From 2742e78227a9ceca4ec80f1f284e192e8e6c5226 Mon Sep 17 00:00:00 2001
From: Marc Barry <67782240+enclave-marc-barry@users.noreply.github.com>
Date: Mon, 7 Apr 2025 15:21:35 +0100
Subject: [PATCH 01/21] initial upgrade
---
configure-tenant.ps1 | 4 +-
template/caddy/Caddyfile | 56 +++++++++++--------------
template/docker-compose.primary.yml | 60 ++++++++++-----------------
template/docker-compose.secondary.yml | 29 ++++++-------
4 files changed, 64 insertions(+), 85 deletions(-)
diff --git a/configure-tenant.ps1 b/configure-tenant.ps1
index 34f0d10..a30f563 100644
--- a/configure-tenant.ps1
+++ b/configure-tenant.ps1
@@ -307,8 +307,8 @@ $policiesModel = @(
},
@{
protocol = "Tcp"
- ports = "9999"
- description = "PiHole Gravity Database Sync"
+ ports = "80"
+ description = "PiHole Sync"
},
@{
protocol = "Icmp"
diff --git a/template/caddy/Caddyfile b/template/caddy/Caddyfile
index d2982ed..913e268 100644
--- a/template/caddy/Caddyfile
+++ b/template/caddy/Caddyfile
@@ -10,11 +10,13 @@
}
}
+# Redirect all plain HTTP to blocked page
http:// {
bind {$PIHOLE_PROXY_BIND_ADDR}
redir http://blocked.enclave
}
+# Serve cert files over HTTP
http://dnsfilter.enclave {
bind {$PIHOLE_PROXY_BIND_ADDR}
route {
@@ -28,11 +30,11 @@ http://dnsfilter.enclave {
header * Content-Disposition "attachment"
file_server
}
-
redir * https://{host}
}
}
+# HTTPS admin access, proxied directly to PiHole instances
https://dnsfilter.enclave:444 {
bind {$PIHOLE_PROXY_BIND_ADDR}
tls internal
@@ -48,39 +50,29 @@ https://dnsfilter.enclave:444 {
}
}
-# This is the 'end' of the chain; and points at the actual running pihole instance on the local host.
-http://:9999 {
- bind {$PIHOLE_PROXY_BIND_ADDR}
-
- reverse_proxy http://localhost:1080
- rewrite * /admin/{path}
-}
-
+# Catch-all HTTPS handler for certs, blocked page, and redirects
https:// {
+ bind {$PIHOLE_PROXY_BIND_ADDR}
+ tls internal {
+ on_demand
+ }
- bind {$PIHOLE_PROXY_BIND_ADDR}
-
- tls internal {
- on_demand
- }
-
- @dnsfilter host dnsfilter.enclave
-
- handle @dnsfilter {
- redir * https://{host}:444
- }
-
- @blocked host blocked.enclave
+ @dnsfilter host dnsfilter.enclave
+ handle @dnsfilter {
+ redir * https://{host}:444
+ }
- handle @blocked {
- header {
- X-Frame-Options "DENY"
- }
- root * /blockpage
- file_server
- }
+ @blocked host blocked.enclave
+ handle @blocked {
+ header {
+ X-Frame-Options "DENY"
+ }
+ root * /blockpage
+ file_server
+ }
- handle {
- redir https://blocked.enclave
- }
+ # Default fallback for all other HTTPS access
+ handle {
+ redir https://blocked.enclave
+ }
}
\ No newline at end of file
diff --git a/template/docker-compose.primary.yml b/template/docker-compose.primary.yml
index b8b2fec..5b1c0c8 100644
--- a/template/docker-compose.primary.yml
+++ b/template/docker-compose.primary.yml
@@ -42,6 +42,8 @@ services:
- etc-dnsmasq:/etc/dnsmasq.d
hostname: ${PIHOLE_HOSTNAME}
mem_limit: 150M
+ cap_add:
+ - CAP_SYS_TIME
restart: unless-stopped
ports:
- "${ENCLAVE_LOCAL_PORT}:${ENCLAVE_LOCAL_PORT}/tcp"
@@ -54,19 +56,18 @@ services:
gw-net:
environment:
TZ: 'Europe/London'
- WEBPASSWORD: ''
- WEB_PORT: 1080
- # Traffic to the pihole admin interface is
- # proxied through caddy (to apply HTTPS and handle redirects).
- # Restrict the web interface to only be available via that proxy.
- WEB_BIND_ADDR: 127.0.0.1
- CORS_HOSTS: dnsfilter.enclave
- DNSMASQ_LISTENING: all
- FTLCONF_LOCAL_IPV4: ${ENCLAVE_VIRTUAL_IP}
- FTLCONF_BLOCK_IPV4: ${ENCLAVE_VIRTUAL_IP}
- FTLCONF_BLOCKINGMODE: IP-NODATA-AAAA
- FTLCONF_PIHOLE_PTR: NONE
- FTLCONF_MAXDBDAYS: 30
+ FTLCONF_webserver_api_password: ''
+ FTLCONF_webserver_port: 1080
+ # Traffic to the pi-hole admin interface is proxied through Caddy to apply HTTPS and handle redirects,
+ # so we restrict the pi-hole admin interface to only be available via the Caddy proxy.
+ FTLCONF_dns_interface: '127.0.0.1'
+ FTLCONF_dns_domain: 'dnsfilter.enclave'
+ FTLCONF_dns_piholePTR: NONE
+ FTLCONF_dns_listeningMode: all
+ FTLCONF_dns_blocking_mode: IP_NODATA_AAAA
+ FTLCONF_dns_reply_host_IPv4: ${ENCLAVE_VIRTUAL_IP}
+ FTLCONF_dns_reply_blocking_IPv4: ${ENCLAVE_VIRTUAL_IP}
+ FTLCONF_database_maxDBdays: 30
pihole-enclave-sync:
image: enclavenetworks/pihole-enclave-sync:latest
@@ -101,11 +102,11 @@ services:
cpu_count: 1
environment:
PIHOLE_PROXY_BIND_ADDR: ${ENCLAVE_VIRTUAL_IP}
- PIHOLE_LB_UPSTREAM_LIST: http://primary.dns.internal:9999 http://secondary.dns.internal:9999
+ PIHOLE_LB_UPSTREAM_LIST: http://primary.dns.internal:1080 http://secondary.dns.internal:1080
# Only on primary
- orbital-sync:
- image: mattwebbio/orbital-sync:1
+ nebula-sync:
+ image: ghcr.io/lovelaze/nebula-sync:latest
network_mode: 'service:pihole'
mem_limit: 50M
depends_on:
@@ -115,27 +116,12 @@ services:
condition: service_started
cpu_count: 1
environment:
- PRIMARY_HOST_BASE_URL: 'http://primary.dns.internal:9999'
- PRIMARY_HOST_PASSWORD: ''
- PRIMARY_HOST_PATH: '/'
- SECONDARY_HOST_1_BASE_URL: 'http://secondary.dns.internal:9999'
- SECONDARY_HOST_1_PASSWORD: ''
- SECONDARY_HOST_1_PATH: '/'
- INTERVAL_MINUTES: 30
-
- # See https://github.com/mattwebbio/orbital-sync/blob/master/src/config/schema.ts
- SYNC_WHITELIST: true # Copies the whitelist
- SYNC_REGEX_WHITELIST: true # Copies the regex whitelist
- SYNC_BLACKLIST: true # Copies the blacklist
- SYNC_REGEXLIST: true # Copies the regex blacklist
- SYNC_ADLIST: true # Copies adlists
- SYNC_CLIENT: false # Copies clients
- SYNC_GROUP: true # Copies groups
- SYNC_AUDITLOG: true # Copies the audit log
- SYNC_STATICDHCPLEASES: true # Copies static DHCP leases
- SYNC_LOCALDNSRECORDS: false # Copies local DNS records
- SYNC_LOCALCNAMERECORDS: false # Copies local CNAME records
- SYNC_FLUSHTABLES: true # Clears existing data on the secondary (copy target) Pi-hole
+ - PRIMARY=http://primary.dns.internal|
+ - REPLICAS=http://secondary.dns.internal|
+ - FULL_SYNC=true
+ - RUN_GRAVITY=true
+ - CLIENT_SKIP_TLS_VERIFICATION=true
+ - CRON=* * * * * # Every hour: 0 * * * *
volumes:
enclave-config:
diff --git a/template/docker-compose.secondary.yml b/template/docker-compose.secondary.yml
index ddfe407..2de3ecf 100644
--- a/template/docker-compose.secondary.yml
+++ b/template/docker-compose.secondary.yml
@@ -42,6 +42,8 @@ services:
- etc-dnsmasq:/etc/dnsmasq.d
hostname: ${PIHOLE_HOSTNAME}
mem_limit: 150M
+ cap_add:
+ - CAP_SYS_TIME
restart: unless-stopped
ports:
- "${ENCLAVE_LOCAL_PORT}:${ENCLAVE_LOCAL_PORT}/tcp"
@@ -54,19 +56,18 @@ services:
gw-net:
environment:
TZ: 'Europe/London'
- WEBPASSWORD: ''
- WEB_PORT: 1080
- # Traffic to the pihole admin interface is
- # proxied through caddy (to apply HTTPS and handle redirects).
- # Restrict the web interface to only be available via that proxy.
- WEB_BIND_ADDR: 127.0.0.1
- CORS_HOSTS: dnsfilter.enclave
- DNSMASQ_LISTENING: all
- FTLCONF_LOCAL_IPV4: ${ENCLAVE_VIRTUAL_IP}
- FTLCONF_BLOCK_IPV4: ${ENCLAVE_VIRTUAL_IP}
- FTLCONF_BLOCKINGMODE: IP-NODATA-AAAA
- FTLCONF_PIHOLE_PTR: NONE
- FTLCONF_MAXDBDAYS: 30
+ FTLCONF_webserver_api_password: ''
+ FTLCONF_webserver_port: 1080
+ # Traffic to the pi-hole admin interface is proxied through Caddy to apply HTTPS and handle redirects,
+ # so we restrict the pi-hole admin interface to only be available via the Caddy proxy.
+ FTLCONF_dns_interface: '127.0.0.1'
+ FTLCONF_dns_domain: 'dnsfilter.enclave'
+ FTLCONF_dns_piholePTR: NONE
+ FTLCONF_dns_listeningMode: all
+ FTLCONF_dns_blocking_mode: IP_NODATA_AAAA
+ FTLCONF_dns_reply_host_IPv4: ${ENCLAVE_VIRTUAL_IP}
+ FTLCONF_dns_reply_blocking_IPv4: ${ENCLAVE_VIRTUAL_IP}
+ FTLCONF_database_maxDBdays: 30
pihole-enclave-sync:
image: enclavenetworks/pihole-enclave-sync:latest
@@ -101,7 +102,7 @@ services:
cpu_count: 1
environment:
PIHOLE_PROXY_BIND_ADDR: ${ENCLAVE_VIRTUAL_IP}
- PIHOLE_LB_UPSTREAM_LIST: http://primary.dns.internal:9999 http://secondary.dns.internal:9999
+ PIHOLE_LB_UPSTREAM_LIST: http://primary.dns.internal:1080 http://secondary.dns.internal:1080
volumes:
enclave-config:
From 3c6c8201a5430e866271b678e1a58b21eb46ee02 Mon Sep 17 00:00:00 2001
From: Marc Barry <67782240+enclave-marc-barry@users.noreply.github.com>
Date: Mon, 7 Apr 2025 19:27:59 +0100
Subject: [PATCH 02/21] update Caddyfile redirects
---
template/caddy/Caddyfile | 38 +++++++++++++++++++-------------------
1 file changed, 19 insertions(+), 19 deletions(-)
diff --git a/template/caddy/Caddyfile b/template/caddy/Caddyfile
index 913e268..9ff25c7 100644
--- a/template/caddy/Caddyfile
+++ b/template/caddy/Caddyfile
@@ -30,23 +30,7 @@ http://dnsfilter.enclave {
header * Content-Disposition "attachment"
file_server
}
- redir * https://{host}
- }
-}
-
-# HTTPS admin access, proxied directly to PiHole instances
-https://dnsfilter.enclave:444 {
- bind {$PIHOLE_PROXY_BIND_ADDR}
- tls internal
-
- reverse_proxy {
- to {$PIHOLE_LB_UPSTREAM_LIST}
-
- header_up Host {upstream_hostport}
-
- lb_policy first
- lb_try_duration 5s
- fail_duration 30s
+ redir * https://{host}/admin/
}
}
@@ -59,7 +43,7 @@ https:// {
@dnsfilter host dnsfilter.enclave
handle @dnsfilter {
- redir * https://{host}:444
+ redir * https://{host}:444/admin
}
@blocked host blocked.enclave
@@ -75,4 +59,20 @@ https:// {
handle {
redir https://blocked.enclave
}
-}
\ No newline at end of file
+}
+
+# Load-balanced access to pihole admin dashboard. Always targets the primary first as config is replicated.
