 z7?3CZzDBPLe4!u%@Y3{qiBV- zFElCwcAdCZg#0M{Epe^5NTKiW+RwnYN~8_Y3)4jcQ!s~_OT1KmN_098w>av*I(ylB z-TmdTKRD~|@1Gs_M%|9nI5_IQI-^W15ZzKe*`QaE`1G=;TDk_Gmnp{OiNE^}$YtH1 zINo_{7R{k!@zYdywOG$Ok4>!Ow4*p{|9g@|)3(4u?MpXlBWg+?;%<5*7>nZ8D=4SX z15WzsmdLO zX4RbOg(YjvT>PG}<@pI4!`hG>vZSe%ui0YbEgcb?5s4osr;EZv zrFNS=y!#mJ8e9iLXd0rg=|N}lD~&o&oZ4;S!69%q%x+{moi}JM7U9SOF*#wuB}`Iw z>fn_Y8vR1PGiD3)LwZKjMjhuxYrD0rQh)AVtL=U?wPPhv55xUvd;yb=gOsm>?%t?B zczgCsZ!qNgm)@x(@i(1O-ndlMtM2w>)DT{Y;rHFsQ?iM+TJ07LFHHtR6nJ76+5H8x zvAFjN1&6D+*lphahsWao4o~Y-Pd)f=$EDwb)hGW(o${?yY7`f`qWY=lj zYO+dm+N+{TJ{D$7J`ivvAE>e_f2yC|Q<&{7(kz-&?c5OVSLh{*#QSgQj|0~iYzuMG zjh-S&*L?*uw1H&NI12LTTJ(i{lrYSHn+JRBvs2dGup#=ULrGwrTJCy=*Dv(2XdE5B z{O$PY84h*^&E_?Z3I4|)!#2nC-Dbnz{Lua@1GEV&uV%z7^x%_wbpe_O zPR9Y8w{hZ!8E8CPZjvWu@l9O(b`qqqI~I}|no;$mvn=uF*tM%S5VbU>BN&@m zWF$(ms`7!F-n(o>Np^R+h?1T$9WB?PxmVOFYdl=_KKM-vmE zVcu#_N$b3stoHJfBT@YHQc%6v<=ay*#;GC0C}TcRlFHPOQKA^14J?J2@OT_dcFe!H zS{XOLfFDjGa3kLO7_2pkG9nob7x@yEtHdja9qJQae^;u&Qx>H5`%(#<@r@~lT>8$m znkeK7l_n2dL98njnV{<#OU6;S_bwYaK1tN#>OvB@dhT8WrZ2CNxiw-KLse9QRePGM z^jZh6n}BLWuFdi~RF&_=0oKI%s$!|}e-%}|NDR!Hx2Y1A((pm#!lGB-K|(Z(XpLfG zBauN`tkkR`G`7y`keve91?y2;n5@I7GG!idP12>R?V5B|F}#YT%WP&Cq)To1Akt;A zTJ9iSnti)Q>9Uc?AYE2!R*^1S=XFR|0qlbHs4ZRAVN~fdkGNjx%FQ90comzq7351b z;p_sIw|qzm(=5WfiXsuU1y2AhuhQ@G1K*nLB3!9fM5AMn~u zmr5Od>tfaxL=`p_KMq~IhP{Kt;b8>1V}i!yiw;&(#Gur>NV-Uihj7=)Bd$fhLO71H zd&GEhSd1q;?kxc#L8W7oGj$2b-y1aK8RdC@F z$#}tJd!Eb3--{MuX3QscJq{Kg+=ml)5oGj^Ld#y@cbvu#1sX>O6z`~t6yT*-$E8uN zH!!ux!vt;YTR!N39q=>o!Jj*lEa53G9rV?o{`B~<@*+ZgvIdN?9j4e4r{VJ_K)JXH zk9;+_WQIa427bNPxZUp^bl)6}&bs&w&e>^yFj}(r1NPQ~5o`J31AZZE%bcsweC3fy&yGO1z8SDzW zZS3WYZ!;^57t$k#~5q(Lqcn9D={dcLh}~|cj`YDY==Kt zhf$sO!eIZ;+DY|AidxLh_Oh&>*-qctSsH@IH~2j(S`AU9SNEn{fP@IUyF+6lwkF_#P$9Q7{N+X@hBCuAQp#jWoDHj&H`ioZ5=uQWv zK}BW3PODAb0Oqz-mYD8m_KUuE9Q&*lH>WmjJp?f$?Gy;1_3Jr(xY>gr@QLoN&`rtbnb({_xN z*-ddD+;rOQ>1N&}-}-PvWs6Z;tK`Cc%wno`Rq5Js-f!BteDl4zb54J$x5_BA`{#-E zw)s5GJ>?CrVthDxR)&lLj~EYxvwzzDej88ir|qA1NE!!jQK65iuoyKcTTIvenO$D7 zy=7Cg?23~~&C>LyVl_)srK+e)b{(rgT`JYFEV`1eWSN8KN+XD^~hLvL7<*8r-&)iFNQc1f#+R^z#IzI*7znzLZyWmzjoOJ&ke<7Ru z*PX_+(|q#~JB`KHT2)Tiia259PyyFD+MugM^Vm&TU}#2-Wl1@~EyuVWEPiY?@sreG zJDd4eYkj)Tr>_UyVNVA= z=pA)`>+Pe@_Fi`fhQVozf4u1p-l|Ou3*(L}EQ~?!*RwKK!1~e%h>{Pwd#0u7?%9{7 zySL)fboYvu#(qO#6@Eo@o&vM@n0HEY;Q9v6$2^LN;$|&>d_Q)BO~I?Gwv{V^6_h%&k3_YGg%Lv3YvTHWtkT`_ zw*H|k5~4gR94|UQEIx<)u2u;~GYH;&7#-}#XzVC{iVcuvQGze}GBx=FbjLI0>9a~2 zzRF9Q7TdSw86#txnYj4&kaSfis6`1_`#CmsAl+#rp5%qEHfFg~@tj>Hf zT95H0e{igC)Z~j+eD%z=lIb$>Lk|o_*wpXtxH zp*p2-R%N-*M|hKlR;a~H(X2wKidiY>L~7WZqWM-Gn@edTWWV50K@N>s5+-7?~cQ z!Rn}BJ*f7!Ok7PMjX{RSouHO2UZfh=R*Z${m(T-qQTxqiZl>ogT}_lfzyAB6>aQ{E z)c)$y;t&CUXiahAtM9if>U-17&hR7m0)oK^pn`|04btT!JF>wqoZNLMotR$ zAI{Oh4);d%YF*FqliAe0gdXrik_z&jg+3qjy>N6iJlpG^ob>ia{lQu9x5MFR z*lFC7dhAQBd0Fg>`9W|BGcd*lJV6%C$8JWk2SZLGa-`|TA1RQupA&@#4 zWx#ZC5~y>iAO&pRDFNG}u2`8=d1MMv0)Krf(V9Lf)4yb9=ieu`vjJ=ecu>m?^8Px9tZRI;YPO`sG_ zYs-qV4vHFZ>+TgU^S!OIW~Y9hI|}n6QA7X17fQeT(6ua*rbzO4(X)&Sk z*IQOc)?=#yZ7hF0wgvP_6fjs+j1)$-@AJ}xp|LJf9P=#E+zygbtQXX2_-!5>_<=De z#5MUU)l)D~GT2C`e4a*&WDF0qZw-fe$3ar&XicbMhQ9tuSQb?k>Nwo|YccFwgebqw zgBHT&sr1|QkBVMG+P=qz?o=S zWQBA#D}z=Ex+xA|HDYQEpr$-F4PdZ=>W?6lxfh36g((E!X3prp8TAIWxFd-c8B7$$ zFjkQ$0fZ51jTMZFotc$DvSUJGu|nTe#}O$-oSdy$mc_Zpqebo|JjD<(l$p{obburL zI=t}X95ufGR;j+k8rS!Xko%e;9OIM1IUV%Tc6@m93LGE48gxg8{S(kX0KXj{frG=N z-q5KxLtzcr!QlW$_*E;bB^G11v}z48L6@vuu`f`-cM%A!Eaza4dkI;xzf0e+lu08V8^p z>5VN4Z{Ig)x#Ad1$synBVQyQ*rRWC`zl6gUtvr~dCOMCZbwHfcg?@aj<-8M}^Jse9 zjnD22mBBukvSKK{UM-e}2l6Pu3ZrSbwWJy8MYj|{zNuK(1%;+T>KCR8cL6<~#N_tI zv?|cZYZA@m)Gq~Lb1vCjz1oFLF-viau!yaYMou+wQTh$}cIj(U!7_c5LgW1}4Q;zI znJ!V_ozkzZ#f(FErMA&7F>VT~Bjs~6Bn#o}tzyC>Db?YtR}j3B5_cO0Sn1a4##nSW znqYxqv_=it@0PN=g)D?*cIJjth?&I!tObRw%? zk%Vjf8~(M7W?l-%z!@a0V)JG1)#1tQ!LZXm7L<17DlLF_j4sd`W3|cC~tL<=xvb$>4T}~TC?re4d`(ff{CYn}pxcbT#@7nJ* zB3aAUN~so2NLtx})l^mS{-y(-=!?WEEtDg!LIl<4^669YTof*~Ww!Z63D$eRgFOOz*O3;`v+YNLSctQ))VHm=zk`__m*)FU@ zcy(a;YVOABM_xWo)f;a0m@mE^xA*Jl2Xf&Bgn+689QiN#j!B$Ul{*Ka{k`2Z(S7;g z@Tgbu!bQNU6$Kvt*OS@8!6(zc_MvtKW8gU(VQS+f+bdcF)f#28@e;oFq{OY z3E@@I#i_WT)nyue2KF_wQR_aKMwnAMLTh1~lFLzDx>mj>H43VJUutOf*f2!LcvUJ1 zolfn->(*rjIx_wmW5P=aXmI1?Yt+>PnXWbaUk(}msp<08080>_9=lewEcRsIHk3+7HTW=>Uo zaEt$g6HL!xn1L|zV9WPR`HpEG4%QTU;K&alaL=Plh?%XRFYR*@dGOFHjFC2cZZf8P z@9*$NaTgY{GNTKLqMEq~6}I-4P%7E1d7wC|yG=q5h0`bT0C8|dySO!Ut7Z_Ee0`D5 z+yr_p#DaCMF9;juw{#*+z$Y+GU<{mp`rfWF$8rLv@OqdfemKR&$Ph4N&7%ayfjfpH zc%5~ejqlWxgnxO)m-=iLMHdJoVGObb3C$~ppS?JCoh!WH}g&A1j07ukl__{mj?Vp|W_j_lD z`v8WQeiDUvYq_MZ%@!EVU;@eh20{ou^8POl{IQ<}Hz1AS*q_`0KLe;?%Tb)ISl>nS zH_|7oLKxk9B!uK1hLh+Rrl~s>JV;g4yuJSMX@A&bsvaqptv7q!J31~@2VIX&Zv*e^ z_?*9TQ!s@gM2D0|UW$6>tvvPE(}a7~@V1Me8O_`#UTPsj841C|8$sGCBa?QjRmF@x zX+oo@h&`3iUJIIZHPt1}2R==ri60;yEm+SB$h?>_YrgNNBn-Q#K-4#MySyxlFq1~Q z6cXQ*#S@^POL9YiH$$y~^{$)tvP1>gua$M#NMZKc?U9IdvN2VD<+R#Kpff~;13|r| z7mkG1jG=#*tP@6n^y0d9hKU5uqf4w=7UqsPcgGit7~65?$7Av(a1psD%y259<2VM* zc#`)(zi~9kwnh}&1J@78<~@$$8-CL{;a5gdKl#j?gQhry0VW}k0<}W;j4j9f(Z$IJcJ*G z)U|mOP4nSncag&0H5@MpN%gilu2`28M)?IMsUL*}z|0+Th-u~~8GjFH2PC%>`ZHDk zEp>YqfKZz{GJW6xeq8to^!9xrI!SFX1g0vFBzm z=cQsWrq;qr2ha`Q#Qngd7i$&P+}6bewPewhh9UihszC7gkql$Hh+QH<*oI|*U%o@OK%)j;A%vHWdAMx+6qU1vPKAXqF>5mq0 zJo7K1r!)(qX=-VguXsmlCF{l=K}{A>rjs@|R3?w7XKpD?Q^L>Oo@0v6CcGznNv!!r zv8Cco=@?c|{Mxi;;`h=@rHeR@l1yqqKf`UbGeB9I8kFOg()v0BwM=-kcn6$+jTcD( znki^TAkXpLyaLX*x3esZ&&H7lmkvO`@3z}J&wgxex3*h5yFYFJ^sG(t;(Oe_+snqS z!0*epluBv_(kzMv*u87AJO)@)!J)=$I#U5t^%Vha>Bl zNi6h1KW)6X#E~CnO=Yg%iB=$!XEJ%wrB86kbLNCm211CI$4$`Um}%t5d_>lJ;y=2* zZ6b9NESHb|=j+dX{|GDIoVo1`&f~z%WM^hGgc(x6;wbRP#3@*7jP331?H_;m0sp(b zy{-Pc^ZoZf{?E?y7teQgUhI7TZ0CQrpFMlNv;99{``%_P{49`w{Ll8C$5JQvJNZG< zmf%=fcA!d&jik_xed-n31@ucloVG50N?U%^zTA0q;fLNXI3Zu1;(m{q)`2vY(4E6w zbY?T|lI+Rm%x$4e*#)@ z(Y~K%FdV~Hb`wM3gp<@k^0Be8A!(YgyVzis4hw!XoH8)kFHx|V!yPat=w;Ss5KaW-A%H*=!d$75mNHeK&KDah}5^ zy&+7X>-EFnW*3me8|c(Ai_9LHgDPF?5To($RgSCzQOY5d0eOM7UErYQNFZ@0QbHu~ z;{v7`cdy=!ZBwq_VV|6vjb}#!)mPpY>MvLcX%Pz=Hh1bAeSqzqjP&2J!HaYKy2bwi zws;aG^5tyuoWZ_s^S`@oUfvwmzR`d6vwr=lYX3(bY{uUCiVlD>|L^nd=ZgKmv;D(Y z`~N|H#KVSo1>2W9=P+}*au<2~ewr+>67X{2O<{JoBMC9n!yiWDXdXu)3^VJ-9@>1m zD;-_zlqx+C>LIquDNyXnZx-xOo)qzo*_|CvcC9{m2p(A9acE$=YH6| zbp60R5A2689!hNa_4K;qPxbvj&D;!57C{QLn&&|A{{P~|iyzhf|Jje*J74$zhxifq ze>aZP{623;*Lzrd!`C;2Klo-}V4q`Jkm-|_Mdr8IShlu>-84U0FoGv5EC-DeON;ke z+G>v)vyXUOb(XjpoKjPt*k^+%2>fvR1~;g3?5$wTtauQWoI4B}#Z+K)^b<%(uY&eU z41AaQR%GZ^bdL(=Isk4MMwv_9O*swV_#$1*+vk4hCO62)CP4gf94tHtw&KJOGtg*_ z=xkdr-IOHsa-_3J0MJa~IH9MJ^BAtEXFt417jt<5=-?#wj>L_xGB)YoL;y+# z&BH1h7x3mOXpl(S-HwsU0?9) z?$YhKJH};O%XewLy(HBn&kN>}SBX1@r!es&kH)uJ*Q2nPh`K;_f9_7<=^_Y*Sh@s0 zP`_c~-OP1@G9U&rjTe~2QJBH&EZ;GbMc7T>qy=8vh3|>dGD-2X#A?m`(9d`zVp=LL z<3*Z9^FyiAOE~pIcBaSX1Kr-Ql^^ggjKrzv^QXlpm9?yVoj>sdNVhddvlz=jpw8sk z6c_a&&bxvA*eYr{pU@Y2Vzeo_)AD>FDipJj?0c71?GSy>o$L~SvWox({@hJ&C`%RWVyJy{5+%);^!Vb~s?OG>zayZt!U^bb@*Rk8GH+U~mLpaf zyE|!XcFX*^!V>hE2YUpQMZgV$=nCMLrn!uxIRuMXng@AzQe+SpqN9=|kHlp^S2LXF z2xqyT!VENLU zTIvE?7aW#5>jK`S?JQZO8T3Th;~1ZO?Q9<7<{}AJ8BXZ0v*dteGph?Xh|=s&B%|{r z3XohQMI5Jeljx03@nnT#Jcn;V8Et+4j{LB70ZE28ZP*o+2WF$S8T1EMMh)jZX1Mif z6>N;$L1Z4sF>#=nUnpIila^{$#pIH>mm_8MGDv=g?a#s1tIbmN%T|$wx`Z?6 z)B*=nWoX~c+;caDnyMWoylEVz*))Oa$DoQf?VYccf9oj0;Y`!YLWZ4w6#cKVp5;}c5p_M%I|ka-Iv{A4`)_9=^pn4D&T9Z zgCv^o%3B}?{&#pYfD`!}pdXb+lnkdL`niBN75b8kHoK8|d#jvk8kpEk)2k@)^cLDT zMJHk*IZwO8;jjI{{;K3GTUm~&M#b_aV0~9z2HxMa6hR7&h*vlj8o&RqxIbB z-qVe)5ayER?M@c+bC^5@4IJ=7jH<0W4jp2c{Yj60hd)g}`C<0hB;N8)Pi~iQZw**l zjcA98U1Lp`xDBL>;TkDflt3FUj(s1uOijsJr_JH6`191p96K#cL5*3colKy@>a8wL z;UwjYAbJW`q-T}kRGP{6K?SlX1h*9_hGGodwcS@KKt4N#D*$q+NrP&B7k6 zFXBRJb|zJ_I%R}`l}FsUK=#fkdxQoi@dm9@eFFmt(dp$Xo3JT2ZU=9LTdRa*0k#^7-RcCWf_?LbQwWMe;_0 zKY`<$aR5cOMRqJkM79dyH49f3ctgL00v7(|-^e#oz;G+Y$o8}HY2iw6tc|N+pq>G^ zLc*`Ewy&iZF64}Sb)z{M~u|KWyLn%OS<^DpVCKXiKyTpIH zmu^4K($>G{*XG@^8Y()l*nmlO?JZ4bcR>erw^6sMtF%VEjxkuLc7VsaqdUrCV(P6( z)flDULtKk-_N$sYY`WPzZc?kI$jeNdv>nZXy7I_2?b9-LTWW9hHx}&Y>-KMhwY^)q zH$OM{>g&EgUv~++eRh9$HTn4J`!@T&f$=@W@6rceccb*fG;@OhCQUz_MD;L4J=!vW z*1uD+u%dvfpngoaw*AEs69L*A#&Z5Ap3RCT;-k0EKCbgle{Z_YZ0{;>gGN;twZoDav z^_f^xMq*8zsm$!oj48ug3t!40*Tj}G&{|xHK4{#k5$#Rz38yx4#}GJY4se=|_(_X=V!kG%v>_LP4Kl03_j{S^ z=Sqj0OeGJ{X7fP0VnZ<1pxm^LQ5J`}(*vl6(a<#>yha_FQg%@5@c?ty8}$V@a|1tg zkJKeAUSVsu&$ZIU??*P%8EDh^vNmFhW)Mwj9JgW3+3dhWEI#YZ25pixHbXH@!lZ1P zzOK$?%IenVwqm~xGVacyo7rEe2wN*}YzZH5Ol>W(1D1AqctEwc{z`XqY=FAkI8DiG z?lgPSpGb3H^ym-|IbYP8@8XJilp)_7N8!YuTG(unCT;8vXtVbGm)4DB$mNOC5!NPN zGDCO#Nor}cWK?6M0G`~`4zR$|5@3~BSk?1QnOj;#w$vgW`W_s+NzE`L zy;p@uqw*LG^dGra8~PDHmB?%`hpSH?59m%NNJ+k_j-uKF0QSiWsIl8tiyMo?r9@sg z%=|7Lh5ED7Xp%W592iF_-K5Zv1WsU*KyQDM_~CRooAcsF(kqie^$vZ zng3MC%_#m9J1oo6LQ4a$oT*aAW^KGUa}#e>UQFP}g})*z-Um+=a#SHd-G!TK@zT0D z>F#_0S3s!0RQ|NNcrVSO048c8PT|9vJ1SF{_~NYU_AYaJlfVp-1u9;Ik;C(44)(V> zP1&fpDDY>+xj$C`YfhA;3|6_;O+K7DL=_X_egfF5gs<0Hy~05B@>MG8e&=xX)z(dq z=C5t`iC9+1Qeb}=Ml6?OHx^f;c8Locd~F&fH%05g#t3}1c!#2B2RM(jn|+^D8_ow= zDY~IJwn3K{mGjg-cVehghm_5|vYzELL$5UfhKB)nact6V?#Anu2MzF@Z_mHRf7~hh zLoJ|(n~6(|>*>|m$s1xx(JJ95*1fPeCgGkim+Iuz+%r}T`KS``vHsbrrC&cM<@E}M zg^XcH&Q^XBR8OQS=6bBKr&b99U1JDnP3qrmxVwAVZLZ+;oF``JwT?s~mZeVIi`lJc zei0i+W^f|{jNbM`EHqI|~)bsK};JyyL^(Ut$7y?5_!+eRLSe}C&! zpicLR?Mk%eTM}=Ra~#`A-6pml%W1byw zFJ9f^Pf|O?#-Dx`oqyhg(`Eh4^-!(k|Gn>s+w{BBtxQ=)bEl;20icf<^aY4Mzy9d0 zdkd+SnWZkArNX-Eq0$uYFjg5{FWxD_08JHr>WoO{kTUuRk7KT%No-IJ`W&`1$?!XD6rce>nd66M0ep>aD45 z=Je}m&U85bOrv?#xitr>!ih7#Ti55UyOR`6bWAWS`F%+{eOXXeRedGk))kx7Sq2`O zFh4Y5c7MIknydFyY~uba%s%u^*1PbhF~0q28!^vMFn;Kr{Lnl3p?7ix#%|HK_@Q_5 zLqnH`hAs~cT^<^`{52c8_{HY_D*ap@S||T)S|^hSNAW{ziHFt_53MB-;9tG9#AmHk z^<`Tv&)KQZ(r%gDM~$nywp?DuX!Ou@`R`+#THG|n3esY(=_BrwUq~w=-f085_kGCI zKKYgWpZ`F0b@J7B?UMp~&1MY*m6v{3_Q!v)ii z|G9_^W-5zJSE-!6)S9-`b~5YpXE|SW^js@nws&^TCoBID8~+e1^CcxKs0RqBVg#w79>qDNg-+xkIUBGKui`W!E5Z84iZ=&e z{&Z}PB`|JOzeS|v73j}UKCdMf@aYpYaxlxdeb?{L+q8UsZ|^yi!^F`gCaGR|=tyqA zeCSC2V8DJbU_ThJ9}L(J2JFvf!2U}%B-irAef1=-g!h+kOMd5)lz;lZk)^ z+6QOWU)`BS9{Sx^p=9BH_gYPPXnFt8^8TUa{X@(91y}aa^8TUay)IDx(DMGF<^4m; z`_jt~E$<&%-aoXwe`tCC(DHtX9>}IR{1@zcug6@f@qOJ(pR@P934r>qX@6h4;=gPM z{5x;+pSiRAEw<}V+FbrNJnNx#`+sli_Np~Kv;lu;1Af14z^i>@b3J3TcW;T2)MOW$ z>qE=(FV(XA^Y||p@m?-{wdfYHUO)(1B%u2q!?~Bl{@sSVyIZ5q_I^JCU^Vom zWLPJDXqi}}YCCRe?2oe>>CfnWR_iS=nwv}N@qgHxcofgbv#4z1?#=bu5`k_d31*cA zFH&#*buHYTwai0}Hj}wSxVNB2lA!hIH?&)=_o&N60(an`nHC%-H-o_$4* zM1EC}?y0qUHHB83r$w3yE|PCjN27PoJXxq|>GGZT7pKuBVSj$IU4F4OlsuD;8|IA} zK^(JZ;(+tx6;y18Uk-h0HurQE=Ao;Cf&bAR>K{Iz^WzIa8(KONUIT00;I|b*hhHhZ zE;GjF=H}*;-Cg+q&CSj7|8MSY?fg%BdvCkl-fQn{wf|>xYioOV?|;bV=UcY@j7357 z|Jl6rSmnk2MLx4V^Oen{X%?#zP5VR`FJ^G{R0J{KxNbMD;xyVPUOVfCdn2ZwyY;ln zzFw&NHg*gD^rg{LV`QO`lQab;e+dJ)t^ZzA2rSqTnXjpU9;U_vShCGk|gPzs$k-y*x^GrR$935__!S2@No>ps@B;SFR1o~x&GbxcrnS?J~_+i|BhJ$ z7d|JCGM!bh2DNWnd?rhC2Rlz$MLAy4+n<>7h5x~p?OE+BY&7AngnG3QJhp1&j==O)ML4g zSj>4c=iY$zSKA(Lb#vHjpf187b;AZ`^7vM()p$fs6b%sJT&yL}5tPN3OCdZ>CSNrk zk#~Ycq&Fdm5xj6o!AUq|;gwC9CcN*z-(!8AGa`kUB2EWnoZaUwJsrXL_rIzCD{jX> z<2Ccw;m&`H%W$Er+CTM8v)GMM$;1BOo8phw`s`;J{hy+v;ojqao=o}ww|3eO`u`XC zl-QZ?QmXL;mW2xKv$C?qY^d`U-P)E1t}6TAAdK9}4Y-Iwbg}b~QKhZyI{X~||0nG! z``_O7=EM2_5}z5h>}F>lsUW|qpUcdmQs=mR_Rw99{I#A|-5p-8UiODLqO=N93PE2k z{(MgGc~#)~ZIdA8rx)BJwP1m~f|{HHKcC?CxdaO&64Z;SrGWi%u>P`v`cqN*p5qIK zZQUkTe=+`Vvlc%C|KHr(-I|X7df@+GZ@re6n1mYUlImjJ4;#RKvv>M0)K`y_GruTgT$LcVN%Jw5*E{cV?u&`;bs_2m>|LHc~0Mon@RCkf$6go~zWM8r*8ghP#K ziJ-VJz@UNriianMmhCq`8vD)ycYY}=zy9ub9@J=X>$F!0 z{pM%=kDn_^~AlD#WFbI$*^JoDc9Z}06s_{FCBy3N;3x4XF205M^+`Q;K(ODcu*}ZSTsm19vnC$a~RUp>hgPI8`N`FbiE0#un z=td8}#65OSIZ}js>~#$ydlJ28Y#54f2iFPDl`|W1p$k4cwJ+tj?kTT$x<%w4I01OP zbXO0H!qk7uXfgD9x0oJsUzbO~V5D+Wp%RviQn3KGO3%)~+Wg5mr{_z|u!j43Tio)c zl&Y{IGy5otC5hAI!X~(z8r_Drx29;Qp00~TQA3ebhGo0Y)kR&GSMWz)$Y1zVEB~c~ zIQ`Iaf0iQpt;E53`rnhO`akWRovjD??@N5#uvIrX5Vl`=AsvCrsC;XsC!IUxa~g@O zsq(LEEA}kzJndKLiilzA??SDzxSXyy=lq9E{vL<4U@8mz793#i`QMzX|M6t|LI3+A zpV{ZXNQ9dbyxfsjUS#x(UX6P!Pg%i0l_`=M6=XR+;85pZmj!(MI70&+uoPA)PzCj+ zr2DX8&pZFOz4P7AT>I}{+5YpS-G1=@ev!{2_y3>c(*LVp^a`W1uJ{p+(>Zthed{N4 z&VR(Rgil877E%B9GyD9v_jaD_PSyY0dyxOX$fu-P`{()(v;Ml=gl3trCB_`<8O~LH zEziZ0E+}~Sk1j%RANc`wfo{0Mw7UEN{^(gnOQsX=i8+-7bisXAwKXe8l#O`WVY)qP z&axy9si>H(`st95(}I+fd;PqxisqEdx1^kl+QpDd%#dnsrRwjV`B$6UAhB1BM~=arV-PLIk!yYA=3r_O-J>qritZW^lT~`#nb_rsy-j5abf#R zmm#hQR*bV!w|76x-UDzVe_yyiJnq=6=I|jOji_t-Zjr|-+U~LYT`P3|eBoHX^ATy~ z{p;yr>zbo)BwQ5VKs44r9XO+_D9%YMTME!XSP*sH=AAz73xY0p6o3!z7oKFV`%7(C ze5WV=)WGA|YhTtEs<`CTg9G=$u$GSI9#chFk87wSXBihU)L8iRY2T?Yu3|q9vP?T$ zt6sOMKaW2bVFDS#dyoC^T7%LT5!