From a44ed30a4f0ad9273851149769527a3994b61a7a Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Wed, 3 May 2023 10:59:02 -0700 Subject: [PATCH 01/89] Add example IA for IaC --- .../iac/getting-started/accessing-the-code.md | 7 ++++ _docs-sources/iac/getting-started/index.md | 3 ++ .../iac/getting-started/setting-up.md | 11 +++++ _docs-sources/iac/reference/index.md | 0 .../iac/usage/composing-your-own-service.md | 3 ++ .../iac/usage/customizing-modules.md | 11 +++++ _docs-sources/iac/usage/index.md | 11 +++++ _docs-sources/iac/usage/using-a-module.md | 15 +++++++ _docs-sources/iac/usage/using-a-service.md | 15 +++++++ _docs-sources/iac/whats-this/index.md | 9 ++++ _docs-sources/iac/whats-this/modules.md | 11 +++++ _docs-sources/iac/whats-this/services.md | 11 +++++ .../iac/getting-started/accessing-the-code.md | 15 +++++++ docs/iac/getting-started/index.md | 11 +++++ docs/iac/getting-started/setting-up.md | 19 +++++++++ docs/iac/reference/index.md | 8 ++++ docs/iac/usage/composing-your-own-service.md | 11 +++++ docs/iac/usage/customizing-modules.md | 19 +++++++++ docs/iac/usage/index.md | 19 +++++++++ docs/iac/usage/using-a-module.md | 23 ++++++++++ docs/iac/usage/using-a-service.md | 23 ++++++++++ docs/iac/whats-this/index.md | 17 ++++++++ docs/iac/whats-this/modules.md | 19 +++++++++ docs/iac/whats-this/services.md | 19 +++++++++ docusaurus.config.js | 6 +++ package.json | 2 +- sidebars.js | 2 + sidebars/iac.js | 42 +++++++++++++++++++ 28 files changed, 361 insertions(+), 1 deletion(-) create mode 100644 _docs-sources/iac/getting-started/accessing-the-code.md create mode 100644 _docs-sources/iac/getting-started/index.md create mode 100644 _docs-sources/iac/getting-started/setting-up.md create mode 100644 _docs-sources/iac/reference/index.md create mode 100644 _docs-sources/iac/usage/composing-your-own-service.md create mode 100644 _docs-sources/iac/usage/customizing-modules.md create mode 100644 _docs-sources/iac/usage/index.md create mode 100644 _docs-sources/iac/usage/using-a-module.md create mode 100644 _docs-sources/iac/usage/using-a-service.md create mode 100644 _docs-sources/iac/whats-this/index.md create mode 100644 _docs-sources/iac/whats-this/modules.md create mode 100644 _docs-sources/iac/whats-this/services.md create mode 100644 docs/iac/getting-started/accessing-the-code.md create mode 100644 docs/iac/getting-started/index.md create mode 100644 docs/iac/getting-started/setting-up.md create mode 100644 docs/iac/reference/index.md create mode 100644 docs/iac/usage/composing-your-own-service.md create mode 100644 docs/iac/usage/customizing-modules.md create mode 100644 docs/iac/usage/index.md create mode 100644 docs/iac/usage/using-a-module.md create mode 100644 docs/iac/usage/using-a-service.md create mode 100644 docs/iac/whats-this/index.md create mode 100644 docs/iac/whats-this/modules.md create mode 100644 docs/iac/whats-this/services.md create mode 100644 sidebars/iac.js diff --git a/_docs-sources/iac/getting-started/accessing-the-code.md b/_docs-sources/iac/getting-started/accessing-the-code.md new file mode 100644 index 0000000000..f8ea975682 --- /dev/null +++ b/_docs-sources/iac/getting-started/accessing-the-code.md @@ -0,0 +1,7 @@ +# Accessing the code + +Gruntwork uses Github to host and share code with our customers. + +## How to access the IaC library + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Volutpat diam ut venenatis tellus in metus vulputate eu. Massa sed elementum tempus egestas sed sed risus. Urna id volutpat lacus laoreet non curabitur gravida. Sed id semper risus in hendrerit. Orci dapibus ultrices in iaculis nunc sed. Sed cras ornare arcu dui vivamus. Sem nulla pharetra diam sit amet nisl suscipit. Elit pellentesque habitant morbi tristique senectus et netus et malesuada. Bibendum arcu vitae elementum curabitur. Amet nisl purus in mollis nunc sed id semper risus. Egestas purus viverra accumsan in nisl. Arcu non sodales neque sodales ut. Tincidunt eget nullam non nisi est sit amet facilisis magna. Porttitor massa id neque aliquam vestibulum morbi blandit cursus. Eu sem integer vitae justo eget. Sed libero enim sed faucibus. Proin sed libero enim sed faucibus turpis in. Vitae elementum curabitur vitae nunc sed velit dignissim sodales ut. Amet facilisis magna etiam tempor orci eu lobortis elementum nibh. diff --git a/_docs-sources/iac/getting-started/index.md b/_docs-sources/iac/getting-started/index.md new file mode 100644 index 0000000000..5dbf47b5f3 --- /dev/null +++ b/_docs-sources/iac/getting-started/index.md @@ -0,0 +1,3 @@ +# Getting Started + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Placerat orci nulla pellentesque dignissim enim sit amet venenatis urna. Tincidunt id aliquet risus feugiat in ante metus dictum at. Suspendisse potenti nullam ac tortor vitae purus faucibus ornare suspendisse. Volutpat sed cras ornare arcu dui vivamus. Arcu odio ut sem nulla pharetra diam sit. Nec ullamcorper sit amet risus. Sed lectus vestibulum mattis ullamcorper velit sed ullamcorper morbi. Tristique sollicitudin nibh sit amet commodo nulla. Etiam non quam lacus suspendisse faucibus interdum posuere. Lacus laoreet non curabitur gravida arcu ac. Morbi tristique senectus et netus. Vestibulum sed arcu non odio euismod lacinia at. A scelerisque purus semper eget duis. diff --git a/_docs-sources/iac/getting-started/setting-up.md b/_docs-sources/iac/getting-started/setting-up.md new file mode 100644 index 0000000000..5886dddc4b --- /dev/null +++ b/_docs-sources/iac/getting-started/setting-up.md @@ -0,0 +1,11 @@ +# Setting up your machine + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Mauris in aliquam sem fringilla ut morbi tincidunt augue interdum. Enim nunc faucibus a pellentesque sit amet porttitor eget. Dui nunc mattis enim ut. Aliquet sagittis id consectetur purus ut faucibus pulvinar. In cursus turpis massa tincidunt dui ut ornare lectus sit. Amet nisl purus in mollis nunc sed. Pharetra vel turpis nunc eget lorem dolor sed. Mauris ultrices eros in cursus. Sed felis eget velit aliquet sagittis id consectetur purus. Sed euismod nisi porta lorem mollis aliquam. Velit euismod in pellentesque massa placerat duis ultricies lacus. + +## Terraform + +You can use terraform + +## Terragrunt + +You can use terragrunt, too! diff --git a/_docs-sources/iac/reference/index.md b/_docs-sources/iac/reference/index.md new file mode 100644 index 0000000000..e69de29bb2 diff --git a/_docs-sources/iac/usage/composing-your-own-service.md b/_docs-sources/iac/usage/composing-your-own-service.md new file mode 100644 index 0000000000..8371cf0e39 --- /dev/null +++ b/_docs-sources/iac/usage/composing-your-own-service.md @@ -0,0 +1,3 @@ +# Composing your own service + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Fusce id velit ut tortor pretium viverra. Congue quisque egestas diam in arcu cursus euismod quis. Diam quis enim lobortis scelerisque fermentum dui. Vel pharetra vel turpis nunc eget lorem dolor. Pellentesque eu tincidunt tortor aliquam nulla facilisi cras fermentum. Enim praesent elementum facilisis leo vel fringilla. Integer feugiat scelerisque varius morbi enim nunc faucibus a pellentesque. Erat velit scelerisque in dictum non. Arcu dictum varius duis at consectetur lorem donec. Praesent elementum facilisis leo vel. Sit amet dictum sit amet justo donec enim diam. Accumsan lacus vel facilisis volutpat est velit. Egestas tellus rutrum tellus pellentesque eu tincidunt tortor aliquam. Sagittis nisl rhoncus mattis rhoncus urna. diff --git a/_docs-sources/iac/usage/customizing-modules.md b/_docs-sources/iac/usage/customizing-modules.md new file mode 100644 index 0000000000..a81c10a69d --- /dev/null +++ b/_docs-sources/iac/usage/customizing-modules.md @@ -0,0 +1,11 @@ +# Customizing Modules + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Dapibus ultrices in iaculis nunc sed augue lacus. Tempor orci eu lobortis elementum nibh tellus molestie. Augue eget arcu dictum varius duis at consectetur. Commodo elit at imperdiet dui accumsan sit amet nulla. Est pellentesque elit ullamcorper dignissim cras tincidunt lobortis feugiat. Nulla porttitor massa id neque aliquam vestibulum morbi blandit cursus. Id diam vel quam elementum pulvinar etiam non quam. Tortor id aliquet lectus proin. Elementum nisi quis eleifend quam adipiscing vitae. Nulla at volutpat diam ut venenatis. Diam quis enim lobortis scelerisque fermentum dui. Egestas fringilla phasellus faucibus scelerisque eleifend donec pretium vulputate. Pharetra vel turpis nunc eget lorem dolor sed. In ante metus dictum at tempor commodo. Aliquet nibh praesent tristique magna sit. Elit ut aliquam purus sit amet. + +## Forking + +Forks are useful tools for eating! + +## Submitting PRs + +Sometimes you might need to do this! diff --git a/_docs-sources/iac/usage/index.md b/_docs-sources/iac/usage/index.md new file mode 100644 index 0000000000..9f642898e6 --- /dev/null +++ b/_docs-sources/iac/usage/index.md @@ -0,0 +1,11 @@ +# Using the IaC library + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Sit amet nulla facilisi morbi tempus iaculis urna. At tempor commodo ullamcorper a lacus vestibulum. Aliquet porttitor lacus luctus accumsan tortor. Amet nisl purus in mollis. Imperdiet proin fermentum leo vel orci porta. Augue ut lectus arcu bibendum at. Eget lorem dolor sed viverra. Nisi quis eleifend quam adipiscing vitae proin. Lobortis feugiat vivamus at augue eget arcu. Vitae purus faucibus ornare suspendisse sed nisi lacus sed viverra. + +## Submitting issues + +Link to issues here... + +## Keeping up to date + +Checkout [Patcher](https://docs.gruntwork.io/guides/stay-up-to-date/patcher) you cool cat! diff --git a/_docs-sources/iac/usage/using-a-module.md b/_docs-sources/iac/usage/using-a-module.md new file mode 100644 index 0000000000..378c2b6f9e --- /dev/null +++ b/_docs-sources/iac/usage/using-a-module.md @@ -0,0 +1,15 @@ +# Using a Module + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ullamcorper sit amet risus nullam eget felis eget nunc lobortis. Lorem mollis aliquam ut porttitor leo a diam sollicitudin tempor. Accumsan sit amet nulla facilisi morbi tempus iaculis urna. Eget dolor morbi non arcu risus quis varius quam quisque. Pharetra magna ac placerat vestibulum lectus mauris ultrices. Duis convallis convallis tellus id interdum velit laoreet id donec. Enim ut tellus elementum sagittis vitae et leo. Varius duis at consectetur lorem. Cursus risus at ultrices mi tempus imperdiet nulla malesuada. + +## With Terraform + +Here's how to use a module with terraform! + +## With Terragrunt + +Here's how to use a module with terragrunt + +## Testing + +Now that you've used a module to stand up infrastructure, try writing a test for it! Gruntwork built Terratest with this use case in mind. Checkout the [Terratest docs](https://terratest.gruntwork.io/) to learn more! diff --git a/_docs-sources/iac/usage/using-a-service.md b/_docs-sources/iac/usage/using-a-service.md new file mode 100644 index 0000000000..6ab90ba6b3 --- /dev/null +++ b/_docs-sources/iac/usage/using-a-service.md @@ -0,0 +1,15 @@ +# Using a Service + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Cras tincidunt lobortis feugiat vivamus at augue. Quam nulla porttitor massa id neque aliquam. Aenean vel elit scelerisque mauris pellentesque. Ac felis donec et odio pellentesque diam volutpat. Volutpat est velit egestas dui id ornare. Non consectetur a erat nam at lectus. Vitae ultricies leo integer malesuada. Sit amet venenatis urna cursus eget. Erat pellentesque adipiscing commodo elit at imperdiet. Libero nunc consequat interdum varius sit amet mattis. Semper quis lectus nulla at volutpat diam ut. Mauris augue neque gravida in fermentum et. Velit euismod in pellentesque massa placerat. Lacus suspendisse faucibus interdum posuere lorem ipsum dolor. Massa vitae tortor condimentum lacinia. Sed enim ut sem viverra. + +## With Terraform + +Here's how to use a module with terraform! + +## With Terragrunt + +Here's how to use a module with terragrunt + +## Testing + +Now that you've used a service to stand up infrastructure, try writing a test for it! Gruntwork built Terratest with this use case in mind. Checkout the [Terratest docs](https://terratest.gruntwork.io/) to learn more! diff --git a/_docs-sources/iac/whats-this/index.md b/_docs-sources/iac/whats-this/index.md new file mode 100644 index 0000000000..e0a94fd602 --- /dev/null +++ b/_docs-sources/iac/whats-this/index.md @@ -0,0 +1,9 @@ +# What is all this? + +Ques que sais? + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Morbi leo urna molestie at. Volutpat blandit aliquam etiam erat. In massa tempor nec feugiat nisl pretium. Vitae auctor eu augue ut lectus arcu bibendum at. Auctor augue mauris augue neque gravida. Vulputate sapien nec sagittis aliquam malesuada bibendum arcu. Bibendum est ultricies integer quis auctor elit. Morbi tincidunt augue interdum velit euismod in pellentesque. Imperdiet proin fermentum leo vel orci porta non pulvinar neque. Felis bibendum ut tristique et egestas quis ipsum. In arcu cursus euismod quis viverra nibh cras pulvinar mattis. Massa massa ultricies mi quis hendrerit dolor. Vel pharetra vel turpis nunc eget lorem. Tortor consequat id porta nibh venenatis cras. Nunc pulvinar sapien et ligula ullamcorper. Vehicula ipsum a arcu cursus vitae congue mauris rhoncus. Sit amet porttitor eget dolor morbi non. + +## Versioning + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. diff --git a/_docs-sources/iac/whats-this/modules.md b/_docs-sources/iac/whats-this/modules.md new file mode 100644 index 0000000000..d7d2bc7129 --- /dev/null +++ b/_docs-sources/iac/whats-this/modules.md @@ -0,0 +1,11 @@ +# Modules + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Est placerat in egestas erat imperdiet sed. Velit dignissim sodales ut eu sem integer vitae. Mattis rhoncus urna neque viverra. Massa placerat duis ultricies lacus sed turpis tincidunt id. Posuere sollicitudin aliquam ultrices sagittis orci. Egestas quis ipsum suspendisse ultrices gravida dictum fusce ut placerat. Tristique senectus et netus et malesuada. Ipsum dolor sit amet consectetur adipiscing elit pellentesque. Enim nunc faucibus a pellentesque sit amet porttitor eget dolor. Eget nunc lobortis mattis aliquam faucibus purus in. Vulputate dignissim suspendisse in est ante in nibh mauris. Morbi non arcu risus quis varius quam. Cras adipiscing enim eu turpis egestas pretium. Donec enim diam vulputate ut. Ut tortor pretium viverra suspendisse potenti nullam. Euismod elementum nisi quis eleifend quam adipiscing vitae proin sagittis. Sed nisi lacus sed viverra tellus. Laoreet id donec ultrices tincidunt arcu non sodales neque. + +## Whats a Module + +It's a bunch of code, ya silly! + +## When do you use a Module? + +When you feel like it, ya dingus! diff --git a/_docs-sources/iac/whats-this/services.md b/_docs-sources/iac/whats-this/services.md new file mode 100644 index 0000000000..268a0d57d7 --- /dev/null +++ b/_docs-sources/iac/whats-this/services.md @@ -0,0 +1,11 @@ +# Services + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Eu nisl nunc mi ipsum faucibus vitae aliquet. Cras adipiscing enim eu turpis egestas pretium aenean pharetra magna. Nam at lectus urna duis convallis convallis. Eget est lorem ipsum dolor sit amet consectetur adipiscing elit. Interdum varius sit amet mattis vulputate enim. Massa id neque aliquam vestibulum. Nunc sed augue lacus viverra vitae congue eu consequat ac. Volutpat ac tincidunt vitae semper. Placerat orci nulla pellentesque dignissim enim. Dui sapien eget mi proin sed libero enim sed. Sem viverra aliquet eget sit. Dis parturient montes nascetur ridiculus. Quam id leo in vitae. Tortor dignissim convallis aenean et tortor at risus viverra adipiscing. Elit eget gravida cum sociis natoque penatibus et. + +## Whats a Service + +It's a bunch of modules grouped into one REALLY BIG module + +## When do you use a Service? + +When you feel like it, ya dingus! diff --git a/docs/iac/getting-started/accessing-the-code.md b/docs/iac/getting-started/accessing-the-code.md new file mode 100644 index 0000000000..4a4ac5012f --- /dev/null +++ b/docs/iac/getting-started/accessing-the-code.md @@ -0,0 +1,15 @@ +# Accessing the code + +Gruntwork uses Github to host and share code with our customers. + +## How to access the IaC library + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Volutpat diam ut venenatis tellus in metus vulputate eu. Massa sed elementum tempus egestas sed sed risus. Urna id volutpat lacus laoreet non curabitur gravida. Sed id semper risus in hendrerit. Orci dapibus ultrices in iaculis nunc sed. Sed cras ornare arcu dui vivamus. Sem nulla pharetra diam sit amet nisl suscipit. Elit pellentesque habitant morbi tristique senectus et netus et malesuada. Bibendum arcu vitae elementum curabitur. Amet nisl purus in mollis nunc sed id semper risus. Egestas purus viverra accumsan in nisl. Arcu non sodales neque sodales ut. Tincidunt eget nullam non nisi est sit amet facilisis magna. Porttitor massa id neque aliquam vestibulum morbi blandit cursus. Eu sem integer vitae justo eget. Sed libero enim sed faucibus. Proin sed libero enim sed faucibus turpis in. Vitae elementum curabitur vitae nunc sed velit dignissim sodales ut. Amet facilisis magna etiam tempor orci eu lobortis elementum nibh. + + + diff --git a/docs/iac/getting-started/index.md b/docs/iac/getting-started/index.md new file mode 100644 index 0000000000..384de7eff5 --- /dev/null +++ b/docs/iac/getting-started/index.md @@ -0,0 +1,11 @@ +# Getting Started + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Placerat orci nulla pellentesque dignissim enim sit amet venenatis urna. Tincidunt id aliquet risus feugiat in ante metus dictum at. Suspendisse potenti nullam ac tortor vitae purus faucibus ornare suspendisse. Volutpat sed cras ornare arcu dui vivamus. Arcu odio ut sem nulla pharetra diam sit. Nec ullamcorper sit amet risus. Sed lectus vestibulum mattis ullamcorper velit sed ullamcorper morbi. Tristique sollicitudin nibh sit amet commodo nulla. Etiam non quam lacus suspendisse faucibus interdum posuere. Lacus laoreet non curabitur gravida arcu ac. Morbi tristique senectus et netus. Vestibulum sed arcu non odio euismod lacinia at. A scelerisque purus semper eget duis. + + + diff --git a/docs/iac/getting-started/setting-up.md b/docs/iac/getting-started/setting-up.md new file mode 100644 index 0000000000..ad56b149ee --- /dev/null +++ b/docs/iac/getting-started/setting-up.md @@ -0,0 +1,19 @@ +# Setting up your machine + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Mauris in aliquam sem fringilla ut morbi tincidunt augue interdum. Enim nunc faucibus a pellentesque sit amet porttitor eget. Dui nunc mattis enim ut. Aliquet sagittis id consectetur purus ut faucibus pulvinar. In cursus turpis massa tincidunt dui ut ornare lectus sit. Amet nisl purus in mollis nunc sed. Pharetra vel turpis nunc eget lorem dolor sed. Mauris ultrices eros in cursus. Sed felis eget velit aliquet sagittis id consectetur purus. Sed euismod nisi porta lorem mollis aliquam. Velit euismod in pellentesque massa placerat duis ultricies lacus. + +## Terraform + +You can use terraform + +## Terragrunt + +You can use terragrunt, too! + + + diff --git a/docs/iac/reference/index.md b/docs/iac/reference/index.md new file mode 100644 index 0000000000..ef83022ef1 --- /dev/null +++ b/docs/iac/reference/index.md @@ -0,0 +1,8 @@ + + + diff --git a/docs/iac/usage/composing-your-own-service.md b/docs/iac/usage/composing-your-own-service.md new file mode 100644 index 0000000000..d68364b262 --- /dev/null +++ b/docs/iac/usage/composing-your-own-service.md @@ -0,0 +1,11 @@ +# Composing your own service + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Fusce id velit ut tortor pretium viverra. Congue quisque egestas diam in arcu cursus euismod quis. Diam quis enim lobortis scelerisque fermentum dui. Vel pharetra vel turpis nunc eget lorem dolor. Pellentesque eu tincidunt tortor aliquam nulla facilisi cras fermentum. Enim praesent elementum facilisis leo vel fringilla. Integer feugiat scelerisque varius morbi enim nunc faucibus a pellentesque. Erat velit scelerisque in dictum non. Arcu dictum varius duis at consectetur lorem donec. Praesent elementum facilisis leo vel. Sit amet dictum sit amet justo donec enim diam. Accumsan lacus vel facilisis volutpat est velit. Egestas tellus rutrum tellus pellentesque eu tincidunt tortor aliquam. Sagittis nisl rhoncus mattis rhoncus urna. + + + diff --git a/docs/iac/usage/customizing-modules.md b/docs/iac/usage/customizing-modules.md new file mode 100644 index 0000000000..2d8bc7c7b3 --- /dev/null +++ b/docs/iac/usage/customizing-modules.md @@ -0,0 +1,19 @@ +# Customizing Modules + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Dapibus ultrices in iaculis nunc sed augue lacus. Tempor orci eu lobortis elementum nibh tellus molestie. Augue eget arcu dictum varius duis at consectetur. Commodo elit at imperdiet dui accumsan sit amet nulla. Est pellentesque elit ullamcorper dignissim cras tincidunt lobortis feugiat. Nulla porttitor massa id neque aliquam vestibulum morbi blandit cursus. Id diam vel quam elementum pulvinar etiam non quam. Tortor id aliquet lectus proin. Elementum nisi quis eleifend quam adipiscing vitae. Nulla at volutpat diam ut venenatis. Diam quis enim lobortis scelerisque fermentum dui. Egestas fringilla phasellus faucibus scelerisque eleifend donec pretium vulputate. Pharetra vel turpis nunc eget lorem dolor sed. In ante metus dictum at tempor commodo. Aliquet nibh praesent tristique magna sit. Elit ut aliquam purus sit amet. + +## Forking + +Forks are useful tools for eating! + +## Submitting PRs + +Sometimes you might need to do this! + + + diff --git a/docs/iac/usage/index.md b/docs/iac/usage/index.md new file mode 100644 index 0000000000..49ac43a002 --- /dev/null +++ b/docs/iac/usage/index.md @@ -0,0 +1,19 @@ +# Using the IaC library + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Sit amet nulla facilisi morbi tempus iaculis urna. At tempor commodo ullamcorper a lacus vestibulum. Aliquet porttitor lacus luctus accumsan tortor. Amet nisl purus in mollis. Imperdiet proin fermentum leo vel orci porta. Augue ut lectus arcu bibendum at. Eget lorem dolor sed viverra. Nisi quis eleifend quam adipiscing vitae proin. Lobortis feugiat vivamus at augue eget arcu. Vitae purus faucibus ornare suspendisse sed nisi lacus sed viverra. + +## Submitting issues + +Link to issues here... + +## Keeping up to date + +Checkout [Patcher](https://docs.gruntwork.io/guides/stay-up-to-date/patcher) you cool cat! + + + diff --git a/docs/iac/usage/using-a-module.md b/docs/iac/usage/using-a-module.md new file mode 100644 index 0000000000..bb26d0b0f1 --- /dev/null +++ b/docs/iac/usage/using-a-module.md @@ -0,0 +1,23 @@ +# Using a Module + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ullamcorper sit amet risus nullam eget felis eget nunc lobortis. Lorem mollis aliquam ut porttitor leo a diam sollicitudin tempor. Accumsan sit amet nulla facilisi morbi tempus iaculis urna. Eget dolor morbi non arcu risus quis varius quam quisque. Pharetra magna ac placerat vestibulum lectus mauris ultrices. Duis convallis convallis tellus id interdum velit laoreet id donec. Enim ut tellus elementum sagittis vitae et leo. Varius duis at consectetur lorem. Cursus risus at ultrices mi tempus imperdiet nulla malesuada. + +## With Terraform + +Here's how to use a module with terraform! + +## With Terragrunt + +Here's how to use a module with terragrunt + +## Testing + +Now that you've used a module to stand up infrastructure, try writing a test for it! Gruntwork built Terratest with this use case in mind. Checkout the [Terratest docs](https://terratest.gruntwork.io/) to learn more! + + + diff --git a/docs/iac/usage/using-a-service.md b/docs/iac/usage/using-a-service.md new file mode 100644 index 0000000000..67ecb78b89 --- /dev/null +++ b/docs/iac/usage/using-a-service.md @@ -0,0 +1,23 @@ +# Using a Service + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Cras tincidunt lobortis feugiat vivamus at augue. Quam nulla porttitor massa id neque aliquam. Aenean vel elit scelerisque mauris pellentesque. Ac felis donec et odio pellentesque diam volutpat. Volutpat est velit egestas dui id ornare. Non consectetur a erat nam at lectus. Vitae ultricies leo integer malesuada. Sit amet venenatis urna cursus eget. Erat pellentesque adipiscing commodo elit at imperdiet. Libero nunc consequat interdum varius sit amet mattis. Semper quis lectus nulla at volutpat diam ut. Mauris augue neque gravida in fermentum et. Velit euismod in pellentesque massa placerat. Lacus suspendisse faucibus interdum posuere lorem ipsum dolor. Massa vitae tortor condimentum lacinia. Sed enim ut sem viverra. + +## With Terraform + +Here's how to use a module with terraform! + +## With Terragrunt + +Here's how to use a module with terragrunt + +## Testing + +Now that you've used a service to stand up infrastructure, try writing a test for it! Gruntwork built Terratest with this use case in mind. Checkout the [Terratest docs](https://terratest.gruntwork.io/) to learn more! + + + diff --git a/docs/iac/whats-this/index.md b/docs/iac/whats-this/index.md new file mode 100644 index 0000000000..89588d11d3 --- /dev/null +++ b/docs/iac/whats-this/index.md @@ -0,0 +1,17 @@ +# What is all this? + +Ques que sais? + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Morbi leo urna molestie at. Volutpat blandit aliquam etiam erat. In massa tempor nec feugiat nisl pretium. Vitae auctor eu augue ut lectus arcu bibendum at. Auctor augue mauris augue neque gravida. Vulputate sapien nec sagittis aliquam malesuada bibendum arcu. Bibendum est ultricies integer quis auctor elit. Morbi tincidunt augue interdum velit euismod in pellentesque. Imperdiet proin fermentum leo vel orci porta non pulvinar neque. Felis bibendum ut tristique et egestas quis ipsum. In arcu cursus euismod quis viverra nibh cras pulvinar mattis. Massa massa ultricies mi quis hendrerit dolor. Vel pharetra vel turpis nunc eget lorem. Tortor consequat id porta nibh venenatis cras. Nunc pulvinar sapien et ligula ullamcorper. Vehicula ipsum a arcu cursus vitae congue mauris rhoncus. Sit amet porttitor eget dolor morbi non. + +## Versioning + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. + + + diff --git a/docs/iac/whats-this/modules.md b/docs/iac/whats-this/modules.md new file mode 100644 index 0000000000..edc4f6b2a3 --- /dev/null +++ b/docs/iac/whats-this/modules.md @@ -0,0 +1,19 @@ +# Modules + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Est placerat in egestas erat imperdiet sed. Velit dignissim sodales ut eu sem integer vitae. Mattis rhoncus urna neque viverra. Massa placerat duis ultricies lacus sed turpis tincidunt id. Posuere sollicitudin aliquam ultrices sagittis orci. Egestas quis ipsum suspendisse ultrices gravida dictum fusce ut placerat. Tristique senectus et netus et malesuada. Ipsum dolor sit amet consectetur adipiscing elit pellentesque. Enim nunc faucibus a pellentesque sit amet porttitor eget dolor. Eget nunc lobortis mattis aliquam faucibus purus in. Vulputate dignissim suspendisse in est ante in nibh mauris. Morbi non arcu risus quis varius quam. Cras adipiscing enim eu turpis egestas pretium. Donec enim diam vulputate ut. Ut tortor pretium viverra suspendisse potenti nullam. Euismod elementum nisi quis eleifend quam adipiscing vitae proin sagittis. Sed nisi lacus sed viverra tellus. Laoreet id donec ultrices tincidunt arcu non sodales neque. + +## Whats a Module + +It's a bunch of code, ya silly! + +## When do you use a Module? + +When you feel like it, ya dingus! + + + diff --git a/docs/iac/whats-this/services.md b/docs/iac/whats-this/services.md new file mode 100644 index 0000000000..aad86a2d7e --- /dev/null +++ b/docs/iac/whats-this/services.md @@ -0,0 +1,19 @@ +# Services + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Eu nisl nunc mi ipsum faucibus vitae aliquet. Cras adipiscing enim eu turpis egestas pretium aenean pharetra magna. Nam at lectus urna duis convallis convallis. Eget est lorem ipsum dolor sit amet consectetur adipiscing elit. Interdum varius sit amet mattis vulputate enim. Massa id neque aliquam vestibulum. Nunc sed augue lacus viverra vitae congue eu consequat ac. Volutpat ac tincidunt vitae semper. Placerat orci nulla pellentesque dignissim enim. Dui sapien eget mi proin sed libero enim sed. Sem viverra aliquet eget sit. Dis parturient montes nascetur ridiculus. Quam id leo in vitae. Tortor dignissim convallis aenean et tortor at risus viverra adipiscing. Elit eget gravida cum sociis natoque penatibus et. + +## Whats a Service + +It's a bunch of modules grouped into one REALLY BIG module + +## When do you use a Service? + +When you feel like it, ya dingus! + + + diff --git a/docusaurus.config.js b/docusaurus.config.js index 510fd531f0..d63efe9c7b 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -100,6 +100,12 @@ const config = { docId: "guides/index", activeBasePath: "docs/guides", }, + { + type: "doc", + position: "left", + label: "IaC", + docId: "iac/whats-this/index", + }, { type: "dropdown", label: "Library Reference", diff --git a/package.json b/package.json index 9cbb966a61..4512314a54 100644 --- a/package.json +++ b/package.json @@ -7,7 +7,7 @@ }, "scripts": { "docusaurus": "docusaurus", - "start": "docusaurus start & onchange -i '_docs-sources/**/*(*.md|*.mdx|*.json)' -- yarn regenerate:local", + "start": "docusaurus start --port 3001 & onchange -i '_docs-sources/**/*(*.md|*.mdx|*.json)' -- yarn regenerate:local", "build": "docusaurus build", "swizzle": "docusaurus swizzle", "deploy": "docusaurus deploy", diff --git a/sidebars.js b/sidebars.js index 7028208b92..8e3f9504a0 100644 --- a/sidebars.js +++ b/sidebars.js @@ -21,6 +21,7 @@ const complianceSidebar = require("./sidebars/compliance-guide.js") const updateGuideSidebars = require("./sidebars/update-guides.js") const apiSidebars = require("./sidebars/api-reference.js") const faqSidebars = require("./sidebars/faq.js") +const iacSiderbars = require("./sidebars/iac.js") // @ts-check @@ -38,6 +39,7 @@ const sidebars = { ...updateGuideSidebars, ...apiSidebars, faqSidebars, + iacSiderbars, } module.exports = sidebars diff --git a/sidebars/iac.js b/sidebars/iac.js new file mode 100644 index 0000000000..e0be8475a7 --- /dev/null +++ b/sidebars/iac.js @@ -0,0 +1,42 @@ +const sidebar = [ + { + "label": "What is all this?", + "type": "category", + "link": { + "type": "doc", + "id": "iac/whats-this/index" + }, + "items": [ + "iac/whats-this/modules", + "iac/whats-this/services", + ] + }, + { + "label": "Getting Started", + "type": "category", + "link": { + "type": "doc", + "id": "iac/getting-started/index" + }, + "items": [ + "iac/getting-started/setting-up", + "iac/getting-started/accessing-the-code", + ] + }, + { + "label": "Usage", + "type": "category", + "link": { + "type": "doc", + "id": "iac/usage/index" + }, + "items": [ + "iac/usage/using-a-module", + "iac/usage/using-a-service", + "iac/usage/composing-your-own-service", + "iac/usage/customizing-modules", + ] + } +] + +module.exports = sidebar From f5f067b8bf683bd614ec8bca3d4158b6ec699d29 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Thu, 4 May 2023 07:51:48 -0700 Subject: [PATCH 02/89] add library reference to IaC docs --- docs/reference/intro.md | 3 ++ sidebars/iac.js | 77 +++++++++++++++++++++++++++++++++++++---- 2 files changed, 74 insertions(+), 6 deletions(-) create mode 100644 docs/reference/intro.md diff --git a/docs/reference/intro.md b/docs/reference/intro.md new file mode 100644 index 0000000000..ac0f6c7029 --- /dev/null +++ b/docs/reference/intro.md @@ -0,0 +1,3 @@ +# Reference + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. diff --git a/sidebars/iac.js b/sidebars/iac.js index e0be8475a7..f8363d7709 100644 --- a/sidebars/iac.js +++ b/sidebars/iac.js @@ -3,8 +3,8 @@ const sidebar = [ "label": "What is all this?", "type": "category", "link": { - "type": "doc", - "id": "iac/whats-this/index" + "type": "doc", + "id": "iac/whats-this/index" }, "items": [ "iac/whats-this/modules", @@ -15,8 +15,8 @@ const sidebar = [ "label": "Getting Started", "type": "category", "link": { - "type": "doc", - "id": "iac/getting-started/index" + "type": "doc", + "id": "iac/getting-started/index" }, "items": [ "iac/getting-started/setting-up", @@ -27,8 +27,8 @@ const sidebar = [ "label": "Usage", "type": "category", "link": { - "type": "doc", - "id": "iac/usage/index" + "type": "doc", + "id": "iac/usage/index" }, "items": [ "iac/usage/using-a-module", @@ -36,6 +36,71 @@ const sidebar = [ "iac/usage/composing-your-own-service", "iac/usage/customizing-modules", ] + }, + { + "label": "Library Reference", + "type": "category", + "link": { + "type": "doc", + "id": "reference/intro" + }, + "items": [ + { + type: "category", + collapsible: true, + label: "Module Catalog", + items: [{ type: "autogenerated", dirName: "reference/modules" }], + }, + { + type: "category", + collapsible: true, + label: "Service Catalog", + items: [ + { + "App Orchestration": [ + { + type: "autogenerated", + dirName: "reference/services/app-orchestration", + }, + ], + }, + { + "CI/CD Pipeline": [ + { + type: "autogenerated", + dirName: "reference/services/ci-cd-pipeline", + }, + ], + }, + { + "Data Storage": [ + { + type: "autogenerated", + dirName: "reference/services/data-storage", + }, + ], + }, + { + "Landing Zone": [ + { + type: "autogenerated", + dirName: "reference/services/landing-zone", + }, + ], + }, + { + Networking: [ + { type: "autogenerated", dirName: "reference/services/networking" }, + ], + }, + { + Security: [ + { type: "autogenerated", dirName: "reference/services/security" }, + ], + }, + ], + }, + ] } ] From 26d4750bf7d95187b2244a766fb69ab2f43b6e9b Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Thu, 4 May 2023 07:56:10 -0700 Subject: [PATCH 03/89] remove other reference to library --- docusaurus.config.js | 16 ---------------- 1 file changed, 16 deletions(-) diff --git a/docusaurus.config.js b/docusaurus.config.js index d63efe9c7b..1435e32e3f 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -106,22 +106,6 @@ const config = { label: "IaC", docId: "iac/whats-this/index", }, - { - type: "dropdown", - label: "Library Reference", - items: [ - { - type: "doc", - label: "Modules", - docId: "reference/modules/intro", - }, - { - type: "doc", - label: "Services", - docId: "reference/services/intro/overview", - }, - ], - }, { to: "/tools", label: "Tools", position: "left" }, { to: "/courses", label: "Courses", position: "left" }, { From fd19cf43b1b4fd3f10471a50aa852e221f7864b9 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Thu, 4 May 2023 11:03:52 -0700 Subject: [PATCH 04/89] tidy up --- _docs-sources/iac/whats-this/index.md | 2 +- _docs-sources/pipelines/index.md | 3 +++ _docs-sources/refarch/index.md | 3 +++ docs/iac/whats-this/index.md | 4 ++-- docs/pipelines/index.md | 11 +++++++++++ docs/refarch/index.md | 11 +++++++++++ docusaurus.config.js | 21 +++++++++++++++++++-- 7 files changed, 50 insertions(+), 5 deletions(-) create mode 100644 _docs-sources/pipelines/index.md create mode 100644 _docs-sources/refarch/index.md create mode 100644 docs/pipelines/index.md create mode 100644 docs/refarch/index.md diff --git a/_docs-sources/iac/whats-this/index.md b/_docs-sources/iac/whats-this/index.md index e0a94fd602..536c453b51 100644 --- a/_docs-sources/iac/whats-this/index.md +++ b/_docs-sources/iac/whats-this/index.md @@ -1,6 +1,6 @@ # What is all this? -Ques que sais? +Qu'est-ce que c'est? Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Morbi leo urna molestie at. Volutpat blandit aliquam etiam erat. In massa tempor nec feugiat nisl pretium. Vitae auctor eu augue ut lectus arcu bibendum at. Auctor augue mauris augue neque gravida. Vulputate sapien nec sagittis aliquam malesuada bibendum arcu. Bibendum est ultricies integer quis auctor elit. Morbi tincidunt augue interdum velit euismod in pellentesque. Imperdiet proin fermentum leo vel orci porta non pulvinar neque. Felis bibendum ut tristique et egestas quis ipsum. In arcu cursus euismod quis viverra nibh cras pulvinar mattis. Massa massa ultricies mi quis hendrerit dolor. Vel pharetra vel turpis nunc eget lorem. Tortor consequat id porta nibh venenatis cras. Nunc pulvinar sapien et ligula ullamcorper. Vehicula ipsum a arcu cursus vitae congue mauris rhoncus. Sit amet porttitor eget dolor morbi non. diff --git a/_docs-sources/pipelines/index.md b/_docs-sources/pipelines/index.md new file mode 100644 index 0000000000..ccd9212e7f --- /dev/null +++ b/_docs-sources/pipelines/index.md @@ -0,0 +1,3 @@ +# Gruntwork Pipelines + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. At lectus urna duis convallis convallis tellus id interdum velit. Pretium vulputate sapien nec sagittis aliquam. Tristique senectus et netus et. Nullam eget felis eget nunc lobortis mattis aliquam faucibus purus. Aliquet sagittis id consectetur purus ut. Lectus magna fringilla urna porttitor rhoncus dolor. Eget felis eget nunc lobortis mattis aliquam faucibus purus in. Erat nam at lectus urna duis convallis convallis. Euismod lacinia at quis risus sed vulputate odio. diff --git a/_docs-sources/refarch/index.md b/_docs-sources/refarch/index.md new file mode 100644 index 0000000000..0e4051592a --- /dev/null +++ b/_docs-sources/refarch/index.md @@ -0,0 +1,3 @@ +# Reference Architecture + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/docs/iac/whats-this/index.md b/docs/iac/whats-this/index.md index 89588d11d3..a29de8485c 100644 --- a/docs/iac/whats-this/index.md +++ b/docs/iac/whats-this/index.md @@ -1,6 +1,6 @@ # What is all this? -Ques que sais? +Qu'est-ce que c'est? Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Morbi leo urna molestie at. Volutpat blandit aliquam etiam erat. In massa tempor nec feugiat nisl pretium. Vitae auctor eu augue ut lectus arcu bibendum at. Auctor augue mauris augue neque gravida. Vulputate sapien nec sagittis aliquam malesuada bibendum arcu. Bibendum est ultricies integer quis auctor elit. Morbi tincidunt augue interdum velit euismod in pellentesque. Imperdiet proin fermentum leo vel orci porta non pulvinar neque. Felis bibendum ut tristique et egestas quis ipsum. In arcu cursus euismod quis viverra nibh cras pulvinar mattis. Massa massa ultricies mi quis hendrerit dolor. Vel pharetra vel turpis nunc eget lorem. Tortor consequat id porta nibh venenatis cras. Nunc pulvinar sapien et ligula ullamcorper. Vehicula ipsum a arcu cursus vitae congue mauris rhoncus. Sit amet porttitor eget dolor morbi non. @@ -12,6 +12,6 @@ Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor i diff --git a/docs/pipelines/index.md b/docs/pipelines/index.md new file mode 100644 index 0000000000..6b47829d77 --- /dev/null +++ b/docs/pipelines/index.md @@ -0,0 +1,11 @@ +# Gruntwork Pipelines + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. At lectus urna duis convallis convallis tellus id interdum velit. Pretium vulputate sapien nec sagittis aliquam. Tristique senectus et netus et. Nullam eget felis eget nunc lobortis mattis aliquam faucibus purus. Aliquet sagittis id consectetur purus ut. Lectus magna fringilla urna porttitor rhoncus dolor. Eget felis eget nunc lobortis mattis aliquam faucibus purus in. Erat nam at lectus urna duis convallis convallis. Euismod lacinia at quis risus sed vulputate odio. + + + diff --git a/docs/refarch/index.md b/docs/refarch/index.md new file mode 100644 index 0000000000..0e56ed1e85 --- /dev/null +++ b/docs/refarch/index.md @@ -0,0 +1,11 @@ +# Reference Architecture + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. + + + diff --git a/docusaurus.config.js b/docusaurus.config.js index 1435e32e3f..963f627a37 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -101,10 +101,27 @@ const config = { activeBasePath: "docs/guides", }, { - type: "doc", + type: "dropdown", position: "left", - label: "IaC", + label: "Docs", docId: "iac/whats-this/index", + items: [ + { + type: "doc", + label: "Infrastructure as Code Library", + docId: "iac/whats-this/index" + }, + { + type: "doc", + label: "Gruntwork Pipelines", + docId: "pipelines/index" + }, + { + type: "doc", + label: "Reference Architecture", + docId: "refarch/index" + }, + ] }, { to: "/tools", label: "Tools", position: "left" }, { to: "/courses", label: "Courses", position: "left" }, From b8154e7100529ec67f6b7d88771075ba2f299d24 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Thu, 4 May 2023 11:23:53 -0700 Subject: [PATCH 05/89] more tidy --- .../{guides/stay-up-to-date => }/patcher/index.md | 0 docs/{guides/stay-up-to-date => }/patcher/index.md | 0 docusaurus.config.js | 5 +++++ sidebars/update-guides.js | 12 ------------ 4 files changed, 5 insertions(+), 12 deletions(-) rename _docs-sources/{guides/stay-up-to-date => }/patcher/index.md (100%) rename docs/{guides/stay-up-to-date => }/patcher/index.md (100%) diff --git a/_docs-sources/guides/stay-up-to-date/patcher/index.md b/_docs-sources/patcher/index.md similarity index 100% rename from _docs-sources/guides/stay-up-to-date/patcher/index.md rename to _docs-sources/patcher/index.md diff --git a/docs/guides/stay-up-to-date/patcher/index.md b/docs/patcher/index.md similarity index 100% rename from docs/guides/stay-up-to-date/patcher/index.md rename to docs/patcher/index.md diff --git a/docusaurus.config.js b/docusaurus.config.js index 963f627a37..f79161a7a6 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -121,6 +121,11 @@ const config = { label: "Reference Architecture", docId: "refarch/index" }, + { + type: "doc", + label: "Patcher", + docId: "patcher/index" + }, ] }, { to: "/tools", label: "Tools", position: "left" }, diff --git a/sidebars/update-guides.js b/sidebars/update-guides.js index e0143a42fa..363502faa4 100644 --- a/sidebars/update-guides.js +++ b/sidebars/update-guides.js @@ -246,18 +246,6 @@ const sidebars = { ], }, ], - patcher: [ - backLink, - { - label: "Keep up-to-date with Patcher", - type: "category", - link: { - type: "doc", - id: "guides/stay-up-to-date/patcher/index", - }, - items: [] - } - ] } module.exports = sidebars From 5e278757cb041e94745a3787878dc82b4d3f61de Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Thu, 4 May 2023 11:27:00 -0700 Subject: [PATCH 06/89] remove guides from nav --- docusaurus.config.js | 7 ------- 1 file changed, 7 deletions(-) diff --git a/docusaurus.config.js b/docusaurus.config.js index f79161a7a6..c3f5fb6cf9 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -93,13 +93,6 @@ const config = { label: "Intro", docId: "intro/overview/intro-to-gruntwork", }, - { - type: "doc", - position: "left", - label: "Guides", - docId: "guides/index", - activeBasePath: "docs/guides", - }, { type: "dropdown", position: "left", From d2faecdfd583284c066b47d74236ce9e7282cd22 Mon Sep 17 00:00:00 2001 From: Eugene K Date: Thu, 4 May 2023 17:02:52 -0400 Subject: [PATCH 07/89] Lots of stuff: - Added placeholders for some other products - Refactored the intro section according to proposed new IA - Added new "Products" main page --- .../create-account.md | 0 .../invite-team.md | 0 .../link-github-id.md | 0 .../guides/working-with-code/using-modules.md | 2 +- .../using-terraform-modules.md | 4 +- .../intro/overview/getting-started.mdx | 12 +-- _docs-sources/intro/overview/how-it-works.md | 6 ++ _docs-sources/intro/overview/prerequisites.md | 34 +++++++ ...erence-architecture-prerequisites-guide.md | 85 ----------------- _docs-sources/landing-zone/index.md | 1 + _docs-sources/products.md | 54 +++++++++++ .../intro/deploy-new-infrastructure.md | 6 +- .../developer-portal}/_category_.json | 0 .../create-account.md | 0 .../invite-team.md | 0 .../link-github-id.md | 0 .../guides/working-with-code/using-modules.md | 4 +- .../using-terraform-modules.md | 6 +- docs/intro/overview/getting-started.mdx | 14 +-- docs/intro/overview/how-it-works.md | 8 +- docs/intro/overview/prerequisites.md | 42 +++++++++ ...erence-architecture-prerequisites-guide.md | 92 ------------------- docs/landing-zone/index.md | 9 ++ docs/products.md | 62 +++++++++++++ .../intro/deploy-new-infrastructure.md | 8 +- docusaurus.config.js | 27 ++++-- package.json | 2 +- sidebars.js | 2 + sidebars/developer-portal.js | 14 +++ sidebars/intro-guide.js | 43 +-------- 30 files changed, 277 insertions(+), 260 deletions(-) rename _docs-sources/{intro/dev-portal => developer-portal}/create-account.md (100%) rename _docs-sources/{intro/dev-portal => developer-portal}/invite-team.md (100%) rename _docs-sources/{intro/dev-portal => developer-portal}/link-github-id.md (100%) create mode 100644 _docs-sources/intro/overview/prerequisites.md delete mode 100644 _docs-sources/intro/overview/reference-architecture-prerequisites-guide.md create mode 100644 _docs-sources/landing-zone/index.md create mode 100644 _docs-sources/products.md rename {_docs-sources/intro/dev-portal => docs/developer-portal}/_category_.json (100%) rename docs/{intro/dev-portal => developer-portal}/create-account.md (100%) rename docs/{intro/dev-portal => developer-portal}/invite-team.md (100%) rename docs/{intro/dev-portal => developer-portal}/link-github-id.md (100%) create mode 100644 docs/intro/overview/prerequisites.md delete mode 100644 docs/intro/overview/reference-architecture-prerequisites-guide.md create mode 100644 docs/landing-zone/index.md create mode 100644 docs/products.md create mode 100644 sidebars/developer-portal.js diff --git a/_docs-sources/intro/dev-portal/create-account.md b/_docs-sources/developer-portal/create-account.md similarity index 100% rename from _docs-sources/intro/dev-portal/create-account.md rename to _docs-sources/developer-portal/create-account.md diff --git a/_docs-sources/intro/dev-portal/invite-team.md b/_docs-sources/developer-portal/invite-team.md similarity index 100% rename from _docs-sources/intro/dev-portal/invite-team.md rename to _docs-sources/developer-portal/invite-team.md diff --git a/_docs-sources/intro/dev-portal/link-github-id.md b/_docs-sources/developer-portal/link-github-id.md similarity index 100% rename from _docs-sources/intro/dev-portal/link-github-id.md rename to _docs-sources/developer-portal/link-github-id.md diff --git a/_docs-sources/guides/working-with-code/using-modules.md b/_docs-sources/guides/working-with-code/using-modules.md index 01298349f1..da10b33077 100644 --- a/_docs-sources/guides/working-with-code/using-modules.md +++ b/_docs-sources/guides/working-with-code/using-modules.md @@ -162,7 +162,7 @@ This code pulls in a module using Terraform’s native `module` functionality. F The `source` URL in the code above uses a Git URL with SSH authentication (see [module sources](https://www.terraform.io/docs/modules/sources.html) for all the types of `source` URLs you can use). -If you followed the [SSH key instructions](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent) when [linking your GitHub ID](/intro/dev-portal/link-github-id.md), this will allow you to access private repos in the Gruntwork +If you followed the [SSH key instructions](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent) when [linking your GitHub ID](/developer-portal/link-github-id.md), this will allow you to access private repos in the Gruntwork Infrastructure as Code Library without having to hard-code a password in your Terraform code. #### Versioned URL diff --git a/_docs-sources/intro/first-deployment/using-terraform-modules.md b/_docs-sources/intro/first-deployment/using-terraform-modules.md index 6e769c7d4f..c20978e8ac 100644 --- a/_docs-sources/intro/first-deployment/using-terraform-modules.md +++ b/_docs-sources/intro/first-deployment/using-terraform-modules.md @@ -113,7 +113,7 @@ of the code. You’ll see an example of this soon. The code above will ONLY allow you to run it with a specific Terraform version. This is a safety measure to ensure you don’t accidentally pick up a new version of Terraform until you’re ready. This is important because once you’ve upgraded to a newer version, Terraform will no longer allow you to deploy that code with any older version. -For example, if a single person on your team upgrades to `1.1.8` and runs `apply`, then you’ll no longer be able to +For example, if a single person on your team upgrades to `1.1.8` and runs `apply`, then you’ll no longer be able to use the state file with `1.1.7`, and you’ll be forced to upgrade everyone on your team and all your CI servers to `1.1.8`. It’s best to do this explicitly, rather than accidentally, so we recommend pinning Terraform versions. @@ -148,7 +148,7 @@ This code pulls in a module using Terraform’s native `module` functionality. F The `source` URL in the code above uses a Git URL with SSH authentication (see [module sources](https://www.terraform.io/docs/modules/sources.html) for all the types of `source` URLs you can use). -If you have established your account and linked your GitHub ID according to the instruction in [Accessing the Dev Portal](/intro/dev-portal/create-account), this will allow you to access private repos in the Gruntwork +If you have established your account and linked your GitHub ID according to the instruction in [Accessing the Dev Portal](/developer-portal/create-account), this will allow you to access private repos in the Gruntwork Infrastructure as Code Library without having to hard-code a password in your Terraform code. #### Versioned URL diff --git a/_docs-sources/intro/overview/getting-started.mdx b/_docs-sources/intro/overview/getting-started.mdx index 51924915bb..3eef1a7a2a 100644 --- a/_docs-sources/intro/overview/getting-started.mdx +++ b/_docs-sources/intro/overview/getting-started.mdx @@ -7,22 +7,16 @@ In this introductory guide we’ll cover the fundamentals you'll need in order t Create an account with our Developer Portal to access the IaC Library and training courses. - + Prepare your local development environment for efficiently working with the industry standard DevOps tools. - + Learn how to leverage these tools with Gruntwork products to realize your infrastructure needs. diff --git a/_docs-sources/intro/overview/how-it-works.md b/_docs-sources/intro/overview/how-it-works.md index f6817597f1..2afe3826f7 100644 --- a/_docs-sources/intro/overview/how-it-works.md +++ b/_docs-sources/intro/overview/how-it-works.md @@ -34,6 +34,12 @@ Gruntwork offers basic and paid support options: - **[Community support](/support#get-support).** Get help via a [Gruntwork Community Slack](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) and our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions). - **[Paid support](/support#paid-support-tiers).** Get help via email, a private Slack channel, or scheduled Zoom calls, with response times backed by SLAs. +## Gruntwork’s Limitations + +Gruntwork focuses on helping you launch and maintain your infrastructure as code. Understanding and using the AWS services that our code provisioned is up to you. Since Gruntwork is an accelerator for your AWS infrastructure and not an abstraction layer in front of AWS, knowledge of AWS and the services you intend to use is required. + +If you purchased our Reference Architecture: During the process of setting up the AWS accounts our tooling will automatically submit quota increase requests to AWS as a support ticket. These AWS quota increases are required to install the components of the Reference Architecture. Often, AWS will approve these requests quickly. Sometimes these support tickets will take some time for AWS to resolve. Unfortunately, some of these requests may be denied by AWS’s support team. Gruntwork can work with you to get these requests approved, but this can take some time, and that time is mostly out of our control. + ## What you provide Gruntwork products and services can help you quickly achieve world-class infrastructure. However, we aren’t a consulting company. To succeed, you (or your trusted DevOps consultant/contractor) must commit to learning how to leverage our products for your use cases, making any additional customizations, and deploying or migrating your apps and services. diff --git a/_docs-sources/intro/overview/prerequisites.md b/_docs-sources/intro/overview/prerequisites.md new file mode 100644 index 0000000000..51d5b0106c --- /dev/null +++ b/_docs-sources/intro/overview/prerequisites.md @@ -0,0 +1,34 @@ +# What do I need to know + +Gruntwork accelerates your infrastructure. Our products allow you to treat your infrastructure like you do your application: as code, complete with pull requests and peer reviews. Our products may require a variety of skills to maintain and customize to your needs over time. + +Here's what your team will need so you can succeed with Gruntwork: + +## Terraform + +Our modules are all built using [Terraform](https://www.terraform.io/). You should be comfortable using Terraform for Infrastructure as Code. + +## Terragrunt + +If you purchase the Reference Architecture, it is delivered in [Terragrunt](https://terragrunt.gruntwork.io/), our open source wrapper around Terraform which allows you to + +1. Separate your monolithic terraform state files into smaller ones to speed up your plans and applies +2. Keep your infrastructure code DRY + +See [How to Manage Multiple Environments with Terraform](https://blog.gruntwork.io/how-to-manage-multiple-environments-with-terraform-32c7bc5d692) and our [Terragrunt Quick start](https://terragrunt.gruntwork.io/docs/getting-started/quick-start/) documentation for more details. + +## Git and GitHub + +Our code is stored in Git repositories in GitHub. You must have a working knowledge of Git via SSH (`add`, `commit`, `pull`, branches, et cetera) and GitHub (Pull requests, issues, et cetera) in order to interface with the Reference Architecture and our code library. + +## AWS + +To be successful with the infrastructure provisioned by us, you must have a decent working knowledge of AWS, its permissions schemes ([IAM](https://aws.amazon.com/iam/)), services, and APIs. While having AWS certification is not required, it is certainly helpful. Since Gruntwork is an accelerator for your AWS infrastructure and not an abstraction layer in front of AWS, knowledge of AWS and the services you intend to use is required. + +## Containerization tools like Docker and Packer + +We create Docker containers throughout our code library, and use them heavily in our [Gruntwork Pipelines](https://gruntwork.io/pipelines/) product, an important piece of the Reference Architecture. Containerization is an important part of helping many companies scale in the cloud, and we’re no exception. Familiarity with creating docker images and pushing and pulling them from repositories is required. Likewise, we use Packer to build AMIs. Understanding Packer will enable you to build your own AMIs for your own infrastructure and make modifications to the infrastructure we provision for you. + +## Time to learn + +With Gruntwork, you can accelerate your journey towards capturing your AWS cloud infrastructure as Infrastructure as Code. Although our aim is to simplify this intricate process, gaining a comprehensive understanding of your infrastructure's complexities and tailoring it to your specific needs will require a significant investment of time and effort on your part. diff --git a/_docs-sources/intro/overview/reference-architecture-prerequisites-guide.md b/_docs-sources/intro/overview/reference-architecture-prerequisites-guide.md deleted file mode 100644 index b8cee102da..0000000000 --- a/_docs-sources/intro/overview/reference-architecture-prerequisites-guide.md +++ /dev/null @@ -1,85 +0,0 @@ -# Reference Architecture Prerequisites Guide - -Gruntwork accelerates your infrastructure with our [Reference Architecture](https://gruntwork.io/reference-architecture/). This framework allows you to treat your infrastructure like you do your application: as code, complete with pull requests and peer reviews. The Reference Architecture requires a variety of skills to maintain it and customize it to your needs over time. - -Here's what your team will need so you can succeed with the Gruntwork Reference Architecture: - -
- - Knowledge of Terraform -
- -Our modules are all built using [Terraform](https://www.terraform.io/), and the Reference Architecture uses our modules to build out your infrastructure. You should be comfortable using Terraform for Infrastructure as Code. -
-
- -
- Knowledge of Terragrunt or willingness to learn -
- -The Reference Architecture is delivered in [Terragrunt](https://terragrunt.gruntwork.io/), our open source wrapper around Terraform which allows you to - -1. Separate your monolithic terraform state files into smaller ones to speed up your plans and applies -2. Keep your infrastructure code DRY - -See [How to Manage Multiple Environments with Terraform](https://blog.gruntwork.io/how-to-manage-multiple-environments-with-terraform-32c7bc5d692) and our [Terragrunt Quick start](https://terragrunt.gruntwork.io/docs/getting-started/quick-start/) documentation for more details. -
-
- -
- Knowledge of git and GitHub -
- -Our Reference Architecture and the modules that it consumes are all stored in Git repositories in GitHub. You must have a working knowledge of Git via SSH (`add`, `commit`, `pull`, branches, et cetera) and GitHub (Pull requests, issues, et cetera) in order to interface with the Reference Architecture and our code library. -
-
- -
- Knowledge of AWS and its services -
- -The Reference Architecture is provisioned in [AWS](https://aws.amazon.com/). To be successful with the infrastructure provisioned by us, you must have a decent working knowledge of AWS, its permissions schemes ([IAM](https://aws.amazon.com/iam/)), services, and APIs. While having AWS certification is not required, it is certainly helpful. Since Gruntwork is an accelerator for your AWS infrastructure and not an abstraction layer in front of AWS, knowledge of AWS and the services you intend to use is required. -
-
- -
- Knowledge of Gruntwork’s Limitations -
- -During the process of setting up the AWS accounts for your reference architecture, our tooling will automatically submit quota increase requests to AWS as a support ticket. These AWS quota increases are required to install the components of the Reference Architecture. Often, AWS will approve these requests quickly. Sometimes these support tickets will take some time for AWS to resolve. Unfortunately, some of these requests may be denied by AWS’s support team. Gruntwork can work with you to get these requests approved, but this can take some time, and that time is mostly out of our control. - -Gruntwork focuses on helping you launch and maintain your infrastructure as code. Understanding and using the AWS services that our code provisioned is up to you. Since Gruntwork is an accelerator for your AWS infrastructure and not an abstraction layer in front of AWS, knowledge of AWS and the services you intend to use is required. -
-
- -
- Knowledge of Go, Shell, and Python -
- -Some of the modules we have leverage Go, Shell scripting and Python. To customize these to suit your needs, you may need to dive in and make changes. In addition, all of our automated testing is written in Go, so familiarity with Go is highly recommended. -
-
- -
- Knowledge of containerization tools like Docker and Packer -
- -We create Docker containers throughout our code library, and use them heavily in our [Gruntwork Pipelines](https://gruntwork.io/pipelines/) product, an important piece of the Reference Architecture. Containerization is an important part of helping many companies scale in the cloud, and we’re no exception. Familiarity with creating docker images and pushing and pulling them from repositories is required. Likewise, we use Packer to build AMIs. Understanding Packer will enable you to build your own AMIs for your own infrastructure and make modifications to the infrastructure we provision for you. -
-
- -
- Brand new AWS accounts -
- -With our Gruntwork Wizard, we help you create new AWS accounts, which we’ll then use to build your Reference Architecture. All accounts must be completely empty. At this time we do not support “brown field” deployments of the Reference Architecture. -
-
- -
- Time to learn -
- -Gruntwork accelerates you down the road towards having your entire AWS cloud infrastructure captured as Infrastructure as Code. The Reference Architecture will set you up with a solid foundation with our [Landing Zone](https://gruntwork.io/landing-zone-for-aws/) and help you regularly modify your infrastructure with [Gruntwork Pipelines](https://gruntwork.io/pipelines/). Infrastructure and Infrastructure as Code is complex, and while we strive to make it as easy as possible for you, you will need time to understand the twists and turns of your infrastructure in order to tune it to fully suit your needs. -
-
\ No newline at end of file diff --git a/_docs-sources/landing-zone/index.md b/_docs-sources/landing-zone/index.md new file mode 100644 index 0000000000..5a3417fed9 --- /dev/null +++ b/_docs-sources/landing-zone/index.md @@ -0,0 +1 @@ +# Landing Zone diff --git a/_docs-sources/products.md b/_docs-sources/products.md new file mode 100644 index 0000000000..d85f296449 --- /dev/null +++ b/_docs-sources/products.md @@ -0,0 +1,54 @@ +--- +hide_table_of_contents: true +hide_title: true +--- + +import Card from "/src/components/Card" +import CardGroup from "/src/components/CardGroup" +import CenterLayout from "/src/components/CenterLayout" + + + +# Gruntwork Products + + + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + + + + diff --git a/_docs-sources/reference/services/intro/deploy-new-infrastructure.md b/_docs-sources/reference/services/intro/deploy-new-infrastructure.md index e879c37038..0bc46b3d21 100644 --- a/_docs-sources/reference/services/intro/deploy-new-infrastructure.md +++ b/_docs-sources/reference/services/intro/deploy-new-infrastructure.md @@ -118,7 +118,7 @@ deploy Terraform code from the Service Catalog. See 1. **GitHub Authentication**: All of Gruntwork's code lives in GitHub, and as most of the repos are private, you must authenticate to GitHub to be able to access the code. For Terraform, we recommend using Git / SSH URLs and using - SSH keys for authentication. See [Link Your GitHub ID](/intro/dev-portal/link-github-id) + SSH keys for authentication. See [Link Your GitHub ID](/developer-portal/link-github-id) for instructions on linking your GitHub ID and gaining access. 1. **Deploy**. You can now deploy the service as follows: @@ -258,7 +258,7 @@ Now you can create child `terragrunt.hcl` files to deploy services as follows: 1. **GitHub Authentication**: All of Gruntwork's code lives in GitHub, and as most of the repos are private, you must authenticate to GitHub to be able to access the code. For Terraform, we recommend using Git / SSH URLs and using SSH keys for authentication. See [How to get access to the Gruntwork Infrastructure as Code - Library](/intro/dev-portal/create-account) + Library](/developer-portal/create-account) for instructions on setting up your SSH key. 1. **Deploy**. You can now deploy the service as follows: @@ -321,7 +321,7 @@ Below are instructions on how to build an AMI using these Packer templates. We'l ``` See [How to get access to the Gruntwork Infrastructure as Code - Library](/intro/dev-portal/create-account) + Library](/developer-portal/create-account) for instructions on setting up GitHub personal access token. 1. **Set variables**. Each Packer template defines variables you can set in a `variables` block at the top, such as diff --git a/_docs-sources/intro/dev-portal/_category_.json b/docs/developer-portal/_category_.json similarity index 100% rename from _docs-sources/intro/dev-portal/_category_.json rename to docs/developer-portal/_category_.json diff --git a/docs/intro/dev-portal/create-account.md b/docs/developer-portal/create-account.md similarity index 100% rename from docs/intro/dev-portal/create-account.md rename to docs/developer-portal/create-account.md diff --git a/docs/intro/dev-portal/invite-team.md b/docs/developer-portal/invite-team.md similarity index 100% rename from docs/intro/dev-portal/invite-team.md rename to docs/developer-portal/invite-team.md diff --git a/docs/intro/dev-portal/link-github-id.md b/docs/developer-portal/link-github-id.md similarity index 100% rename from docs/intro/dev-portal/link-github-id.md rename to docs/developer-portal/link-github-id.md diff --git a/docs/guides/working-with-code/using-modules.md b/docs/guides/working-with-code/using-modules.md index e88b9f41ea..fd2409712f 100644 --- a/docs/guides/working-with-code/using-modules.md +++ b/docs/guides/working-with-code/using-modules.md @@ -162,7 +162,7 @@ This code pulls in a module using Terraform’s native `module` functionality. F The `source` URL in the code above uses a Git URL with SSH authentication (see [module sources](https://www.terraform.io/docs/modules/sources.html) for all the types of `source` URLs you can use). -If you followed the [SSH key instructions](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent) when [linking your GitHub ID](/intro/dev-portal/link-github-id.md), this will allow you to access private repos in the Gruntwork +If you followed the [SSH key instructions](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent) when [linking your GitHub ID](/developer-portal/link-github-id.md), this will allow you to access private repos in the Gruntwork Infrastructure as Code Library without having to hard-code a password in your Terraform code. #### Versioned URL @@ -770,6 +770,6 @@ Now that you have your Terraform module deployed, you can pull in updates as fol diff --git a/docs/intro/first-deployment/using-terraform-modules.md b/docs/intro/first-deployment/using-terraform-modules.md index 95cb4bf943..ba2e2416d8 100644 --- a/docs/intro/first-deployment/using-terraform-modules.md +++ b/docs/intro/first-deployment/using-terraform-modules.md @@ -113,7 +113,7 @@ of the code. You’ll see an example of this soon. The code above will ONLY allow you to run it with a specific Terraform version. This is a safety measure to ensure you don’t accidentally pick up a new version of Terraform until you’re ready. This is important because once you’ve upgraded to a newer version, Terraform will no longer allow you to deploy that code with any older version. -For example, if a single person on your team upgrades to `1.1.8` and runs `apply`, then you’ll no longer be able to +For example, if a single person on your team upgrades to `1.1.8` and runs `apply`, then you’ll no longer be able to use the state file with `1.1.7`, and you’ll be forced to upgrade everyone on your team and all your CI servers to `1.1.8`. It’s best to do this explicitly, rather than accidentally, so we recommend pinning Terraform versions. @@ -148,7 +148,7 @@ This code pulls in a module using Terraform’s native `module` functionality. F The `source` URL in the code above uses a Git URL with SSH authentication (see [module sources](https://www.terraform.io/docs/modules/sources.html) for all the types of `source` URLs you can use). -If you have established your account and linked your GitHub ID according to the instruction in [Accessing the Dev Portal](/intro/dev-portal/create-account), this will allow you to access private repos in the Gruntwork +If you have established your account and linked your GitHub ID according to the instruction in [Accessing the Dev Portal](/developer-portal/create-account), this will allow you to access private repos in the Gruntwork Infrastructure as Code Library without having to hard-code a password in your Terraform code. #### Versioned URL @@ -240,6 +240,6 @@ output "private_persistence_subnet_ids" { diff --git a/docs/intro/overview/getting-started.mdx b/docs/intro/overview/getting-started.mdx index d92133cbe9..bc3f55cd01 100644 --- a/docs/intro/overview/getting-started.mdx +++ b/docs/intro/overview/getting-started.mdx @@ -7,22 +7,16 @@ In this introductory guide we’ll cover the fundamentals you'll need in order t Create an account with our Developer Portal to access the IaC Library and training courses. - + Prepare your local development environment for efficiently working with the industry standard DevOps tools. - + Learn how to leverage these tools with Gruntwork products to realize your infrastructure needs. @@ -32,6 +26,6 @@ In this introductory guide we’ll cover the fundamentals you'll need in order t diff --git a/docs/intro/overview/how-it-works.md b/docs/intro/overview/how-it-works.md index c4e0b80a25..de6634337c 100644 --- a/docs/intro/overview/how-it-works.md +++ b/docs/intro/overview/how-it-works.md @@ -34,6 +34,12 @@ Gruntwork offers basic and paid support options: - **[Community support](/support#get-support).** Get help via a [Gruntwork Community Slack](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) and our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions). - **[Paid support](/support#paid-support-tiers).** Get help via email, a private Slack channel, or scheduled Zoom calls, with response times backed by SLAs. +## Gruntwork’s Limitations + +Gruntwork focuses on helping you launch and maintain your infrastructure as code. Understanding and using the AWS services that our code provisioned is up to you. Since Gruntwork is an accelerator for your AWS infrastructure and not an abstraction layer in front of AWS, knowledge of AWS and the services you intend to use is required. + +If you purchased our Reference Architecture: During the process of setting up the AWS accounts our tooling will automatically submit quota increase requests to AWS as a support ticket. These AWS quota increases are required to install the components of the Reference Architecture. Often, AWS will approve these requests quickly. Sometimes these support tickets will take some time for AWS to resolve. Unfortunately, some of these requests may be denied by AWS’s support team. Gruntwork can work with you to get these requests approved, but this can take some time, and that time is mostly out of our control. + ## What you provide Gruntwork products and services can help you quickly achieve world-class infrastructure. However, we aren’t a consulting company. To succeed, you (or your trusted DevOps consultant/contractor) must commit to learning how to leverage our products for your use cases, making any additional customizations, and deploying or migrating your apps and services. @@ -50,6 +56,6 @@ Gruntwork products strike a balance between opinionatedness and configurability. diff --git a/docs/intro/overview/prerequisites.md b/docs/intro/overview/prerequisites.md new file mode 100644 index 0000000000..c0e28c18ac --- /dev/null +++ b/docs/intro/overview/prerequisites.md @@ -0,0 +1,42 @@ +# What do I need to know + +Gruntwork accelerates your infrastructure. Our products allow you to treat your infrastructure like you do your application: as code, complete with pull requests and peer reviews. Our products may require a variety of skills to maintain and customize to your needs over time. + +Here's what your team will need so you can succeed with Gruntwork: + +## Terraform + +Our modules are all built using [Terraform](https://www.terraform.io/). You should be comfortable using Terraform for Infrastructure as Code. + +## Terragrunt + +If you purchase the Reference Architecture, it is delivered in [Terragrunt](https://terragrunt.gruntwork.io/), our open source wrapper around Terraform which allows you to + +1. Separate your monolithic terraform state files into smaller ones to speed up your plans and applies +2. Keep your infrastructure code DRY + +See [How to Manage Multiple Environments with Terraform](https://blog.gruntwork.io/how-to-manage-multiple-environments-with-terraform-32c7bc5d692) and our [Terragrunt Quick start](https://terragrunt.gruntwork.io/docs/getting-started/quick-start/) documentation for more details. + +## Git and GitHub + +Our code is stored in Git repositories in GitHub. You must have a working knowledge of Git via SSH (`add`, `commit`, `pull`, branches, et cetera) and GitHub (Pull requests, issues, et cetera) in order to interface with the Reference Architecture and our code library. + +## AWS + +To be successful with the infrastructure provisioned by us, you must have a decent working knowledge of AWS, its permissions schemes ([IAM](https://aws.amazon.com/iam/)), services, and APIs. While having AWS certification is not required, it is certainly helpful. Since Gruntwork is an accelerator for your AWS infrastructure and not an abstraction layer in front of AWS, knowledge of AWS and the services you intend to use is required. + +## Containerization tools like Docker and Packer + +We create Docker containers throughout our code library, and use them heavily in our [Gruntwork Pipelines](https://gruntwork.io/pipelines/) product, an important piece of the Reference Architecture. Containerization is an important part of helping many companies scale in the cloud, and we’re no exception. Familiarity with creating docker images and pushing and pulling them from repositories is required. Likewise, we use Packer to build AMIs. Understanding Packer will enable you to build your own AMIs for your own infrastructure and make modifications to the infrastructure we provision for you. + +## Time to learn + +With Gruntwork, you can accelerate your journey towards capturing your AWS cloud infrastructure as Infrastructure as Code. Although our aim is to simplify this intricate process, gaining a comprehensive understanding of your infrastructure's complexities and tailoring it to your specific needs will require a significant investment of time and effort on your part. + + + diff --git a/docs/intro/overview/reference-architecture-prerequisites-guide.md b/docs/intro/overview/reference-architecture-prerequisites-guide.md deleted file mode 100644 index 59d888d471..0000000000 --- a/docs/intro/overview/reference-architecture-prerequisites-guide.md +++ /dev/null @@ -1,92 +0,0 @@ -# Reference Architecture Prerequisites Guide - -Gruntwork accelerates your infrastructure with our [Reference Architecture](https://gruntwork.io/reference-architecture/). This framework allows you to treat your infrastructure like you do your application: as code, complete with pull requests and peer reviews. The Reference Architecture requires a variety of skills to maintain it and customize it to your needs over time. - -Here's what your team will need so you can succeed with the Gruntwork Reference Architecture: - -
- - Knowledge of Terraform -
- -Our modules are all built using [Terraform](https://www.terraform.io/), and the Reference Architecture uses our modules to build out your infrastructure. You should be comfortable using Terraform for Infrastructure as Code. -
-
- -
- Knowledge of Terragrunt or willingness to learn -
- -The Reference Architecture is delivered in [Terragrunt](https://terragrunt.gruntwork.io/), our open source wrapper around Terraform which allows you to - -1. Separate your monolithic terraform state files into smaller ones to speed up your plans and applies -2. Keep your infrastructure code DRY - -See [How to Manage Multiple Environments with Terraform](https://blog.gruntwork.io/how-to-manage-multiple-environments-with-terraform-32c7bc5d692) and our [Terragrunt Quick start](https://terragrunt.gruntwork.io/docs/getting-started/quick-start/) documentation for more details. -
-
- -
- Knowledge of git and GitHub -
- -Our Reference Architecture and the modules that it consumes are all stored in Git repositories in GitHub. You must have a working knowledge of Git via SSH (`add`, `commit`, `pull`, branches, et cetera) and GitHub (Pull requests, issues, et cetera) in order to interface with the Reference Architecture and our code library. -
-
- -
- Knowledge of AWS and its services -
- -The Reference Architecture is provisioned in [AWS](https://aws.amazon.com/). To be successful with the infrastructure provisioned by us, you must have a decent working knowledge of AWS, its permissions schemes ([IAM](https://aws.amazon.com/iam/)), services, and APIs. While having AWS certification is not required, it is certainly helpful. Since Gruntwork is an accelerator for your AWS infrastructure and not an abstraction layer in front of AWS, knowledge of AWS and the services you intend to use is required. -
-
- -
- Knowledge of Gruntwork’s Limitations -
- -During the process of setting up the AWS accounts for your reference architecture, our tooling will automatically submit quota increase requests to AWS as a support ticket. These AWS quota increases are required to install the components of the Reference Architecture. Often, AWS will approve these requests quickly. Sometimes these support tickets will take some time for AWS to resolve. Unfortunately, some of these requests may be denied by AWS’s support team. Gruntwork can work with you to get these requests approved, but this can take some time, and that time is mostly out of our control. - -Gruntwork focuses on helping you launch and maintain your infrastructure as code. Understanding and using the AWS services that our code provisioned is up to you. Since Gruntwork is an accelerator for your AWS infrastructure and not an abstraction layer in front of AWS, knowledge of AWS and the services you intend to use is required. -
-
- -
- Knowledge of Go, Shell, and Python -
- -Some of the modules we have leverage Go, Shell scripting and Python. To customize these to suit your needs, you may need to dive in and make changes. In addition, all of our automated testing is written in Go, so familiarity with Go is highly recommended. -
-
- -
- Knowledge of containerization tools like Docker and Packer -
- -We create Docker containers throughout our code library, and use them heavily in our [Gruntwork Pipelines](https://gruntwork.io/pipelines/) product, an important piece of the Reference Architecture. Containerization is an important part of helping many companies scale in the cloud, and we’re no exception. Familiarity with creating docker images and pushing and pulling them from repositories is required. Likewise, we use Packer to build AMIs. Understanding Packer will enable you to build your own AMIs for your own infrastructure and make modifications to the infrastructure we provision for you. -
-
- -
- Brand new AWS accounts -