+https://dnsfilter.enclave:444 {
+ bind {$PIHOLE_PROXY_BIND_ADDR}
+ tls internal
+
+ reverse_proxy {
+ to {$PIHOLE_LB_UPSTREAM_LIST}
+
+ header_up Host {upstream_hostport}
+
+ lb_policy first
+ lb_try_duration 5s
+ fail_duration 30s
+ }
+}
From 2115625d1f4340bd44b0ef26975d9f4783b76d58 Mon Sep 17 00:00:00 2001
From: Marc Barry <67782240+enclave-marc-barry@users.noreply.github.com>
Date: Mon, 7 Apr 2025 19:49:30 +0100
Subject: [PATCH 03/21] Correct settings for nebula sync
---
template/docker-compose.primary.yml | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/template/docker-compose.primary.yml b/template/docker-compose.primary.yml
index 5b1c0c8..29c364c 100644
--- a/template/docker-compose.primary.yml
+++ b/template/docker-compose.primary.yml
@@ -116,12 +116,14 @@ services:
condition: service_started
cpu_count: 1
environment:
- - PRIMARY=http://primary.dns.internal|
- - REPLICAS=http://secondary.dns.internal|
- - FULL_SYNC=true
+ - PRIMARY=http://primary.dns.internal:1080|
+ - REPLICAS=http://secondary.dns.internal:1080|
+ - FULL_SYNC=false
- RUN_GRAVITY=true
- CLIENT_SKIP_TLS_VERIFICATION=true
- CRON=* * * * * # Every hour: 0 * * * *
+ - SYNC_CONFIG_DNS=false # Config items set by ENV var cannot be changed, produces a 400 from the far-side API if not set
+ - SYNC_CONFIG_DATABASE=false
volumes:
enclave-config:
From 859319a822d9fcc640b88c8772a2e56ced6efcf1 Mon Sep 17 00:00:00 2001
From: Marc Barry <67782240+enclave-marc-barry@users.noreply.github.com>
Date: Mon, 7 Apr 2025 19:59:42 +0100
Subject: [PATCH 04/21] Update configure-tenant.ps1
---
configure-tenant.ps1 | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
diff --git a/configure-tenant.ps1 b/configure-tenant.ps1
index a30f563..2ba770c 100644
--- a/configure-tenant.ps1
+++ b/configure-tenant.ps1
@@ -300,15 +300,10 @@ $policiesModel = @(
"internet-gateway"
)
acls = @(
- @{
- protocol = "Udp"
- ports = "53"
- description = "DNS"
- },
@{
protocol = "Tcp"
- ports = "80"
- description = "PiHole Sync"
+ ports = "1080"
+ description = "PiHole API Configuration Sync"
},
@{
protocol = "Icmp"
From 8f9ae88c307ea48a9521a33da172b311ce50a7d6 Mon Sep 17 00:00:00 2001
From: Marc Barry <67782240+enclave-marc-barry@users.noreply.github.com>
Date: Tue, 8 Apr 2025 14:00:35 +0100
Subject: [PATCH 05/21] Update configure-tenant.ps1
---
configure-tenant.ps1 | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/configure-tenant.ps1 b/configure-tenant.ps1
index 2ba770c..cb79e85 100644
--- a/configure-tenant.ps1
+++ b/configure-tenant.ps1
@@ -256,7 +256,7 @@ $policiesModel = @(
@{
protocol = "Tcp"
ports = "444"
- description = "PiHole"
+ description = "Load-balanced access to PiHole admin dashboard"
},
@{
protocol = "Icmp"
From fae29d6f6cca499ff654f8ebae4f64eb2968d835 Mon Sep 17 00:00:00 2001
From: Marc Barry <67782240+enclave-marc-barry@users.noreply.github.com>
Date: Fri, 30 May 2025 15:31:35 +0100
Subject: [PATCH 06/21] gateway policy should be ordered
---
configure-tenant.ps1 | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/configure-tenant.ps1 b/configure-tenant.ps1
index cb79e85..c596005 100644
--- a/configure-tenant.ps1
+++ b/configure-tenant.ps1
@@ -342,7 +342,7 @@ if ($HasEnrolledGateways -eq $true)
gateways = @()
gatewayTrafficDirection = "Exit"
gatewayAllowedIpRanges = @()
- gatewayPriority = "Balanced"
+ gatewayPriority = "Ordered"
}
if ($HasPrimaryGateway -eq $true)
From ae66121a25b00939394024992d48e0d6c3292d30 Mon Sep 17 00:00:00 2001
From: Marc Barry <67782240+enclave-marc-barry@users.noreply.github.com>
Date: Fri, 30 May 2025 15:31:38 +0100
Subject: [PATCH 07/21] Update README.md
---
README.md | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/README.md b/README.md
index 878bae8..aa71e11 100644
--- a/README.md
+++ b/README.md
@@ -195,10 +195,13 @@ To test if your network traffic is successfully routing through the Internet Gat
## Operational notes
-- Failover between gateways is automatic. If one fails or goes offline, connected systems will automatically switch.
-- You may need to disable `Use secure DNS` in Chrome (`chrome://settings/security`) to stop it sending DNS queries directly to Google nameservers.
-- Notice the `300M` docker [memory limit](https://github.com/enclave-networks/internet-gateway/blob/main/template/docker-compose.primary.yml#L13) applied to the Enclave container and increase as required.
-- Only make PiHole configuration changes on the _primary_ gateway as the PiHole configuration in [synced](https://github.com/enclave-networks/internet-gateway/blob/main/template/docker-compose.primary.yml#L124) _from_ the primary to the secondary every 30 minutes.
+- Failover between gateways is automatic.
+- If one gateway fails or goes offline, connected systems will immediately and automatically switch to the partner.
+- When the primary gateway recovers, connected systems will automatically fail back to it.
+- You may need to disable `Use secure DNS` in Chrome (`chrome://settings/security`) to stop Chrome sending DNS queries directly to Google nameservers and bypassing DNS.
+- Only make PiHole configuration changes on the _primary_ gateway as the PiHole configuration in [synced](https://github.com/enclave-networks/internet-gateway/blob/main/template/docker-compose.primary.yml#L124) _from_ the primary to the secondary every minute.
+- Any changes made to the secondary gateway will be destroyed during the next sync from the primary.
+- Notice the `300M` docker [memory limit](https://github.com/enclave-networks/internet-gateway/blob/main/template/docker-compose.primary.yml#L13) applied to the Enclave container. Monitor and increase if necessary.
## Inspection
@@ -212,7 +215,7 @@ sudo iptables -t nat -L POSTROUTING -v -n
### Uninstall
-!!! Warning: Read these commands **BEFORE** you run them. If you don't understand exactly what they will do, contact us on our support channels for assistance.
+!!! Warning: Read these commands **BEFORE** you run them. If you don't understand exactly what they will do, contact our support channels for assistance.
```bash
sudo docker stop $(sudo docker ps -q) && sudo docker rm $(sudo docker ps -aq)
From f8df151ef22f273d70716802fdebe998977a2161 Mon Sep 17 00:00:00 2001
From: Marc Barry <67782240+enclave-marc-barry@users.noreply.github.com>
Date: Fri, 30 May 2025 15:32:01 +0100
Subject: [PATCH 08/21] fix sync
---
template/docker-compose.primary.yml | 27 +++++++++++++++++++++------
1 file changed, 21 insertions(+), 6 deletions(-)
diff --git a/template/docker-compose.primary.yml b/template/docker-compose.primary.yml
index 29c364c..91f635c 100644
--- a/template/docker-compose.primary.yml
+++ b/template/docker-compose.primary.yml
@@ -58,8 +58,6 @@ services:
TZ: 'Europe/London'
FTLCONF_webserver_api_password: ''
FTLCONF_webserver_port: 1080
- # Traffic to the pi-hole admin interface is proxied through Caddy to apply HTTPS and handle redirects,
- # so we restrict the pi-hole admin interface to only be available via the Caddy proxy.
FTLCONF_dns_interface: '127.0.0.1'
FTLCONF_dns_domain: 'dnsfilter.enclave'
FTLCONF_dns_piholePTR: NONE
@@ -119,11 +117,28 @@ services:
- PRIMARY=http://primary.dns.internal:1080|
- REPLICAS=http://secondary.dns.internal:1080|
- FULL_SYNC=false
- - RUN_GRAVITY=true
+ - RUN_GRAVITY=true # Important, rebuilds gravity database after sync
+ - CRON=* * * * * # Or, run every hour: 0 * * * *
- CLIENT_SKIP_TLS_VERIFICATION=true
- - CRON=* * * * * # Every hour: 0 * * * *
- - SYNC_CONFIG_DNS=false # Config items set by ENV var cannot be changed, produces a 400 from the far-side API if not set
- - SYNC_CONFIG_DATABASE=false
+
+ # Config synchronisation
+ - SYNC_CONFIG_DNS=false # Keep false - Config items are set by ENV vars and cannot be changed. Produces a 400 from the far-side API if not set. DNS settings are host-specific
+ - SYNC_CONFIG_DHCP=false # Keep false - DHCP should only run on primary
+ - SYNC_CONFIG_NTP=true # Sync NTP settings
+ - SYNC_CONFIG_RESOLVER=true # Sync resolver settings for consistency
+ - SYNC_CONFIG_DATABASE=true # Keep false - Config items are set by ENV vars and cannot be changed
+ - SYNC_CONFIG_MISC=true # Sync miscellaneous settings like nice levels
+ - SYNC_CONFIG_DEBUG=false # Keep debug settings host-specific
+
+ # Gravity/blocking synchronisation
+ - SYNC_GRAVITY_GROUP=true # Sync groups for organisation
+ - SYNC_GRAVITY_AD_LIST=true # Sync blocklists/allowlists
+ - SYNC_GRAVITY_AD_LIST_BY_GROUP=true # Sync which lists apply to which groups
+ - SYNC_GRAVITY_DOMAIN_LIST=true # Sync individual blocked/allowed domains
+ - SYNC_GRAVITY_DOMAIN_LIST_BY_GROUP=true # Sync domain list group assignments
+ - SYNC_GRAVITY_CLIENT=true # Sync client definitions
+ - SYNC_GRAVITY_CLIENT_BY_GROUP=true # Sync client group assignments
+ - SYNC_GRAVITY_DHCP_LEASES=false # Don't sync DHCP leases between hosts
volumes:
enclave-config:
From c3509a960eec7e175537d13727e2faa4784198ef Mon Sep 17 00:00:00 2001
From: Marc Barry <67782240+enclave-marc-barry@users.noreply.github.com>
Date: Fri, 30 May 2025 15:35:40 +0100
Subject: [PATCH 09/21] Update README.md
---
README.md | 2 ++
1 file changed, 2 insertions(+)
diff --git a/README.md b/README.md
index aa71e11..2807e3b 100644
--- a/README.md
+++ b/README.md
@@ -202,6 +202,8 @@ To test if your network traffic is successfully routing through the Internet Gat
- Only make PiHole configuration changes on the _primary_ gateway as the PiHole configuration in [synced](https://github.com/enclave-networks/internet-gateway/blob/main/template/docker-compose.primary.yml#L124) _from_ the primary to the secondary every minute.
- Any changes made to the secondary gateway will be destroyed during the next sync from the primary.
- Notice the `300M` docker [memory limit](https://github.com/enclave-networks/internet-gateway/blob/main/template/docker-compose.primary.yml#L13) applied to the Enclave container. Monitor and increase if necessary.
+- To bring the stack down: `sudo docker compose down`
+- To bring the stack up with latest images: `docker compose up -d --pull always`
## Inspection
From 82ed99f16de1354d606f64538c05f4233ab4a473 Mon Sep 17 00:00:00 2001
From: Marc Barry <67782240+enclave-marc-barry@users.noreply.github.com>
Date: Fri, 30 May 2025 15:36:13 +0100
Subject: [PATCH 10/21] Update README.md
---
README.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/README.md b/README.md
index 2807e3b..d2aa8f7 100644
--- a/README.md
+++ b/README.md
@@ -203,7 +203,7 @@ To test if your network traffic is successfully routing through the Internet Gat
- Any changes made to the secondary gateway will be destroyed during the next sync from the primary.
- Notice the `300M` docker [memory limit](https://github.com/enclave-networks/internet-gateway/blob/main/template/docker-compose.primary.yml#L13) applied to the Enclave container. Monitor and increase if necessary.
- To bring the stack down: `sudo docker compose down`
-- To bring the stack up with latest images: `docker compose up -d --pull always`
+- To bring the stack up with latest images: `sudo docker compose up -d --pull always`
## Inspection
From dcb8cef2601d3425fe83403ef7225cec34f14692 Mon Sep 17 00:00:00 2001
From: Marc Barry <67782240+enclave-marc-barry@users.noreply.github.com>
Date: Fri, 30 May 2025 15:37:30 +0100
Subject: [PATCH 11/21] Update README.md
---
README.md | 1 +
1 file changed, 1 insertion(+)
diff --git a/README.md b/README.md
index d2aa8f7..f9fd7b7 100644
--- a/README.md
+++ b/README.md
@@ -204,6 +204,7 @@ To test if your network traffic is successfully routing through the Internet Gat
- Notice the `300M` docker [memory limit](https://github.com/enclave-networks/internet-gateway/blob/main/template/docker-compose.primary.yml#L13) applied to the Enclave container. Monitor and increase if necessary.
- To bring the stack down: `sudo docker compose down`
- To bring the stack up with latest images: `sudo docker compose up -d --pull always`
+- To rename the stack, edit `COMPOSE_PROJECT_NAME=` variable in `.env`
## Inspection
From b127d3fefc06d74169add9251a6fd89d5f538baf Mon Sep 17 00:00:00 2001
From: Marc Barry <67782240+enclave-marc-barry@users.noreply.github.com>
Date: Fri, 30 May 2025 17:44:54 +0100
Subject: [PATCH 12/21] update blockpage style
---
template/blockpage/index.html | 128 +++++++++++++++++++++++++++++-----
1 file changed, 110 insertions(+), 18 deletions(-)
diff --git a/template/blockpage/index.html b/template/blockpage/index.html
index a324567..bcad682 100644
--- a/template/blockpage/index.html
+++ b/template/blockpage/index.html
@@ -1,22 +1,114 @@
+
-
- Site Blocked
+
+ Site Blocked
+
-
-
-
-
This site has been blocked by your administrator.
-
Contact your administrator to request an exception.
+ a:hover {
+ color: #227eb8;
+ text-decoration-color: #64748b;
+ }
+
+ .content {
+ text-align: center;
+ max-width: 520px;
+ padding: 3rem 2.5rem;
+ background: white;
+ border-radius: 16px;
+ box-shadow: 0 8px 40px rgba(0,0,0,0.06), 0 1px 3px rgba(0,0,0,0.08);
+ }
+
+ h1 {
+ color: #1e293b;
+ font-size: 1.75rem;
+ font-weight: 600;
+ margin-top: 0rem;
+ margin-bottom: 0.75rem;
+ letter-spacing: -0.025em;
+ }
+
+ h2 {
+ color: #475569;
+ font-size: 1.125rem;
+ font-weight: 500;
+ margin-top: 0rem;
+ margin-bottom: 1.25rem;
+ letter-spacing: -0.015em;
+ }
+
+ p {
+ color: #64748b;
+ font-size: 1rem;
+ line-height: 1.6;
+ margin-bottom: 1rem;
+ }
+
+ .msp-info {
+ margin-top: 2.5rem;
+ padding-top: 2.5rem;
+ border-top: 1px solid #e2e8f0;
+ text-align: left;
+ }
+
+ .msp-info ul {
+ text-align: left;
+ color: #64748b;
+ line-height: 1.7;
+ padding-left: 1.25rem;
+ }
+
+ .msp-info li {
+ margin-bottom: 0.5rem;
+ }
+
+ .ticket-info {
+ background: #f8fafc;
+ padding: 1.25rem;
+ border-radius: 8px;
+ margin-top: 2.5rem;
+ margin-bottom: 0rem;
+ border: 1px solid #e2e8f0;
+ text-align: center;
+ }
+
+ .ticket-info strong {
+ color: #334155;
+ }
+
+
+
+
+
This site isn't accessible right now.
+
Content filtering is actively protecting our network, and this website has been identified as inappropriate, potentially unsafe, or malicious.
+
+
+
Need to request access?