{-D_xt~}znH9j{5&E@$LANvhX)VKikC z8D}I;358I{T&Gc)=PSjFVNql*HfkTL>V?;`bTX9)@4Q)+15c_rn3omgVD9*6i6Pz5 zzN=VW#fX&)7K=S~d%TE07%@`|oQ;{8MHCjDLtROPnkm$AT9-vClY{;^On8G8AxcCW zR#cOL9q~E`?>; zBamn~WOB>CySzM~n!$9#)|ms<^PBQWo#~;{(vqaC7}Mm4C3MnZAy1=fUC~2j#Y;Za zjO8(p7KZ0N?n5f#5#!@xVNm|_KCC{ClX1>2hdC2No>Un)O3=!0`0&ISGJThTSAOF* zcUlr(vze#Id*HT*#~5d1-2X^OkG2Zb4tzLfGNAfEFuKX5tzQNz-5i3 z@^vLSQ=@H(X_^N4knfz-b1e(Q-$cBrQ{HlLbtXumJng+rwJoBM%Z@Py@V z=q#`e`{k0O=pCLiHB`v=6>Wnn?~{^Gw93FT#XDxaQ+;FH%|}|ph89#jrVud$4OO9G zOJHR7>-UP9n&tX&rgKhzB_d|FTE2Bt?F!glkK*6wH_w~$ajnfpt?B zTY4qJyr81eHSBj*U+BGRDp|Bg`vP%AB}DwaGDqk5|Ffuf_YAN(@jvbM)>b+H>&ezb z{NES(%=Q1fuJ{Zr+$Ot7l>p<>Q7rN?G|7B9js{Ctj`?#q;}`W8-d}mIxgPDsU6}Xo z`yR#V!8MH&NeC6AyFdT^nBsrYXCD8*UByTLGmro8?ru-<|A+klFY~Er991vYu2x^>>S|L;BI|9zRyQu6;DyNUccSnZb!x~;K)mUwI(~ODC09AkeErgW2^_8eRJW;u>J|v6!)UrWadZp% zw=3GtxQ{O0ab}J;ysm?be4(;7c6E?h?R4Fly5V*+XImGex9ntR1@0{xvNv-h#O-#X zI$U7Z>cr>R3vsK>5VxN19a=8g@W7=Jeh+Pyd?Vi-x(>~>0M6|_TBn1Q^*T-mO-YKhh_4xhaXH`1tMCy?*#KlovYO?rAAevGh5>xF z7LcwCUlm(68sPn#4@SHUskwZQj@s#{{*dbAzi$*Yriw*cMPQMZK z{*!OOfAtr`!G`>g{!?718x~NHhF9YZ3O0(ydLVAH#(L1BSB>?c7-fz1|F7|g{7Cbd zj|Dk7Iu?x}%lU6CEE+)^F}i`z<@~qC*-xj(7o9(POPBhT&i~*OGc2u%sk zure5yl$MgT*W|R|a)g}GXoB2=${Sd62dKL(p9djX6tox%XT)ti;+`4tRr~=tQ^85s z?Q-(I$9W-&oMv4$F;}t=d0ON=feO{dkimUVcpv_)%8Y?BOQn{8WyK3JlFYOi$_1v3 zgz_C{a$9(qk_H5 z204w`g(ROYxf#ac5Nf>BC}NTAv8&}gl5tVU4JBiI(HVcUV)(gB*bFuiLOa+A+6F{> zyLQ_V3L(+8K0cvHg^8+8_hESMraX&e1=D3q?$Mt1x*q(b=j%y zR!_~vk!Dsrcl$R(E^yqJBj(ISnuWb1VSi6kvc2g6m$*ir2=ob|apRm>rwk0M+A9oL z?j%)O;M*FwbKXv*pmNRZ;RwcpB*hYjon?I)HGY~#rT5PR;< zvxu+{bd)7bb7LfC^v0-*#zJ|bp*Z|#>gK}3_a8WXU5Hjb1Eh+syueOhb;$XT4oonPo|5O)m3Z3FQw&95++k&I}jZE`TL?#EBg%iH>8+yi*|Amzo7<)p7xT=2mFR*6g3 zJ>5b7v5>Y5q^&8OEe4@&AXu!IcXBaEn+B2rG@my2ENyNfQcwA{5+5q(G8S?o+D}i; z^O!^actS0GZXt#N(vw<9HLq@&S2s)R@RpJA0kvKX%OeM!wv`VFBJ>@ znE`HjN{1DMeUKbHE>LEXeDi;k!2a`GU2)G>R=Utp>6*t88M0(VuD1!xbDrBVo|-YX zme`M-plv}sF(BG5WvYtEMteeh$YX(+{J}-!o`ErSBphJ})v}TV+Ln(BhCA-bM*dxm z6k&(l)k9Wu0*^({bHAX1aWjkymMFFXSBGE){80(4m}Km^>ul@V$r(PiSIb;zIsu=g zBr#^S8gi}F8q%96R@SZ6e7b~+RxIqe+tuSrnNM4LeGX@+&cZOqbGM$|4;i61q9wLl z*V|~Gl1f%nsW3E(gfE5ih@2d}g_iivY|SCI=i?`dcD3w~XOpw^_?qPtkWt53w~3OR z7^C)Dz)a9iPNaNDqBw_D#!~RhneLWFdaN&{LJ3mq$!JwGlQFDdd#QtD7~7^@j(g$T z*)or3NR+S-aUqb>q!zAp_AF;DA=fLlf`O7|>?knLv#@Y3uJx0*=Vup}2d9^$MP6PU zAN+7~`kJ7@tn=0S`nSFOMPq&a=oF z!1U$I8njfma#X#9yFBg$qv+Sw@;7U8qRyaV+|yPlYSeX51~mb7_k!Kv zLpMOfwf;7ic#ufw(eUbq<`MW=Xc6}kw!V&{B8Uu0WZqfrZU)bS-7d`Gloz-d>lI#K zw-Z}mC*R4N1m~tu-ymciJjv=?kM9ntP|rnQkq%?z7Zh8;zVqv<^T(Ru4U$@}*hEOo zMgYAuhgc|TViBQ|zB&ahSbv;!SOL$&Kn^~KX41c|Y5`|B?txP%5W@}lNo)uZ6gKRJ z=zGI-*YhebuUlh$&9&rI~Yk=)#w6U#V%Ym__VLV$3MB4!YM0YSA zC`*fxz=4ezWs>FZ!K{tfdwdP{9i`EGEm$1Ln+Ec73$(Pj8?<*d5J%sU)6?o@XGn7v zVd7)P@=+`V-Wo!T@s83)6Bp`^fx5HA)Y`$G3uM~>X?s&sjg&~v$3P8W`$uPnnu`l% zOGB{|;}KrNV2>ePjKYShLdFddggJ{umyA=eph;Cyn-rzorOhP9oC&lU=ByyA2LR4U z4g;35Tq>l5lANZI`&QhCc_^JYk}}d7iUZmVGc}=D*vD5)nr?6&YfZ_`p&M3Q zC?jlIW+j57c*#cSf+Z1W0;hz5*Df9n9b2hcTQqxdO7jUw$iy@gB%~dXL!MqU^m~)KQ`!Ec)L^e!cw##+CTv&mQdo8;wmChqBc47klxXZ6G-FOwGN~VN8%sen z5iapOGZg3%AnJ!#Y_efAMJGE};!o2`L~dxF%3aD?8nN6Oby2P=KDanW!{j(|jX#}u zlqGS0Vt7R{&amt3kmm(Ub=eWueFr8&2ksLCcX#SEqDg|#9v>HEi2gI0Wy!=h^~51d z1rrX?Jp**BEKBGEdT@TC{D)S?Lt4yPD5Y%MnLu*_cZA)F5f))0+YXE!4a3*{tL~>C zoq`ly*I(!P6_gk!Z(kiqT9~Zbe(BD~rTkylg zx39Pd*WhZY-EBJ{&>1jJT^r{jFd#UTTrku^&s~2v#^3mC7n!5f6MBrLWW*yp+i^<# z7!ETv?Ou{o+gZRIN>g%jZY>XRg|uiiic`YUDC2SJ-2B?Tho>@p98aPVEW{wO#fhmK-q0XlcY&TEQ-e?z<)yX0jqNT0bskg zj<7D6ZEPSMw}?;d4oxbriFTdp;x=ZSZFPUhf!fOmd7HtG1LT>3v54{8wqr9#99s1` z0G}Fw(*l$fEJliv#&`us6{ZQiD#{X(c3h29M<7~cx!cZjYR_2Siqk%yW`x`NcBmTU zHRpqbk;8zjV%)sG?`&}tyCbXn51D4 z@|>M>o^;~>u&xW%pwG$)Dllc7f*PghV&X$pfxEqN8YL{~Gg^#ulW^+|fU<9vyMEd7 z#J_+0FEZk(yoX&Y$(D-QImq&@XYR|)e|^Yk1iFUOzl8$ij#ux>w{TUB!mA6>3Vx%XyQ`{*$F;kf43e#Sg3nfLIgA{Q% z?Sev}dj{y%Ox#S%crKJ(1tpmSrZ*0+SaB?sW6{N6C;9yVc$#8nF5De6yS77{Sfs5R zj`O6eIka|@-wasMCDEAaOE_gWX!?ia?*iX8lisZN@#3YU&Bql&J=!NTn$r<0Sndw6 zWoEyG!R(pC+P1Xb2$QV0LFpSLnim9zFgL3ft|S@Nyjc}Y0m>fa+~N9L!L!OKfzl&! zWIgLY9-==G6aaKg>$@B8a}XTY9MDfKXnUo+91rw~84H%5C*wh!s=EKqyXJW8lynF5 z41#0>Y8qPG;oLf#fJ*+j;4N))h-^HawmCS%?Nv<`N#5M=Fu3#1Zsj`=cd0aUsmBPj zRFc73g$kvDq%D(wkTf5t2bu22jNJ>4xrBp<@$`*IGX1fA5 zPW==~My1sG)^oC|JT9;X3^Aoi;sV~XNU67jJJ|5TGm)TmIO^8k4Dm7K*@RG%#G)X) zuSDyDlY@)PlUE0amuDA0zyI#+?XeVl%A(GezQ4UO7C6iH{%)%~1Yr0V_~8je1LM9s zf=1KGx5C(RB9zHpuulxwty#;rjtcDr^Ax2i5^t-^VH$FotAFcUV86rkUIgEoV!glX z@}nLa}|XNqJ7w28vD`v5@B0?v0Z`E0?zZ z;WKVf;)2leYOI2(>NvV<*r`|pxPtY5LzuTYNj*maX{&onzU_#+U=G9p#%vHKj#Lb-Pn41wp^hmz5wKuC z@?1qTy3ox@bVT-_wDqn^p9Nh;Irz~66BiD^XBF^3cq+=hMT{$2#AyginUEWnGZIn- zSMphRr=M29b{X={6L~9oR%IQVSa6b$(=`W}Ip@oG1)c^^91!L}x3_)LDX-LCI4ma# zyJm?4#T>zsnQnS-%|(NU04qi!pYt_KU-DA{GNmCFSnHkx!W@%ntL+R3I}QXt&7tyM z3TZ);IHgj@6q=#Xm2Knwpxw$r13uKc8)K8Jid7U zueWdBAOGv};^6(^+3D%AyyUxNEL>W1QX|?+QHr_RpVJv=wdg$f&p2n~Wx{*LGWQak zd)juHTX-fCe`~238LE4#O|K>kVR2E&k0q#(S^PUm*fF2!A=`DP6yDdyYwfkcPzVd7 zlt7>^p>bL`xeMqWSw$YSraU_dWM^&Ir{06Q`yPrS8}KHxKpp3&6*Rf{Mm<%wSP5_2 z+j!sPf~qC5WKft%99bB<6)@&*_Fk}SA((udr@qAKTjUJ-vT-ko!*_WC<@~p3EKT*n;1pdq(t)Duivkeg>T`3cs(h=)Ai56N`aG;pfm%TES zZVZWj#YE+Gg*k&SXwrp1&XnJ%ywuL+#KeamMlnb(b8)qR8Xk z7|`Pu2sgq0fdj|VT^Y{z^qOi}YNd7L9)X01S8+NBG>^d$@u;_=f;?jz_u{JQ%BJrQ zZ$pWfptarLnFGSaGjBa}>4c#e@3faNe$~=Rvap_2fI3ro(Q=nmm3J>OI!?h`8re)a zOq8=wpH@KCYqSBJ?h>EL1KG9^OyhyY9ZLXg{SUa!lp8;RRaK}_NZHQh6x_! zXwSs|#HK7L1#iLmI;Y>{6{vgWsWH-JJR&qL;+E-yp*@69J)>faEL4*<;II@EUF5~3 z`T?*KH~Bb)03PKz)_OQgi+qC4awt+9P z4?{W@1&f?H*g*WJrQLMN7XuEQxNnf$Roo9)OeEGMQJFAxB&4olG6r*dcn)F2ZIAU^ zA4WM4Oxu3JL1LM$1M{hYxmBVlFv)s3zST9>b!7sb*=CO1 zDx4kd_gQn}tRo%LGmzYTLaw*$XnVi<;noYDE(gM{hR}XiK3xXGSY=c#1Znw= zlVzsgrFkzda(U|9EIyu^!w3n=P7oF339pmmw9oU95vWv~#3Pd{GFDFSQ0}vmZqYfW z`($*@;9bG{MVClnZAkN|Ycju0dYe14$3PZayl_`P9cAItoXYYO+g%kBNiZf-UzaKd zBx89pF*zCNwQco9*NX1bm~|o>92CL(wZqwc-!c1MKFPDiG7G_E4mg6Hl$H-NIeW4d zY-;(-zGKn@oZA3I{?4|EYVvHvWc7v$BDXQ*k&b@uifxtPNpD0D@=Q|Ytj*Qrql_1+W+Bw=LxRmqHlx8;jw@PWIKEp<5Nv8qt}X$LZC-*t|gMAL`ij zCZwa-5ot@UhmQwC@(k0EV_^(R<$3XZYGNVJCV4y<7KGoVESEw9nt7mB6wl-Tz<9c8 zV#OO+JV}s2E@e<9yD2<46JP_HkYfNnHHmSmBwCCS2Pk?LSpH0b!7?iFlN1BLS;tN1qmM1X}Ppe0|w-kvZ-X_JmZ21i&eAXdXH8VloeQt zAgl2jzRGV{-c+V>If*#Me>XuZqe?7H$M;P3=aWp%M__$d59G#J5i>zEN6X|=NQQ{QZ+HIK>dT<2UMdQdEc+*(UrjLuh;@`R20kPy%^ra`)ypsk08yuwHG(n&Mgqq3 z@9?FjpTgr<#WQM&dJ6wcy%LpwB3ZqkAUp&{_?4Bmm94^b5U}@3Bz}%Z5 zPvB4xp2ve2Ds@in`7}S)e5&sq|0XG;Phn3|v$mn$!1sWdoQ-H~&L>oVlawOy(!`Q` zIZGxaiPI}UTrW<6PNcHBrZ*kxhxKU)mqgRKBMnlgCMB`Mc;D{&p=9Oij<4MD@)MscB-hn72l zx?tv5DrJY}3cbs4-Oao$TtNlQ3vzf#?>#o8NuTh3z3{TwZBJIrnpPAnyzdQL z=6wP+dUBq|VN>oxk0wAzH@SQ-1>s|yYU7^z3ej}0EF%hG@mJxpa14f%q6XZN>IvL_dGn#PVq`5B=}m`?cvRqE8)|gL zA{=8f5R3?EUs{a(2{@j;n%D=81b?lX9z&jrEDpzfERqQs(fkVSU`9I9A{P_!AXV0E z*dst}B_&E`wQ|Y}LWz4;gO%wcT#~QNvh@j^EAqGql>Bj28q}t0<}75u$$JxT9D4`_ z``OM%xpe#nTn0`gjlRdU!vvwSUCkBMhcq8Z#feX7QcPO? zoUtZ}^PFAt5Q1{cx4HJA7u;xD%vKVZ;&hgsW4J~#k%XEhbkelnWGu(4R=_t(uyFM@ zSIjrO7=-1i5i729;4Qd8+s+1^Q^|Dy2D`J$K7=eQ(dn0X_qQ_VYL$XpM%&`tEZN{;F6bG=WlMN&y`8 zRDhnk>*Kuqf?kj=JOu<;a3$pVlT$<7$gR+KT|iFya{rAkB#O9@G;KDeh*jSOI-v4r zU~)=vU$qyOk*#wsL<7$g1MHV0EQmXiREl%E(B3k!dLX?NqMj(Qf!30_9oI1$1+Xa+{nJ# zj8}LKCu>?&2oPdPYs6Sls(fa7*M7t3RcpA?u_(wu&R0$k^^Kf`aTYVlv|Q2GXovDM zwNPqOGTa^eCtRa?%$_qQ8g8s8E%hj!sua>3otdLJm2`sIqi}}zij7N{sx+IeXy}g| zIwR+-pmEyNaH1?S*kC&A@|fUU~;N@V8(LHqvPttLCmVRlIg43M_ROoH3!xHE5%Q4^~&kl<;mgk z3V|dFNIaoJk0C{FXB_u*IV_;!q)cHJ_R9gKRZj}V4O9_3O?0dhtva~ZMZaQdz!`8M zu!QC!cy+*3W4IEpKy0)i38O-)Q?8X>y<$%*r2UG0Jx!|TXmM>Zx#xm8io@3=wxm{`9|v1XoJTFW$cfpT z6zb(B6De3Qng>|Gk%KNRrqS%|HwX`?N*f~|O&sM_N+|wxB3%+Jiu)7KHgB#C8b$Ko zxzu-DigcjpsVfXEauS+|eGx|<>3}{(A>Ejz(RgHP2DucY84K!vdOOQJ4G`><9H~4^ zV6DPRO;8)OOn-=&I=@9FimX-vVk;QyQ2;0zzMQR)Kq{)FK#YczT0JSZLV~xZy$Y9+ z3iYt7=lzP=H0`m`Rg9}u5!X6rjuOC=Lp#Mq%1``#w^E-RcpGklD-_VY{)@T zujg8ymr>1>m<7{x2nIo*=o)G7Bffvi3;B}q-oX9RvN0nO2`RMtI|FJLbqms$W3 zD)L&((WZhQh}>??4i(u8la_C5HwGOs;Yc*1X=?MUKW(QLmE5n0R?oO;txif!H5nTa zKg+1#sR;zd$YPpf09>4sh>0+ddul6;(h(2hY5S}`O?uzdZBTIqAf}!Kj55|%u%_KGb@qjw>ME4Qq~WlvqPkDVh443b zjX>!tvU1QNC!H1Y@}P6l(a8PjmiNi!$>p2lCOJJjZJnIH zx;Qy~ef;+L^s-6b9$y@OcW`=n@bcu%$>q;LLa$CPPmenoK5(F5oF80Vo*ce=b8tb< z-(8%ab&m12MQ>rk5~-_+jHd!B2SThbL#@y!7n)@`&+=G`=dj?u3XlZ)vmDp4m!h>% zi17$?70s?=0i0d%Fg9v3GIix=1#7J9Xq{GOk@lVj(VnaVqKB=?AZ3Fj9V>0KW@Cq2Do3HAU`76A<79?^ks!{{$QGv|B;6=if)rrTrW-??E&$aWIvi4oB9;@Hqt9I4;^wXvSyUaVQydg&BR&Eh6;;OGDBeiT4<_nUJ^`cmgZY@O)87P~u zN>>B^EDt=Mcfd{G;3i^ymPYu-kS9@v>73>x;6z%uHdwUBd7S6gTc#|>R0x*K?ww7n&-J!nY=9v6{yT%dwymYI9Ai$@gQHM1rt1Ot?U%-^*!u z#R@@IK7LxUN=iaQecMemF<~krYJH9-9gtP5udIwV&KcFfzgi=pt%I5>hJ2hv7;>-X zp|k_%+ID=i&~k8+7W9L0go09!69~vpjL<}I+k;R!47Ab)g&%=#guq^*pmu?nnd!?| zyHnC_z5lQ6eOg{NE-GETCDjzU0muvr&AhbRr83A5j%6zWH zc&H#O#YJF^hN6s!<7oZ72i7v`nd~$n(?XN`ypU5B|J;HIcS07D(CcIm6?4{bt&|?V z^z>rkJy0is-%A0NQ6C!*0aYlH*(IN*#DuhWXhrC5DZ+Iz-3_}A#nqq5o0YP;Xk=JOv;WQ$c zD~u)8NW@c9&DDhjLUn-XPZ+&cHY5*qeI;rSX&NPr{Kk7|8Z9VTD$+=2dqb3EKF*XI zCQf^NET6+v=AiKc4TWmfUIu_FU#PRuE1LmkoF`qZ;BbP~LA5o-(B>mZ#6z0?PNyMa zV}iy@%$kqwtN5I4dnKA6l%(o9r>Y#=FV1rop6!uU%4ytKGomwsPGXi8jc&Kwqhi=t zB0EyPgR4^ORSUi3dKD-Ps$-+%BUMux<<73p;k*0(JT#bA3#C-=VS*i=W;f9MR)6W1yzl(nxjcURUQYJ?;o0e{ zlh^Mq4y080!lE5{S-E1bX^XId(IXqSBZ6s&aFRM?rkg)bn&gJ5$}!kUe<<06+jF4_ z)hAIi35Q;n1?xx!QJa&cE4ACk=<;HMGO*Cy0TcTB*hw+>W`Mq2 zHHw7q2HcmN=D*yQl#b6gET{U0r{CBc@{#?4r}pa>(w)*cXWCY4#0hP2!pWTpAoI(&+sYK;tp&~NL$vI}ghkWE@f1u3<>W#zIq*7X-yMk^p z1eKM7#w*wx725AKlH}te8y8L(fM#%^?I$=;Ax!QuI5~&0-(9=`#*h88;vzsCKyGju z1!qzzmDh!;o|Lj1zxgg+CLy%bglI9KL8rkdxK=%OZ2E5ce7K&Up7gy2DL0TTgN3sr z<5sb?C7c>hGr2lhrM5+w1WLyRHz5{lO?5U1HWzhwV8780$ZLgRu%e}f1=XAAS~ix& zou73sUtb(|-k%?IIzOFV96kSf^=jN>VUfUAsrnzSlza=mzl?_L1^IR~QTN=7mXiYB z;^a5M(~K6w=PMrrDatv^Yw3x6S|Ptfy3O7WX|*C2@`$YgMz;d;PHlpFm-Z&G2rX}9 zIlGQAbiGvV9A~>low3MUwp||uMC*xUI6WTo&+Dr>Oq!i1JGLIAU7{K&**m*uaj3k2&wUi zNtU9foaI~|MqAwrBw2~|5iQ~nA^_xLJkkZnp{E^V5sQMxNgAZSOhPJ{zKVRA1+#Idk4v^Yv0JC*V7-lkv zjpr-v*YVw^qXF$K2}thASyqVP!$>?|X%BAu@`vXuJBz&xeUb0HFC{3;Z%W-Xmfex+ zi7dMv0OeMDQGRpwM%1+;E^R}5#xB%?@b+N$HV~#ZVQ=ScJ^toR#O&nO(-}}45vmRw zTeFC=@_iQ-?OP75r@yh>7Q4xEf=p?uy|A_CTibC2yWiiiF#&+o6^(O1QI z7km0cH)u4Z76n2_gf?<1KWMS4Y{pUMfZH3tq=;~kNPTfIBr!--h-h|pS!!!Uj+gH^Aqy0=TJAm1H)bK-3GH#CjD>9As) zJ^Jpz{eh+teBJ6GExpTr=Hpy-3Gl4xYYjXJ+9ifYGo`vAK|70pF=rKef8IlL^Oh&#v~!DiZNL zmHUkrImF&0)b_qBe4xr8j$T3hrS+{cM}k8BqUDQGEj46ovrAYoFfSP+X8rSx7CDzE z&*|wY7u|Ku07@Wo4WwOTr3iwcQLmx86z(-rdtT&YX3Sf11Kv8m?z?S(=QW?R3pINn zd~pS~18JA{?XlCf18M18E1eXcI^^TD=(>9<7Ti=^M(bOc22ENxffwE8VtcG!-&DJ| zC`q)t!Dpfgz{;WoVNWX*%!^8gb{2ggVXRg(`dl+bZLq4d0!^Wag5~)oTCv1({^Oz2 zB`z3^e#+y5y_I|zpjr(ir6XmHzQ*J?0bYg%As;{5hNdh21_b?al1MsOAp!aHsU@f0 z%C5uKx3Hd;qJkI8LBVxb!jUsNuvOJC`*X-|1lcO#Qlm@WL3$;liF&b2M`qrevz~J1 zHS;+Gt-T<$Hq5UD1*Jh7thsKbXn?Y&A;S((0}!L`>n-n2r?51zf_%&n39S~HVtY%E zfMkC+P{f)_nn26AE=D&>YL#bk%oJ&C6 z(^sAMC+A)Fj_b-DRLlamscR&3tp9?^c&|EyeUM@_iyR3a&f1MUXI@Y%3TT>5$#)$~ z!F}9bB?3f1r!%g_O*%wd+ zr9`KqXG*WBhF-d%`;zLyp|w_gQw$kI&cI-goL`C|GvBvfyG_h-a6R^#-kH)AKl3JG zTlJQf%;)Ww*M&XMotU0~{qgnT`TLWjPfG%@tsNAIAC7;XrU7jHq=GWm*U1lzWs=E^ zVx5^#ZrDI?L`!UU-A2ivY~lHIJGkf+Ig=8fLQ5!h!ZIFVXVZXqw`V!^x9ky8b5X!@ zNMJW3gZ)FEMw@b?pE4ngG#th$Tg8l342JaVVL}HQSY^lQXD=VK6^jfu%>4%uXzgBg1QBOVGlA=OO=&LPGQB^#3Qh+<=qZ{#$MSTHO`*y7(X zc=F@+Ef@o)6Y72ReM}ea8c%CNoQ+8!(RP1229_g5NSW^fk{D`4X>UGU65R$vBQpT z+EQbXU?iFZ(D%#LxW~3)IPL42iq?>xQbriD00R&ut(R1D5U(bq2FCoDdJe; zM8u;wp?T0Cr5oc%@6ymgp-vYwI984o#UOpv5pxFQx=G zB;Z4A6pM~3q`(iOr17%}%};eJVONdS{bheCy?0+kxfXoe%U?7u!6itgsB*)#*H!r! zV$o={19BW;QF9|1#3}j3u@C;b>in@*7aiFX>+KsN z(m2alL0YXB`YCil>Rg8BE7$Fn7f$fax8V@VQ!07r`HJHeUD+^DHW18<2JY8Zplx`j z!ox2eh?uu%zcOz7Am$)3OCTZ33bEn&MK>_keq+sgdQo%&*rmg&@;?mrAd3|$ildSV1FNP`L*w9kG2f4W>Z|w)4l0 zqFJ`@9uD{tWGVk^QAjE~Qou`OyH9>^{h=FNx`K_VRyWBt0U&Y08alrN^AuXCm&DTQ zlVGC;`3<>orJeR-i`72wFP`35$ChvgFTGQQd;WZSa&uB14K~JU{J&#H-eL#aAK0WE z_MyGdPEv$=$9BDS1Ld6{qM=kMQjA?Ic^FnbMo8ukd;&dKA!EZtd$~{30;-V9KSelqen>NR)4h(fy&(iBS=cyF=zgk~!z%`;?(^)=tPaqY= zXFgbwQE7>^(0JU?*)ByqVnNkGxnh$BIxEQAgU;pgg}j2Ff4#~xmI{%OTn^M4vJYf? zYpub;Atzsdv`>CAM*}DVphhmn3Jxdbb_c_d%yVzd8DxKuK%3$szGlh926}`gzTh-A zF75D$remzV`zJzhnXQ$k4@7^7|IiUK>Pe^$-a}u#-j|k~lIDd9GwN}mwKycBNlPcd zwImO1C2_%Wnmo4$~40GS|&Xm)nBgy3X~rn)LkNCj&`e+V?PNx4i<8Hye` zWWcd+e1BZXCqtSfi^<|&5fx$Ck8`L9FNXvxfa(a8+|Y?ISuEX!X}%k1$O4k8ZVR;v zjkpk&3XJe|>Wi9^rwZTL6^o2hRhvGjzG%MZaXNL)Oy4cP$;a;DW|460z4FD`F<`J2|c8741F4EA(^KXHesK(NkD)1QmLpJ44+&2R76Eoc#Az7`-pvD_3|I&a2;l zK5xgD+9|??