- -With our Gruntwork Wizard, we help you create new AWS accounts, which we’ll then use to build your Reference Architecture. All accounts must be completely empty. At this time we do not support “brown field” deployments of the Reference Architecture. -
-
- -
- Time to learn -
- -Gruntwork accelerates you down the road towards having your entire AWS cloud infrastructure captured as Infrastructure as Code. The Reference Architecture will set you up with a solid foundation with our [Landing Zone](https://gruntwork.io/landing-zone-for-aws/) and help you regularly modify your infrastructure with [Gruntwork Pipelines](https://gruntwork.io/pipelines/). Infrastructure and Infrastructure as Code is complex, and while we strive to make it as easy as possible for you, you will need time to understand the twists and turns of your infrastructure in order to tune it to fully suit your needs. -
-
- - diff --git a/docs/landing-zone/index.md b/docs/landing-zone/index.md new file mode 100644 index 0000000000..0e97ca3283 --- /dev/null +++ b/docs/landing-zone/index.md @@ -0,0 +1,9 @@ +# Landing Zone + + + diff --git a/docs/products.md b/docs/products.md new file mode 100644 index 0000000000..785a6c0a34 --- /dev/null +++ b/docs/products.md @@ -0,0 +1,62 @@ +--- +hide_table_of_contents: true +hide_title: true +--- + +import Card from "/src/components/Card" +import CardGroup from "/src/components/CardGroup" +import CenterLayout from "/src/components/CenterLayout" + + + +# Gruntwork Products + + + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + + + + + + + diff --git a/docs/reference/services/intro/deploy-new-infrastructure.md b/docs/reference/services/intro/deploy-new-infrastructure.md index a146d3cb5a..58ea673610 100644 --- a/docs/reference/services/intro/deploy-new-infrastructure.md +++ b/docs/reference/services/intro/deploy-new-infrastructure.md @@ -118,7 +118,7 @@ deploy Terraform code from the Service Catalog. See 1. **GitHub Authentication**: All of Gruntwork's code lives in GitHub, and as most of the repos are private, you must authenticate to GitHub to be able to access the code. For Terraform, we recommend using Git / SSH URLs and using - SSH keys for authentication. See [Link Your GitHub ID](/intro/dev-portal/link-github-id) + SSH keys for authentication. See [Link Your GitHub ID](/developer-portal/link-github-id) for instructions on linking your GitHub ID and gaining access. 1. **Deploy**. You can now deploy the service as follows: @@ -258,7 +258,7 @@ Now you can create child `terragrunt.hcl` files to deploy services as follows: 1. **GitHub Authentication**: All of Gruntwork's code lives in GitHub, and as most of the repos are private, you must authenticate to GitHub to be able to access the code. For Terraform, we recommend using Git / SSH URLs and using SSH keys for authentication. See [How to get access to the Gruntwork Infrastructure as Code - Library](/intro/dev-portal/create-account) + Library](/developer-portal/create-account) for instructions on setting up your SSH key. 1. **Deploy**. You can now deploy the service as follows: @@ -321,7 +321,7 @@ Below are instructions on how to build an AMI using these Packer templates. We'l ``` See [How to get access to the Gruntwork Infrastructure as Code - Library](/intro/dev-portal/create-account) + Library](/developer-portal/create-account) for instructions on setting up GitHub personal access token. 1. **Set variables**. Each Packer template defines variables you can set in a `variables` block at the top, such as @@ -398,6 +398,6 @@ most commonly used filters will be: diff --git a/docusaurus.config.js b/docusaurus.config.js index c3f5fb6cf9..a9890eb9e9 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -93,33 +93,48 @@ const config = { label: "Intro", docId: "intro/overview/intro-to-gruntwork", }, + { + type: "doc", + position: "left", + label: "Products", + docId: "products", + }, { type: "dropdown", position: "left", label: "Docs", - docId: "iac/whats-this/index", items: [ { type: "doc", label: "Infrastructure as Code Library", - docId: "iac/whats-this/index" + docId: "iac/whats-this/index", }, { type: "doc", label: "Gruntwork Pipelines", - docId: "pipelines/index" + docId: "pipelines/index", + }, + { + type: "doc", + label: "Landing Zone", + docId: "landing-zone/index", }, { type: "doc", label: "Reference Architecture", - docId: "refarch/index" + docId: "refarch/index", }, { type: "doc", label: "Patcher", - docId: "patcher/index" + docId: "patcher/index", + }, + { + type: "doc", + label: "Developer Portal", + docId: "developer-portal/create-account", }, - ] + ], }, { to: "/tools", label: "Tools", position: "left" }, { to: "/courses", label: "Courses", position: "left" }, diff --git a/package.json b/package.json index 4512314a54..a19fd0e968 100644 --- a/package.json +++ b/package.json @@ -7,7 +7,7 @@ }, "scripts": { "docusaurus": "docusaurus", - "start": "docusaurus start --port 3001 & onchange -i '_docs-sources/**/*(*.md|*.mdx|*.json)' -- yarn regenerate:local", + "start": "docusaurus start --port 3000 & onchange -i '_docs-sources/**/*(*.md|*.mdx|*.json)' -- yarn regenerate:local", "build": "docusaurus build", "swizzle": "docusaurus swizzle", "deploy": "docusaurus deploy", diff --git a/sidebars.js b/sidebars.js index 8e3f9504a0..e11c7e7968 100644 --- a/sidebars.js +++ b/sidebars.js @@ -22,6 +22,7 @@ const updateGuideSidebars = require("./sidebars/update-guides.js") const apiSidebars = require("./sidebars/api-reference.js") const faqSidebars = require("./sidebars/faq.js") const iacSiderbars = require("./sidebars/iac.js") +const developerPortalSidebars = require("./sidebars/developer-portal.js") // @ts-check @@ -40,6 +41,7 @@ const sidebars = { ...apiSidebars, faqSidebars, iacSiderbars, + developerPortalSidebars, } module.exports = sidebars diff --git a/sidebars/developer-portal.js b/sidebars/developer-portal.js new file mode 100644 index 0000000000..b56b6a1120 --- /dev/null +++ b/sidebars/developer-portal.js @@ -0,0 +1,14 @@ +const sidebar = [ + { + label: "Developer Portal", + type: "category", + collapsible: false, + items: [ + "developer-portal/create-account", + "developer-portal/invite-team", + "developer-portal/link-github-id", + ], + }, +] + +module.exports = sidebar diff --git a/sidebars/intro-guide.js b/sidebars/intro-guide.js index a368b66eec..b3f596326b 100644 --- a/sidebars/intro-guide.js +++ b/sidebars/intro-guide.js @@ -1,10 +1,9 @@ const sidebar = [ { - Overview: [ + "What is all this": [ "intro/overview/intro-to-gruntwork", "intro/overview/how-it-works", - "intro/overview/reference-architecture-prerequisites-guide", - "intro/overview/shared-responsibility-model", + "intro/overview/prerequisites", // Temporarily hiding the unfinished sections from the sidebar We'll put // them back shortly and don't want to delete the pages as we know we're // going to have these sections within a few days. @@ -14,44 +13,6 @@ const sidebar = [ "intro/overview/getting-started", ], }, - { - "Core Concepts": [ - "intro/core-concepts/production-framework", - "intro/core-concepts/infrastructure-as-code", - "intro/core-concepts/immutable-infrastructure", - ], - }, - { - "Accessing the Dev Portal": [ - "intro/dev-portal/create-account", - "intro/dev-portal/invite-team", - "intro/dev-portal/link-github-id", - ], - }, - { - "Setting Up Your Environment": [ - "intro/environment-setup/recommended_tools", - ], - }, - { - "Tool Fundamentals": [ - "intro/tool-fundamentals/docker", - "intro/tool-fundamentals/packer", - "intro/tool-fundamentals/terraform", - "intro/tool-fundamentals/terragrunt", - ], - }, - { - "Deploy Your First Module": [ - "intro/first-deployment/using-terraform-modules", - "intro/first-deployment/testing", - "intro/first-deployment/deploy", - ], - }, - { - type: "doc", - id: "intro/next-steps", - }, ] module.exports = sidebar From 992ee43f69b05729f667267135d0c50b077da5f3 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Thu, 4 May 2023 14:11:04 -0700 Subject: [PATCH 08/89] add label for IaC docs --- sidebars/iac.js | 182 +++++++++++++++++++++++++----------------------- 1 file changed, 96 insertions(+), 86 deletions(-) diff --git a/sidebars/iac.js b/sidebars/iac.js index f8363d7709..fe378efe11 100644 --- a/sidebars/iac.js +++ b/sidebars/iac.js @@ -1,107 +1,117 @@ const sidebar = [ - { - "label": "What is all this?", - "type": "category", - "link": { - "type": "doc", - "id": "iac/whats-this/index" + { + label: "Infrastructre as Code", + type: "category", + collapsible: false, + items: [ + { + label: "What is all this?", + type: "category", + link: { + type: "doc", + id: "iac/whats-this/index", }, - "items": [ - "iac/whats-this/modules", - "iac/whats-this/services", - ] - }, - { - "label": "Getting Started", - "type": "category", - "link": { - "type": "doc", - "id": "iac/getting-started/index" + items: ["iac/whats-this/modules", "iac/whats-this/services"], + }, + { + label: "Getting Started", + type: "category", + link: { + type: "doc", + id: "iac/getting-started/index", }, - "items": [ - "iac/getting-started/setting-up", - "iac/getting-started/accessing-the-code", - ] - }, - { - "label": "Usage", - "type": "category", - "link": { - "type": "doc", - "id": "iac/usage/index" + items: [ + "iac/getting-started/setting-up", + "iac/getting-started/accessing-the-code", + ], + }, + { + label: "Usage", + type: "category", + link: { + type: "doc", + id: "iac/usage/index", }, - "items": [ - "iac/usage/using-a-module", - "iac/usage/using-a-service", - "iac/usage/composing-your-own-service", - "iac/usage/customizing-modules", - ] - }, - { - "label": "Library Reference", - "type": "category", - "link": { - "type": "doc", - "id": "reference/intro" + items: [ + "iac/usage/using-a-module", + "iac/usage/using-a-service", + "iac/usage/composing-your-own-service", + "iac/usage/customizing-modules", + ], + }, + { + label: "Library Reference", + type: "category", + link: { + type: "doc", + id: "reference/intro", }, - "items": [ - { - type: "category", - collapsible: true, - label: "Module Catalog", - items: [{ type: "autogenerated", dirName: "reference/modules" }], - }, - { - type: "category", - collapsible: true, - label: "Service Catalog", - items: [ + items: [ + { + type: "category", + collapsible: true, + label: "Module Catalog", + items: [{ type: "autogenerated", dirName: "reference/modules" }], + }, + { + type: "category", + collapsible: true, + label: "Service Catalog", + items: [ + { + "App Orchestration": [ { - "App Orchestration": [ - { - type: "autogenerated", - dirName: "reference/services/app-orchestration", - }, - ], + type: "autogenerated", + dirName: "reference/services/app-orchestration", }, + ], + }, + { + "CI/CD Pipeline": [ { - "CI/CD Pipeline": [ - { - type: "autogenerated", - dirName: "reference/services/ci-cd-pipeline", - }, - ], + type: "autogenerated", + dirName: "reference/services/ci-cd-pipeline", }, + ], + }, + { + "Data Storage": [ { - "Data Storage": [ - { - type: "autogenerated", - dirName: "reference/services/data-storage", - }, - ], + type: "autogenerated", + dirName: "reference/services/data-storage", }, + ], + }, + { + "Landing Zone": [ { - "Landing Zone": [ - { - type: "autogenerated", - dirName: "reference/services/landing-zone", - }, - ], + type: "autogenerated", + dirName: "reference/services/landing-zone", }, + ], + }, + { + Networking: [ { - Networking: [ - { type: "autogenerated", dirName: "reference/services/networking" }, - ], + type: "autogenerated", + dirName: "reference/services/networking", }, + ], + }, + { + Security: [ { - Security: [ - { type: "autogenerated", dirName: "reference/services/security" }, - ], + type: "autogenerated", + dirName: "reference/services/security", }, ], - }, - ] - } + }, + ], + }, + ], + }, + ], + }, ] module.exports = sidebar From 7f72b069fdedb76246e91c418c5c9f47486bd3e5 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Fri, 5 May 2023 07:27:34 -0700 Subject: [PATCH 09/89] add sidebars for placeholder product docs --- sidebars.js | 6 ++++++ sidebars/landing-zone.js | 16 ++++++++++++++++ sidebars/patcher.js | 16 ++++++++++++++++ sidebars/pipelines.js | 16 ++++++++++++++++ 4 files changed, 54 insertions(+) create mode 100644 sidebars/landing-zone.js create mode 100644 sidebars/patcher.js create mode 100644 sidebars/pipelines.js diff --git a/sidebars.js b/sidebars.js index e11c7e7968..07d2972482 100644 --- a/sidebars.js +++ b/sidebars.js @@ -23,6 +23,9 @@ const apiSidebars = require("./sidebars/api-reference.js") const faqSidebars = require("./sidebars/faq.js") const iacSiderbars = require("./sidebars/iac.js") const developerPortalSidebars = require("./sidebars/developer-portal.js") +const patcherSiderbars = require("./sidebars/patcher.js") +const pipelinesSiderbars = require("./sidebars/pipelines.js") +const landingZoneSidebars = require("./sidebars/landing-zone.js") // @ts-check @@ -42,6 +45,9 @@ const sidebars = { faqSidebars, iacSiderbars, developerPortalSidebars, + patcherSiderbars, + pipelinesSiderbars, + landingZoneSidebars, } module.exports = sidebars diff --git a/sidebars/landing-zone.js b/sidebars/landing-zone.js new file mode 100644 index 0000000000..d76b1a6614 --- /dev/null +++ b/sidebars/landing-zone.js @@ -0,0 +1,16 @@ +const sidebar = [ + { + label: "Landing Zones", + type: "category", + collapsible: false, + items: [ + { + label: "Getting Started", + type: "doc", + id: "landing-zone/index", + } + ] + } +] + +module.exports = sidebar diff --git a/sidebars/patcher.js b/sidebars/patcher.js new file mode 100644 index 0000000000..8b11ad203c --- /dev/null +++ b/sidebars/patcher.js @@ -0,0 +1,16 @@ +const sidebar = [ + { + label: "Patcher", + type: "category", + collapsible: false, + items: [ + { + label: "Getting Started", + type: "doc", + id: "patcher/index", + } + ] + } +] + +module.exports = sidebar diff --git a/sidebars/pipelines.js b/sidebars/pipelines.js new file mode 100644 index 0000000000..43240590f9 --- /dev/null +++ b/sidebars/pipelines.js @@ -0,0 +1,16 @@ +const sidebar = [ + { + label: "Gruntwork Pipelines", + type: "category", + collapsible: false, + items: [ + { + label: "Getting Started", + type: "doc", + id: "pipelines/index", + } + ] + } +] + +module.exports = sidebar From ef733e624f81f13f863dbad3bd739e12647fd9b3 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Fri, 5 May 2023 10:41:34 -0700 Subject: [PATCH 10/89] fix typo --- sidebars/iac.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sidebars/iac.js b/sidebars/iac.js index fe378efe11..ab329d1694 100644 --- a/sidebars/iac.js +++ b/sidebars/iac.js @@ -1,6 +1,6 @@ const sidebar = [ { - label: "Infrastructre as Code", + label: "Infrastructure as Code", type: "category", collapsible: false, items: [ From 247ad923d8fdae414741ea1bcd5d35f127cfa72d Mon Sep 17 00:00:00 2001 From: Andrew Ellison Date: Fri, 5 May 2023 13:43:13 -0500 Subject: [PATCH 11/89] Add pipelines scaffolding --- docs/pipelines/how-it-works/index.md | 26 ++++++++++++++ docs/pipelines/maintain/extending.md | 7 ++++ docs/pipelines/maintain/updating.md | 6 ++++ docs/pipelines/multi-account/index.md | 13 +++++++ docs/pipelines/tutorial/index.md | 19 +++++++++++ docs/pipelines/what-is-it/index.md | 8 +++++ docusaurus.config.js | 2 +- sidebars/pipelines.js | 32 ++++++++++++++++-- .../img/pipelines-docker-packer-builder.png | Bin 0 -> 96838 bytes 9 files changed, 109 insertions(+), 4 deletions(-) create mode 100644 docs/pipelines/how-it-works/index.md create mode 100644 docs/pipelines/maintain/extending.md create mode 100644 docs/pipelines/maintain/updating.md create mode 100644 docs/pipelines/multi-account/index.md create mode 100644 docs/pipelines/tutorial/index.md create mode 100644 docs/pipelines/what-is-it/index.md create mode 100644 static/img/pipelines-docker-packer-builder.png diff --git a/docs/pipelines/how-it-works/index.md b/docs/pipelines/how-it-works/index.md new file mode 100644 index 0000000000..52ed97a4e5 --- /dev/null +++ b/docs/pipelines/how-it-works/index.md @@ -0,0 +1,26 @@ +# How it works + +In order to maximize our synergistic value proposition, we need to leverage our core competencies in order to achieve our strategic objectives. We need to think outside the box and come up with innovative solutions that will allow us to disrupt the market and gain a competitive advantage. We also need to focus on our customer experience and provide them with a seamless and personalized journey. + +## Block Diagram + +![CIS Benchmark Architecture](/img/pipelines-docker-packer-builder.png) + +## External CI Tool + +We need to be agile and adaptable in order to respond to the ever-changing business landscape. We need to be able to quickly pivot and change course when necessary. We also need to be able to collaborate effectively with our partners and stakeholders in order to achieve our goals. + +## Invoker Lambda + +Oh my goodness, have I told you about the time I saw a beautiful Blue Jay perched on my windowsill? It was truly a sight to behold! But I digress... let me tell you about AWS Lambda functions, which are like the busy little hummingbirds of the cloud computing world. + +Picture this: a Lambda function is like a bird feeder that sits and waits for requests to come in, just like a bird feeder waits for feathered friends to come and snack. But instead of seed, it's programmed to receive code and execute it. + +## ECS Deploy Runner + +### Standard Configuration + +### Docker Image Builder (Kaniko) + +### Terraform Planner/Applier + diff --git a/docs/pipelines/maintain/extending.md b/docs/pipelines/maintain/extending.md new file mode 100644 index 0000000000..ac12f43773 --- /dev/null +++ b/docs/pipelines/maintain/extending.md @@ -0,0 +1,7 @@ +# Extending your Pipeline + +Ug ug. Me type. You read. Me make words for big brain. Me use stick on rock. Me try hard. You see? + +Me have idea. Me tell you story. Long time ago, big mammoth roam land. Caveman hunt mammoth. Caveman win. Caveman happy. + +Me tired now. Me rest. You like words? Me make more later. Ug ug. diff --git a/docs/pipelines/maintain/updating.md b/docs/pipelines/maintain/updating.md new file mode 100644 index 0000000000..23837c7ac3 --- /dev/null +++ b/docs/pipelines/maintain/updating.md @@ -0,0 +1,6 @@ +# Updating Your Pipeline +Is there anything more frustrating than having to put up with those obnoxious notifications and the seemingly never-ending cycle of downloads, installs, and reboots? Every time you think you've finally managed to get your computer to run smoothly, those darn updates come along and mess everything up again. + +And let's not forget how unpredictable they can be! One minute you're casually browsing the internet, and the next minute your computer is stuck in an update loop, wasting your time and energy. And don't even try to cancel or pause an update once it's started - that's a recipe for disaster. + +And the worst part? Even when the updates are finally finished, there's no guarantee that everything will work as it should. You could end up with new bugs, glitches, or compatibility issues that you never had before. diff --git a/docs/pipelines/multi-account/index.md b/docs/pipelines/multi-account/index.md new file mode 100644 index 0000000000..a9625729f9 --- /dev/null +++ b/docs/pipelines/multi-account/index.md @@ -0,0 +1,13 @@ +# Deploying Multi-Account Pipelines + +Have you heard about AWS multi-account setups? It's like having a pack of dogs - each one with its own unique personality, strengths, and weaknesses, but all working together to accomplish a common goal. + +Imagine you have a pack of dogs, each with their own special skills. You've got a fierce protector who guards the house, a speedy runner who chases down anything that moves, and a snuggly lap dog who just wants to cuddle all day. Each dog has its own needs, but they all rely on you as their owner to provide for them and keep them safe. + +Similarly, with AWS multi-account setups, you can have a whole pack of accounts, each with its own unique configuration and requirements, but all managed from a single "parent" account. It's like being the alpha dog of a pack, making sure each member is fed, healthy, and happy. + +And just like with a pack of dogs, there are different roles and responsibilities within an AWS multi-account setup. You've got the "owner" account, which is responsible for managing all the other accounts in the pack, and then you've got the "member" accounts, each with their own specific purposes and functions. + +It's important to keep all your accounts organized and working together smoothly, just like how you would keep your pack of dogs in line. You don't want one dog to get too aggressive and start fighting with the others, just like you don't want one AWS account to start interfering with the others. + +But if you can manage your pack of dogs successfully, they can work together to accomplish great things - just like how an AWS multi-account setup can help you achieve your goals with ease and efficiency. So, if you're a dog lover like me, you'll find that AWS multi-account setups are just as fun and rewarding as having a pack of loyal furry friends by your side. Woof! diff --git a/docs/pipelines/tutorial/index.md b/docs/pipelines/tutorial/index.md new file mode 100644 index 0000000000..61f5ca168c --- /dev/null +++ b/docs/pipelines/tutorial/index.md @@ -0,0 +1,19 @@ +# Tutorial + +Step 1: Setting up your code repository +First, you need to create a repository for your code. Just like how cats need a cozy bed to sleep in, your code needs a cozy home too. You can use GitHub, GitLab or Bitbucket to host your code. Choose whichever platform suits you best. Meow-ver, remember to give your repository a pawsome name, something like "Feline-Friendly-CI-CD-Pipeline" would be perfect. + +Step 2: Choose your CI/CD tool +Just like how cats have different personalities, there are many different CI/CD tools to choose from. Some popular options are Jenkins, Travis CI, CircleCI, and GitLab CI/CD. Research each tool to find the one that suits your needs best. + +Step 3: Create a pipeline script +The pipeline script is like a recipe for your CI/CD pipeline. You can use a scripting language like Groovy or YAML to write the script. Make sure to include steps for building, testing, and deploying your code. Also, don't forget to add some cat puns to the script to keep it meow-nteresting. For example, you could add a step to "check if the code is purr-fect" or "run a meow-ssive amount of tests". + +Step 4: Test your pipeline locally +Before you deploy your pipeline, you should test it locally to make sure it works as intended. This is like when cats scratch their scratching post to make sure it's sturdy enough for their needs. Use the CI/CD tool you chose to run the pipeline script locally. + +Step 5: Deploy your pipeline +Now it's time to deploy your pipeline to your code repository. This is like when a cat finds a new hiding spot and decides to make it their own. Meow-ver, don't forget to configure your CI/CD tool to trigger the pipeline whenever changes are made to the code repository. + +Step 6: Monitor and improve your pipeline +Just like how you need to monitor your cat's health to make sure they're happy and healthy, you need to monitor your pipeline to make sure it's working properly. Keep an eye on the pipeline's logs and metrics to make sure everything is running smoothly. If you notice any issues, make improvements to your pipeline script to fix them. diff --git a/docs/pipelines/what-is-it/index.md b/docs/pipelines/what-is-it/index.md new file mode 100644 index 0000000000..270b11f1c0 --- /dev/null +++ b/docs/pipelines/what-is-it/index.md @@ -0,0 +1,8 @@ +# Overview + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. At lectus urna duis convallis convallis tellus id interdum velit. Pretium vulputate sapien nec sagittis aliquam. Tristique senectus et netus et. Nullam eget felis eget nunc lobortis mattis aliquam faucibus purus. Aliquet sagittis id consectetur purus ut. Lectus magna fringilla urna porttitor rhoncus dolor. Eget felis eget nunc lobortis mattis aliquam faucibus purus in. Erat nam at lectus urna duis convallis convallis. Euismod lacinia at quis risus sed vulputate odio. + +# Secure by Design + +This is a paragraph. It might not seem long enough, but it is. + diff --git a/docusaurus.config.js b/docusaurus.config.js index a9890eb9e9..1233d14d48 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -112,7 +112,7 @@ const config = { { type: "doc", label: "Gruntwork Pipelines", - docId: "pipelines/index", + docId: "pipelines/what-is-it/index", }, { type: "doc", diff --git a/sidebars/pipelines.js b/sidebars/pipelines.js index 43240590f9..1487e7646f 100644 --- a/sidebars/pipelines.js +++ b/sidebars/pipelines.js @@ -5,10 +5,36 @@ const sidebar = [ collapsible: false, items: [ { - label: "Getting Started", + label: "What is Gruntwork Pipelines?", type: "doc", - id: "pipelines/index", - } + id: "pipelines/what-is-it/index" + }, + { + label: "Learn Pipelines", + type: "category", + items: [ + { + label: "How it works", + type: "doc", + id: "pipelines/how-it-works/index", + }, + { + label: "Tutorial", + type: "doc", + id: "pipelines/tutorial/index", + }, + { + label: "Deploying Multi-Account Pipelines", + type: "doc", + id: "pipelines/multi-account/index", + }, + ] + }, + { + label: "Maintain Pipelines", + type: "category", + items: ["pipelines/maintain/updating", "pipelines/maintain/extending"], + }, ] } ] diff --git a/static/img/pipelines-docker-packer-builder.png b/static/img/pipelines-docker-packer-builder.png new file mode 100644 index 0000000000000000000000000000000000000000..6e50c1ed8eb9dcd92fb998c44b1a8b7339d34082 GIT binary patch literal 96838 zcmbTdRX|&9&@CLC3Qmi=7mB+jNO39dR-i~J?v_xBYjJmL(c&(}-Cc{jYY5~|-|svB zxj(sxZ5dg!X6Bi_ci2Z2S*(|&F984mmb{#_Iskxy_=?JeiGuhT4hM`}?V>na#~jTJr&MzxCte6U5FB zQ0VjXGdu1*utpp6Fmt_`#qE2w!`N%Cg8D{*|K+ieRFwr zb$WXC`1n}Rb#fELPp(mXcXxMlb9;V%es*?tadCl0Ek~Z+=e#p?LC8^UHrFq58i%=>gpRlJHI3%BJvK3_4pP! zzqA^kQ4o=snVp>jdxB%L=|(5#{7B2gW!2a_IFvS6`@6j>2<$P5S;pqEbI95o8yhE+ ziz4JUc|pLqxVVUmPjGZ}JUBQgEhVX_s3;lSTToE+>sM)NYPyDo1_cF$toe?wuWw{z zRApt==g*(j*kkqe^>=r7J3G5#f5ef0%wuL|UjMtjvA!M>5^8E{`jT4e{rmSkJdHdq zv$eH#+}zx~Jw4yPecRaDd2jtk*db5B?!?K-N&kBfi9(X9`z@D_znz^OKR-XCaeYEU zGMC+eYkVhWUS-lvS8>i#vQF?k&&=Y~~)_;ifjZar-oqY3aP=E>+YrbPT`Pg7>(V>c4~My$w*qVKw^MG_c-b zNA=DiLXruP)4V=f86K+<%cJvm~ z3$FnU&+jX_w8V{`IBK%#$n$cDtIw60>=p>-ly|f=r~R2aFQ2>}o4z5(1!N4Z8u1nu zo7;eYFQ}L8!jfFe8=Bbc# z)B;}eZHaeUg|s=E?@w~x9JcCop*c3eP4t^lwoOI8XJlDPdc+l~>etuT*;U>d82sbl z|H}*VM?5pbm-`iUk9gBV0|x0ccCoEuFx} zSNEfYkW3E}yKlE*mTVSV0aYvd7dfh1NvTMtVNc-|7+@y~qcjRY(u}w8r`-8)($AO> z2F+7f8F&tXHz8){RFi_@mcP1!$0z|nv5<7t;$d;Li`50KbBehz6~!cNviSkoRLHek zv;%vbUx@?|amI*siG@jfCxN8vD&d+4p3u_eb^)+e>94%!ubOwGB7_9ZzKn=bz8#?g zygJzHx}oo`-0CDpu5vt_bh2^z=33MD`Jgf1OcW4Nn31t+gjR~?aZ|2y)B&&Mi^MSf zaol(JrJ+wdK+Ev!k^h12E4MI!shVc~a(jf{$H525JsF1m7V9;}W@$hbrou)3V^ZOK z6T4Z|d<;KQ{g^9a=e4i3@x@egCRS?;#@Tf zX!B*V*}ShT;-9Ns?$Psv3Ubt)*7a+jH~!qyfRP_E-Wew$bzMiTeV_YIE?dI>3Hcx- zI{dtKQ+!~393v02kxA4Bd zo3Om^YenJID6G}8Uhosvr}L3f>d>a8z=AB2q#%wm5?<A-oI$+xCZI7}*^9$-9SdCd`bJl!yzypHY!J?Vh{+mj~hx~uw&$0POLeMpm4 z-Ka0w-+AnMsyS7K=obJD9qi>8ps>&Spt%1ObM4q8Q`48#3fTaFk{&DNwM}j2h2Bb! z*~0Q)(sf|Bkf6N~p3LIzJ&r@Bbz zcD6RVEfJ#)C{vS%i&w_z{GpiZpDWjYGay5(rbcG3nV%PYeU*pnrk~`6^{>n`tXdJ^ zX7wtQZj<5q!q00QZUnb0b{%oflAmGcVh&H|iTUWA-$^I6o+Wf1neJMkqy}j2Of&VT z^N~C8Pqa7xc_Htudjysp)!Iqwz#Heev$M`IvzCSXEX0|^zXbL6%ZT(BwsOtmBxR)+ zZe^C--&>4dpyb3J1%}nn8f8-|^FQyqR$n-65F^JLh-IFC1;ujG( zSO@;Z!~%U?>6aoZ`&5rO?PX*5*}Mutd#@hr?c2TQL6=z^4hm%e_pc(qlN-j>evfo8 z)%qRIxE|0(Fb`nyG2AMB`|?|=di8-Wmo zIeYAEuu^e5LWB(F)WOZw^7zE~nFZMUCf==|2+}p5(kO6w$!jBf*UhEO5ZC?FJ>jel zfedHo{Yp*WZYZl#u+hTK{EuH{|I4o%dtKqBo5_~s5-NY^0;GKn z)tH*6Dt^z**@cltqbE-vQ(^tuC&?QR0)$>L1M#OpvEk34kbFbs7~!*QLJ^;JuO_I` zzimcudLP!Xy%JPzO-^UU1;saoxxw&%DoOv_1kREF6wx;hl+WQsx@aE!A2 zAMe;s|52fms@-V?N!yUc{tc;nw#wW<*5p*B8y@^Y)|V?Cir_j#tA0`?9J@`Ci7Z7V zN%_9Mp?=PXZ0y&w-tb=xT|FHezi*R?qilcKx+_gh8X7vrs@rAc0j%!?Q_qoW>x7nH zZ4}(xnIn`e-TTK@W7ym6vz6b!4=lQa_FO)8uux!`&ho;Iy*}UI50xRJ|P z`MCwlY;KtvdZZ|eqDvBWeIaw5u|>5TJn;fiG8?b=XGTbBdQu2!p!@Y%S4?Fgx0iFQ zQdnTct?H@AEMNW0W9*WztCfpGOpg(|z=UY@ss&rKhK0`CzpGhchBW3+&)CQ0^+YxP zs)$q5{$F}d|1UkQosO7%#;71@ZhoAT_4P;7`Gb8_ne6UQf{xfoY&qV|ORSB1B^(IX z{!NH)DFWVXj!ztR!0CIl|1u1J?0ApZ@Y}HW?o0BE^}Mn-ei1Huhat&hjF2ET<;SIE z<>r{v`T_BF%U{{N8ESx6xrCMOal)_`k?oq`e<#;A8zSm(AB11Q@ za;qCTk(9bam(sVa@Sx_UyfA zOicbNp+G9|xp-`W#MS;|VbRP<5muj)RtGn^VzyODU1d=qr%rQsN>RPoQuX{4L#y_f z!|P*SOyD1<)_{rkj0CssV~rCO$3E*Ee9snT6>Rq0N!Qx#7bz~-faXre759cANRd|Y z>yD{Soi?8j8vZ`llr+gRXTWS-`V<$_a0yXDi(R^-bYfBYS~27W=YKH=*+ieR1yiH zAa%Y;J2-hUa07c3UY!KwT&X-}z2^`Fqv@VL&en>gq_l(l*HQm%nPwb2g&99#78+bG zGQR)_A7&k#aDTTSDi$FHxGK%G>SEfv`1-9^PK35ep11c&x;pHUiI2$x_92k0_IueZ z+YfU=4-pY;Xvm;tWqto!ycm{>4|OZA^=BfNmLL8T-u7%6-he`??dfgjB$8vc=q|lB zCa@ok4mjE3(bx?9S$OLp*CO2>3XC^L^a<8D;O0Sv+!rrqJZx3(( zQ*X)a{p7W|l!?2Wf-76W)UAcJ<~<=#T^d7&o;bpqjVYT8hb*w1hPMRK zR4^ORI#Rq@wOyf|@~%s3EN9}%&nf1j&tq0Ps8e1O(3Hyi zpu#pyfd$b2F_jq;6=UV=zAQQ~<{f>{z2$V7$z3D}M(WJ{)LK|wy$Lh?vbDE6=wRt9 zxkZi+z@TMRb<`2dMueYf`nuq%E7PVg7OVPm$X{QqQRHm&uqYNEVgpA%M z>cjp|z{HHjl=FO+wg(Tf`nqxe%zgWx&IQ3WC(GmZ`j)^po6F@yhieyq6bJ}h-6oPY z&bzGU7YyUy#5+&$!8z8z6K-z7lD(X)y)!_b8L`W zWNoq5@ZB(2$5v@Oo*tktt%LzHO{t?LPo@JO=YoIaC}}E9 z^SYs`U-;WUR|ITY#xi?Y7P=Hk?2toj6intm@uP6c6`8+lH?V~b>Kf@SS+L3bGhIdX zXIud$bWVLfw-{J}rhhfqA$Y0rKfF{!@N)3X^*_i$88uXbwOU*dv`m;0b7lXJm$d6q zzRigKuMuMZkC&Ol)n`fnhnGz2nK0k*X(~vF<>rsKGB{Bsyi9oOUGwI@-7Z&$tq|dz z#n-sDiRJ0qv-$!8o4YI~K*ZL@ho`|y)<(3w%8envhBWs*{Ar>A4>9mJgzrWBvw!sJhJJN`1+^RG;-za@Mg?tbx1>7UH!=b|C7D%N zxi62{*sBriF%(98Z7?ZYGyOGIXxQlj=hBP!&j91x-P+zW& z2-rKj0rt%%?GP~4%{*h7B@dh}!IYw-;sDpbAnYbK-cSCjOT^_ilZ!SsX$zZ@@$Fyw z{?ItQ3EkVmeXd<;IT#5-`EPU^!z^(`?-QOEMdD(vTBz`BlC2ItN?EXu;H`& z(QL7!CGu-@oVzsv%9xTnvfnE?plmJw7Jjoj3FL>&;c+#5q#O^;$E+8v&!pHoOr55V zUpT-QS+=E9&4^g&S^b`Q5!OPm-I9`R&Vmc7Oi{3{?#_+*>$r+aOuh`hvKn>jGTd|v|9DG@nn%|@;<@s0fA1OWOLTQZIFAEi{ldfg{^+Ie z>ktM4)APl#bf5AbqP<;%cdV>q<8KB%xPU5J)R5AH&+5;pYAyFxd`OgMlvJYNae{>8 zt5M8(JP0dOte}xpc<5ZLG5BSOCBeqvwGK-dXU0yk)oUAno~Oiili({p-b)S|pu@*E zm>c1PDSPXjy8a)CoAIy}nL3BAJvO1wA@YwGU#9gC2dsB|dM)%69tRs9R4sGjLu!-^ zA51%0Wjh>*{$qB4>e*`0K-k#!iNn~(Q#NZ|+K*z{oXO2~+r+qCXygsrM);ysb&sUQ~^N)$gQ}&J#f@c6fF~ z!r>3{qE8es?RRaDKRYBPp!qxW6wVMLkEj>3@rf7KRUeDYmVkW zH~{ZdiaN$QFrGbim|^bJ8OROUib;9uTc2x8xP)n&y5DJjP2Xaj0IPHsyM_Hn&@8n6Z*|k_ zHJ6*~R49BEZSM)!!jqA+kNJG9vO6+0;Fj;*?|;`FsGhoK!J>C{SgqcH;Re~pE`vz> z_$(Srhg+LPvUO(?{aMKhh3h8RGprnFr(wy+cfc7jd!@d(Tm2}*{jr-iL>>im^UM49 zUw(OKHC8H#V_!vxnL|bxKcyT2(@q5MX>2^Vs2}W^pp*Ks6B>siR5-EISvD^hO=)Pe zQU5=Q{J#cEd*DpzSI3RC=fJq<=@GkWyN zJ=bg{)IEt#(p3<8s4HD<$^*MxbNKv5Y|W_Lb35(Y_Zvz#ghf|?#53H<=TOWf>$UX!Q8ej-8hXFRC z6ANJI%qKqD#;_KC>TLM4ew;GI{82>2M87GJ2g%Ltd9tC(6 zg>UC?7FgxiYr35ex+^aa&XU3K`+Pg(6>tBN2?}LrIQ!kI?NX+ql1VHa9uEiKR-D#_ zx#Fn4&C`7OYKrl9kt?fvY#?J@IJ!y@We2l7QIeb94RuR($||1x@JO$51~B(HD3;7X zju};hRAH)sHzf3Z7r)qPSA9I{2Yu;w35oU_xv~85bYJh1$g(JrudMZ<23={u9PC)9Ef0C3K5VH+ocPPLapnd&;8V$B|!rvgdDl8+No-A3ueEtKOCdNtor1UBM>pT0^B>_EB^pO=xQ zr5Pz-uB{cf-AwznmGAu@0b%i($%U!|`(6%I15~1nhz(r$`DV7)l~;-?WbO=Hse$gs zi%`T8H`~3j#-O0ebF{-O}gyseUV0ZKF0ATT;0RSXC6b6&cGa-ddRnpK_2Y>v3cHEM>hRZ zejS4_u)PmIupRvZhwd3;ZC5G35Bl7NXp8~mLX=Dk?t*(lt7L%ykEQyHWNRY{wqjQ` z6VCEIKZSRRQ!G`X^|XZYwwmw0u({PXfN!2}aBMMLv#c;&DL1Kj#Vfr(R=k_)%Puua{UP6ZWLFw}4Q;b zT$*Wur>FJ{9qF@V!C!&WsddBLkGk};6J>0}UtQ9xzRrN0@FCi?3-(PdN9^UD4zQ!l zMp8n<=jHF~33AH`BLTMlZ_2pY0v5BGvsmw2%As5uyRB$uo zO^i_Z2*0qMJzCyolLkKy7HZ9_zdJ_%g@Dwbo1TxcS6@5@=km%s=}*^)_jEiI={h;z zd)k*?C)2@nN;LTghpSmo3}cnVKnY0Ep}xrEO8PUCx>{n`e+>@ZINITE%nN%V{!h6@z7DxR zJENafeB+G%M1#zB94}l_a5mgfr(m->Ay3eTiCdaKN#}e03CA4oB7)cIpu=O!=6oF3 z=2S_w`4~370PA-9s42Q`;rTf?VB=jaG7_K@k5+t4z`)d={fyuJ$AQ`q&Ew)oMD0UE zwuV_O)pPtZlRBrK;ZqYX)nk>1YA+f3x}%`nUWjs)rOVAlNCfFL-z%l*gJkT_0Tw@% z8N0XwJkxR-`PRa!uEaiRlaHxZJTe^Dt8HofPgh~39yHLmw;R95;nvOpi!G@VC-MH^3&?4mV89V2Kck#`56sk+i zwN8P+fgNCnOXv7{2g-%eMrv@*D9M+Ll_2=8SMcBf^Q(WU4HQEH`oj}wdi?%Nk*ssi zNouAh?<*lzB=!mif!){J>e>RB-*@7yadQ;Fp>MC8lbQ&%eFQksNLGGFjmJMp_quS5 zm-&W~GS<{@elblzR0?n8NwLS^m6B!qIs zW_{{?ULl+&J*do+m&9LK?9NtO0s4hja>X1Am$ zCaCPu+}R~qaS>&x|131SDOi>FPM630t43wh=Ve z@&iv2GI#h(gQ`0C0EZxly7ka9W_10A$8^ty^oK@`oRPbdZQU<@ z4$rOfAovI?UU?hNf4=k8uEh6G6#c{{f~N0AMiGC6UmgIZ0VN{Wg-x=JK3gb382TNh zrTIC6)Sz^zmx`(m0XjXz|?!OjxjjtkM_-Ob|OGx`0BnV z#^jPysiH*-NC)N7qTjh5muw(!MslQCkpTY}@8V8kPGc>kCTaaB+lC>FZj zZ{RmUI-tuYc33YIn3dYR9VYkV;)#0b2bwa=zGd3W@8ACQ9{VpY4j|EM+Q=iHThw$P2Faw1PHw7=uUy<*u7Z?f02f-CM8ifRtzQSTPkHeBkq}8^ROXE5q{6Wq z*jPhX<@$UF$QQNzA=$1j?zGwJra8~9E*PtO8}_rL0yRB7opmC3z04h$5V@Rde-Ux~ zjy%6$NdfC$rhz;y`d?Ob2=tAPKQKZK6#F=lg1al^O$#itwi9~Y6K-AVo!wu;Fupz) zM%^WgYIi4TL9Zkr-yHA4ONDhd6*%S{#-eZ^ad4AO9X<{Ld zd@r$)Q>jrhE*Mv;E+<;yx6Qd%Qyf#!(#9ta)TRais>Iq&{5RmEj3Hz^Prb}Y!5(>K zyHpIdxOwI6Vu)L4{^wo*o?(=Bi2$^=2Z6kfj(rKR8W-WEJmeeaRp!M2R38A(FS^v_rL_i@6CG)7T{Y;|;EuXWPs zD1!%mcCd*VkN|+lbtWo|G2)Qmv3=AO!|7sBw;9n(->;+3+d)MSdYQbBa;%QoqIayH zingt80{G#`c!*$bhYu4#ui{Nk?|h$9RDAi?RqTBmMmzYXUK;*f60o}D-UK$Y#J}5q z4ehR=sTEsCuzl8=!5xAfqrv3Su>^MhGc41}vM`H3*9hd8O6 z1mq;kJIMzz`z2FHuo*x&29O=RsK@XF04g)4MoeEFRUZ|_1{95Gl>;oua-o+F&XgfZ zrz|8-e?L0nJ6FqW%cZ0Z-@a`aahqUnvYbl#)FOkZ(!Y)qL*M+%5h}t^EBjlhT0yjB z5s(bYw!G7NIqj)wqu~odsJ^c8I6c*{j$Q2l zm3v`kNxl2iPxB)?IbjE3sm$M*(O0xz6@Ior^Ip9guI~N=Vz%3;p1{PaPUYog&HSZ_ ztN(&uABy(fvi%#?Czn&Py*0!e*d9NB^3exW!gX-*ed}!S;mM2A?Scb0CG|@v;D_-1 z2?3KmSbSyZ`JvflZ6oByvPgD({Zd&Ow4{t*eShn|O{(OtFp@)Wq-fhK~anx zvsMz)-JrkTp-(Zge$+BT>x6`x8oVu3oC8{^F8Mhjj8xG+l7lMoIqaYKo?(Z?e-3y4N!eGQES#ZKfc(p8L?sUwP|g!f13b(TSiB}6^`cG^>LmHWA{>R#R29{IJ*ux)$+ zro5N>B3HTXDnJ>(%!J|^^Xzsn6Cm;Oq;t*+7Dv%+1^fLrFYqpjwo|NSeTU>E*)U`g zJ1zGG=b)JF0H?pr;!ME9`5!NF#t<_$O29c9ql{-v--2QQu`QP!C1O518QXdV$0+fu8pzMHIJ!lE#VLCzrCb4kXg=|9dGUP}-{~rvU&FXM3XrbW zl6zU?1$F`d@}uorqDUD7+Rh$<#}+WU@oO8udT~X_!F9!-85AoN{;=&Ex?%QIJ|&qL zy&{?)a)9AuG{QFRS)~eEaVmna7-~rXp#SZv0AXU*Z-eP-s+N%U3?zG=A%;%Q^5{O6 zXS{KsS?Pw>t9MUEesp6)9OZM#Ym0I$-sce%fu1tFbI-Dy0wgNeMyUn)BJ8)l1BEWe?X zipBq}8TJzm<1MoYsE?hbiyMz+f!n9$$aWf6D>#Rh>y;BSKrmR4=ecKiI%}nET)80g z^knP1b`rqHxV&ik6ge7PEYYB0(pcYXk!Yw~PwG>;ja;Z?hc$p`_^%8yoin=+rLYQbtOZ(qKI z(iPDd_gTmgm?pgfkTYdu*~?uxZ6B#wDG}7_TsNx87f;J$Ajy!oaq+>Nz-R&-CEq_q z4g#@}NGTzh7l!N&pM&_)k(?l8Pu>M$k9*yP*t^R&7pV(+eq%2g1T9W3k54!x(+Y zBD`eUk>ZXPKq1snJeFjgkI1gW9|B|`KAu;`Ew>!d&aUlOey!r{&tF@eSl2qi_x0WviGCp6MDO)`!;ZWH`pRjE zMe_l(s^kl)mFSx|?Z@RjL*MaYJ!gf`|o?SLO~! z`Oi!)pkGYxeV>L(vnZR)xQ$+oy^8Rft=+-YrEd1b8{%xzPI?PZ<5sGGKX2jC1S95- zgn_^7*QpH^s3xoX0(EK2w+p>!D6L-L62ULoo_1c@L40cJMF9ehQbyU%if@~Obn7;% zYLhJm>{p)S7C5S93PHd1=o{P`-ylmr#$bWSkpR)u%^^{wW1uTO@+}9jlD?EPqQB9d zCZh%ADx!v&@bLH|*G7OD74Y~w+dxGEPhZzMP~&y_mf+7GP-wkQK@Z1N8Coe@{8fS( z_a;c01OJgN(oN;aF+OoYq;1 zh>>f36Yz{aqrAtXu7m%Gz*R_&h~K+S@7s8xm`OrYH;oud3&`wE%VZv)r#>FvN}_Uy4KdZR#T;(KGrm+|LSPv^U5 zr1pQ#c^~J|E^C%DlK!nK0&JoADRV2~1I)&u$n8KrPd5_6s@q~#9k-l*B z!*QiTy>lXljA&y8wX=L4%`sy~{XbJEP*Ej)K&qg4^jM`VVjo_E2efw^!8`9%v!kyn z3IAcHcA+Z%?stWO7N|wBQ3yHV1c-!~yn>kWS?7#pFIdg7@Jy?M4=O))vW$}|LO$q# zEM%z$h@e@rkcZIntNq-*8u+6J<4}d%Ivfb!Yw4iag<^Do_Z}8BXTR~;U&MGmzwr6M zmpPHWz}e)lwCn7Qta%LQ|F?w7j5xrX_M^*0q!e_?=aCZXiz7J z8pGEfd?!yhI_Wx{3;s&%J*@!)!(P2u{6Yo4(xiYt51W;Pi61=#EopvUm$bgk(DzV% zHbYKG3%35L&-sp_^ABU3;yQjd4$dPLWe_t8z?D9$Pvuwk%b|OV2BL%M&-)^p z_!3b+%g2emm~G1xrL%Y_{}TIwOa==efQx;U)#Dr$r<1E^7SYDr!s{pa#o^BmIPA)! zSmo)cE4K{H{J58D`G&C0G_w%M3x!}h>X>b-g+ijmn=X6 z2xDhQncUs>_&@KhbkW2dWFGB(Y6Ud>Zl<$wmJ2SuHI;rTX74{v13Eq7z{Ql!_d4B| z%Kv)$*bFB7?J{)-?*NOs-B1BDMIWXe;EsofF-92e&on3NJ48)w2`b}3vvnKQTemuz z6DC6Bhzc#vaDd3^uR@Ht{lr_(fLxf9=zx9ZYo>N6&_`#U;6qZd%@0?J?>*nCsng#k z9~2NtYjWcU+Ysw~2N1`*pOHp|O|$s}wk}E2{Idw!h(*XSVQ}&)Oaryc;!yOtDD7 z$b_P?ij2I>OmL0#}BrY}~7m)BjCK$MGk>Jg{zDpK~U+ z^A_0NCu8xZ<}LUqUJT41j3EQDUt#zY<&7FFWe1ICvcg0q)-J`s3IJ^geM$%tr%Kuc z8q&>7qN4KS>MxZmvzQ&~HlM}|5%QiaVK6mn^AOJ zdQS+sT`*NS=nx!1lgE7u7t2+!8Y&g19Q}6Z#y`Q(q45zps)1pWjS3J}iF!rp?_X2P zl*T4r$8W``@&5WHBWnY&r%K8*Lh!^p%%XF{iUFw^@yH*O0P zgtwvgo90<_cyh@l3{7Lk&cieq&HnHryAHYqe#8(&)`(Oy{ZM@|j~(7hM_q;Vad9SY zq@UNVYzWB6a5dvx#{Of2QZynlDUBMWIzWnadyTt~(-{;kPQAl^Wefiq28?btA2|YB zY1?M3ANO#&^s+vT5n7l&9rwjdtxs|I!;jvy;j*7y=V_KN^z5Vbb2mw|1`}Y#(@e)E z&Ifb?jdKZgfB3>qBq@|Z)XNL%HNeG~p+jBiRVJ5`hfPlvn_~wY1w~~%Q_4ZsSP6*t zbNDt5sbeywpLZ1Lck7cUNyUJl(5ieKvv*DMqO;TQZ?p^)c8uGiDwY!=JC_`d>^$ zt-`7M*@wGNpMUl`K6rIy;b3&}qWXxhwJzGTKHqx(2tY-xMz_+aC!kh=48#)IOpus$ z#=i0hbEFP2$$`C*#Ei|mMv`gc$3}V^8L5aO0CZ93atq_ezkn-33f=*hIjZATz&~ts z`Edl4+yxCAZR7-dQ9Yp+*S4^pDY-(}iH5i$0LCBYRI>4h26nJn$W4K)d`xEsi~04r)P9kN|yS_It)i7tn~ISj!O}b(?vO97TqP$w-HaJRQP-?hth>1H;jGyPps4( zuz!k%xKMV51To5RvdfPa7c~8Sjj05QD6t9U7DBo~5fw6c>II1JYu0os@%kK0AvnC{ST#qavq_nZNC)=3li-T9R>1d#rNAqke1P zZxWRqEFnXyUhCg?3Uu%b*Yz%zN7nS|cYw>2_+cUj)M4+scyk|$`CsuN*NUJc^_#H% zGnzY$p!}Y?x^CROS@n&``(Gkz=zsYNW3CM6F?#8$FkHeMV{teJ9wG{^bE6epdmhe= zoPO&eE9t?ukHC79Vj9d9!tQu|l6GF@&FO;pKk{yPJm6kO8mp4A%BC|Xn@!Tx?2QcU zX=dCxoi_cvYcLm~2`Tk^>eki!AmKC!sPCg%i&;U{%*^dZ1IB&{(Iymkwa+~))E1~J z-n#LL)emBOFob4~!l|fk-Si=jcd_zfx&J0Yx@T@)^R4E8<}#ik%xyMGT6?LaiL!Fs ztr4q+&kF^eM?`uS5xp1%rT|V9a`85S)c=_q*ydJHId{seds_4CgnS@gmf^jdxB3>7BqY26oD$p+SUbQXEGw@Z2SW~?rPw@ga8 z>j(cY#qYg0JU$4MYhbjA+8g2eSdLDHwD>ae`d2uS;<#Axlbc>)jOp_^xH-yPb_y`J z_q04OFbgR5()QhXmmjDazJ%0dT85xP!Dh-gJOhq?IZe`lRT<~I;G*kX9mV{;D8J5d z-u@U9c=#8TI0sFp`ny-8>rai*nv&qMJ{j7y!rk--_xbVbr@eB-(_7fKvH=9+fgxx3 z0ny^PFL28#sjIypfRjZUu1yD`Lu+K@gAbOhTOVq6bfH*kzv;k@H1<-csV=7lP2we} z`yeA);fvkutd0Q%D(gDl8CF zRTw;dun68}K3ZPMW%A;UjLw(6b-`cxWSw3pVdcv%tZ=#(i;;;nJ2l}2j0b2?0Tl$g zLr?YYeyM*C#YjPPIRwAmMAOl?uwjgH z4}&0T0_b__MEe##X~vMPmgl8|2(p1QFT>;@`iN{TZA2?+(J{ceOPn{j`xmu@aNKNBv|Tf6_5MgD zOq78-7X7+@jq}P}p#3R8cYuYNRo1@_tDYUQ{6eD-tvCsq7G<%x6fX0aGp_(^PW)cIAHcb9`rn>i_x3dc~4%y&+x=_1FJ z`~TL~#0l5&k=)axw)->QR@RXxdG(1#J|-&7A>W3{1|v~})2HU>R($1yz&&UVeLJT( z5ygiqBHsn1ghtwTNbKrqL1CzOmk;=98x!|UoK#@s^etBnUg@PZqewT6AkgeXr`z$- zrJQs};tkg9!XFt&55M_K7jAsu(?j4v%m+vozDt{Vo>_JG-?@aTe7Orz`EHAri?jbo z_OtsZV?^H7&N|pFT7R}_H;SqMh(M|-U;JkYj^+?4hgS7r;a)p5t6uyj7R3+)EBN)^ z!|TAYmzH@C5so8b$cS4W{AF&`UT7U`P4XBWhU?FMYIRJBGEqrRrnm7$W%xb*>G+9i z0okA40coponb~V^c(lUdemwhP&_Q6H=@iI54uX~Ksj~Q=^8Y0wQAz{g4R3!WOv{ju z1Dy1kd|dOFvUraakgy?r^pjrjYFgXv*H8SDqjiklah^+oN(B_tQqHEu`-kv%i3AO` z{t719PD3#VP>@SlC~Z8rK&aAsfb-qoKMCT1q^u5g0z*qJd(zKy-nC!jgQ^a&kv*KH=L^gUf@&Fvm>4P)#W6P@ zC(X_{O8(3_~GI)kgX%Wa3l1^ zZ;s0&@F?&_a%jmKj7MO101w}OER81} zDhM3Q{d@oR6dUYEt`X0D!DsR?znl6)=)5@FWr_s2_YYtxh!=e&2p#D#p7Vz&&gT@R zl_x!3rFt^>B-~~ z3mlB2JAOvGIaL6&Y9088AKN91VW$Z=hs$fw>)vs{XHzK3cu2?zbmQ+$G{wSx;MA*V zQ&h|taYUxKDko-Kj_N4-K+lPUL{xi79S0&@%Aj+Z|{VPZhkJde5n7T~@#3-lDKD|%8sztEH z&_^ttIfA0PjMIAl>C@&geY#hAh?v%%ze=XCTiPkpkz(ZP#A@%lR&l$=%{<)iV1skU z=$#5M1g)}7*aF)ekb&=uykDs(%0^R${_5JQ!{dzB+C&jNY$=DF;6~}Pd&7>`iTeN1 z^p#O@HBGl@kl+vq?ykXoa0w9HJ-EBe;4T4z2X~iX!QI{6-Cc*7%kzHg{yl%XSJmFT zdv(>>g(MjulO_G@BE8u$a=C=ETeIv-D7YI=Gu0pMGa>MeKkjT~;M{@1%|ChA(8g5^ zVxL7z1nhR=u01kPo@i}%lz^DZk_h0>>2;ih?whpey(H8RWi{lf#SDU<&tF>yk5V6tI57(Bf;)@ z11#K-jK13;58ofNo&1f=smXarN()}|rtVRNNBiGNdv0$*RJ{jMfE6S-E$ws_A;ovx zo3&mV|3|5ax1$^_CP%q$N}$$B2m$5^HTU_U&e(h<-;ZGeC;w3H~Q%8ya z-wQCtU+lytJ=raW*vw|ka3tynd}Gvpo2`62QZO^qfFT|kCH~diQ_m5J{LMhon07jvwL%_w< zqRf<%37w!STXxy=$WTtpo!42yA>DYDC8xLb%;bY;jsS_?JT{riCv?$(Ip?x|;Xue{ zrJ>^Y0Q_jfcJQN$8z(X{!kwmm5*T4c<(3Y^e1v=IpFy=T1q(46JYIEdVoW3y&%1%S zc)&rljq>ZSkZPPdM*S1mASl(c`EvUpIo%OBd?4hP2y14Up*p}) zq@b_@4Gi{=MLTwE7cE2fy>^k>^=7F7BGWaI52j0Ap<>x&PfS6B&Z206hAJ>nR- zt-7zE20my@*?{zD!%ndEx~oP(E?FOU$ceIh15sP3cAbWngF!&jK8_mZ3BI{?Fz7$28?6q z1=R}~E}d=;wZh>`9%p7L>}fh;WP0~!Sk-MA`JUB14^A)+{dA5$Tv>POQ^Cv}WZ@_% zp&DH$H9~vhZ0E8>l4V&Y;Nf*+79xQiDNuum$d+`&Sh}Wg#D$Cu)1dKX^{U*c7!duQ zAy%02jx+RNfMWny?+cxhWuVYU@p@CajSqmDkTl?iLzE-!2607dy#A6SbzRfn#z4sh z1pKxSVx;om==Otz!jlK;Xt9Hg&AZz&?!K`u>>HM`LMi>!