+
+ - Raise a support ticket with the blocked website URL
+ - Include your business justification for needing access
+ - Tickets are typically reviewed within 24 hours
+
+
+ Raise a ticket to request access at example.com
+
-
+
+
\ No newline at end of file
From 943bb23572e26b3d941c964fc6f194460b3dbfd8 Mon Sep 17 00:00:00 2001
From: Marc Barry <67782240+enclave-marc-barry@users.noreply.github.com>
Date: Mon, 2 Jun 2025 23:51:47 +0100
Subject: [PATCH 13/21] Update index.html
---
template/blockpage/index.html | 1 +
1 file changed, 1 insertion(+)
diff --git a/template/blockpage/index.html b/template/blockpage/index.html
index bcad682..10131d7 100644
--- a/template/blockpage/index.html
+++ b/template/blockpage/index.html
@@ -14,6 +14,7 @@
align-items: center;
font-family: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
background: linear-gradient(135deg, #f8fafc 0%, #f1f5f9 100%);
+ min-height: 640px;
}
a {
From b198b351f6a9966b5db402604a80c18ee95192fa Mon Sep 17 00:00:00 2001
From: Marc Barry <67782240+enclave-marc-barry@users.noreply.github.com>
Date: Tue, 10 Jun 2025 13:30:11 +0100
Subject: [PATCH 14/21] signpost to blockpage customization
---
README.md | 4 ++++
blockpage-example.png | Bin 0 -> 69979 bytes
2 files changed, 4 insertions(+)
create mode 100644 blockpage-example.png
diff --git a/README.md b/README.md
index f9fd7b7..c722656 100644
--- a/README.md
+++ b/README.md
@@ -14,6 +14,10 @@ You will need:
git clone https://github.com/enclave-networks/internet-gateway.git
```
+1. Customise your DNS block page (`./template/blockpage/index.html`) as required
+
+ 
+
1. Install Enclave, Docker, and other dependencies
```bash
diff --git a/blockpage-example.png b/blockpage-example.png
new file mode 100644
index 0000000000000000000000000000000000000000..619ef62de67e52a29ba8f981cb2f85a426c9a0a8
GIT binary patch
literal 69979
zcmeEtWm_CP(>5(_f#OzNTC^-u+@TcrQe+oh+}+)s;_k)W-QC^Yi@Plj&(iDu4ezJ-
z!ybfeGMUUwk~wE)gMP}0B7emH2m=FyEG{PW3kC+36b9z)Dg0Y#55^MP0rU^HtuV+|
z&{|K+*2uz~RKdth4+d`k!$%|>%1<{Za?k;Aw&K#l|GMyr`s9
k5Uo8V~IANn!peVdnuyBinx9b8B7rxrzjWd7Mk8u)F~yn
z+W8P&%*a`k7F~Rjl*QPmXt6wFI+~drK*@-kB~(RCY3lkx8s1-Bpz05Xs}SQ4tnuH}
z`hOYgT$~&8n(|z74RUuohF_@mv4myq>=f;8*uid34AM43>aW{^fte=jU&8*^I%C(=
zeDm7MM?#|g*AwgI_5QW-hv{4SzYc{DA3nV{JO|s`|4sjihYR}m4GkKo5y?XiBr&GnnOl=zdRHDtN)
zh>2t2yo%BYEIM={^PDQtr|p_@;gai-~FG7fh@&NgZsPn@iP7qxurOZ;0)<<2F{*?(%}AE7$(*W4r)@K9-DB)
zWF(j5cG_tF#=>~?mN)~gjmBiLI{z7A${S*)NhcoNv;RnQgj4owUof`P2ct9#!$Uc&
z$9`S>Hab9D+IPxp)hPh&zXfjJ7VfEQ(fxo9Y3KI}7*h5icz)8JY^FL+G!~Mq*$~siij!`^sX1~0HuKnF0Pkv8*z>M)f
zDdITxi>*8TZ)H+6IpI?YSR$y^oQGIUA`!pz4!4aAZZ|OyeN(kb=S)yC7{dD6&n|tF
za2cB?O=8DVlFg-b_i=IuF%bthoBa4TG{@#XcY3@jO45b+)keM}5t(SqB$7mIR*xmC
zo5rp@kiw;+&x|nKohoQRhlMP7qkMw-F1`Nw5{KtBF?#4mYbt)@ntk9HmG+T~Co{-J~_
z*t&{pz(G6j@5PhzVNe1MoOkRpn*4T{F_+GI62qB{q33;N&i2Pw^YXmE6_ARxLA8cS
z`Oab250)**+*22TDt{g6EFx%<50%Hp9aBE%*HMfQqvEeL=7t2C2aB(bKMZb6JD|4e
zIT}FHt9wp+?@;j~Iu9ws
zPW$vfe*k>XNZ)(|S+^?VU3Y(+cmG*%H&fHBX0$Ie2WzZsAC{*cmKs%smf@gx>TE@p
zR^8HUzPkWJOiSwDm}59Ulvvq`mCM~T>*|e?yRsd0&Z-II&_h_f!LVE0k>eYDQy%&|
zE|$Yyf_}u=KU=3T;X?6us@6%GDR_+
z`9zQ5YK^#!q_BB(zoXcdd>L))`9odezZy$Hx9q&?_a0VK?}$5pUEDf4q>DWb$$dOj
z!&u*ru1RJE_M{eVWltQchrCjpx~$-eZFzTE$8t|=F0Q8CpoR^ODE%`t)QBdl759jt
zo8%IOn|lG%xWg>G+c#;9%Eeg)^R5P0r3or7Ql}poLC-$atrFC5ngew*lAC^?VMIOQ
z(o7F{&maG&s#(aiwO^)jHn@^NQW}or5OrGsGrJGX7s}XPUf3W*HD}lQn-6r`2vD0R
zKuu&wAS_M(a#Hc`uB-c6YtKQIKXAm_?FxpZPgqb?m|$pQ$^VcM^o|RZ3Kv2)7#aD)
zqXoVkF5Kn#&COOH#7APJtaN)@Leim;_~%fi4G(e)z+<|}8fzDcGH-;o?4e@4<3bR3
zYT+dGmlGj2|H{`|Q||Al5+CQWWt6?$q32@RhY*IUyvU(P+Wg{jMCX^pDGjyQme7&H
z&z})+SEaW`&!0ZTm1TWv9b^eu&A6YyMn=2ggn!gGIgv~+Uwf>F?pHruXa!M99Q8qW
z>_JdUF>kKvqSQS$fJn0x7IuiF97mbLMQ7Wt?VjDR4H7Y72i2BNR}8-{7V_Ar#W|-j
zzvZ0G?(YKc03=6EuJDDaj3xh`ww~X-HP@xZ&4%M07iL(4Wr+8(9f4UoCvUIc>}a@j
zJ>7Z{ZRY4J%~c*w^RAmCPMot`l|HJR4$8SmZam8*SZSQ=bok6DPmE)F2b;T!WKHsp
zJUF|0kqk8Gp5UYzIXSEhJ^P?iO~#J$0vnzm_XlR^b%=B$TD7f^AFx
znHt5_{MBv&l!BYt?5=Ic8AIFIV2Nx}~a1JJa&hzIldH6BI_h#Sh{vVK2q+NymDjgD*2u)9&2E>9o=fryNbpPrzSMDoZvXE->^)md4&Y8u
z3Oy2k%9W)mM`ucU%3F)Kv8xgKkgv!4`o0UeL7FK)wMeA>EQ!T)S^1VxRqS!k@tHda
zKhZ7F+jSOVO+z>DOz2on+rO`l&Xt`SxLKOe&~Zkb0j~oGrLp!?wk3I_E{L*U+MTxT
zN^^tm2jZ}a&tp7XB6}d7WD3=^03yJ)+TjZ6_`@L-p?Izd;wkY8HmxBjhcLYHT9vM#rN;uc`q96
zj;;GF*~x`Et-lRsb2}EDz(W{StO>;ku>TI3@}g>&8@@va`rY2WLxV~R8qfpo0+O}_6M6`>L*)!f&1?g+_?qd&t{Hqk>D
zAde$z0SsvebSt+2(kD7Ts=-QPISA9P7NZ>21A4uBvVDAD>n5Pvd&lwlbB7dCoDl#$
zyyvfKA8=qB5Z+<^m2Kz}c{?`i{_U3*fO*lz$n-_126B-nHsL$F5723EK3<~f#uRa|
zM|IY~C-TqFHfh^itDH)hhyK{pbV9ilB8APf>Y1PY#RU?nf-54UhTqJDPJ4@W@Ogeh
zpifg-I~g?8|46{?C04vy#3Ce)6nDpXl(HJDHXMh8Kgb<${pQvgsFpOy!)mml~xSJo6D1Q@)}_w0clXjxVEP=JmUg358A&pcE##
zLLUDvfkxP9NAr8xk9tEVWa@*$<8%$67aMaUMW>6@u%#lT-oZhrO7f0`05<
z-@8xJwCsE8=K%8jls<%RTw3vCz#$0W&htqJ-sD!!^&e-QAq7z(-IZAmdQ=}m=mPU`
zleewjPW$xqsH0y#{^6{b&{f2=H_>ISSZ{+`1KRr8W~tCBnLGKXR0f=&oQ+sAyzrcj
zZfve&6<;qy&2z;v+`rXj^G_okp#MDV`WaZ|zSv%o<=Eel*l&Y_5~mV;GDBgj*xKdI
z{uD4FB;XmXnCVt+h?YC+p=Khv3G{OD^z?Ja`anRJG1O`Ip~nhXTV3{>?ZVF(gwkvJ
z`NI$*$OL@8RV2g(8ou|@m!?HdhJ|kB-8bt4rKk!ew(7FwOb0()+A_@&H(}aCQ>e(v
zr^f#w2Xeb|@;Ym0poqL_oa$96n$I?NaZOoZtlrR`x>eh`U&Vi*3ABn?-3>IV=b$l1
z)liG^Esa%(iTybgOxORp1t72-``r_f5p*K-$FoP(<7c*mFvspE1~x>lf7pKGP_sf`
zQZztMTkOk;1dY8!ua{oTf@r~NZ1K1FK7?XiS}zE;*4y&mvsS<;BXjj1P}WH!HhRba
zlTDit>}?&oA1?yNPXb>8Tbb-FjZ9#1|D!8=J=lNAhOk*tuinrWyj9^y^6Bqoo&8od
zbQ5I#CH&M?ReE$kC_`~yp{Zv`2L`kY6!H_-fue#wBl6vQ@j?(nZLS;Pc#}6u9L^t6
zZ&LkKbo1RI`?FaRmf)%1C~@d~|4?nH9a7w|itn#dYOU7Il3%YF$mvZh1Uo)1ux1iu
zO+NK%Hl$l;i{5F|O&HzkP=%1eYkX$WV)=Mv)LE#pFmK=f3Oz~7Gh&y0eD17(P=UL`
zVd2>5m>f2)#>Up>)M=N$9rmGk+~_PEZUvB?J_+2pTBJj7c9?bPTP~2PzeqLq>DPG-
z(W!3zB(dGgIt@pAxCA&!TptQGn~0fu?Maa=>a~6mZKnqw=p-16FTov~n?=LMptyQK
zC=^?#l*S%913O(?WrwET{hO!|j1ssQ8T=
zG9bSKG#Jl3pB!`}wSk<(@Sw@yn9}l38R1>P_D#$2TvnzI&??_+{HHy+yifr@gkM79
zbkMj)0D%s$@rq{g1Fl}j=P|mJ-a_sC(2Erdc8KePWLG+aLYzMo0z%15*Hnh3PKxy?