@rd&n`C|c;<$534$k2(=)SYQ z?i6K0wT+ajfgN>&$L&gO@_29p(=;a8tV0q#0@~T+Vob26+ zGOK=fFr5$sMKSIxlz$C-?K*h`lGsjpp`!UFb`w|%WsH-=G+UAv0#8i=P)JcpY@I`0 zogOPGl9b&famoV8t58$aC6^35(6FSgC$E*JsTnzd!-^I&57S4R)`gvdh`;^LZ=R{SusZEPq{7~iiD;U zzc>)Yoh^7lLtEph(}~8os-3}gm(DmPaRCMf-4k*&PKr279NJmc_r8_}g%`34CEhjDOn6AmdBJtY zf;^^q5hQW=cx{eU;$HZQxwJGeC8tQ3&w~vG(UVM^?tHgb1oah!GkZQ`M$M|%B3e*+ z^{e?UBFHGwLh^J>21(ep+%@d?QO+uXd*Lere7F=7h7Yl*>2fiteq1q@xfNc7=lh{P z_F^fI7a#L{qX~vxMpTmELRF|ZEX+s|IdA7YyKnKB`fkG z)YM&Jhqp zsPv6I+TBfX6`%lK@p_+8D7Fb6w^CMG*P{XUp~z`V-aK6=3S8bcAVEUQMbjR>dvI}i z^6KF5^6cX0_urkpJ>FnN=)O13xNBHaMTejSpy0YHP}5=({Yz8T3x$czS!#5i5(egR zGw$UL*QgX$thrG;zYi`(2^zc=#$SXTYP8r@Hp}cmTL69Ph8S{-{ZUxMNYGgvU?lZXF>A;EA|O1 zLifE5IXr1JPMj*Cw#=!Ww!0QMv1qxdDPPuV83oqo!qv6RJl1UdzX$0=dx|PbdYUp# zUa2kzvg)}&1?eVyKzrep#75WIALZ8^(ah;3ARq2g^{_v1(73O?b?vVzv8)`ZRynz8 zJV-(T9Q_Djg!bOIluuc$ruAWzwD9c_%}oCS`S)9@2#XLh=OuTfw|txyOAR-YZ=BO& zxKB2UQRY#BdT(Pfy03eCy@J+N^}|0Id4nWosP>ckutLU9%rME<;PF(4>euyTeF^!r>P{0Ye_}rCCEbp zHRHTuqbj5r8&c`Y;81xSYRY-fxr?>GEWg&$yQL+`dFvNiRe)=O*CDgAyyEw7|5Yk^ ztqhvFat8>HZhb-8<6|`Tun!m}{`MsZPGBW&ky{&}zJL3#ZxB?Yag1#dP?cAB37VW@ ziBXF>uNaQ%`-!)iyqG2#BX2m3UP3nmmjCH#a{4vhzW`!>-L=f2Vj|^buP%)uE~(|o zX$1Kw4pi3kkc$FPpj6lcctXw7&urRX}jjXs%EGa&0rk}i2BQWFsTNm@XV1)wGinABM=KazD zr4k$JB_EQ+Nf`_w#D5hgupN*$bex9H`i%&y7ek}Shz;_*+hbtfS!j;?-|7|qHu}(# zkX~2_{ww?6!V>Ir_Fh9~8s;n#0WmsioDRw!yO;8}oMss$Idz;7z>uG z?^-k(#VN`bp=ybLa{gFKk?Z80d~Ps?Rtuc`V&>tIiZfT0d9#G0?BMXwi||HZYhY7R zs$N%36js%81Y=czO2wN)meM&{b>eHN44rD4s;+9f-*>)?UR*n zPtM<89Gt#Bez8IxsnWjtWMv&2>lvVA*v z%%(dIOcPesgR1_Y@soq^!}tP)wKn2iWK*seq^H*j@6p5;B{4bQ##%xUTr(!@wwF6U93+&F;nGUc?9BwLEAQDUpp(i$kqmJQUQG*Fcf>p#}k z?Y1@2o`3!E@Xb32-tCtZ5cUZZxT5mK^V5)}`ZvE_n9lM| zCN{WE_mZ+sSfvK6q^$R zT`9^@Tpf6GoHgDs*dA=l@AUW4^arD@uWzldms;{k!gBqmLP3=OUSHoXJx^9CDR@Dl z3B?Y6x8}yp;)DvWefm>TpG+X4zY%kb{#@&V4?7`qS;y3A{7%pS14#T=& z=hU8fT`xM`vwkPYd&J$=z2dG#Y~VsCt_VWVQHv0hjBkB7L` z!+0=cq9Ce>;8%@DMArmXCV5CCn>CT|bB+XUj$~iC{R<5dZh=LYzXgK!zy2^95PdZt}5N)6e51Rs7 z`h3W-W(*X?{XX-r31IFl7zCs{ns~U0dfg^^U(B5cr$I|j4tVVr;3;``@kW`8yj%mzdP$(e%i;Qe|B;CX=4f@k1GHQmLt1(*EzoUH2pwU z!&9ot8vU#T(Itd#9g@1%UZ*WG=vQ^h_;=0t>rP>55kTn;J}yX%Y-cJ|N!_>P4Du3= zUV?#l8G5cHTit`!6Oz`~ElsYk2eyfmTOQqQsNj;~9m@b{PO%0(Z{4ay4*x#l;T6kC zJfZ^#)eV!evJ_QxBPK|QLE{CHtcL^s%#RX_qN;?Ril;VVZY6MJD$uOpqmULGN!+{j zIeg^Q&zjN)+(koTnFRNCQn6Hw@m=Or`zCA#fd+?|5dM7SM&3fLGqS<6Vq@yY-LUK4 z7)_+Ws<;@>Tffn3+S(1;!A?8)jpoMj_FD)6@Ifz5i=0k?KH%L-2pb4t9`uzO9tE$} zvZs)b0(c^j%x5NhLS}ODrh=FJU6~E0tYkTBnQ}nW0q`mm4%7M35vu9YF&^s##cEJp zgw<_MMMXf`$#qPf#h^+hx*#<$8cETt>+OZ|wM?Pk>Eb*$Ev{-2x6OPj(?{v&8tS;! zy{wP}Xb4h2^=`_yl)03<^|Gfso&7&F8SQq;Sa|bQ1PvEdGYfn`-o&gDVDKP4{4sM z9&ouOJ|H=!^8g#sII+JTzdbm4gPndM9YMvN;WjyFfxO)A@+M$F`}sIgMQ+4%yYAVh z-#2_P0K06&LYfODHNqvXyq}^JHzTD|{Wy5-X`GO2n#X)BNWuq-xE=n4$&X+l*4@H& zbm#19Szr;>0f~mt3_HkpG{s}UTEQa$EvHWp-X3?(4-SuCkZ;e=j-UkD3(wa1_+ub1 zd0V_p{IdQlTrHm-lix{^lgILZ|4ttx%6^R5jSbOE_+V-RfPooVh5Us$iFnm9z=-d4B%To#eh@`<(_|l5IEIW^oNxUMO{n&X*CO*J8^o#h z8bYqRKY*##FyKtZ4nBIc__PprOV4WQ3E2Q@oRH!V3(zk%~$Lg=0%o=@*cIUz0<>N;G6 z(BR}boK8*d3sILwMNLXd8E2{?{M50Q5WVC>Ngn6Pco3%~Li?L*JuhQkiVVNhykA+7 zdRk_Y1lh{q4Y4+BL&_R8h{^XkxI7H@0GN`6j%2> zDvm|UVu3&gQ9plG6)B4JWYr|FdzzG-)&A)4J>lm6)tnW%cq9ZRHtV#4%1uzesp20^>XsAxouFfmRDxlV9#97BF5i zA<-nIqd0_mS2iN!I;QqY?2l7m$pV~>I=@@H>)=hSFJ*wIj|-D|WoM-;(P=}c61fFo zl67MeHus`L_Ese*p-~#sEL$qifT^s&xEFfF&!||N)*rx<_cSgfa+eL%Fx-H zNPa#o3fR;Jn#%-aTDI0l)KtrLM9C4BfT9IRz&76<@+S4k zB;-JMMvX^|{NjhU^ZmWxS+HqI$MsxHpXV&+Yf$MRmSoTabpQjepaoJ&6L}9R2HjPY z4+!zDZaEjlZ)2#Z6Kg8~Y_-doyh;j=J4`V19!*>}rVCscNFKIT?Jia4-A_7xOS5t^ zP`Ug8B(_@7PP5(vHy2rzS5r}HL=0Jy5E15aR$%$9`b_6lH;>t*CNCzJbWO;hcQI6W z=T!9QjC6F34K2?(vvF#M`wNIzZ#;Ou0;YSvXf(~>pyj{@p06C9op#RN9Iuctp+Y=g z35UV|auMh;LY}kW5R(rM)SDhWfXUL3OOP{Qs7Hb~bi&8QPb&8K7{8r@2v8GvR0HMt zAn?LZ`Ct&Ig8-ijUefUDGN&Osr-h_^9H$a60MGET7yp2c#=rcdwF_OpekK22{YPtS zGyJ&yY5yN@{=G*2F=9f{0sBY#?S_7-YPK6Vkty74sFi!0u%UOMRB{E^jn+EcANROV zBOd0Ato!-O$?2;zTlafv!&^D)lbrSKo^SYb!f{{JPDSnj3zIk#EclHT#k~3abZ~Kc zfAjg)FHH5K0pCl0kEOmdE{YaZhiHM|DTelNK&{IEpS|~QYa>Sz$M0{y3ayj70YbNJ z2ua4f+4~Y;GJGZp9448aXLb(DZrSclyVcWbL)ege?cYZwsaxt+|FAJ6vx}d*onT9< zQmIrbmFh=ZRhgTo=?!=vkx>HiKJ8YcSbM`kI^E_a!S-|2#+l=YkI!N1&)#bE@oY{# z^yHJJTc>K4e}>*mcWNH+Z;q-7A6w8r@G_{FT;JsaQWdm<7Yh|ypH|A70; z(VL%|o#P5od5YJhA1NH>syp9V@;$u|rG#5>jjn+^4jirmobR8ZoYHyDsFMSn z8Ig=Z(d*Q_lclax_xbFuZv(ECTvIsMau>*=T3WqAmI5CR#mMmpk2Ol__!Vh-_G-@kLahRF(?90@N}5XD#6n-s2T8{yW3r5?f~2f97*{&55ov$<}7I) z&ls%+qXKX-eJ&+VWojoiYWhwnWQa&%WC4CWc}J7em@pD1)zC|T>kD55ZXvz~T)4-i zUbjBAo34hXz-7s+p+0IJIA;eNaQ6TVfcsJOp)g9#%%j++@F*Ez#tbo#g8+>Yj!>KwHqbit402P*6%glRS^{K<42DmQ6bHMEke}jgG8P>dx<&3ezI`GPG z*P!)KL3$4%Gt#qHbre=2DZiJTyO1X=FXeM88*hR(7|A6-rCRDX@xx}704@W5rp^vm z>G-Zt)Q2UQsF+*PO5F@>E3-5qEVzuL#juVz9++tFyl;I-j0j(R- zVP#wtRmyPT^e7;5OI*e{!GRy*H#*ar;LjmWVhuc72fQ)U<}kVo-mOQ?&ch|Bt&^2Y zQLAC;9BOyL*>$Luad-~3J7M%PN4nuniT9*(aguI&=^2r4R>Z0i@LIUS4{r&umB0&r zVHy0QH`$6rF9j|=h&0X5^lP$>v<%n=z@=eR1FkdRrPgMxz)#aCh*RnbOb!C<&visj zKOBI8SoeYmJz1eYt98bkfu}$JHlkq1k?E_o1h^T9^VE+(%fX=n9|j~rH}yz2z<89I zgryNG7f7%3m9jZYqxU-KTzCamk}t-P=+^N0;q)`}BWi9k_1F}EXN6VuRt5;YI_f^^ z?YwYa`3a;(fixr=Gx7<0WbDszfW+ILx2e1^Hg-IjN4;# z_1>}?h!m~4>OC^h(G}(i;dCTi9HmRW44pQUt$_^BB~mj=evD``6RwB>_@1Qk(+fsC z*Q8`oIY?cHIK51_Dsv|CcpqKYzgwH7J7fSj)84=JBnP^0xb4|mWFGg!v}~!uNg@Qf z)xlKnC*oxsYy4I@d6Up(3{!eM-A;?nE$Oflcq%W}1Y9LER#rUw8;E#JNkz0DicEUB zN5(ocb}8`WI;sE;Iiu@mhK91p-tnnbAe8|hr@hk0nsJ)D>iCrJ#o;>|k|7+MGlIQ< zFqSC_5_sqb<;KKP;DMGtdH~nyGpJ`XEP0DkdhhWmIygQ&<7&rLC@WVpKOqnqxdB=q zL<$=u^qG-)dy{icDPqRsSP3$P2Qf*C&tEFds--X^N`oRBz-xOrPAe>_8i*8oXasW+ zr3Pr=qM=9w#)hzJP}}xK`_cwnB~&`4aZ=8MY1$>ovRA=_FS;*wn!h0^$J=V)s+G)R zzqNIE!ZrV`Es&`2Wk9ds48bAlb$6a_t{+7WF@f#+a1}W9R(OdkUCoBrn#;OgJYsy5 z6+8ccV;_%<*I9Ifjv&xctBDR#)6g!f>72WV48Do@0$IJ*qvHj~dzJLVvf7UyPM>gn z?}>1Gc$9t3zZG9P0~N_BtY9yE7v=u#MgfGilyFBmw5v zcN%)a!UkWc%R~-MUs=V$kKqROUUZivR}+$v*r#5Gk|M*8^a{~QLPV-i5>IG6mto?$ zMZH12Rq(1qEb-@rE|MH(HzLVwh6r!Q5M5YbG42F0wt%bW`79=EMgvd11ike`f4+c# z21dq<#J?m+wk25te~GoMZx}M)BQfz*!^t9$m%Ev$`ZK|P!0#J3s8@>^Z@Y*|BgACe zTD$~&6DPn`gpNxh7Z8gH_WXK*A>!Kjr3JhbF*5r}bYyR%=Q2J$6^PjdhJ=x}trr`) zp3P-Q9fDT5krNwvJPo;VgPyHt6XYpplN(<}Y~&EL%8jogHgbqr<;GVL8#%wwF;ctk}TX`wqj0`GIODN^agQ<7-E#w379T+j=1&h%m* z7cdkltPWqDf>VCt6Lu2nr~;!28 zsdVsaDa_HtlBl-{k(!rZ2#pjTc_ z7v(1P&Mw9br`5Kv&2rl+WuJNskk)8v7gxy(Ch2Z84c*GxJtY+opmMwlHgjYeE&!W_ zDi3|#^8_qkY4BI&Gf@>cHKia_@HUq*KateYGY5P?NG>D55-5o0fma41gUooZVm4)Z z6E2nVXf<*Ftd=SG(*YjO$N*T{q`{c~;7rm&w=vRNb0IdmP6*>D>~$+0ajU7oN0b5a z@u44cG~j)SQa(^?*3TU=Ef!UUEk zoO*CjyqHU|s!rF+mxmh>O(l2b(kR5lTZA4C#};Qk4TY?k9fjQ`{q=Pe!U@Ye8Qj3( zF7jcb1)@yA6Z!3*Fc_^JXt2QC^_ zfv*Mb2_Duiq5Jg{2jHa|h%=KEsRb_ZPr(E5+KJZyS2U>wKE@Fq`^j~x2ywE5%b9k> z+kn@c`Hf}{2l`2r)9_O?q<$}cUm`TBTJe*bvKubuBNCrX_@xy~Tk4Tgqs5QHK>&V6 zGD>54dyx)&O6fEp16enPgdRMgOD*^{{D|bQX#eyWsTMbAsEVzKA#mg~cT96~ZVA}% zHgFOKQruZ!L-m04R=$`MPo(AtFE)F)%o6ZNi}6S0fL4Sre$74Yn`5W@YX#swq-vK; zUjUwuH1xfC5xWHNEK|H~=6T@YTd+Rh#yztD95e&24GHp>kiC;C4OXAIx-~!g*6{7Ck^3|PxwU!9e8_8I@7ol__jmT5Rlb`Q;D0Egz!Eetu(=&IK74ht^x>-urVoXasnMC# zIDE?n(4s0dP!w`92w$<=Ec`m<;j+T;!#A(3eAsnA&e;I0Bm>_gN8vcWhFjxLmMvkRRsd?Pyrud#^C7bagnem1) zFV&okXE^lP{GR5V1HbfQE*LqD2|vF4aB83F`?EJlHYhnd8bL~r$Rn`wEQAJ7*wJJy%o6ayk7(GG(_lK76MZQo&^$RgkJ;jg1T=7o>%%& zje1`RoNHqPc(Y1#=L}{zCSDc@E`3krGjf=vDPYhL>h(3tUsR8YG}YxEL==IWJd0F5 zOc;+8*{e}wymD_P8eWZ_idJ|q`3JtlCsD#&2uLnxFf+6?vykxq=^F-A55z$r3gd6q zs)CHoN<3dRz>+<5_=CZZ$^?KKzYp5M=VM|j=gr}oAt#dZz1`jK8+z*7iSTJjEQ%3A zOJQM&@b%}oI?^}iJ|jAaa{9Sm(u$qM;Wi5(2O z<`*)6mt_}Pa^@D`_6$N+;LY*}H2_|dBgg>0T!x_Lz{|1#8Nipz0aOY+6_uandA6$n z4g&ITbC!Q`ULANoedRp@AJdqeQW_{PB*>zgz9nOJ9gelKk5F%9j6;wFkbWV?K|q4E zex{D9lT}7fb>@#Dy$XmoCC&&l(wWgK$D@w#B#V$Z`tdfQu`?t1^4j6LG3$sK4tvk+ z3H{7T{bT;AE@12bz5SbB_|G8Z5{VU?5t-u?6%T?Nz=EF;isU&wzV9}8zh4fG8D(}f z_z$3(ZbUd{B2piVY}U#HZ&RXGm3>hG6&V;Gmu6rrV#ZkBg)d#K!QhR3g_@15nLqNY zYVbp;nPhp0pvwH<2Ss>%gXs=!09a@~TyK;mnl0$~%o-Kcko#nwl*TBfiB;|hsiJaP zA@s_$(r}*=QVLM5 zP{S%wEmOprYGMF9CQv*5K>74F1upv`VP7zTTcXwNz~_Fruj)xJ1AOj>S|Mr;1+Kz3 z1zw?mRst_gaJkHyS16#3fag`v6@eEN&}y=msGzq4uFbm&c$o^i6z~cKv=Vrk7Pu;K zOaAox0=`}aRKt_qp8{&m=qqcVMP%+@^(^9WTfI}qty%W(65X?i+FBIP;;?tBby~oE zMU~USa$i~BG%>PTLdykQnYy`@fU8h80eDW|OqI>k4+mMGjUmpOX`2a&=Y9y(dJQEC zi$Uu*=satLro5GUN8OOGsQCmy@P=AAqU+&zXEm?UA|&V+OHiAYcV%3k8A-b_6km(j zxJ@orJt%}UBAzJ6?lgbb{C_{3oxJX7FrSDQpeMiVzkLJTk<0r&%;p7xrdgj3X|JMT*Ml_l>oSnb=+&hl?OJsn99mt$6od>y! z4(*52m@||`!@7Yu#CSorjqPzPdZb>fTH&cBR4oH|q4ZOJODdT89C!8E?dpM>_j5a3 z?Jm9|$P(aOU8}5KqA*Z;omT8>l|oSlaFJl{dYT7#7MSm4Rpl++VQx5z2#(PuiAOl`=c=1X-OCmM=mv8f`V+zukqU2U z!F-sGIwAqR5*a)`;dvAgD4IB^DIThPY zbHJp8PSxQvy*`{q>`Y&dRl&G)dF82WX5GL;-)#_;KLb$3Vkg_vxy_R{)<@ z0e>CSMN|SEfIq(-aBJ1PCMEMK>gB=6h6zkm%_{+(tD2_+w@0_20ufY&`v$PHij9$~TS=`+lgr&GhOttMR=#LDtsIu2_q z=v4xxB-d+6K@gOUunN9BouDDCVGF*c5ge|QQkl8Yu z0x~_I^MH!(&Z`1q_enmsBK>aA@afaaELR0UtI=;MK&6iA3Yy(9T>;uDFTh{{Wc5YY z0hQ2hDL^`qACn}4l+8z{XGaJ7=SPSAJK=Vng7q-h!}$4mvehQK6u0E(Sp#z|9NMh> zK_Q!Yn$N#7oB0y85K2+{N`((f@mWi`gYL@Z4y+{lx`hsGD1GG;2R4+xa&ZG2N?*CG zfwJw@7c{tsdIl9Jm6tNOL1%YX$)FscuUommPNJ_`v%red*R57yMd|C-DX^mSbt@DI zl#+m%b$7ubPUfoyS4_P^q{>_^l#z&fD^zgSfQuB&2ddJe`Oq(5h=S83Z6lsLI2DGO zg$PQxp(dB|0`Ps)EF|z~06gcD*a!=Q6KZXtjf|jNf8XoAtx0-X4?J%PEp<-G0q=FY z*1X0|fS1}qOWjn~IP+2~XsN?W4*1^EGcTz&pa54F8L*TVfKl5Gb$x4{feO&FjVmgL z`y#`t_Tq4*M0xR%5Q!?aTsZZX^uTF?yVZR5Z7elB_ z9F7CZ4~A3Ge(*nUzztF1lQv%JE~o*A$G~$u&FiEZyt21Q4fyx&Gq+d&7@Y^6{Zn5B z19&>q(zKt$hR#6cz~3`|*PmAaUofk)#5#bVY8Bh$-wE*X#eMdXJu~naE=nP+sn*y;7@m}ZF+X#bw0Bi63gX8 zSP{74J!=8J`txi#aJwI^2K@Gqv$eo;9<>_q+ds_$@YGS;tZ|_Ycce_3DYwCk+J=Vr za2pNh*YY1U#^ZnpZ>TxrUv8FTW#Zt){-xz1(}sg+ilBzqkj7I@O1Xz>m}XEHvGv8$ z231R{^#1IPwNuki4hLp^z_sD9kS9R-$SdLyY0|w0hY~S=dmO}NlL0+6SGP(!3{@qc z997nW!$&Q{SrZ(LTKl)hK@nQgqH-qiSTh|Kap0!YveRJ^2c;xf8x9#e z)Z>sN!74a}B)OvTN8#UQas9kOugI9r31sU|y=dNvUgAk#IkHxY3~j)rv_uoXh39|A*?DjLOwkX)yc4*X*hCNU1s8`)mHHg6+;0?$7)d`S=u^CVW|_xHL_pIX41&&;0)Cy6Cf zUGCwOH$<|b36K$je$|}re%oLP=gM5EtB%&B$lc%6Yg`FdcUxY+3i91PE1Qt>kC3Gd zl7CmbV-9KZTJsfHq{)NiQZJHAFiDe_$2;SaiWid~l#pDP=Xe#^?5(5#_O>457O<9A zk`(N^JjKhw>hB{d*mZe`r(o4Ten}muHE0lnkSihW2Nq3##ZBK7;g)cazD5Ldtu?Kb zBQ#dd-9yJ=1TtU01Q@?=r~mwIh;TezfC7|IG=$_Qe#jCW1Vgvgdi3a#7TD;a^EZRm zxv2d6Bjib;GNu{fPzBd1Enn7NRnfTH2zyXul@XL&Q55hE%Lf3p3`UbOv)>vHha=2p zEgc=?IG{$ER6~DnAtdIP3(tNDUY^CDA&mIf?r$&KrVsr*!Xf;(t#vX|BWTX?FW*s5 zM2Kc>jVQvGpf19%wsMzzhOO4|L`+_Jw&Nh6R}A4rLg(Oc47BxW*ojFJ`{WV_{9XkS zwSe34a0huczGK*DWtPMG6RT#z!a=<_#&Z8Y&?rV2|d?74c*FQWgYV=uD$tMdqZ z9$%yl!Zu~mX$HAkqL?ORoVZ*y3{#c^N=TmonS}}Bz9T#){Z`6F9~UDsP6E|UIS~ZR z;3fXI<8aJgMmU*u652@u=JGF)QN?A{v?b z{BTXf)3+7UWnt4Q2A3*65v8Hc($ie%h{^K5TSzf_zs2PP-@i*_CXjvLKa!LC(7UBZ zs|>hTjovO;!bg=gq&=>vtHxO#9UU0#N`W#$jWSF# zUyV%eEI&#ng&NhbcukVT52sHcFAnjZ@U8PiPyK?~6Z}NLc%oozS|rt+E0=!A^*iw; z9??Z2YRNH@EFw4CFxqx8IUXT1%|PGW6(HbS#@ab(e$D@MO6n`EGr4t}Z*$7p{-m&$qLFZG9uhaZ# ze~a<8+d2*rjXj|@cocMmZN&U}6kIEX4^1dnY^13W=bh9X%W+n_Ih*ZH+vdAJhHY>B zx4#KA+vwap-sIfYMxDnyXcQCt@y~#rnczZ=AvmUw{_^&hiyu!0=kNC49{p90&LwJg zRPe>fogDnDKI*jeYr;q;QufhOpY+jR{&u$i%f;a6?8DI+{O9=K=t75_>&4aIl3u4L zXXk&lA;pRDO(LeTLc&_g(c{Dvr?*h3>3IVrC-ko88Q z2-bG3$+oyl$Re-sP%xQ53ob6;0^x^f0!6XtM0&L;*atLBVj2W|7#b@ZFo(v3{(!c& z{^tBZ<0~9{#B;W`wje~9#B3Xy&i&~uL04GZd1XeLt*!4Cj5w3Do9qJD$nUncq`Y;} z37_$m&!mfCszFcuAP|C*GNJ%x+P^Zt=vs-NpqPw_e@SFIIo>c0+cGF7Zd(#pUtX@w z>w4v_S)|xdM}znh^w!)j(ln88&Pd|01Tw~sQ}Vk)4!Y%Z1ID4TL{xI-(9W-G0%@Ir z!Xv#n8hIrAfMn~GomFEIf1hoy3=J+01SUc-SkXzfHx3-`t!hoosivR>QUV{&r}C;% zZ4SBJ!cLH7o1^!POcntO{O}`dEs?A7=rpgwFVmaf0FK4v_z0TD(qxp@e>{Bt$e)}s z^o(4Rn2}SiS|8}@mOJ-WhSBYIyU+Lb;J@8&H}~J(UiazFfAn^r?e==ldQW$H|IzI| zf8N{u57b@jOiMlsmf-k5y0?avpWGkh^9cRFA7VN+E-I1<5O4t+2+_i%X#$i2&`KVe z4O?3Xp>vVjIA@-aY3E{PXEmrkm7UNJI3iV23OJqrapTNiR~2pU5S80!y?BsK2^SGehd@ z3a9IM1{LWUVN&ZXBF{;x>1KX7bz7V$TkmK>wzgDAyl{x{IHUQaMM6Ar(3e2;nX>MR ze!@5})^Cn|;Yb2;Za^0oAr2FmAN@d}ZZXSe3KBbn&-hfateUsUNPrk4!9-Or9t_?X zHhRU5urlz@q^lwwslth^aw@#gb0GLU@}v4;q0FSr3YhX@I?00>=D$siyq?9hNE~SE zJ+rEKd?m;FFwlY%%}fc!IoFz-i7Ro!@z$W7Q2!w&DoZ+ufwm81rd(F$RevioNy+gE#%& z{Lk8qx!k!BlI&vaM>Bp!Lx@UC;iE??!DsPJK>qMq-roa2t%!9YUk3W}g~R^ylKpr$ z)km>Ek*}rb@ZCVTl<`0KiIq?lSEg@?R%T)#@db4Fzm5O?OH3mASNF;0-`&rjkuRUG z%8OaJ9F@i`|J;&L{R!H5%;omQr;GGzBzO+JMBjb4nUWI0@mJOsJ!az>nG;2fFBwtx zBM9yjXQ9dx7SJinnh2^~1ayi((gaGz81@gDD4w@U{J9@aHOiAXrg7Z>(1`ahTAUx7 z2Iea=!co*g%EVvnptt_-4cTGyzZ;Ij$&McLB}RXGiP~+X(^Wb%|Ly$t1WcWe8(P+F!<2XJbyTnMY!QAW-bE7QknwFz!Z8I+hNg!9ap03M zxtQZm7bEIjUqCoiH{FX=GLHdGqZgd_7cs%!g?