<^>w9ftWH3Et^ zX7}k`NTzcRp1GDt)ujt^YbBl3A3+~KGJwV>Ljx^MGsF4zOjyLtzS~&+wJB zVai9kkW-g9*0+fN@n4#NLUD7Fc^10e#=Wv0fN(lu_cCjF@7u>UAjTwJ7Fkf-P)^hL z!-EdX27d$1qfOg`SEC)Q8Qa7jRkOQdWw=t-3fOU1Q0tjPP5h(-4$fE4Q=Qtm zJ00Q}^eh!BTAIm?uwCl2j5GyZE(ZtPjG=siF?P8hD>SnvlybURfM z`tM0fGD!nLxPopI!Y=;;>m}p$n!uA88Rj#@ET%VMHxDb>qqzG^(k0c~ON-E@jg2|- z>Ul8^?5Y?W%GV^3fl;Nd0x-h-l2bZ9DJ;UzRnmYCB`bEG)&s18D_;ca}E(EIUT-%Z=#Hu*BE{79jnkSYO8l((D~36RQ?#)e1JITjS&GpQ4&PX-&jjqF(j zTrQ-xTy=To2cE^&+DH{upH2-3o+OvjbIw0Nv5fIov$HS~T%57_Xd1tgKAOS_uIgc6 zCD+CC;IBI$sO2hvPGSMSHEjQKz>H5xW9R+>C7InhXP+Tqq%#R7c)DDD6jc6Vb$Nj< zgv2cPk&*8%Ocvbh@m^=1(gU%2FOsLq6;6!^jTc-Icwlnef)~Vy1hEvu;|_M$Jj9VJ z^**h1FTe`s@P=x>VqBfjekqDCIG`&+zXN@ISWb-?@Yhv8x!N$feTHsQ1BSgVw)*@V z{G7Ui(sxDwOVgh+6(6t{C4$^OtYrox5WYvwLUe=i*j0jhZ-%$dV|TU70{u^5gt-|r zJ5gCRko%^D4?O+zq+k+}4LBnoP>ztokdi&Fi8P(Bwkxq)Z2H@bs{6b@o&cyu92?Zj zt4i$dC{M6+y*GSs0SOFlW%NcHZ|%S-=Wq9kL)Kht49k z17P7)KSjb}|L2H$Y*M-9YM$k&I4iXZVG>;CoJ(bNq^b4$z2QubXRQ*b{`Qw0%(O0+ zaiK>V^KVaC2zqn`P-ROp9hH@edH~)$-uz?S8{}kI=1)#?dl0_-v zHW7SdyeuSBUWAoMJUjQ++z4km2TAV&TQ|+|#RrLrNyhHA2P_?_vS_0#--^al8v6Rk zdjYA|VTE?&Xu?FS>Ck=zL{VevUld*dOY*wsSp{=SH6t(a1LgX|%#)!|o3HB6OQ@k2 z@9LJJ6>hJx)|5d*o$oMD?`>}c|E~2c4qxJ{j9&W}(*6V!pFIujC=RBp__%T6SwRr8 z<%I&#shZav`}eA5ieYN%RtSJ!yJRZQf|KPWR5V}0Z=>aZWPGQNnirs6LBAg8(5=^~ z)Q4Ccy{?J$c2XZg_3xZ1zH@z2`#XA#msbAR4_AECNOx#(+$&bu2QpTSX zaNN(fLY7(bt-r$$k{}bn{hrf!7GGYVti(3n6nxT&UCu%7mO8BTkct~-C3+&v z+}!s_YD0Iu;2=oKJj$98cMF0k`>2z24qTQr&LYtHX+8gDdyyvSigGtLTU;14N0KMO zVaPPmvkfir%vW9wL~Gu|3&40cA!=q>5`~Y3bSt6=9r;3srS-~3+#hOip|5Fl-_bd=SOQ|S^0Xmwwf$$Np zP4;*ZPxVQICcI&M?TyozQiYFA?=ax#u2M$pz4%CNKJOT=x5i&VYz_aDk=UP&{%c!L=NoIeh-O zxI8QEY;?sM>!1~N!Na~-BFs(X#c@U!@ljG$4wI;m8I6mWF|ERyJww)z# zX2&H)TZO3P;t4GqAPt$?To~X?xVSOtapg}>e0Jo?8%JeU6Q{SC=Cbx~>{yB)C`FgT z-*7uQMQy9-Hw{j~CHS5Rvs0jd%6;o3izo{XOKATniJg>eJ06Rq=R)dvx6^t3vp$lQ z=CE^%&%%5){bc;UA!~FAWC*u-`*i-t#oq-CxqEv@Lx3T5UR}C;BKD3Y9ni`UGEzum zBy^u1+vxwJQ~n7Depr@Jdrdz5wXZ!gp_%3j#X|qg_%$l^zbK)f_lPc4B0e0)1Q9fT z*;)$i&FpuID8NjG)sAiLGC4R-Q56`GZx5nOnW>)TyI4-zr?|ZN*+y!7QsHj|hq{*Mp_tLB8b-)cm5_Bg!r!hm#~RqwO}8+dn_b{HEC z#%~bk=jJj#^ui9K$0N`aJW7&ec7n8Cb@14WX84zjdiQ?nug2g;BA!Pv%18Y)UB{Xo z#vBs2LebKL_`houKy=Olf4+z;NE@DlbAqj2YJ{0tmUP3+w?OG=ZK#k|3$Z(NvF%S) zN6$7@B>7caAldx%d`jgdm@f8;d<;t1?n+w&p(lIJHl_}K6y|yyl%x&awI9J4Qvh+| zi3mU3Vq8AVww9?e*VN;%-G~;l9K`DD)YlnQzitEY0 zvy1`#{4Oz9gW>|ntGd6@DZIaFFi1EahZC;F;JwNKBDzgUG)Z3xxDo@ea71J7(*Rb> z=MBV>!788*O2zg-PQI-38@9O499UdCw+2psymDVgz&35pf+`5*u4Pw3PLS|TWOR@U(&=v*H^YK#{2GIZKI`S^PRKsyCr zqxEKX=|R~|zgqnCV}UX~zmNsY#6W3*RSblLN6GWc{2H@7Lr9zc|Lsg2*+YmP84B|O z`t+0RMWTMSH~jQg(us7!f2yO*<3yB z=$J$L_&xKz8O3@c5Q#N(5&9fN*h`&OT&$3;oJcYAf(+NKS^k}r395C2Ha%ee{uo_n z>PDQq6`1=IibrQ#gC4ad%3@WP`;drI1(PH90xc7lu{QcW+{gS}GKSO}zUc-~B{e^F zB=YoCB;oLE0Q)I-aDDoz4r@Ydp{Q0YVSO^5*q za;b|t$?i!rxQ@qz>ZXF}hMsY%Nhmz$E>7k;^(0{J9ugPz>>Jsh8=>Svz zr$DYBjR68~cPWcN78!oAd8&sNw>!0y7y8HF+v%Tj8PxZvBX(H+fT(QYJ5$RGBB8E# z-hW0+GC}pyY==)Rsk=>$5&{?QzMp23zfZy(s3WB99Mqlg(;NHq$9%o3ljmXMQ@=?T z8c;Wm2ND?g-h@gQdy+_SK^?i~0I`0IBlijF^gH`)y9JuMk7z@U^PqY$K#L5_kq-TN zNz)YE5Y_%lXDAFmhX58)1iaywn#|~)*I;Yuuew7ZZ zy^UU&X13C;!_rDrzs-Fd+ z+KCRxQ1C;`bIllKyM}Cd(~IQH_<)rOVMtwV>=ZN* zH80^mUq40p$njHTl4_p@uiq)6LWRD-rgKCM++{U@b*>2B3Nd}yt##{6OZ;CSvwxC@ zRyG>Dtyt++?dlfpZ8jGj(Ed9MHK~P;;FR#)xhbc(y*stMG+b=T;D#?Kl*iig`T|(2%W)s@^d3D zAxO$r>cY~22fkY)O#wLv(_w>Hx9>^{`1*RBk4Tw9K2LR7W%-?M(Kh(>)Z{RcD!WGx zYXB_ngdh!2*W9L)?R^}mD~}HzgQn-HQs-4Ij*V$u8>{|$oyAc8)C@2ym7Dk0$}bK=Zx&5huTG&G(C8fFqu#2bP&h0Cx$kG~Z+5ug`bL5Hcp2UB z@q<{>43Y)4A5SRk3ndbq9VeWk_hpX+b~t?VLlw#C%TCMVKc>ePvQ}h`2zPRo`q;rr z{8J-e&t9HFynH+zPod%G8Xiu0Ad6;yzNUVK!UkAJnJ$rPOTgsuLFuX8j;nCV3p;Kr zlXVke_iTM?ELbueLoN7X*-sKxy+|=e&_r4dpwm-VMz`uX?0Fy^9qG!@wv>A`qgdIT zl}I~Naf0wxf{2|93X^%FmUhwUvcQKk;D^Nv@bK`qVlKUR@X74Z7TZx(;U)e&LlRP> zNDh*N)I*aM2kLmjvz*A<$geM06qemHdsW?Hs>4I?d{xHjgal96n|!)AQxJ^yU}RSQ zgm_F`{`*WIRwhOs#w6^H(R zBKT-BzurojLJn*FK-lx){2%gu$q-(y85X;Sg7IN$X#v+4IFXwJ`0Qs#X=EVW4mFA5 zZytZGxXRp1Z5|)jXogM3^T1m(o!=4sSh;o2`7-p^3tgR66k-9sIFmn55sWo-Wm`&i7N`RqD*CfRQ51VEOtmKe);m8X$<)^wJQ{WLhmn0*U` ztx782X8YlyO>2VA^>gWypS4BK_ULGQjCyczBa{}uiQn8gsn!d%lq|bSn%)WQr6HqD z{yQT*-y0?gY5(T+tfTB+c(F8z&4GNp##{)`9NEM_1|P+M(KUkK5mKY7?)ic~lYA&Xn{X&v#ai#hJF@Q`=uDe~tXLu~1( z9R=4ZAjU;J)(K+lC@tp#8#9QbT>e)%Jqm2@`l};BBnkNiffFQgH^*2H>*TxLWL21s z)sFT$P=#0T3qtFt&*38HX`gWLY2m96{#*)TYEBRt&6;3G907Fnk5R=zVQ;c+&H5~3 z>5)OE^H+IIy!4>$^^1#hkm^B@A@(oREgl#Vz8Bi?aR*jLXpEcep6wSo`j?^mgV#3i z?7z(_Yp+w_Z!8MyCK?G&(p9_X#lTjqPxb?Yt>}GbCphUq>^!QMED~x+?eR?TQ4O2J zUM*sP8kXdt`wZ|9e?PY2n(30Xm~|pDlz}~QVPj3Aol@FMMgJuFe)z1Gtds57jwpFHza?-bLKC7_-gzd^CsAc`}DGN;=cvdEI;p5FU(u%Nglez4Of09Q-tAg_VTXSw~)b z!3M=fNqlpK?@{*DU#7JhN3mjAF5-DwC^_4m`tShDJg~Bm#9drH+A-Tf}hBbNJmQQDjt- z2S!7lREq8p*vslDlAb?V+-FSz&toFqkp*emGXF*#;>&@3<HYE=GhUhIus1Zy z`e+pr&z9Cslp0E!QN4(6DL9?HXj#HAd|$0LdQVA>N=VMHL8_1amM}Ym4458lPz<`H z4c-ZgPv++KeT(7I$TO7vK8sIh4!!n~wN@x)RqgOVNDxXBEl{$R4;@wi@JNEr%fSVS5uGbO+nFDC_i~_+fHu` zn@#a`ACax&3AVL3+S(%FYNRl<3`s}Sebsm*Ta>Ulg%jJb?i9Gam&s{!) zC-_;j0nGAt{=U$Z&28TM`{{f+YW7N(zO@Uu7yG721cgDe4q)nIh@aMg!Vck&1PQ1q z826%;ZVPd2+o`=y1x!a(e4;=mkMNb{JxJ>?CzXQgA~+|x(ry~TWa(qaZHe7i#{4MB zRA%(%Q;Tho4|7S(%Q;-NElUu6%D0&>4r%%nixoj^m*5Fn5km=y{<{lbqn1e|c=;YT z0r-jttoj@x2lf15XXkcYUuNX|*J3d3sq$)R>-R*Qxi0!zC{o21B1)#baZvRNB4sW`!0H3fyEAN1xUhjqEKgkv=IxZ8qv)V8B@azM2Rk;W2vREWTm&Y5QEG}vvR zzgq7WKI}|^zafxYAj3|`rt^;F%Qz zBG&y`EjjA{_X4bb?sIfzxE_!8$kw{$=6*-`ZuDW4CYqwU4v3*VLo zK`H#aittt1;gd=+dm1cP-Pa_ALq^>Pu|X5ZWOD}0d_Fcq+I^%V7z(@9KfYpfDcz+- z>8{^&f^LQ;0x!wKcGDid{vnO8Uy-9d{_t`me<7B~AjsZY z#cdjK%^n6!!ex2gdEMkP2l?-Z9^h}bHt?{86Y+D3>bD|y7c>MTu4dYjz(j|Fli%`Wx@?c z)IFG44_&%A=?8s2923}4%E*a~qIv3Pf}G^c9E;2StE90bIRy!bQ+UsRkhT6lMAhKC z6rlD}!Go`GFt&o(f*R!8;w zUC8S=Zo|Q0r(ol;f9}!Y`O^CPLcy`_RjnwA_O71RQo`?Y-_#GjOUNxEtxO(HJe<&z zg3oC})uDxA@}=K9!PSO!|HYpEb6hiC#!@XMmsdREj{9llX^Yp+xf<)U zCT7Tw-trh`6^IHSS-NHB@s=(Od{hQ}ZeAylSs>%DjAJQ(+;M_ej#p>lzQRU)M9-MF zKV3XLUexNI8nx+6*_29))ZZX);z2Eq-So05)%A!4_$evQN*0a1E>tHS?=;I_=+{yL)(ueCfNMnti1cbcf|02c}HKnkMD4EH&ZG$bpcwm#pFT)DPDG@l@- zVKo8ulO|*Ff>#8C1?rNay)pL{^9fvXc$F`L4xD^t?=3DzSvQVUdsx!X(wXNB87zam zm2aswaF|1IVG3p6``i$2o)O?1b_uWbu81TS*y?b;gur=5Ts6GEr0Qd5YiBGS>s)kD z&+Ym7UMvXoLm_$vN7+UFhw?VtzXdCcgvEP8lpN{A^lZ+BtA{6wQ+uqFz*PY-b&!%8 z;;4hqxDG`F_@BjBC?v_XUl4|2WU%Idltj_Ux#eGKj8%7cR4}f`Jug0y zqpoBG4#juncs`hrnyTg$WK*m=3Q=u)ak0b&IBdsQJ}q;zZ={A>_bPve+Q>g$L_uP8lF1|vevhY35SLZhF0hOB7gr;aMmQq(O}BsCIJ~X|85PxW+E^9 z)Y#EFTJ9OE%hYr|c$T6lH=crcxhq*|O9Y4mAxWOT& z=uYxR7Zm3>>DqvWriar#E+oPa-r~-XX-u)8vcGcl_oFMyWw4~=8R)**(t`zM;GirZ zQe#5rGI>*J6aEj=G=thcZ;cnG%-=2ngC#-*RQniJn$wzw{x2VIgVK$VV^8B5th~D^ zLI3`yBM1RPGGfPbgAYaxd=LU%g4Bu3*bN{TQ>2T`}zQm(T7*TJi?O z@v*|M*}+ley)cgHlGOnbd>zaJ&c=D!yIL zlQaH2Vp%}~4P43^W=SeKt^}_HU^%)$LEq~7-u~o!4x(p!S&(EO`DITv<54%&NYp+5 z6DAoUhad7#5Qb62c~kQe`RGHSQLkrCL@c%$RLHB%OJxzbqElPmtP=tnvsTX}Hpr%+;6KO4sFhJdcN=_frJ;RBA9Phft(RENC(+nA*%Tm75W ziN7tUFsd=_fEcKx@;;n~bP8*PKdmoDM2qbIu=IzB0@DkNit3^u;0E+*dWI$I9rfNP z79?xYH+TCk*Z&t|hSiD`t;}bQ{pGPgieeo|ahGOqajjES$pZj*UOxekVU2w5p(VsO z+pXpdiEyU2N{$=``ZoK=H$%(T|DMfjAB!W$a zfI{&X2^@vVKg8=uuXj~4>O*uBMNz-1VbZt#_{Wz135d#X#0lWU{BHf!`D+3|;eG$c z3bd3EAG~_W?3y~Z9G9|R2R#sqxBLLV#Y^agLSTK7!Kt&J?1fdt)fcYC^ZJ*;|5O$B zo-fI+hz+5G^jaO4vv9GRmbvvxWjlHH*s;IglJyE@7VZ2%QwRYd^K$N!ui0?nd^2hJ zGWR~sCq;ub5yL#c<9;! zhm-CdIhaLu#HYv33*K!6*G^7e?UF=tpy_7#AUM_JKsFO1DsBMSLz34yQ9DfURkg%L z2iXc)s}k~SctVNtX2j!6$we;L#Af*>6uffS1-zHU)>Nv2*1T6ss0H03C+^#UTS-tIIt3Km*!M_Z_hCz|5m@&>~JE039)EG zInzj|@lXTRh*{e>KcizZ35i`yX(hk!&OA03P>ai|+ zDMl0csV^eRJ`1Zbpi+GMDJJcrH2tM717K){XtydXq<#hF4>`Tre5Q9W2*&+N9J>->TXxm-)N3dO*9RU(9P}Z6Z;(lr++@vEvE z;CJ1Fj{I~!C6rIT2L>^3nmd@AQ`XiT#U3cx(s83RhO^tz3^~7pDkw4A_7C)s3#g|V zvDP1^ik#w}Q(banX11Y}D~MCV6(r(Et9@5+^S)WeHYFr-Plre@RALOAnmI=xA{9U>aH* zY#E|(@ejh^^So86G>gvmdfnXoE)hQne$ibqaC2-x&*`g+&)W8xv?-nDMTik_wDwAwtR0knuhzfd^v~~(D&1vn-Si)GUzc*DH zgkjaPjGFgL@C>~1>B$;2n0Qg3<6^of?L>{g%`z$ZYL74+ zMHqZjk%Oi~IphzB{WrwW>r0NR)MK3wILS&cIK!|gWk7kas#N55X(C-a+{9f!Sj|O`<#@HuN(>jea^^R!A zaUv2cprNYi_ik{hYvg7;Tuxg{NN4h;I)Zvz@aAc;{&@v`I@tI9*;d4E{uqVlPms!h zE%O;MD|;^73#wtc1AH$N#2ed{Ka>ZPGW_(XwP}_)e5avmWMuPA(NxU-{i9w zc2RaYTO}1X$L$rHTtz}3TatO3`bhx`V}_) z7f;s*b<=EFyg47IwqObhzPYSiRtfNV-&Cw^*sRVxx}p=GJZeVstO38mM}PU=m0uM+ zGis$49zZk*h#8U9!vA8Z(`S>JG9XXu%84OVULy5xef-3-F^Zlz_H$T2234@HdRC|> zK2Gm7cETjlPXKbWs#Isj%#^fz*6cUQwI#qx`hF_lmB6e{k{^Je9XB$uv$&P1+sp|) zEyiiOo&)$mI2qJMNlmL*L&tY^5khb5ZHwN9^dZMZ|b(oASk1oL#FrRSYY$#zHue zhtgSM@=DUjUz5R)SAY@C&ul$8`R~QfAlt5+z_Fw$)Hd+%Dv`bkz$54c#PN~FrEw0( z{EMt2z(BpLD2x&oB`y;40d-gR{rUZ-#>A9z6CMIZ9GgYWXOBf%YLxUfTV4m9bGe`( z@Hhd$wo7dxE4{{$K0CvUUiOn2uBHkp()TG=n;PO*Xk_&iP}9+d5~#CbKnhxZ9^NDjMrBc1$$_PwEmtLlFG*V|PxN3T$gz!`cI z3~>ZW?E77FH>LS_SVPHOa8BFxj*!23#LE0N3h=5g^l2Pef0z%HG0I?gs$6IJxR94+ zp=F3oFdbVCQ6p)_Ni{F8x^kL^$E9%O7GPecQ$)Ld8kkSPyJ<(~s{byPhKl&Nwcz`o zCYaToPum@C2u~0!o4-CSka#&|0!e)xU~diNzV2wMiCI{5JPp-k&X6jcPw3^vqAv@w zax~smH!)1kRI`(4=a?yKZUePy&N<(sT%vUZ zsXT$|LcN08O`6U75WA#N+Kgu3wol|UU^xe?;@ zM9opFO+nZa*D?pkzW4cSc)V)#zqrd@>;1^Bq|7BJMt$riYP@XwIeB8aw&B_k5rOzd z?T#CyErLnS*@92shANVXMy$X$nnp+l%r&8-}EDR5Nf`_lfQvWws@j^mr!!4WUeoX%$_bH&k#?anCd%XJ(Z85O0a z1z054ZfecQ#J^s{65Gj151`pdtsO}~6O%Z6O6ZRL&4=j90_SN zg1tp^8=9;DM}q?@*SZ{!ve454`8X`d=y`>wM!UNO25XM8p3b~}+IOMyF~?Siq(NAt z-ruQy8aX<>HFy~L?{0GZV@mWJ_L7nFb<-p2R65yl4YOX_7?1lTPZ#TDz#evP>8q=+ zYMIO;AnC`o36uMG`aF}yc-*dIJ1i!**C&OjzJT~P$XSgSBXP&D`2aOy4*iNo^!6s| z1wyg1WpQqaGVf{GdPY`d&zt~KC&w0J?sDL?)fTg(9)gJZS(y=k8{OsX`+|uR@ ziEhw)r-%Av+CNt6(nIw++v?nM_Im(=cA-LicZof^qN4DyETt@MB&^T|lfE?0^OBx( zBs&BGdVDfqbN}#XB3zEx`d4n0B!qSP#owFT%RI-{Fw=+1zLr$-rj#p%xv$l zwfM1|rpSsunlSzGdZTUJp%LS(`85|^Zg~oLK_lU-M(NBc(q5EAgYJ&3HrY6QkpmG8 za^OjvmXP^>i%oqMAP5$E7Sg>9N&k}7<)rc(e8}}zQL6Kp>Cj`nSHCYn4#mQ%C_YYf zpxv#JcXN3LQ8ZLlNWLt#1!boOD$@g&@LN9yWPiQe=TNelvPv%&o7p``uz#OmdFI^H z$%tS`gDdz2^5+8ZU!J%<8;)EhEH?&2>6$chfNmoGH`^6Qp=T;_<4!}3n83*TRSzw;K20}dcZIP(wwIuIBt&>IT++6Hv3twF zF82ambMk@QBz3o*e^YJ#ShC7Y4fLg0Wa^;fcz=6e#b$yuD{nE@yAy{`1_{J^>z`e+#w$(36 zFke8ap>qnkO0~K|c%$A_dUex#^gJn+pK&{umnpNw#M3jn1F`bm6!l0!JdNBql8#H(4uFTUQiLcBRgkeH%L{f3F3=VWGsE~2qhK?huo&y@mP(U9ok^EigFfFF>x0)OEMd6jx|F2w9UZht&18GC3 z$OJD;db3ZW+Aw+n$(U9xihuY$Y^Iw1`Cm{!*$})Dzm$m)wj@i)Xf3L&TBOp-4Ch)d z<4&vHCb|J0x@4ileCE_ zW8%e}7IJs^`(-f~;mui@P3ur?JwA=oRWP218n3u0D96Sp3Ga+%F#E!F?5-?J!eD8- zxfSY!qC1q{l>}3=t6P5Gp$wR#Qz-Kq`)}e#y|@N-Mz} zxyDdw-?8vwzb!Qhf;meLo`@6jm!HAtF72hWX3{kn+6-l@Fg^M$iY=IFkS)nKA55Cx zu2(nQ_1t6d_E}+n0?&J{nwvH`-b_UZR2f}V$+S5bd#?ta1kEJvRj8K8^Nv#1vUZ*X ze(!z%xlLI>hmg*H5H7^WV^K&-=KbYjx5SaZ`m10zEX+_0X0Y&WZxASI6ZL-CZ|Kw; z?DgvfLfm+@;ve$$l4H@GWa==0@a*m#;W__8oRZPceOw{5oGLvkTMlVmFFUt6rpXTY zE{`q8I0p_(=N+s|nZoU8h}Ot0Bg<5ia3H2}%k{JVD}awN?PgEcjMH|^s1E?Ns^?gW zb2jwV6VaJ)%txkw3~&bfpnY4{L}VqQxW8Pur$*c+b~dH0rw?rR9y(9D2tJ;9`NG4@ z-(t0jFx6jM!%pMqSZBNQWe`E_oF+wU(wK?MFV1oVy7a(*S1n{Szwk#ma=OZoir8Y7 z40vp9e3a?O;d4G{)>SQ`Gj0OLRD9N}6{TVm28J6Q*vM5;lAjbUaOakOhY*itu&{}A zTgkN7loqx>=7sqCOzKXtbbXkddHvbfNz}O!>X$uQ*(uP{#}MOm+(DMX#QdDqV*nSuM#oa!CWn7=qjR@BtA(O_bol*>H3ewF<7sR zt!Pm5nP375s<3}K|F;h{t0VQASf05gZ$TvNGcbC4po=^Dm#&mdE?JwuRSs880{CV zEce7)-8<{Pyhbuov`Qq)Cw9E#E=JMiT5U=vLt1lim&oIj2WH=U5G{LW#OdX`NxS%N z>sZ3>h@_VJmZx91f{nd~tJ9c#lvl*UNLnAoaSs71%^lwN4c3ieg+it3m6^DV$%(Ey zeoK@+3ZW$A?;}HUN5mhF#f{EqOT6_1^5*rl2%P0kt=bfTat06RNPVj7P5+YO%+f?n z3dD2EamZENyG0D~g>WE{ug7PwG!1tMjOA#jZV?C6qZa-FqchYp>Gw4)+I`bnmN+cN zqnyHW`Uj1P{qjsAp0i{5iyn*yMd^qI9Iv7NYK?B#H~C~r!Xv~5HjLR}6`bFFpt|~I z(y`o8V{-Ftea1qJ+qJraf2G(Q5JTQK$j@`jCxo^XyQ7OLUVJ8vxIJ@)B{f04L>|RCuS0@b%>4`XvR9NL1oDVlsFgT(3OGFjVE%RRb z=&FkC{=#hKV1k`ynGm!)XRk~`4&K9th;Ye1@TE1-jWeUlV&8R|w1F18r0Tyt$h--l zYn!&JiMYP_`muVXO^kf_cE4LD)bMQtcT@xrh z_1apD>BQjPP)`&wdw94tv_&fDDS{1cOidxRhCI&mxkUU1K9;i0A~U$>C$QJL%v5~4 zB1%Ni_EUBl{8YjZ`~N^_l| zbJ6Q|#6cZJX)i6V0DIQmiljer8RJgqy=9|sW7yEYX`+>xlzsHb3{6t-t2i3a5TdYx z{Cm#Ce`LUzV4wJbc574eOk=M0<6}zKRif!MVl+HXbScM~Ur6LpJvYR(wb-ul=}Z z&b#~{BwQ=ca1dcXk@3@!#dzn0fF>0Jd@#LZoX>0JPfeBMOjrfI23rkg(Z>Q)Hs}|5 zN3kDASoG0UQMC{5_{4^O!~Vbfwn`ySH|SAf$57@ptcXtWWE!~ZDN{7-?OLv2Wv^0pMqzFiNcXxNgvit4(yRPpqIP=UsXW}_C_bhk^ z6$_uW6a@X|K)iwg^fC=Go;aERedvPpou$EL+U}$eV8~6;{ia-ws64XmF);1O2U z9G0dyqnoEnRh`IL`m(19Owk+te=h(>YSy=s{)=W~P0{0gND(?pX=eS2?3`y7*gVN(`I<`n*}3Mn~KIrRQXK+FJF z|Bl(AI%IypTU#-ICV55VzFBOo%)g8qlIOFD9+46)ydY8WD}|C#ZFL*{sSFuMf}&LL zyP6J@wIzR>v2Nn2a_Llb;b+ge!pxfYVdb~&(ylx>5-F1gmDV8}xqf%$V6e{@$QSIL z>!F=>89`$WFnG*Q-Rn2(5cRvWL)82Ns=s)*CEkl#xQW~O&P^NS^~J4chv9w%)G;&# z;iI!gq6CSqjdOKGS_73WTPYUv;(Q4C?k*=04GFTkRzLMW_C-#S!wdzJ#nC@|@rDjHu0$Eq$$$$?@tx5OVQ2=qqjZ^p3rggs$gE)(_23Q|Z|- zhpwOFfOpHe^E%M5FvWGcc1AToSKvEcpYI2A?)#l}R!!nas(>TGWYYkpZ8J6|2erliUM5b-Xp*Wj=i$WfchXIjxlyfgr zPw>ZX$Kpz|RI#O^*pG6B7V%|?&DDPo$7%i(2b5b~ES`VGAmP(Bdzg9YC8Nu~5vD97 z^h>f4X`^fJnG#;Ui9HPx)L-WJDDjSK#WFUot_92ICiZ!NhDbYfM-TU1LMDQOVBHkI znRePZqnZk3&6=y9C(`=lspu(9xD1bGoA$@~=^4`}j&A9ZGXe=o%}|nl{o)x_TuJ!o z8AY?*WeiTi5i{JFbhfGTzX5)H-IJilgMzmN`oUtL!?li^Xb=>wMXdvm^xZbs@|W%T zM=?opsgl!x-)>hvM#SO5(!9A?Sv#q0(Y(4k(>0EU*9CA7dx>a{gl?8XsJY4T8Ea$b zs{~pe|{RK3Dk z{v2oHGG_A}6qWh<%Nd!LhhWF|%WA*2MT!^eXYyFRuNBgGtfG~MERR&j_4_5Emg7Nt5 z;otK<=qjc#im86VjpXxp#Pm%c?gdKMztxQxx3&vkIsV9bdav0bWW*#lEk5g?Yw$u7 z?p_1Ic$9hX`^OSLsz)W{Cq3>mUB;JX9c*I}hFGq9uq!?!i&i<|bKzfUq_W{rmJ$6s z)}EqBkPV0)g;o1&*Iv=Rv>lcW?Q;Ch?PllmCKUbpvs-xi6aF6Hu-0%mdQ;$?V~B_B zNjaKps8uYw{wd!3V4PIKj^&*rO9%0AS~;3r5{fKgKld)Z-(eS|&sbHR#)Lp_?l0Ww z{EFL7W$&&i$QkRo&OiC6_#@#K0dN)YXSV7X{t5EqAnC4Fdj+r$!dpq}#3*6)mnw=; zA&SK3Qh)n_+a!~NW|IArAw+!Sf5rxLV80TQTAwM8JEN#VKxKZH+Zxy4JMd_%QBm## zCZy1O(MUS3v&Sr4PE$91=4JqlGbUSM(i}y z-RDdc{c~+`;w4?n9dl4Hk8DV8KcD$B2sgGMB=!}dDZ`E>UcSVhz?ZjIWv)`{DqqBG z=djEF*29ZGb09N3Xw#P_j%|%SF7B`#Mp_iYv?TZxHe)@p#bb=GZCJB~d$LN$R$Z5h z@ng(S=ns1ft_kp6_frmpjLhTiUuy_jU2n#A6j7&Kh#3o2c&mSr)%rIr0(t7x)=rz8 zcnxpNU_jsvmf58$6=&~=>AL0VJ*Q>+u}5JyqNbrBHCVkdp&K_CJLAeKmJd&jSG3qw zbNGJ%9=3^mf3;$`p1-n`_?&p)#O)ylyN!}88XDNoFG!%er*sh>J#R*}MKbOaMqX)I z=@30nBNyr~_LRjCvT$KG;<4X92myL^I`LsRt;AK`26pmVB%LDR)Mgv^NPwKJgm5GH zO#!OM19gL-m1oQFG3j7;DH?m;)Tyt$u~9OSv?}!(8e!(3ixJ6=P~TS8e>%0C=N!Kn zc%`1nX$W`Djh|8OJ~)lzs-UkJ%|(PRLiax0Yvhjo#%?2jm^KUJQHbNqFmFMySfxP( z`&chtGl)++(c1@o0NlaR65yNfwz{i%y<-hM_Ad8sLi1ATmFsF7;k&Y$$w`dF{YY6e zFbN_)JUp>?jkObKw=+@sta3d+&kF_}CMi$k$wI52Ks()Jy&UatH;c!atw?x_rW-Mmqu54%b#Uvw| z@@qs-#L+(B6aif*bOOJA$}WIjj7$FRo}V_sTkcaltlB8@E4f3LUz%V08srxwMJaz0 zsBwXB6&7&9#b^ zfXS#!&u*PuaT=gj6E>$N&<$y1^>^TdxRsi%S5qN>V_C<5`O%*&-eC_Oh0BPS?{nR+ z(4Bn*TYxA3yF!5CrWTcPb~_hc#_{Nm4jbLJbtLWGaju(ZU|0gr6fVH)m^c=<5A!(L z(J9y+ zWPO(|@U(ICWaf?7UEK&W*~n^=Ue&dBbXid`7u~i>0LU2E0rWAW)B|vU29YTO|4&dGL!8%is|)mFWnT!iIJ%wae(8? z-h@|sgb$_FUz?EN{gyLXFm?mJi|%ojDNswwI{4XG>8(a!o;z0_YIcjeo{4p? zs}G>~+bPyj?-AXl|7&8X?vI>whYQCJH;UAm)>%a&QMzq3Z-6$deqx#kZBry_QIFJ< ztVH=}*vs4LNr&mk&3~sew~DO5xGei>*DvsZ$j0UIeRE)e!CLAdw=bcf*SG&7xw~-6 ztD~Q17M?beeEd+;d+F<4{EH*Pm<@b0R8@i97w%CHct#HOR{jqta+kh%?dU}V!7AZD zme}ocR!jAa{AfF;TiDs$g*Zzzj%L3X@ffk;4oXu(w2^puBAF3KpOV?N9L6py5)ZZ) z3;v5jO(8J?>wL}jl?ZYQ{bmoKw^77rs~zI}Oa!(jB@pe_5t zAO|Bhz;30~f3^2Rbc$Oq4CZEBdM>te8mgwC+g08gxd|dcCf@d zwq@rgwlm(*V>E%Nb5CI_I5{t2Ua~wQ*ne5}wab>GNPEoA(#8o&LoPfv)o0{GX!zo8{?U zlkuFtZ$|iT#!q}xNn4GL{M4j_k>XhME|AS|pG!8ZW=LOU*QJ`h@0ooQ?2;FXCU$r9 zFh_iKw8BL61@YWxswI;vko`s{e^dRkgphrG%wBa#ivZy!^; z4|wKer0KS1SYs)voL1UDkU90o9kR9o4})y||A`|*d7fOn;h{wloH~w8T{veL3$K=B zQSQ8P1?r+6oC76W!DD;3*Ixn~x}!lBL^bD?G+P&@?$iQoI3u0VziZ1{3)Jt9{|0@N zizd}p$@4e(kl-_k3LbM8HUI6Mcg)!G+pMhKv9S)PJL8gm2y|H5%`l~QK5a6 zX$SnxJ*ZYwLG(|Z7uAQO)7$43fYhUc0cG?|s1Wq`P;H(h!Qwp`_uQR5f6_})17-DS zKZ`1j41VhKxuQ7|t5($qp6Ttl_IVYlsNEi6ZP-X|q@{O><0bZ!LN@w1PQ)-B6nNIW zSuveJz8AzUzBWPfxp3}{5Wk`DMb)F^a}!>hiGYFT4)@#QZ`>&p*g^&$7)ZNdI}XLZ zB3bQ6)#R5cU4v!=M9pXE3)*vmI=a2#KOD2lzEHx`eWn=STsLl1 zdao9MRU=|w|2j3Pj#Q>QMG)mXKaWBK-I%W%@CaRMY0cwbl>MkcS;M+cQAs$@O!$F# zFGr>#=3t8#Zy?COMhLW@V_s3*`N;FNfmk|0Ttek>aNa_5o!JLhZ%-qx2#ZK<{}1e? z(Rczj!Nt4ZYxI3N4)LXG*v=ct(M*nT{zeA8l5d?98=Tk$VfZ$QK@J`cesp@VS6#Re z{VCDZ*h{S$a>$byf7`KSayL6Sed26y!U|zLxUjY>bDtI&7;=LX)E9#)|%Y- zC!wkOC0V}FDLkqw(tcBi#1h6=KYypfB;XGc2%#rK*$^Rft1zK^!beZM8%4i1t#+D8 z(ie2V0kY$&>TcDJvi;y8HL(ote9e|e!b3bc6ih?W_9l>6bP>lL6;L44MwVIKXCJz2r2~b1=W$+(;vN_`=C+lw!_CY&G_`3U>CsxIjvHo8zCt z`yJJR@~OOt5T~F|v>Tx^557y(75UUUo5-pIlZc^o>@UF9#$4FX4;je5rzCz-#-m|{ z)J=DUk!uuI-x%?GX1~*+QC&*D^05?|d1V#PN|dn_&;4lzuO{CAUX zBUq9kvCLtWB-$#_-5^-@E#Fln_dM(3>vnFms*hwyJ_-~mrW5TfYAQBMJf<{^xf&M# zma$~~2PCXehNOrY@YzW|7Ae|DOMQ&7$95O>p~1t+nkw;7dQY`GsHHD7CLK7I%TsdGhZ#1^v}+TIi<|;MvOB2aj%N zPNg^;BKQaoMLV*CO(~>?pR#{UCK?pA8KHQOg^FteQb?(2?uDtV*XW$b$L#_}Q!h4= z!l`gyn}l!f*a=}S$PJ=ilsLfm%hyv-pQD`HArZdyqYbuW4nMhbO{RJrcxAik_PzLb ziDV5fnY*XPoI?B(uwQG=zXr9zi_0M_9q>XA@L_zgWLpzHI7b%;(ThKj?QkL;FAV@`k)YAg#UfIo)2k{4xb8+)@nBSR6?k0qIM?^P>TB zdZ!_TnvAYsxkf3<7x|o z{TndUx$j}hO1p&87IuM_n;M6F)Trf?RN2j+V4Z|{Jc96^g=u*C1rz@kBm?V zT>bil7=}oG`5NIjl^1kRcD?)j^VUmmzLB|Zl(NnBn+Yd;n7xM7W0uwapFp^4prg3_6lmQ#MXZ8Zexybo#tmfa}SsQwp-rn1pQom$J<`1O|x) zY_EqtSZLm1Z-djEY7~-3wsJS7g(C9sDQ>8i@>}uTb+lC$72*2JuYZ>Y`7>>bTZfq# z82+zl?MbJJdi*2+)2U>_d*KcNgHIi6)Hp^iWzt(3k#p1fbYy#*fBm@A)hJz>a#k&K zbBYp0vXjY?Wo|PR!sI4@)=0sCV1xN$!Wb4S&laHs@$TpKLxa0&KjjbH#pa*)Z!ck* zaP!OWIM#x++chyAmE3_SnC!iL1g(oK(E)Z&2H#P<5>-Rb^POBgbm~VF`pV8fl>Jhx z5+Qq4?z7=~ZsCSAlle_N@-y)u=WsERw2Z5R|ND2eRE5*LA&w_lQ0@S45BBrKT5e>H{+LHbh!P%Q)2VO$L=(06&IZkbdsd4?2>i2yJ>V?-rY808ng7; zL8du7w-Z%YuXZRv@Y*CTw93qf$-hVnN#cBY)mUw1ACIFMk^arYUeAs(RE|(N?yXUw!w5Xw1fe(gHkltLp5Ohv1h96t4XT#9?4QzG8 z_>n(lQ5`+*CkVAL@H=M)31Fcyh;CBrY!DLF(YCjlW5cZT;ySwhG#O%g5m!EGR&dgA z^sk@+Pr4L71U%XhFj?}NZf1{$R@yq)P6AtaKWppCy?Ms)!0o7#e>z;uTN7wTd{`TB z+d}by4lS;o4@v8Jy&%wNX;<=1b#D=i#2uKFyJhRwwAH(93>I(-+s>Vj;yjXYJ-5A+ z8TRQ&aw6Z5mGeQ1aW0is`>cX;aXwsS1p z{M9(fLRA)ldX$_BRG8(%#o6Nt>VmRi59EMmcy##BUm)1RPz3|TNJ1Rf+SX9^ZE&NB zTGE(>U(-_eqTN_P7I1(e!Cc6;o`5D;WI`A9bkCD~4_J$f(gKCWKR} zGt%y=g`iOdo2T-0H|RMECzgwco4voHKr1(wMJ+MlmFEzI9az?WYVjs6wrNfR%?;7( zg8RwoQ*|$c3a>Bz`X;w2ZJ2eEdNL3w`A{kUa1uuL+)@x3q0FtzhF&d@l}R`8!iyhz zH&nIhJCHRmZ!hNq$8P`=V*H&aXH2xp?fS5YRxjAvw(#)|49 z>~d7BXfQ)FU|DLPc&HbtN6|22%sFQB_>(sg0FhD@{(V@X5hY*qpqQ+I!ss^z52I5B zc!wMNCF0Ws&zR(M>hk~P?wm4|r42YM`CXqhM!E}H`VqUo_rX2;OrfhevsBJ7o0pv6xUN}P!Uw(p z>@kr`Pz~G%4Yji{Njhw!#HWVpvbCtjon=myyfmSE-LbmBNV_7QxfL`F60>mJ!>*DW ze}AMOq-b#lEW+uZgEZku_wD@nTSBjuqhE74hyfnMl38(Dr@qQQm3~MGv+Fx>7V6x( zMj*{o-x2X?g)6-up8>gXD)_&cOWbUSGkcNEN9wiWcXw@xzVbJYI%?<#%~}sds7j;4 zv+md*RLX^E19!lgMi6MDj~A^=sl!uYNNz5}jODNRHpMx1t@^p342RIYL+A0APQe7GYqhT2OR>$@N3oi8%9`NaUQWVk%#nQ`eXupxknreMt@tqc z=s!bXaMbdSInS=x%5ciRfXa8A(B70U@9U%hW0*2D>8ldSssC8Y_FEFFL*xNKF>emf zRy4^U)J$k*W0qljDN;$u*lWTL(eua?=A*j1BvZX4W4&2Sy~VFkjF&FIxQ62FriTTi z-3lY-=byN>i{I^Z$|1kstltNJ8Qr>Ep<^%zgvOn!q5x30DA7Gos5SUQv`O$e1Oa&6 zqJ-e;#zM{xg9SJ)w<;q|kBc<_33Eh`fk z#ohTkDD8o%2%b>AU(f~bSQp!d$;F!4#&#=tjZ?Jy+TBel>|ZuJnGMwv1S#<1xNw)6 zGHAsCl)tbuB$2*zB9R?!r^)yvB>aXAM;~JA*Zl4^x5|k%vu%bO( z{8=~kXh*)f=Fb8@9FLvC_iJ+jyGtqbW{#3cjYbOky z-`U}H&hJe2Vw;ml)Cc%^Z{gRTJI6?DN0}&j9VQ~;BB(qI=9Lo3n~-PUKxJ=|WoP!t z%XS|&_&}W#XgOIcXKhQRZ#IklR43+8b%&xO+$Is##Df{;d54UG=ER{<5VA`upzP_=VG0WT~0s)Ip45ZKSb>!Q2bS&WTo3Cb1AwqnEE^vu!IM!QWk(;#+Y^ z$R8SdbeD64QbGL_C|ZD{FJA@ejC+qHs^_VY&g{efrw`ka#4?v8Bek^)6RM=@DZ88T zAcZ(e`z=AA3Xlr|C!+X9wYDDh=SF`B^1nS=#;f3Tj9}pGyFu#rWgEOsW7F5Tm2jy8 z)6^sA!LV6gjo&2zR1FN4-7SjTnA;e0x#^ zl8{(aBzSjCh4jkXwJ{NhjcseB+&Sq)L^8cU4mpC<0--fYEHjk_oPMr3Yt|=+7@*E! zJ+sf0W&}X%|KT0tVH;$d#Y`rAEUpD|LOPC1!LkIH?K z`&v*%i{>4WB}wlfw}<_o93sJ=)z}AK9l+D4E0#tO3nel^^mHO@RG1LirT?R>62N!c zLeQh?7Y^tv6X z8H%Bzs^YU(nJoqF7;>Jz@3-w_9tbH}k7ybI@R8jGIu0M604yZV?XPzrhA-5QsOGe(P|g~ALi*|hE4@} z4^W0b@G)Ncll1eU)t&HA;Fv8q3!2S1+=tRue$G-kgn3Xq(yG^pR%f0oy~ z$!q!`%SnlV2moJgP{8L?1d5H}_0mL(t__;<;-y53A)lLEJ!xcMu6Z~vJr)pzwtoNC zZQyTcMS}RnzdVcFm<}&xurQB1@(!HG0MF1=0DsLK?(07B#Ud2-XF`N6d|OQSj^fXM zr!QyrR0WGs-%@t|aUfp0?gb?k zEg@(JLahUj#_OzZT)AsWQQ{DYn#(4q5klu03OXkX9v=?i3Z-62l?wq*oCFA4+4?_K z6n_qQ4T#w=gq|mH5#ggHs{iOJQX!u^0vPTGR7%x}aO*e$K!z)YNbOMeMbISYLBML- zX2uf|{{m_XOIOs31GJaFdcFxKE`F1?j>>E$IEijmp@=`KuJWM9|@tR~3 ziOTNlls5s!%2%r^pyI}bh?mPFV{FTqG)=gFt@^deR^^YiauMM5&ibuS=T|^h@tfyQ zV1$xHrTd#u#=?)&>EFCvHViW0vJCVsCcw_ePS|{1TsHo{u0CQKLYD8NZU^xH`s%-+ ztV0P;x_<53u6~V_bi)qc!j8r63Go?B&QoAUx(a?-yvF`xM-)qixoD3i6z-Htw-zx> zDFi@mc*kC40qDcA7eMR_yI_80rrSDKQM8m$jsrn$mo+l;BE6sSN58WpU37}je3RJU zE8r()BZBgP_y5yq%&od>M#6v}JJsmiWQRyF%L84}9lG zyYcBQHZ%YWg{WigLRIu*SQbFf4!Pz4O*)KRAdO|fb5|g2gvejlwiuuV!=Kyvjlkup zaU^{ZxeTz8VNW3WM~~|}Ut78~k(HdQPOO__s(##1T$E$qYP&M=94D^eLd!y3@(QcP z9>she8}qCIU~6`l4-y>^>Aj9kk?G73L_JAQGqAEfx z*q$ricQnA;r^~Zb0RbgZ)P;~%KWA~%VSD!!k zNDZefDAJWsG4il!u~Xm4GCU6Meo;(YyeV}|51O7P_?U(p?}!6HU9xsz{G;mcr^WFG zH*Qh%y7d+ga$m~^Qd?1TTC?9znd3ohaLJb5KZL4a40s;?q8H72no}{&89Auo=}#gH zb)2DW9YKTiB1Y<8`edHG}{# z#N(AyG}VyQR8i+_6kQFIK@vWoP?j1i35jT2S&-y+x-z!LEXVAdIV}YGxn~C$AjP+`ZP{Wnxt1Pg^fAGBqXC~IuObT7ga zE}&>vn*q1k3Gbq!I#$OVrNVKmNAWA4Nj<`|XS+1)_F^z@{ykeG;B5@=_p{AMDO`ld_D#ggB zZKm?Hi+cAu7FIxAp?0BEGUxL;H){V;@8l+(hU8y?OcYq_n|fnuw@&X)0c;0(G$+^J zRw3#k-)!kEg|zj?I+np9plp0v%-oB=MY&mG=r2nMu2?~1FY@T|G@z1a`}`xrN9j&V2&1^0@Nw(M)hB~*R+v$F`h?~D+s-jZZ`Bis2`%o>(c#XCb)~#$29M_W zl$U%+LIXU}^-sK6rz@S9O3S-3!~rFSZJpTA1$nV+gXu+JezcHG9uI(v81xSfV2vOsDI(8I zkZ~{MAKoq~>dU@TV;DmA$FpP8J&$k^f?Xe1?aN3EHB(S{+wX-Cd*k|K2x-@y)$F#j zYQ`-U-^XJB=-6%Xqsi0&ygY~ zpyU=)pQMyKsr~*cR*Edu-s`zxR|Dlcl-yWa`iBjLSBxpM8k=4WeVrp>4Y@H2=!8=W zxrrRj03m(wqhzG;>qC-y^oHJ{F8vb+4J1kwsy4n)i?9wuMX0je189bckog=< zUqZLjV0*d0dj5Mu6(o)|qWiZ}VhKr(ko*K-a6Am1>o3C}tM*(hXxdUCgCvrz6)EIj z#Mw;hXpjPu7f4RlTNa?Cx0_zoA=sdE!Ix;XhSl!`hu>YBfVGun>MAKB8lwqJqg{WN zQ>=EGlrm5N>lX%(pIR-RZBMn-Ps4fVd2Rp|T9lZW;%KZXpiq;FFPyjyHP}l4VArdk zK#%HRfO{x6q>V-n?j*U~L;te#(RTzP80p)xzSCO)Ei`1pRRWxV`3P+c-MZ8&kgue> zd<%&>(fa)_cDMf&8|A_nLRbu#B4-@Ffh$~n6L`-QMDIJkAg|ZU0!PC|7=5OvS>c~C ziK`Cu{W@&IlFuKXkpUFG!NvwepxPq!5R1mPc@51blm^}Sj-UkJ<>DG7{Dw?MLo-AX zcqJg~gDxUqjxqAq>Nh!`)%I-qiY_ySp0L_{;YMAr7DEW3YM`SrDq!lIDte_fxF$IQ zMmKp+5L0D&hp>fRK!Agjh6Wa(n-L$S#F4qdelN4GR+(qMuV~0ekh@%MV4pKFT=JMTrlR z^%u*-xERonH?>*l5p_?zKJM_n(qlF(rHKzweh)gh5G*(#^L(uwZO@o^Sf4fNaG-`v zzIr9yqUielhK@IYqoP>N=ycN)O8@i1um?Fu6lM!5m@nq!_J2>N*ltHu134Ri&60y&7QX+4k>+DHa7AbVGG)a60 z{U}UspkEv4KCRL%q3g*pGCr{Yn4>=-0AT??n}c@kwK zHUjifC}U~I7jg`|Exrgn0#w(Z(;E{(Z@^pf3l5I++Z(v4d zNz+#Fu&gLHeATD~W3Q9!^_uJ0`6Kn1>mhvm@N2%{!!J2#)9IvTi!o&XEz?&fA=l;_ z5eVu2(0vYx*ddqgINoWn_CO6U!x=2m+@%Zq_P2iglUk+&ExZiXzF0+5gv?@p9tb7i zhI>$YK!z(F4Lt_otStJJ_A`qEe(d(9B@pqkiR!6R$PJrOvY4Q@9iAz41_8n0t4L|= znupj8_R1|y7E2yUbNsR`K*+6ep$ipq8Mr(c)m2M=DI7ggkFJLCK4^rEu3&@hKj#B& zU&r~lPBZG}edN1Ci4AXlR{u$xoaaeue11Y0(FNC!qU~-T-+I4coYgnUlBj759tzb791U#saj|SuRiI~wN22kC%q#=mCyYjh8D50ccO9RDuy%4!_ z&t9qPYE7H!LkNCorgSt6(nG~0!=>#PUH@UW)T7D7mHdW`o`J61L6In+`d`}$vil#! zuEITdHI@}_WHqSc_RTjy^Hg~8v1w&XBpBj@5xO+9En=upl5E41Qord6%3N*x4CO7f z`WY%XY5CQg-(^)<`=pF)IK%+jrv0`A99=E~q|k|^wRTM=5!o!?WNu8rztQA`W7GD- z>;vT0ufvhP3k+=T%Xgv4U~=x?W9_jbMk}zu^6mwyT;jhFQY(8)nniEH%9?8lWl!2J z68iAn7QIo1?Q;kF2*r%`G^Z;!nVuCd^F6KHN7B+dw?V2fUxCt^_g3zD`DlG8QoPSm z-F3=zyGr7vCkTG&f)s$k)RV%I+T`-$8K~QRONe|5S`c zai5&Oyf0{s{&vsRWNl}V+DKDW%R1G8P*N#H2~b3!GQFTH50!^2#s5IBiw~f?akG8C zixV2>?{m`so3DyGB*|~-LmafP)RFCD+CYqG`hMYsyA7H_E*`MnIHtI}jutBErf_^< z_mzqdFHW>Qmn^-3wlp8qBDLH3RVzZ%51h0qu02m;1{?z!&huJ0p=gjsz|WkV zI3tgG0YYS2TEZ+F55_-uadFjG*BNVrD`P}Xw(6O$Io}H5-y>K|vjEcNgxHX6;CKoo z-veaoP+dsd^WU?XFEXRZ?wR{mJtfp;=X^Csf$_dV(`P`Sa?Qsx_23E`C#`w$+eKCr z%lKd8e-Bh{K!4`e?4Awy0SB4mYhgpYSb%nKvnW~JEh_xOFUlN805?Kh|J1?RXC8$v z!^t}R2`C#dR09)U%IKwEX{f@S_+1GS7LO0jqnHUmEF6dg7ZAAIjZ~xd{E|?3zx@>_ z-0ZS-0u7Kl>IC@ss&Nb!jPaUm=feADZH~mV;!^czgRKU%O}5NkKEby#@Ahnf)Gg@r zYI`C5MF2^8d8Z1IaLBn)HAc=-N+TgarLUi|jI39nzsk4G(`$Vo6F{;lfC!-dN4d8r z4>$9HPCXIr{vFz|wip1WgCF0r@{zV{jCwPgi1wX|E=cL1`ozNK&26ljsXxtB;4S{c z1hhSotoiu!*%7IypbPtU_N8Q!6e2RFpI4obs^wKUeN*drh2xf!@5bvz{Ug@mqw#kf ztq=q)SDeN_;SU?(37U>E796nxC-Y65%_!DI;Tnqx@qJzS)Z{7f&&d)iF^F#l za&N-50zAa%fNj0pQY$;%J^mbiXFY3nbMEq$zP(Mn#~gtcU}SD?lD+`~OfJS7Nt5Gt zJ2H7OCDo-Ve$URBje6&zoTmLe-PotD7(!2g#NR5T>c+m!)G$~$0 z5y}ak)7AE$3+G7mzs2SWfbOnbiomh`=kZ`9%ceC2WubJ+tWgP5_W!PSUe23L8dl~R zGN%j0{wX2vGfG28z|G{?om~K}xT)zleBo~>$ywLiO|)sDzrbAyER}_kx0|Z!IFLzP zXI*#0m)VYS4Ivd8sJOrxFX?j9!FMLx#Exj-;C$DM7Q{r*nH<|)O?;fN`TfgGUXX|eDn&HhQ)>U-d z8;nYK3oE9`TBNf+d~`0q_{%MC7&F+DPeNFM1*lBrdWX(4b0ISwNU(|WBJoVopk*v`|PW~u=nt9{pEwL|^^S}ik?LpllpCGw2t^3GDysI8-v1>_!6k@D~& za&S1om`T*=S)Lry_e{))xwV1$8A<}ri|f7Mbw4VS7x`PPuc}M}fFExPjo|m6U{CWN z?$7zAx~g8<7h-?@iq8BqS%|hw_+*=IjtbaGkcQUPi|R;vOQ6Z zsS>%%C#n|<7x3pF19a;uRpYJRR<|(u*6Ts)y(&cf3*H1q*;orVsF?Hr6>xh$=-W<++fP+(ipmblL$j$ zL@NG^W}*~6m2iGEcYeI86Ji1rv6{cEWKvp4AOda*!bRb&l6R`0=dU|O10zV`95o~>(O-GzF&R(xi0;hFSpwvZC#38{05h%1o#hJ5$N#f zz5o#7?9#uO3WWSJ!U3FH1Nyiz;^RqGkdS8#b+=la*^<8olV-{)CU?YPIDMlKgd==% zP8C!HG_4M!sqF}}usjBB{O}Ahrf5$x0A9P(|Jn9V0}M&xw4?`^P0B@4?E?Uds)R#c ze}lTI{N^Yh#p9Ae2rsE1%&veZy|Y(q-WzPVLagVcJe${i!_?8oF(lmke(iW1{{=^$tFQ)z79^2PuV>mGG2+RXkedI zHy`^t{pR8T&(Pcj1`IUX;=xHZK`Tbh0~auQH~aVQ#6PI9yfRCo0KWX;BH@AU>>}Dr z%#e1yknGmAST(v+OwEv0{A_=qsV~FyE{2Y(8@H*#$4Z z&;cPs*c1yCHgTfE16fz(+T=qwj%K~}Tk>HR)yT)e-$j$w3UbJK*zVO321cX2BzUn# zu1~YD;YgsEV!s=bpo+4kinh?!*TTFQ>l5AmJ<_5Y| zW_^2x@9|v+G+V++gCDD_e$hswF`ULQ*S%M5V{Dce#u`WM3rca#x`_G^sJAB}UWEdH zXZw6uIybA4$cm8zM(-fKj?p}4y)TT)C;vIV&OP`Tzhu1GIQy*cgaN4h7+%r+i)P;+ zS>bulhTy-;!3Di{`}iSgf>^)AY8d|z?FljuznKn0$sNe%AgM(%q9C zTx6>!F+}M?7skhE#U;QJb3TeVIJ<7YKo z*rag6l7KtjnM{+bpEvnp!Nt3${YdRVlcDmo7x)h*HUPLZ9Lg@Su-uqdKEjewo2Mc zn$^!%QRSG^`Q?O8991-f-ak_h@@fm|Whj-y|45c7QUZ~p_uCI~nSKB`4>k+Tk?ZsGUSh7N0TC<^LH1GLTW@IKNM)m?T4>s)O zpXU!J&pqC)s4TSUZXNE!+H`q>#O-&f+?Yh#kBT^ClXO7WnT|hD_fVvUb+?+sXEkct zrARNi8o*v9?9-u3zC&H&_u?JH5t0?~7~?5dDE}~2sI6q=%1aJmih+R3HS#&Ep7ZAg zm~g?RtqeMOaskNu!ZUBkzL+E9pIEvCo_qSP*m>Emx=h%nB(3X2$?Pn|#2Bsqtbr&b zHdHCv0ux13m=wA71j?#W2x(#U2$KA^n*tEhR09|m@?5O6(464~@u@=2e_xX3fUQ3V z7rwl{%%3>IUKJ%iG}ad5ERF54U5ZJan&0YW^#6Y^z*oqPQO2d=@F(I7SuN(c6AlYO z(&>l8GurBJ;$?=JEG;S>%c-AnoNQcBo>F$&o zF}8RA5AWAqyRLJ7=iKKxPu%x&%zj^klO{dx`g&{mG*)m-<}xP93d&92^~qh`jby;r9-STo1WKLKq%(4`-aH8kZ`$}` zKj3|WkHh!!Uhy)Qqv{*Y_M9YiB{>OhQ9rDJgRvd`v^3+1ij}zA{$@2V$U_Tt3Oil| z<8@NX$@&^EbbYiwkN=V*Q~(CNItPqn1B66d=)SoNc7uWi(^f@Vhub42 z?u@e0vhJT5h@b-1l%r3c&f|Cw3rIs#Cp8D3&s#tGyslKtR-zjSN4}xe9qV{(0a({2-jdj>DxQ4B}x_{Vy%#6+lFu!b3?Dx;C$nJ;V8Rd4y9{c;0oe^OW zV33bA)mRTpmVS&_Z2QFXgn*yBQ~OrMfAg4QbL72@Z{t)R`Qw{N<{udECuV4(Nmwye zPwFjMx-P{(CgJn(;}tiGUV{?t_?3I}?);)p)u$Pres4)XkDo*EHdhZC#;(W2bqXW$ z;5HKz2Rl2HoG@AD&-MiQS2fa5xnp7))S3EiA=kD0lJr!;fmlPm`SR6v3U_DV?W;S6 zf7glsBn0E7GV4MTtzNJ7a9$@z_8iJB4Q_w+O=Fg6QzARdDP?B`-nRUUst-@ zf*q3R#&}*c{Bl*~WnkvfQNX|N*AR3qV-2d5bK)NduUJ}~7wT&95(|UHxK~&FFJqup z!{MYSQ-e+U1P3Eyq$J%N#~cA6i80>@bbRQS$6I)}?M7ZGHC9NUcB zk+j-+PV1tMQ5w7)px^kOXC3Tzy}gIpJ6)xuOZI|c_OWk>&QG+c#{AN&LkMZIYvJW1 z@POib9%#-Q^dW4vD`H11jrDt;2D^~V{r(=juz@cPgGh?1)mGyUJ1#TgHxB+!zY~1> zrNG-BS)bw~T!8dXTwSGd6}5xGVBK-GM*QgUNl^AH%BkPvHoG`0(^Y9>sa=}8pO;U z?v2N(r~l&p{XYN0zs4nh3d&c(-(eA_;PFpmyV0p}vwaLWpftQ7J$<%Gb=o-vl^`Z| znd?WB=wEPL*s}}4A6!bYi6x4f@!dn<&2+|pHr}z!&9650(rY(fu4A9?-t|{OT^SZ# zZo>KI8LAPE5BCgDMh^O4p3mvcoqNW3eA7ULUX2pD#cvJCT^mm$*M~_lt(Z&N@EG{% zoAf3(wM4d2FJh)_;SB5Tkv5pSg0yJsy{9Z)uV| zWPFfVF~$Emddo9Uxmq<{c6DlGKDOyOu0BlF2c9Zpf6TERe{5$dNInS{E#0@bc`w5d zD^BoCoJr0^C{ty!P_`52jBS4NI{aeUj^vxVEVD!V&lx8T=mrj>rRX^p7EzV~g7f{yu!T=d^l94cYDXcC zH+DIZl)WW|#9YmCgsscrHC3D!HlH58n4-_WZE4~gp|qPCEnX*}9`8*C_|7Es*hK|` zwPZ%kM=_V)Ke1-LN%cZJhGXG{l*q3Rn4tkZn!oc4arom%>1qX;K#ygGkcUx9XV>2c z8JltcIvYDnPqB4@&4}0#M3Trw&d7~j_itZ47zd&-4fC@9-X%Ya(W&NdLTwM8axfyC zD_`tp25$-eV)qI(4D&!%63ig&&%ck?VRmQFzKtdD93er_Nct!*j=GoTgq#8Ajs<3Q zg8+Pu;rgrj?r`3EWW8GEOe^OH#BU<8j)CuPrB1qI6QBKR4rufe{mtzb;+mWsS0C`B zLQy&B9EXeu{bz3l{1Np01M_ySoH*JLZ~P$S-O=XFhkCEdYP*UnQj82B;KU?JKv~Xx z`1`)zd+IHzXEsg^k~Ic*A;q6&90QAPadFcRIT{+|B^RdknM@1W3G?FK$2^nFoad&& z8GhU)&K(ZT{wNHVRTp9lvbuSqeKODgcPEdK2(7=dc84$m>4f(~Rx7RqY2{B$KHoav z46WMc#AJEl@9*QI0z(;84vO}qTZRv(k);=QM6|+S1r@%>ai9T9MG6KN+0eN6awdun z(KN19+&TatqSB6NTk3nO9l+;0?FIf+A(`hm3RmL69H)X*#O*fgW68`NMc0;5_4_82 z5?g1PNf)?6HvwsDID&K(>CF>)-tey4$#5&uXXeM#7f|*s+|)WZ$%P4?#=P@IHxX1o8Bb3MEe((hr4f{szdfL8n)r8K$MwsafXz11)vYQS^nTw(7^yTnd zI$EoEkS(6opl19#$io8d6r0e^RMPnq!;|@K^x#IW+JI-(EFX-I{$-q$rMz-bljDQu zCTE`iZ2GGV^1|%W!7I`iU4<7yOAMdLExWy`#>RQ{E>v_;GL(zlWrnIMX7#=-DYC0x zjpRjFqD6MfK{7aG>5QYr1p)1B<|p%X^RGRPm@vq@U)PyDZy{>68^?rx=f9e6#N_(b zmbOiM+$%!5#G8vq<=>pn+}SDVneZ8*B!{!|xK&X(yw6-k5-Ee#P_!_uB*GUa`Q|E-wTo*Yju)f4VrK-?nle zFuOzf72>q0=F@oG4lH23KU>jTQ*Sdxdm*!p?AH%0i;-2g3S^eA(-^m=etP9<-o}7@ zlEt=vpc5C1cH(~`yEp;zDisr#0tGMBzr46m4tj*K)lc+IGKx6JcwtO3;gt70cb85d zOvo}BN0)8S1X*Ox!mDHwB;0<~zxv(L~S|}?uDIC76m=n^CjX7`5 z+^aVIo033;rVc*SUt!=0bhF^|SWqTo&@m+V20?Oqr%@gP;8i&aY0IBkL@Wyk2wbbL zy`m%g!3riYw{SH$?9}f9^Zg9Ed@1wCz3T2GATKA?n>E38_TQm|#M}(>YbIo6X-G_6 zlFvMfMoB}3zPT=~@$~iA&bl_Q#+3X?_=f*OQ(oSzO*rW!2(Q%+G4bK#qRq~Eimld0 z-uHU-ru7hmp++($vxND2` zt32PbpD;EkPF2_(6+6_34+{y*9+balk{xB5L^?!0lU%4A!i<-&2SzT}*jy%zh>kQKi`kybZQi!{Hu*#)u;+-Nx^R7_V1oGS^p6y1Q3$ zoj%1=bY;@HQno7K=}7;3tB+I#1}N**+u^yAssiO(j5u&6_K`KghiGGM3-OkRDV}J5 zLt@jj@Q{`@So>zu7?#6t`f23X+|K+6TAVL%IB&OWa?w7$=7A^;F-`dXz0#ij%e=VM z$3-5r99IRN)8nsRkFaSze`JyW3|+Z$hhw?aur9|oD-kG(tRPL^C$Fph*`iKpHQHNZ zHeo-s2t7Q;(xHB}oOiXq3RWpHFpK=|2PnAtvB&K;--a8L=#gTI-nOf6J2$G(Jjw9G zR~#jc`pSF5?KVs;BbnJJE$%R#B#HfjCph2Y>A9SW6EQWz@gS=)=^4Uu>aU7oPn_33 z@Qzu>b~{i6$twz;OaMElfT^-hYiDq~z@9Hv@xA;cWtoHA%XA!OJR4WrL{4dMmP>v> zjz!+<@8w&pTK@!zhZc5$cb`{nXm>t-dsPFhxZU0wr+HBy zo2VT{!||Ek?>NiU??%;C)I*YcQ}^S(eP+ACLT=oiAe0z-C70=c{WcMq$iFWAfL)@p z`>M+iORiEFWPE|^x8|Fb+$nW&anW$;V4pSPxNIGd@0%{7OF&`c(lh7t$%#y$hP}h< z1z$BvBkSOz?ao(3M{h}l0ZKkKKECVW`@9|*dPDF;4g=>bCNG&BH%U|b*hEfTq1hr{fhJ~?;w(+Fc38bcqvxsB^RkO@Isg21SliG08n%5>TeokohD?c^pZ9oUrA$bx zv9{IZ$+LOWNG_tOay8|;+U6U)&Xnv=omD!ZSt!>|O3)AhRWj*ls1E4xAzWhu7 zPz=@t1FS1=^@WUIK(TjQNNX{F1>rw6IgnzQ6sT=?MXnS@&EOy07w_9gzx8UAt-=0vojq5YWq63S}er??PD5GG2 zF=)xSocn19GVZ=;`geb5J+|B2K83h?xvuhqUE1>6uw~$<2OWaMPJx_8h5=!dh;iV& z`_qv5pwe45akSB0qVkIfGHERr z%*h12d%?npit-p2<7&)ZU)}Y2PV=u2)d&q7mBH02K8?ynFx%uh`~ux9b}!UBZKq%} zxKx+}uPhVhx_5Km=(pMB&erl=hR0|*qU=XWQx~L_)f&DPcENS0;77011GUFHfISjr zhga6g2Cg!ZopuY%gT}TH>}{wZhq6|>jQdNko=&4fY`MsE#^R6IA3A^K z2*UDye@>TbXq2V?-uvk^YVu(-Zh+(Mi`!yKE*rDVxaQqw5=U37&(?Ao0*KiN*a~I` z)I9YR*p7N+(zHuwsP^rhx%Dqp+)*dE81Fq)PoI0=K9%u6W<%kGm?ln-A}daeOI_sx zJ$56Su;@O%YeK;#MO;#}zrM$Zt~oB0KcTg|!QIX66QHXFn#n@snMzb<@q>`Xla(S% z3o9p&WpxnZ&;f>Hl5rQBOq_%3vE^*I<1f(Of?K;{S4?8+_|t>CnxFZb!>cLXSs54< zAszE((B8Ju?AfdeB)(k7p<8-havH^%kRKNVh)kiLa9^sAdiKepj-)BbzQih~rmtde zkr017^ps+A|GzRST0Hx|WcYuvN8V&Dgr;gF!-Bf)#z8i~c&2h9l+O1E9FA7It$n*{jo5Yur zap-Z{Et?mu$;S#O#Jj>Uy}7+e6cij!XuL<`Hne3AfU(#!lcWA{_7#tLP~{^-Jyrk|x)vVVW)O+lyySwy;=bTG zF`0qerJQ;KNh@aUQfY=`rgaxqNP4I-XCNgwRSijk>YYaoEQ_yiFa`UU)Dk-kM$M7L zDKW!9`0Q}ltSgHa#ZFHpa0^7#HxWzQ~I>&^9 zJpcH3zu}MtK2)^?6tb(MxPhA853Xh8ZsW;~*_>L^b)||%R4Y4i;gPm86jCI^bEg(R zs;crd5AASSBo~OW8IBdGmREP3+_^-Al7O>3t_rlKuQn)F?>bz&a>@P{q0$<9O zTHs7ke-Zq8ss(a}vLlFiQJ?n=#FIW@4~XBhlF7zlS9hN5OI+yxIm+?zVP;R@gE1*w z$*2PG@sT0FL-gk@#d%7};TJ&FGOD(aY{T-^Bm|jU4XAC4F>} zS;~`idaF%@^^r#p;tyEkI!xW=;hkCM$0(a*FE4uQWU3dE3vMa0#uRAEPN#=4yVQ&#|+^ z+1+W>Yr+t{7caK{gz^rOi0^S(5Y4?+H-l8qoq{PG1x=*Cwd^i>1fY1-0f0o)70!-JmG_ z@9+t&CXdjDGKeD&lNYJ-dKPpjPk!60j6U)|Q8dvaha=Ax?$myCjE|^Qtfb(vp9Q$( zi^$)yag94$PfeA4R94g0=5hOalM^ECRQTuLZwbdiH-{xFwhj_}99w(P!1p(6i^3kv za7;I25jSp&mQHEJA0~l~hPMmlE8GrPUl{*wFi|>%CJR3mrNCBT^a5coY#22QCZ~4U zUH1M2cfE(!YG6a!0~W1MjmIg;yNdpzi;YgZ&eLY|SNvFmHa~dVvFn^Vmqs7mdJ`|) z4YddE=ss?t+LN7tvv#Ze2qv#rF(+ei`9X|9faAL|Jeho9Cy}*?9z*%P3A-;_o+Mg9 z6&0NCWx*5skt4@UVhGIwrI`}PLUv<-RC*M+&PtgUWySf_zKqR5=*^o1kdJo*s+BV* zjzV@>V}EY74)XBE96%X}&ik>F`{;00a6N;R)1HRk^ig3I)5z7EsRFf&(kVCqCaKRR zDIvK4*AUxb>lX)poO=M=ONhta;=fr;Rz2#HetPnhm-z#h^GYC8+NZ~BVF9NPvRnH6 zB%{0b#m4NDq;-O|-MBcfB*pN4T3h>)UkOLh6+4bvLV|D{&zi_ll%}Aqwvjhb4XAnf zuo}4iJl@|hNq?z<;+*JK@y2eDt1E44J*#kT+}$<$8CQn(|hF}2ZyWFMX+H3zC!V)Au9_>v3TZhQ9mH%3xSv7Guc48*p{*ey}E z{(}PPyywQ0Rn8d-O}Y{GNbjB-@}&j|?G_?-VM`R7~Fea}8S@ns-?k zTD6nSdlP_<6nuqrB6-uvYGnRwa-SVr2#!E2$sj6QnjY{|CD-eb{hvhGve|C=vn8lq z9t=#-p-&k`#fzz#ZcF)D*HZl?O$9HX6bG?H0uARG^T(b@JQVz!BYqXcjVjy8Ei1U> zexd$$%k^RAnwJl@?|=KY528HbB|CO*Qh}=q%B$<^WWBzF#UQt{yd?4e+Zt%gpFbkt za+x&!C6Q?5=kQrb>(v!$Thb0W=INq;HIVW#b$Lm;aqhCQ)ZcCX*fU*nhVy6JD2J?@ z`zO$4AzHi>T4z71qu8DHto45zuOH-Qg143%{NH`oQvKNu*f9NBi;0jvhBG zkNehamw=fih~<+htfBJ+Coa3LPv!^JP0C5!zHn0|H|=L;yEUf6qW{((>aF$S8Fc%& z6O}E0XJpNjFka3bWL}dUgHdrB(#NzMU;7}u4`yLF z3H%sRRp-DZw*vgx0yBOxsC_Tytf;!!HlDnT!QocQP|?9MpO)vp^>ICGvrFpCbS+Lm zJ~kW}8!y+7%6pAjBFAdW^d5d3)_r^NWaj3x{gs&X-oIzed2!cDp>bl>I&3LbvE{@E zQBLkf8Pc8fk9quIdbQE6or)A(VCm+COLT58-Q=8=(2+ByQGFye28ufseHXSt&e#9pF6jlW;+ ztKDFPLXz?)f|#t^aX1ihlN2B6`}=Mqi^c^CnK+ZCUJ}_}0?`&0y;^j>=K2HpEwKj@ zy|W_7Z)mfbZrgqJ;|8I_3@so^xCyk@_;K^(2A?0+UfsKbu6luqx<=;sjR}<6jDl8*H@}?szb?mNYX0#YuQCgqaJ7_>)9F;wEw9B^t;>HUTG+OZfLG zBF)Vyj*VY+5}r!r(Gz$_&h;T@h{dDdLLQXX83aO+{su3`kRUYI&xZ9Muh=I6l5zJp zR)5q!QdQC;Z@IOVYfQ6^=(AqL^5-{5mk0f=Z{ajSVr@i_buGV9U_FJfAdd8xNqN|z z=(=}htFwwn6Uw%33OJWff2GmjwS3U67~ko;}ot zX78agQ~Yg`MRwe_yXIT=V4{em4xh#+o|Kl(ml-iV5FepMCI>$%@QKOR(fLwYkh$2c znaX=uC?H&!_L{@rKM<9$kJ8uQOh6egBI#Fi|N_9+3)&aZD+hh zClp?;kG#x>?b~O8Bo|H!ChYXAxo+J#AQbBj8y`tv--r{JMS9Y62kjkxh;`6zR@1QM z`Cq%rAe;x?bx*6E26;r)%WFRcv?T-T?eZ&X6tQbdOQo2(pn~&y_`F!`7r&YS>@fZY zGctsxJiwRdVMK&|57j=3iE%|Ng{;abuZj#uekT|T>f7L%RB zGb0G_)ng9Y{B8Zj_42pG*6_<#SWIH5S7Tpi#6SVW*qOb1T;lTJkjv|IoxAlMeU$T{ z^U8#7pd!poLpDU1pBX4eJ%vq{0QhaJSfVaV5%R2_H(yjKDr)~FETLKKry|c_G*7oY z9*_PzMUjkdN&Md|if&wE{Y*Yu$RQ>%?dOnVraHt@ORndtS*Y3GXHL%1iJc)A&y!u5 zU5RmoQ|3??IwH(!RntI98*#!=1>|ZS?aYCLlX#?r2A-=Q9C=DnMB+_D1r5a?f&n){ zISK#g0#s(E(b(pXeF2R_0J520iY7FGHNz&{S#VE*Q8%e90rWYL#^Q)vVDX*fIp3^f}k$@&2N9Xv7~u}u*PALg9dEYczd}8XM})+-+AVM@VPtx zM9bbuu*gVW<|?jx?YTKOlg;#}$!#a9F86Ad_<*l-`8!4zo__lAAZ0bsfxX!KOBT@) zgiEe*vc5`1Q^MvkW_D`e{27F1w7FQ|W+&bb>+?;m(5l4cFz@4|YrF47Cm9W&5uMBF zGX2~`I}PmYvH41Iu(?@ULEhVuDqhA)eRhU^_^oD$Q<4dTB^I3k&6i0g^ZvEs~_zU*8 zII)YEDGWPvUxS=J3h=rh>FOv~X1+oJl`d0TI06Y%LB!blUCL&-wzw2w(Qpti=6uF? z22|gPKLqjsHmu2~A=oSrnDsYWgXF zK2Ll2&(c_$H`37ag8xNlrsdlFpGl0($l29X$vRA+%UOZP>P~YH;mlQfD6?vcWb}sB z7vJHl$kmg!_WYg&w>L=rusi?eMg?un@MLFa1_V58^jSk5>jPpe$Q)5{faWGc%1vL7 z7cf>CAMiz@JL2JPgr|mE@yzJ2zL!Yw+4rG}k+y;r*bLG-6M}E3lC{$aI#$THq%O2_ zn}O>VvctbdeyHcUxsibHhJ0&@xn&zGy|H5`=~qaS5+Z*2XZF8J@NxP{#!o=EPs9;7 zAZjOXHE#z2g|0fj5kChB5gV#(I-uaWP{LprdD2)22=?<#%FXI}<*&t~wYqF1s1Z35 z%e^cD==ynK=Oo_&1uiqFc{6^c_{r!DoVKgDok0d8_D*1W6dDZ2k5S)Q{N0q*q;yN% zOoM#IY-1IPs=oRsWcoan(t%gVh$tKuI<)V1*NIvnT;>A9zx}ZDXim>bZBlz;c!#%u z^|?+_6n&QdD`JyW#VSRQ2v(~{fysQy{ka^}{q@*|3TN%;&a(fc5=nhWUD|zE6I|u* z!-Ij3D&WAY?JA`pzyOT>ZD%zWiS^`DY@)MgvGFFmb@JB7%DvAEvwY=oVh^i7vA2S` z(QFKDBhhmaTt_4Yua2nQwBHX_xggqvDi55O_g|?h_D?qz6{|LqzO)U3`mZ z&q5OW)u-8*jqzCn^1`S_0AM<&jqK-EtmLEooz-F_Psj5=RJtmB%s0C})+KOUFFqkT zJy88L+`P6;aGS!~ruxx82&-g}t?6%#mLN#d?z={yccUx0b%8(U0Wn-d9Q`zZ5)owd zna`s9)+o%=b>D!M@${GB;V)4dm|{MC;mZSRlNro6qo}7y@Bj%1c%}pWD?dY(tgfeN zdfR@OPG52#_yn@==du8%_dA^INj%6XXO`85@brJAN#T`aYIw4!B8b9Jo-i&w$FFI} zdp9?)Dh!qB_${BVJcG+!RnmubIh2YjSAsZ%a)8L*8w z+D8WwgB~gJ8VA9rB2!R!lBqE0q2XZ-y6B&ZbMPHF+>r+M>XCaI9(;$1?S2SLmbaez z$%7TvB?E4dzdS+Jwg=;v&Wqa}V=cu;uYn-!%x#h)XQP;_#sr!phZpF;vApx`siCB@ zvNB8g;ne|*L(bEue(z%LEjmDJ8%^!*-PofcqXDC#txK~F};!>tf6O_hQ|Teu1EJdszv`S4Du=A59+II z(sBIqe%{h5%Qd0Qc+rb*w;{FTP%wZy;@8#43>SSmKlWvJ3fx{=c|uEv#b%DIs``i@ zmdO-Y-W}8u@TGs%sb=O!hjo5;gOY)t-IE3DhS8Vn_l!EE984@QC zJ8KIvZ2jI<^G(>Z(!dOG@VJe2E%<)j{?t-Xu4B{LrQ@AJ-itt@AOtXZyyU^v@Hque z0=}uA%4#2MTTZ?mZB%vjG*PQhC+%ZPYGLC~y$HMM^S(Gz*ze!{k?T83PG9G^<`?u`u~{SFrb>bqb%8ptX|I~ZUt%Vq3(8^i=7KCJE3*KvUW$fpBZglJ+jwgLKOki zZDqSRg(E?=!`v$mi}?nY<>eCu35=fyO()oX8wP)xqn$lO&)TM*%wK(5+|R@$n-|5? z3CI$J+KRPx37M7Rj%4*q))aKD8%#XjD%pJyFt|9aLDuzf>C^-9$Y`Ft3ydJ-`}`Mk z7rt3%K1*rWfk)w`N-ikHNiHN(mY7SAJvXal=&V%(_*NNHCO>8Bg@SVWW?qnYJEY?} zFN?(Oe+~X&7Yb<3YQN98|E)1a*E75{f~bQ03J1`*n2Vl;)he1c38AQI#yb-!s9**c zt^|Fn)6a|u_+#eKDd(Bi28ha%QeDb@_g^yf3)p>|@3pnLR_Se$5^ee0lDF7bD3$hG zvT_G+kx87W2#Ocz+);E2DFz}`!>fUj+{u&vXXQ%93|bWoOc}a9>~GD@8II4)?AEF` zy9x|d=@qO*ww?_7UxW_ezL0bbl}Qg1sPcbrWQcHn+dH=WfP9EdD`;{MP)NE#VKow} z+XsF46b#DG*9eVpM7?S6C+(8Gh>r<-X2Fli_n=)QBrua2##rZ z3EvUd-eD$Co4hXcg%ukM9vW%WXktbYL2Ebk|bS)9kfg^E&SEm4(x}1DbR>5 z;0I|Pq;q|uE3uhg4uRl_#%ZAG0)E()?!!N}?&adJy7mz=%+MB`>}}2N@{~Wun`dEB zS~D=rOxD2O2(Hkvc@3okTw#N7Nr~z)e(-(RQ9`%V!;|SZR{Ob4!wix!>8&1Z#!pHC z?nJp`g5UC3Cq)!=^Hhh5@=P}VD2a!lk)y1h*_qJO9Ub)f{uWnP3p(J%Ks1mHIx=Tm zhqM}Lh^~5)Dvec9Smj|B^x3*PE}SjFVO`0ArB;pcqDZ?3mWOz$ZJ1=Zkrufzh0&(O zCxa!U4|0V^A(^u`EyBYwWAFh>S-!I#|G%U{69ne}Ro&>P3{v~uGe`Dt^1K~&wkTS^w+L|IalusBav|C7!v<9Jf5wgIkV&?PmL*I0gB?8MmQ}sJq$nJKfK_klww05V;i{37PdZUqpiS_wfH+`iUjHjV%z-nJStL)qo+yc)qAPvKGq z?Nx)?ta$Xkf0Aeh9cWHGvU`#`q`x(J{bw} z_O>ReJZ!-dUoVNKtj(~gU(Gl7h@w?8&{%~&*1!N}4j2g2H4Y;5PTET;{{bR`9k2L~ z_EJmb9ykH7HDp#)*<`q&!rK$olsSC-(pzayAoeiZf7Uy90$K4+g$d-i9Gs5BC0{oi zBGrvcHSy#+1Ry079jej$BH%KJ8)ko%^cf=ZRPX?=Cgdt_%8f1sqLAWo7^TChPTv5R z+-s?7j&$sM^Z4}}^3TxMN>4`7|F+RdZ-Lkpsy8>);UkvF=i_*9lc%+4q9*=wt7XQ$ zUn9(#*1|uDNb(6$ceqmRv<6N5iNt!telnk&+iC})RA!p(8HMbWj%gVHtbm$7BM7Z7 zFaG3@jgCjC=Z@_J&m=t*WdRC>q=0Bn z6+n{(`um}y&`CzqrbxM4qVTfc0iY2_G-Fa{rsAdO^oJTE2oZViTXjSKFJE?6*O7G( zHKdFIfaIfJlE6@Qw}4?|QRmbobU<{+zP)gOB;AK(FZ0_St5)uRO}5$wD8C$+DTC#A zN}eVpKQVJTKQ;`Doho`&O+PUj;}*9ao+&|>3H^RC@BtJRtqFLgpFSifbk_ycV?Y1? z*%I5O0?(^4+Nj@KQKen+Tj3S2MKSGfIw9G}^Q?$l;|tORgYv6hFg=&YIQ7e>a9l{i zJyU8&n9)5W_=KFgYv|)NM>mrWW5N@PE;R^NkO_N?%pkdJ)f~D-%t^c)+Gm^W&k6B3 z$if(jgsz=%UfWe2HQqd{zzajXwfAn9){f?Kf%$2>jQCS8HP$Dz>!=8vGd&$0SyU*_1VtV*VIo*(=|RahTp~Y} zBho+oOI{?v@fYfi^oa@Wb}rACq@3!253Hb{j!)~`>ynFaqjrqgVXmu$_-kFd6TENK zP$(WX$;@UmMl5-icJ2H^+ddwPl0$xF8@SN*Je|16Z&%cQw7(d4A2^HL50%fB-(tjw zPsltLuE!25qvj6Kc!tm{`ESH%hQ3ndcC&YGQD#YF#JgkFT_0G`9MGahWQp&sXDK|-!=`^lw#kV3?+q}GLfn0`^WS%y`|cX_s-jFe(gCjfbZ2vn*)cN zVu(+j=aPG)8m%0P;#oiT3(XE;uu*;_z@tPZ8XgJICOAT=ayNR#&Y_Kb7Tsg~ORlMSV&BX+>l=XLC9*eG z_16AcsCcRXM{8D*UwmLpsQddQE{xLkEcOlwh-H1BJPj5~|9(6K#nj2f)z!be`^`yg zz`vL2KP#mw1ok)%QDzDhja)%5rUOiS-!MHhX1L7kVxjT5WO?V;7>Um;eb@DqUYtWUAHFuKtD^Op%FS`H*pQ)@eS`Z_l2fC*SvEeuWRYvr5zrzL(KDV5L0e7hJW$ zIqM4^xOh|EdWgjp6fLKnsiX>c^|h^&BQF^s_UY$}rNo1ObN#t9wBF}XaC{cSyNhCW$v)>li;BCY7r(zfH(o|$%O>OJjh2qWT|O1Xu) z!Vd2H;uoZeU9wcuIsK~`lDZ*kRn_fA_uZY|2%_QJt#^WD3g9^_%|Pvxg+`j}wt45e zOk>p~1oJL*e4N;>bY6*bY)MYdMh4@4p1&c`bG+nTP7tvq%LB0^PW9zSX)S8^xrjpi zIb^LyXr3Sp#ld*}$^byvdFf}AS9k8aJHr4X^530hiudPS1&j};L=3y zi_uG^c+|gY>oYLdr?~GO80HNubpQ4x>$vFFJJIqhAn@kw?rJfFKI=C!8}Q-7(3K@m zu&C|4tdRO7M(ENM<|UfDPo9pXpOHeuIH4ZXYWQT?TJT9d>ikLVjI;9Q>?0#Y=?xR| zAO3~_xyI3b$czrtdq1jdBpV*H5&!3f9x*^3e~t8FjV7SQ>p{!x7{mP2M@>r;XMBC_ z^VBTZP{sd4r61j0&S&aY3Cq5__I{33|fm( z0F2chS?1bZEf`;JW|q1AE{v$m>IFCSjCMkHM*K)%)aTehOq{b)_JdyDt`ssB@{~V}r70{$U1_2@)aZ;A2B4_Vm{mPiPkiFd<(j zV$xC|#?>a!8#IV{ADJ=#=V506aF*(u-el$2p8Ze5HQTQkf;H-O{6VC@n1(1gn4h2~ zFm6Ra1_#4Ed64;3OK)HHXQ;A-py93<5$@{)l+B*1|dO8|e0Ew;_>5d|XV1sFsfh9I7}uwx{_`}XgL zoE$z?t!%u-D^}P``bX5VvzMx>fPZ@U=zwY3Q<*D{3B0*H%sYR>mi*hfF3{eW6(8KB zWXa}<%YT;au_Wh=uI4p6edexJ5OTIeX{CT#>)Ng&th&j451)SLVJ|G2mvaH~d|uY~ zYSdTD4H;~fDO7*oX4 zcQo?O7mLcVu}PuxyCN0omLG6FZnYbffw|EzRX_=tEDVD;na48oi;rhK^q6K=1 zDmMkvt?-Ddj~ltxnb0I5MCIEQ`UkP%Ec{h54(N5P&3d&I5ZC z=Mv}6Heh0Z0f8sF0{i(V z7SPA7oM3KIO--@xOjgFIQg;W7vmvWm!5Le@qc~G^HA_k7yTGY1i#7Mg$Kr&s{}PY(^TfyV8V?U63WRgw zN|r5Ch1hfV5e8ELdZ?$CTw#f0@KSZ_j_eP|Tc!+T58m4P!wYz+B6a-4&I6z`@-b2S znxY^twAj1K$Xn^lCm}Dmte_h$jOk{h6F!&Bn7_1(G(#r0`>UF&D4o4sVOKDT2;sARXuVgCKkLj`OB^7{zHj?e}!e!dW>BJa|f`CTME zy%c*^li48HX{ya`K~WAv)Bx&}=NE>VBI72>o=>NCX2vD?1$xI!(cXmxV^g?+1_R8c8T7zK9SQ&fi+uaP}5wHR-{ZN$S zCJU*Yrk?LU{OmM)94EXLG>1t)Ua@dxYxL^NjQF#n z#l~&KzWw1#$xIEK2iZM)`bE~lq964Wg`||G7g~0Gg`}f+2+bpp^%AaEWl~pUP;^^B z+07wZ;yFI_w%Mv?#3txaVT{KBz=SV8z>di;EY0n3S^(N+^t*71an9!Un2~9(%Vp4U z<*WuM$&qSfFNR4W=Vc?AZ9Z9bY!QKG99!~qwslkylL)TP4xW^-g5(buzu|AnUH|6- z1PZKUm!hdpe^<$J@_v{%7-UKT1dbD|#boZTKDPi)!L_5=&vKiU)p)S@@EEG}WK}Bs z=^Xz%C!JK;`+9o$x4v`sl`F)}gK3J($(xtpWbHR-+XEX{8n-zncxQahSVA=^;J(d^ zz$41|&Xx>F^%{!*61X%HTmdl!xFUWjsR~g)&Oo5!gY9)_~(?bb5TT)u^lL`cgJT8-gae8LJ5hv=#eZ z>W?BWJiAUr#Kt|s&$qv{4$xoRu_Qa0&-@l+()ps!^sB2_Xnj#e*P1XZ*>U_$gu&Vcdmn56_F(5T{V^{LYCj9S4dJS>Qs!} z3l>@wvEyD}h20;LxRr4&sp-xnaS9+*6^vZMbXaR)x>6W*4L1v-|AQj;Aa`!R;LSy= z*!D9U$e{Ve<>@(Q?tNbr7Zzi>)u;g_O=STXFt9EBSmHYVA5CB37iIUnO_#KUbeA+p z$5H|k5)#rN2&kl#)Gpm6ASt5^N$hHT+bzU(&N`G@q@C&>JKk-5>HX*rf8ds)6%MJ{TVocZ&KgA0afHkt3bV2C z2n*9OBbO*lK;JQT_aJJoM5^RbJ||eGX8udBtO7SV#Bwe6?Bt!<&8Dq6yUS8Ds$O~* zrnbK08>W3Cr5-#F|7ya@i+|u)sC|KmBmM=dzK82E9qf(Yd3ZPfrGT^!raQ3{FeN@! zn%wUXYfVF#K0Z5L_=c_n7#=nL7MUAsP$JI<`o;nmwP70;FFYP)9i!_5^&c zH;3yh0ew~X>!EeDmaZq`DZWAK!t(T2p?ezUp-N=K`+YH(VGZNFIX1qyF!g=BqDwe* zzJY=Ni>!J1Jnx51r6m(qEe(b(P00j|I1LuXf35K7t$gbKG7ah{6f*z}0&xk|Ivs`+ zRonhcqNWJX3<%QY>a2WO1S{)KS}Ze0*X2g4tv|Hk>Q)U*CXGp~S!kBH2Pp%$P|ZMA zHKUVmVhp~!@$s<9qr2+N|Fj3LejXEe#Lr3ggou~Qjs}#lti9RQoVgN5N0GHk&r|pN z__vsZZ?aY^tTl~J5csD^uM2 zuE{L*pOQLT*Y(b6*RwkY*k}^qW`yXDjV7kf>%SIh{2^X4{`#C}gz7BkSXt0!tnpC* zD)v2-lRjLIkDKkF$e*!o_MD3qR#v&g9{gCM1YEZzb4mT=X>2i5vbP5$z9T4eS?KGE zoK$TPEt>>eB3YVO8&DA7Z9)und!