z;8EOAc`G7P=oGRhPC!LiM`e)%g#-Z}>L4WH+#I(dBLz2lT-I^U9
z|8@`=(ovb?ARMS!D?{H$(>e%sL#()Dpr?oUJIx14d+-1*?SD`nZ9~Nue@H4ldo}j^
zoCK3TfV$rvdId*FT$lcx9PhA(i&KQZD+CgWxQ9WVMeTp_0rWUr+ALS<7$UehSZ5%Q
zu;ad)5Mmi_qMom?Q8*?VBS`Hk7V6VvuVUjk2>EGF%2L?;A0#7JW0z;Q-a+5LpKwFwNT2?T
zEs&p^{ij?gNx`vW1o!%W8Zw4K3Gv0Hyv@97HQE)hduflPD7zZ}^>&4Pr~~Y_t5>k2
z`&mAG?`O+T56(dQy3#WKz#4eBH+bl@`yc?<7gR0~7SIHeTI`_tQtp*#n}c*z-Hw^}o5Nmz~gv1}ZRHXf=zC7MdX7`-XNo{J!Qg+64m^J_T&PX`kl6
zzUJ4-CXDP*sNFHJ*_Nl=!c9{cgIw!57r2j~1=9E)$J4`+*r-G)sjO!e&nK_E$fWq0
zFBu*t?s|JJ!yQd0;4h8%uF}X>CE7`u9l73X5C)ty)qC!qLE|Ny{|+*m2@$QTs*1V-
zCDBht(8NIa*d{NNx!U97aF0KrE@7=Y2#?u60O8qq?_k-g8kPR3kko1_?EX!a0e{-M
z?&nd=oL<9&ZShDwZmeqsm5#fm@l;DZlEOmVBRpa%)EJO{m)
z->Ffv(EGtz&pGUJikONNiPk`;{P!a+?OP&R14fqFn7BEDd<8>WYirlFpA+d8tSrgk
z&Po4k6ddX5YBhdE4X1_2O!={T@ZP2~=Y`pl<>B(cg$+Mbn=Mg9e#qgPyrnOsiQQtE
z>6<9(F%hu@5_{>IDHS{NGRg>Y=vtJV2?q=pI8Bpt|JE0vI$@LeZn}fF>{d1@7w4aka%#blbc1prRI;@{}
zMj&C01YhrRX{xvXzN(DHRm}RLJgs)I=E=MZ?{a^Nj9ePWAdAU98Cbd)r88!HHg7`j
zGE=oist&iD&QqD5iIEU#TBtVGIxVntn#S$^o6mtVW);Hmx290C>8dU6ueDqUdm$UcOWBO~SW@5!sAeOUDqz8-7x&=i$!g&7
zF=X?x{MPBvCZ4~)mCi9|eL|dIEHTO|#DT~?$<$4M*7(_UaiLkXZ)XC53x?ChGqmyj
z4I$@YPMt?OV><*Hc;ZS__U-B1D}B^W-|Sp*^?9+|@3ai;ntpW{VO24a`2%;<%-Q^k
zvJ_p{E!w{-onHBIx3fxH(Yy8QLeU(3!t~eytb$-mrSyOBRZMOI#t>I>^VJE0_j5rQmO0l{kK2u`vM6D0F0b
z9E+EZm3sVp!dsOocy4emUwD{hCgc;%BN`+TNAY|YD)5G0)+8^ZOxw;?Ebs=VX4Rc*
z2bg3MemXZ;iQz4Q&4)Eo820?!3p|`1R<`2n!@C*QZdRK?MLLTOtB2U?YHXw0($#i%
z;$yozbW%t-ZZZq)fTykMh8=bcChPFB#L=o58jY8=aCb+^3td?==YvS;>)OT7XlOl}
z6=moW*+JB1wv=Wx-hn(67pkGQi&O7}BDkqMgb62JgYNWG3e8fs?BrK2D^4$wPpiV*
zBqdL_kgHwtG|Q{>uvVVSh7lZ7_vReqYn>|cv|Owa*5utWWd+xvyQxM}`8tSd-bH*4
zKV)}Ozi-I4w3DA$l?7<1E{9vl##13S&1ZE^(_G|O<+#1KZ&FeM2==dhyhG)uJHg7$
zKoR#HW5=>^wQbJFw1_Qr;(B@yI1J{?3L$Cvb{Jnq*!0!#IE3WsAw_g9qy!)ji#42n
zaW$mZ{K+QYNuAJzXLOqmLm8NB^KvQp!v3Pxv?7~KAY`hZSXgl%#98H_Uak6WC}$+3
zq&EmD-htt6`_a{kL5&yE)Bp(asD6^eDRmGQiwB?Y*lb>4qc&F$BS9Fp``!x#v!;`5
z_zR5yV;>p8;QRNg)-Ti5?bW4$;fLyX5=ctlaY3Ib9I}K5Qm1NuCC$D|K#4nyF;}U+
z;X()*OJTh}SH_HTJPDOQoHMVnYid)yy_Iwp~R5@JNg<+A+X_G=(ztX-|YxPaMzpk65nm0qPg4S4oP
zJVZM6*KNGwf)6d6dJi{sTZSRd-1N4|Tyu+k$JWnr~Y@R#&U7kb6G#
zcnTyk3jRQRUDG|ivIy5#k=CS|?k1=6^<1K77f9QN?V)Ubmy>e+Y*>79SI3-C>!LW~R6qX18PvhWJff=JUmRqbT
z$sqIWOb^E`ZacXpw4sDCJX}dX>okKb(p#9*!Aat6;?G7#C10~VW-nsn215MR3F?wg
zSI$EaS5^8)K1ruU;JsW49!lTr2_~~C%7RkPB%yQdMhR(ictDxj$(
zQtCBz*2PbKPU^CZ{{ENc+6Uz-_nmB`g|XH?HU%?{lZ=!)Dtn6K?S{hz1JGaJIz(_{
zx74Q8u%k6S)sA>D`w<7bo(5rTqe}UKV3i$qo#oP6`ffKTb8h%UgED{B(_Z6^N$%8z
z3<_&mh>oln!*hdF!cDp;jx@M8WoQJI-TdiVRTdI`M_MLOEk8>L9?}pZ*O`pbtra+6
zZ+5ZWIK+cc5fsdd4KF-Fc#1fc8FMTwX!WEuG|Kd(21hyT_8S78^Ll3ku+>g$8R)s^
zsoS3B4fGsH(tm(|2Y=Am%42BbuJXkv$QX#07qh}ko%^X`b;rMzIEX8wl%^dF&sL-1
zH1jpexHe}{B4niJCWU9VD$}j?odw+wqZWW4BS=EKN~-MA1PX{T-pQ%frcwRm0nvX2
z3&0I=dNV7PtrH{J22N)C*=)_Pm9AJ$59xfd(iqqu1E98EKMx*}Q^<0lYhkXI(H4AN
zt<_oa-XFb%m|U!~b0b$Tv?){nh7ECX-tT;ts^s$khh_WSlPbTdQjUF${X+0kfD~^5484J)Y
zbLlnxsmG@x^Q4F}!fkDOHbrz7f#yA*TlqHw7kqxZ~xnsCjAU6GmJi
zFJ07JYs@U_zJu>+nPojm%t16`kK`_O=-CFhF6!R59edU3b3WAUUewA;3+CV42APH{
zC@PhQD&JFV6-lOb(;i!HCoFs+|2xfYdZ(oveQI-^!o|o};;;>%FNPwh`aQrGZ24_N
zd}_S}nMcB4qJF38G4=8cQ%6~V`c(zJ
zj+)*iYX~3reur)me;-v|qCE22Gz&HT%>Ku|{Y~N3kT*VXl>ec
zEgMG_*Q((QhWV}0Od`Qx_7JdI{i)*y*xDnVm)FbPGnH#pxIej
zVSn>TcM9>{+z?>CBRVlj|C)ZOU$@qzR6&uIYq6O=jF%5%chX@|M~%hFXr|6Oy_!X=
zvtA0o5D#%Dav=)(5}+GFBjmkEL+|=CbIyBGfBW4pKsWuy2n;*T-Zm~nj&Q&!NiFv=X=Ekvbo5WbVo6FN8XXb
z1c|q4(1$#}fP@BnmRlyC$7%2=MRfCl>qh??_1a)Tcf(>5(d?+8?K+z5eN$E^e+{Qy
zSZ#w`mBo$MqmO8jaWcMnf0^a5Nq)6Z(-gG>16YrUs%ukp(E){3<2g$j#0?AR5u?>YUP!mpQ8S!E;f=!am#o@KtF^NXz
zF%(jO(G5I*4Jx$5`Wm!e%+$W$EL&kekR=)f^S%V#4pStzRovmPM;xsPn-JrObFzT>
zfzFm)m3gA!?wbw)rI=KP`8M4Q+wkUv$iszCfF<^7SslVtc^EOKxX|POKKW
zx##l-R2rc)>dd@Skgdh}-~8C_tp~=^M&}bN0by}U8m8;3Jb5$DJEF(SH5`!~B5Mh)
z)9UjvQqImJuBne{TCiD!v`ci@O5y(ML$txLi+j}pRh0aM{C_-LFCzBNDq~?i$kcFL
z*Z*+*NXVO(UX;~&kn2_*$ZJp*$d^e69VGV6gTxmsUcdw^yM~R#+k;ZR|
z;7>vfI7uWQzbD?F@X6g&B2RjB7WQnJ{?2(rc2pM+h3@vHwP^=96Kf1}jRv#I!i0E^
zEAx44{S^g^((i3iNf^qE(FxI{VaugHqVTcrwi8;wmX{w&|^pOJCbm{BDBmixef7lEB
z+E>-LmJDur2p`nqk;W<4VPZSVQdXoBUOksmM3I=;ezqvNePrUi_>GgGoN^mBREjG3yn=Dw^j^q~^68eJWQ=CH%l$zGEZXvn+j
zrq_JipDEldbauyW`tP*KMFXj8#bmG_L#M_E3F!z@^^GC`aC}vtnlh!jDnpikuore5
zvR3k2M1$DuMNiyCC9gQ_KWK~?Jj~-(&QA|No4Q*bWXUHexH+B6*_=JhlUI2#QiM7&
zWL*7S8w_VwJ`c}EpwL%2alSmb`T%|3C?0w<^Il=NK2qG|YpO={yr{84cG!JmjNn44
zwOJMI)cR7F^QKisFKCfiFSc+^?V^cq;g`dLb#ho5
zV{)h|Z#9$4l(74Tf0Yv_rzCOWx33!P&l9LbLGP97I%TZx9=MV{*hdB#UD68BL2)=2
zyKUyj^MUSPm5=4a2-?j~zV!Zzv7+O~tYUTtcs
z#XCN!b0*pPPsx(_SRH)+8Jd$5ShdwuiQ1C|hMxN)6c2z&V{F6D?DZP-mk
zHQY!#jhlt&*C&s(-dJ%!NavYVhp3d1>zf-06l&@(wohzr*-g3c4&I}sB5Pd5X5!LP
zR4A)y#=9no?MPY#DK2ik>&D73GP5X1py}4Uqr95hCe8W;YBpWm%PhW|`UPj0To}x^
zqM)YZ{^y;6u59GQ*U%AXHodJ=sZFo=H5Zwi@ZSao`V^2xmximUx|_Hv#`1|VK7GKS
zf$G}d1LlVG3B0wG%!vwqBhSXtB5R2Zv}@Ph##5Lt(=R;e;F$B{gze)Pp8Q}4~(vu#duc?`3n3;$iFGFi-3a^r#D+bTodnVkS)js#9R
z9aoiflbr4JW8T39)kIlcWXtMT)b85(0eO7Z)KPmf_wzt>lnZ+d$(B-iE^dQkhb@5s
zPe+iXlFWQp^YFZ*<@5YSwzzUQjGh?$zl7ic)zIDN+I}v;0h~|6PlSXfiLW8LI^n
ztp;w3dzTzl$j)a6s{(5ps7Jr)ZTBNq$4tT)pHm`P=|i*?!+1TDlhly$um=W0ef&-`
z@YJa7d16v}L63p5V2+3{v|mz}{licW>pRX+z`mPqZJfl}rw|DB8!b(vzuJX_(qtcp
znBP&AI(rDr=nw$*;1*Z>CuM>0?lj9<eWduA{z%9OcUtvpE(0(VPqp3-kvjY=jeDiyobx
zGEftH=6mEBHTh=Ay*+#;8_^R5`Uv5N^~n`LGBGOyhnU^HfI!hCT|`sx%~7xmmxJh&
z%}$Rl5>AMN9DgVABfrN$>g3eMtFv{!$It4pQO6k*X`9jflVjx*pP71V3tH*fFwnlN
zSQ_hb`PmM67oI{9`7zJ8RdiT>4=%GrmXiSx&lITT6G3Copt09X?5`8zG|EiPW>7x2)1i6yqlf$<2yI4#Lv_!%&
zbToP2xIKV&P{$@z`Vw6}+n@b)PoE!46sI}k;0Hl74ch-Lp0`6*J8YYh~AygAlL`ApAKzv~%*GhddR
zOml>_0fm%fshm*;DEO@fQL`v}>~;b90(-;L+e@_!vXNH2{j4!;&Xb#UG>Bj+%%lvf
zs#&5n13P%<)b7MzbmPos3$=r0h?G6SPiBjs@rLS-0m^Zva^jZ%1*z`!p^o9w!s8Cb
zqQDfe`Fdt?+VVX~yb0PQ;QV~ffyl$fIECAnzQ!l*@o;s}n{~*BNo4X6NU6U=>j+*!
zH{9C%mFK$P6(3i%bDNQqh_UA3=;bzx4@AIYc6_6{b@%o}$0m-7k*wTgGIPOevsK%!
z+_X=@C?zEI7qR?y`LE_a)q)1$V=?hHL3g?zv!f^97G14)$b2wP5fD#jPjm|Js
zZeCc!YkORGxx8-zrKN^QrgCw!oTd1lfHQUf+@oL5CH?sE!`s`N1%EbTvzR{F=nza{
z6Zl9hlGdQhO}FU08j6kf;S*zDL-JKw{Y-KYML=bWXRtzz3U}nD*QVlWZ-+kOi8w?=|UpjFq0s
zW!UO4HZckHel2;8pWfkT>S;D4LvDGiW346``~8-W!`*4ZJ!3z!5Zsct%vD4w(TaHRb&@VapOn92ZK){@KIj-sMRJ+f1S~QdiU1@ER
zC?3@$%
zwzGXx>GR)N%)e!H)QPp{sL%oMhS_tUu>NB1yQ-@0c!cHls5ZDlQ@0;J?Kb_|CV>t>
z8?VpKr*E3!h*dfvy!`fhw-;9zr^t5wD=}z~oT{-_JRK}im4!}<+pK{TLRPbD)_isIQQf$`UyozlxDJ8Q5XX
z{$JI~bk`-LVz=I0+&^zl2`O&t1fk4G`s{02_5}-c3!GU#?_ZgOAq|2KQts1)2A#}6
zJ+E2ES6hLBiD-|%ek~-RstEpsHVgBJ$>RsN%T*ZiyMpE-jD(4a*jXaRFySQaH|Lrd$BNYx+lngY{&u%cgHc>9
z>wjP}SAyAbP%~bP4?_ro4|Pbyf)$Ep4KANuhQMw6VlJd?(^VsiPv`#e7cve6yvF&_
zIzPeZ18X;G$Bg=#z6O93jpgwkufd!sc79Gw9%}ln&lpO!OAg?T`FS*kMH
z_%g#Xt3!xvhkyX|wlFe^Ax#q$*P)WGe+p6zYetkLi!RgkIBh8B8q1o0Pv{mBA;Nbo
zXgf_bUvJd|!HjiqK_XiAFhms`SoMxq!iib2Z}@9MVe(Rb-OkD$Z?k)-EnBR&_nCuU|#ZWCZ!_&nzq4A@~Vm~YTJA7vg@%#cjyi_}7&;J3L`qrD1j%@fsa
zgGXI%Jq$Nhe-shteJ~MHNbe6^jU45FG@nar{b|)Y@Pr-T6I)tMN(eOH(VwMxSF
zSFz!abncMmSy9!cPj%N2KOLA2y^*cLk_3xYlkM*%*n}}*CXJ2b3fvxT`p}zao4W0?G4C|Dng5f21%6aUBA55u1s^`
zlU(_-T`$N^dZT(Z&si3BJ?ypO2T(T>;3$RaimzYxO3d)up03#s)`1*VBaNP{KGP4U
zsf;YRAaexQ&nSy@WNi}FSTfB2Y)Xi7&8uYB>@`}Z%L96JXK~3cz6Y8Q^=R7J+Fl)P
z5R9t14djL!H|g?0IvMUkOf?f<`5&I6%UVw%76S;p(ws!n*bjVeHhsIoqAzmR8#21f
zf815{fd`0I&wN{+zW!t2A?{moE8&Hih{&!iLDnmrf>;u8X4_y$+wEs2vd>AY
zFZRd4^lkGj$fM{$VlTbVrt(Wu*7i3w?z3JO3*x5@5tF`9o9!O(b5^VD;FFw`oX-@T
z9Apz!53a3=6?Ah}ep)aL3tUo7ruUG$ANzO-MldQ~zMNQf;QPvZHnV@}pGFpNwXaPR
z&$l-l5=nM?-va)aFF%)0w*x;WIZ7+*(9
zJEb3S3DqguKBi{Y+^vmcW3sjsT&(#SgdUmP*Oas#MZYXa)JdHWkTfC(g&cq0#yuGa
z5+`>@kS++G~Z>+iZ>i`T1s98TGyc1-$y&%#N(fO8KW$M`pl^X~&GZ
zi}{8vEf}=lkZ&(t4qu)pl05(m1_c>XK9?@Ldu@fPU6>!P_j4Ihu@6gQ3TQqvZHxT|
zTsMIrd(DhvD8e?FZbKHiEZ~4&E8aH`Kw9rO*(Rmhm^;Z!%oHS!%2XAx&r>@)O?fZ%0^Au
zDTB!=zrH1?{CG+3av?L-r4B3ZD67z|#_jBn3t8hJQkr?i&1GZ#_2RkNDb_E$tg_Vl
zXF4jHva77p`)}?G7`&s?mtF#)>B=~OW}f{+^HXr0@)``?^vPPKv4Q%L&-rltuP5MA
zeA`Qn`_BupUaI@9$QlnmkcY)Z|0l|8XKE_QIFC-w`NiSf~$jvY^4mej6bt4N;w>MOD>%@D+sB9ao(
zCU3{Oill7V(a*E=v-^b5%-&uX3^anAcbD{3*~;##>9wbEX$hd>|
zg7c6Ph8CA*hyhvd&+C0F$OyYcVZpuFEz+V&{^OE9yVS9PsuI>Wy6B|ms>bHI+M~OU
zdol%4(@|d6nd&86_4vhOf?AuVnw0swNw5S>BT`0KGM*^S$6ET)B2z|IxmiuRee`Hn
zPCF56EL9Idz>2FJ`bdo)72TSHs*I8n%MD@DxDTM5izkiV(lf(!Hx4^}CWuD2>D?P!