#xy==*NkUp0s@V;ADmj}RKbcFVUJ zQ~J>-7cv9H|84zm$K67mtd&|fFcMuXVjulqju!+?_2tyz%P+t<-03vlu6<1q>6S~~ z@W^GZj>zL)hV~Z=DKhl#1Diad8A-CWK!0;If#{rEk~sD~;=IC)IPc@2OzQMIoyTB- ze=LP(MB_vUTL(3>J_622A7_caAOTBotRCh^ns+Y~!|+)(M}Vs+2t5|fu;&?AOlWKh zgfGH?wBw>Gfc%>paFcVkviT_EsT8z_F7az&Bn~iuzq5zN0F&ramMBZ(*)l2Y45(;}e zOGt!zZicktO(fL^&*RD)B4HBygo*3|Kxj0>42=ln_DnJi?Yc7m*e*H^RpZL8-+~tW z^y#ie$9>Vga|O0!)ltd!56UTg9+cAu<Ve?;O47U%J9rZHv5Kb_e01?7|}4tsv6;}N|iZsAPNxdNxwIDTR{LZyUk>W;(p z0|?A}nFp6*`P4+_ko`EYgXpbZHnxIUQaK_PzHeoe2m=O5r z*QN>M>WCR|V1yQw=yc<(%r`&sq!AJ)C|-nI!1N2mY~Y<=hwIB6-L1az67JW2p?dh- zkgWgLM z0l!W%;o=TANL5pm3H=%enJW=*i9(20L|KIYScNAuaB`82;Ud^||HcL1j{CP(YYQSK zWO_M_LUN@S*rBm-Hw(Dtbq$vn9A-{iS;jLlVNmcIMHt%J@+e0d;mL%I z6As`{TU)Iyc*WMy#A$$a6#EojP+s~~cjw1%kI?Y|ogMwp z`{T2tL-fPR8QOn`P+ie@_{`mNKMiG;LiMfBVB`@V zf8;6aPXO2AXQCWt3e0t0gy(^OijuxSe*a( z_b!_$?vosst)svR?1fsjDQ$kNwWatE03R+yoHM^mfOnrV9u|yX}T6M;hGi+d8cgPD5hf>9mRY8I#~pPs;*2vK~6Pr<(Tt- zF6j_)44uFoBJ`ddeUg7|N-Nsd7C&VBTOe*2gcta8vaP^Eg3UQeFrNt^k*nr8o{{lK zG(7qwO#HHJ(NIx#DC#vMfd%?6BoG*GBIbuh|7q z(W`)tKZh&$A3Z387XhET{` zPb~Vf%O^vn_b#6t@sKyN&`LQAd?XPkEaa^C7;?A(U_&eKogp}KkqQ*mXY}Jf`soGB zDleqTO^uS@66Y*|9}QlL25hK8EQ26DHWcylWyVw2p$#r&Q)4%ut8#oDDvWnrbSh)( zhhnXfV1Z$_NrwC0+z*Gy`70Xc83VplJ@~)PLG*EgM0m*3y zk7LSGscx*o!HiO2t7Iw&C*320WQto2Kr#dCM&8#&w?YgvKw}pj1iqM-pvQ)IX}}?v zt`Vbiu|-v%T^F4#@}erHjLDo{N|z(vo-?Ns<~q^&O%}o; z!SF&p@r~dos4Y%mE|ycBCBW0RbX6BI(n=c2eSF5dyu2oC=%OF6AIK0P=?5lGet{nB zZ$1+__Maq1PhE7vr3e7u7FF7H;=eye8=23)V)K|dB!q}-e$Vwi6!>EjGP3ES!ACz5 ziHO1x#WCE>ul#@V^BRPXPKiu%9@6l;1YOZMzE+NS-z5*Q}QVh<_(F(p0?HGHoDzbGY8S<`YNVZg88qYgull9TnpkmVtKaz zOX}$5T+;>TkiQPiEhlz@K&yTyJaf^Rq@?v2C<=XD-W!6GYia5nr?Efvxk||ei9Csn z$H5s?q6q1g*hhRHBqB?K8YZOi90!~~{5}WnY>uMI5>4>X>D^nl4Q%a`+ z!I95EH*O(y0QS*yx9j#=o*ekLdrxFyQTu5-bxfN3)=s@{vDXXn#Xs;RK8dnk zpXQ81nYPovKk>%!H@`V3j5G64AMO5uX7LTIzqbG9#Pb*PbqRpl{ogI<|Ic>z9`^rz zeAc!9pBDGPPVLTlQS9`rYU4c3ZJcM7+kfYeGl_3v{k8qi<~RuM@BAYNAGgi6&eO{M-}~cC;+t51zW?RBZ+0E)fHTPLL_y8|@AZoLANHO7TuxyXSUW!d)d2_jKVJG@-HflC_O+D3cF6F$u8DhnGIq>%|`6fun`c z#>v^?tG9zqnXNcPWFE~hgTj*FN)j@ErXFiGtRQ&Pm_MS)c1+qN$a1p z6@6_EfA~~=YURJ?khCg{YWct0eb&p#|DA4k_rd;qFP}$`(CdJXa9|dcN%Pr*&*mxQ zDc=SMPmw|}a}l62I0Ig6^PRV41TrML(Jal|S>AF_#f$R(Q-KQb90z=`h+}?kWX@*O zN@V-un>3rU@ZG{wa=HitnOnN`=uu0I0t#=+>3#J1OY0Fr<`8`}zgGW#hvy_~p$*xG zZ$%BM>(ksTUvZcgLJ6KKoxt(P$j71cy%WE9+7gMoWiz7sC9-)$ojFrxgbzB``0qseJZ7zvZ_#BeDU zj5i0@ryY-uS!cmW>`WKFM>+t2bsj}AaiRsJxO2pJEtxkwN>S}29h87{5(#xCxR&nB zoT(6wV+;wK@|@tdR!d{<=H|uh6H74r$kIHx#EGcqq}oA;&qPeliDLf}C&W=}-BGiB z1oKV#mVZ&jw`w}D5|HOn=KZ_^*9)lG1(7R|Kr_Zho=qC6$je8M&~bv2MI18pYJcz} zY|MB2Z;z2jMvEz=2J%BR_e0+!BaIeS8i;J|0ASX6#D{li=!`I%IqA5Nv3RtYrn!kB zPCZsGPyGCYl}Y88rZTED30a=m4UlW|%oHChXmpU02NTI`$m?YygI=o8MtX5L0vr%vz)nPG4^pX4IuS3+<&{lq0SlV8biB(tR)i@GYYDv&XN5QT&w zHl7i00jZ3khD)2D%^%xt;e;(E2=+Le@=Kc|FK-%+=8GWlqkuRm9B~9c$^b(OYe4Rl zdc~RDdSMh{;4AVe0r(bb<@c=I<9*cYc6%*@mher6vG9N1ACI}TxIMzz_tI(F!D8r6 zOMW3i8Ca`o5RV?AcQS?(7Fsw1l21N^%+$(TTMp@}q?SUD6$$A)pNU!>P!K1r1(fTW z)&_zTTU@AHE$udMMQ;HF%)t{WD1AIx&#DGj#G361=uEX&xrXgL3 zuu(rjbLx>kqTx28lgT#t5+~#WM^SK{{v`tGMf$`s4lJ66#Zm$*_PzV8Bg0S~u|Ccf z4%}HX4<5aKf8hMQ|HgT9^x^0YM>|9A0C4N0Hl0k`0^ASEEjC<$vnQRPp)t`R^2h{o zEkeZYwh+ih2a(|$t{-p;LrDgmCb~^Uu*AvvQJ-rbV<<;{$`nC`UFvteU2;UWB zoMnTe1643eOESSZz*VW6Co~rGfU31p3g~ztsPpQ>aiEPN657wNFSPIER!gq}AaQ_` z3Y%>i^NbNuc6PLX`1Z)1dyixecPE(?kmm6g`xU3KWH? zCC|SLUgbEL7##X>AK5Oy91Ed;t73iflHw=c2;q3j?g&4fM#lhcKc2F_feTitXVaV` zD&9|{BV;ncq8?d5r}u{L&p6;z%`dB&nn;_BJSK91SJ{;}&tC);w9jq#iW2Vhs? zIv5}9b6ez2dbOBLNX*)O)ZXiM-@a;p;lJ)n_07K|{B%=^m!m}@qO`OV43ZiwLa2{3 z6Pd4AM@w(p^Z*g3F-)NB_ehxsx3l$5& zubh@%H6+=xQ$nN}%MoN1j(P;86CEjynUhdwM4W(Pk9b)s59UC*5+|AA5G1xtB&-bt z2|jY9Jd(tM1iA%Age*Q>Pn(f2QKxGud&;5`u*0J1#cYIK2~yn_`OOqU6=jZ+T&r5< z%bHg*9*U+vj$OO>E*r=)%<&>bIFaG}BTADdtFDH~uei$h7bfvF7*ZU8lQa|84&~hOyO3J0;A^ENCKQT|FJx+fJj2N^;MSb}W$K>F&VxL)ar}_$jWqOR7%=r9 zY*JK`Bk|k^!^JelV*)0`Mz)GE4aX!(Scemfi)Ge{sQ91GBQ>f|Lx)cIb({&F)P8u) z;hpMrz58gln-|9Fj%;pH`E6g^qfRN~@UC@cdO%5xL1$WUw!nBh6EmJ z;-ruEp6>3n%ohi^B&xE&;wrE7s5caQuVf`BVRBaObQD-a<9kX>*_k;ZNjPEsaH_uR zJmMod93PHwW_4E>_9gbRGyuZkwO&L}E1M_lOU$8cds>S^;(DIu(f1i5{9htl6<4y9 z`FI;Kx(&3Dc|*6g^!t1Vi5EFUL*$-GBQ}kZ3qBsX5`O6O7wst^Pg9dr~fri%csUkK<7G>B9{|50>y`c{RS{?0TZZY_c1G?}W89yEK>k_%b zLC|>=6PCpOIFacjoe7Nrb%nVycG+hz08GyyV}^LEaZs=8ivQzBy7ks|sxtT|=z}om z%a=wZo*G4MVrg#KHl8JA;XnPWzsmN~K;CxRwl3}Vw&d5;jOJZ)opCIp%9&3?Kb*?3 z_;D$WJsVnGiA~OZ5=^)Vf^8Ji0w^$xBOhh~NkX^Lct$D9*QiLLLhY1|X|%)neE;Xc zcIrulgo=aE>z|Ic`A_J-&`CtXL4wC0;U!0_gjI?AOs{=D)R?SLv1S#UQ{KW6|huw zIWXM!z&Hk3e8t_*^Z5lYePqo)cuR@gLMW|3VZGmLc(BFDsHCHzlu$7YN@$9U&nJGV zTVbR;5Z-14oqiA%jg<{gNu?AswipS#+HF81_q^YB+FXRfu768ClGda>BiQ>n_7idv z!nPNsYhS$fEfSZr=OXfOLIz2U6EeNdx!&n{euT3_!i0g7=|2^%9L;ovtnwZ>#=&rm zB%MbBDTfKHe8O5Ln*H=xKcnyn_8xv#FPGW`-hws4^fze<6NOY9_?f+p@MOaEDB;qP z&_KrXGZf$v37ELpQO^6!pTdGJdF&XvOGgX?PZa#*?mU9*1S9|kTkptfW)2QL2ZxF8 zsBhK_hpX2K11K8(oDoT|GZCeXq%-wE&QqTH3LW{U*13;<{jG)M5~$V%ts$b`8@)wD zy?vW%v7f0yMF#nxJx!;s8(_^7zkm@|A=GRz+c08;BAX8Qp2~44?6U_ZePB|>9_!&z zeXL3rO$*&>!=jr6Q7mKT?&zU(ol9tj|iRul!-F8X;U3j`!o zblDaOx%d?~%k=|w_{MSzN_!%3iT1oGC!nRZ5tsAWc<}L=OujGtjUGKhG?Z9yRdKtJ z_K6P{fzcx*V<93$qRH@DUQfg@8+l}rN4OrQ-V)4-E^8k)Z8D?m;P#1TL`kF?J4&1OqAKIMN~9g9Lg@o{iS z0(`BTB@l{CQ$>$|C)2d2U+%RKnqWUz#N>Py6E>rP*GJDlr-NnIzU{SIDaOm8vv)Vx z7z;Wl{Bp@u_PZE#C-I%#OG1l=5)w_b(bx0#*Oovtl^!2*^hOkzi7~t8|M{_ZX*o^!)uo_(QU9sDhu2x9k zeJ)mmuMJz>V@=&ioOB^l-?gs$%ZGI3WT@DM5r;BN&tcs%q&q8{>XP903R z8E49a@IsxDn6zM-j>1dO=)O+;M{WF%vLmsM$O)f(N|uFD6aV?V82{7T?LNf++{mgoLV;Bck0~ZKd{TOD@Sz2 z)4Q~+(i(}HKcC80g}!`Q0w)mZ%OfT(F*&?Q2*A%p-b=WhsAozp z_uFL{sh3TGQJbG-lCCnn=;_Je{Po$<;NoGb$wu zOHX>q3=T#AU^I+yGJDzn?0PuCnqyAt<@cqHZqNub^6V*c9FL5tM>boW2$DLo;#r(U zA;*h6pUKKAa@J~Uyj{aply^qQiRZ|1lH?jWKL3kwk&?Xp?j5-#@psKAfui_WR&%a`2VExInkIG%kRt&NU#)IhGa zTAx4P3H{&Eg!It>lDM0O6Q3!)s9^69c8yh5OFig-(IzoA7&y-xK3PI$>2j%ZPlAA_ zi-f88QI!%{_pT^xSk`YTiJW?kwAIUgJEfz_y$+Ak91~5py*oKPx;Q?~Ni>mxxY>3! z<&>Y0Is3Kyo68cMESQTuFXks9d?)|-(%vkfaC&lfof3+b)D8Bj}s^u_Qlo93aKxlonrSLko6-FffCs zbRUOGzDnZ^=J;Bq$i`?wuF%{M7YSi@f0W}>=@^v;H@j&XnV)eomI=v$p;|tlU7~{iawvHTKoWOIt4%|u169wPKbv#wAtrT$Q7y2F!=Ii za~nl606Wc2;lq`cB{2=B!L?EPC!q*mQeQ>-#2F?~lL(_IrrtutTWIDSxAnviCp5L| zd34NNJ$+CXhuxXcD<`2H@CgQABS%7UI21=~X{^uJx&JR=|GAivAR;kylW4hAFxB>- zo#(yo^PK%>XQ%s6|Ldnk&`e)wuRppIPfPv@eqz85wY3&nTXM$eZpbzi7+%GW4vIp$jMKs z`CeM2d=hvJ;h2cWb>gM>ppB7mMV8hph#ri{c(a-^*$Jp7q@5G_%nxas(guwv#+3l| z$77gQ|7G(<(eO+U5iyE!{%5!v-!6?{6#HQ^LGAx!&VRCYZZrXR88#{Z_aBjagrA&+ ziB@0M$7vQ4t@lR#Ds0wsZH)!BWW_Ut+G4ux+c1$n-l}{fnB|Nli&&TxaTLWgihW>) zG@l~e`lK-@62_crA!*uu(s2yYz{vcP#0PX9aV~2A^<~d}>U6i!UwZCyr`tyE0gf;v zPV@q|<8D-8PAm#wBDq&YE3j-;Qx+PwOGS#lHN?NwJZ>O#pI>C!Pui$`(UA4Z_=Ix_ ziHqsI_(UrwAdSE29*wnxWPG3I)n=LfOlz+c>9QWFqMi2P+I68}PU%l2C)DlSaeF<) z77-Yt#KuVd93e4>^i}67c=|k=rhNeAJM{}kY)m7v-5MC#3;HVX{9-T9t9%hs3>DQae%J_I`zkHYd>Ign>QEr;-G>p;`f07SYHY80RQt^ zxz%fhWN|28*0VL!M4L=dm%ayCess+wb+V~yp0Q`=KUp6*w5oT0abe*c4SXsItAUtI zRX?h}hjj?I8oiOowWXM-+CABQ-*OU3ni|*Ve7XpIF_-FR5Xfo(Fq-CJ)Qzb3iE-%d z2hj|_Tg*|fyAm~xJS9yis~_V_Qd#S|9GPt$%jj&w&r0dihIdA5_54~%-|UTcNzT=5 zPfKxb+OKr(6?U#lGBn}2Ml{ivYDxNNT{+TA^BZ)krA!{d)dU-jlWL(xb(N-a+R~s4 zaj%W0taqrLZdT%0Z@t7+m1|;})~0IOs?pLrLbIYSwIkAg^|IV(TE1V3BR08XNZm10 z7~w58%jYO#-J&cbVsMSNux;|*851Q#$*G%n~Jmsa|@UkbH z*KWwvI@3-a)UyRK23cxv=6jaz$P~Otq*@01VPigQ%&)gGU*~-yg~wsFy-4>;Y@}wG z$pMjdT7@+!?_Z{BSejMAsT#Gcul2!Pd#2x9LKwsy&`gzOC!IZ=Rz2-X`ZXXP z@9D_t+zZL17+8{CdAZb#5)#(qBHCrzq%3!G3>sv5j>~bt-KzfmK#Lb_e^oUMG@^Cr zVKC4gX<`*xm_|t6vRDj8+6bqlN%ySe`sdHWY3p<56QmzpG|oN7XrYuPy0@)G*#$aU zepc3wwevB@C`Wktu^LXTp5l2$^?~|di~3d(o(o@9aRD`EV?BuUK=crD&_Oq9yIT*M z%;xCI0GMcc;WJTUKzM)Jy6FK{H|X~TO*A*pdO&)YneJ}d$ni5}-P_~4BJgZM4Ts}; zcT<7#ugIC84vi9PO{;m-anpmGc<8rgR}%e5HFM%sUI(?rUVq?|v*NsSDoqdi{0mkA zzG=ws;Qvt3ZPVzNzjzkY3I4tP_jbDgD`V)U<5;fUm9tS?Q)vj%jsIDK!194BiB&d2 zkz%XSt(tnv(s0T7>f|gXag|kQSyJDc$oJ2djptQKxC+S!Zs?gHnqe*3vXbO(>pg?a zCnaY?5(R*68*M-mZPdOLf2Om*$;?fto6Ly#3bkcYjW)mMeECu-VYA_Li=SLa|c6<5w zkEhR`Kg56B$43iNr!m@afA9ms+}8mep|+@HkTX%YH|?#m`WNj@i`Ro$B_jR3P$?o8 z3~x7F!-0~kT>sGzy?$o-Y|Tl6`Gu;VmOXD8{ca?&PZLLq{9{p6K2A1)0uK zYbj#`aXB?d?#tV_FfKg)NUpchV{uSxkItZkG#Va4LHRJ~2C)!-BxB(P^pby_suPxz zK09~o`MrW}db_1)R@fTpU0w|+NLAG%1@p8pv#%R=`0)8gK1-bcxd$z$u|809{`YpC z=JS8;?LE~0zn{-%EhxN10g%xR z*rca`7_xFj1;VNtRD(m>UC+t;a6sL|X9@XlzMMA~|F!b}>GN(u{_pHP$p8EJG?4%0 z#q2s;?q@dJX1@pg|J~_7zi7vU;qs6>73_{7cY3YUJxcz_r$N;@P`OfKh2V4;`5}(4 z57To+itz|1vu*Tvbe#~U$??yhA=RSz9ew!%C_Yx;Ng{u^L8E6+NjT0UTa@Va2U-)B z`?AzQ=a?s*Sus$IBdoyi`dKl|zu2j?g#4Gz0uH+zFJ}R)mH&Hr`M>l0`ObsXlZS&0$B>C)y1&{^hcJ&x#9?#1j!Log~;i}9Zky&i^w>unWfou@B z=5lMMK8^WI>jGyLlp)keou0PY+GgdLWZ9#drG*3d-{A0j_$+h&Gg)kEN$-#P`(LkD zxc~K@KYcj=@8eVD_-@8ty5;6M(d6IqFc&wrlL-I5AT2fd41=^{Nx#hPUe88tGock6 zVN0veXi&8_^%&T*I8|X|@rnG}eEjfP?X#5p2kyt?F5IK{7M7-H7}ch;&bcDg^$3-WV_=o?tHrtqxgwOo$0@DaQ+Q*!L(}BH z=DYeI<+IHBpGBxSV03J13aUQ;cb@L-Jz7~?ItVg@3 zk^v0MU8b0pOGErwsfsB`5>hW!@Uo`*w>Fm~OJ9>z&9q!8X(kgt^b;)|srsfIblPWi zun7%FoaY4X%W~j)&sE?jB%b>r4DdR}V{%GjpLzo_rlF_fQq{~5h7AX-r3)D^Vn4Y) z5a|o@Md`UzH5z16Xu@8{bP*XymY)(CgpB~!tJ#77QXcqXna%NP?z7x9=d6K48#Uu4oSH(J)|28D8m^>)k=3M<1uX*GVNeH_#o`C*66 za^E`R+!r@F*NFK?&yQugD%(=dIlr6=fA&spZ2%j-Xy|#jyXpWFKlGaPMb4a4DN1Ij zi<~+BB>vq)PDm5vh{9(s3vt9|G-(@O2b3jGCUg;cZFGbFp2Gm4PdJ`3G@j9`5IJX6 zTRdKb`%Kov=r1D*P?c~2Zc!r}BBsciRTyalijHqN0a>0^#GbRPMN02}lNHHzW{Xi} zSNVH|bR1Vmh^16WR4+JI5EI|BP+0byTag_bGM^Pi5?- zb-&JOXCQL3?xZygB6W&M69u&5-e%oZ-;l9JO`u|0YsrdLQ%r5CK7_yqylX~x>YH*0_%%sCh{qX@ds^J+j?0asER$y4Q3Xcge1{~ zNOJ+wOn3;XU<#@10)z2hg_5G?)7VdWRyDPD^l*n3%5T&)= z8WKbgUZ^>uN{%NokCN*{KklQ?O#qf|ZI*9bCku2j@S=3Ki^#(X86+`I$n;u}wvbT7 zY^3EAF^eah5fS{?uIiZHE@K)5emH#(P5LNY1VIZ~d>|U=2ttG%1lXUSE6+pa1)TT7 zLB(Y%_>bs-3Z7BoV>prMlbs2YkKhbk|YwL(GR9oqOp_eVhpgEIP-dU-)^mRm9= zmUS_a6CS=cyO)J+vo{>$2K4)au)Ja_3sscsS^ht*K0_rJayFWiDi|~WxoW(D$D;3I>a~2A5cZhrY`j2mi6F6 z|KLNfeb(heue}lL)f9|m1=rzt7SoU}*a4l-{RFk?WYXTOqu}6|cLzV7oxD4FKe#wJ zdHeSGyn@Ti5+xL1H$1KRF>PQV*R%fg(!qy|`5?m}P1tbD(3!goQ)r6A(lX-i<-$Wa z!JUN@tnN2opv&Q_Qnp#fEq;X~7W_hv!b@v23*;mUpl2IxK-J{-rTD8bUVAL=CvEh2 zb2+~=^bo2ce|ZSi&{*UlRO2C3;~`YzAynhvC{*JPOQ>dUx7MG_G?wv#C3K!If2x0U zSNIA?Mr1daUj+sQ(gt z)%}=wsC^tF8ha#02}NQCY8}uuU7(N7p`?KRxTSFB4VKPDO^fuK0Pp|Wz?7tZc=F}rEJ)iN} z112TDFY=DGxv3Fzt(Gl)E~op0!B;hG<&pUpv1?iRrpmTyMN+?Q-<`2#mL$>Zd=w!< zkvJyu-&!*Ni%;FPNJ*SE-q`I!u6jwbk9Lc@l6}BiU774de*GK$J@e2yuh=DH-j<8j zcjYb_aV>oGZ=Wrp!c1;s(1MLztBr1%b4KPB+^CA38@W?8jza$e_N0Gz<*2Jfz3o_{q2*_ z5GzA#RgGW(gYhr3rHBILqQ}S*{>^W6>(Ak!4_!yUjZ)b9 z1m%VPA&bF776bH$NL{c@{Qu=R4FO&%0YF{-_wG(H{=fU|A^!h9K2_yk15d!Cd3J3D(1`Csnk(=2}DZcYi#On>APqM)YBfbn(a zX(^;pQ82RnDV7VMY7|iHy}|(w$Nac5LK}>6+HbUmZFz|?J6n;+jh~{E>g3H2#x_40?z6o9-`m}NkpK7c zxf99$Zz|NI0BtDAzKI_H%L{i6x5mJ$fDFKJbB4pIvH+F++6UtXQ@mo_O%7>H}h49zI{;Q@j7qj`k1V9=UUGbr_ZVzxTAe^Sqbe z|GnLZ{eLf?N9a_n_27Trv|7JrfBd#FOOlB7JDsbmE8WqV#?#Iw@)^P*qN9J1apJ@z z06iE7nIrWahj>cnT)|@3EFp8WadLL}>g`}tsBJhzWFE~h^BJNc0$&j3kNm(-u0h$N zAz}#*Jsf+?8PjbZaXFe0R4m6@PVM&Z5hA^^{V(KTe#mF7gdFllw|LaHxjtt%= z@<{he-t>pdwu-wZ|FGWBx2iWOyb0mGuTFxU_rvf z1GuL#os(on7Qh_|jW~Fq$E%-C&&(M_G4))Zb~XiXoW=wq0hpf<)@nH@BRlH3y`3j5 zM@(eL?e(4@8jHVn-L5kt3Et(upMF45OfP+YF(xr$i-@bve9jz)Md*<@xaLdbhm#ny zBwmb@MNA}r0SBrD1ah^`Y08=WOF=3i3I9{7vY^zX;r!Z>Ukv+IEbfRzeOdD|ra$Kp zMX;${U#4w)An=UnWKwJ>=c{sO8lG!>(FywX6vuc@I2Zi3@hD3F*hGxL4nu*@5(dL$ zzoKM@6UCuwRN^6T5euTi1O=E@>#t~Q>)emFw)*Ie&l1GvE@#Z-P8kAWI4H5l--o_! z75FkN)K49c1SBEwvrcnu3s}i7yJbC!M2^XvUJ{1Xa_gj}^N5BdOc=t9(Xo#cwLvq+ z5DOJR2aP`@f2U*=KqoW^=oL(quRhZ#o-WuZFvu_WlEwoW++;@lI9>8fahYqiZZf#2 z$>#-)(gb;VU zqRQ>rzM|Nh`(Zkll66goxZS$m$wZ|I@s!3%eq>{!pquH_Q?^I`!&(?t2Yd$;)t=q+ zOL~LOvL9iS+E-M6xsTSdrt6z%z8-;n%>40^9xQUFa^b^uCVq3oag5h?;@qI&ufGk^ zhDQkl4`b|kBF-8`3ju8~lFxpV6j*anAv8ncp@@2HvoKNJ1GJoQ=|p97H0JHaJCV1MUn`NR2UL%KA03Lom-+v8xBEKxXq}oKYtO(1lD9D0HBviP&&kY(L zPu|hwG$xFMg=4R-w>i;Dd8^tj#C7=Hpd6N9TU%dt|iCbSo!nJz1Mibj`=>4H~i} zCdqiV3j0=0)OxZupXi#8*Bdn453cZa<>9yNL`#zw4bcsPBu2-FpvQAr>6;V3tIrJ@ zc2^Zea-zBT>FUvL(2w|17|qoQ4G9v62X`|x@dE+|e1bhNxP+JJ634e!Cf0C{TD;q< zu4zXibClNW7U(a5>Ut--0RF6mSFkYL&qpG9QH!CycYdN#-WXPdS8htV(~p{HEr#~q z`H6y8xXQwB8|wzWTg*o!=KBvCv$SCA+U8_O6%Bj06h@V04~ka60ZEY73|`>;1kI^O zT(lnq^on>=(eI-n4Tswt#GEGN0!LABt^Iu!`w8KH2Xu^sAv}f+>11N3aM>>_P1Igs z!8k{=6-}2C9#KI@pK+0_lR+OGy`u@~qXY0)=GUAl6xijb6b`F6%U#d$Qc|_zZ0gJs$9FB=+2xmr;#1E&d@%RlI&aW>tpi9jfCR*_TVS~5olf*4Q zYq-5sJSo}W6`myS=Zw)1U17Gli56a3Z1Bq8UhedBgDzqmdUTF@U3kdHW7t4JG{fOy zPGWy7Z@U+^-sVILuc0=0w)fF{_^g$6WxcCv<5+H@$n#?