{nvzBnpb$r2{=T951~A37n~z4rlKII~ z*od>-1pbCk9;oLej_#vN2S5w7GgpT7MdVFb0JWtXPE}+ z!1ajmL5{ywHKv$k|A^#jhq%Hot3jLK@3{<>7@IEaDg>+!0TEj3mMMp15l<lI-NN08~z*?~F9qLRvL4N|j`)CoslEFArgij!iMMnZ9S6-|CT&+nX8p`T&#nFw1v(s?W~GM;&&H+dzt zK!1havwizU>cacIH7^!!x6Opq<}xsR(u7s^eqC&U<&IcXf!;OM6J=q-qv?C}8HF|f zs1nvH(H6}g-hQ3(w72W^UQ1q#B}SR>$t@vrWMjC%)us6N#`KvywNLS|PAsFF!;s8Bm?pLgzaj>2}3nmXh z;yzV+ErQxOKKcau{bvm_9;b++HIGBX^VdM|nBR>fdyI>=dv1cRw!(YTQ()X@ z+HYp3Lca=pkT1@|7I2S3kOx2qEqx&H744q>oDSwX%?1 z#L&`+r=0?$9Ro+@7CEZO`+aeTciJO zOA_36Bfjq#_c>`-T*k`*aE3@zx*F2$F-{`?2q8=U`1_A=C6+@(QuQ54gNy&!Qh`t91o|@lQP|1>g#@;Kr5Jy-NgWaSv5;7Jo9OM!x%m{;5D7aZgr|JM z1wPW2UtL-{&qWVwW2SM2YOC4acIz&U`SQYLO{{li1uC3TTsBLSY5O>iROoHg- z&0?=EZ52ppyu*nFcQ0Q7O*G)Jh9d6w6^RuQ)f$ngH8q62USC2hBg>^N=5jX;Woq8H zCRJ<|f6V1Rf218wO8lqb;Me?|AU#9sU?juhpUCB=cUH!$<*@5_)g*4XsoTG+V!HZd z|GYUtRANMr%X+NM=ZqQgLK28l_^@ptK=eeIE+_XaBK`0yclv{9i%_)0h8SLRZ=#ns$>ir4JRP46R5L8cOIuAjI?7?lUd4McuxDcVt=@4VSVEy&HKwElaMG^~BGO)e<- zB%a>nM0VYXLp?mBB6jY%1#Tm=?h)6FcejZCzo9S6y60gMtLBxne?l#NpPbg%oX~_zWVFGmge>OwcD<5e&wv>q|^QGE2RJ0o;(C_ zaZbeH{l||J9iCj!^M@=?>D{fP*(9ymTv{dD;pM~!SCICceg%FBvg?r?N_$W3se<8C zjNi$}CTS&DEnPZHhDE2t&Y43zi5k3`Eh<;{R*>ig z2t!T@(biT1V`9o<%xiBf1b;O{)p%ns6CH0BfnC)zl3JUYn94MA<(HcrBLXGMNsS-( zT#pjho%7KkrK0+U(eJof&9zj6+O5MZ2P z<#VJdOu^C>v@S^82L!~jZs#);>t~!%QjA7pYt#y6*jk-w+dVQV?p*e{U+nlKrz29v z9C@6UmhL)G_q-PYM-s3~-^v#Ol@EC~30QV-04`zXp=$wcSha7&-%|`Fy`+IkO3L=z z2TTJg=!56A3H=|NI4HDA_j0m=?#pP&X?8UX?|_}Eqie}MmhAeHV;q0?!|@+p*-hI1 zC%k1gmk1i!#~?4c5-4i+qtM-$k-(AWvHJVqM-n5f>W|tHXVzfq7BoB6Hux8(j;_?F zPuqy^Zwvi^v>r1gK~KAXzK*sDo=&~o6CRiO9st5Q$N3(Vx*1);5{=_Ed*mKq>o9(Y zv+w+MB_#2s?~~Dfg(Ho2rzyJ%kTWON0Zy3yPxN&N##dG!Zgf|p$0zBh3l3r2Oq1q) zp?5{b9IQ$D;qjX{sb{;>$<4PPap>HHb9H(R;wy{PqAr$q^Vj>?7Z)rQqoaoKz$c6! zYE`_8)yDO7)#l5oM;%i@EYJ4DG!j2_MSXk1ZgvV;%-@%o|7}&$r-v!O5mzuzil&z- zXthPRl1r@C_7Y4@vVRC@RuufDu=JNi@3BjRegC!XP^#=1l%o<{={95cSNTaYDERi6 ztTC(75so#Fl$;JVuV*Cb< z@`UJIC5PIR3HM`ZdO|C9Sp-81tk>CU0bavCMo2A(Q?sCmPJ=hQ21<*3#l@~Mf#pZ8 zg8xA5$^9`lWgLR5Ky$+HC^?VPj&}+7)kak-m*0Cf$nBiGQcK_Zwq2`p;6<;nU{b}k zQP_Y)Wf#Ac95_$@QmBsZaN^(Es0DRCm6joFaQ^!(@#o&twD@ZS-XsVw>=AYsV#%KW zIS15$LD?F(CjKAuMgA^}ey`MF%IuoHh4^!jRgQW~4U;FO-Xi|Lls?!t(tLYGH@j>U zFpVFbH268X1lKxJ_BoF?kV(JMDx^wNx4bUupw!ybn^bFB{@8`{_WLu9hyAa=#3_3{ z>Oo>U8gi(%3}-MnFL>`O8nuQ_&mYsskKLRd;0W1f}1Wi(cB+bddYPE#G!@AgV(lC&5HK7>NUApKwr?)hv}4wg&%xl zVQ>omkmG&qO;Wvi#Wc$HtDV1Ay$azj$%;1-%}5i89h0O31C7cWI!~IHEmmlgr-?K* zUwXY}NSQTAtvWoK_Lm?OJY>YaR~|swVc&K9Y<=hjx{Us-VbEyfj3qCBY2|2e{%l$} zwO%`UEf0Bcy}uRRi$gxb!pw98=;6}RXyT4Sn8Dkfc08`!4gGv?3N{;KOslD9uLZk` zr0jD~6@F1_PEPjFdd7ZHd-7imkfQh39KPg|$g^PHXkXBaI{}BAIqN?g`P3I*Q?_Gn zMi`H$8s(JEJ4!lu4I<-R(MD2wq6iYXC_czsm zXw96po2g!lx&QnZinCEgd-}=tOG4@wwuQM640bS?C8mIY0FMhJno>sdsJ^N*4(<6^ z#?oilg|mjR?=3bL{bSace;fU#kkGLWk(?HaN)}G5*^jHM8+iLF~WD!*0&=i59xEd!A7R@y=-{bCiEmKqsy< z=KHoyExHxIck?)p08fS-BDKU+m=*h9g?nxuzTf2-G(GO&9q8sNgNd8+g9?ofr_RvN zc{Nm?3_de2^W*KDNxDlXuhnufIDLTuvvE&JnNZpkt)JPZ#5EyUE88g2^J@;~$RkM9 z#ALTcD9P1P@|GF0(_c4P2%XTM51$sVM@{=QtTY*(br`j$DpI$68NCDGj!91FYJ}sQ zpNiZaPQ1sw(0+$QPU?PYrhk)JJLwBvg1lSfoaBl#aiJhDbk_Tb&v~e z4n`n!xs-!r27@1SiElfXd~u#e}x#a_-&73~KgOj@p~Ur@r_E#qHvS(N;YK+{Ex1 zFQqX_QtG&ebo(Ilj9zH#sa@2H_9;U5np#A&;uRqd)|Y^5lg3>O3=|SGdG*G$i(EFR z&A@O@C*r`_F0LM}{Hg?ZE{b6{fR`COGvG2bveX$5C5c0zaEm59*%LsiowuubsI&Cq z4`SlZ>oGhJu`bi-o3Zh70z3!JD)RkLX1ucWP1u}}itdk>3~-KQc~s_c<2SJJb+##;3&kld7Q?+zhyc*Qvwy|G61b!ni? ze}C*UwQqm3gT*V_zz)43!wl=U}{4?(07DofZ6RomH5bb>l#4i@VMdlhABF5myA#==`C5e)>H`T zkZCiC7Rr|{lI9lid!5(2@2Z?4-hR+|e?=QV`gOE!mM4S4&BEbLHVT}A@$Zrr`v`D$ ztw3pDA6uhm5M!08*5Sl3%Uc23**zUt9XR!7)&rs|O=4QIFezbn!C3dZHZSOqsDfd1 zGZL?3xk=WQL#SFsWpM7K_FIfy_YZ?ZCH)4GZ85fI?%Cf9VxO$n-cUVCxMV&c^z9mj zlVF)Pw)i8XHrMr_%T8wT2JdDfMQ}+YECn(Oe?&JTOq!t1W%fNamg;d+|D*GgiTIzy zix-uX4kl-A8Gf*HTIzehm=^)I=<(a(aKDxN?qcIBu<#k^SAs>!>oXeZJ~h%*Yc}Wi zdQ?CJx`yahP%=UmgB~@QZPAwlVe=EJEVUJ$)H;B^8bs)(SXBt1G+{v#UeEq2E{45r0B!{`9AB|0FzyDP4 zy5RwpeSd29OMNv3PV+qUYqJa4zTpf)qajnDFx3lkZ0v$d5lNFnPjYG;x zv#LM{5+{6uNpz^{pw2>&9(b#sI985l0ZN=fH~aWxlI@Jjrt}txlii41;{R1`!jnCW zIIYPDvlX_MRUBGp*w|bbkC!HDCW8%!y8nTcN?Qzg$Qy-?m7i==xzfM}Gf- z<2WcqY!%wYGUV~SvWNN?6{8KHtb01633R_@O&Mz8np`@0G} zYss|s){3Xhp#K!GwWMX;0uzikYxT>ep!LN;2eEWpceCs`XWKP~O7*>r5N2zQkhkmmOT2fji+uia;i8J*C z`t4k;!HvDP_AV`iX~vMWX#C$WKVf1eIGgg>N>esKxt8oxvV=T}#S(JgiuWl!eG~+G z*sQL<|2GKHtEVS4-m_Uz!q>iYDfTmhTpei^_bp)7V!TSn+n9P6)J23)y5nb#a&$Qt ze&btj(S6o79>MIGXoE!*3!#b;%z;WJY@=-7{i1!V*p2S03%Rg|RsTioa+h(vi%7$A zcengtg(msWWtLzfU(82Q13phr7UF2ODE5|V_!;lG(-BD&!rj$BPJxpc!jL`cVP=@A z9~$~jbgjI;&CtC~TBv>lb(tkS<3!|^tQ^59A4fw$sFJq+946ogUMk>`_b=NZB9oxs zS7*P^C*Mk6QNdyUuss&E3c8DwDxFk-FZT1fF6gtEU$y{H8+A%UynMBRx3Q&xWz3*h zKWB1Xkd-ADBa;;K_$iGeE&*`=AYT7UBWZ*@VVfZ^Xr%EUdevuwj+h_K{>Y!XU)?x_ z+Q<@xppbhejVCo3we?AaZXC43FgTp-EPGt|pZcpsV~t$P?A^os$o1K1 z@LSO_P&M`ESWO15;IwIlaNT6)icyvWucCwcwUwH+6CV%JAX2`GKL|P4tjlTbC&zMi!zPp=l0%ESuh@x ztcNpQmFk@`OHvp0$v2JgeHZP;pF@?wT}FH!H`m)K8sU74bO}|zg&!XMcl^G;D3xDJ zITuBqlWw1BLlIqV@y>{1M2zer3yQM80!-a*@K0Ok2)ioK*W66!ie(l5C!STP%SuyQ z)umKB&)YH$rtECcVLO}ibxWUh2hJoVv*{UOYGa^8!$&h+J%z#cur~vcZb$3+523KH z=bpA}MLOH2Oi~|kndE3qG{k9|W$8`+OX!-P@U_CBVp=NRP-Op%!kYmAv*SU2M^NIu zf^{^xR#|u27$teo%&qSGTLaf?7q8wx7+=?%kzn!Ha&S*UakcjvjkH1OfHNM2~r$B@ljDIdSVrJ5src5@c z9i0?z;oSqgdj@q6C`o|;mb;QmAn^5pe4yVP8zx7s&=*2Ya_0IsWp){^+}DgbV>OD* zB~%0%;YOk!^w}t`iI-RMX^PyKK+nQpwT@l6%I|u^4CdDza;bWhUS#=Z|t{UctmPsQL}1>a$x6Ot_qiM_SL<| z>~e4N7bsQgG`ijA1=^~t*4uH>!VybdyJbGn4#0%EUfnnUWM~Y~CzmCgbAj~+p?#G9 z6MZqLR}d&>-HnbK6dqz1J^O@3Vxtr8arpdped$VEr~V z#HN+fqSz+qQE!r}!dOsm0ikr_Kf{^FGDAIqgo$sq)d}>LD%Hs@j%fWdlJ0ck$Le%i z!$jj!5(fd;$U7Y@2WnLMAcq`G8;PIAcU!fvtTmT>Oc%mt; zq@1;s#ht*^n-a9YJ6slYCOW>mA%cJ>d4>%F7!*1|ExF5&IPeLWLryihIPdH*M>0#3 z0mo)Vo)vPwBW8~wz92Yj#MZ2wW>Uj+kr84DEJX8tm@_3>5G8P#&|l^vcTGjgG>X=g zYRUH0PljxSAcL0~#)vngYe#5TM>0d_y+1K{Zo8|yIZ z`+a24cg5diA48sWuL@h8(%isg=E}d!H4vcYP{0&X)aIK@Gh1ssfOl5K=MERIV7eM` z+ic(0EZsohP{AIIOo1fp(S`^udmDkhN!|}n$^#`M_wxlm$s&Ki1*7oM$iTHRJt=v3^%Z$2rRD=|jblT?Hwy^v zjyj!We_#YgH(_dpa?(FIE`X-j<~SaoE|BspU0*;g8n-`*4qq|X6=bpl!*!;p86ju( zcaNu>K!5(UHPzi3o=F|J>$GxKo?%yGf+gXQyMf&A48~-@+C?-hbB;)liKIG^Cc+2m zn;FN2gs&Hz9H~sL6*l#|O%$n;$dkR)n&L~j&-wT=zmER<_+<$`audpDb$pt4(pKQWm6pOnB;wWT!2pU-hm+-`G8;vUWT0+JLAh z*x_cl;0(rr=vC)fp}bhI32aw?C1avtF>sJC(LV@@{Gfd?0N6t$)>1r0$2y1(;M!~v z{b9cqP7@YqqtwQ0znuhi+2|c$;f$lbQ1*UV#|H%;LQOAumeYiUszLX!MnUA8APq;z z^*xzGZ$}5pjPo))2q5Wd(CeOsZwvuP{1yeNw0)ZpGgoozKTJXkV(&aRKL)LoyN3S> zV~7fsGlu+exfus~4Zr)o`V9RrsX59&(5G#w4X@Bv3;q;?Oyn1juWgn!eBUxiuKlV& z(@)-=?sMe;%3q!S;sdgdjOA>K@LVwuxlhGwLZov!oHP<-ToPn6=p|hFb1tw6>7PQ|zbY@bqKOIZMgfehJ5A-0t(nRns;Q9ye zRsjdn(MDYRZcOe?-CC`W17_Olf*g(mrE-G$uT#G0Fg<~Kl>xSfq`mY`S}6649q<3b z4x;?e0c*>8yMQtr%}h*XBB~FuyfTCiz=y4*g2Te)Lgw6pWOe|GC+<>;j2!g13l=wTzA(g)s2&pR-x zstccBoP7~0JS|0FslmkCF#w!XES*?7^_Y?9=qP+P`uUBUQW>hr&kdj(Y{m${d>TMM z?McZJks7kaK`unX$+}~n5+R9`9j7d0j;-n{7VKP$!~2q0g(`-mm`>*zF&TvTHzy?a zDK-L$VXxBepifN;t-_CENA8Wl_f}id`N)~- zH0Kx!ac94woCsoa#3cBo#v3>sbD1L{iBtT-5>0$_gl!?xV}5llz8rSJ^|L0HtPf}2 zUL;`<+jB4@=A3%>_HH_>XBspgGls2VuqlskzhNVA0a!b#uLYIpYBag%8&)#jC9nis zpT&@j$s>Qyt!V}8X$UeSqlQlP2V%@VzRySAso)XRtY*%%k+gY$v>6r zRq#gel*qBSj6atuDfPggiIoYTL8!<(v4rzzU(bRz#o7fVKhwa*d*OPtc zIrRIr`rWD7Qdg>t{iERI83V&t52z#IUBcTW7w0dU>6l`(Qj*{7I0XJGXq9t(nE3gR z!IRGm4KTZ%>noHRaSRD}LC67$D$=|JuoJ>Wg|1;oxoE{647@YhTY-_2~lM_Q@gcQli^zD4b+h3I_kW%w;J^$A<5S?FL2io z%_zTpf_OAoUF-pDgOjW?1j*fQ_;t@oM#E>CAtDQe7R-C!$g zK=8TX1#?gS^)zv6qLe6OQv0r9v}@YI`E3iWe~1sNnL7FrYYC!KL2kW_`-J!{y;fCt zu(SCPJ?h4fPi_Rw(F5})+py4Fte;DJBT4$bnI% zBk`a#f|1So_QJVY;~<MKMevDx(dE;1J&)ZT0ikh>J`nvI_UW6I9Huv)k!S2ei^IIKOj`*Xx!{bW z+%{y?jr+QHbJqv9^O2E4&W<9Do1lv`DQ*sc0JI(jw+5-+D}b4K6t73bU$#39Tz=Z> zF)yMbaOtc&tvuekOC+)~cGDOnVN-AL77l#I=o(Q=p+RL#Z^vH9&h>D!?UMN6{%z+U z8k8+8oGm3bq+wHv*9fz(pzztV=(&0BeP*Jt2b&)=1wplYN16A~&y(B;-$0o`lGuiq ztyNwn?yL8?#bm!AhlM3IXg2g^@wvWn#Dh)qz24Db&iVD3B}_`hof zoBFZcDBvnKUJO2U(|&m?`OIMj4ud~7HI)xl_8Ji%r03PC{KwY&?=!w2GVZW-fE_*+ zH43ZZsR$f94_i0vo$YgSr8&$CJl+^k!UvKB(}_8SP2#IH3RTNyqAt~DI@$A6k8&}d z``ucI+5J)d^nr8mlW4PvNv)kIX1nDk{*7Pf5b2x1V9HaoBi@aC3Vwp>>x6EaEoJTf z0GprJfwJJ&rr(pc9X@9elAqJKva^mYZ&Y3#9L9(0i4`>{%aTu}D8jOt74Z6mDX7L6 zh%H6fg!rz1^}klq$Ehi>= zMzMRC+l1sk4Chd)TQk~s-qLMtNy3`WzOaBB6mJg=;N~Dvl37dI`UJ_oBu?BmhlOgG*?N5uLZl#c(caGb!{`Y$7 zNCNJLb9_HQA9r~cZk#zQ2FVG6ktqao&Nxtof;UNN&cSW9dNqyZ? zy+sh-#5nC8-?hvcd}rz&ri-EsA`uy+L5VzDv|X1Kz`Yb{{zBbOqoE{(SEhJ0=brr+ zaYPH(%fv=4uu;_g*|#>qb8^{MTRXqEC?s?AM5A`Mt_^L&fwJb;9X55a;YCp21h_-x z3KDazZ9a6maj=%>{hyQZZ(T~XQXwKhioHM(08x%uGL#GtzlxHWcbR)c`*s6eW7w>k z{tcb(GV$Kb+;|gbgHZ}!H46zw_CkKUQ~8MU7B-|6UgD=IO;GjuV1{vsywcRLhxU3{ z6b3$w)n7e*L^|2GqmENzUMHpgB(2NvDtAAAY*PYJPfWrLZ3DE`Mj$2eNi-Q-`8O!D z>HBj@qZlM@JQBQtCy!Wh?bbbQ9Uy|9-UaS9Tor~SsXN6jP+N@acGiEbz_WC9 z7vhLI$I?Q*YtU8kEb|SvFYtWax<1D@XHhKgwl1R1hugX_vKAICfH>hoz0$?tSGWH; zi8cHGcE*mHOd-g1jqG~V7%-hZVgRDX=gQkKm=dugkmV*xNwam-$VFPIfAJtUm;FhV z(0d!Id$Hvvq|E1fE|Zj52@^egh9W(6dXkeF=*=jwO#{%E3t#fdnimj$4(WmT{moM3 zMRJ9?;HW{0&=0XF$rvnF0EMZVs;VyedCo}~xtP-K9I~wjF^9T|N4VQu2rsyp+V;JW zO@_&?{|+UM{v{zZA$9R6r44dp0D~hP_MPd&QGJlG;h)_TuJzKLTVn6~YLbxpTYip-prjL*S} z#uxVMv;x8T{GnoiFaJ8hm*=h^6w6NRmc}SCr!|2qhAW2(1faY zZ{J0_aFJP*d8+%KG{|-7&4l+XRhLRcxO!)(df!gbHIbAQhzTn%m(Cu4dbalT`$e>p z@~g8jrYNd`HYGSQxtdZ&6wMy}#v7fwJHZy7aSS>+(Dx!#=USXMO3D(;TEaxj)$Pfg zJEo){u~`2}X2wD8B{H}AY_1S20e^fQS)_sF5LRm2* zTIB0vaI3N~!?+3b@8x7@`;?Tm)r`&Y2#&S6kw>EMQT#~=WS+>?!AE_j^92K$tBvYB zNmHu4r&e7K=o0j5fmH>q{$^2TmwtZasv*7;N>e2>eY8ja*(9H@I*Y zwA4Y;<^Un}#=jJf+*tjL-woQ6F(*n7mMZ1A?N3;d%sCLQF48N#1Z24WqwDIX43Axx z*Ujz|L$jlp-u-jT7_u?ayrj%qiTo+zsBBRmrB)S1kOQNJV5w_8|4=epVddRyc3y1q z(zV5rDc)CWu(jW0#QWUQd_F##w0{wa`Bx0*EXw+oP($R`f-v^(+{#QUQQPB&8 ztZ$=+(o|1upUx+-MMpv$%qRax*60B&2ELS>{p5D`wA+&cDcUV04VQ zl+?CFF|y{?&5YM_ikJeSPObq<~n;=l=l{ zrUHd$PAGhe(^=fl(K0Z4=J$F!7M-09mk4dBYwP_x@7;1+r{$kr;rg!=NZoUCx@>K3 zn^h}TCU64OZE=%$AiKP##RZeSGI%0K#Jy%9GQwDBgt__Ad6`olA(NDcdAU9_c|BN9 zT>AK&9hijyp?%KU{;<$vQvg5;6rjFe*(?kvq`H+EXe@1Au36KsG=&zV^h4lsE*FC! zJ6LYi!|6t+Q`%q8&U`~Erp}*&G?iF5ht99t%Gk0>=W6Hl66PfRS&_g)uRTlSPM|)s zP#ZI#38n7$KBUvhK#lkX8-&LM^HO4+zAS3!sJFM^JvHk*zJeGPD4+t~VRxbGRq10p zAwEopBNY01;@|J--Dtqk9$*e}NAspbTbIdoD;GEI!v;gkB))AxvyIjF3mXEY@JeFI zsacs-2^AHtx~hG-5oVacmwvfQU@}d;o5qLNOWO+;%~i3Uu8eVYV5yef81rsWYB^-Z z2tLeN`bwz*o}FShl3b$nib(JqOxowgUs9|RB@rZ2o029(ja1(A3v_OhA+{ixILXk0 zHnSZ{v2^~TVemuSiSXQZIACcH#R$8*pGi#J%`i1JUHkLTMqeI*U8YgDnFu*YUce8@2v|5aCk2WU{A6voLiFs9sXu^~W z@wz5~Q%GbUU}wLP_*Y(%B)Rn@tC?luW78{K=FX)bZGx`bmAzE@hE8D! zfd`EoL4Dv;Z{9ct_E;+speUi1SI9eLxNafBfYlW9GPlrE3^$)X(PmHZ`2{4BRuC^E z`|zTx^5}ORAbO?n?5e+D<*FbM`A{Ld2wC-}wCN}2e6*=fs zN{fzu^#WJRO|xn9*?P5o)=i0I7L1?$@sTGN*5~Avw>A0}K}|NcTP0J+T$4~+AHsEh zomCh+)3#bjlSkB?lG3IQpdsR+`X6)Hfx(!1=(u@p;Sc z(w+MkaBZoC?!_HaehZJgrme5%gxx`t#4Z!mBD{A``(b}lFC{0e-jQPoVixTfV5NmA z`zgVx2&N~JQf;NKr4%2FoI;$;2HnTJ@!~=8QY?e%a~l7>IQc`V59@+g@d z8xs?a{-=dxOu=6yO`l)ThJo(yG4hd}c|T1$eGSubdPrX9G=O`5#M&Ld=w3Jw<(5#c z5?A&sd2T(BTIo+B@zV`p&?$G+$5i?XIGe7ShUr&o@Z~dU%9KKyamXfVMM>09;;&(w z4H6Nw?f_r;X|asJj@t9}NzbfB1S-mxK3xqJoLm*yBh8JNPU2bcr+Ad0^*La&m-L`j zxJ4)T#r51VLzniPZd|JJ)H#MCE##?Z+#6+ZS}=$Df9ezKjwV|Qf6m=aU-5_$u+lO- z{THfn&#hq$t35^)ca_jMQ^gfE@~BQwGFM_eR)SoH>e+5)^L78H6D250Mn z`7rfV3_|DEm3HjYes+ubTx3-BCO^8Y!XAhiAqfx_WhPfGtq?$Lr&I0j?dajZI6yrD zO)borj|zxJv+%wA&^PHb6-F{7<#XfNX8C7qQ`^X?s_Wx>>$v;EjQ4ePWm=y!s>FkI zzZEF3wI~_LxO8LS?15tKJ>p;B^VVbZZLBrQKMbzD5Op!Ra4PwlJO~YopCw}{S9Em4 z$MpvJGsCm7hJ}aYohl6e@tI+E;{NgTfR)SM>z7>YB?IPP?&r&>kak)drqfrI4_S^_ z2GQwjTw&}SC)k|m=f%!hbz)cbz{el)8}7yL;<-CaTD}Kqe}l-zehA%+(j4LDJqEoB z-g4{9Q7U3tula%lv!J{hh~zsL;JI+R%~p#;F{591J(dQ6XI!R$v!%;Xn|;_+5Qh27 z>B%0n!H3~U!}GpQMsFqn^bpMT_&_I-+A62iCpe6D zGt*euNBvJbSZp_6Xk0iohp}B)khW5odDhycE??2gB40FY96GP4U@^j|(YoxwHv_xs zJ!8B@yOX+*rI)5!ag;CH=Iki=mCjw4517Xn7$(e{*y-*?^xoAP+6)(nTVW)DOE~1E zk=Ps*JgOtS-6AA_C+?UFWCanlLl~Z_Fw+Y%+7FoD7cBhMh|??&aYpEHv=5zG+HrUj z6-%sbbM>@jkY2m>o|3D-{y^}2xaf)E*oT$cUyT9JE!w0~E*@z2h3pP>^j@m6JZP_; z_;?cf#whAG)ov1m3bH0*;~x=z#^Wth0`TsqzQrBU!{k;B)`GDgWNGiKr6E2)m$_1=6i<9y(Y1sZDVJuZsq@0D8!fIpzI)60!;E)Z%74 zqU&IO;}8szq6F*P4`dr{G(|

$m1N%-)~QLOV{Mi(wzSVA*DO4hRL{@s8NBh#v2m z380FS+D9l@zf##y9)rZH5ovIWdT>m{%C;%WkR+Eij!{hg0732w*XSe z&1qs60IkN(z z56z@QbiHL!7(v6!i{ca~NO_ozAUdBp7<37jqRuMl@Ic(zr^+sB3|v|<2J>FPppg(B z#&mRjW~$}urlIZmJ*&{ym8VJ17zYM@GBtg;X-+{}KZSP~OtZ7Y@9G{H8j*fpl_)kA z9Fsk{40Bsf2^SRM1pc6((r-%rAJ|l0tONM=2)wPih)I~R6bLS-%ya^lzHitso&(qe zB`HtKI-RI8X=;WS!pVl(EDQdD{9O6CJx-;Pg9U19DP`Z$9Aztm4fSgt)l4wUklDJ# zd`2Obw8Y+_O2iwH2tW1GhPZgp4x1F^#a960Xbn6E@IvxspPGTAh2p3(3H`!DCD9R% z&Ch;Wy{(&=i(kGI&m>28!^TB+m-xpt7w-bX-?%;*8cpI(x#npK?eJRHB_hiqmp$tQRup_fbcM1x zZ!ybye23_L5-<*$?H5AAFTM#!c;$5Z0C|faTVC0<`3#i<383srA?-B0rkL-5Ax%x6 zJlL@&!zd0RERJGZQdAK3kJHB%l2 z9ub|TMC3uA4v9XlXtc5I=@1jWbN33f{$mNh!)S#AOztZd=}gWv9v{x)qC&D*ST#dD zxS8jEMai5ej&@na7yJ%o`;c|%G>QuI(y}c4PiVGttTPJW!u3_%sjr^$xU$_pKl)8D z%7%eosSpKqcZ{DH3wDPeoWV`1#Ezu^mIgf_ZA~BYwi>}oE6gxNW<-^troqY=Y?jHN0sI_v#t<6A4NY{+eap!`RpIm=X^fe2P3QKB!1;Z6NIybI7YJ%=9K(Wj?n&Gu~qPSMUoA84dVTXxsb3^!@3YekTeYoaYe%{s8GW%UI8e&Lix|^xCn=WjShp zpQI=r@53J?V2Q)R8B6x*1(&o5sGg~Xh)fW3p_;0)=Wn(OaBS3tlxok5T>kqTZi3K& zLTr2BpKAgddvVd%qDB`3J$!jeJp)j4y<#;YoUL<9X!#nM50vt=R0)d@WC{K0A!y&^ zj2fH|)CUV@Q@N{&Jj^%H$C$UqovERs zk_+d|D}E$`0=B`D1xfcNjD{Ga_dM}CK;B>jJ&xn;{NIX1_>O%SRG`D(@9BXXEO2<- z=?%-i30&|Xwe0nsp)dqq0PtBLSX(57l7f00q4Q-b^#fX>H+Z2B$K8MK(cIqL&rx=lAc?i z=07lFAP}|zv4RZe(NZfsXTKxHc!lUA;9yPvd*FxnQ1_EL9nRnNYPUPRcJ~(Gc$oevL?*!M$h}d|hAktX`Xmj{NnI_kJ(T)s3wXcLNRcFVwe*+l4 zJS4f=onpQD$!*a3FlTo-4=>~W`)u1q>%hp;d{)Zp%dOQXP0j~8}q;rIA)TaM0!Xfj+Kaek2( zrj5{Bdh848S$iMUEzBFi{^+r9Rg5Pi0Hh>ED^1k>i}ok-oztMIvr>zg+HqGtyXY znTx44BDzukezyPC{k+Y$g`@*d7 zDYdTvfced8v|REbru3yGm@BFo`a8RSdij}mnlYvQG<%Q$xsTgp2&Yt9{l$7+-S6$5 zy;hlzIDcQ-IvZduN_1s!FQnxL&Qkv}Yi#M$f%jI?UWG>N@J1wxQi(i-Mq9W{`67P6 z*BXu)qx}}dieo!WjO|^RtxTeY(*cru(z=WeR6$2tg1q7lN8y zM=*{QfG5v(`p=@Qvfu8r=HBMlJl&6qJ)QYSZ}EVA#sll$<|q)s z$V=l_x~xZ}PRC5ybeZBS0K)DM^tUMA;5r+UbtpFRF&38C;y`2jrH#LM``8a_0BC|zuR-rl7Cq7iX6bvU^qp_0G%GHR4Er9j zJ~$0WQd(WO9S6g8ijz|e*>9?Q)=n>1L_y^F<*c^q&vik~eK_)7NzeJ}ccUdzC?O2B zY8^;uW3AuI)Xj^3wnNK(=dGPUL~}zfn;^0_^~r@cmm){mO?;fxHf-RIVx7%-+Z_xS z;7kt|3tme2D0H}Aw9)nO+-iP&w5fx9@3Q~76x)$`m8h7%yW<-k3x;Qx-s7k^4WEyT z=%|?w%_M<_rVs0Wr{X$B{-UN5BX5SHtVCak0D%Dl#P`%@$%j-%hrQy&^cab(vc2&&h*_Dk zzn!;d*_k2v*xrdu?`tc({e`f(lzNfqdiMFJ#abNj6T*^5eYm}x;c+v9d+t`wGxDUJ zh)MgB&w}?-?ymXoW%<>~=Cx+mqNG^z1uVhm5}}OK{GL*46=y5s&qFiUZNXr39+2S9 zGx`2|);;xLlkK9X$jB!1O~q$SiMFut$NGdrE)psECd;n#p;sYT6K|6^u;EP2O=1A7 z;H>^pjKFb7Q#n>iL++&{U?PSz8Yx7Q=?Oz5!(X1Pkj0#AIQ{3g{Jl?)PI+yWwFq18 zm&G3v<$?`cvoj!*ht?mra=Ge73;KzLR+#^~Jew{aU56DvK4d!gb0LJT@0#*0f^jA2 z+~P%^>)DKJT;y6PK!5A6zfWu-^)NjlUyg^uMmzLjomOn)bHSC@F<&9xFD)jT8!_fz zj2(K~4ov1QnOUE9v`}4TTz)NkbXt_sh0LVFHw|>O+?w@$`TW=FyOHhSl^3708ZM!| z55)SW(pgxVEO{PmLuzAA;o8y8q1>D$_I9bKuzy+Ok&KF?M)Yu1TMB;Un+ougwS)F*MKW_e%zx02}Q5nNKyy&gE_AtuS)Mi#Z?i8Qk@Tl5hGrt`PHOQWYprBPQHoedi?%4;{kKzD<HJ&ov3;ic%wTx1G!t^UcN)Z%$||?R0B-+-6b%7; z*7|WoVs0R#|GxkleGQ;*7aOeJZ+(9AvyB`dcO`}3Z+v_YXCxt9sQ?w3d57R zgr9u|Bax``S2-$zmY41cGsz3qffSC*RUwKFM6jZ2uPD?f=Ov2d{jq`dSggYd^!^<4 z&zCZ*wX4u!{pym1%@sXza0-hs3a$YVjEC>J4FdE5xX$a9#IT}Snkfy#dyV=#`hlKf z0)!uBv+kq2@TuPu3O>5ed21w+45b3MtJ09smN7RkBokxwp7WYO>?~8>oHYwc##1Ls zhgskyOKDA84kY`nrmtFJp`Z&Fp~TaQeur3Lv=3@Hl3woEB6b;>@lhsEc}Fx)sya4# z4%GL`JioMNY_BoCozY@WOlsy`ljL8MhfSSPFriO*dC}oFfIY49+=`>@7Dve}$Hwom zA(-F2{TJ4ZnO0``*^kXJ0n43C8@A%fvWSmI9Cmbrr+qGpI(Vi!lf0bF-=gsuI5)mF zG08?HF61eFxVc-qvMPVDZm}5fZIdlCpCNyLui_&vY^?#}oW7e}c}6Kn6nHypo;-D0 zxCJw4^o)atFm1W#y|IO)UVLs;N^l@oKg?*iRvO!Ezx6qJArcwCyYeI-O;&y^1WFCX zXeipEg_XbZ-A@Mu%n6_IgG$hG-?5FM7)~mCU4fiFg4AwWZ7O8@yi*G(H*~7%6?N4O zN;6A&X_e8+org?4JjZm)v0|tjEu8dyF*fVoblku^(!Bh9T3Gg=VkP{P<==sd#~*8* z5M}3@TDPl{#&qJ^9Zj2nr#0`>*HUzY7}(WE$CM_h3x@__baScxs*(S>1CQnON6}9A!R{m2N+UsI{Du2Y&6m zWxcJ%P&Ul{JO0rjm4RB@owSiIM8`xCsnJ3KKF`%yz`I20X6f6hWF7Sv`P?IPYp!60 zCyJxY!R)lKk@Y90WSh670D1!F*mk=D0h6Y0Sv$_#MTW^^HwM2I=+nM=$aFR!^Q4-E zycx$Q6z(y~TunUYa$(Y)*7lqg^R4g!j{O^M>+7sv8wJquv0W#wX7}apr(UnT$fH_VvD=G%lclG=9NM$@5}Kjot*oHMyt(RInO#0l&zT1q zin!THsqi*~DRwXmwH{@?UD~eS`>jW$^fe#i@72IuEW)|(^6#JQ*pn1T(r>q!c6;B1 ze!r@D5*@H6kL2h+g$U;rhtUBMbd@=2*VTB&s~wuV=Uc(S8^dFMr>1l}#$Rc%R>L{4KW977ZO4X=mO*`vPe=;mNn#agCD`x) zCHmr2is9h>5``ByS4F4}`RZ3}kY-ES!h0NQ^a;sXI@=>aK%!BrBQZZ@UtRp6yV(2Z z!sZo%I_|AaqPQj*OmRx&=Onfnq#}w;iVXW=TZ@QR3pmlj4LC<($=<7j}4GW(M4We&V>s5WgO>VAU3WDg^8KDBSJTQN} zO6EZ-;^!+({*||WLA6p+ps{4N5t(?QHS>J88-F5T>t=@PaLqnjyWHlXxE)t+*8NFvExI(IW$+L(^Lh0j=rIpsHB#3@_KCRs?t5f-L7zAz z2Fc}NHpgrmVb<0KhW$&mFu&Q?O;Q=YM7Z1QwBUL?^~T7=pnY&&L!Ge1Vx~+whM2cO zMeAyI4?h@A@~>fGl5yJHcp z`Qr0)3j8~3WKVAjTv*k<`+%e0@IFtk(|%=i0R+~)JBZ+qh|cA^Ov)-6`RTTw5{Ci{ zb@(qXjGOlqjKJ;Gu{F|PX=13*?IDKe6fbBuyz4A(!--@OeMfxhu8F%-oF)E1;HNn2 z;4x;;eS2%kzjcOMj=C@IIl%{N%Pu`QaMJoCg*s9XE{eyyN`|=OHw>}Ip=h^cQ~`Asvq_hWHGkDf`-hg0anxQAHDu;#y2^H9|h zOnOp4pfv||X_ZYNVJ*7vQMJTQo5t5UCGrz`;N59on0L~s#QO$E&mW<&llGI zW9~bx|Kw-5lqwN}V#_bZ{7a3nGV&YadPm?c&ew7D%0+r{KvE=Nf`M*?HA)rjFRfxw$ky?ZI!VPL5?1yIrI`oZs|$aA=qRxg5Ms7EyIPak=k4 zeaf38(>g{0e7V0_>!pd$(DBuV_Nn@4VoWXbucC%1HTb_}M{~`;F+91~)qY9t<=m-|}oDt$R|6G@9XN5_XTKW*gAlnHB|SYXH z6a@v-_{H$F+9vQAS@%u}dQ-ADo~U7bsL-Gnd5R*FVG!yQdcSE^dC)-8HAJWE*hGoR z&O{}B+Vda$lFP97p5!22scz{&WzUpcQuRIB{-W};15)ZfR)Z~JF>Bi{uhAXfyX`UR4|~`lBn~biCiB2ZpG6f6XgNVe=)tMGDXUNvB$V79I63y=imVoU?9u zOmG$UqyN+&BUDh6dG-FdcwMM;{S`=p3c)+M*iut7wda)-`oMjx2rV__%e;xrkEr2- z0I`#hl6%JYP!i2`3n$?Rdi}W|4|?-q<1>N)`)a7x#_bupvV!j;4?Q3N@DDOJQEv3! ztk2eelRVsU-yd1}dQRl=qDwmdtl-;0-01P_qc($dd9=urN+TxB6Kxsf!bSQ+qo2Nb zzz4INm0prW_0(24IfwA1OJP!vpRbs7gpF_)BjwiBYW}14bBh*p*x4K7dghZvU|m0$ zro#FWT^V-pZ`~zll$F`N997i_A-?{YPJAK#c*l=;4EZ1Oe3H%ZsPTKnReNq2;Ac8k zs7!d|7dGf>>r~R)i;c$1WOyHHQ9dO(VDj;4*={4OxhbKE#A*|1m#a!KnnAdzwc7q>o2odaMttD%fsl@GNYFl4 zij;wz`+yh3T*JFF<-!D8aX@(XOlWUwv9%!0e=)l`6-|=C`m?!g$*+SVHVg^`4lex+ z@OX=#7BEX`S%chjZSQLTeeXe0v@(XwZu+d#(Q+PjRqso@Ega#3arSauBQ6?Dcr3w= zT}~O-6aj$wAbu?-YXx-~UvlqFD}u(xH;#d;$ZEfDGH~3)rPLq?L9vlMd@?W+BliGU z^Bay9AY=1tsU5fx6WiIaWb$@{6WA zf23$(!iT_o^-pK9(lFnbs<)h=@{@w{&AvvS1Rln(O&_&eVn<=h<2~ezn9?k*RQTZE zKhqOoAgSTej@z_^tSOi|R+&yQhq_XaDVj9epNZQzd`?uUS))IaY!^Q6KHHj~H`IoYH$Vs@M(y+O!sMXvSB-+tHlf-^N z27ZWuW@NCY1x#)Eoeb%KED5+7#l)>K{$WMjd6}EB@cI|37OxTcaUD5bq@AGr_y@0?o`XW_6Rfm40e*TaKH@B) ztWLVpUN*=N%iz&{5+AIn0l>mMLchBg2*t5}(;`qZgSoMake@KG<98=$ znY7|)${FwG_0XN^)<;JlMhC;TiP^DmW})lIyhZvA8XzrTaus7WM&}Z}WHozEw3ztB zCgkwNn#1HihJ`Eb;`3j7I%$GZi}WGYur-TQcu_6?~s|> zE>_KWSnLFA)rci#vx`W92{5gtpLjgc27g&_KZiT-X|GZYolg9*zye=8G!uo!REdb3 zr&l{zv@rsvtB-oPKdA&weA-&q@Bg{rRGYf8BzSbHC&N?d(seoEE#`j<0BSVTcfXv< zea`wsbLVI-GeOc4qjvb8Y4FCiSash~sa4wH*In^M7k|94Q3==A5BEJ8ont zyM?6luSA1_$7FzzV=l`@SNiNxxg2<@LxSK%dc5;3eIO8WpYJdI?uYc3V%jrPzT)}! zDgz9AQvC;2?G$JMQ<*Tz_*r%$`#(N2bB22(&z!OEr%rjZDYL@3ftJ5Riyt2d^6b@c zPuGWwzEa}JTY2}5^H#Y`KY+p8uxU%_K6Pw4x}^mKHf8m#a+^al$t?v<7T;rA?#v1^Y+rRiEVOe5$x+~t<-SZpgbb+I2BaEjcb&<=+;&A zR?fZ~O+cnSjagRoS`4dQYENMvSDNtp#`hedcRV^`+kLu4`ic;kd|lueWRM2ru`Z?< z8DmG@=J?c~zh50*s~bhqOE?+Sxy#AC!CIj!zm6Fa0l>-oWT_N3BB+(8ZoI;$^17LJ zJ*039SRJyuuus*Se~q}X^b;rslx3Izm~>gdk2MzQa0nMbGp4})*h#p4))zGE93J}C zaqvt6yjI3>EYW{(A&eQ+(&2YWoAf)R4H-zV7Rs$g8OK-(|ySm#?VF% z%$sJY8OxKV#c+d+>HA#dyVM5vhgU21O0ussp8w3WLI6xRy?v)h98+3TK}b|yE2 zomESe8`pP?c;K~LD@#mk#KliEFJ3wUz+KZ93UWGoM6tUJVqy0U0DxF2nyJa~O{;o1 zrK-Bjzki>;_NqNewaO|j7^2cfa_hP&V0uOCSlEdG*T6WRloTXTtuSekL{B|bzR^kV z)qPqN@dyvN_sCO1SO(bOcFmTWPQe-;&P}fkSW)oV)dCM0F~8RI-c2w0apvA)0|Hx@ ztMvWYFXi&@z`Whr?qqJ&27KF%UEejyPh$sLlM_eoL|GpZV_&*A6J=AFp^gi)Vjdo% zzXb0x0P}lxRg51c7zVU#=-*m2e*_+U@bEhQZQi2B&zb=WgcC5e47S=_M)a{g+e4+GDyM33z3Oc{N3 z9MEj+0H92`4)$O7$SZ5=?`@1)3@>IPzViWBbL=iee68zYc{MBhYYxEO{4-mB(dYhV zy>DukQ7F#qI9|JT$#12Zf&etR#3hyOSJy#1)EVqcFgfXwTbrvt8visRsaMT-%|#1l zo6~jV-5Nm+VphwmnAgg+*B3`GmHjFAeLEYqt+FKK%*W}t^(LE8lo-3cmI%@pDh>Wn zdT@$-V$>RZnt`v~$SV)nbj7Kwb**kkEB!8vPVH$Mz=VV4V$cXI74QFHz4*HgbL)SR zxyvmjI)(wdznjrrJ$OVO-Cp^M)?tjTx%0pO+;gP93QHsX_Rgkjm3v8Y4Wg{Swn z*`F!Q+R$Xm4Y&)2p&V;^0I8huxCy>tt-ScWyId{Y`U!p#9uJ-@4m_bp`RfPpyFyks z{nA`1;W9^B;&p1dDBr>l-p>G_kGrg0Q7raQM7maxh$OXgU2uMRIhmln8Z#|6ftPZA zaY#OL*!~G+kVixGll|mZP|XehK7hPrZ|S_k3_2f|^<#mswiIKZ zZ^7u>)(WO^0KDSs?oI6^FMHp6I4tdGTbZ02$#TA>aBwnp*tNJfcdKf0Dn$r5lp=xI3QD<~`c2$H|Ue zeW|l?vWXm~09^mPp>3?iXRziAzs=N9uI9dYE~ND{+KI-7b8PN0$Q0;0G~la~53(jgHt4vy}yv zrh>V6!1I*-L+WzDfGjF`V+BJky=G&-7%$39IUEw@nJ zlK{?x<=8?x4M~^`gj-#v>7oR=*e+OiS@@{ydIer^@HMKY;qJ8d(V|UPkB?LVkI)9I z`xn3QTJUrixYg?3fPMaqd=X6FVEubXt0svD!h9Y=RqoKp_4JiYm}xPk+hDrjCp^G> zJ&dB`P^6FG(0-cvN**@jyK+Pr^Q)S6ioA#BcAqs>9ER*je^cu-~Eej0zHL0$4RLLNN9YSHWA z%ky-pGzz(Wr(a_rYR=p_m2xHZg4RouB|AXg?q!|Lh*0P-DX^DgJ+jdmKy-$SHU6>C zm^4r0uC@FCHr_5Vi1voRoh+dlg~8eS1+>BSnvvSSXHx8cVZ!NyT**L>R^qq75o5$c ztl#+WM?`@5=XB%ar>btF!_(!fRAQ%_mXdD-2Hc*=8O%0~PtZmUKnhJi;sa@FO1sV{ zJhG?7Sw{>0w^-i4fTC>ryVrMDtG@j@BLu{=og}B7F@6Z_juH~TjDlSsJ7Bhx90s0B z2D)!D!QDu=Cbg?3Z$CaQ+`Hq%aaP+JxrW}!4;U{u^w`m7U8Dx)FDn?)X7szBL(Szk z5t3O$F=MciIvc)Mz2-XLvX90k7pJZnWH3qb_C;%kgPhr)>Wd$P`DAXG!s>o8a1%5T zvBJT;ZC3kaq5t+~o|f7)whDKNv2u6(k@t+$k$)34n^w}AhDygg`7~m3B{ry+KPxN-o~{A>xnkc( zhLxbFdq2$28fnlsNQ}uzBQ!1Pto(QMBCETl|qRp-o)L6wuR zG@Ne-z(EPj+l#buev8U&xMJmA>fKyy3z)s@&6k59JEjYf)kF}K2Mylo$wfZD=kT zs8a%Km5J(qf)07aLMnVyJ5|(ri zTWoQWo2`5H1${zv|O9KkaLC;7C(Y18TawpN4du%DSsiYxjF4E6SlA19wXJs$vwS#cHzymKa!7T7ZH z8vINmEvU!OmCXCey|c~{9`IjCzMZB3^2_`&ZSiY4#TL&mv6_KC=^)77)5-$(WBzPR zjbTZLuv6L~8b1;9-m;X`zeeLAgV~&oO;Tk|1pL~}XG-XfrJCTUcv7xDrS z2Te_cOrBYcEtoi5U9)aWm9CbFY8cMTsB-zRHfbH1b_Hes&!mmfYrCu=Z*6`>@hPT0 z|1n$s`*jrv#*|{e5f_Qal`(T!DJ+UFuBEB!d3rVwK(yA}-NAmjZWsOBkWpteJK=|w z;9~&T`JI|CLo?^bz_%6B_#K4f41uj_RQ@0sPp>@t=^}0dfeqyv%7>akOv>ctMErJA zS(oKrD(8n2rJn~t$Dzr_1LjLyp$=%i3HVG-Hj&!wmy^lEry3Vq6mK=EwU*P{(II%C z`+$%v>_&R$zj!?7RJ-yYJl+EFIPF+8`?)5)qg4;_`5GD7G)dIBk`mFHWb)ra16Qg0;Ds;XOV0sv-<|CaR#q(g)Hx(;3_^Mni&0;BBH4IQr zuj*_L%0f{PpatH$xsqZ_+ocmn3dvKLwhQ>831udIH9)r(QuSg}?@nY7#Qlf_cK`t1 zr5z4b3WY7#h)iUxORi*6`oD;Le&TstSabe4?JB`cj2RzjiDaU$$kUx~NO=UeE{y95 zUSoap2vIV{B5HRRdzt(l5}<)4?q&g1PjJ}|s#RXz5oe4i?SHw+gz>_KQ46gczcq)Q zqniADG>j+~#VH4ZVuY?_4e6@$3S(5VsOdCXe%z+J@gPK}{9X5R?#kqLR~)GgTITf6 z-vy@Xm61YhK!_xPC}rdB!aqSDgcfA(*t7DG@d|OPAF^q8qk#grNntRcF^R`N)%^Hj zWSxnwcx;M6$ZbEx;^gD2M6Az)(>|xUvIzi?D~84Wrrax`rc}bJpY}L2P8IZP6n1KJ{c955%dqNMCy>Kqj`c3J2&f%T6 zE?t0o>7+S|Zk2);b+4BoOTgynufv&d0FLGK{hCmgoBc0>ljF_bY$?OhFLBU6dJ^22$G%hClHE8zBD7p_uoL%So zxu_k7m=XWgsIevd&h^X`lpoO14`$cBV1U_x#8syJvK54DnYCSBok$eJsC5raQ zx)>{Q_m5%#Uk2TjG9as+7}+69Pyd9WxgNVM>a-fx^m~eomcJwayaqahQ}cwJ7QOA} z#|N}+?L!{KwJ_D9XD`Q7L)^Ab+^mTA*qdEbgx)^B-%a-a*Zsd+%7y;<%H0N!?jf3IYK)@CeC{g8GZlg zBUiH9-nUsz%O;InV|_iQlxY5yMMg2HJ5?Ile& zglVqA1qkd@H8C_;$A4%iIG(PxY)o7%H$rvk<9}%+L}f8|Nkd`q>v$AJmx41aLewaO zo;~l`H6EW71+8Ei9sc9NagshdOnQ}@GW>G0km|}cyUs=kOgRpma2H`BS+|vVA-Zkl zR+Dx@vpYKcbS1sLxVu%O&IYp;Hir*1W`#?mzNAaFNUa9tXlM!hFAPulB$#_jjx{PN zK0?Hs`duRf_n5|cIgvl_dm2TFZf#(2u;NY&&BGKwsJ{fr;sWEQu`v(+wA4?j%(d{j z4|?ThJFO;FyunFgpGpw|@0f@+H=k|+iBA-Tb*H*9x725lpO$w|A8Gz)Xh?20mX2U}YwA#ORC&!i#d1L$%WYpf>GTEKrkdKbJ&TRZL zkeMmc`X9l2D?GR$k1AV|NpY}s~aDmp>R zR2cwvm)My3=>C#6GCK%H&08^t>I`={)Y*u75deEpmMH#U=6Sf}wC#kbKJh|5lq<$> zrFV-En1|D@EWQBUs4!!?8dh(*nu)r|4w{*=e#MKBhX?e48$^GNt)8LoIun@?Lg6#1 zhi}~mqXugKk`@_ig5baq3r5;AdU=>h6YZlHw2F1JM;)!%i*K~*mZGDdN)MkSv*Ot6 zY;a$Wi2?tl8a+}MB7U{`coZA+wn)I=-VVIm6f!Y>(Bo^C@Bf3Q)A%Fvyu74=pus5h zHxHPaGEa)vgHy*XqsjvykO~UjG6Hpny(a>-sc^Y~x=Za}jA)~=9OI~DZR;^S04ZB) z2v4U&TO;yLM@TdwXhA0{UjPENeh=9fJ`~{cWEmNz4o)lfZ4?Mw z0n3to7`p-ZvwTQ!r|}9Lk(W$~6Id~LDIRNyVCjaq8;TW)0`sr)k3YwJ`HJlw6PhdJ zaad$E$EI>38wr7y)WQ@`LH34~$PvVJ*Jk*#mS|y-ATTf7qj4Ob^p)=#@$9FaJ}>X8 zCaV?+0Q0d15!PJK6}-$=a^Bfi+DIUR4^Hz04a(|4`5bNY!G{M+O}^F57$31FyEO%%O;nl1A$MnouLoeI2wx9rHJuO)}{qw{H(|I)qs{n?K`8x z5Ar8GO`3lTf Date: Fri, 5 May 2023 13:51:13 -0500 Subject: [PATCH 12/89] add some fun placeholder text --- docs/pipelines/how-it-works/index.md | 42 ++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/docs/pipelines/how-it-works/index.md b/docs/pipelines/how-it-works/index.md index 52ed97a4e5..7d9a57c730 100644 --- a/docs/pipelines/how-it-works/index.md +++ b/docs/pipelines/how-it-works/index.md @@ -18,9 +18,51 @@ Picture this: a Lambda function is like a bird feeder that sits and waits for re ## ECS Deploy Runner +Hark! Let me spin you a tale of wondrous tool, +That doth aid in deploying software cool. +This tool, 'tis known as ECS Deploy Runner, +A champion of those who deploy with honor. + +In Amazon's world of cloud, it doth reside, +Where containers reign with power and pride. +This runner, like a loyal squire true, +Doth serve those who would deploy anew. + +With ECS as its liege, it doth obey, +And to the cloud, it doth make its way. +In rolling updates, it doth excel, +Ensuring no downtime, all shall be well. + ### Standard Configuration +Its mission, to deploy with utmost care, +And make the process smooth, beyond compare. +With blue-green deployments, it doth impress, +And safely switches traffic without stress. + +And when the task is done, it doth report, +On all that happened, to provide support. +With logs and metrics, it doth reveal, +The story of the deployment's ordeal. + ### Docker Image Builder (Kaniko) +And lo, there was a tool called Kaniko, born of the land of Google, and it was a builder of Docker images. And the people did marvel at its greatness, for it did not require the use of a Docker daemon, nor did it need root privileges. + +Kaniko was a humble tool, born of the desire to provide a secure and reliable way to build Docker images in a Kubernetes environment. It did not seek glory or power, but instead sought to serve the people, to make their lives easier and their applications more secure. + +And Kaniko did work diligently, using its many talents to build Docker images in a way that was both efficient and trustworthy. It did not rely on a Docker daemon, but instead used a container to perform the build process, ensuring that the image was built in a clean and isolated environment. + +And the people did praise Kaniko, for it did not require root privileges, and could be run by users without fear of compromising the system. It did not store secrets in the Docker daemon, but instead used a secure file system to store them, ensuring that they could not be accessed by unauthorized parties. + ### Terraform Planner/Applier +In the realm of deployment, there exist powerful tools that rival the strength and cunning of even the most feared warriors. Among them, the ECS Deploy Runner, Terraform Planner, and Applier stand tall, ready to unleash their might upon the field of battle. + +The ECS Deploy Runner is like a fierce direwolf, swift and agile, capable of executing complex deployment tasks with ease. It is the tool of choice for those who seek to deploy their applications with speed and precision. + +The Terraform Planner is like a wise and ancient dragon, possessing an almost infinite knowledge of the infrastructure it seeks to conquer. With its keen intellect, it can survey the land and plan the deployment with utmost accuracy, leaving no stone unturned in its quest for victory. + +The Applier, on the other hand, is like a steadfast and loyal knight, resolute in its determination to carry out the orders of its master. With unflinching obedience, it applies the deployment plan, ensuring that every detail is executed with precision and care. + +Together, these tools form a formidable trio, capable of conquering even the most daunting deployment challenges. They are the guardians of the realm of deployment, and those who are wise enough to enlist their aid can rest assured that their applications will be deployed with the utmost efficiency and effectiveness. From 481f17f5c6b1860ed4e46f49cfbd9f339004442b Mon Sep 17 00:00:00 2001 From: Zachary Proser Date: Fri, 5 May 2023 14:47:59 -0400 Subject: [PATCH 13/89] Check in current progress on RefArch --- .../index.md | 3 ++ .../index.md | 3 ++ _docs-sources/refarch/usage/index.md | 3 ++ _docs-sources/refarch/whats-this/index.md | 3 ++ docs/guides/stay-up-to-date/index.md | 21 ++-------- .../index.md | 11 ++++++ .../index.md | 11 ++++++ docs/refarch/usage/index.md | 11 ++++++ docs/refarch/whats-this/index.md | 11 ++++++ sidebars.js | 6 ++- sidebars/refarch.js | 38 +++++++++++++++++++ 11 files changed, 101 insertions(+), 20 deletions(-) create mode 100644 _docs-sources/refarch/bootstrapping-your-reference-architecture/configuring-your-refarc-for-delivery/index.md create mode 100644 _docs-sources/refarch/bootstrapping-your-reference-architecture/index.md create mode 100644 _docs-sources/refarch/usage/index.md create mode 100644 _docs-sources/refarch/whats-this/index.md create mode 100644 docs/refarch/bootstrapping-your-reference-architecture/configuring-your-refarc-for-delivery/index.md create mode 100644 docs/refarch/bootstrapping-your-reference-architecture/index.md create mode 100644 docs/refarch/usage/index.md create mode 100644 docs/refarch/whats-this/index.md create mode 100644 sidebars/refarch.js diff --git a/_docs-sources/refarch/bootstrapping-your-reference-architecture/configuring-your-refarc-for-delivery/index.md b/_docs-sources/refarch/bootstrapping-your-reference-architecture/configuring-your-refarc-for-delivery/index.md new file mode 100644 index 0000000000..b1453c12a7 --- /dev/null +++ b/_docs-sources/refarch/bootstrapping-your-reference-architecture/configuring-your-refarc-for-delivery/index.md @@ -0,0 +1,3 @@ +# Configuring your RefArch for delivery + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/bootstrapping-your-reference-architecture/index.md b/_docs-sources/refarch/bootstrapping-your-reference-architecture/index.md new file mode 100644 index 0000000000..aee7260ced --- /dev/null +++ b/_docs-sources/refarch/bootstrapping-your-reference-architecture/index.md @@ -0,0 +1,3 @@ +# Bootstrap your Reference Architecture + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/usage/index.md b/_docs-sources/refarch/usage/index.md new file mode 100644 index 0000000000..580a7ce60b --- /dev/null +++ b/_docs-sources/refarch/usage/index.md @@ -0,0 +1,3 @@ +# Usage + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/whats-this/index.md b/_docs-sources/refarch/whats-this/index.md new file mode 100644 index 0000000000..d80ba3d6a4 --- /dev/null +++ b/_docs-sources/refarch/whats-this/index.md @@ -0,0 +1,3 @@ +# What is all this? + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/docs/guides/stay-up-to-date/index.md b/docs/guides/stay-up-to-date/index.md index a332f9130e..d6d6f16e0b 100644 --- a/docs/guides/stay-up-to-date/index.md +++ b/docs/guides/stay-up-to-date/index.md @@ -16,22 +16,7 @@ import CardGroup from "/src/components/CardGroup" - - - - - - - - - - - - - - - - + @@ -113,7 +98,7 @@ href="/guides/stay-up-to-date/cis/cis-1.5.0" diff --git a/docs/refarch/bootstrapping-your-reference-architecture/configuring-your-refarc-for-delivery/index.md b/docs/refarch/bootstrapping-your-reference-architecture/configuring-your-refarc-for-delivery/index.md new file mode 100644 index 0000000000..e1090b3022 --- /dev/null +++ b/docs/refarch/bootstrapping-your-reference-architecture/configuring-your-refarc-for-delivery/index.md @@ -0,0 +1,11 @@ +# Configuring your RefArch for delivery + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. + + + diff --git a/docs/refarch/bootstrapping-your-reference-architecture/index.md b/docs/refarch/bootstrapping-your-reference-architecture/index.md new file mode 100644 index 0000000000..3377b62ce5 --- /dev/null +++ b/docs/refarch/bootstrapping-your-reference-architecture/index.md @@ -0,0 +1,11 @@ +# Bootstrap your Reference Architecture + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. + + + diff --git a/docs/refarch/usage/index.md b/docs/refarch/usage/index.md new file mode 100644 index 0000000000..40c47c9e87 --- /dev/null +++ b/docs/refarch/usage/index.md @@ -0,0 +1,11 @@ +# Usage + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. + + + diff --git a/docs/refarch/whats-this/index.md b/docs/refarch/whats-this/index.md new file mode 100644 index 0000000000..e6d8397110 --- /dev/null +++ b/docs/refarch/whats-this/index.md @@ -0,0 +1,11 @@ +# What is all this? + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. + + + diff --git a/sidebars.js b/sidebars.js index 07d2972482..1bc510cd43 100644 --- a/sidebars.js +++ b/sidebars.js @@ -21,11 +21,12 @@ const complianceSidebar = require("./sidebars/compliance-guide.js") const updateGuideSidebars = require("./sidebars/update-guides.js") const apiSidebars = require("./sidebars/api-reference.js") const faqSidebars = require("./sidebars/faq.js") -const iacSiderbars = require("./sidebars/iac.js") +const iacSidebars = require("./sidebars/iac.js") const developerPortalSidebars = require("./sidebars/developer-portal.js") const patcherSiderbars = require("./sidebars/patcher.js") const pipelinesSiderbars = require("./sidebars/pipelines.js") const landingZoneSidebars = require("./sidebars/landing-zone.js") +const refarchSidebar = require("./sidebars/refarch.js") // @ts-check @@ -43,11 +44,12 @@ const sidebars = { ...updateGuideSidebars, ...apiSidebars, faqSidebars, - iacSiderbars, + iacSidebars, developerPortalSidebars, patcherSiderbars, pipelinesSiderbars, landingZoneSidebars, + refarchSidebar } module.exports = sidebars diff --git a/sidebars/refarch.js b/sidebars/refarch.js new file mode 100644 index 0000000000..0fa828c5d7 --- /dev/null +++ b/sidebars/refarch.js @@ -0,0 +1,38 @@ +const sidebar = [ + { + label: "Reference Architecture", + type: "category", + collapsible: false, + items: [ + { + label: "What is all this?", + type: "category", + link: { + type: "doc", + id: "refarch/whats-this/index", + }, + items: [], + }, + { + label: "Bootstrapping your Reference Architecture", + type: "category", + link: { + type: "doc", + id: "refarch/bootstrapping-your-reference-architecture/index", + }, + items: [], + }, + { + label: "Usage", + type: "category", + link: { + type: "doc", + id: "refarch/usage/index", + }, + items: [], + }, + ], + }, +] + +module.exports = sidebar From 341c185fd2ae43c63c267f8c6d97b0674e850fca Mon Sep 17 00:00:00 2001 From: Eugene K Date: Fri, 5 May 2023 15:03:58 -0400 Subject: [PATCH 14/89] Fix URL --- _docs-sources/products.md | 2 +- docs/products.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/_docs-sources/products.md b/_docs-sources/products.md index d85f296449..7cde07f5cd 100644 --- a/_docs-sources/products.md +++ b/_docs-sources/products.md @@ -24,7 +24,7 @@ Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor i Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + href="/pipelines/what-is-it"> Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + href="/pipelines/what-is-it"> Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. From d4c855ebe275a9b928c836f9a9efa64ada720b45 Mon Sep 17 00:00:00 2001 From: Zachary Proser Date: Fri, 5 May 2023 15:05:41 -0400 Subject: [PATCH 15/89] Add more refarch scaffolding --- .../usage/complete-your-refarch-integration/index.md | 3 +++ .../refarch/usage/do-this-first-auth/index.md | 3 +++ _docs-sources/refarch/usage/how-to-auth-cli/index.md | 3 +++ .../refarch/usage/how-to-auth-ec2-ssh/index.md | 3 +++ _docs-sources/refarch/usage/how-to-auth-vpn/index.md | 3 +++ .../refarch/usage/how-to-auth-web-console/index.md | 3 +++ .../refarch/usage/maintain-your-refarch/index.md | 3 +++ .../refarch/usage/pipelines-integration/index.md | 3 +++ .../usage/complete-your-refarch-integration/index.md | 11 +++++++++++ docs/refarch/usage/do-this-first-auth/index.md | 11 +++++++++++ docs/refarch/usage/how-to-auth-cli/index.md | 11 +++++++++++ docs/refarch/usage/how-to-auth-ec2-ssh/index.md | 11 +++++++++++ docs/refarch/usage/how-to-auth-vpn/index.md | 11 +++++++++++ docs/refarch/usage/how-to-auth-web-console/index.md | 11 +++++++++++ docs/refarch/usage/maintain-your-refarch/index.md | 11 +++++++++++ docs/refarch/usage/pipelines-integration/index.md | 11 +++++++++++ 16 files changed, 112 insertions(+) create mode 100644 _docs-sources/refarch/usage/complete-your-refarch-integration/index.md create mode 100644 _docs-sources/refarch/usage/do-this-first-auth/index.md create mode 100644 _docs-sources/refarch/usage/how-to-auth-cli/index.md create mode 100644 _docs-sources/refarch/usage/how-to-auth-ec2-ssh/index.md create mode 100644 _docs-sources/refarch/usage/how-to-auth-vpn/index.md create mode 100644 _docs-sources/refarch/usage/how-to-auth-web-console/index.md create mode 100644 _docs-sources/refarch/usage/maintain-your-refarch/index.md create mode 100644 _docs-sources/refarch/usage/pipelines-integration/index.md create mode 100644 docs/refarch/usage/complete-your-refarch-integration/index.md create mode 100644 docs/refarch/usage/do-this-first-auth/index.md create mode 100644 docs/refarch/usage/how-to-auth-cli/index.md create mode 100644 docs/refarch/usage/how-to-auth-ec2-ssh/index.md create mode 100644 docs/refarch/usage/how-to-auth-vpn/index.md create mode 100644 docs/refarch/usage/how-to-auth-web-console/index.md create mode 100644 docs/refarch/usage/maintain-your-refarch/index.md create mode 100644 docs/refarch/usage/pipelines-integration/index.md diff --git a/_docs-sources/refarch/usage/complete-your-refarch-integration/index.md b/_docs-sources/refarch/usage/complete-your-refarch-integration/index.md new file mode 100644 index 0000000000..45b1764832 --- /dev/null +++ b/_docs-sources/refarch/usage/complete-your-refarch-integration/index.md @@ -0,0 +1,3 @@ +# Complete your Pipelines integration + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/usage/do-this-first-auth/index.md b/_docs-sources/refarch/usage/do-this-first-auth/index.md new file mode 100644 index 0000000000..00ca657fd0 --- /dev/null +++ b/_docs-sources/refarch/usage/do-this-first-auth/index.md @@ -0,0 +1,3 @@ +# 1. Do this first - get access to your Ref Arch + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/usage/how-to-auth-cli/index.md b/_docs-sources/refarch/usage/how-to-auth-cli/index.md new file mode 100644 index 0000000000..0405392cc0 --- /dev/null +++ b/_docs-sources/refarch/usage/how-to-auth-cli/index.md @@ -0,0 +1,3 @@ +# How to auth via the CLI + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/usage/how-to-auth-ec2-ssh/index.md b/_docs-sources/refarch/usage/how-to-auth-ec2-ssh/index.md new file mode 100644 index 0000000000..f535d493cf --- /dev/null +++ b/_docs-sources/refarch/usage/how-to-auth-ec2-ssh/index.md @@ -0,0 +1,3 @@ +# How to auth to an AWS + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/usage/how-to-auth-vpn/index.md b/_docs-sources/refarch/usage/how-to-auth-vpn/index.md new file mode 100644 index 0000000000..d8f5a7036b --- /dev/null +++ b/_docs-sources/refarch/usage/how-to-auth-vpn/index.md @@ -0,0 +1,3 @@ +# How to auth to OpenVPN + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/usage/how-to-auth-web-console/index.md b/_docs-sources/refarch/usage/how-to-auth-web-console/index.md new file mode 100644 index 0000000000..7b718d5411 --- /dev/null +++ b/_docs-sources/refarch/usage/how-to-auth-web-console/index.md @@ -0,0 +1,3 @@ +# How to auth to the AWS web console + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/index.md b/_docs-sources/refarch/usage/maintain-your-refarch/index.md new file mode 100644 index 0000000000..4976c545ff --- /dev/null +++ b/_docs-sources/refarch/usage/maintain-your-refarch/index.md @@ -0,0 +1,3 @@ +# Maintain your Reference Architecture + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/usage/pipelines-integration/index.md b/_docs-sources/refarch/usage/pipelines-integration/index.md new file mode 100644 index 0000000000..1fde5a1662 --- /dev/null +++ b/_docs-sources/refarch/usage/pipelines-integration/index.md @@ -0,0 +1,3 @@ +# Pipelines integration + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/docs/refarch/usage/complete-your-refarch-integration/index.md b/docs/refarch/usage/complete-your-refarch-integration/index.md new file mode 100644 index 0000000000..b7091632f5 --- /dev/null +++ b/docs/refarch/usage/complete-your-refarch-integration/index.md @@ -0,0 +1,11 @@ +# Complete your Pipelines integration + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. + + + diff --git a/docs/refarch/usage/do-this-first-auth/index.md b/docs/refarch/usage/do-this-first-auth/index.md new file mode 100644 index 0000000000..4fa174bc63 --- /dev/null +++ b/docs/refarch/usage/do-this-first-auth/index.md @@ -0,0 +1,11 @@ +# 1. Do this first - get access to your Ref Arch + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. + + + diff --git a/docs/refarch/usage/how-to-auth-cli/index.md b/docs/refarch/usage/how-to-auth-cli/index.md new file mode 100644 index 0000000000..154d51ed66 --- /dev/null +++ b/docs/refarch/usage/how-to-auth-cli/index.md @@ -0,0 +1,11 @@ +# How to auth via the CLI + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. + + + diff --git a/docs/refarch/usage/how-to-auth-ec2-ssh/index.md b/docs/refarch/usage/how-to-auth-ec2-ssh/index.md new file mode 100644 index 0000000000..1ad46ff299 --- /dev/null +++ b/docs/refarch/usage/how-to-auth-ec2-ssh/index.md @@ -0,0 +1,11 @@ +# How to auth to an AWS + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. + + + diff --git a/docs/refarch/usage/how-to-auth-vpn/index.md b/docs/refarch/usage/how-to-auth-vpn/index.md new file mode 100644 index 0000000000..94653fb15c --- /dev/null +++ b/docs/refarch/usage/how-to-auth-vpn/index.md @@ -0,0 +1,11 @@ +# How to auth to OpenVPN + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. + + + diff --git a/docs/refarch/usage/how-to-auth-web-console/index.md b/docs/refarch/usage/how-to-auth-web-console/index.md new file mode 100644 index 0000000000..f16c9d02cf --- /dev/null +++ b/docs/refarch/usage/how-to-auth-web-console/index.md @@ -0,0 +1,11 @@ +# How to auth to the AWS web console + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. + + + diff --git a/docs/refarch/usage/maintain-your-refarch/index.md b/docs/refarch/usage/maintain-your-refarch/index.md new file mode 100644 index 0000000000..39e6886471 --- /dev/null +++ b/docs/refarch/usage/maintain-your-refarch/index.md @@ -0,0 +1,11 @@ +# Maintain your Reference Architecture + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. + + + diff --git a/docs/refarch/usage/pipelines-integration/index.md b/docs/refarch/usage/pipelines-integration/index.md new file mode 100644 index 0000000000..2e78df3bfe --- /dev/null +++ b/docs/refarch/usage/pipelines-integration/index.md @@ -0,0 +1,11 @@ +# Pipelines integration + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. + + + From f8fa6cb38fc6158d1f6a50998963e158c8fb96bb Mon Sep 17 00:00:00 2001 From: Zachary Proser Date: Fri, 5 May 2023 15:27:15 -0400 Subject: [PATCH 16/89] Update dropdown Ref Arch link --- docusaurus.config.