z*aJzv`PMv6wvbXS)t)|8pw)X7_WA+`6tzRao6&^8`z}9*7WZt8T!5M4Okqk-8Bu9G
zA@IPVBD5+3Kfh$hJ<=TQP32t3wl`f9Z%nJ^78yN}$8k9KKHkf7BVKfXa56)j9D-K%
zP+-E|PGj)Y&PfqJcy8V_KcCBtK5yrTuua{3M_dOft~!ZAEp-9S%v%r630(e@yK_eS
zv_pPEjf%$d{8G_DL4}$CTTb=LgV3()<_??nmg64XvzP&{R3&ibrH@150;-a{n{#$1
zoxkzlVy}C3f)JW)9u6jlsC0?dc-lA*r&ao)rKktLH1n|m9SrmIVRhh7E!GNL0uo_!
zwfx(#5(Q}@#a$?WR{3SmCy&R0^BvtgX5-y8TPFM*1dM~WRV~&$4l6QjDuS)}I{=jf
z?K-RYO9WTt(?OtZ`CIMaaYCP-HH;#{)i_X|n=G8!519UkkT)&zUCZ$_&HF
zdQ4rD@&TtRb#7x+eayR|`mGN8E=V5NepXjEwTxK-AIuz&(+y}U1E_lTCVfh=kLUU*
z!(divVuLbgVvYvdjpZgFg~trDC(*6XxW|2=Y$>c%lpg2Z&0r0g^VC
z*C5bxQ?xV0j1mdK6-;Dms4!57U|Ee$MG!(ij`^o=wMS%p%L&$hcXo3`tVu&7gA58t1@BwEQk)&{nZCcxEL1DH
z+qqQNqv|$}a~+E@c!HCCdjM+gVe1N{xfRvQqI(wc9QQfk>>j2_cN#xfRa|5rp3|eT
zmen-yg!l_%;|B|HbCvEGMQUn@pL3%HM+V9Hc+o=FF&wjBckb`QjO1I-f)X)jsijSJ
z`k1G)h&vNvMxn>ef_Rc#qT~I6r-6gcsLDYw)!v@S^O33KFl-sqIg*Y@-c{Z~Ze44R
zpTteQT7|3epiJGqJ1c|1@BO;&zza$l1%^J^|#0V+u-hksZ?l=-v4|M{QVo~lU&(_KA9;eGd)LrZ}@kC}d0oJ{Tj5F;zm-tIAHN)uM
zj%sGrEWHu}eT<2INz4Y8Dk>h(NsqFPHDJroqC$y`#iEG3>=>5HU@{o~b3#}BL
znNfRZnx5ff=E^6+?rqXO?<+RBsAVlYJ*|N2oE={C&Z{SEj)Hp6XPh{@;z(@bjxu^u
zNNVsF4x_kh&HJAGH@hmZr0)9u^zh&`s@EhpVqOxb5P9+Hym?AI^)h}5}aXe|ef4L8q_Bx-KpOj_H(QCQnu}#yG2Rb{i?}HelO^iDLIc;Z!?d^vByJvY#i;
zjOyiGw)-il6%YBt-Dpn>RlmH((8b9f&=xZ@ja_mt9s)DAv;*)}qC7ww8N$uPvE~h%*otWt$3t0P{#WtE
zSsR>D?w`oSkW=f`UMLK6)uZcdhiEctd=2%kMm^A!tE>mC46Yi$~2T9xeOq?&BHs6I>N>F&uXt
z`#G9G$H0DPV~Hn%hnwaaJybi)qZz9GjITDoGK=}=Z^t^>QQd(aU02jI{2Un3
zv(e_GVjjzRl6R_d19Nurlzr14Zna9>x)W}`bU(q>=5CSsna7)N^LLd8sdg~%huW%Q
zNWIGabK?qLBAL)i^z##Oa2n6kqtVefeASv{lo7PSk)eeWF2ySTqJ
zQ#`z1U@9vTqU;qp$s>7bBrz%K($+^JCU&+ESFUjvxj~E#{fsabP)O=ufsY-{s<#>QE~qT0af9)1w_h;#KEjOMeFxXdc;F!Y1HeS=
zV?oKu9<$Cnb#dsqE?L(nSZpCM%7vT!*)y|l=k0Q0P189bnb;K*)Z5=IqmPw`_YzGZ
zjg=Gh4V)F(vf={JSn4!UM(r11-Y+kFf(4(fW`%M@dvA?>*o7KtY4TBJq3p4H9>b
zG>5an@t~=xtRLirF=o@(1)-Kd-v_x<3h&49J$Rlek!)&VQ!@)>BO-|3&&bVdFJR~LT;I}ft+uUd6o5W?4>
zhYlR6k_rT?JEN^XEEFG&_WI1_(fP|a|jU^;>;fgka0va
zmrg=C6BF4(npR^VX6%ez?0qBsIc7jq;P`Ez`iud74UTb51@mTud@Wa`{h&&<74hc^
zO#M-#l{Uy_YQxR2D$8JPo?q_$7V5=djX1MMjjd2y;5WLvjWfxz)bfX~1tQM{!q;_s
z+LInlUs|pqHJ7`x@kBfgyDP{4N7PqF#r6CQ(-tcfcQ5Wxym)bUSt#!AE(@b&DELjc~R|l?ld72
zNQ_G^kKG>1%lLURto4a6%h~pqF}G=sR7u^I@c08rZrmJb9^v79dNDL|0T1FO-mMm7
z8CBJ3*lm6X29S-1qC8w!|3zKZ7klTqb{i9zz*)a4_C}ddY3UA|sO+jp$O%
z*<*;|XPX2B{v0;v)>N^%Qz3$Vxx=xvn^w0v35GM}W8*JN>J?Rfd9Y%na8(~W&?r6h
zI{<{@r!{Z)Q=kG(uoQ&$e{C-d^5%$!nVUO$2Xr)C_AW{Tqw;r1pWj;@ySHQIR@osR
zl9~KDRQ@Fs|G5i%G~I@;?hBBs6QSh5I$R^2HFK8+xJ4$-M*sP#TpGn$N~biI!tWKS
zy8d}AuPqFmF4lRVn|~82X1(=Hsg~b&fY@+zIotn5#;fjiVP;8fECMHuRe0I`P;|GT
zAs}n|Ds%E93);FKzx^Q(9?ya`y;fAEOo9oQ3p3qTwp@MTPtuq=JN-kx;gaoqR+Y_3w(M_3XR0b1tsn+M
zv#W{_BzNZHs>C=xPL81Z`BY+0-y5H9ozrlrvj2O=YQ)y!!i85CFqm^_!IJNy{_qfs
zeu>u8UKK|faH*za1*fyQ<%W{rFgp42vwSCd$scA}LC*@3v-|LRpLRw_TiLQ!!0WX&
zZ$;lxw4`8ZslRbBf(w+IJnT>2)cgPgqkgt%OBY?onYmb7uu(7fL{G`cIfzaHZ^4jb
z32`OR+C97;&tEdvt?|;y@QehXX3Swc$+b_5lf10PTH2h1SF@n&Sd>8)?-S6GMb9=C%rh%vS
z)*-HDW
z!%n=9Z#(hJ@RsC!r?|;D$+yr{HK0T)hs$U*0+5-??ur2U)~jLwx!I13)M2o4K0k&8
z4R#*GNTNVZ+QRo~P{jXp=W{O=UgvfFDzaP;bt(^I;^@!#dJY!AX`nf{@X@0suA;rg
z4vLrD_iE0A@##Bxde6vmo6GYC$@SBn0r`mWN6b>4g2S#p3an+!B7(XjFm8_@PQs9v
zXM3X?0hf(YsX`_X7~3$>d4A7v1wJSg0MNCWBIeK89X?uTK(P?ep_Q3G>KBtv>CE||
zR?NNV-h$N1PWHXp;MmjS-e&mP(4wV*yD13uJifH;-Dn9|o%vTlj5W()aTM?*5t&y`
zwbsa}TH?@8RI1yu$&;@geyWTX)geH)EuZd5ef~D5kboe9NUfXv`;crjR2paipC1ET
zsc5%!Rqa0EYt>^x=8N2@m)DQFLR+|3rX1sH!sJhj+{BxEQhhukc0t}HjIJL1_u$iz2|w~#~0916bF
z()IVBwuuu_@u-k;c`Oq!kH|u9wUl?IBLIB=%GSc41cJL{h!m}NVCyQQk7fYm9|!C<
z8{WMU(soW;V_J3cAdoH>yCE;J$db!8%`UFtI^mOVN_~|`j9fupgdR7q5P9?
z5gDbAti)W6MF9dV-XL5Qs*WrRAvqaAhco&Ofkz2^G39h7YVL^Vbn|GXqMpq^JL74G
zYXMM5PS5c9-%z_=vR>ZtZ5lg}>c$g{Ah$;J-BwM*_C!IY!8zpBj))wEAaSN;Y`Ir{dz54QkJ3_IW1$*K%#Xu+zKWP
z?&42Ahr{8uJY$)wo<1s^@3nbDvB8KyKP;beVElI!bV@0M8c$-aDzebzHXQl1)jTEmfwL?Ji)4Z
zc*s=~>j{S#J4SMd{iDphesWX3BatJ6lNngM|aMu8s9}DT~{ZYn}NK$Be
z3U8TIQr4sQ2jPst34mGO>*8@ZrB1<<&s)$Gt}Lvql3BnY><3r&bn6x>D?1K{nf@Ns
z`rjaPXUh)6WY@xQ%XKaFF^+{9=CFeEy;SXShra+`)}#6pi?2ME8}V?95=#S^kPLDH%EIF)}MmMb7nMe
z&ulO_KNlBEC4+n%epP_mw~yXIDT}4e@ACV&D7=rA>%Hh*a6`#?pK^UcpL^l_;}x4U
zK}b4CBEXh@VLbQ-EV;QTkHa1DsAn(^KPeG#g>i;P8sXk$z~MXls{;$(J-5Ikw|6Na
zitU6P*gxnz*c}cZWeTGHTFv(;B})+(Y%!5c7XH28?CyVt$ex#O=4?oiNZ&U_NI?11`cu&6OEJy8{sX!9Y
zO(`7P=y{Om*tcjS{KftOG9Q6P=UG$B?d_6A_z*@D%S${@_x=CcTi$Q!KOAh3D|r$|
zF$phW1!dY&1pb71f1CAe4vU7=M%gn70h=x4FV4Ds;g$&%crD59A8i_tQ$!$TsQ)lf
zlPf$epz&W5ShQl_urJaLH~fjMl}6|5FQ57MPKmf
zS?Gr3e;875XhV0XGa(3QRBCva=0XVKdz0xyAx7b*@SBAlyOp0zZ9#@1Sa?jt^m%}p*aT9yerzEld67Cb703nXU
zd;X$Kc?#!$)VU_r70}S{2ZBxy2*%jmdQ?$%m-D1MUbVev=$odI`8xb{%gaZr|lpx(p!tol>+Q9-cS
zg+#3)2-yif0|cM0qCn@3NdDY+2)28EHTDg_puzU)j)50Yt3y$L|5==*92I}031zN5
z=9IwnY6o*xV9nPEWO+mG#l#!nbjm
zplX5Q*w^zOpyf*QRiBe$!wLEsx5J2pM7@VJdb0>If9lR(%op_P9A?sgPiP~kb64rZ
zzILN{EKvCU!#1gNE}6MJf5|yx_{p`i4?cxERrg2CF#b)+9d|$oIvl-}HwaWk)C>fD
zNzFw`OzIyi1cC}N{nR+%)a7h2T+5JPqxjwe60{oCJg+)xyMIs*js37sqvNP@1+2-U
zNTI&R^J)2}_9##A{F`$#U(qr2O9(6KooAuYgBg^N)6pOtAh&d#pwUp_t1u80Y>t|I
z`o8+!^c@uZOC1y*c)2arhv2W2c*7yQ&DH9ux{U*9X(vAJ`tK6XTM5kF2-el^N%~$p
zR*1!3UU!2E1zbfzOMh^|TDc71Ro1
zzxh-oosMx5JvqAz`_*nz2h)^Z?%3ks;op2vM|oGg0UJ$7-r
zrw+yvZPZkBT?@ML@&5*|-Be}0rxQ|qR4n_ZTQH)(NuEtm{jT*wAIQAS_CDZK0CK%o
zLr@8|;sa4$kZHY-{R~31gNk|r04G1r8MY&T(f6HdXSGtwkyPr5#n=4Cw*xa?b?8W#
zG4#^4(*WC12aeyo=sZ-E%eo0-bK~d3@_J3&SZSc(UNqg99Rui!(##X-YlX3#1H9<9Xu5wKA
z-^SD10HUxT!Iw7D8+F4`u%dOt+p(t-Z17X$Q}3+h*i0c7dX<^z*J(sp|C!by7;RN^
zQFHkuCuFXh3%pP?x3{x4w1yS-$gwA(0^
z7rTp+m{>;u_sq4!I19NVb-Wr~&d!#qc=xK9bm+#V@Hm|<
zsubvSM}*1a6*S?x->QVy8C2GS4X3uWOh#6+<045
z>q9DQZ1N`A{wz;_crF(U4Mb%Mo^&1@F2gZnVSEhBV04>SXC5||C`K5szt$yqpMqF(
zf0e|5QT>vyz^+JJo1$0>KK?0Ts45%Qi@4{QLB2$8Hq)pXD5%}R>NfUbwYn6UGlG+7
zJW7=%S!^$1pse<`^-iy{IKF7S#Yp%o$ryvGaUn>>tVmPhiR7cIRT6e+t>{(LkAQd9
z#lN0J%;@Rshy`~WUAQ{Dia+d0=UZVJcI{LMHae$eCD5|Q$XxorGKW*?A{Rml@R*G0
zeX0N^HV*>?_BnZ}TA0#X#&jRtm>G~$O=x81PO$E4esp_3_%bazM0EG}vKDuyHPkQ&
zrkSwl9v(Ldy4iGje=E!q9Y$swNl*PJY+VRtl2^hoHY@~P-O{_cb=7H%kEFx%Nl3L2
z>$5ugDdS-ZXP%}!>!ADo3qjiCyAQbC8np(vNthliByX>5_#X_F>Z44ysK0wfzMM`o
zCBbWIAmEGK)HXt2p%+M#g)BY8tMfLcxQ!d=J69KxVN}rAn+sJC-f?}
zIp34}vnL%nw8UWYYJBP>VmO*y`Ctw(yw}eG2{Btgy1;nO7if1tJ@2Kj>8~)vyr-6^