~p@DbD{Ck6jmNa8Sw86N{ z5Xm_(L)Ns#oB4@m)#oZSBWj^1Fd5hnheAkkR!8oJdy>QP;$ zsIF_G4fI@ObEtv@YjRb3(XahZ0z)MS|DtjkPS7cQ8iHH1f zN!m3;bfz;G;hGLbYDwCkTVd;k+wlXt*9831OEJF z#aZSjYGxHEmAbj)1O7zKPi$46p`o5xU@d3MdRMe84?*r}f8XSz zMC@|R=c-S2T@(HFw_EgviH>K)TLdJwTXOU8l)00$=f@WerQOj6O=ij*EiYy3^Vwa; zHLaKqw!yQZ)=LH{oqjl2c^VB+MZ+Xstg2-dC#t8lwLgKJ#`Mzn2!wJf8}{(jmLqt$ zPN}r!6-^Ci<<~SQ>XlIO&@E;Hb3^#9j~A;Iuwn1~L}hidN)>Q1^86U`aa^mtDyN!G z{|@GSgNE()$|Aft(K3)5Xx?gLjshstiKWk=PEn{+-6_8JKADSWF?tZ2z zeCp2#_I{52gq(z9^4ro5RryTJb^f~Aik^vd&-XFe8#H|J+F##_)~SI-6%edrcY3l& zz{AhWdtRr#`9x)Yd#;%eWY(W5Vf2pktH>h;6OAZ8E|@;InFPeMK8w(m1@g81fb9DdQ3f z4(Pvd#&wZ$-uO)GPIJqH;CwV~!H=x+WS?Z@>QP-C#u{>aq3n?pi1M zrhZYYSM+Y?C;_i)qJ`S7B`V;)=lL>ejZ_Tgq7>}i&iMx2MjDk&v|8*IW_n+|d+V8k zKUzbDVL6QfM*jcV`}XIyZ7$LNtiJ*)-Py#cNJ&ndhwkQ^>%?yAX`J}lPO{&mod_Z! z2@OSP0n(0I_kZ8PIRFSgB+HJ{Hl1kp+r}h_$HBqDd7mw58Mc7CxX{fQhMRK?+gj|_ z7P=Y3a2t+cJ4@XH$6$7JBZlFI9D~~4inq3-n=uTVa|~NtqZxQh3*C%ixE05+72MtC zLN{O-ZptxikM3@5p_?%bpTRMF=9;&5k8a2?+=^q^67GKXN;4+sJcaZ2Lehwx_+@pQ z!UwQEu2~aQhKIG@pL`dfFmMj2qxgz*|wq3l1f$#S} zHMvl88yhQplLX?{mJcFLXkAl1p|zlT6J-Ql&~)UuX;9PccHtnhj%wi*Nbv=DOBB=EPL>gRLy zcA*=EhWrykLZVIjfgR0wR1~2jLP8O9z*<|j-OA(J6JfR>dRKRJt*cx~g-t6SbEc;P zl^0@b*Xb1*{q7x?kc*y*Bwer}X=_%Z-L1UEf_?2LgU65Be~g-!x;AE_DON(Vm@Bu= zFBCbk{XIPvDbIvlL7gz!Pd4MApf`+JCTu|RS*Z{7{q%~+ESRMF`Rx|EWpZQ}N*$8= zrnVCDTCBC@?g?_dZPV+(`dG~@wtP=h5dSRC7 z8W5h6%NdVmtGD*^e_sxDd73eKQB@sXkux9y#J(Zs4?F*d^6C!3f+mA}zP7qV zN;8|2=EYu<<@{^TZeCyLnk?sEb9VEB?rvcJUTydG8Qw3m(CzU?8<>UHnS;ORQnz3Z zwhP_J5c4$~V44@YLLvAyYXX}WxGc6kZ=g9* zru~qBmwogO-`taWHcVND6+*GHTwe7+r;E@W^0;w1;wFY_UG(U zFtNq8mvo-2g0WZo{NEynspX25sVd36%AjPgY3rXBL$ zoC5Opj2zA9In0S}{rXf$(SB<4LQfUDk2Tn3rwL4ACc(KHSub{ObB0+)51hE znog_k(i{`rKyK}fPC)?;WFWS+!eTy|FsXY&wNtD03;}>f7rUjDr0mj^QimR(n0=-S z9fi_^VY3S+m0pEOvjbU)UArz(e46qJk7#OVt-3@=5=jp8CKq{s>p}nmQ*dN2*p&8Irb` zOxo2Eo0_HV`T}oQcVyMHnrod5Nxw3$RqX~2B&(fM{IM%8FU8*0UKIO!F1%BcEa99O zgo8uUb!cyi@hAwSE88+j=oAxX#hN+L?^6fHROrLSQzTM;fdNOaLb9JIQ6FRNaTL-Y z&pU)_CN5LFs112|j#SW3jfBJqR_^suZ-J&co_fG=^HhczqHrbgxF}&)+#a)h92)zT zzB^pAqh4nf3E_Yo4lo@-rWP2f9Ae|tu#RkFkuVtN>))O>&#Vk z&sSzE_Yl$B(3RQQ3mzK8lbAJD{4Cd(vuY1Xd#~R= ze%AgYY_*P3Vx21tAQU44ybV+_d)!WzVG2VG`lu#+*4&$cV^b1#t~9?8iGlk8I8oa}-NaAJY^n^O$ct%{;YDCj1FY6fZ|4T>q^ zCD-&X$5932My=M-1OO95gv%vGvBYq}9(u1$Ob<8)QE3)4A|@eibb$yS{OzG|S?@BB(pIZdPdOj3A4+2E{w9bacUtsN{NthJ;lHI9=u(a zWS*-Gw>`p;OwdCW5~QsrG(t2tb7pBKmkYtuEWi}$VLT#AV3$Tb)q-X|w|X46CD)Vc z$~sHfTq^2NqQ#mLe-XOsfNYAm;po?3?6ifI2IZnj5hbgo40S1j8^wBe8`K^PG&ec3z&XXOp!w&3*I2F#1=D1qO04xf> zQKGNm|H+x;nu4D(1kiK6(|1%^dd9+usb!gAAApD?nS~6_L7zEq6^)R%lp<#;Wr^cl zKiJPZc$o$%y9~^%g9}ar8X$lJP3m^gTSG`@HBbg)-zW$TpC)2VlS0)Eln0teLeKsa zQ4ve2-z?N(YYHq(a#=Ay`$X<-773D}QN zhrm$#C^L)7A^A~UvJ22q=412m0BFfB9Kw{Ly3Yi{>wo%XF%`LFNmAyXVnLK>>d*G| zF%_4!DqzJG+tsX*<`VE~1ImKR6c8K1J~n3Nkvo&FnomJ33K3<9M8adi8%!w~Q z%g%fd-tdFnO+RRC<}5bxcyQeu8r!ZIzSI`b0JxVw((S7S&FG{qp<`b zUbC}AV$STR94rAbpG*eFo&pf@IJ-ENnWFMa%IcW=T5@uT>DpN-k$_z4|6WKRZ<_Tv8D^|&APww}ggb#aG zW!jTMWE0g(_}IgGHS4_G8$1qP?(IF?v67M_(kRggg}~^N1=_?Q6bUeA4lpqF@Aw=9 z1oXfto4(0}r(DfgjK`pqQU(;%sIVs{af|g8C@1@OB#6AHwk44GB%gvLKr=mugkf=8 zz3*NOXgQ6I7MzPM@c4Hwz#7`isQRdSQ1V%$i42Tz(u-M?P{{%_fdHr4LGQ9)De_>< zraaw2?9~))Ro)#J@fNmPKM3hh_F@q3k^j{Hd5FjdItLKJvs|Y7HZQNIB1|8k!s&pe zOD_zo2%5A78}80ga&Lx*AsO;u?Ta=E5?)mQMH8PFWU?Sw_P$ zw99aO`uopqo@(S&Kevba4<*p5{d0TxbK6_j&+R|{Fcz(M`VuO`!vMKUGD-E#;|Mk6 z#Y61=Rl^iecJIOcU9$-wk1QmMxU#_LHtk|5snApOmp3%6$l?W!5Q2_1nX;5g&>NK! z4Xt9YLcDyikrxiQNa(VVfJL4ya;PFpeP<|hUhvQz7=w4jG;5e$GM1A1?PK+6X-wW9 z0Qn)WH2^tHR$6>MxNF1QLakN+DuhZ0^E=ZzG zqoY?x=LgR|?4Q0kt3Q3W|MKAI6kvYx;$Z)LKP3A`lP1}m@>Cz|=BevB86TL)>cCfR zYG`(4<)(vDCk^yPp&?;TuEA=P9?O`D^}fhFbxAg{E@UO#1NB$vcVY5zGCAi8wO!>} zM5sSB1xBA+ZetXZee#hl$(W^V!ZZActE#(!D%4GSHik1SB4@@-A9YEi3_{@Hwo>|- zYk3HWfnJPAeHt8dl}SF%kyC>C&8Un^;W#Rjlmv$vSS zYMZ}ls%mDwtA4S<-K^6gZx&NYW7cXNWp@-wnZ6&WTmtiEEC^^vGPxU_a@+XH8CP=s zil!vT-oQu#&RHnwnCLf6k@Sw0+^u+u-UE`Rv6v@I?-q1ph2)gY8Azk6=4Jf*4CNTr z1w5lM_iqvBh3Jc^P>2!NQIcnouNhM{v(A2Yv7VQo<q3b9o6oGPe5^8_S)0`&p%I&bB}$PGjdS>b zJnDz$kv6P5Xdeo4}mR z>94|pi;VO6!a7?5($Qlm-LeEzy6`zjv>2 zWCXWK=l>Zywj1zO%SZb5HvXUX;1mkWgr^_Xki54$a(Q{_tEq&X_UKsTSubUmsyBH2 za_Zpd};#n*I#kB@NX~ry?D`mQo5g)|&m8Ppf@$|yN$v}_dW-<|1Q$;$pAW zStb^X@?6W^+`CubOsl{95529|W5B(8EkfQ8ejz{XpYOjMk|NB*cw|bj4;Y%Bm}>wX z6U~xGQ@vMBtaG z>4}C)QW1RXW*4cgb8_;PoaM7$87WOnpcgk@x{#z30Brnj|2|78-|DT8ttsgt9mX ztFc=+8uY_QVLy-$A6s3VeWfR;ntYQIG360_(1E+fv<$>$S`2}0%h_<|dYjFn{g ze9mG{GnQ!S_~`iL_38QktMegozM^ngth1<-_FTUf8krWN=JX>YAOz}foePw=6E)~L zQxbWd&6vF8_Lu=GOl?9qxVKS!*Ce1pfN9i;ffLevku5ckZ_-qSCe0jc{$l^-%h&Hd z93G#X|J(KbbZH9YfC{&qlmrzGfP+@R9VayX=*zO!y5)yJfeI2W*%vGk3q1=fqj$)C z?`SxF3Bb#dtKYmP>b`r&_v|2-mONmERpHyXf`(!GS2419n-A1Y%D&CZg5yat)wXlO8JBxt|x zj?NBG-yS_bge+AflnPuB=iSlkmj?w2+p%Z2&=7f?Fh)(*q@R+0AQMJ=V7ySwIOgwH zug?$9!t9gDCs&%NagBAlhw+lgJWV0QjWimeGzC!?5xmu?b!7B@cTp_`Al`9zlM9on z2YO1j5QdY#KK65k_AStCo;B;(F&82xcdek}!3Fv(7Dz_^lJr3x?X0rAu}>@_0ndou zPPo79_^-9-nTY8W*bDzs*LOKEx(?smjp8nR6oU0dq??brMp;8Ma>*?IMdcN`PO3;! zoxACj1T*3zBMIIV%Grbc^ZjT0XXeenNH3c&dRjus7oh|4KA4pR)y)%Nrzw5a8i|5ftTLOqhSnmn2Z!7A@z6}+>0PX@;NikH7ImC{t*DI_-`1}2>YaG z?0g<^nXpBLT&IDdGRks6{?fHj)2IV}u~K)I|1qoe_!aH%q% zh645Ucya(`cnv6>JJ-_=iKSQ+GbzFN|N8CBN!+|;u9zfm&JIuOEx@IUNRhCjf%VQZ z;J@?i==|0G@e$ZA9R}Yibu*P3%9_G0B){MZn=;5f(L6^DzID@C@s+qVT$J~%#X- ztga`<8=n8waj6^7gzL_~KJ4Z5zjy!9qi^T`&-nej`G6YBQ8~a=$RfTJX@Ct$)-s-n zfsRRBB$7aJX)Hu$l|nXu(hW|vYHq43{#loF+$oVOH*R$O&jIyWpg?Hl)7#ao1!MgG3!( z2yVBqU3sx1tccu7at68U&|c|9OikBLc8E_-Z6ywjG@(;=Qq&1(bvh=ZYuF;5z%wMj z|Iz9YQto0%=1cqUS9H#b7G9S_cuGj%HU5b$@vZyHc&j{5s8YJyGw*M3HCpLwZPm`5 z4v}m!BsWf`q}L2x=_O0IG*?Ijo?41HB=v4ugk*F&B!fY?S4yq)_(6-1PRG?*papPD z#16bRu^7Nm-Punr=~CSxd{ShHB3zL>3C)3E?U03!xB9_4ytT_g zeZ9pZy32^VRztKL>i`B;y^iia5NR-`Y8JSDTLj0jdEfLQI?JTdMKARI2Rq~Fn8(6fn`B|JybCmM zPI>C=FxIA{8}8_X)*-$fb66Qs_qpL{*jd#u3LUmg;v7GRksrO>=@=jSlOl*>X!E{- z+8@-ahAA_SMj&uuhb9;jG$WV)r zN)VAjHixmKk0A|U^l_2oXz+>igh`W1uC4FpkL|E_!`>v=vw+b&PcptpSm4INE4Wh( ztQU!-;Y7ssm3{WcSil6P4iJpr0IlkoHD`QC2L1k^Re~ivDQ1jj_kB$1{P`0uo*RpP zV6sK`TIPWnsx)h)>3}R6q7c-Wy3lOrfnc2kOqbx|W8AQ~GP%)Bus0fXU4r21r+A zM*G3K3=|0@Mx}L*NX#bSu>m&uu1oGve1Opqo28yL2=V&-aH#o?A}s7*W$?BLS)FAT z`Z)DmZB3HP;cyGfoHZ>*1U)Z!O6Lu*5*G(5F zZav0oxN53KN$gP#eI4n>_7PrCL;FU*ItHpx@`2XxP+MKiPOV2;6`$Mc=ecy37u<7NR!!Ne!ab1^Ww3QqQ3l962OSqOYC>a^JQ}gAq}97LN&) zQ}u=B=fmg-M%$MVGE(ARjgA#EL)x@OmB`ji(p1sNIv@XO(|t!14b|$lmMjeZV$3bE zI`!{$$$WKZtMmD`Alq$YQp-i2HCwKs27ysRCrtHQ#f|zOonJIM0Z_2cY2x>n>%B1601c1|;{IAz^H}Wq{mD#SYf8z#7YfOax;V zps_5NNHGT^lnTID7GyJ;0>w7QGOr^&qbev5y?nEEM8s?uG|y%%&Ft;E5vdVrD0unype-Cuj_hOU_AN-*Ou7o zkmgj_!)qqA>cEi3WW?B;q3$N;$;Sdsezb5cL6r8={EivAgJzz+YLi`e8FVWw? zI&&>MS(E$~waD}32mSN|b{?wPkX#w{GU@zBZ_Lx4n%M^|nhDZA5JmpeuwA-kD)&il z*tW6*cO`*w6@umg2!ZaeGBZ`#!VO@%617Sose-7o*T{}-G$y&LDJVskB_nmJ<}AKD zmHFvCheT5}5um5^CPai>F~jQA4eJQ=c2)0VuLg?3x^*ruNy=D^Vc$&7IjAkBl12;^ zh#P4tB9TUHk*S`Zy(Y`5w-EUMdL7#<7il0SS{PS|lirILdb|_Ae&CSY?^lVjm5|Ga z)I1%c9Cad;rWbzmY`M^~F_zylvenTENY#=3Ye-&+l!2K>WKu8oZI}tK7 zg1qIUUJ4pNqX|tT6T|Y#w)3Z;HdMVkV49CrP-GRe&w3r*W1#1wCtT>m~)=x{y7q#9AT2wmGV@EF0^OrQXB;!W%5!~$DSmK3waWCQr>dNm(7 zt_PlA-k|P_5|PJ&ahj4^Tw<3rNqQa0R3>?p1*V&ckT7*SbF1oVUcnj6^c13=&{7kS zK|jR*(^q<<)KyQoXzYvx4UL@+Iht5?OSfc{L_NfR`H%i(+8gzFJ7_n3(r(+}S*Jvc zmzrmc(3MPa0Wmn(m%c7h*>l(Po!ZgZXNF1hBovGh znG6ZJJ6-H*Jcl%qkc5#+jriEhi=QxqB>7Lw$&}IPBiM1gbUIB+J6FC{ z;MbG~a$Xvpwg>!^x6hr%-YV){kER5zOL>LfaAT3D@n=&37c6xR5inS3)gQ17d#uhO zTEixNDbLbX-2izHlw+7hM`6hh6N~8XhLXA4P~;XNE{Rd2eDBS}&*D_c6$WXiaxi7N zxp2Mk3ttOk=mGjPGIH`3;~%XK&r&5fGnJ2VUhOtaqhj1|2W?G4;nW|Cm>H8tKu#Hr z-$|aa*C`x(#eZW%^7sXBptu@6%VjhxIWEbWNuzQGl@?-1Ut=PNy;pTD$7Z~O=8~jH zzKcn(@Fs+3q+Qq@IIOJop7; zmeIf@32Bj1Y_PfY?R3na-p51o{+AXpTVPw)xQ2y@U-~T;BHnLeEsCn24G8kqGfX?j z4bbM{8&Ja932oL{Q#aT{9Zk6oaL&FV={F>`=&>Cf_4`_jqAnv0a~ZU}EI$z8 zIp-DHf35pMB<718Z1{#v2D7pI3%$p147}0iY!1E~yL%6hIXsCLx&E_1Z?#HEaLrLM zwK%O6RbSTSWV~)Lch^>oy~V9>zL<*`bK-*CGsJrDhLeO(x)`TWPOWPapkZ&N?7D?{ z(Po&&i@d0*ElUO;u1EqbA9@>gIz*&q7MfM;mh=2133Ru}{ER!Ms!O^w;t6(hw>nu8 zGtGxtTcXT%9FR&Wh7FHe#u7Asm^w#5j1qpqQl^wi#$rmZW8L(Pn1)R)`gWke4HDoW zy^i-WJlSd4#!v#j(X9v_yAN1Gm%dtpkVRQlG0@L4K4&7&+{3*VA=Lu{QBtDS)(r!5jgvX{f@e{`1Es-*J{0%+ z#?Q(Wd^*R?&|9N!@2+MAlECeQb6o3(56g8(Yu;ZKhtqF9U^O4GM)#;K%)0I%WktIt zm$C+Qta?UmVNSQCm@x9~2|Xb-l3S-9Yv^1vrE8{jtEk-ydPhi|{{CI&2DU?- zg9V-|{u?VjSv||jOzY}>-BqcvH}}$W$-P2fy)6Ut7$!hYab5L>B}C}2dJWjH+kfzQMFWcx#~wIjU5 zNEl65kSwF}@djQ=t_nDGJzD9zY_FPvmhz@mlIEs>S~b_lM$~e~VZngr| zOXc^#FzG@4LJbyxH`w%Ah}GxZH@DfqRe-5(EJW$JDm)eFR;lw=BG9h8WQ-Q%&jwgQ qRaWX~Ho*Myidy=Ae|*cS^zHZU_wBd+-~R>x0RR7ytckV&#t8tqjXEd* literal 0 HcmV?d00001 diff --git a/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/helminstall.sh b/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/helminstall.sh index 6f0132d..b7e77bc 100755 --- a/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/helminstall.sh +++ b/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/helminstall.sh @@ -1,23 +1,30 @@ #!/usr/bin/env bash -if [ -z "$1" ]; then echo "Skipping creation of persistent volume examples. Ensure there is available PVs 200Gi per node for HA."; else oc create -f pv-examples/; fi +if [[ -z "$1" ]] +then + echo "Skipping creation of persistent volume examples. Ensure there is available PVs 200Gi per node for HA." +else + oc create -f pv-examples/ + oc new-project jfrog-artifactory + oc create serviceaccount svcaccount -n jfrog-artifactory + oc adm policy add-scc-to-user privileged system:serviceaccount:jfrog-artifactory:svcaccount + oc adm policy add-scc-to-user anyuid system:serviceaccount:jfrog-artifactory:svcaccount + oc adm policy add-scc-to-group anyuid system:authenticated -oc new-project jfrog-artifactory -oc create serviceaccount svcaccount -n jfrog-artifactory -oc adm policy add-scc-to-user privileged system:serviceaccount:jfrog-artifactory:svcaccount -oc adm policy add-scc-to-user anyuid system:serviceaccount:jfrog-artifactory:svcaccount -oc adm policy add-scc-to-group anyuid system:authenticated + # enables hostPath plugin for openshift system wide + oc create -f hostpathscc.yaml -n jfrog-artifactory + oc patch securitycontextconstraints.security.openshift.io/hostpath --type=merge --patch='{"allowHostDirVolumePlugin": true}' + oc adm policy add-scc-to-user hostpath system:serviceaccount:jfrog-artifactory:svcaccount -# enables hostPath plugin for openshift system wide -oc create -f scc.yaml -n jfrog-artifactory -oc patch securitycontextconstraints.security.openshift.io/hostpath --type=merge --patch='{"allowHostDirVolumePlugin": true}' -oc adm policy add-scc-to-user hostpath system:serviceaccount:jfrog-artifactory:svcaccount + # create the license secret + oc create secret generic artifactory-license --from-file=artifactory.cluster.license -# create the license secret -oc create secret generic artifactory-license --from-file=./artifactory.cluster.license + # create the tls secret + oc create secret tls tls-ingress --cert=jfrog.team.crt --key=jfrog.team.key +fi # install via helm -helm install . --generate-name \ - --set artifactory.node.replicaCount=1 \ - --set nginx.service.type=NodePort \ - --set artifactory.license.secret=artifactory-license,artifactory.license.dataKey=artifactory.cluster.license +helm install artifactory-ha . \ + --set nginx.tlsSecretName=tls-ingress \ + --set artifactory-ha.artifactory.node.replicaCount=1 \ + --set artifactory-ha.artifactory.license.secret=artifactory-license,artifactory-ha.artifactory.license.dataKey=artifactory.cluster.license diff --git a/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/hostpathscc.yaml b/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/hostpathscc.yaml new file mode 100644 index 0000000..13eef79 --- /dev/null +++ b/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/hostpathscc.yaml @@ -0,0 +1,18 @@ +kind: SecurityContextConstraints +apiVersion: v1 +metadata: + name: hostpath +allowPrivilegedContainer: false +runAsUser: + type: RunAsAny +seLinuxContext: + type: RunAsAny +fsGroup: + type: RunAsAny +supplementalGroups: + type: RunAsAny +users: +- artifactory +groups: +- artifactory +- jfrog-artifactory diff --git a/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/requirements.lock b/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/requirements.lock old mode 100755 new mode 100644 index 