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docusaurus.config.js b/docusaurus.config.js index 1233d14d48..36c6e08c02 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -122,7 +122,7 @@ const config = { { type: "doc", label: "Reference Architecture", - docId: "refarch/index", + docId: "refarch/whats-this/index", }, { type: "doc", From 23d75167aa6d53b5a8adfbcad81ec6b215be1d44 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Fri, 5 May 2023 14:57:29 -0700 Subject: [PATCH 17/89] fold in Ebens feedback --- .../iac/getting-started/deploying-a-module.md | 23 ++++++++++++++ .../iac/getting-started/deploying-a-module.md | 31 +++++++++++++++++++ sidebars/iac.js | 5 +++ 3 files changed, 59 insertions(+) create mode 100644 _docs-sources/iac/getting-started/deploying-a-module.md create mode 100644 docs/iac/getting-started/deploying-a-module.md diff --git a/_docs-sources/iac/getting-started/deploying-a-module.md b/_docs-sources/iac/getting-started/deploying-a-module.md new file mode 100644 index 0000000000..c8f2764b9d --- /dev/null +++ b/_docs-sources/iac/getting-started/deploying-a-module.md @@ -0,0 +1,23 @@ +# Deploy your first module + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. + +## Create a module + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Hac habitasse platea dictumst quisque sagittis purus sit. Eu scelerisque felis imperdiet proin fermentum leo vel orci porta. Ornare arcu dui vivamus arcu felis bibendum ut tristique et. Arcu ac tortor dignissim convallis aenean et. Augue interdum velit euismod in pellentesque massa placerat duis. Turpis tincidunt id aliquet risus feugiat in ante metus dictum. Vel pharetra vel turpis nunc eget. Ac turpis egestas sed tempus urna et. Scelerisque in dictum non consectetur. Nibh sit amet commodo nulla facilisi nullam vehicula ipsum a. Ornare aenean euismod elementum nisi quis eleifend quam adipiscing vitae. At varius vel pharetra vel turpis. Mattis ullamcorper velit sed ullamcorper morbi tincidunt ornare massa. + +## Run terraform plan + +Lobortis feugiat vivamus at augue eget. Est placerat in egestas erat imperdiet sed euismod nisi porta. Volutpat maecenas volutpat blandit aliquam etiam erat. Vulputate mi sit amet mauris commodo quis imperdiet massa tincidunt. Nec tincidunt praesent semper feugiat. Accumsan sit amet nulla facilisi morbi. Euismod in pellentesque massa placerat duis ultricies. Amet aliquam id diam maecenas ultricies mi eget. Et tortor consequat id porta nibh venenatis cras sed felis. Lacus vel facilisis volutpat est velit egestas dui id. + +## Run terraform apply + +Tortor at risus viverra adipiscing. In hac habitasse platea dictumst quisque sagittis purus sit amet. Pretium viverra suspendisse potenti nullam ac tortor. Nulla facilisi etiam dignissim diam quis enim. Massa massa ultricies mi quis hendrerit dolor magna eget est. Tincidunt tortor aliquam nulla facilisi cras fermentum. Sollicitudin nibh sit amet commodo nulla facilisi nullam vehicula ipsum. Faucibus purus in massa tempor nec feugiat nisl pretium. Suspendisse sed nisi lacus sed viverra tellus in hac habitasse. Fermentum leo vel orci porta non pulvinar neque laoreet suspendisse. At auctor urna nunc id cursus metus aliquam eleifend mi. Condimentum mattis pellentesque id nibh tortor. Enim neque volutpat ac tincidunt vitae semper quis. Lobortis feugiat vivamus at augue eget arcu dictum varius duis. Tellus in metus vulputate eu scelerisque felis imperdiet. Sed arcu non odio euismod lacinia at quis. + +## Curl the endpoint + +Congue quisque egestas diam in arcu. Faucibus a pellentesque sit amet porttitor. Placerat in egestas erat imperdiet sed euismod. Duis convallis convallis tellus id interdum velit. Congue eu consequat ac felis. Eu nisl nunc mi ipsum faucibus vitae aliquet. In hendrerit gravida rutrum quisque non. Dui ut ornare lectus sit. Phasellus vestibulum lorem sed risus ultricies tristique nulla aliquet enim. At imperdiet dui accumsan sit amet nulla facilisi morbi tempus. Viverra aliquet eget sit amet tellus cras adipiscing. Dolor sit amet consectetur adipiscing elit duis tristique sollicitudin. Ut pharetra sit amet aliquam id diam maecenas ultricies mi. Nullam vehicula ipsum a arcu cursus. + +## You did it! + +I am calling you to action! diff --git a/docs/iac/getting-started/deploying-a-module.md b/docs/iac/getting-started/deploying-a-module.md new file mode 100644 index 0000000000..7e8b056ede --- /dev/null +++ b/docs/iac/getting-started/deploying-a-module.md @@ -0,0 +1,31 @@ +# Deploy your first module + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. + +## Create a module + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Hac habitasse platea dictumst quisque sagittis purus sit. Eu scelerisque felis imperdiet proin fermentum leo vel orci porta. Ornare arcu dui vivamus arcu felis bibendum ut tristique et. Arcu ac tortor dignissim convallis aenean et. Augue interdum velit euismod in pellentesque massa placerat duis. Turpis tincidunt id aliquet risus feugiat in ante metus dictum. Vel pharetra vel turpis nunc eget. Ac turpis egestas sed tempus urna et. Scelerisque in dictum non consectetur. Nibh sit amet commodo nulla facilisi nullam vehicula ipsum a. Ornare aenean euismod elementum nisi quis eleifend quam adipiscing vitae. At varius vel pharetra vel turpis. Mattis ullamcorper velit sed ullamcorper morbi tincidunt ornare massa. + +## Run terraform plan + +Lobortis feugiat vivamus at augue eget. Est placerat in egestas erat imperdiet sed euismod nisi porta. Volutpat maecenas volutpat blandit aliquam etiam erat. Vulputate mi sit amet mauris commodo quis imperdiet massa tincidunt. Nec tincidunt praesent semper feugiat. Accumsan sit amet nulla facilisi morbi. Euismod in pellentesque massa placerat duis ultricies. Amet aliquam id diam maecenas ultricies mi eget. Et tortor consequat id porta nibh venenatis cras sed felis. Lacus vel facilisis volutpat est velit egestas dui id. + +## Run terraform apply + +Tortor at risus viverra adipiscing. In hac habitasse platea dictumst quisque sagittis purus sit amet. Pretium viverra suspendisse potenti nullam ac tortor. Nulla facilisi etiam dignissim diam quis enim. Massa massa ultricies mi quis hendrerit dolor magna eget est. Tincidunt tortor aliquam nulla facilisi cras fermentum. Sollicitudin nibh sit amet commodo nulla facilisi nullam vehicula ipsum. Faucibus purus in massa tempor nec feugiat nisl pretium. Suspendisse sed nisi lacus sed viverra tellus in hac habitasse. Fermentum leo vel orci porta non pulvinar neque laoreet suspendisse. At auctor urna nunc id cursus metus aliquam eleifend mi. Condimentum mattis pellentesque id nibh tortor. Enim neque volutpat ac tincidunt vitae semper quis. Lobortis feugiat vivamus at augue eget arcu dictum varius duis. Tellus in metus vulputate eu scelerisque felis imperdiet. Sed arcu non odio euismod lacinia at quis. + +## Curl the endpoint + +Congue quisque egestas diam in arcu. Faucibus a pellentesque sit amet porttitor. Placerat in egestas erat imperdiet sed euismod. Duis convallis convallis tellus id interdum velit. Congue eu consequat ac felis. Eu nisl nunc mi ipsum faucibus vitae aliquet. In hendrerit gravida rutrum quisque non. Dui ut ornare lectus sit. Phasellus vestibulum lorem sed risus ultricies tristique nulla aliquet enim. At imperdiet dui accumsan sit amet nulla facilisi morbi tempus. Viverra aliquet eget sit amet tellus cras adipiscing. Dolor sit amet consectetur adipiscing elit duis tristique sollicitudin. Ut pharetra sit amet aliquam id diam maecenas ultricies mi. Nullam vehicula ipsum a arcu cursus. + +## You did it! + +I am calling you to action! + + + diff --git a/sidebars/iac.js b/sidebars/iac.js index ab329d1694..86dcfa470a 100644 --- a/sidebars/iac.js +++ b/sidebars/iac.js @@ -7,6 +7,7 @@ const sidebar = [ { label: "What is all this?", type: "category", + collapsible: false, link: { type: "doc", id: "iac/whats-this/index", @@ -16,6 +17,7 @@ const sidebar = [ { label: "Getting Started", type: "category", + collapsible: false, link: { type: "doc", id: "iac/getting-started/index", @@ -23,11 +25,13 @@ const sidebar = [ items: [ "iac/getting-started/setting-up", "iac/getting-started/accessing-the-code", + "iac/getting-started/deploying-a-module", ], }, { label: "Usage", type: "category", + collapsible: false, link: { type: "doc", id: "iac/usage/index", @@ -42,6 +46,7 @@ const sidebar = [ { label: "Library Reference", type: "category", + collapsible: false, link: { type: "doc", id: "reference/intro", From 2167c93d2668f11d72230d2464dab024bba7bd19 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Fri, 5 May 2023 15:06:33 -0700 Subject: [PATCH 18/89] add tear down section --- _docs-sources/iac/getting-started/deploying-a-module.md | 4 ++++ docs/iac/getting-started/deploying-a-module.md | 6 +++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/_docs-sources/iac/getting-started/deploying-a-module.md b/_docs-sources/iac/getting-started/deploying-a-module.md index c8f2764b9d..eb1991c873 100644 --- a/_docs-sources/iac/getting-started/deploying-a-module.md +++ b/_docs-sources/iac/getting-started/deploying-a-module.md @@ -18,6 +18,10 @@ Tortor at risus viverra adipiscing. In hac habitasse platea dictumst quisque sag Congue quisque egestas diam in arcu. Faucibus a pellentesque sit amet porttitor. Placerat in egestas erat imperdiet sed euismod. Duis convallis convallis tellus id interdum velit. Congue eu consequat ac felis. Eu nisl nunc mi ipsum faucibus vitae aliquet. In hendrerit gravida rutrum quisque non. Dui ut ornare lectus sit. Phasellus vestibulum lorem sed risus ultricies tristique nulla aliquet enim. At imperdiet dui accumsan sit amet nulla facilisi morbi tempus. Viverra aliquet eget sit amet tellus cras adipiscing. Dolor sit amet consectetur adipiscing elit duis tristique sollicitudin. Ut pharetra sit amet aliquam id diam maecenas ultricies mi. Nullam vehicula ipsum a arcu cursus. +## Tear it down + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. + ## You did it! I am calling you to action! diff --git a/docs/iac/getting-started/deploying-a-module.md b/docs/iac/getting-started/deploying-a-module.md index 7e8b056ede..c67e59c97c 100644 --- a/docs/iac/getting-started/deploying-a-module.md +++ b/docs/iac/getting-started/deploying-a-module.md @@ -18,6 +18,10 @@ Tortor at risus viverra adipiscing. In hac habitasse platea dictumst quisque sag Congue quisque egestas diam in arcu. Faucibus a pellentesque sit amet porttitor. Placerat in egestas erat imperdiet sed euismod. Duis convallis convallis tellus id interdum velit. Congue eu consequat ac felis. Eu nisl nunc mi ipsum faucibus vitae aliquet. In hendrerit gravida rutrum quisque non. Dui ut ornare lectus sit. Phasellus vestibulum lorem sed risus ultricies tristique nulla aliquet enim. At imperdiet dui accumsan sit amet nulla facilisi morbi tempus. Viverra aliquet eget sit amet tellus cras adipiscing. Dolor sit amet consectetur adipiscing elit duis tristique sollicitudin. Ut pharetra sit amet aliquam id diam maecenas ultricies mi. Nullam vehicula ipsum a arcu cursus. +## Tear it down + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. + ## You did it! I am calling you to action! @@ -26,6 +30,6 @@ I am calling you to action! From 10aa9592d45e73a6a5afa0a491170a7962768fd1 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Mon, 8 May 2023 11:15:30 -0700 Subject: [PATCH 19/89] address feedback from Eben --- .../{products.md => docs-and-references.md} | 6 +- _docs-sources/iac/getting-started/index.md | 3 - _docs-sources/iac/infrastructure-as-code.md | 27 ++++++ _docs-sources/iac/reference/index.md | 3 + _docs-sources/iac/support/contributing.md | 3 + _docs-sources/iac/support/issues.md | 3 + _docs-sources/iac/usage/index.md | 11 --- _docs-sources/iac/usage/stay-up-to-date.md | 8 ++ _docs-sources/iac/usage/versioning.md | 3 + _docs-sources/iac/whats-this/index.md | 6 +- docs/{products.md => docs-and-references.md} | 8 +- docs/iac/getting-started/index.md | 11 --- docs/iac/infrastructure-as-code.md | 35 +++++++ docs/iac/reference/index.md | 5 +- docs/iac/support/contributing.md | 11 +++ docs/iac/support/issues.md | 11 +++ docs/iac/usage/index.md | 19 ---- docs/iac/usage/stay-up-to-date.md | 16 ++++ docs/iac/usage/versioning.md | 11 +++ docs/iac/whats-this/index.md | 8 +- docusaurus.config.js | 41 +------- package.json | 2 +- sidebars.js | 4 +- sidebars/iac.js | 95 +++---------------- sidebars/library-reference.js | 79 +++++++++++++++ 25 files changed, 243 insertions(+), 186 deletions(-) rename _docs-sources/{products.md => docs-and-references.md} (95%) delete mode 100644 _docs-sources/iac/getting-started/index.md create mode 100644 _docs-sources/iac/infrastructure-as-code.md create mode 100644 _docs-sources/iac/support/contributing.md create mode 100644 _docs-sources/iac/support/issues.md delete mode 100644 _docs-sources/iac/usage/index.md create mode 100644 _docs-sources/iac/usage/stay-up-to-date.md create mode 100644 _docs-sources/iac/usage/versioning.md rename docs/{products.md => docs-and-references.md} (93%) delete mode 100644 docs/iac/getting-started/index.md create mode 100644 docs/iac/infrastructure-as-code.md create mode 100644 docs/iac/support/contributing.md create mode 100644 docs/iac/support/issues.md delete mode 100644 docs/iac/usage/index.md create mode 100644 docs/iac/usage/stay-up-to-date.md create mode 100644 docs/iac/usage/versioning.md create mode 100644 sidebars/library-reference.js diff --git a/_docs-sources/products.md b/_docs-sources/docs-and-references.md similarity index 95% rename from _docs-sources/products.md rename to _docs-sources/docs-and-references.md index 7cde07f5cd..16aef576bf 100644 --- a/_docs-sources/products.md +++ b/_docs-sources/docs-and-references.md @@ -9,18 +9,18 @@ import CenterLayout from "/src/components/CenterLayout" -# Gruntwork Products +# Docs and References + href="/iac/infrastructure-as-code"> Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + href="/refarch/whats-this"> Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + +# Infrastructure as Code Library + + + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + + diff --git a/_docs-sources/iac/reference/index.md b/_docs-sources/iac/reference/index.md index e69de29bb2..fa56d0f3ab 100644 --- a/_docs-sources/iac/reference/index.md +++ b/_docs-sources/iac/reference/index.md @@ -0,0 +1,3 @@ +# Library Reference + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Lacus viverra vitae congue eu. Aliquam eleifend mi in nulla posuere sollicitudin. Imperdiet proin fermentum leo vel orci porta. Proin fermentum leo vel orci porta non pulvinar. Hac habitasse platea dictumst quisque sagittis purus sit. Malesuada bibendum arcu vitae elementum curabitur. Ultrices eros in cursus turpis massa tincidunt. Molestie ac feugiat sed lectus. Donec ac odio tempor orci dapibus ultrices in iaculis. Id ornare arcu odio ut sem. Condimentum lacinia quis vel eros donec ac odio. Enim eu turpis egestas pretium aenean pharetra magna ac placerat. Vulputate sapien nec sagittis aliquam malesuada. Ipsum consequat nisl vel pretium. Ipsum a arcu cursus vitae congue. Sit amet nisl purus in. Et ligula ullamcorper malesuada proin libero nunc consequat interdum. diff --git a/_docs-sources/iac/support/contributing.md b/_docs-sources/iac/support/contributing.md new file mode 100644 index 0000000000..0202938475 --- /dev/null +++ b/_docs-sources/iac/support/contributing.md @@ -0,0 +1,3 @@ +# Contributing + +See something you want that isn't available? Make a PR! diff --git a/_docs-sources/iac/support/issues.md b/_docs-sources/iac/support/issues.md new file mode 100644 index 0000000000..d1700cf372 --- /dev/null +++ b/_docs-sources/iac/support/issues.md @@ -0,0 +1,3 @@ +# Submitting Issues + +You can submit issues on Github! diff --git a/_docs-sources/iac/usage/index.md b/_docs-sources/iac/usage/index.md deleted file mode 100644 index 9f642898e6..0000000000 --- a/_docs-sources/iac/usage/index.md +++ /dev/null @@ -1,11 +0,0 @@ -# Using the IaC library - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Sit amet nulla facilisi morbi tempus iaculis urna. At tempor commodo ullamcorper a lacus vestibulum. Aliquet porttitor lacus luctus accumsan tortor. Amet nisl purus in mollis. Imperdiet proin fermentum leo vel orci porta. Augue ut lectus arcu bibendum at. Eget lorem dolor sed viverra. Nisi quis eleifend quam adipiscing vitae proin. Lobortis feugiat vivamus at augue eget arcu. Vitae purus faucibus ornare suspendisse sed nisi lacus sed viverra. - -## Submitting issues - -Link to issues here... - -## Keeping up to date - -Checkout [Patcher](https://docs.gruntwork.io/guides/stay-up-to-date/patcher) you cool cat! diff --git a/_docs-sources/iac/usage/stay-up-to-date.md b/_docs-sources/iac/usage/stay-up-to-date.md new file mode 100644 index 0000000000..7994818305 --- /dev/null +++ b/_docs-sources/iac/usage/stay-up-to-date.md @@ -0,0 +1,8 @@ +# Staying up to date + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Morbi blandit cursus risus at ultrices mi tempus imperdiet nulla. Augue interdum velit euismod in pellentesque massa placerat. + +## Patcher + +Checkout [Patcher](https://docs.gruntwork.io/guides/stay-up-to-date/patcher) you cool cat! + diff --git a/_docs-sources/iac/usage/versioning.md b/_docs-sources/iac/usage/versioning.md new file mode 100644 index 0000000000..d473fa7216 --- /dev/null +++ b/_docs-sources/iac/usage/versioning.md @@ -0,0 +1,3 @@ +# Versioning + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. diff --git a/_docs-sources/iac/whats-this/index.md b/_docs-sources/iac/whats-this/index.md index 536c453b51..f42d600648 100644 --- a/_docs-sources/iac/whats-this/index.md +++ b/_docs-sources/iac/whats-this/index.md @@ -1,9 +1,5 @@ -# What is all this? +# What is the Infrastructure as Code Library? Qu'est-ce que c'est? Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Morbi leo urna molestie at. Volutpat blandit aliquam etiam erat. In massa tempor nec feugiat nisl pretium. Vitae auctor eu augue ut lectus arcu bibendum at. Auctor augue mauris augue neque gravida. Vulputate sapien nec sagittis aliquam malesuada bibendum arcu. Bibendum est ultricies integer quis auctor elit. Morbi tincidunt augue interdum velit euismod in pellentesque. Imperdiet proin fermentum leo vel orci porta non pulvinar neque. Felis bibendum ut tristique et egestas quis ipsum. In arcu cursus euismod quis viverra nibh cras pulvinar mattis. Massa massa ultricies mi quis hendrerit dolor. Vel pharetra vel turpis nunc eget lorem. Tortor consequat id porta nibh venenatis cras. Nunc pulvinar sapien et ligula ullamcorper. Vehicula ipsum a arcu cursus vitae congue mauris rhoncus. Sit amet porttitor eget dolor morbi non. - -## Versioning - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. diff --git a/docs/products.md b/docs/docs-and-references.md similarity index 93% rename from docs/products.md rename to docs/docs-and-references.md index 0647546a52..986fa36089 100644 --- a/docs/products.md +++ b/docs/docs-and-references.md @@ -9,18 +9,18 @@ import CenterLayout from "/src/components/CenterLayout" -# Gruntwork Products +# Docs and References + href="/iac/infrastructure-as-code"> Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + href="/refarch/whats-this"> Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. diff --git a/docs/iac/getting-started/index.md b/docs/iac/getting-started/index.md deleted file mode 100644 index 384de7eff5..0000000000 --- a/docs/iac/getting-started/index.md +++ /dev/null @@ -1,11 +0,0 @@ -# Getting Started - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Placerat orci nulla pellentesque dignissim enim sit amet venenatis urna. Tincidunt id aliquet risus feugiat in ante metus dictum at. Suspendisse potenti nullam ac tortor vitae purus faucibus ornare suspendisse. Volutpat sed cras ornare arcu dui vivamus. Arcu odio ut sem nulla pharetra diam sit. Nec ullamcorper sit amet risus. Sed lectus vestibulum mattis ullamcorper velit sed ullamcorper morbi. Tristique sollicitudin nibh sit amet commodo nulla. Etiam non quam lacus suspendisse faucibus interdum posuere. Lacus laoreet non curabitur gravida arcu ac. Morbi tristique senectus et netus. Vestibulum sed arcu non odio euismod lacinia at. A scelerisque purus semper eget duis. - - - diff --git a/docs/iac/infrastructure-as-code.md b/docs/iac/infrastructure-as-code.md new file mode 100644 index 0000000000..496f6bfd3a --- /dev/null +++ b/docs/iac/infrastructure-as-code.md @@ -0,0 +1,35 @@ +--- +hide_table_of_contents: true +hide_title: true +--- + +import Card from "/src/components/Card" +import CardGroup from "/src/components/CardGroup" +import CenterLayout from "/src/components/CenterLayout" + + + +# Infrastructure as Code Library + + + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + + + + + diff --git a/docs/iac/reference/index.md b/docs/iac/reference/index.md index ef83022ef1..e722d889eb 100644 --- a/docs/iac/reference/index.md +++ b/docs/iac/reference/index.md @@ -1,8 +1,11 @@ +# Library Reference + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Lacus viverra vitae congue eu. Aliquam eleifend mi in nulla posuere sollicitudin. Imperdiet proin fermentum leo vel orci porta. Proin fermentum leo vel orci porta non pulvinar. Hac habitasse platea dictumst quisque sagittis purus sit. Malesuada bibendum arcu vitae elementum curabitur. Ultrices eros in cursus turpis massa tincidunt. Molestie ac feugiat sed lectus. Donec ac odio tempor orci dapibus ultrices in iaculis. Id ornare arcu odio ut sem. Condimentum lacinia quis vel eros donec ac odio. Enim eu turpis egestas pretium aenean pharetra magna ac placerat. Vulputate sapien nec sagittis aliquam malesuada. Ipsum consequat nisl vel pretium. Ipsum a arcu cursus vitae congue. Sit amet nisl purus in. Et ligula ullamcorper malesuada proin libero nunc consequat interdum. diff --git a/docs/iac/support/contributing.md b/docs/iac/support/contributing.md new file mode 100644 index 0000000000..442cad8b4c --- /dev/null +++ b/docs/iac/support/contributing.md @@ -0,0 +1,11 @@ +# Contributing + +See something you want that isn't available? Make a PR! + + + diff --git a/docs/iac/support/issues.md b/docs/iac/support/issues.md new file mode 100644 index 0000000000..6f3145139b --- /dev/null +++ b/docs/iac/support/issues.md @@ -0,0 +1,11 @@ +# Submitting Issues + +You can submit issues on Github! + + + diff --git a/docs/iac/usage/index.md b/docs/iac/usage/index.md deleted file mode 100644 index 49ac43a002..0000000000 --- a/docs/iac/usage/index.md +++ /dev/null @@ -1,19 +0,0 @@ -# Using the IaC library - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Sit amet nulla facilisi morbi tempus iaculis urna. At tempor commodo ullamcorper a lacus vestibulum. Aliquet porttitor lacus luctus accumsan tortor. Amet nisl purus in mollis. Imperdiet proin fermentum leo vel orci porta. Augue ut lectus arcu bibendum at. Eget lorem dolor sed viverra. Nisi quis eleifend quam adipiscing vitae proin. Lobortis feugiat vivamus at augue eget arcu. Vitae purus faucibus ornare suspendisse sed nisi lacus sed viverra. - -## Submitting issues - -Link to issues here... - -## Keeping up to date - -Checkout [Patcher](https://docs.gruntwork.io/guides/stay-up-to-date/patcher) you cool cat! - - - diff --git a/docs/iac/usage/stay-up-to-date.md b/docs/iac/usage/stay-up-to-date.md new file mode 100644 index 0000000000..dfab84c414 --- /dev/null +++ b/docs/iac/usage/stay-up-to-date.md @@ -0,0 +1,16 @@ +# Staying up to date + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Morbi blandit cursus risus at ultrices mi tempus imperdiet nulla. Augue interdum velit euismod in pellentesque massa placerat. + +## Patcher + +Checkout [Patcher](https://docs.gruntwork.io/guides/stay-up-to-date/patcher) you cool cat! + + + + diff --git a/docs/iac/usage/versioning.md b/docs/iac/usage/versioning.md new file mode 100644 index 0000000000..78ee4aa728 --- /dev/null +++ b/docs/iac/usage/versioning.md @@ -0,0 +1,11 @@ +# Versioning + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. + + + diff --git a/docs/iac/whats-this/index.md b/docs/iac/whats-this/index.md index a29de8485c..3bcdd5d175 100644 --- a/docs/iac/whats-this/index.md +++ b/docs/iac/whats-this/index.md @@ -1,17 +1,13 @@ -# What is all this? +# What is the Infrastructure as Code Library? Qu'est-ce que c'est? Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Morbi leo urna molestie at. Volutpat blandit aliquam etiam erat. In massa tempor nec feugiat nisl pretium. Vitae auctor eu augue ut lectus arcu bibendum at. Auctor augue mauris augue neque gravida. Vulputate sapien nec sagittis aliquam malesuada bibendum arcu. Bibendum est ultricies integer quis auctor elit. Morbi tincidunt augue interdum velit euismod in pellentesque. Imperdiet proin fermentum leo vel orci porta non pulvinar neque. Felis bibendum ut tristique et egestas quis ipsum. In arcu cursus euismod quis viverra nibh cras pulvinar mattis. Massa massa ultricies mi quis hendrerit dolor. Vel pharetra vel turpis nunc eget lorem. Tortor consequat id porta nibh venenatis cras. Nunc pulvinar sapien et ligula ullamcorper. Vehicula ipsum a arcu cursus vitae congue mauris rhoncus. Sit amet porttitor eget dolor morbi non. -## Versioning - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. - diff --git a/docusaurus.config.js b/docusaurus.config.js index 36c6e08c02..983f7b66a2 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -96,45 +96,8 @@ const config = { { type: "doc", position: "left", - label: "Products", - docId: "products", - }, - { - type: "dropdown", - position: "left", - label: "Docs", - items: [ - { - type: "doc", - label: "Infrastructure as Code Library", - docId: "iac/whats-this/index", - }, - { - type: "doc", - label: "Gruntwork Pipelines", - docId: "pipelines/what-is-it/index", - }, - { - type: "doc", - label: "Landing Zone", - docId: "landing-zone/index", - }, - { - type: "doc", - label: "Reference Architecture", - docId: "refarch/whats-this/index", - }, - { - type: "doc", - label: "Patcher", - docId: "patcher/index", - }, - { - type: "doc", - label: "Developer Portal", - docId: "developer-portal/create-account", - }, - ], + label: "Docs and References", + docId: "docs-and-references" }, { to: "/tools", label: "Tools", position: "left" }, { to: "/courses", label: "Courses", position: "left" }, diff --git a/package.json b/package.json index a19fd0e968..4512314a54 100644 --- a/package.json +++ b/package.json @@ -7,7 +7,7 @@ }, "scripts": { "docusaurus": "docusaurus", - "start": "docusaurus start --port 3000 & onchange -i '_docs-sources/**/*(*.md|*.mdx|*.json)' -- yarn regenerate:local", + "start": "docusaurus start --port 3001 & onchange -i '_docs-sources/**/*(*.md|*.mdx|*.json)' -- yarn regenerate:local", "build": "docusaurus build", "swizzle": "docusaurus swizzle", "deploy": "docusaurus deploy", diff --git a/sidebars.js b/sidebars.js index 1bc510cd43..e1016aebb8 100644 --- a/sidebars.js +++ b/sidebars.js @@ -22,6 +22,7 @@ const updateGuideSidebars = require("./sidebars/update-guides.js") const apiSidebars = require("./sidebars/api-reference.js") const faqSidebars = require("./sidebars/faq.js") const iacSidebars = require("./sidebars/iac.js") +const libraryRefSiderbars = require("./sidebars/library-reference.js") const developerPortalSidebars = require("./sidebars/developer-portal.js") const patcherSiderbars = require("./sidebars/patcher.js") const pipelinesSiderbars = require("./sidebars/pipelines.js") @@ -49,7 +50,8 @@ const sidebars = { patcherSiderbars, pipelinesSiderbars, landingZoneSidebars, - refarchSidebar + refarchSidebar, + libraryRefSiderbars, } module.exports = sidebars diff --git a/sidebars/iac.js b/sidebars/iac.js index 86dcfa470a..ac869d0671 100644 --- a/sidebars/iac.js +++ b/sidebars/iac.js @@ -5,23 +5,19 @@ const sidebar = [ collapsible: false, items: [ { - label: "What is all this?", + label: "Overview", type: "category", collapsible: false, - link: { - type: "doc", - id: "iac/whats-this/index", - }, - items: ["iac/whats-this/modules", "iac/whats-this/services"], + items: [ + "iac/whats-this/index", + "iac/whats-this/modules", + "iac/whats-this/services", + ] }, { label: "Getting Started", type: "category", collapsible: false, - link: { - type: "doc", - id: "iac/getting-started/index", - }, items: [ "iac/getting-started/setting-up", "iac/getting-started/accessing-the-code", @@ -32,88 +28,23 @@ const sidebar = [ label: "Usage", type: "category", collapsible: false, - link: { - type: "doc", - id: "iac/usage/index", - }, items: [ "iac/usage/using-a-module", "iac/usage/using-a-service", - "iac/usage/composing-your-own-service", "iac/usage/customizing-modules", + "iac/usage/composing-your-own-service", + "iac/usage/versioning", + "iac/usage/stay-up-to-date", ], }, { - label: "Library Reference", + label: "Support", type: "category", collapsible: false, - link: { - type: "doc", - id: "reference/intro", - }, items: [ - { - type: "category", - collapsible: true, - label: "Module Catalog", - items: [{ type: "autogenerated", dirName: "reference/modules" }], - }, - { - type: "category", - collapsible: true, - label: "Service Catalog", - items: [ - { - "App Orchestration": [ - { - type: "autogenerated", - dirName: "reference/services/app-orchestration", - }, - ], - }, - { - "CI/CD Pipeline": [ - { - type: "autogenerated", - dirName: "reference/services/ci-cd-pipeline", - }, - ], - }, - { - "Data Storage": [ - { - type: "autogenerated", - dirName: "reference/services/data-storage", - }, - ], - }, - { - "Landing Zone": [ - { - type: "autogenerated", - dirName: "reference/services/landing-zone", - }, - ], - }, - { - Networking: [ - { - type: "autogenerated", - dirName: "reference/services/networking", - }, - ], - }, - { - Security: [ - { - type: "autogenerated", - dirName: "reference/services/security", - }, - ], - }, - ], - }, - ], + "iac/support/issues", + "iac/support/contributing", + ] }, ], }, diff --git a/sidebars/library-reference.js b/sidebars/library-reference.js new file mode 100644 index 0000000000..7403d80d86 --- /dev/null +++ b/sidebars/library-reference.js @@ -0,0 +1,79 @@ +const sidebar = [ + { + label: "Infrastructure as Code", + type: "category", + collapsible: false, + items: [ + { + label: "Library Reference", + type: "doc", + id: "iac/reference/index", + }, + { + type: "category", + collapsible: true, + collapsed: false, + label: "Module Catalog", + items: [{ type: "autogenerated", dirName: "reference/modules" }], + }, + { + type: "category", + collapsible: true, + collapsed: false, + label: "Service Catalog", + items: [ + { + "App Orchestration": [ + { + type: "autogenerated", + dirName: "reference/services/app-orchestration", + }, + ], + }, + { + "CI/CD Pipeline": [ + { + type: "autogenerated", + dirName: "reference/services/ci-cd-pipeline", + }, + ], + }, + { + "Data Storage": [ + { + type: "autogenerated", + dirName: "reference/services/data-storage", + }, + ], + }, + { + "Landing Zone": [ + { + type: "autogenerated", + dirName: "reference/services/landing-zone", + }, + ], + }, + { + Networking: [ + { + type: "autogenerated", + dirName: "reference/services/networking", + }, + ], + }, + { + Security: [ + { + type: "autogenerated", + dirName: "reference/services/security", + }, + ], + }, + ], + }, + ] + }, +] + +module.exports = sidebar From c3f1d9904cf3f9eeb2d6583bc968ca54b00ee627 Mon Sep 17 00:00:00 2001 From: Zachary Proser Date: Mon, 8 May 2023 16:41:20 -0400 Subject: [PATCH 20/89] Implement refarch sections: overview + bootstrapping --- .../index.md | 2 +- .../path1.md} | 20 +++++++- .../path2.md | 5 ++ _docs-sources/refarch/bootstrapping/index.md | 7 +++ ...gruntwork-reference-architecture-differ.md | 40 ++++++++++++++++ _docs-sources/refarch/whats-this/index.md | 7 ++- _docs-sources/refarch/whats-this/services.md | 0 .../what-is-a-reference-architecture.md | 8 ++++ .../index.md | 4 +- .../path1.md} | 22 ++++++++- .../path2.md | 13 +++++ docs/refarch/bootstrapping/index.md | 15 ++++++ ...gruntwork-reference-architecture-differ.md | 48 +++++++++++++++++++ docs/refarch/whats-this/index.md | 9 +++- docs/refarch/whats-this/services.md | 8 ++++ .../what-is-a-reference-architecture.md | 16 +++++++ sidebars/refarch.js | 42 +++++++++------- 17 files changed, 240 insertions(+), 26 deletions(-) rename _docs-sources/refarch/{bootstrapping-your-reference-architecture/configuring-your-refarc-for-delivery => bootstrapping/configuring-your-refarch-for-delivery}/index.md (94%) rename _docs-sources/refarch/{bootstrapping-your-reference-architecture/index.md => bootstrapping/configuring-your-refarch-for-delivery/path1.md} (86%) create mode 100644 _docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path2.md create mode 100644 _docs-sources/refarch/bootstrapping/index.md create mode 100644 _docs-sources/refarch/whats-this/how-does-the-gruntwork-reference-architecture-differ.md create mode 100644 _docs-sources/refarch/whats-this/services.md create mode 100644 _docs-sources/refarch/whats-this/what-is-a-reference-architecture.md rename docs/refarch/{bootstrapping-your-reference-architecture/configuring-your-refarc-for-delivery => bootstrapping/configuring-your-refarch-for-delivery}/index.md (89%) rename docs/refarch/{bootstrapping-your-reference-architecture/index.md => bootstrapping/configuring-your-refarch-for-delivery/path1.md} (83%) create mode 100644 docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path2.md create mode 100644 docs/refarch/bootstrapping/index.md create mode 100644 docs/refarch/whats-this/how-does-the-gruntwork-reference-architecture-differ.md create mode 100644 docs/refarch/whats-this/services.md create mode 100644 docs/refarch/whats-this/what-is-a-reference-architecture.md diff --git a/_docs-sources/refarch/bootstrapping-your-reference-architecture/configuring-your-refarc-for-delivery/index.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/index.md similarity index 94% rename from _docs-sources/refarch/bootstrapping-your-reference-architecture/configuring-your-refarc-for-delivery/index.md rename to _docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/index.md index b1453c12a7..0e7bd6273c 100644 --- a/_docs-sources/refarch/bootstrapping-your-reference-architecture/configuring-your-refarc-for-delivery/index.md +++ b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/index.md @@ -1,3 +1,3 @@ -# Configuring your RefArch for delivery +# Configuring your Refarch for delivery Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/bootstrapping-your-reference-architecture/index.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md similarity index 86% rename from _docs-sources/refarch/bootstrapping-your-reference-architecture/index.md rename to _docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md index aee7260ced..13dd8d71c0 100644 --- a/_docs-sources/refarch/bootstrapping-your-reference-architecture/index.md +++ b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md @@ -1,3 +1,21 @@ -# Bootstrap your Reference Architecture +# Path 1: Use the Gruntwork CLI Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. + +Just use it. + +Please + +please + +please use the wizard + + + + + + + + + +pls diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path2.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path2.md new file mode 100644 index 0000000000..34080cec89 --- /dev/null +++ b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path2.md @@ -0,0 +1,5 @@ +# Path 2: Contact us + +You don't want none of this. + + diff --git a/_docs-sources/refarch/bootstrapping/index.md b/_docs-sources/refarch/bootstrapping/index.md new file mode 100644 index 0000000000..7c5c7f7579 --- /dev/null +++ b/_docs-sources/refarch/bootstrapping/index.md @@ -0,0 +1,7 @@ +# Bootstrapping your Reference Architecture + +Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. + +Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. + +Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. diff --git a/_docs-sources/refarch/whats-this/how-does-the-gruntwork-reference-architecture-differ.md b/_docs-sources/refarch/whats-this/how-does-the-gruntwork-reference-architecture-differ.md new file mode 100644 index 0000000000..c4496c057b --- /dev/null +++ b/_docs-sources/refarch/whats-this/how-does-the-gruntwork-reference-architecture-differ.md @@ -0,0 +1,40 @@ +# How does the Gruntwork Reference Architecture differ? + +Haxx0r ipsum injection server void loop semaphore Starcraft wannabee try catch over clock tcp protocol alloc it's a feature. Cd ip gcc *.