z(T0^88V=B)6@x9dW4#VntrC0nH92sRFKlcZWAgj0tLZy+Fcwpk*p*BH=;^7=t!66sP!@9prV_
zvsm={XN0kWJG)y$33G5-{=~*^K55SVbfbrhS}DIrui^NoVo5X%XHul`yE*;5E>b!g
zWdVY2WRG9B~3M56ER`|>C2gE-n7T?Z{NdLg7ruU1M@q5+O-2rLiQW(u4wMd
z`G(3ptlHy4A|BS$*Gj77_k#O&pM++M=>-Xsqo%!_ltB0
zB?BnPJ{@)6m2!vnH@EwNXHAcm%o=p$Cxa_kCSk4k%z8foG%S7oXn}BHGQ)e~bJ-g#
zo4Z8!CbX4i{w>aSL#rFAq@(1#LTPx&+MCfbV=d5vDXmTe{tfzm$T%Hy?o_L&cQ1^O$nr@b
zhPeLmxf1tN(y(3DU=(szB+2VNE~x7apCO{&t>)iZ6WZtdIP-wHpE;r)*VyYe6&IZrw!rQF<+MEVPpm
zk;`1eGo30>o${xVMp+D~PuD2RY>x3Av*H@+>BzPzlQ+axdiHN~1k8s+w6#(v84p
zcP(Uy1rNlr)UoG3iS|?A?e*^9qua921p>F}j2)}m9n3)Muvqlo!lzA?f7e7{S%e
zlAn)xxyycTm}04Ii~B>Y;>4c@1dgvXoRZo*jxL>NCw*NkBa9NC=^3?TZ&m*wIW!Dt
zywkpT9}l-;ySHCDw>6hw^gd|Rt)H3?$zX#<2H1^W5hMNE-M4d|geI?MW?3!MQI5%&
zfOGAFf&n$O-3pctKGHEFYh|)SE25n|zV!W}p4xd#{%gp)}o;y1P#!j
zXy3;S+1Y7FH3Yi?zTL1z>jmpJf)5{{YZE^4#pJHo=;XAMu=fPpI7Zb;5I!iA;<6rI
zB%z+&;RgMvE2arbBE668)0ImMW<#^RI7bM0lxjHXmC(TK6)KiIl{bO-HM#=sEqr{1
z5R&{C7VYDSNR7)+ZuDlV#!V#X#LMM>Za6gQ=ZhJ!Ybj-HN=vKCh=pAH$y~1^T^He@
z9cH@&I)?3VdCnzc1x6)9i5M^qfTd*j`jA+E7a7zZuZ!2UKm(PdhIOkO$9To+cUIS$
zs~sf_{hB7cZfQZg%S8^pA0sH%2xYe|kJ8
zkETiyIA-`OKZ7xyO$dKW%{XDt5%H8G@_l?fjz?mUS|8Lz@|(?{u50}C8)HEY!E5Hz
zCKX!UQ38?MEYhf)mw=e)ZwyT6W@xdG`%SMsQ7(FsQ3lNEH7c6$Wv=V@`Otj3^1Gjt
z0w&L*twO$N+aeGw^mic6BhUr^?$%gGa_fv}p&R;u73^@m^>w0cH)8LHu|OczAGM4)
zbbCrKQ)Fma(_U2gwN-Bh*x)ZL6F$mTCyfgyl1Z8j@o|!8d8CCl7akcMPNMbdUtMn+
zQsQcj7L6`Yq0wI`bX~XD)F*?ttG_jq_lEZ+z4aZtmdp&Krrqh;z!FA&BkXc>T|y(A
zr<2YqrSUF$4+I$s$_vJJ|8{Jia6>q6gkP0NA|Z0@T_^dJebI=l!$t%b2CbK|T*Xq2
zDDC!URQVankWHelQ|(C>HOFyYw_w#05BGpWyQvVUhx9hhIqsDH4O+KHpcIp)1J
z6%^josvz@6ZItTStdFl*?X^F{wp#99@$@~=T+}`ZA&HWP=(EI76f0Fq%K<&grAkB8
z?eMJ#Z1UQrB5o(I#qBJYQn{*TRY%pH6qU;+=_tRK;UXP<2u1$}0~3+Wgg_7Dkbq8XEw(06=nES;O}VyS6AzVpXGYlrl@{j3Z;FenBhG<`^&Lda=o8iCAdId5L=2*oO8!x;Uk21``ca){-kv
zmHgB7{ibaPH>snKv@f_RuS%PnFynV15t?0c>oN(O!6`MyQmUo131wf(K*u7e!=$g(
zkqet2&JHw4ffmLmcA&iYz~SCi(#33x)^g-8w!ntM)7K&8;vt6-;$gB@%krJ^ih9+c
zxZTXFs-n6@8?Y=?^f~52K|Z3)qfbI38*m|n=<8(_Z8c*Tx>XHJOAW-Ov&k_ZjD#gMX@_^N9vcI1S3SJ-`B)B0
zHRL|Bs;(nWIWI=R3<8s^>3)UQ9Ou6|jd!v$#7f~GR8~5
z%u=fJYnS$l_vcUXEN8vG+xRjyov^N2=U9EEa%43i2izUnRE(nMC0ha=O~bJwmZoZ(zx{r_j%rB6
zev(M7T(8NByFS~jId&Pbi~X}u)cLe^boe18mLM#%C+P)pY=B9)Qxas%u2E@O>mB<}
zgp4Dfj=C}QmDJXH#^mkrkHymt=3Qum&0;%gZTzG{9Y-S2r6C-;4+#z1&hjXX%lL~-
zDj?Qn373U7;i2Y~h0a4&ax_v7F4PKA4vn!MC(3pqw%S#pFcm){zi;Uz<-#MT{A+&%QVMck7i_J
zVfwv)iBYo;;Thl+027l2P?*R4RQVN8>a^8Zg}b+3P}ou?H1v2GzBcv)K_riIT+N4T
zChrs*>_I%MFk~E#SP9tDmlB>Yr<0!@>)BgFx!2^lF6T}wH{?~(Rny|Cw+%C@d!A2m
zu=*upsj5{O`kvgrFjli)mbDO%QxqW}^QNE#oR)pM`uXMTNiP&BMv9q#_puby4f7)+
zq`H6$&+rMoLx~j2oix`ot%6%spg^Nb5u3n5eD!AX?tuT|@$;WX!?-%hj3Wb=l;x3M
z%WY$$Mfh;Cl6YA9yn(jI2zC?8W~U@loZl|?t-+eGTNX%lWC@9l93T0zOrfDk_
zc(gwHCNlOjto{QARR|@C5{rWY1t)IlA#-At<%ysS(gWO_ZOwDWlw9c_K24Es
zvh9&5*c9Mfqp2tNBD%YHRBRQXYBbl_kW3K;De;$LUe~1>34_p9mM{6k)o2PYwh3z$
zY`C0Mb4HwzN15Hwl!wdN+wO1Pq7kDtA<~O!({^I!Hhge#eEhM*n#X*bv83oxw`Lr}
zI2jB@+iMx;sF?(pw>444WPgP2W8P+>UEC{%PhGCf-Jb7>uIU=j$H~Hxv?pb1O!N;_
z
z=9a8yNk-y(b%Qx8ow+$pU8F4tGFmMfS@NqZS@&(@ywaL`+N7OEA95>VWVO@2`g2~8
zZiD1);rVAX0`ha!(~V+E8OBp7RX=pGW6Tpw@}zIrb{KF
zHJmvQ9w~20j;EMpqyB7g%BSP<-Qn>O;mSwOi}rMw2tl3E(?{AH{B;^I+ZD@4Xxmdj
z6l0!zm6K%c`{uwr(%!Odr$?f3!|}q8eKiygEz;uhnD>fd+OB!^uvf=^OoDU8c$d37
zR#jb*;mnSI+M*e_M^@tlh}WvutP#)vnj7v|;VRaAgCUtch-r)BCmSOtSc>c9UKif^FWlkinUv1vMK=QYa9DUmZC#P;75
zm<-T5)q}So`#j@mHYC?dUc(qxatB1mv~7;rdC$n$AC1bv^@Z|Qr={eiqutE>DEde%
zre~jZ&tKB>ddgAtvnhWZHwOy|gYB6b$x6$S75JEB9N*+nE07V5=UBB;+CU1UYA3J_cuGDeLjRZ*m9m%=a*DZbdfDd>QP!-)HNTqU+dgNj^$l
z783etO3yHKVrX(Jmre8JqRv32K2I;-Ey5jC9e_bPMD#&1vs30kYoHwQ@I)nGZ)&H9
zTm$={Q$%Ty28g9Z*FGy*P9?gvJP;`7?CF-gNtTcj+;SrAxn7VqBs?vnv)&ReUMLm|
zH(byGPVJ$XRSNLsKwr>o&*7oi!y1IUFYuBo{osFJ6s>JXuM_nse_YICpDTVf!~Sp*
zTKs~6Y8Af~r&m{nNyw1Ee}c|*8Z3hpr!7m-s=Q1Q_4yn#hc^@ZWX8$QJ#+#wm|u+M
zye|7%B_JL}5OTkTzLHmwP+Btk%JS$rJmX>(uq7`&8k9V*cU}LH9cxnou51|sfwX|;
zHm?Z&Wg9z((!+$Zn)8?IvW)sTVt=|;0LsHTRQRF~E@ag)7HN-pxwKs5y(rM7upT^<%(C+6XRYf?KN!q^o5{q8BAEt
zp*@Ms+#ujf)ev5VZ15oASD@^_8=SJwm-0Nc&+)fL={FpsX?+;hI~SgUF2kchc8zom
zQNP{qYda653~wNd&tnSjU8(+-P=3ZM+s34)GOQlVU{O+J{_cqjSxrZ-L|e{DV#5E{
zJ%1B7Uiy}^U?#1wjpKGgB!AivLsKSE-rnCE65@1nC4UNO^P>pF3rf4$9(l8_?r9Fy
zvWp0zq%u8>w71rb#ZYN5d*+3NhahmRd*lu8+;lWi#Q)Yaz31hFbB!aXqRR2SoxnE1
z5Z5}U-Aq6jD3vh>wS2OW!>VE*?E4G-ZA%FpKU@&va>(fco&r;UOjHIYa1?5U(*MMT
zd_Ony7E+Lcqv>es4S%t78LjraOO|GwWhtS3bM
zDS9F6Lci*Yy=rx&`wzPJ(%H}!;TfS9erJ;y&7MCD(%($C4W2Cljg^J+yj;vDoe+!C
z4gcNRCVIEPf5~yEH(luGt%mc6zy;5wV1Po?F#Mc||1LrCRqJI8LG#}+qijz50M5HE
zDUO~iH~#hibsLzF(6pZ5)b7T#`sxs-I0YA$SMT=^V6@Poc7QTIL-hg&61I}!Sq6m5
zk|5Pb{f`xJ`q&?@e`4_rna#ZH8dT>0D$v3XtEmcG^@YmC8+Ov)>+{<;k-M4nYED2>NTHw{
zeE^2oXMU-4p;(BC6Z#KdN?$6o|1lu_+@zBpLq-k>NgXF|>I?z@Z*kz?czU<3j=h-P
zpccaYYy5xjzEOIUFwi0;-fIU`nu8#e>w+83`*W{Ps{{8B*&p#JiS{Et(NSk^Fi3MB
zB6&LL|3geb01SDPNUgLFdHkb)IP;SZw-so^f7Ycbx69C$mUn;?DRF-Q_b;j>J;ua%
zvFEK@y&106%GI#cqlp6-QP9H)D+%aPa%~Q*)cuhe(;pp?YSe
zj^Y_pL-@!4h7kI~iMrcAWjtK09Zn=ix;1+F^)*IcsX?I7n%~B-Pn2&j!95fe0&4?B
zDFt&NmU0&toUJi$_>&qn!*GjGB^{SsL&txaT?6+YodVc3ww%yhrFkhg{0r!A|H5ik
z@DD`$OD-Rjaqf&Wx4x2Juw}e?^8UMReE*~fYR=~K5LKWfUEfiGG~%;H2JA5REyFA1
z1Wfb4?8U~-Rv!Rnmv%s=sHDHiU{wehhPlCXy#ZI?FZX{SrNPR~oP{2xhb1_YF!VWL
zdJ;lr4owQrelj4{8lU0*A8X^m9mr^xt>|I=d0nj4a~4rKT}Sx&9FUq~|9$7=+4Y|-
z@Bwf#Q~8`YJd=0D-gGHb)%yQS`kc@tVW><>SoIeg*$xH!Qy#m)kT8sI)xd_G8>OLO
z|6}Yk@n$o;&ZIu=oIHf(MGiXtl(_$iC2A||FgnkJjt9UW@*7I-7+l!5fARpI{TpuB
z%Ljm-cK!J;p=_9h|3k($IV^g?uo710i>vkgq33Aje*c8N3kT-zgg&=3fD;LO{4CV(
zzjRdp9ypnwr$dYa8cY@q*iG%3u@Y)(|Aav@GxbFFGXOp@$
z<|5pd(}jKwp#_WIEJyN=W&FK98nYFs?f%!_izYxyJCGvle}%&XQ~CrN)KS46^sldM
zMSl~ImI*Y(Cmp5o1zm-7ASnJp$H9nCY#~9?5(Hn}zR|~kgl%8}nX-^l(oi(>`Yzvj
zXK6_o{)#Vcy-QaivtC+!IT~L{7g^=K&Z5yT_f+?NCWAXEP`>>jT-e=|Yu2LZ
ze76;WDELuU
zbk%(R%d!7pE?hun$%xp&ho<~4^b3fp`)w4o%*IAMlbffyv`y+Tgo^fi@9x|A2-
zWd58xitET|?NB-s-e3%m$w!{2%&M%L~y2FO|K{
zs*v5JwDkBk$;U)`0gZU~@P7jSJ2x!1_oXu3=xG9GH$Ns@a8U&TBLL?mkTbtPB!5vWDaT
zO`yu$6}Vx_PI?EVL>NjRK>9-3T}F$DALZr`F?W21%0lS~l*C52ziRiKCu35-nf+Jx
zw#v}og=<$c{iV{{qOLs>r&h)I>9RL1@$U@&QT6%2-^53xeLbNZMcwQ_T12B@Q{vTP
z*n072{!8Ju7SPCrbe3Eero89hchL%ACpsgHM0YlX82PX=87SC4|54w*+qgzhd!2F(
zz}HDHZA~!}dIgVHwx%@?hA_*3>FQyK5|n~@-7PX2fGnmx`GL{S??3L`=!