7037cff..97b3164 --- a/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/requirements.lock +++ b/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/requirements.lock @@ -1,6 +1,6 @@ dependencies: -- name: postgresql - repository: https://kubernetes-charts.storage.googleapis.com/ - version: 7.0.1 -digest: sha256:dcdafe9ab91ccf0e5883e2b5dd9ba13e82190b5e16e6dee6d39fd16a04123ce8 -generated: 2019-11-10T13:12:29.836238+02:00 +- name: artifactory-ha + repository: https://charts.jfrog.io/ + version: 2.0.25 +digest: sha256:1de97dca862a0b7e74fc937fbeff231119071a00cea8e42f92adb87c59fa554c +generated: "2020-03-09T12:41:44.126599-07:00" diff --git a/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/requirements.yaml b/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/requirements.yaml old mode 100755 new mode 100644 index 756a19c..1b41f8c --- a/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/requirements.yaml +++ b/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/requirements.yaml @@ -1,5 +1,4 @@ dependencies: - - name: postgresql - version: 7.0.1 - repository: https://kubernetes-charts.storage.googleapis.com/ - condition: postgresql.enabled + - name: artifactory-ha + version: 2.0.25 + repository: https://charts.jfrog.io/ diff --git a/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/values.yaml b/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/values.yaml index 242803c..1991513 100755 --- a/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/values.yaml +++ b/Openshift4/artifactory-ha-operator/helm-charts/openshift-artifactory-ha/values.yaml @@ -1,1330 +1,20 @@ -# Default values for artifactory-ha. -# This is a YAML-formatted file. -# Beware when changing values here. You should know what you are doing! -# Access the values with {{ .Values.key.subkey }} - -# Common -initContainerImage: "alpine:3.10" - -installer: - type: - platform: - -# For supporting pulling from private registries -imagePullSecrets: - -## Role Based Access Control -## Ref: https://kubernetes.io/docs/admin/authorization/rbac/ -rbac: - create: true - role: - ## Rules to create. It follows the role specification - rules: - - apiGroups: - - '' - resources: - - services - - endpoints - - pods - verbs: - - get - - watch - - list - -## Service Account -## Ref: https://kubernetes.io/docs/admin/service-accounts-admin/ -## -serviceAccount: - create: true - ## The name of the ServiceAccount to use. - ## If not set and create is true, a name is generated using the fullname template - name: - annotations: {} - -ingress: - enabled: false - defaultBackend: - enabled: true - # Used to create an Ingress record. - hosts: [] - routerPath: / - artifactoryPath: /artifactory/ - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - labels: {} - # traffic-type: external - # traffic-type: internal - tls: [] - # Secrets must be manually created in the namespace. - # - secretName: chart-example-tls - # hosts: - # - artifactory.domain.example - - # Additional ingress rules - additionalRules: [] - - -networkpolicy: - # Allows all ingress and egress - - name: artifactory - podSelector: - matchLabels: - app: artifactory-ha - egress: - - {} - ingress: - - {} - # Uncomment to allow only artifactory pods to communicate with postgresql (if postgresql.enabled is true) - # - name: postgresql - # podSelector: - # matchLabels: - # app: postgresql - # ingress: - # - from: - # - podSelector: - # matchLabels: - # app: artifactory-ha - - -## Database configurations -## Use the wait-for-db init container. Set to false to skip -waitForDatabase: true - -## Configuration values for the postgresql dependency -## ref: https://github.com/kubernetes/charts/blob/master/stable/postgresql/README.md -## -postgresql: - enabled: true - image: - registry: docker.bintray.io - repository: bitnami/postgresql - tag: 9.6.15-debian-9-r91 - postgresqlUsername: artifactory - postgresqlPassword: "" - postgresqlDatabase: artifactory - postgresqlConfiguration: - listenAddresses: "'*'" - maxConnections: "1500" - persistence: - enabled: true - size: 50Gi - service: - port: 5432 - resources: {} - # requests: - # memory: "512Mi" - # cpu: "100m" - # limits: - # memory: "1Gi" - # cpu: "500m" - nodeSelector: {} - -## If NOT using the PostgreSQL in this chart (postgresql.enabled=false), -## you MUST specify custom database details here or Artifactory will NOT start -database: - type: - driver: - ## If you set the url, leave host and port empty - url: - ## If you would like this chart to create the secret containing the db - ## password, use these values - user: - password: - ## If you have existing Kubernetes secrets containing db credentials, use - ## these values - secrets: {} - # user: - # name: "rds-artifactory" - # key: "db-user" - # password: - # name: "{{ .Release.Name}}}}-postgresql" - # key: "postgresql-password" - # url: - # name: "rds-artifactory" - # key: "db-url" - -logger: - image: - repository: 'busybox' - tag: '1.30' - -# Artifactory -artifactory: - name: artifactory-ha - image: - # repository: "docker.bintray.io/jfrog/artifactory-pro" - repository: image-registry.openshift-image-registry.svc:5000/jfrog-artifactory/artifactory-pro - # Note that by default we use appVersion to get image tag - # version: - pullPolicy: IfNotPresent - - # Create a priority class for the Artifactory pods or use an existing one - # NOTE - Maximum allowed value of a user defined priority is 1000000000 - priorityClass: - create: false - value: 1000000000 - ## Override default name - # name: - ## Use an existing priority class - # existingPriorityClass: - - # Delete the db.properties file in ARTIFACTORY_HOME/etc/db.properties - deleteDBPropertiesOnStartup: true - database: - maxOpenConnections: 80 - - # This directory is intended for use with NFS eventual configuration for HA - haDataDir: - enabled: false - path: - - # Files to copy to ARTIFACTORY_HOME/ on each Artifactory startup - copyOnEveryStartup: - # # Absolute path - # - source: /artifactory_extra_conf/binarystore.xml - # # Relative to ARTIFACTORY_HOME/ - # target: etc/ - # # Absolute path - # - source: /artifactory_extra_conf/artifactory.lic - # # Relative to ARTIFACTORY_HOME/ - # target: etc/ - - # Sidecar containers for tailing Artifactory logs - loggers: [] - # - request.log - # - event.log - # - binarystore.log - # - request_trace.log - # - access.log - # - artifactory.log - # - build_info_migration.log - - # Sidecar containers for tailing Tomcat (catalina) logs - catalinaLoggers: [] - # - catalina.log - # - host-manager.log - # - localhost.log - # - manager.log - - ## Add custom init containers execution before predefined init containers - customInitContainersBegin: | - - name: "custom-setup" - image: "{{ .Values.initContainerImage }}" - imagePullPolicy: "{{ .Values.artifactory.image.pullPolicy }}" - command: - - 'sh' - - '-c' - - 'chown -R 1030:1030 {{ .Values.artifactory.persistence.mountPath }}' - securityContext: - runAsUser: 0 - volumeMounts: - - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" - name: volume - ## Add custom init containers - - ## Add custom init containers execution after predefined init containers - customInitContainers: | - # - name: "custom-setup" - # image: "{{ .Values.initContainerImage }}" - # imagePullPolicy: "{{ .Values.artifactory.image.pullPolicy }}" - # command: - # - 'sh' - # - '-c' - # - 'touch {{ .Values.artifactory.persistence.mountPath }}/example-custom-setup' - # volumeMounts: - # - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" - # name: volume - - ## Add custom sidecar containers - # - The provided example uses a custom volume (customVolumes) - # - The provided example shows running container as root (id 0) - customSidecarContainers: | - # - name: "sidecar-list-etc" - # image: "{{ .Values.initContainerImage }}" - # imagePullPolicy: "{{ .Values.artifactory.image.pullPolicy }}" - # securityContext: - # runAsUser: 0 - # fsGroup: 0 - # command: - # - 'sh' - # - '-c' - # - 'sh /scripts/script.sh' - # volumeMounts: - # - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" - # name: volume - # - mountPath: "/scripts/script.sh" - # name: custom-script - # subPath: script.sh - # resources: - # requests: - # memory: "32Mi" - # cpu: "50m" - # limits: - # memory: "128Mi" - # cpu: "100m" - - ## Add custom volumes - customVolumes: | - # - name: custom-script - # configMap: - # name: custom-script - - ## Add custom volumesMounts - customVolumeMounts: | - # - name: custom-script - # mountPath: "/scripts/script.sh" - # subPath: script.sh - # - name: posthook-start - # mountPath: "/scripts/posthoook-start.sh" - # subPath: posthoook-start.sh - # - name: prehook-start - # mountPath: "/scripts/prehook-start.sh" - # subPath: prehook-start.sh - - # Add custom persistent volume mounts - Available for the pod - customPersistentPodVolumeClaim: {} - # name: - # mountPath: - # accessModes: - # - "-" - # size: - # storageClassName: - - # Add custom persistent volume mounts - Available to the entire namespace - customPersistentVolumeClaim: {} - # name: - # mountPath: - # accessModes: - # - "-" - # size: - # storageClassName: - - ## Artifactory HA requires a unique master key. Each Artifactory node must have the same master key! - ## You can generate one with the command: 'openssl rand -hex 16' - ## Pass it to helm with '--set artifactory.masterKey=${MASTER_KEY}' - ## Alternatively, you can use a pre-existing secret with a key called master-key by specifying masterKeySecretName - ## IMPORTANT: You should NOT use the example masterKey for a production deployment! - masterKey: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF - # masterKeySecretName: - - ## Join Key to connect to other services to Artifactory - ## IMPORTANT: You should NOT use the example joinKey for a production deployment! - joinKey: EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE - - binarystore: - enabled: true - - accessAdmin: - ip: "127.0.0.1" - password: - secret: - dataKey: - - ## Artifactory license. - license: - ## licenseKey is the license key in plain text. Use either this or the license.secret setting - licenseKey: - ## If artifactory.license.secret is passed, it will be mounted as - ## ARTIFACTORY_HOME/etc/artifactory.lic and loaded at run time. - secret: - ## The dataKey should be the name of the secret data key created. - dataKey: - - ## Create configMap with artifactory.config.import.xml and security.import.xml and pass name of configMap in following parameter - configMapName: - - # Add any list of configmaps to Artifactory - configMaps: | - # posthook-start.sh: |- - # echo "This is a post start script" - # posthook-end.sh: |- - # echo "This is a post end script" - - ## List of secrets for Artifactory user plugins. - ## One Secret per plugin's files. - userPluginSecrets: - # - archive-old-artifacts - # - build-cleanup - # - webhook - # - '{{ template "my-chart.fullname" . }}' - - ## Extra pre-start command to install JDBC driver for MySql/MariaDb/Oracle - # preStartCommand: "wget -O /opt/jfrog/artifactory/tomcat/lib/mysql-connector-java-5.1.41.jar https://jcenter.bintray.com/mysql/mysql-connector-java/5.1.41/mysql-connector-java-5.1.41.jar" - ## Extra post-start command to run extra commands after container starts - # postStartCommand: - - ## Extra environment variables that can be used to tune Artifactory to your needs. - ## Uncomment and set value as needed - extraEnvironmentVariables: | - - name: JF_SHARED_DATABSE_USERNAME - value: "artifactory" - - name: JF_SHARED_DATABASE_PASSWORD - valueFrom: - secretKeyRef: - name: {{ .Release.Name }}-postgresql - key: postgresql-password - - name: POSTGRES_DB - value: "artifactory" - - # TODO: Fix javaOpts for member nodes (currently uses primary settings for all nodes) - systemYaml: | - shared: - extraJavaOpts: > - {{- with .Values.artifactory.primary.javaOpts }} - -Dartifactory.async.corePoolSize={{ .corePoolSize }} - {{- if .xms }} - -Xms{{ .xms }} - {{- end }} - {{- if .xmx }} - -Xmx{{ .xmx }} - {{- end }} - {{- if .jmx.enabled }} - -Dcom.sun.management.jmxremote - -Dcom.sun.management.jmxremote.port={{ .jmx.port }} - -Dcom.sun.management.jmxremote.rmi.port={{ .jmx.port }} - -Dcom.sun.management.jmxremote.ssl={{ .jmx.ssl }} - {{- if .jmx.host }} - -Djava.rmi.server.hostname={{ tpl .jmx.host $ }} - {{- else }} - -Djava.rmi.server.hostname={{ template "artifactory-ha.fullname" $ }} - {{- end }} - {{- if .jmx.authenticate }} - -Dcom.sun.management.jmxremote.authenticate=true - -Dcom.sun.management.jmxremote.access.file={{ .jmx.accessFile }} - -Dcom.sun.management.jmxremote.password.file={{ .jmx.passwordFile }} - {{- else }} - -Dcom.sun.management.jmxremote.authenticate=false - {{- end }} - {{- end }} - {{- if .other }} - {{ .other }} - {{- end }} - {{- end }} - database: - {{- if .Values.postgresql.enabled }} - type: postgresql - url: 'jdbc:postgresql://{{ .Release.Name }}-postgresql:{{ .Values.postgresql.service.port }}/{{ .Values.postgresql.postgresqlDatabase }}' - host: '' - driver: org.postgresql.Driver - username: '{{ .Values.postgresql.postgresqlUsername }}' - password: '{{ .Values.postgresql.postgresqlPassword }}' - {{ else }} - type: '{{ .Values.database.type }}' - url: '{{ .Values.database.url }}' - driver: '{{ .Values.database.driver }}' - username: '{{ .Values.database.user }}' - password: '{{ .Values.database.password }}' - {{- end }} - security: - joinKey: '{{ .Values.artifactory.joinKey }}' - masterKey: '{{ .Values.artifactory.masterKey }}' - artifactory: - {{- if .Values.artifactory.haDataDir.enabled }} - node: - haDataDir: {{ .Values.artifactory.haDataDir.path }} - {{- end }} - database: - maxOpenConnections: {{ .Values.artifactory.database.maxOpenConnections }} - access: - database: - maxOpenConnections: '{{ .Values.access.database.maxOpenConnections }}' - {{- if .Values.access.database.enabled }} - type: '{{ .Values.access.database.type }}' - url: '{{ .Values.access.database.url }}' - driver: '{{ .Values.access.database.driver }}' - username: '{{ .Values.access.database.user }}' - password: '{{ .Values.access.database.password }}' - {{- end }} - - ## IMPORTANT: If overriding artifactory.internalPort: - ## DO NOT use port lower than 1024 as Artifactory runs as non-root and cannot bind to ports lower than 1024! - externalPort: 8082 - internalPort: 8082 - externalArtifactoryPort: 8081 - internalArtifactoryPort: 8081 - uid: 1030 - terminationGracePeriodSeconds: 30 - ## The following settings are to configure the frequency of the liveness and readiness probes - livenessProbe: - enabled: true - path: /router/api/v1/system/health - initialDelaySeconds: 180 - failureThreshold: 10 - timeoutSeconds: 10 - periodSeconds: 10 - successThreshold: 1 - - readinessProbe: - enabled: true - path: /router/api/v1/system/health - initialDelaySeconds: 60 - failureThreshold: 10 - timeoutSeconds: 10 - periodSeconds: 10 - successThreshold: 1 - - persistence: - enabled: true - local: false - redundancy: 3 - mountPath: "/var/opt/jfrog/artifactory" - accessMode: ReadWriteOnce - size: 200Gi - - ## Use a custom Secret to be mounted as your binarystore.xml - ## NOTE: This will ignore all settings below that make up binarystore.xml - customBinarystoreXmlSecret: - - maxCacheSize: 50000000000 - cacheProviderDir: cache - eventual: - numberOfThreads: 10 - ## artifactory data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - # storageClassName: "-" - - ## Set the persistence storage type. This will apply the matching binarystore.xml to Artifactory config - ## Supported types are: - ## file-system (default) - ## nfs - ## google-storage - ## aws-s3 - ## azure-blob - type: file-system - - ## Use binarystoreXml to provide a custom binarystore.xml - ## This can be a template or hardcoded. - binarystoreXml: | - {{- if eq .Values.artifactory.persistence.type "file-system" }} - - {{- if .Values.artifactory.persistence.fileSystem.existingSharedClaim.enabled }} - - - - - - {{- range $sharedClaimNumber, $e := until (.Values.artifactory.persistence.fileSystem.existingSharedClaim.numberOfExistingClaims|int) -}} - - {{- end }} - - - - - - {{ .Values.artifactory.persistence.maxCacheSize }} - {{ .Values.artifactory.persistence.cacheProviderDir }} - - - // Specify the read and write strategy and redundancy for the sharding binary provider - - roundRobin - percentageFreeSpace - 2 - - - {{- range $sharedClaimNumber, $e := until (.Values.artifactory.persistence.fileSystem.existingSharedClaim.numberOfExistingClaims|int) -}} - //For each sub-provider (mount), specify the filestore location - - filestore{{ $sharedClaimNumber }} - - {{- end }} - - {{- else }} - - - - - crossNetworkStrategy - crossNetworkStrategy - {{ .Values.artifactory.persistence.redundancy }} - 2 - 2 - - - - - - - - - {{ .Values.artifactory.persistence.maxCacheSize }} - {{ .Values.artifactory.persistence.cacheProviderDir }} - - - - - shard-fs-1 - local - - - - - 30 - tester-remote1 - 10000 - remote - - - - {{- end }} - {{- end }} - {{- if eq .Values.artifactory.persistence.type "google-storage" }} - - - - - crossNetworkStrategy - crossNetworkStrategy - {{ .Values.artifactory.persistence.redundancy }} - 2 - - - - - - - - - - - - - {{ .Values.artifactory.persistence.maxCacheSize }} - {{ .Values.artifactory.persistence.cacheProviderDir }} - - - - local - - - - 30 - 10000 - remote - - - - {{ .Values.artifactory.persistence.mountPath }}/data/filestore - /tmp - - - - google-cloud-storage - {{ .Values.artifactory.persistence.googleStorage.endpoint }} - {{ .Values.artifactory.persistence.googleStorage.httpsOnly }} - {{ .Values.artifactory.persistence.googleStorage.bucketName }} - {{ .Values.artifactory.persistence.googleStorage.identity }} - {{ .Values.artifactory.persistence.googleStorage.credential }} - {{ .Values.artifactory.persistence.googleStorage.path }} - {{ .Values.artifactory.persistence.googleStorage.bucketExists }} - - - {{- end }} - {{- if eq .Values.artifactory.persistence.type "aws-s3-v3" }} - - - - - - - - - - - - - - - - - crossNetworkStrategy - crossNetworkStrategy - {{ .Values.artifactory.persistence.redundancy }} - - - - - remote - - - - local - - - - - {{ .Values.artifactory.persistence.maxCacheSize }} - {{ .Values.artifactory.persistence.cacheProviderDir }} - - - {{- with .Values.artifactory.persistence.awsS3V3 }} - - {{ .testConnection }} - {{- if .identity }} - {{ .identity }} - {{- end }} - {{- if .credential }} - {{ .credential }} - {{- end }} - {{ .region }} - {{ .bucketName }} - {{ .path }} - {{ .endpoint }} - {{- with .kmsServerSideEncryptionKeyId }} - {{ . }} - {{- end }} - {{- with .kmsKeyRegion }} - {{ . }} - {{- end }} - {{- with .kmsCryptoMode }} - {{ . }} - {{- end }} - true - {{ .usePresigning }} - {{ .signatureExpirySeconds }} - {{- with .cloudFrontDomainName }} - {{ . }} - {{- end }} - {{- with .cloudFrontKeyPairId }} - {{ .cloudFrontKeyPairId }} - {{- end }} - {{- with .cloudFrontPrivateKey }} - {{ . }} - {{- end }} - - {{- end }} - - {{- end }} - - {{- if eq .Values.artifactory.persistence.type "aws-s3" }} - - - - - - - - - - - - - - - - - - {{ .Values.artifactory.persistence.maxCacheSize }} - {{ .Values.artifactory.persistence.cacheProviderDir }} - - - - local - - - - 30 - 10000 - remote - - - - crossNetworkStrategy - crossNetworkStrategy - {{ .Values.artifactory.persistence.redundancy }} - - - - - {{ .Values.artifactory.persistence.awsS3.endpoint }} - {{- if .Values.artifactory.persistence.awsS3.roleName }} - {{ .Values.artifactory.persistence.awsS3.roleName }} - true - {{- else }} - {{ .Values.artifactory.persistence.awsS3.refreshCredentials }} - {{- end }} - {{ .Values.artifactory.persistence.awsS3.s3AwsVersion }} - {{ .Values.artifactory.persistence.awsS3.testConnection }} - {{ .Values.artifactory.persistence.awsS3.httpsOnly }} - {{ .Values.artifactory.persistence.awsS3.region }} - {{ .Values.artifactory.persistence.awsS3.bucketName }} - {{- if .Values.artifactory.persistence.awsS3.identity }} - {{ .Values.artifactory.persistence.awsS3.identity }} - {{- end }} - {{- if .Values.artifactory.persistence.awsS3.credential }} - {{ .Values.artifactory.persistence.awsS3.credential }} - {{- end }} - {{ .Values.artifactory.persistence.awsS3.path }} - {{- range $key, $value := .Values.artifactory.persistence.awsS3.properties }} - - {{- end }} - - - {{- end }} - {{- if eq .Values.artifactory.persistence.type "azure-blob" }} - - - - - - - - - - - - - - - - - - {{ .Values.artifactory.persistence.maxCacheSize }} - {{ .Values.artifactory.persistence.cacheProviderDir }} - - - - - crossNetworkStrategy - crossNetworkStrategy - 2 - 1 - - - - - remote - - - - local - - - - - {{ .Values.artifactory.persistence.azureBlob.accountName }} - {{ .Values.artifactory.persistence.azureBlob.accountKey }} - {{ .Values.artifactory.persistence.azureBlob.endpoint }} - {{ .Values.artifactory.persistence.azureBlob.containerName }} - {{ .Values.artifactory.persistence.azureBlob.testConnection }} - - - {{- end }} - - ## For artifactory.persistence.type file-system - fileSystem: - ## You may also use existing shared claims for the data and backup storage. This allows storage (NAS for example) to be used for Data and Backup dirs which are safe to share across multiple artifactory nodes. - ## You may specify numberOfExistingClaims to indicate how many of these existing shared claims to mount. (Default = 1) - ## Create PVCs with ReadWriteMany that match the naming convetions: - ## {{ template "artifactory-ha.fullname" . }}-data-pvc- - ## {{ template "artifactory-ha.fullname" . }}-backup-pvc- - ## Example (using numberOfExistingClaims: 2) - ## myexample-artifactory-ha-data-pvc-0 - ## myexample-artifactory-ha-backup-pvc-0 - ## myexample-artifactory-ha-data-pvc-1 - ## myexample-artifactory-ha-backup-pvc-1 - ## Note: While you need two PVC fronting two PVs, multiple PVs can be attached to the same storage in many cases allowing you to share an underlying drive. - - ## Need to have the following set - existingSharedClaim: - enabled: false - numberOfExistingClaims: 1 - ## Should be a child directory of {{ .Values.artifactory.persistence.mountPath }} - dataDir: "{{ .Values.artifactory.persistence.mountPath }}/artifactory-data" - backupDir: "/var/opt/jfrog/artifactory-backup" - - - ## For artifactory.persistence.type nfs - ## If using NFS as the shared storage, you must have a running NFS server that is accessible by your Kubernetes - ## cluster nodes. - ## Need to have the following set - nfs: - # Must pass actual IP of NFS server with '--set For artifactory.persistence.nfs.ip=${NFS_IP}' - ip: - haDataMount: "/data" - haBackupMount: "/backup" - dataDir: "/var/opt/jfrog/artifactory-ha" - backupDir: "/var/opt/jfrog/artifactory-backup" - capacity: 200Gi - mountOptions: [] - ## For artifactory.persistence.type google-storage - googleStorage: - endpoint: storage.googleapis.com - httpsOnly: false - # Set a unique bucket name - bucketName: "artifactory-ha-gcp" - identity: - credential: - path: "artifactory-ha/filestore" - bucketExists: false - - ## For artifactory.persistence.type aws-s3-v3 - awsS3V3: - testConnection: false - identity: - credential: - region: - bucketName: artifactory-aws - path: artifactory/filestore - endpoint: - kmsServerSideEncryptionKeyId: - kmsKeyRegion: - kmsCryptoMode: - useInstanceCredentials: true - usePresigning: false - signatureExpirySeconds: 300 - cloudFrontDomainName: - cloudFrontKeyPairId: - cloudFrontPrivateKey: - - ## For artifactory.persistence.type aws-s3 - ## IMPORTANT: Make sure S3 `endpoint` and `region` match! See https://docs.aws.amazon.com/general/latest/gr/rande.html - awsS3: - # Set a unique bucket name - bucketName: "artifactory-ha-aws" - endpoint: - region: - roleName: - identity: - credential: - path: "artifactory-ha/filestore" - refreshCredentials: true - httpsOnly: true - testConnection: false - s3AwsVersion: "AWS4-HMAC-SHA256" - - ## Additional properties to set on the s3 provider - properties: {} - # httpclient.max-connections: 100 - ## For artifactory.persistence.type azure-blob - azureBlob: - accountName: - accountKey: - endpoint: - containerName: - testConnection: false - service: - name: artifactory - type: ClusterIP - ## For supporting whitelist on the Artifactory service (useful if setting service.type=LoadBalancer) - ## Set this to a list of IP CIDR ranges - ## Example: loadBalancerSourceRanges: ['10.10.10.5/32', '10.11.10.5/32'] - ## or pass from helm command line - ## Example: helm install ... --set nginx.service.loadBalancerSourceRanges='{10.10.10.5/32,10.11.10.5/32}' - loadBalancerSourceRanges: [] - annotations: {} - ## Which nodes in the cluster should be in the external load balancer pool (have external traffic routed to them) - ## Supported pool values - ## members - ## all - pool: members - - ## The following Java options are passed to the java process running Artifactory. - ## This will be passed to all cluster members. Primary and member nodes. - javaOpts: {} - # other: "" - annotations: {} - - ## Type specific configurations. - ## There is a difference between the primary and the member nodes. - ## Customising their resources and java parameters is done here. - primary: - name: artifactory-ha-primary - labels: {} - persistence: - ## Set existingClaim to true or false - ## If true, you must prepare a PVC with the name e.g `volume-myrelease-artifactory-ha-primary-0` - existingClaim: false - ## Resources for the primary node - resources: {} - # requests: - # memory: "1Gi" - # cpu: "500m" - # limits: - # memory: "2Gi" - # cpu: "1" - ## The following Java options are passed to the java process running Artifactory primary node. - ## You should set them according to the resources set above - javaOpts: - # xms: "1g" - # xmx: "2g" - corePoolSize: 16 - jmx: - enabled: false - port: 9010 - host: - ssl: false - # When authenticate is true, accessFile and passwordFile are required - authenticate: false - accessFile: - passwordFile: - # other: "" - nodeSelector: {} - - tolerations: [] - - affinity: {} - ## Only used if "affinity" is empty - podAntiAffinity: - ## Valid values are "soft" or "hard"; any other value indicates no anti-affinity - type: "" - topologyKey: "kubernetes.io/hostname" - - node: - name: artifactory-ha-member - labels: {} - persistence: - ## Set existingClaim to true or false - ## If true, you must prepare a PVC with the name e.g `volume-myrelease-artifactory-ha-member-0` - existingClaim: false - replicaCount: 2 - minAvailable: 1 - ## Resources for the member nodes - resources: {} - # requests: - # memory: "1Gi" - # cpu: "500m" - # limits: - # memory: "2Gi" - # cpu: "1" - ## The following Java options are passed to the java process running Artifactory member nodes. - ## You should set them according to the resources set above - javaOpts: - # xms: "1g" - # xmx: "2g" - corePoolSize: 16 - jmx: - enabled: false - port: 9010 - host: - ssl: false - # When authenticate is true, accessFile and passwordFile are required - authenticate: false - accessFile: - passwordFile: - # other: "" - # xms: "1g" - # xmx: "2g" - # other: "" - nodeSelector: {} - waitForPrimaryStartup: - enabled: true - time: 60 - - tolerations: [] - - ## Complete specification of the "affinity" of the member nodes; if this is non-empty, - ## "podAntiAffinity" values are not used. - affinity: {} - - ## Only used if "affinity" is empty - podAntiAffinity: - ## Valid values are "soft" or "hard"; any other value indicates no anti-affinity - type: "" - topologyKey: "kubernetes.io/hostname" - -access: - database: - maxOpenConnections: 80 - -# Init containers -initContainers: - resources: {} -# requests: -# memory: "64Mi" -# cpu: "10m" -# limits: -# memory: "128Mi" -# cpu: "250m" - - -# Nginx -nginx: - enabled: true - name: nginx - labels: {} - replicaCount: 1 - uid: 104 - gid: 107 - image: - # repository: "docker.bintray.io/jfrog/nginx-artifactory-pro" - repository: image-registry.openshift-image-registry.svc:5000/jfrog-artifactory/nginx-artifactory-pro - # Note that by default we use appVersion to get image tag - # version: - pullPolicy: IfNotPresent - - - # Sidecar containers for tailing Nginx logs - loggers: [] - # - access.log - # - error.log - - mainConf: | - # Main Nginx configuration file - worker_processes 4; - error_log {{ .Values.nginx.persistence.mountPath }}/logs//error.log warn; - pid /tmp/nginx.pid; - events { - worker_connections 1024; - } - http { - include /etc/nginx/mime.types; - default_type application/octet-stream; - variables_hash_max_size 1024; - variables_hash_bucket_size 64; - server_names_hash_max_size 4096; - server_names_hash_bucket_size 128; - types_hash_max_size 2048; - types_hash_bucket_size 64; - proxy_read_timeout 2400s; - client_header_timeout 2400s; - client_body_timeout 2400s; - proxy_connect_timeout 75s; - proxy_send_timeout 2400s; - proxy_buffer_size 32k; - proxy_buffers 40 32k; - proxy_busy_buffers_size 64k; - proxy_temp_file_write_size 250m; - proxy_http_version 1.1; - client_body_buffer_size 128k; - log_format main '$remote_addr - $remote_user [$time_local] "$request" ' - '$status $body_bytes_sent "$http_referer" ' - '"$http_user_agent" "$http_x_forwarded_for"'; - log_format timing 'ip = $remote_addr ' - 'user = \"$remote_user\" ' - 'local_time = \"$time_local\" ' - 'host = $host ' - 'request = \"$request\" ' - 'status = $status ' - 'bytes = $body_bytes_sent ' - 'upstream = \"$upstream_addr\" ' - 'upstream_time = $upstream_response_time ' - 'request_time = $request_time ' - 'referer = \"$http_referer\" ' - 'UA = \"$http_user_agent\"'; - access_log {{ .Values.nginx.persistence.mountPath }}/logs/access.log timing; - sendfile on; - #tcp_nopush on; - keepalive_timeout 65; - #gzip on; - include /etc/nginx/conf.d/*.conf; - } - - artifactoryConf: | - ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; - ssl_certificate {{ .Values.nginx.persistence.mountPath }}/ssl/tls.crt; - ssl_certificate_key {{ .Values.nginx.persistence.mountPath }}/ssl/tls.key; - ssl_session_cache shared:SSL:1m; - ssl_prefer_server_ciphers on; - ## server configuration - server { - {{- if .Values.nginx.internalPortHttps }} - listen {{ .Values.nginx.internalPortHttps }} ssl; - {{- else -}} - {{- if .Values.nginx.https.enabled }} - listen {{ .Values.nginx.https.internalPort }} ssl; - {{- end }} - {{- end }} - {{- if .Values.nginx.internalPortHttp }} - listen {{ .Values.nginx.internalPortHttp }}; - {{- else -}} - {{- if .Values.nginx.http.enabled }} - listen {{ .Values.nginx.http.internalPort }}; - {{- end }} - {{- end }} - server_name ~(?.+)\.{{ include "artifactory-ha.fullname" . }} {{ include "artifactory-ha.fullname" . }} - {{- range .Values.ingress.hosts -}} - {{- if contains "." . -}} - {{ "" | indent 0 }} ~(?.+)\.{{ (splitn "." 2 .)._1 }} {{ . }} - {{- end -}} - {{- end -}}; - - if ($http_x_forwarded_proto = '') { - set $http_x_forwarded_proto $scheme; - } - ## Application specific logs - ## access_log /var/log/nginx/artifactory-access.log timing; - ## error_log /var/log/nginx/artifactory-error.log; - rewrite ^/artifactory/?$ / redirect; - if ( $repo != "" ) { - rewrite ^/(v1|v2)/(.*) /artifactory/api/docker/$repo/$1/$2 break; - } - chunked_transfer_encoding on; - client_max_body_size 0; - - location / { - proxy_read_timeout 900; - proxy_pass_header Server; - proxy_cookie_path ~*^/.* /; - proxy_pass http://{{ include "artifactory-ha.fullname" . }}:{{ .Values.artifactory.externalPort }}/; - proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host:$server_port; - proxy_set_header X-Forwarded-Port $server_port; - proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; - proxy_set_header Host $http_host; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - - location /artifactory/ { - if ( $request_uri ~ ^/artifactory/(.*)$ ) { - proxy_pass http://{{ include "artifactory-ha.fullname" . }}:{{ .Values.artifactory.externalArtifactoryPort }}/artifactory/$1; - } - proxy_pass http://{{ include "artifactory-ha.fullname" . }}:{{ .Values.artifactory.externalArtifactoryPort }}/artifactory/; - } - } - } - - service: - ## For minikube, set this to NodePort, elsewhere use LoadBalancer - #type: NodePort - type: LoadBalancer - #type: ClusterIP - ## For supporting whitelist on the Nginx LoadBalancer service - ## Set this to a list of IP CIDR ranges - ## Example: loadBalancerSourceRanges: ['10.10.10.5/32', '10.11.10.5/32'] - ## or pass from helm command line - ## Example: helm install ... --set nginx.service.loadBalancerSourceRanges='{10.10.10.5/32,10.11.10.5/32}' - loadBalancerSourceRanges: [] - ## Provide static ip address - loadBalancerIP: - ## There are two available options: “Cluster” (default) and “Local”. - externalTrafficPolicy: Cluster - labels: {} - # label-key: label-value - http: - enabled: true - externalPort: 80 - internalPort: 80 - https: - enabled: true - externalPort: 443 - internalPort: 443 - # DEPRECATED: The following will be replaced by L1065-L1076 in a future release - # externalPortHttp: 80 - # internalPortHttp: 80 - # externalPortHttps: 443 - # internalPortHttps: 443 - - ## The following settings are to configure the frequency of the liveness and readiness probes - livenessProbe: - enabled: true - path: /router/api/v1/system/health - initialDelaySeconds: 60 - failureThreshold: 10 - timeoutSeconds: 10 - periodSeconds: 10 - successThreshold: 1 - - readinessProbe: - enabled: true - path: /router/api/v1/system/health - initialDelaySeconds: 10 - failureThreshold: 10 - timeoutSeconds: 10 - periodSeconds: 10 - successThreshold: 1 - ## The SSL secret that will be used by the Nginx pod - # tlsSecretName: chart-example-tls - ## Custom ConfigMap for nginx.conf - customConfigMap: - ## Custom ConfigMap for artifactory.conf - customArtifactoryConfigMap: - persistence: - mountPath: "/var/opt/jfrog/nginx" - enabled: false - ## A manually managed Persistent Volume and Claim - ## Requires persistence.enabled: true - ## If defined, PVC must be created manually before volume will be bound - # existingClaim: - - accessMode: ReadWriteOnce - size: 5Gi - ## nginx data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - # storageClassName: "-" - resources: {} - # requests: - # memory: "250Mi" - # cpu: "100m" - # limits: - # memory: "250Mi" - # cpu: "500m" - - nodeSelector: {} - - tolerations: [] - - affinity: {} - -# Filebeat Sidecar container -## The provided filebeat configuration is for Artifactory logs. It assumes you have a logstash installed and configured properly. -filebeat: - enabled: false - name: artifactory-filebeat - image: - repository: "docker.elastic.co/beats/filebeat" - version: 7.5.1 - logstashUrl: "logstash:5044" - - terminationGracePeriod: 10 - - livenessProbe: - exec: - command: - - sh - - -c - - | - #!/usr/bin/env bash -e - curl --fail 127.0.0.1:5066 - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 5 - - readinessProbe: - exec: - command: - - sh - - -c - - | - #!/usr/bin/env bash -e - filebeat test output - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 5 - - resources: {} -# requests: -# memory: "100Mi" -# cpu: "100m" -# limits: -# memory: "100Mi" -# cpu: "100m" - - filebeatYml: | - logging.level: info - path.data: {{ .Values.artifactory.persistence.mountPath }}/log/filebeat - name: artifactory-filebeat - queue.spool: ~ - filebeat.inputs: - - type: log - enabled: true - close_eof: ${CLOSE:false} - paths: - - {{ .Values.artifactory.persistence.mountPath }}/log/*.log - fields: - service: "jfrt" - log_type: "artifactory" - output: - logstash: - hosts: ["{{ .Values.filebeat.logstashUrl }}"] +# Openshift artifactory ha +# Requires one custom init container +# to resolve the user id perm issue with redhat +artifactory-ha: + artifactory: + ## Add custom init containers execution before predefined init containers + customInitContainersBegin: | + - name: "redhat-custom-setup" + image: "{{ .Values.initContainerImage }}" + imagePullPolicy: "{{ .Values.artifactory.image.pullPolicy }}" + command: + - 'sh' + - '-c' + - 'chown -R 1030:1030 {{ .Values.artifactory.persistence.mountPath }}' + securityContext: + runAsUser: 0 + volumeMounts: + - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" + name: volume + ## Add custom init containers