* sudo todo giga shell thread /dev/null class exception big-endian lib segfault leet nak packet sniffer client bar. Strlen eof access boolean continue packet memory leak malloc stack cookie mainframe. + +Else regex continue python crack ddos bin I'm sorry Dave, I'm afraid I can't do that. Mutex foad wannabee fatal double server deadlock cookie private tarball cat bar L0phtCrack afk float mutex hexadecimal. Long ip spoof access var /dev/null boolean bubble sort. + +Float recursively try catch then it's a feature ban else ip mountain dew perl ifdef hack the mainframe continue ascii concurrently. Loop cookie semaphore terminal bang infinite loop error system hash protocol printf. Piggyback fail xss I'm compiling injection suitably small values. + +# Opinionated + +Haxx0r ipsum do shell bypass L0phtCrack back door private baz foo infinite loop while server brute force ban salt all your base are belong to us todo. Stack mountain dew throw default less null frack rm -rf continue fail stack access January 1, 1970 for error ack hello world. Ip hack the mainframe epoch root eof bubble sort bin I'm sorry Dave, I'm afraid I can't do that double warez irc concurrently rsa. + +Public while flush Donald Knuth root firewall segfault gnu script kiddies packet sniffer alloc headers Dennis Ritchie daemon. Null access wannabee if giga float buffer protected hello world for back door spoof. Brute force class leet January 1, 1970 private loop foo gc pragma race condition infinite loop kilo mainframe. + +Hack the mainframe hello world malloc James T. Kirk Linus Torvalds todo default system Dennis Ritchie hash crack long injection exception. Bytes ascii var ban data man pages cookie do L0phtCrack private. Break nak tera bar tcp deadlock bypass grep gurfle d00dz access pragma cd salt null recursively infinite loop fopen. + +# Terragrunt + +Haxx0r ipsum protocol win tarball new wombat Trojan horse lib class memory leak. Mountain dew recursively char grep Dennis Ritchie system I'm sorry Dave, I'm afraid I can't do that. Function ip it's a feature regex while bin headers thread loop ddos strlen brute force unix bit stack fail ctl-c linux rm -rf eaten by a grue. + +Cookie cat printf chown default socket foad foo case void long wabbit bypass perl protected. Boolean irc break ack malloc semaphore baz leet eaten by a grue giga warez. Rm -rf wannabee float script kiddies char infinite loop Linus Torvalds mutex d00dz. + +Protocol blob linux function tarball char shell access wannabee L0phtCrack alloc Linus Torvalds memory leak. Tcp frack mailbomb strlen unix afk terminal pwned tera flush bit fork flood fail void break gcc pragma ifdef sql script kiddies epoch irc d00dz. Infinite loop public concurrently over clock deadlock packet sniffer. + +# Delivered as code + +Haxx0r ipsum Trojan horse afk false for race condition big-endian do irc finally tera ssh continue over clock. Less suitably small values highjack Dennis Ritchie cookie protocol ack bit hack the mainframe. Function pragma mainframe int mega void else grep spoof true eaten by a grue socket L0phtCrack. + +Tarball break irc ip class gc throw continue access January 1, 1970 perl endif wombat hello world eof alloc packet sniffer. Dereference Dennis Ritchie exception fatal syn mutex chown emacs ssh eaten by a grue shell. Lib long race condition null do suitably small values packet. + +Packet stack int ssh printf fatal fail mutex access alloc bit gc tunnel in bang eof protocol Donald Knuth flood grep injection mailbomb. Socket I'm compiling deadlock perl gobble highjack James T. Kirk mountain dew recursively. All your base are belong to us sql worm bypass socket pwned I'm sorry Dave, I'm afraid I can't do that it's a feature thread. + +# _envcommon + +Haxx0r ipsum race condition case void then else todo server eaten by a grue deadlock. Bit bin dereference foo class unix bit script kiddies firewall mega new hash worm hack the mainframe loop Trojan horse Donald Knuth. Ssh emacs crack stdio.h mountain dew recursively win hexadecimal. + +Race condition rsa fopen dereference deadlock baz system nak case eaten by a grue foad bypass throw pragma mainframe injection back door. Leapfrog strlen port Starcraft ddos break bubble sort semaphore I'm compiling Linus Torvalds. Hack the mainframe vi loop gobble grep false char cache mailbomb terminal L0phtCrack lib brute force wannabee. + +Bin root emacs I'm sorry Dave, I'm afraid I can't do that. Less printf class bubble sort nak char fork cd warez ifdef if tunnel in ban continue ascii machine code injection fopen error win double system. Protected deadlock try catch python int break mutex new cat headers Dennis Ritchie epoch stack trace race condition. + diff --git a/_docs-sources/refarch/whats-this/index.md b/_docs-sources/refarch/whats-this/index.md index d80ba3d6a4..f86182bfc0 100644 --- a/_docs-sources/refarch/whats-this/index.md +++ b/_docs-sources/refarch/whats-this/index.md @@ -1,3 +1,8 @@ # What is all this? -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. + +Haxx0r ipsum endif race condition d00dz fork cookie recursively big-endian tera. Wabbit break concurrently printf script kiddies eof cd malloc warez chown kilo /dev/null todo ascii foad bang exception highjack epoch headers. Flush data piggyback class hexadecimal true syn ddos daemon snarf over clock. + +Cookie packet sniffer ifdef endif all your base are belong to us stdio.h bin ssh I'm sorry Dave, I'm afraid I can't do that terminal hack the mainframe. Concurrently Leslie Lamport brute force else socket malloc over clock foo grep double var mainframe. Ip cache access buffer pwned bytes system packet todo emacs gurfle dereference foad strlen deadlock alloc cat false for /dev/null. + +Wannabee dereference private wombat case root fatal char giga Leslie Lamport perl sudo sql ascii cat grep James T. Kirk bin stack trace afk. Malloc foad class daemon I'm compiling salt brute force highjack syn regex socket exception warez hexadecimal linux bit bytes echo hack the mainframe. Then wabbit injection Linus Torvalds pragma tunnel in data win protocol leet fopen printf void default gc Starcraft piggyback todo gnu concurrently. diff --git a/_docs-sources/refarch/whats-this/services.md b/_docs-sources/refarch/whats-this/services.md new file mode 100644 index 0000000000..e69de29bb2 diff --git a/_docs-sources/refarch/whats-this/what-is-a-reference-architecture.md b/_docs-sources/refarch/whats-this/what-is-a-reference-architecture.md new file mode 100644 index 0000000000..caf9be512d --- /dev/null +++ b/_docs-sources/refarch/whats-this/what-is-a-reference-architecture.md @@ -0,0 +1,8 @@ +# What is a Reference Architecture? + +Haxx0r ipsum interpreter bang cookie eof over clock exception function ban mountain dew irc loop public *.* gc python hack the mainframe. Try catch ip double printf grep buffer deadlock January 1, 1970 stack todo nak throw if /dev/null infinite loop socket port chown hello world class. Giga afk Dennis Ritchie pragma I'm compiling big-endian fopen server boolean xss ddos memory leak void L0phtCrack. + +Injection rsa script kiddies salt printf gurfle int access linux stdio.h cache alloc null fail gc thread. Flush foad I'm sorry Dave, I'm afraid I can't do that else overflow emacs Starcraft unix echo ctl-c cookie. Hexadecimal injection brute force gcc warez function *.* pwned mainframe win big-endian. + +Mega else data d00dz nak null void protected cat ban port machine code. Interpreter bang system wabbit wannabee error syn float hack the mainframe mutex all your base are belong to us. Packet sniffer ifdef var endif gobble Trojan horse rm -rf cd bar January 1, 1970 packet race condition. + diff --git a/docs/refarch/bootstrapping-your-reference-architecture/configuring-your-refarc-for-delivery/index.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/index.md similarity index 89% rename from docs/refarch/bootstrapping-your-reference-architecture/configuring-your-refarc-for-delivery/index.md rename to docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/index.md index e1090b3022..5c3181b142 100644 --- a/docs/refarch/bootstrapping-your-reference-architecture/configuring-your-refarc-for-delivery/index.md +++ b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/index.md @@ -1,4 +1,4 @@ -# Configuring your RefArch for delivery +# Configuring your Refarch for delivery Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. @@ -6,6 +6,6 @@ Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor i diff --git a/docs/refarch/bootstrapping-your-reference-architecture/index.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md similarity index 83% rename from docs/refarch/bootstrapping-your-reference-architecture/index.md rename to docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md index 3377b62ce5..0894a55e39 100644 --- a/docs/refarch/bootstrapping-your-reference-architecture/index.md +++ b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md @@ -1,11 +1,29 @@ -# Bootstrap your Reference Architecture +# Path 1: Use the Gruntwork CLI Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. +Just use it. + +Please + +please + +please use the wizard + + + + + + + + + +pls + diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path2.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path2.md new file mode 100644 index 0000000000..757ad0c355 --- /dev/null +++ b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path2.md @@ -0,0 +1,13 @@ +# Path 2: Contact us + +You don't want none of this. + + + + + diff --git a/docs/refarch/bootstrapping/index.md b/docs/refarch/bootstrapping/index.md new file mode 100644 index 0000000000..2ebdeff3f8 --- /dev/null +++ b/docs/refarch/bootstrapping/index.md @@ -0,0 +1,15 @@ +# Bootstrapping your Reference Architecture + +Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. + +Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. + +Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. + + + diff --git a/docs/refarch/whats-this/how-does-the-gruntwork-reference-architecture-differ.md b/docs/refarch/whats-this/how-does-the-gruntwork-reference-architecture-differ.md new file mode 100644 index 0000000000..7fd76ce8b5 --- /dev/null +++ b/docs/refarch/whats-this/how-does-the-gruntwork-reference-architecture-differ.md @@ -0,0 +1,48 @@ +# How does the Gruntwork Reference Architecture differ? + +Haxx0r ipsum injection server void loop semaphore Starcraft wannabee try catch over clock tcp protocol alloc it's a feature. Cd ip gcc *.* sudo todo giga shell thread /dev/null class exception big-endian lib segfault leet nak packet sniffer client bar. Strlen eof access boolean continue packet memory leak malloc stack cookie mainframe. + +Else regex continue python crack ddos bin I'm sorry Dave, I'm afraid I can't do that. Mutex foad wannabee fatal double server deadlock cookie private tarball cat bar L0phtCrack afk float mutex hexadecimal. Long ip spoof access var /dev/null boolean bubble sort. + +Float recursively try catch then it's a feature ban else ip mountain dew perl ifdef hack the mainframe continue ascii concurrently. Loop cookie semaphore terminal bang infinite loop error system hash protocol printf. Piggyback fail xss I'm compiling injection suitably small values. + +# Opinionated + +Haxx0r ipsum do shell bypass L0phtCrack back door private baz foo infinite loop while server brute force ban salt all your base are belong to us todo. Stack mountain dew throw default less null frack rm -rf continue fail stack access January 1, 1970 for error ack hello world. Ip hack the mainframe epoch root eof bubble sort bin I'm sorry Dave, I'm afraid I can't do that double warez irc concurrently rsa. + +Public while flush Donald Knuth root firewall segfault gnu script kiddies packet sniffer alloc headers Dennis Ritchie daemon. Null access wannabee if giga float buffer protected hello world for back door spoof. Brute force class leet January 1, 1970 private loop foo gc pragma race condition infinite loop kilo mainframe. + +Hack the mainframe hello world malloc James T. Kirk Linus Torvalds todo default system Dennis Ritchie hash crack long injection exception. Bytes ascii var ban data man pages cookie do L0phtCrack private. Break nak tera bar tcp deadlock bypass grep gurfle d00dz access pragma cd salt null recursively infinite loop fopen. + +# Terragrunt + +Haxx0r ipsum protocol win tarball new wombat Trojan horse lib class memory leak. Mountain dew recursively char grep Dennis Ritchie system I'm sorry Dave, I'm afraid I can't do that. Function ip it's a feature regex while bin headers thread loop ddos strlen brute force unix bit stack fail ctl-c linux rm -rf eaten by a grue. + +Cookie cat printf chown default socket foad foo case void long wabbit bypass perl protected. Boolean irc break ack malloc semaphore baz leet eaten by a grue giga warez. Rm -rf wannabee float script kiddies char infinite loop Linus Torvalds mutex d00dz. + +Protocol blob linux function tarball char shell access wannabee L0phtCrack alloc Linus Torvalds memory leak. Tcp frack mailbomb strlen unix afk terminal pwned tera flush bit fork flood fail void break gcc pragma ifdef sql script kiddies epoch irc d00dz. Infinite loop public concurrently over clock deadlock packet sniffer. + +# Delivered as code + +Haxx0r ipsum Trojan horse afk false for race condition big-endian do irc finally tera ssh continue over clock. Less suitably small values highjack Dennis Ritchie cookie protocol ack bit hack the mainframe. Function pragma mainframe int mega void else grep spoof true eaten by a grue socket L0phtCrack. + +Tarball break irc ip class gc throw continue access January 1, 1970 perl endif wombat hello world eof alloc packet sniffer. Dereference Dennis Ritchie exception fatal syn mutex chown emacs ssh eaten by a grue shell. Lib long race condition null do suitably small values packet. + +Packet stack int ssh printf fatal fail mutex access alloc bit gc tunnel in bang eof protocol Donald Knuth flood grep injection mailbomb. Socket I'm compiling deadlock perl gobble highjack James T. Kirk mountain dew recursively. All your base are belong to us sql worm bypass socket pwned I'm sorry Dave, I'm afraid I can't do that it's a feature thread. + +# _envcommon + +Haxx0r ipsum race condition case void then else todo server eaten by a grue deadlock. Bit bin dereference foo class unix bit script kiddies firewall mega new hash worm hack the mainframe loop Trojan horse Donald Knuth. Ssh emacs crack stdio.h mountain dew recursively win hexadecimal. + +Race condition rsa fopen dereference deadlock baz system nak case eaten by a grue foad bypass throw pragma mainframe injection back door. Leapfrog strlen port Starcraft ddos break bubble sort semaphore I'm compiling Linus Torvalds. Hack the mainframe vi loop gobble grep false char cache mailbomb terminal L0phtCrack lib brute force wannabee. + +Bin root emacs I'm sorry Dave, I'm afraid I can't do that. Less printf class bubble sort nak char fork cd warez ifdef if tunnel in ban continue ascii machine code injection fopen error win double system. Protected deadlock try catch python int break mutex new cat headers Dennis Ritchie epoch stack trace race condition. + + + + diff --git a/docs/refarch/whats-this/index.md b/docs/refarch/whats-this/index.md index e6d8397110..ec6e1dcb06 100644 --- a/docs/refarch/whats-this/index.md +++ b/docs/refarch/whats-this/index.md @@ -1,11 +1,16 @@ # What is all this? -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. + +Haxx0r ipsum endif race condition d00dz fork cookie recursively big-endian tera. Wabbit break concurrently printf script kiddies eof cd malloc warez chown kilo /dev/null todo ascii foad bang exception highjack epoch headers. Flush data piggyback class hexadecimal true syn ddos daemon snarf over clock. + +Cookie packet sniffer ifdef endif all your base are belong to us stdio.h bin ssh I'm sorry Dave, I'm afraid I can't do that terminal hack the mainframe. Concurrently Leslie Lamport brute force else socket malloc over clock foo grep double var mainframe. Ip cache access buffer pwned bytes system packet todo emacs gurfle dereference foad strlen deadlock alloc cat false for /dev/null. + +Wannabee dereference private wombat case root fatal char giga Leslie Lamport perl sudo sql ascii cat grep James T. Kirk bin stack trace afk. Malloc foad class daemon I'm compiling salt brute force highjack syn regex socket exception warez hexadecimal linux bit bytes echo hack the mainframe. Then wabbit injection Linus Torvalds pragma tunnel in data win protocol leet fopen printf void default gc Starcraft piggyback todo gnu concurrently. diff --git a/docs/refarch/whats-this/services.md b/docs/refarch/whats-this/services.md new file mode 100644 index 0000000000..ef83022ef1 --- /dev/null +++ b/docs/refarch/whats-this/services.md @@ -0,0 +1,8 @@ + + + diff --git a/docs/refarch/whats-this/what-is-a-reference-architecture.md b/docs/refarch/whats-this/what-is-a-reference-architecture.md new file mode 100644 index 0000000000..01eec65913 --- /dev/null +++ b/docs/refarch/whats-this/what-is-a-reference-architecture.md @@ -0,0 +1,16 @@ +# What is a Reference Architecture? + +Haxx0r ipsum interpreter bang cookie eof over clock exception function ban mountain dew irc loop public *.* gc python hack the mainframe. Try catch ip double printf grep buffer deadlock January 1, 1970 stack todo nak throw if /dev/null infinite loop socket port chown hello world class. Giga afk Dennis Ritchie pragma I'm compiling big-endian fopen server boolean xss ddos memory leak void L0phtCrack. + +Injection rsa script kiddies salt printf gurfle int access linux stdio.h cache alloc null fail gc thread. Flush foad I'm sorry Dave, I'm afraid I can't do that else overflow emacs Starcraft unix echo ctl-c cookie. Hexadecimal injection brute force gcc warez function *.* pwned mainframe win big-endian. + +Mega else data d00dz nak null void protected cat ban port machine code. Interpreter bang system wabbit wannabee error syn float hack the mainframe mutex all your base are belong to us. Packet sniffer ifdef var endif gobble Trojan horse rm -rf cd bar January 1, 1970 packet race condition. + + + + diff --git a/sidebars/refarch.js b/sidebars/refarch.js index 0fa828c5d7..15409fe478 100644 --- a/sidebars/refarch.js +++ b/sidebars/refarch.js @@ -5,31 +5,39 @@ const sidebar = [ collapsible: false, items: [ { - label: "What is all this?", + label: "Overview", type: "category", - link: { - type: "doc", - id: "refarch/whats-this/index", - }, - items: [], + collapsible: false, + items: [ + "refarch/whats-this/index", + "refarch/whats-this/what-is-a-reference-architecture", + "refarch/whats-this/how-does-the-gruntwork-reference-architecture-differ", + ] }, { - label: "Bootstrapping your Reference Architecture", + label: "Bootstrapping Your Reference Architecture", type: "category", - link: { - type: "doc", - id: "refarch/bootstrapping-your-reference-architecture/index", - }, - items: [], + collapsible: false, + items: [ + "refarch/bootstrapping/index", + "refarch/bootstrapping/configuring-your-refarch-for-delivery/index", + "refarch/bootstrapping/configuring-your-refarch-for-delivery/path1", + "refarch/bootstrapping/configuring-your-refarch-for-delivery/path2", + ], }, { label: "Usage", type: "category", - link: { - type: "doc", - id: "refarch/usage/index", - }, - items: [], + collapsible: false, + items: [ + ], + }, + { + label: "Support", + type: "category", + collapsible: false, + items: [ + ] }, ], }, From e7300de8ca7361348a90e44db6c4f28b1df72eba Mon Sep 17 00:00:00 2001 From: Zachary Proser Date: Mon, 8 May 2023 17:11:05 -0400 Subject: [PATCH 21/89] Begin building out refarch/usage section --- .../refarch/usage/getting-help/index.md | 1 + .../usage/maintain-your-refarch/index.md | 30 ++++++++++++++++- .../usage/pipelines-integration/index.md | 28 +++++++++++++++- docs/refarch/usage/getting-help/index.md | 9 ++++++ .../usage/maintain-your-refarch/index.md | 32 +++++++++++++++++-- .../usage/pipelines-integration/index.md | 30 +++++++++++++++-- sidebars/refarch.js | 3 ++ 7 files changed, 127 insertions(+), 6 deletions(-) create mode 100644 _docs-sources/refarch/usage/getting-help/index.md create mode 100644 docs/refarch/usage/getting-help/index.md diff --git a/_docs-sources/refarch/usage/getting-help/index.md b/_docs-sources/refarch/usage/getting-help/index.md new file mode 100644 index 0000000000..f041879dbb --- /dev/null +++ b/_docs-sources/refarch/usage/getting-help/index.md @@ -0,0 +1 @@ +# Link: support diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/index.md b/_docs-sources/refarch/usage/maintain-your-refarch/index.md index 4976c545ff..5c787ee72c 100644 --- a/_docs-sources/refarch/usage/maintain-your-refarch/index.md +++ b/_docs-sources/refarch/usage/maintain-your-refarch/index.md @@ -1,3 +1,31 @@ # Maintain your Reference Architecture -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. +## How to: Add a new AWS Account + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. + +## How to: undeploy Ref Arch / modules + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. + +## Stay up to date + +Link to Patcher docs? + +## How to: upgrade Terraform across your modules + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. + + diff --git a/_docs-sources/refarch/usage/pipelines-integration/index.md b/_docs-sources/refarch/usage/pipelines-integration/index.md index 1fde5a1662..edc9308b80 100644 --- a/_docs-sources/refarch/usage/pipelines-integration/index.md +++ b/_docs-sources/refarch/usage/pipelines-integration/index.md @@ -1,3 +1,29 @@ # Pipelines integration -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## Step 1: Set up machine user creds + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +## Verify: Testing an infrastructure change end to end + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## (Optional) Configure Slack notifications + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. diff --git a/docs/refarch/usage/getting-help/index.md b/docs/refarch/usage/getting-help/index.md new file mode 100644 index 0000000000..2fd9aec1a1 --- /dev/null +++ b/docs/refarch/usage/getting-help/index.md @@ -0,0 +1,9 @@ +# Link: support + + + diff --git a/docs/refarch/usage/maintain-your-refarch/index.md b/docs/refarch/usage/maintain-your-refarch/index.md index 39e6886471..ca583d9eda 100644 --- a/docs/refarch/usage/maintain-your-refarch/index.md +++ b/docs/refarch/usage/maintain-your-refarch/index.md @@ -1,11 +1,39 @@ # Maintain your Reference Architecture -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. +## How to: Add a new AWS Account + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. + +## How to: undeploy Ref Arch / modules + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. + +## Stay up to date + +Link to Patcher docs? + +## How to: upgrade Terraform across your modules + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. + + diff --git a/docs/refarch/usage/pipelines-integration/index.md b/docs/refarch/usage/pipelines-integration/index.md index 2e78df3bfe..d56e62f8ee 100644 --- a/docs/refarch/usage/pipelines-integration/index.md +++ b/docs/refarch/usage/pipelines-integration/index.md @@ -1,11 +1,37 @@ # Pipelines integration -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## Step 1: Set up machine user creds + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +## Verify: Testing an infrastructure change end to end + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## (Optional) Configure Slack notifications + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. diff --git a/sidebars/refarch.js b/sidebars/refarch.js index 15409fe478..762acf6663 100644 --- a/sidebars/refarch.js +++ b/sidebars/refarch.js @@ -30,6 +30,9 @@ const sidebar = [ type: "category", collapsible: false, items: [ + "refarch/usage/maintain-your-refarch/index", + "refarch/usage/getting-help/index", + "refarch/usage/pipelines-integration/index", ], }, { From 7edd9a10e664b7287536f7b6458439b68292b8a9 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Mon, 8 May 2023 15:05:53 -0700 Subject: [PATCH 22/89] add stubbed support page for refarch to make PR app work again --- sidebars/refarch.js | 1 + 1 file changed, 1 insertion(+) diff --git a/sidebars/refarch.js b/sidebars/refarch.js index 762acf6663..a9f00849bf 100644 --- a/sidebars/refarch.js +++ b/sidebars/refarch.js @@ -40,6 +40,7 @@ const sidebar = [ type: "category", collapsible: false, items: [ + "refarch/usage/getting-help/index" ] }, ], From 283a174cba76c6edff4e42c2f72aececa0bbec50 Mon Sep 17 00:00:00 2001 From: Zachary Proser Date: Tue, 9 May 2023 08:36:51 -0400 Subject: [PATCH 23/89] Check in accessing the Ref Arch docs --- .../refarch/access/how-to-auth-cli/index.md | 24 +++++++++++++ .../access/how-to-auth-console/index.md | 24 +++++++++++++ .../refarch/access/how-to-auth-ec2/index.md | 9 +++++ .../refarch/access/how-to-auth-vpn/index.md | 9 +++++ _docs-sources/refarch/access/index.md | 9 +++++ .../refarch/access/setup-auth/index.md | 27 ++++++++++++++ docs/refarch/access/how-to-auth-cli/index.md | 32 +++++++++++++++++ .../access/how-to-auth-console/index.md | 32 +++++++++++++++++ docs/refarch/access/how-to-auth-ec2/index.md | 17 +++++++++ docs/refarch/access/how-to-auth-vpn/index.md | 17 +++++++++ docs/refarch/access/index.md | 17 +++++++++ docs/refarch/access/setup-auth/index.md | 35 +++++++++++++++++++ sidebars/refarch.js | 14 +++++++- 13 files changed, 265 insertions(+), 1 deletion(-) create mode 100644 _docs-sources/refarch/access/how-to-auth-cli/index.md create mode 100644 _docs-sources/refarch/access/how-to-auth-console/index.md create mode 100644 _docs-sources/refarch/access/how-to-auth-ec2/index.md create mode 100644 _docs-sources/refarch/access/how-to-auth-vpn/index.md create mode 100644 _docs-sources/refarch/access/index.md create mode 100644 _docs-sources/refarch/access/setup-auth/index.md create mode 100644 docs/refarch/access/how-to-auth-cli/index.md create mode 100644 docs/refarch/access/how-to-auth-console/index.md create mode 100644 docs/refarch/access/how-to-auth-ec2/index.md create mode 100644 docs/refarch/access/how-to-auth-vpn/index.md create mode 100644 docs/refarch/access/index.md create mode 100644 docs/refarch/access/setup-auth/index.md diff --git a/_docs-sources/refarch/access/how-to-auth-cli/index.md b/_docs-sources/refarch/access/how-to-auth-cli/index.md new file mode 100644 index 0000000000..7101a603da --- /dev/null +++ b/_docs-sources/refarch/access/how-to-auth-cli/index.md @@ -0,0 +1,24 @@ +# How to authenticate on the command line (CLI) + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## Accessing resources + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## Using aws-vault with the Reference Architecture + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + diff --git a/_docs-sources/refarch/access/how-to-auth-console/index.md b/_docs-sources/refarch/access/how-to-auth-console/index.md new file mode 100644 index 0000000000..805f8d50e2 --- /dev/null +++ b/_docs-sources/refarch/access/how-to-auth-console/index.md @@ -0,0 +1,24 @@ +# How to authenticate to the AWS Web Console + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## Security account difference + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## How the IAM roles work + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + diff --git a/_docs-sources/refarch/access/how-to-auth-ec2/index.md b/_docs-sources/refarch/access/how-to-auth-ec2/index.md new file mode 100644 index 0000000000..701aa13a7b --- /dev/null +++ b/_docs-sources/refarch/access/how-to-auth-ec2/index.md @@ -0,0 +1,9 @@ +# How to SSH to an EC2 Instance + + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + diff --git a/_docs-sources/refarch/access/how-to-auth-vpn/index.md b/_docs-sources/refarch/access/how-to-auth-vpn/index.md new file mode 100644 index 0000000000..c575d4e4cd --- /dev/null +++ b/_docs-sources/refarch/access/how-to-auth-vpn/index.md @@ -0,0 +1,9 @@ +# How to authenticate to the VPN + + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + diff --git a/_docs-sources/refarch/access/index.md b/_docs-sources/refarch/access/index.md new file mode 100644 index 0000000000..d618789c98 --- /dev/null +++ b/_docs-sources/refarch/access/index.md @@ -0,0 +1,9 @@ +# How do I access my Reference Architecture? + + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + diff --git a/_docs-sources/refarch/access/setup-auth/index.md b/_docs-sources/refarch/access/setup-auth/index.md new file mode 100644 index 0000000000..7bd1bb691a --- /dev/null +++ b/_docs-sources/refarch/access/setup-auth/index.md @@ -0,0 +1,27 @@ +# Do this first: Set up AWS Auth + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## 1. Configure root user + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## 2. Configure your IAM users + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## 3. Configure other IAM users + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. diff --git a/docs/refarch/access/how-to-auth-cli/index.md b/docs/refarch/access/how-to-auth-cli/index.md new file mode 100644 index 0000000000..a1b1fcb975 --- /dev/null +++ b/docs/refarch/access/how-to-auth-cli/index.md @@ -0,0 +1,32 @@ +# How to authenticate on the command line (CLI) + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## Accessing resources + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## Using aws-vault with the Reference Architecture + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + + + + diff --git a/docs/refarch/access/how-to-auth-console/index.md b/docs/refarch/access/how-to-auth-console/index.md new file mode 100644 index 0000000000..e951be3dcf --- /dev/null +++ b/docs/refarch/access/how-to-auth-console/index.md @@ -0,0 +1,32 @@ +# How to authenticate to the AWS Web Console + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## Security account difference + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## How the IAM roles work + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + + + + diff --git a/docs/refarch/access/how-to-auth-ec2/index.md b/docs/refarch/access/how-to-auth-ec2/index.md new file mode 100644 index 0000000000..63fc2d9960 --- /dev/null +++ b/docs/refarch/access/how-to-auth-ec2/index.md @@ -0,0 +1,17 @@ +# How to SSH to an EC2 Instance + + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + + + + diff --git a/docs/refarch/access/how-to-auth-vpn/index.md b/docs/refarch/access/how-to-auth-vpn/index.md new file mode 100644 index 0000000000..f2910ee437 --- /dev/null +++ b/docs/refarch/access/how-to-auth-vpn/index.md @@ -0,0 +1,17 @@ +# How to authenticate to the VPN + + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + + + + diff --git a/docs/refarch/access/index.md b/docs/refarch/access/index.md new file mode 100644 index 0000000000..f633b33730 --- /dev/null +++ b/docs/refarch/access/index.md @@ -0,0 +1,17 @@ +# How do I access my Reference Architecture? + + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + + + + diff --git a/docs/refarch/access/setup-auth/index.md b/docs/refarch/access/setup-auth/index.md new file mode 100644 index 0000000000..3a87a735ea --- /dev/null +++ b/docs/refarch/access/setup-auth/index.md @@ -0,0 +1,35 @@ +# Do this first: Set up AWS Auth + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## 1. Configure root user + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## 2. Configure your IAM users + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## 3. Configure other IAM users + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + + + diff --git a/sidebars/refarch.js b/sidebars/refarch.js index a9f00849bf..0e23e14e73 100644 --- a/sidebars/refarch.js +++ b/sidebars/refarch.js @@ -33,8 +33,20 @@ const sidebar = [ "refarch/usage/maintain-your-refarch/index", "refarch/usage/getting-help/index", "refarch/usage/pipelines-integration/index", - ], + ], }, + { + label: "Access", + type: "category", + collapsible: false, + items: [ + "refarch/access/setup-auth/index", + "refarch/access/how-to-auth-vpn/index", + "refarch/access/how-to-auth-console/index", + "refarch/access/how-to-auth-cli/index", + "refarch/access/how-to-auth-ec2/index" + ], + }, { label: "Support", type: "category", From 9d310f42223a900d11eeabca66af3646d541d8fa Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Wed, 10 May 2023 08:47:45 -0700 Subject: [PATCH 24/89] shift things around per feedback --- _docs-sources/docs-and-references.md | 5 -- _docs-sources/pipelines/how-it-works/index.md | 68 +++++++++++++++++++ _docs-sources/pipelines/maintain/extending.md | 7 ++ _docs-sources/pipelines/maintain/updating.md | 6 ++ .../pipelines/multi-account/index.md | 13 ++++ _docs-sources/pipelines/tutorial/index.md | 19 ++++++ _docs-sources/pipelines/what-is-it/index.md | 8 +++ docs/docs-and-references.md | 7 +- docs/pipelines/how-it-works/index.md | 8 +++ docs/pipelines/maintain/extending.md | 8 +++ docs/pipelines/maintain/updating.md | 8 +++ docs/pipelines/multi-account/index.md | 8 +++ docs/pipelines/tutorial/index.md | 8 +++ docs/pipelines/what-is-it/index.md | 8 +++ docusaurus.config.js | 44 +++++++++++- 15 files changed, 211 insertions(+), 14 deletions(-) create mode 100644 _docs-sources/pipelines/how-it-works/index.md create mode 100644 _docs-sources/pipelines/maintain/extending.md create mode 100644 _docs-sources/pipelines/maintain/updating.md create mode 100644 _docs-sources/pipelines/multi-account/index.md create mode 100644 _docs-sources/pipelines/tutorial/index.md create mode 100644 _docs-sources/pipelines/what-is-it/index.md diff --git a/_docs-sources/docs-and-references.md b/_docs-sources/docs-and-references.md index 16aef576bf..2b0304e462 100644 --- a/_docs-sources/docs-and-references.md +++ b/_docs-sources/docs-and-references.md @@ -32,11 +32,6 @@ Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor i href="/landing-zone"> Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - diff --git a/_docs-sources/pipelines/how-it-works/index.md b/_docs-sources/pipelines/how-it-works/index.md new file mode 100644 index 0000000000..7d9a57c730 --- /dev/null +++ b/_docs-sources/pipelines/how-it-works/index.md @@ -0,0 +1,68 @@ +# How it works + +In order to maximize our synergistic value proposition, we need to leverage our core competencies in order to achieve our strategic objectives. We need to think outside the box and come up with innovative solutions that will allow us to disrupt the market and gain a competitive advantage. We also need to focus on our customer experience and provide them with a seamless and personalized journey. + +## Block Diagram + +![CIS Benchmark Architecture](/img/pipelines-docker-packer-builder.png) + +## External CI Tool + +We need to be agile and adaptable in order to respond to the ever-changing business landscape. We need to be able to quickly pivot and change course when necessary. We also need to be able to collaborate effectively with our partners and stakeholders in order to achieve our goals. + +## Invoker Lambda + +Oh my goodness, have I told you about the time I saw a beautiful Blue Jay perched on my windowsill? It was truly a sight to behold! But I digress... let me tell you about AWS Lambda functions, which are like the busy little hummingbirds of the cloud computing world. + +Picture this: a Lambda function is like a bird feeder that sits and waits for requests to come in, just like a bird feeder waits for feathered friends to come and snack. But instead of seed, it's programmed to receive code and execute it. + +## ECS Deploy Runner + +Hark! Let me spin you a tale of wondrous tool, +That doth aid in deploying software cool. +This tool, 'tis known as ECS Deploy Runner, +A champion of those who deploy with honor. + +In Amazon's world of cloud, it doth reside, +Where containers reign with power and pride. +This runner, like a loyal squire true, +Doth serve those who would deploy anew. + +With ECS as its liege, it doth obey, +And to the cloud, it doth make its way. +In rolling updates, it doth excel, +Ensuring no downtime, all shall be well. + +### Standard Configuration + +Its mission, to deploy with utmost care, +And make the process smooth, beyond compare. +With blue-green deployments, it doth impress, +And safely switches traffic without stress. + +And when the task is done, it doth report, +On all that happened, to provide support. +With logs and metrics, it doth reveal, +The story of the deployment's ordeal. + +### Docker Image Builder (Kaniko) + +And lo, there was a tool called Kaniko, born of the land of Google, and it was a builder of Docker images. And the people did marvel at its greatness, for it did not require the use of a Docker daemon, nor did it need root privileges. + +Kaniko was a humble tool, born of the desire to provide a secure and reliable way to build Docker images in a Kubernetes environment. It did not seek glory or power, but instead sought to serve the people, to make their lives easier and their applications more secure. + +And Kaniko did work diligently, using its many talents to build Docker images in a way that was both efficient and trustworthy. It did not rely on a Docker daemon, but instead used a container to perform the build process, ensuring that the image was built in a clean and isolated environment. + +And the people did praise Kaniko, for it did not require root privileges, and could be run by users without fear of compromising the system. It did not store secrets in the Docker daemon, but instead used a secure file system to store them, ensuring that they could not be accessed by unauthorized parties. + +### Terraform Planner/Applier + +In the realm of deployment, there exist powerful tools that rival the strength and cunning of even the most feared warriors. Among them, the ECS Deploy Runner, Terraform Planner, and Applier stand tall, ready to unleash their might upon the field of battle. + +The ECS Deploy Runner is like a fierce direwolf, swift and agile, capable of executing complex deployment tasks with ease. It is the tool of choice for those who seek to deploy their applications with speed and precision. + +The Terraform Planner is like a wise and ancient dragon, possessing an almost infinite knowledge of the infrastructure it seeks to conquer. With its keen intellect, it can survey the land and plan the deployment with utmost accuracy, leaving no stone unturned in its quest for victory. + +The Applier, on the other hand, is like a steadfast and loyal knight, resolute in its determination to carry out the orders of its master. With unflinching obedience, it applies the deployment plan, ensuring that every detail is executed with precision and care. + +Together, these tools form a formidable trio, capable of conquering even the most daunting deployment challenges. They are the guardians of the realm of deployment, and those who are wise enough to enlist their aid can rest assured that their applications will be deployed with the utmost efficiency and effectiveness. diff --git a/_docs-sources/pipelines/maintain/extending.md b/_docs-sources/pipelines/maintain/extending.md new file mode 100644 index 0000000000..ac12f43773 --- /dev/null +++ b/_docs-sources/pipelines/maintain/extending.md @@ -0,0 +1,7 @@ +# Extending your Pipeline + +Ug ug. Me type. You read. Me make words for big brain. Me use stick on rock. Me try hard. You see? + +Me