z@I4D!((0Wb{pol
z8Hv@dLLqhkKIz&FLxA-E7Jn)KT}K92(n8g~=UB(eJ3a_DHNQJN2BKykAdCKAp+)UB
z`-im80@s;)^){`rL_G*Hj=;&3Iv)|&v80K{+MWp
zggvY%G6NU(`@iY}y=o-o@(()PGwMv9det)H(?sYH9RdH%%)H&Lu{tCAH>jhXea#k9
zwW15^ukb)VBVrzt%IY#~`co#j)=HC1>L1=#YB!ZdLW?ur8_$jiow!}|CRNH;g(o+j
zzHs}`ROA7)>ckoiFF9Rmbvc$Zmdjy@jm!C)@DD`kWS`8qZrGZ}0
zP(@Zw+G3pG5PSZ+tX!D}##_GCP3#;pq{QgL(BPy10z>12hPi->?JHu%+&YF*nH=)-iFQwNs>n-Nt@tKt;a%jfuQrT53*}~cB
zN}H9Pl+K5bVKOPrmrvcx6C}^ZgB?fWJf%D>&k=FP6IaJ;K!KsQixaQ~uhVslSO129
z(jfELeP4WU$4}uhnk4}Nv=o=j57l$Xn!+fgNhi*f32_|=-
z>!nB}O8t?7t#&6@nh#)__o44$ctHL2mP?{C>UneQf&4%m{01g*U6J+nx+)t?cbzL_
zc-D7_^&2zb>HzeryqVoDGfzfvRo&9X%^Y<+yN{tEt?r=|ieI=5OqEf(+>As@@Fnm#
zU6i9KMH21Xavgdh?kV6+4qRA_=?+kiYO?ckNRvM^bt-6B%}ty|>RtCEMsn~*a^#>$
z9JK|84T!@`-$+%Rt_UadX3p()8^YdD!MNG2H_J%cp`;H&{eZ)rqlu}Vla_U(uvNg4x;k=e@!e@#Uw4Cv4`mx*OFDhlzoy~A
z_J@Vnxh-=O!2w^vV3lRx>Ki{qaGqd?`^_&n`kQ<=VQI?HQQkw?&JJa}7vX*xwu
zX8H+mUjrnjA6t?0DELg$!aJGM5l$*&*$HqVZWwe=PKr)w^_hB=QUVv|U!~>A8FyvOrc@}e9GJ_U};dKy(T%lpPoYx;mKRUo;Y)>{#
zmplHw(=%jOUC$Ui{;5!!ekxJN_n@
zq$K6ZNqghZk8$nIde*X1+OM*>Z(u~da^6W`S
zw1v(a#by=;mqojzC}V-v0QrzL+2OT%;8}p1sW|(-?Q$kC>Y9-EZQPEM&4>V;z`L#)
z$21dOTr%t`Kl)~`{{8lM2+7j*nVFkU4Di>>MN4^8za0rTY9b5G8tD>~OxMg-fap|#9*
z!d-^*emZ}Rio&0`TDLadHNMK}^!C@gCmuSPGfD;DJO4v7PPvDCioHHPn-sj=HbbDM
ziHxYm%Dvuqf;rvln^A>ZY@+e0C^PIv>!fAEQ$+dCt>Mt;YU<#~5JUo6)o
z%Jz~4SM3GBIGv;8^6Ph(e-<4QA;&j&PBMWm0liF%ZPqmpt1#4@?ZAKorgfsU87<#y
z$&Q%ojFyA(t6$&0C%m5C(${0{Qt(91-ajI?uD!fmIC>5`u$dv>o*#aKa^FC`>M|7k
zYu)eG3?y8$BFKd6mk3qEmN^xG6F~~7xUKqV86E6qc8^=-(|;xwRm=#2O&|HJ-U}rM
zSi=GjZT<`k%5*lVT)W_rUZ~(i)|r@Y4kDUO0B(lT+1x%h$H$pb7$5j$QEHtL!ibN1
z%wi9##HKBeytw!7a2p*!=UpFbE0I1Ql+2xkc1&drGTTspWbU-=d|GtcIpL1NxU^9k
zBjTawj#H76?7eR^TOxL;<@iwj3Y_ZNH<>S%;?944>T)A&m^I9XuuwFjynAXiOdU778_HFVU<@K5yi;M$f
z(8IQa4Sr{CW7}x9o6E-K{2BZXjhOaqMqb
zvfyy{WK^-nL0k27E9b}ijRj~&Z9NZv`3S=R0nDpla*-D0v6XhZ^{XfDCqhKr!`>)%
zjtQ#{kGyo`ZKK5pq4i>T9$wWsE5{5rKlz)nLOtG&`*np|Ld=_)xOFKhJl@-jVEsV2
zU3szF$v87+K>8#H-r16^G;2ykM_s%R8q3MYTYDqXmF>BMEtA3*^2}h9b^>e+oQh(F
z$MEDUN7Y-Vm$A2}xiwuhhY%5oNZCwQM{_-=A$$%8%cCTV#iE9B?%J}mjfEHmWH}-(
zhu+VTMdCiL0vXPQOb=DNC03d9*taI$r
zwI%wRsyRvlo_G-pSLStC2#_xJOuuL$JfvVc<@HS(gf0CMo4FD!|@LoUN
z{v~}=P$WO~Hs#gFq}gtL`PnqU?!j!5_URTp*sQASLmT#bcL!8b!LdonGUqMyBx0+>
z<=v7p20%d-fYMi1_uOVjAub~YzXHgXe&E@kYO)zV@OTl0_a1fAD6uUutMx(oaettQ
z*D}wLm^7c&x)%kTDH!8%=0`EEa;_JJ#|6PQ%v7N(ke#%plpq1z>w^(7GfP|V6MDpa
ze!&a7w~dCTgrJT(`blC|Eb3`8RyF4snB9EQVo7B6rM!NxQpMH8x=DdrcMhkq^f=xX
zxi)0Y0mH0Q(1EjdFKu95ub%#``}GAUQ}3DRFzER1EVs5Sn46@cX8m+Tr!%8
zm{1PTB`08IbjfWh#+7}~PP>-U92;
z0iWOSMC4i`^2B&mZ5q5>$7-WjxhDA@L!x)uLVYk(UCgSa!*lQOB#=ii#AmIq3P4VIg0WCkdtsl-^EvUzwsgS^1~Mm@p^$U4QAIorhKh2C!NcIfwivVZ%fKgV9_WmFUi6WC&rtb=@fPwP|n1_s6n
z3n}x@j8Jsm_6Lsx7d-${`VucUZSB5~2U+v*GmyHFK*v+_xWht$tqg+@z{{cZUo6zeXjmj;#CC1l39aw}?w0->9XT%yxCC@r}T$@_R4z?ANcIbcj)fHlw!YV2-UKK@U?!
z)Qn11!iS^BQ361vx=suB`F-$D(sKU8S@%PGTNgP4O@DQ##>?eg@bR7TIyhT_;MR3q
zhj!IBcCl)>i0$=U5QdAlyZ>cpU>s#eOO$np(0KhUgm_
zYn~qUbD+eSR9Ue)T`GtTMBNpO*X4-bN*mu-om6yH=9(n~I;f*_)v)h+y+XQ$4udxT
zr6B2E{HP2`(tRiz-_I;7w>isr9vWXy!?PN+_k*MKWp3EqdYJ0=Lu@W$PH&wg#O2?b
zKYQ^m-_2C&?7gVId4QRBnXlZz(k}T#(Cm40u&kHaPL-~I17v6sI2)O@n!nyPVeB!b
z7`VoJY&ZK*mENxGdFZ%yC_~x!-7jyT?XEQ|5}O_1C=UvzqIzh~Axc6(sNC7j8ZRK2
zz{G_do*A$UKQ$w^Ln6K$apJGUPCTg6$#pyTyoyc|@K~%9tm;qHj{yy2$ytB(-8x!b
zR(rf0DkK$r+)YD+aqiSaCrTL$k;T9JGurJ}76`NNq>#njHuWtzQ}gRm%`$KccG`+*
zTCZ#($yv1hk?`qIY&1H5V2K$EJ5haSvW&4w{$<%Oi!VM4AhocJ)cW1=)RD6Nvb%;y
z#C~SyO{2xy*ls|VD`6*5JpnsoyfwSA;Rw#(-{gtnv*S*3#~WRTqI)I#e4E70yGV}d
z_6ynHH%|LiI~m;LgvV(_N>XuadavC^x5j{JRiCeKj#e6%cY3&ZQjjnjHdR+{@>{uP
z_@K{Ol;pr(tYgcB@>G&R5eH4Pb=pPj<50_mms~}LURacf(laurgWXNFUMdgdNaH*)
zn@Bj(h_8)}4a(iwKA1>ZwzYaww>HMS`zhdK>5LY^87F?o!bxAn-6
zRh2yFU4$8$<8dhAA_ud7c)b{Gkgy!j8EU&bdm8gEpv}_G=_2LT8_@O
zBkw!I+)a;!Pl{T5TBnFmEmGf|&8<_DSvB}5HW^%tN2H#z`Ex*Jhm};8AR-_jfFdEK
zKWlJ9DV4Fq7@6hD(I|P4L5#o4_A9yzo)Hw#THuD+{Lu@Z;S;4czStv&R6Xd^QYcQ>
zMyYyY60T`&UHsnAZBG#7J7}XjOrVFHy=85s>il86FL~O!17~uVDv$6KjN%9DYFH)W
zb%&&OBjgFGR0IVT-{ToNk?%|q@`6cPrps9{sjKjW2o`q?oFa=wuapMk7s
z6g~2S
z%$x`b%;N`wUZm4A?IFb_Mh+dw6JB*RZ%fJ8a50)glHkjY?fw9KZNlE
zBp^jr1_^0!s9|eZVD_<6nG6JA)iUxx07AX>_d3hjf
zuq=kyDEbqnSr0E5t^L6!y>x=V9Qd6slS>l>@%NPiK@cCS`>!tIS}Fj<&x
z2?CaM<y
z9wH%eFbWMw$ksKtf}QI9|D)*~10!3WJ{)Yg$tD|bY}x@N+Gs^eona5;)zfdSu)3L%vt~&|C+=dR
zDFOdVF$ST>pbCt=H1!Ei!~Z&G{-qrjJ>@?Q4y(h2UKoTlG2cPrr4xwd|Kn2Lh}P^H
zZ~eeS1`-VjehpzzYEVB2Gr7U@52*CO`xgt}^o!>sVc;aPfgio;YFcSNEU)ec9$seu
zBj$9))FGwxDbYXchM$%#z8cg^Gt7b@;~_|nQCj>*M)=pRK0*-ZPUnl;TLQUI5rmCx
zHe4j#hyS7f!5eHE^x{HFU5plk!R?mazVfG=GQOIp@bt
zl-vG>(@IjGx{FHlQ74e906^~@QS$O_nCJse(LtYkN7tZ3@-?sHZ!HyMfwOn>{M3)oA$Yah6LDu%!~1s
zpS-9`azi)F$KG~0^xvynt`~*zaMd4$70++J=$qGREW6mtNwpn8E>etu`?kl
zj|3)C48Naeafx!fS*+7(Ff@Tgu0Qo6IV7I(k7DmX1I2WnI?q5mNt+MRgHz8ks%o(-
zzV@!wT`j1>RGJ8sMMs^~Uak=6$M9N#q?nJFUF=>m
z>;pH|Qf=api5!z$*9v)*Bd>iUS=8Q)1xscCoy^RM%e3x1TVJM!wldifNL&Lwt2;z0
z$OR6&cRSVWf*?AZ#?~ZErTWDtfh?|p&zxFL`eXl!X6WctF6qmlM_*gJ^~kTzLw*VI
z$Xz{Y<8Z{~b={57P1|xJTEp%6FK;x)#*qP=>h;)51YdN)kE_n#C5fXet}$*5
z_Cc}+C?X=m_Y0_Z+>6yf%5N3D2uSm;KuS5m4c?LtL`UP`Zt=5I)Pzb;8tP(S_P%S4
zDj2|ih4_J;$m@A^u=_E+pLuT&Xr^d#R_}ghy{o8xy$`SzcMV}Lm>ZGFWT7LQ_l0LW
zbBZk@FyB7={)6ZA(30vSn1i;3h#xOxueK5Bc8l>b*(QE}qpp|3*p=$+WnuNreqEK*
z<}m^;J}9ZAmS2g_?&y5?C9}6c8&o`1-q&ZO5t7!H_Qgpv#BhGVl27h}M`76j;f%|B
zuc^I|m@S5G8QlzTdg|DIt|5HzgQ5!S_A(@pBXciTA3MGGan%;mlIMM`lnb1xYD5E*
zUtvi&YM7v^r!3qLn5YT&&c1?Sel;^$&id4s26xx<)}~ellM%tZ4baCFFuv*~I^wjElDJF6seG|tKpVq#aC_GwuH72lmVZQ=kcA=P`ab_pX9~;
zu;J{nah3Bc8Cg!dHQr#3bd8ponaXA(;?G)HRay}!yANVwc)JYP8f`em|LVu-x_)5!
zmw3f?JjS*o{;9QFZ20~$3#oe_w`^jwiG#xAd47c)0oE`VMQEJ}u6D|x8Q|#4yy3|w
z+$I)*6yP0N=at~8k`1bQMxXv~UDVDC+M#1)5nVF7I8@h~Oja%mib!(7=r~tf
zQEfMlPTNJAD)^4V3JB^oYegvc4HaZn*=GL?2gQ@@RA}tXKsB((MwQIq|OpW)~Z
z#0aF-rpiAxal9XgIapdo_g{=-@kZf}K1`x}(tq6nXQqyydY-0z#1>jY%yj==pil13
zT+A`~-S*nYq3P;B;^U?XRh(zEvYq(yFRZLtzY?L0am;V{JogfpDl}hv0^;pZSMH4)
zf>3Uv?;qTB`xiSxj%;1A0q(lu&?8qYcOodaGf;JJ@eRCv^1nc@TxxrtID5QL>@?>G
z5+HUE@5>0i3s1eK{)y+gn?BQnR`}E*e@9L;5wkJ>vK7(G4qa>X5m|x_#ttyhGB3
zTL*?tr*+w6dsZW?DMX9MfQ5&Q;a5nFaTTns<}oCKrK89fzi2|S%&-K)#A?vDMgGNR
zTqJ4?JbrZj)^Ke1-U4(h{JLflW}(izG?|QnxC9OLY-we~-Ep3l)o*QJ!>eU7#dLX3
zRMBA39q(E;YiC{7U#O_EBU=SPUNF8wAmBe&TiX9Y|H$)`$E&KUz0QRJZQYQVi;dvz
z`uh)j=j^Lvy@l~@dYqLg{7Rz@0qg?ml(L!FYU4d8$hmt1o1MiTezj4OSN}P0`K5J~
zxtcM0racnw-6O=Y>A62hZ{h`1UJSVBR~;wGE4weX$e+WTj&S=^9XsR_szg_FF*7wJ
zOD4x%EbFd86Ot1=!Ig=mG+OL=eAJL(T`pav%GQo_coPUl%WhWsPW=YwY9JW
zdGOO&Xki&JajJL(Jb=bKd(o#n^2yb2mygFQ)yd{4le}ilG9K{BbAHR#Dze%%58Bkl
zLvpsVbLFkjgw;yriC!n7czjm7Q=HUO!1e?Dub=9z;4iZl
z?6GI=OHw~h;iX{BolJOxu2z?{#IN|GlYDU!?xsh{ejASc@mtF$L-4Y8#g={(Z|SM^
z{kxqq1}oA>0`R_nup)lw&{A3Ud8UbM2f7Yg?es%&pfCuF9Hx`}TzHuyuYiqJz4+)B
z!h4f0pmE8hOFKK&+S2;@it?WKoHBhtRa0I`XL|I<8o0^c3GHM5sfPYt)i!a&=|;fM
zrA>%RmgjZ@dR@LVj*bonJ9)g4!%_<@DcPD7)om1kaw}
zsA(ntHgU^GU*lrNMt+K`(kQn-(|3_`ezqjp{{?OzvnJ2%ZjPfs7H}U_|KX=o16C2Q
z;64;}N>aF{-sAikNy(KW;sPhLw!U3J;_k|3-2t?{nG#EF(S#c5W#2-x1gv%^cKNu>
z*!6i$((YiZqpp6Tq8Wm;T6beh%$9wMWYZ-;c+Ae6ZBc=5Q|9D0X(*t>9chG0sGYT`
z8({k3Fn+H{FQmO}g0jO!FHu5gH_7yi`L`HwfGObb*HB}8o&q9u6Cz?a+1V+7*R!_a&kKpFUjO9k{MSg~YdqoSyoY|D3VCylDxi7nuMbC1?gemJ{qVHc#%5GiGw
zJQmpd$I;Pq;ydk}oeCif%eStVqtVL+!8@5|R##H6vPnwYpA~xIP3?@Psn-Ln(nYfz
zNt&P7)x|c#r&Y;#-GN0FAmZG->#S
zra-s;a1q)0%i&P3%~PA>ShXE+w7Wi4a%kl6H|kwtNS)H&cvziYK^SN{T`)zSiq^s*
zHFmU-n~m-DL-g75v;jsW7{>kt<^?%WYXPdB?h&56z46c@ir|a+!w+SN_lRGu_`=cr
z!aIDP&!fHDYm(*(Ud2#&?;4-N9yGD=g^BX5abSr_l6nciG-yaQ4Gs8_z=~8-0Fw<;hOpm(-`b(5@5qf-ikDde^yqb
z1^OTBO+<*rpIu-|IkWk(MPWYUE
zjjbW4-wn{;=diS+hor1z6Ia@7>91k;>HG<=x3@iNEalzF-DpB#
z!VibwyXkx#5^oA)<0j@L!Y!`3%%eYX=E>eC!R%$pW;Ob3>O7PLAC^&B3F~i3UYw*t
z%Q6p1!q~O{4K`|EM;WC4BVo%_Ay_brI7oEkRoZ1})p^~5dTmMOn`0t8o^O4f5K6I4=HtD7@nrW2y>Yr@Lh5!;HD`_2cX`SG)Fyb1Czj>%M
z)*Bh0wbyCYjrP+p@jp!7*TP0$T=rq6(Zk`Yhe)zaA22>42O9YI$t84&ru6V4Ds?OY
zRO1mNf-w^QceO#cQUVh|@u4@HfCGlzvU=GxGl@Z>QD_>f`Z69g
zml^-}W;G0*ZXL9IHq*XCT(>DgO0K#9E40<>@OW+TcC$g@5n2r43^FGk3+K?Bzdw*P
z3e6~yanX6Wnc)uPD`4r0gv-IxKCr7#{jk`4Eeo?)h;Z1;ayPwq)TtTyR}I5gQ&4q@
zJ`hP_0elXFgNg8GA9<`a`R2KZy-{vCq}gA;@Di$$A-bhAs1>6uCz1*T}SP
zU>4G7IZN(07wk}7ee=j{}N4YLY6W;&txoAzNOvmQEib;*frN-h(x`;cMJQ$PcRIidkE3E(>?#G_L`d+X|My&9uPrZ8kw2towHQ+@`26
zkq@$m^@+r>u6>+Wh<`%gTSIx|<)K#8&%@bt1h-VG;pHB(aNVY%euLM3OwP>6L@4<9
zQ0?SP5R+}M(Iec|Q?wL`5j(7~x#0+mYsjhA05ou$G`V{n4FeQr1CIel_?_qGQ9fwY
znNK!9k4s5O9=BXasnMnWxJp${sJ2qj15)x;vlt|p2Y41pK#_gQ
zDft}yn@0xi?brU{Mts~+O{CswqpPgUaH?*-TBzt!S3Iq;VmDAT{+xLG-p&u!{&jAj
zPb9T=3!UO8arO4xa@drwX$&oZq+@7P6myO2M(zar#|bCIgVUn9yJ23gRUOu!FDEJL*EQu~N`R7+_oANrR
zD>nFx!a&q_+%ukuA2`YfOCrO(k}r33#eX`}j5P
z?N*d^-ZifBjesY)d~^Rf$po}$-52{_^3MgX{nnI0fWO90wJk&8JIf;6492ZQpWTm!
zg+P_++44y6gWX`uz~SS!h?nSr;5CC`B-lh$+ZLx9WAv$)PmUE!vu=cPo4T=jiV>&j
zHnk9f^wPEQnT2~cYLzq-UtfMS`09^L9X~31^DoDYpIs6WV?*VE;HT80Q}|$r2CI;S
zDMU(&6IeVMnaT3&4^Hle&O)6jc6;dOfN8x+dk=pGuZ?+vo8=r;dPp0!8(*xgG1IfWWOc8
zeA%yDjf=$^ko+M@Y@)w+bt7uuU#Okj-3&2K6T~~2oM_?>Plwi+NJ@qMW+Wsjh>vKt
zwT(_A8cYKZ_ff&vZU6n}pm>;-p(A3XZ&m`qy#4p18CW%VoGMX2^&|q?kY1XQsa1MZ
zoT_1wE~z+4_XYzLp<4O?xbHuE-oZ83RrfSC6G#(&(y-dkl?_Qc#Sh6;C}_wsNjSv|
zCRVY|Pp}R&(WB`hLRi!OVvMH^RQ)RXs+7@f+K)cq#jcrJ5^TgC%^CfQobu&hF5nR6
zD{Nf*hc0?injp#nOe9kj$~1{AOkgD}3n9B3R!KB6`B)PJ($8KNtdep6mk*(D>1Kh=
zUFc@8UmyYmF>odZs9NNI8A{MY3NicO{K{^OEnS63$?_6;@=ha`(H(0epgn6$f)gLO
z+x^1jsi`v}GBbnf9F(t6M(S4zOW-@EiO>T_=;SG}YV&W49z-RuVg=~I!3PM2LN;0D
z{_IDhr>a2`1djn&_lM>601&50vfo?1`~5@BZvIE
zUnRLC?lLScRpBZj9>iLpS
z5Fs+`7h>3cH+BDoE9zoI3?Cx~JZ&0_z+_paXuNsby1j+2^#5IUYk_*lIc#bzw&Kg&
z*l#oe^=_!qqUJrC+6PTTfL5jATL-_&u2H^di7%irxvw1rY8fJcmP|%KL+0NR?u!e4
z>5s@R8ghBpbtDJ{5Ko0c`9>;)byf9&Jig50Dp^`NNvWig^jSSpxqgjumre_{lF^2#2{Xnsl@Mycj-%NSf+i4;|8}hWGraR;R_Aqm)CxyYT~HxX5WZHG@0-JXAG_t`tI$$JJg4PDbz0Lv7jxO
zUE|*lBP&$GVuDPzVAtT)K3mFc*+R$T{GAN0!>-}d@J1*6?|9?eCcN}(J-5Pgy&J$i
zxueTfR2(LFE7Y~w)ScXH82lYq@s`=3J%RZO8cV`hURnW-_(02bgW)}+b%T17Z#cAl
z+zAuxUtLjRv-LYCia>m0G8AtGPhXvCbBa
zKlOEt;Lt%FRH#}`p4PIyAt&_Q=bB*ap?(Q<>tXFJ_8N398K4*c8XJz**GY4LWA15p
zjxV(13Gb|Rd&X`t65^6vD+@kAFeni;ca)${$Dtr%7NAGJOmIY+6q@%34M7V|MR~L9H7&g4@uPQ2EGfebI-yyH$U@=5nrTQ%iSyKndxnZkaJ=jeNJGY`|nJ+-36zdVGK6LE>$d1cysd<23<)eo@RQ4SHVhn|7Q^n~EF2q|w|Y{6Nhgq#}n
zJ<&q{n#Uv=b>+8)D%g7xA6nmxF6ZCyW@MtuBoLI44)`?%T*^EBT;m~FC9h!(5Ww-u
z9x4(E%S48}BDZt;7P`S5%`jdghB^-|)=vMuQ`CJ*x~pHt8F7p%W}
z3r;69)1S7Vx}VH)0B=WL`rA)AR?nyBuIJDGR6M;$zL
zGE!EiX>MxD4qHbnWUJT_#lASJ8Ar+OA~LX*DW2PWSq^3s2(PLx*FuvFx-lEMX)}n6
zDe3jl9==IusMAB92PcXQA7j^0nNfA|tt-GKS=SQ6sfy~i2^3qGn_E*6Ltw#Wp|hj*
z*b_aTnwSAv=#bdf00=#el<)}JZdTpr^Km#GL|OXjEUl`_y}rvJGuT!afSVW$nx
zMDedMztU5AbDn~Z4&{!RQjF{S&8elRTA<}m2fwaPXF==IBI8ony?z!a4{u>tm*`XV
z6hkTNnxFT9rQ9LYh7kjU?9;P`h-DsyC2|Axx&)_$m;=0Ks_Oc&%k(2jYWg9Yc-OD1
zxy`yOTU;)?-)riRJmdFoXZsg=u$i*2c{nY8nxx@dp;b=Fm31hniCODifY
zX($IEQo&2r>tIhHM^N7=PcsQeQH*tqS5PKjmaM%8x*9
zM@h%Wl$oD<#O!S8t$kyTc>4XbeF*64e!K(P!7OaI_I+)c+H9jdX;noGF%);ukS+5*($r-$%1?ZsPXPfxAeo84T5k
z+VFK04Y%&(sYSrVR@3LIgsuj=?%O_0@i2uEtWd;Z@T^r6JW-qCUw8Gf+OwaaaVSQtR5aWOP=iur
z6&pUg^26hDo>N((g=j5#kPosYuu(-82&2A@pEKWfrMnwKRH-X>l`lm8l%_}1VJ4Ei
zx5TEpCA;;$KT3m!MR(G?!F#6aOFv!d5W}HCw;oVJsHB=32gGc%x9d?KdU_%YGt>#D@x>M*M4ZINdo|_VnNo04OfS|khw85&1{#ddci#Lz3YF0=g%_X
zdrQqbgGAA4y~@OhQY5vaL=3w|n!J;>aq1YuNj6PpcTIH<92-SL-KsO$uP{qVBNZ0(
zH&*_Do9&v*pfvbjKW^)ls`2etRntZ8o3qxJV>7yz)HUP1_I6g&N?KIor#Him>{W=u
zt4d^pNI*%NbgK&L9%S%r_tR?BqY&Tr_cZEwpku#jLQGHZ=Db`-FaIGYXv?X-pqkfn12_?ye%s!s3A^1gDFskfN
z%B>xwTQL-HhhJe-p`9$y6!P_&KWo+w7n|@c?IV0#g8d?&dK>fFbmGNJ7%DeT{4NF3
z+0z14f7S+reG(Ag#=+Vk}6jSlN9
z7Wsi0fqlokOaBvDjCddzz+hdm({49|RY;Z**o}`bpWV)COyawWIc{}6aZ92{6_*rG
zViewn?6Em?5wGm$g^?tMZZg;4Se(DG@JtJln+iFF34Kq_qbJUla8{Bk8U*peJRhHmROEOLquKa%-qAakQM**W-4n~;i;1iMxvRm$u2^!M6fn*RM2L7{MA
z2|bFc$_bcO+2eRpVuc7
zmx785TbeL}bjudWW1xFWLQH;fwP-_tuZ@J)OiW~)u3oDqwUG)hsj-4h9mH;0EMdOG
zs(>28U!cRfrWA`t`9mOjllX2yL;r0|&A?zeIETic3CXiU>dt*Cu$jMQW~vZFpHZTh
z>=&UAr}A!40FtnK476S~`VMCPSH!ppf1q`u^mBxJ%oh&%BU7k!+iI1k)fQ`jL!Dlj
z@!Ikux#`o5!>Ib8#@~pcB18E3y25cM8;yrwx$rbrdcI;Nf$bWSS`iAwi)arQ5BWKf
z?zFMtb6~N9uEUI2#Ov~k7_LeFgfrjs(ty(iyolvhiiV6rCAuKcRX1H`
zTWMc6Z<8$ePmfa}v$NV-CU_(DifG)DUc%56^j4O!Ye*6-OekR)khNkG>8@%6i2g#@zO(N@$catHEH~`XG!XNN+?lAJkIY2H@{sNf
zaM(#YN4t0RBj$Px>re6aSEyJJdhkKyu71ULn(Iq#x!`_ep|HwHpFLkRHil7jFi|(1
zBADNo+PACvC~Ie>%(z^LENgj4)M_2HV%}V=92x11<$U^NsmGsSu-{PMJ`$B3DG#sY
zeppjxzoGf8P=g?)5~I`!p}N%;!Gl~#8+-fgX`;m3ZJ4fzO+G85+PkDc^M3rcOYwlB
zmuJ$AO&NFfDdu`JL=2-&1&Y%U{T9|Qt=jbbF-8}n^}?ik;Z)xT*A_nX|5CR!UjP)s
z4sQDb;~{lB{9#=fdFj)NAZ6%e%Pa)S9M-CT?iW4otyCmR-KTbnT*46kpjd^D-1I|^
z`z-tld1f8}B#F$RpN{W3e{00tRnj0fx$!>)sWEZAm4xcpk(LYtx%OUzJT~rD#hQ^fbJE+mjKKyf)V=qiB{jk8(#i2*YFK=^jEylP!b=_E!MuV5
zT;rg8joA4k#39|w$a0qe4S}w~L-)xF{@tY6a`X5A$0wrG(>XSC=FLV(b|g)8y_MAt
zb5w%OjJeTx>j0H0=a18TI*vT7m0WXOfj+SjJ$7iF?p37MgotTvq;9G&prhntQM);e
z8;p&mMVs88XNcPvF`Yh>G$DC!RF@wV}
zbWz!qX5~f28i;4&mq6GV1X*IUK|GE)mFpUm-9nluamrJSwEX|&9j&abTSlyFysMm5
zg11Vx8(y`N0lET~&~aj81rP4c7Vidh!QjhIjs04kKX1<6KOaSp^)AxNf_eDXmJn;5
zWH4cp6V*aDF55V^7kJn`@4j=mpbJt`?dGlT;#b3g@@=;|KjNF6lx3+%9hPp2+Vl&%
z)UBdZb?e;tUKeR>_QOK;8CPAVd^!JIK0b%%=e%|7c1|uQP4ty2Y<6e;l=y8z=ZXW>
zwZ;m)=4~tY_DhW`KJ`nn<_KzgXJ189BW+a*@q0D2X1Q`XJ&uuPvk`Wx@C3-?DqjZ$
z(<7B7H7`H|iX%Ux-Z{U3sgUC2fy9#-O?sUW->R#(MG_;f0m@R0+T9-?^s!fTew<#Z;COsD=Lp`z)Rqe1)^g&ZoV5Zk=U-)XI5Wag7)gZkLyy{0yGKiLWq4D%dhf1
z?=SkkI8Nu#4bUflZf3lG*aF>k6aYCB86;u`FqBq-Truo=6wbMFrsxPB~r4Bhp?u{=uT)OV1-yA&V
za~GF&@pHm-fqQ3aJy$m{*zZt*TRoT6*(iSF93PAzIC=hl$jAEiI}Os4HBZ-8+Ipk;R;^>VEh