have idea. Me tell you story. Long time ago, big mammoth roam land. Caveman hunt mammoth. Caveman win. Caveman happy. + +Me tired now. Me rest. You like words? Me make more later. Ug ug. diff --git a/_docs-sources/pipelines/maintain/updating.md b/_docs-sources/pipelines/maintain/updating.md new file mode 100644 index 0000000000..23837c7ac3 --- /dev/null +++ b/_docs-sources/pipelines/maintain/updating.md @@ -0,0 +1,6 @@ +# Updating Your Pipeline +Is there anything more frustrating than having to put up with those obnoxious notifications and the seemingly never-ending cycle of downloads, installs, and reboots? Every time you think you've finally managed to get your computer to run smoothly, those darn updates come along and mess everything up again. + +And let's not forget how unpredictable they can be! One minute you're casually browsing the internet, and the next minute your computer is stuck in an update loop, wasting your time and energy. And don't even try to cancel or pause an update once it's started - that's a recipe for disaster. + +And the worst part? Even when the updates are finally finished, there's no guarantee that everything will work as it should. You could end up with new bugs, glitches, or compatibility issues that you never had before. diff --git a/_docs-sources/pipelines/multi-account/index.md b/_docs-sources/pipelines/multi-account/index.md new file mode 100644 index 0000000000..a9625729f9 --- /dev/null +++ b/_docs-sources/pipelines/multi-account/index.md @@ -0,0 +1,13 @@ +# Deploying Multi-Account Pipelines + +Have you heard about AWS multi-account setups? It's like having a pack of dogs - each one with its own unique personality, strengths, and weaknesses, but all working together to accomplish a common goal. + +Imagine you have a pack of dogs, each with their own special skills. You've got a fierce protector who guards the house, a speedy runner who chases down anything that moves, and a snuggly lap dog who just wants to cuddle all day. Each dog has its own needs, but they all rely on you as their owner to provide for them and keep them safe. + +Similarly, with AWS multi-account setups, you can have a whole pack of accounts, each with its own unique configuration and requirements, but all managed from a single "parent" account. It's like being the alpha dog of a pack, making sure each member is fed, healthy, and happy. + +And just like with a pack of dogs, there are different roles and responsibilities within an AWS multi-account setup. You've got the "owner" account, which is responsible for managing all the other accounts in the pack, and then you've got the "member" accounts, each with their own specific purposes and functions. + +It's important to keep all your accounts organized and working together smoothly, just like how you would keep your pack of dogs in line. You don't want one dog to get too aggressive and start fighting with the others, just like you don't want one AWS account to start interfering with the others. + +But if you can manage your pack of dogs successfully, they can work together to accomplish great things - just like how an AWS multi-account setup can help you achieve your goals with ease and efficiency. So, if you're a dog lover like me, you'll find that AWS multi-account setups are just as fun and rewarding as having a pack of loyal furry friends by your side. Woof! diff --git a/_docs-sources/pipelines/tutorial/index.md b/_docs-sources/pipelines/tutorial/index.md new file mode 100644 index 0000000000..61f5ca168c --- /dev/null +++ b/_docs-sources/pipelines/tutorial/index.md @@ -0,0 +1,19 @@ +# Tutorial + +Step 1: Setting up your code repository +First, you need to create a repository for your code. Just like how cats need a cozy bed to sleep in, your code needs a cozy home too. You can use GitHub, GitLab or Bitbucket to host your code. Choose whichever platform suits you best. Meow-ver, remember to give your repository a pawsome name, something like "Feline-Friendly-CI-CD-Pipeline" would be perfect. + +Step 2: Choose your CI/CD tool +Just like how cats have different personalities, there are many different CI/CD tools to choose from. Some popular options are Jenkins, Travis CI, CircleCI, and GitLab CI/CD. Research each tool to find the one that suits your needs best. + +Step 3: Create a pipeline script +The pipeline script is like a recipe for your CI/CD pipeline. You can use a scripting language like Groovy or YAML to write the script. Make sure to include steps for building, testing, and deploying your code. Also, don't forget to add some cat puns to the script to keep it meow-nteresting. For example, you could add a step to "check if the code is purr-fect" or "run a meow-ssive amount of tests". + +Step 4: Test your pipeline locally +Before you deploy your pipeline, you should test it locally to make sure it works as intended. This is like when cats scratch their scratching post to make sure it's sturdy enough for their needs. Use the CI/CD tool you chose to run the pipeline script locally. + +Step 5: Deploy your pipeline +Now it's time to deploy your pipeline to your code repository. This is like when a cat finds a new hiding spot and decides to make it their own. Meow-ver, don't forget to configure your CI/CD tool to trigger the pipeline whenever changes are made to the code repository. + +Step 6: Monitor and improve your pipeline +Just like how you need to monitor your cat's health to make sure they're happy and healthy, you need to monitor your pipeline to make sure it's working properly. Keep an eye on the pipeline's logs and metrics to make sure everything is running smoothly. If you notice any issues, make improvements to your pipeline script to fix them. diff --git a/_docs-sources/pipelines/what-is-it/index.md b/_docs-sources/pipelines/what-is-it/index.md new file mode 100644 index 0000000000..270b11f1c0 --- /dev/null +++ b/_docs-sources/pipelines/what-is-it/index.md @@ -0,0 +1,8 @@ +# Overview + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. At lectus urna duis convallis convallis tellus id interdum velit. Pretium vulputate sapien nec sagittis aliquam. Tristique senectus et netus et. Nullam eget felis eget nunc lobortis mattis aliquam faucibus purus. Aliquet sagittis id consectetur purus ut. Lectus magna fringilla urna porttitor rhoncus dolor. Eget felis eget nunc lobortis mattis aliquam faucibus purus in. Erat nam at lectus urna duis convallis convallis. Euismod lacinia at quis risus sed vulputate odio. + +# Secure by Design + +This is a paragraph. It might not seem long enough, but it is. + diff --git a/docs/docs-and-references.md b/docs/docs-and-references.md index 986fa36089..1937e41712 100644 --- a/docs/docs-and-references.md +++ b/docs/docs-and-references.md @@ -32,11 +32,6 @@ Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor i href="/landing-zone"> Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - @@ -57,6 +52,6 @@ Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor i diff --git a/docs/pipelines/how-it-works/index.md b/docs/pipelines/how-it-works/index.md index 7d9a57c730..09520a3ce5 100644 --- a/docs/pipelines/how-it-works/index.md +++ b/docs/pipelines/how-it-works/index.md @@ -66,3 +66,11 @@ The Terraform Planner is like a wise and ancient dragon, possessing an almost in The Applier, on the other hand, is like a steadfast and loyal knight, resolute in its determination to carry out the orders of its master. With unflinching obedience, it applies the deployment plan, ensuring that every detail is executed with precision and care. Together, these tools form a formidable trio, capable of conquering even the most daunting deployment challenges. They are the guardians of the realm of deployment, and those who are wise enough to enlist their aid can rest assured that their applications will be deployed with the utmost efficiency and effectiveness. + + + diff --git a/docs/pipelines/maintain/extending.md b/docs/pipelines/maintain/extending.md index ac12f43773..8218ca17e6 100644 --- a/docs/pipelines/maintain/extending.md +++ b/docs/pipelines/maintain/extending.md @@ -5,3 +5,11 @@ Ug ug. Me type. You read. Me make words for big brain. Me use stick on rock. Me Me have idea. Me tell you story. Long time ago, big mammoth roam land. Caveman hunt mammoth. Caveman win. Caveman happy. Me tired now. Me rest. You like words? Me make more later. Ug ug. + + + diff --git a/docs/pipelines/maintain/updating.md b/docs/pipelines/maintain/updating.md index 23837c7ac3..13c2a65ec5 100644 --- a/docs/pipelines/maintain/updating.md +++ b/docs/pipelines/maintain/updating.md @@ -4,3 +4,11 @@ Is there anything more frustrating than having to put up with those obnoxious no And let's not forget how unpredictable they can be! One minute you're casually browsing the internet, and the next minute your computer is stuck in an update loop, wasting your time and energy. And don't even try to cancel or pause an update once it's started - that's a recipe for disaster. And the worst part? Even when the updates are finally finished, there's no guarantee that everything will work as it should. You could end up with new bugs, glitches, or compatibility issues that you never had before. + + + diff --git a/docs/pipelines/multi-account/index.md b/docs/pipelines/multi-account/index.md index a9625729f9..cd78a9a91e 100644 --- a/docs/pipelines/multi-account/index.md +++ b/docs/pipelines/multi-account/index.md @@ -11,3 +11,11 @@ And just like with a pack of dogs, there are different roles and responsibilitie It's important to keep all your accounts organized and working together smoothly, just like how you would keep your pack of dogs in line. You don't want one dog to get too aggressive and start fighting with the others, just like you don't want one AWS account to start interfering with the others. But if you can manage your pack of dogs successfully, they can work together to accomplish great things - just like how an AWS multi-account setup can help you achieve your goals with ease and efficiency. So, if you're a dog lover like me, you'll find that AWS multi-account setups are just as fun and rewarding as having a pack of loyal furry friends by your side. Woof! + + + diff --git a/docs/pipelines/tutorial/index.md b/docs/pipelines/tutorial/index.md index 61f5ca168c..8f698035d7 100644 --- a/docs/pipelines/tutorial/index.md +++ b/docs/pipelines/tutorial/index.md @@ -17,3 +17,11 @@ Now it's time to deploy your pipeline to your code repository. This is like when Step 6: Monitor and improve your pipeline Just like how you need to monitor your cat's health to make sure they're happy and healthy, you need to monitor your pipeline to make sure it's working properly. Keep an eye on the pipeline's logs and metrics to make sure everything is running smoothly. If you notice any issues, make improvements to your pipeline script to fix them. + + + diff --git a/docs/pipelines/what-is-it/index.md b/docs/pipelines/what-is-it/index.md index 270b11f1c0..505328b8fc 100644 --- a/docs/pipelines/what-is-it/index.md +++ b/docs/pipelines/what-is-it/index.md @@ -6,3 +6,11 @@ Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor i This is a paragraph. It might not seem long enough, but it is. + + + diff --git a/docusaurus.config.js b/docusaurus.config.js index 983f7b66a2..4312557978 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -94,10 +94,48 @@ const config = { docId: "intro/overview/intro-to-gruntwork", }, { - type: "doc", + type: "dropdown", position: "left", - label: "Docs and References", - docId: "docs-and-references" + label: "Docs", + id: "docs", + items: [ + { + type: "doc", + label: "Infrastructure as Code Library", + docId: "iac/whats-this/index" + }, + { + type: "doc", + label: "Gruntwork Pipelines", + docId: "pipelines/what-is-it/index" + }, + { + type: "doc", + label: "Reference Architecture", + docId: "refarch/whats-this/index" + }, + { + type: "doc", + label: "Developer Portal", + docId: "developer-portal/create-account" + }, + ], + }, + { + type: "dropdown", + label: "Library Reference", + items: [ + { + type: "doc", + label: "Modules", + docId: "reference/modules/intro", + }, + { + type: "doc", + label: "Services", + docId: "reference/services/intro/overview", + }, + ], }, { to: "/tools", label: "Tools", position: "left" }, { to: "/courses", label: "Courses", position: "left" }, From 1ef702ed31aea81cf3a144fb77480ffbf986e9d6 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Wed, 10 May 2023 08:49:47 -0700 Subject: [PATCH 25/89] make pipelines sidebar be always open --- sidebars/pipelines.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sidebars/pipelines.js b/sidebars/pipelines.js index 1487e7646f..c083d55df4 100644 --- a/sidebars/pipelines.js +++ b/sidebars/pipelines.js @@ -12,6 +12,7 @@ const sidebar = [ { label: "Learn Pipelines", type: "category", + collapsible: false, items: [ { label: "How it works", @@ -33,6 +34,7 @@ const sidebar = [ { label: "Maintain Pipelines", type: "category", + collapsible: false, items: ["pipelines/maintain/updating", "pipelines/maintain/extending"], }, ] From d676684219e1d489a43f880cc89b219a0562eda7 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Wed, 10 May 2023 08:58:53 -0700 Subject: [PATCH 26/89] make library reference a page --- docusaurus.config.js | 16 +++------------- sidebars/iac.js | 9 ++++++++- 2 files changed, 11 insertions(+), 14 deletions(-) diff --git a/docusaurus.config.js b/docusaurus.config.js index 4312557978..63a636c914 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -122,20 +122,10 @@ const config = { ], }, { - type: "dropdown", + type: "doc", label: "Library Reference", - items: [ - { - type: "doc", - label: "Modules", - docId: "reference/modules/intro", - }, - { - type: "doc", - label: "Services", - docId: "reference/services/intro/overview", - }, - ], + docId: "iac/reference/index", + }, { to: "/tools", label: "Tools", position: "left" }, { to: "/courses", label: "Courses", position: "left" }, diff --git a/sidebars/iac.js b/sidebars/iac.js index ac869d0671..ef616782e3 100644 --- a/sidebars/iac.js +++ b/sidebars/iac.js @@ -25,7 +25,7 @@ const sidebar = [ ], }, { - label: "Usage", + label: "Working with Modules", type: "category", collapsible: false, items: [ @@ -33,6 +33,13 @@ const sidebar = [ "iac/usage/using-a-service", "iac/usage/customizing-modules", "iac/usage/composing-your-own-service", + ], + }, + { + label: "Staying up to date", + type: "category", + collapsible: false, + items: [ "iac/usage/versioning", "iac/usage/stay-up-to-date", ], From b5f75cf515da61b25f8c098146505381faee636e Mon Sep 17 00:00:00 2001 From: Zachary Proser Date: Wed, 10 May 2023 11:54:26 -0400 Subject: [PATCH 27/89] Implement initial RefArch section feedback: - Collapse what's this to what is a Ref Arch - Add understanding deployment process doc --- .../understanding-the-deployment-process.md | 19 +++++++++++++ .../understanding-the-deployment-process.md | 27 +++++++++++++++++++ sidebars/refarch.js | 4 +-- 3 files changed, 48 insertions(+), 2 deletions(-) create mode 100644 _docs-sources/refarch/whats-this/understanding-the-deployment-process.md create mode 100644 docs/refarch/whats-this/understanding-the-deployment-process.md diff --git a/_docs-sources/refarch/whats-this/understanding-the-deployment-process.md b/_docs-sources/refarch/whats-this/understanding-the-deployment-process.md new file mode 100644 index 0000000000..8ba7bfeaec --- /dev/null +++ b/_docs-sources/refarch/whats-this/understanding-the-deployment-process.md @@ -0,0 +1,19 @@ +# Understanding the deployment process + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. + +# Phase 1: Configuration + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +# Phase 2: Delivery + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +# Phase 3: Adoption + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. diff --git a/docs/refarch/whats-this/understanding-the-deployment-process.md b/docs/refarch/whats-this/understanding-the-deployment-process.md new file mode 100644 index 0000000000..ec39d329a9 --- /dev/null +++ b/docs/refarch/whats-this/understanding-the-deployment-process.md @@ -0,0 +1,27 @@ +# Understanding the deployment process + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. + +# Phase 1: Configuration + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +# Phase 2: Delivery + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +# Phase 3: Adoption + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + + + diff --git a/sidebars/refarch.js b/sidebars/refarch.js index 0e23e14e73..eb02030fa2 100644 --- a/sidebars/refarch.js +++ b/sidebars/refarch.js @@ -9,13 +9,13 @@ const sidebar = [ type: "category", collapsible: false, items: [ - "refarch/whats-this/index", "refarch/whats-this/what-is-a-reference-architecture", "refarch/whats-this/how-does-the-gruntwork-reference-architecture-differ", + "refarch/whats-this/understanding-the-deployment-process" ] }, { - label: "Bootstrapping Your Reference Architecture", + label: "Configuration", type: "category", collapsible: false, items: [ From d62d0cb9290096567cb6df7b1160e400fae98893 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Wed, 10 May 2023 09:03:32 -0700 Subject: [PATCH 28/89] fix sidebar for refarch --- docusaurus.config.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docusaurus.config.js b/docusaurus.config.js index 63a636c914..9355e84947 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -112,7 +112,7 @@ const config = { { type: "doc", label: "Reference Architecture", - docId: "refarch/whats-this/index" + docId: "refarch/whats-this/what-is-a-reference-architecture" }, { type: "doc", From 4555a019654cf25b40eb69aa12614aa29090caf9 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Wed, 10 May 2023 09:40:25 -0700 Subject: [PATCH 29/89] remove unused pages --- _docs-sources/docs-and-references.md | 49 ------------------ _docs-sources/iac/infrastructure-as-code.md | 27 ---------- docs/docs-and-references.md | 57 --------------------- docs/iac/infrastructure-as-code.md | 35 ------------- 4 files changed, 168 deletions(-) delete mode 100644 _docs-sources/docs-and-references.md delete mode 100644 _docs-sources/iac/infrastructure-as-code.md delete mode 100644 docs/docs-and-references.md delete mode 100644 docs/iac/infrastructure-as-code.md diff --git a/_docs-sources/docs-and-references.md b/_docs-sources/docs-and-references.md deleted file mode 100644 index 2b0304e462..0000000000 --- a/_docs-sources/docs-and-references.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -hide_table_of_contents: true -hide_title: true ---- - -import Card from "/src/components/Card" -import CardGroup from "/src/components/CardGroup" -import CenterLayout from "/src/components/CenterLayout" - - - -# Docs and References - - - - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - - - - - diff --git a/_docs-sources/iac/infrastructure-as-code.md b/_docs-sources/iac/infrastructure-as-code.md deleted file mode 100644 index c1ada4109a..0000000000 --- a/_docs-sources/iac/infrastructure-as-code.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -hide_table_of_contents: true -hide_title: true ---- - -import Card from "/src/components/Card" -import CardGroup from "/src/components/CardGroup" -import CenterLayout from "/src/components/CenterLayout" - - - -# Infrastructure as Code Library - - - - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - - - diff --git a/docs/docs-and-references.md b/docs/docs-and-references.md deleted file mode 100644 index 1937e41712..0000000000 --- a/docs/docs-and-references.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -hide_table_of_contents: true -hide_title: true ---- - -import Card from "/src/components/Card" -import CardGroup from "/src/components/CardGroup" -import CenterLayout from "/src/components/CenterLayout" - - - -# Docs and References - - - - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - - - - - - - - diff --git a/docs/iac/infrastructure-as-code.md b/docs/iac/infrastructure-as-code.md deleted file mode 100644 index 496f6bfd3a..0000000000 --- a/docs/iac/infrastructure-as-code.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -hide_table_of_contents: true -hide_title: true ---- - -import Card from "/src/components/Card" -import CardGroup from "/src/components/CardGroup" -import CenterLayout from "/src/components/CenterLayout" - - - -# Infrastructure as Code Library - - - - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - - - - - - From 4680574da2ac002d837b18b5bb01947efbbf4f8e Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Wed, 10 May 2023 11:45:43 -0700 Subject: [PATCH 30/89] minor wording tweaks --- _docs-sources/iac/usage/{stay-up-to-date.md => updating.md} | 2 +- _docs-sources/iac/whats-this/modules.md | 2 +- _docs-sources/iac/whats-this/services.md | 2 +- docs/iac/usage/{stay-up-to-date.md => updating.md} | 4 ++-- docs/iac/whats-this/modules.md | 4 ++-- docs/iac/whats-this/services.md | 4 ++-- sidebars/iac.js | 4 ++-- 7 files changed, 11 insertions(+), 11 deletions(-) rename _docs-sources/iac/usage/{stay-up-to-date.md => updating.md} (94%) rename docs/iac/usage/{stay-up-to-date.md => updating.md} (87%) diff --git a/_docs-sources/iac/usage/stay-up-to-date.md b/_docs-sources/iac/usage/updating.md similarity index 94% rename from _docs-sources/iac/usage/stay-up-to-date.md rename to _docs-sources/iac/usage/updating.md index 7994818305..e1c0da1f04 100644 --- a/_docs-sources/iac/usage/stay-up-to-date.md +++ b/_docs-sources/iac/usage/updating.md @@ -1,4 +1,4 @@ -# Staying up to date +# Updating Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Morbi blandit cursus risus at ultrices mi tempus imperdiet nulla. Augue interdum velit euismod in pellentesque massa placerat. diff --git a/_docs-sources/iac/whats-this/modules.md b/_docs-sources/iac/whats-this/modules.md index d7d2bc7129..70de7d020e 100644 --- a/_docs-sources/iac/whats-this/modules.md +++ b/_docs-sources/iac/whats-this/modules.md @@ -1,4 +1,4 @@ -# Modules +# What is a Module? Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Est placerat in egestas erat imperdiet sed. Velit dignissim sodales ut eu sem integer vitae. Mattis rhoncus urna neque viverra. Massa placerat duis ultricies lacus sed turpis tincidunt id. Posuere sollicitudin aliquam ultrices sagittis orci. Egestas quis ipsum suspendisse ultrices gravida dictum fusce ut placerat. Tristique senectus et netus et malesuada. Ipsum dolor sit amet consectetur adipiscing elit pellentesque. Enim nunc faucibus a pellentesque sit amet porttitor eget dolor. Eget nunc lobortis mattis aliquam faucibus purus in. Vulputate dignissim suspendisse in est ante in nibh mauris. Morbi non arcu risus quis varius quam. Cras adipiscing enim eu turpis egestas pretium. Donec enim diam vulputate ut. Ut tortor pretium viverra suspendisse potenti nullam. Euismod elementum nisi quis eleifend quam adipiscing vitae proin sagittis. Sed nisi lacus sed viverra tellus. Laoreet id donec ultrices tincidunt arcu non sodales neque. diff --git a/_docs-sources/iac/whats-this/services.md b/_docs-sources/iac/whats-this/services.md index 268a0d57d7..70d4e50358 100644 --- a/_docs-sources/iac/whats-this/services.md +++ b/_docs-sources/iac/whats-this/services.md @@ -1,4 +1,4 @@ -# Services +# What is a Service? Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Eu nisl nunc mi ipsum faucibus vitae aliquet. Cras adipiscing enim eu turpis egestas pretium aenean pharetra magna. Nam at lectus urna duis convallis convallis. Eget est lorem ipsum dolor sit amet consectetur adipiscing elit. Interdum varius sit amet mattis vulputate enim. Massa id neque aliquam vestibulum. Nunc sed augue lacus viverra vitae congue eu consequat ac. Volutpat ac tincidunt vitae semper. Placerat orci nulla pellentesque dignissim enim. Dui sapien eget mi proin sed libero enim sed. Sem viverra aliquet eget sit. Dis parturient montes nascetur ridiculus. Quam id leo in vitae. Tortor dignissim convallis aenean et tortor at risus viverra adipiscing. Elit eget gravida cum sociis natoque penatibus et. diff --git a/docs/iac/usage/stay-up-to-date.md b/docs/iac/usage/updating.md similarity index 87% rename from docs/iac/usage/stay-up-to-date.md rename to docs/iac/usage/updating.md index dfab84c414..7cf27649ec 100644 --- a/docs/iac/usage/stay-up-to-date.md +++ b/docs/iac/usage/updating.md @@ -1,4 +1,4 @@ -# Staying up to date +# Updating Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Morbi blandit cursus risus at ultrices mi tempus imperdiet nulla. Augue interdum velit euismod in pellentesque massa placerat. @@ -11,6 +11,6 @@ Checkout [Patcher](https://docs.gruntwork.io/guides/stay-up-to-date/patcher) you diff --git a/docs/iac/whats-this/modules.md b/docs/iac/whats-this/modules.md index edc4f6b2a3..07517da01e 100644 --- a/docs/iac/whats-this/modules.md +++ b/docs/iac/whats-this/modules.md @@ -1,4 +1,4 @@ -# Modules +# What is a Module? Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Est placerat in egestas erat imperdiet sed. Velit dignissim sodales ut eu sem integer vitae. Mattis rhoncus urna neque viverra. Massa placerat duis ultricies lacus sed turpis tincidunt id. Posuere sollicitudin aliquam ultrices sagittis orci. Egestas quis ipsum suspendisse ultrices gravida dictum fusce ut placerat. Tristique senectus et netus et malesuada. Ipsum dolor sit amet consectetur adipiscing elit pellentesque. Enim nunc faucibus a pellentesque sit amet porttitor eget dolor. Eget nunc lobortis mattis aliquam faucibus purus in. Vulputate dignissim suspendisse in est ante in nibh mauris. Morbi non arcu risus quis varius quam. Cras adipiscing enim eu turpis egestas pretium. Donec enim diam vulputate ut. Ut tortor pretium viverra suspendisse potenti nullam. Euismod elementum nisi quis eleifend quam adipiscing vitae proin sagittis. Sed nisi lacus sed viverra tellus. Laoreet id donec ultrices tincidunt arcu non sodales neque. @@ -14,6 +14,6 @@ When you feel like it, ya dingus! diff --git a/docs/iac/whats-this/services.md b/docs/iac/whats-this/services.md index aad86a2d7e..3ba24d303b 100644 --- a/docs/iac/whats-this/services.md +++ b/docs/iac/whats-this/services.md @@ -1,4 +1,4 @@ -# Services +# What is a Service? Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Eu nisl nunc mi ipsum faucibus vitae aliquet. Cras adipiscing enim eu turpis egestas pretium aenean pharetra magna. Nam at lectus urna duis convallis convallis. Eget est lorem ipsum dolor sit amet consectetur adipiscing elit. Interdum varius sit amet mattis vulputate enim. Massa id neque aliquam vestibulum. Nunc sed augue lacus viverra vitae congue eu consequat ac. Volutpat ac tincidunt vitae semper. Placerat orci nulla pellentesque dignissim enim. Dui sapien eget mi proin sed libero enim sed. Sem viverra aliquet eget sit. Dis parturient montes nascetur ridiculus. Quam id leo in vitae. Tortor dignissim convallis aenean et tortor at risus viverra adipiscing. Elit eget gravida cum sociis natoque penatibus et. @@ -14,6 +14,6 @@ When you feel like it, ya dingus! diff --git a/sidebars/iac.js b/sidebars/iac.js index ef616782e3..b7cd3b2cc5 100644 --- a/sidebars/iac.js +++ b/sidebars/iac.js @@ -25,7 +25,7 @@ const sidebar = [ ], }, { - label: "Working with Modules", + label: "Working with the Library", type: "category", collapsible: false, items: [ @@ -41,7 +41,7 @@ const sidebar = [ collapsible: false, items: [ "iac/usage/versioning", - "iac/usage/stay-up-to-date", + "iac/usage/updating", ], }, { From a5b9f35eb14bff84ce15d9bd5e119c02777dffa8 Mon Sep 17 00:00:00 2001 From: Zachary Proser Date: Wed, 10 May 2023 14:46:44 -0400 Subject: [PATCH 31/89] Build out new bootstrapping sections per feedback --- .../gruntwork-cli.md | 7 +++++++ .../path1.md | 5 +++++ .../preflight-checks.md | 7 +++++++ .../provision-accounts.md | 7 +++++++ .../route53.md | 7 +++++++ .../setup-quotas.md | 7 +++++++ .../gruntwork-cli.md | 15 +++++++++++++++ .../path1.md | 7 ++++++- .../preflight-checks.md | 15 +++++++++++++++ .../provision-accounts.md | 15 +++++++++++++++ .../route53.md | 15 +++++++++++++++ .../setup-quotas.md | 15 +++++++++++++++ sidebars/refarch.js | 7 ++++++- 13 files changed, 127 insertions(+), 2 deletions(-) create mode 100644 _docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli.md create mode 100644 _docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks.md create mode 100644 _docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md create mode 100644 _docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md create mode 100644 _docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md create mode 100644 docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli.md create mode 100644 docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks.md create mode 100644 docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md create mode 100644 docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md create mode 100644 docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli.md new file mode 100644 index 0000000000..85f55be5ce --- /dev/null +++ b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli.md @@ -0,0 +1,7 @@ +# The Gruntwork command line interface (CLI) + +Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. + +Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. + +Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md index 13dd8d71c0..625de37629 100644 --- a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md +++ b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md @@ -19,3 +19,8 @@ please use the wizard pls + +# Path 2. Contact us + +Please use the wizard + diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks.md new file mode 100644 index 0000000000..96570df589 --- /dev/null +++ b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks.md @@ -0,0 +1,7 @@ +# Reference Architecture Preflight checks + +Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. + +Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. + +Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md new file mode 100644 index 0000000000..ca39bc03f8 --- /dev/null +++ b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md @@ -0,0 +1,7 @@ +# Step 1. Provision AWS accounts + +Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. + +Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. + +Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md new file mode 100644 index 0000000000..113e8c17fc --- /dev/null +++ b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md @@ -0,0 +1,7 @@ +# Step 3. Configure Route53 and domains + +Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. + +Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. + +Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md new file mode 100644 index 0000000000..bdb5312c93 --- /dev/null +++ b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md @@ -0,0 +1,7 @@ +# Step 2. Configure AWS account quotas + +Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. + +Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. + +Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli.md new file mode 100644 index 0000000000..a156e2e902 --- /dev/null +++ b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli.md @@ -0,0 +1,15 @@ +# The Gruntwork command line interface (CLI) + +Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. + +Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. + +Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. + + + diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md index 0894a55e39..f17b979ef4 100644 --- a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md +++ b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md @@ -20,10 +20,15 @@ please use the wizard pls +# Path 2. Contact us + +Please use the wizard + + diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks.md new file mode 100644 index 0000000000..04fc6a8f8e --- /dev/null +++ b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks.md @@ -0,0 +1,15 @@ +# Reference Architecture Preflight checks + +Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. + +Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. + +Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. + + + diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md new file mode 100644 index 0000000000..beec681323 --- /dev/null +++ b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md @@ -0,0 +1,15 @@ +# Step 1. Provision AWS accounts + +Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. + +Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. + +Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. + + + diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md new file mode 100644 index 0000000000..0e552826f4 --- /dev/null +++ b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md @@ -0,0 +1,15 @@ +# Step 3. Configure Route53 and domains + +Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. + +Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. + +Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. + + + diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md new file mode 100644 index 0000000000..97a67310b0 --- /dev/null +++ b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md @@ -0,0 +1,15 @@ +# Step 2. Configure AWS account quotas + +Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. + +Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. + +Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. + + + diff --git a/sidebars/refarch.js b/sidebars/refarch.js index eb02030fa2..5a4e9a26dd 100644 --- a/sidebars/refarch.js +++ b/sidebars/refarch.js @@ -22,7 +22,12 @@ const sidebar = [ "refarch/bootstrapping/index", "refarch/bootstrapping/configuring-your-refarch-for-delivery/index", "refarch/bootstrapping/configuring-your-refarch-for-delivery/path1", - "refarch/bootstrapping/configuring-your-refarch-for-delivery/path2", + "refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli", + "refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks", + "refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts", + "refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas", + "refarch/bootstrapping/configuring-your-refarch-for-delivery/route53", + ], }, { From 8347e453cf1f79f8aa0fac38f5a80c1b9ea7ddcc Mon Sep 17 00:00:00 2001 From: Zachary Proser Date: Wed, 10 May 2023 14:53:26 -0400 Subject: [PATCH 32/89] Modify bootstrap sections, add preflight checks page --- .../configuring-your-refarch-for-delivery/path1.md | 2 +- .../configuring-your-refarch-for-delivery/path2.md | 5 ----- .../provision-accounts.md | 2 +- .../route53.md | 2 +- .../setup-quotas.md | 2 +- .../configuring-your-refarch-for-delivery/path1.md | 4 ++-- .../configuring-your-refarch-for-delivery/path2.md | 13 ------------- .../provision-accounts.md | 4 ++-- .../route53.md | 4 ++-- .../setup-quotas.md | 4 ++-- 10 files changed, 12 insertions(+), 30 deletions(-) delete mode 100644 _docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path2.md delete mode 100644 docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path2.md diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md index 625de37629..18cba9ff72 100644 --- a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md +++ b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md @@ -1,4 +1,4 @@ -# Path 1: Use the Gruntwork CLI +# Using the Gruntwork CLI Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path2.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path2.md deleted file mode 100644 index 34080cec89..0000000000 --- a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path2.md +++ /dev/null @@ -1,5 +0,0 @@ -# Path 2: Contact us - -You don't want none of this. - - diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md index ca39bc03f8..9e8b2c24af 100644 --- a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md +++ b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md @@ -1,4 +1,4 @@ -# Step 1. Provision AWS accounts +# Provision AWS accounts Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md index 113e8c17fc..e042c0fdea 100644 --- a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md +++ b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md @@ -1,4 +1,4 @@ -# Step 3. Configure Route53 and domains +# Configure Route53 and app domains Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md index bdb5312c93..06890dbfcb 100644 --- a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md +++ b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md @@ -1,4 +1,4 @@ -# Step 2. Configure AWS account quotas +# Configure AWS account quotas Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md index f17b979ef4..fba6643ab2 100644 --- a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md +++ b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md @@ -1,4 +1,4 @@ -# Path 1: Use the Gruntwork CLI +# Using the Gruntwork CLI Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. @@ -29,6 +29,6 @@ Please use the wizard diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path2.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path2.md deleted file mode 100644 index 757ad0c355..0000000000 --- a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path2.md +++ /dev/null @@ -1,13 +0,0 @@ -# Path 2: Contact us - -You don't want none of this. - - - - - diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md index beec681323..f7dc4ce57d 100644 --- a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md +++ b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md @@ -1,4 +1,4 @@ -# Step 1. Provision AWS accounts +# Provision AWS accounts Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. @@ -10,6 +10,6 @@ Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain d diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md index 0e552826f4..30a5cdb7f6 100644 --- a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md +++ b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md @@ -1,4 +1,4 @@ -# Step 3. Configure Route53 and domains +# Configure Route53 and app domains Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. @@ -10,6 +10,6 @@ Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain d diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md index 97a67310b0..455c591a21 100644 --- a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md +++ b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md @@ -1,4 +1,4 @@ -# Step 2. Configure AWS account quotas +# Configure AWS account quotas Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. @@ -10,6 +10,6 @@ Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain d From ff315d4cd5eb3f88cbb2f226ac873d3a476c1e7f Mon Sep 17 00:00:00 2001 From: Zachary Proser Date: Wed, 10 May 2023 16:11:07 -0400 Subject: [PATCH 33/89] Split maintenance tasks out into separate pages --- .../maintain-your-refarch/add-new-account.md | 9 +++++++ .../usage/maintain-your-refarch/index.md | 23 ----------------- .../maintain-your-refarch/stay-up-to-date.md | 8 ++++++ .../usage/maintain-your-refarch/undeploy.md | 17 +++++++++++++ .../upgrade-terraform.md | 8 ++++++ .../maintain-your-refarch/add-new-account.md | 17 +++++++++++++ .../usage/maintain-your-refarch/index.md | 25 +------------------ .../maintain-your-refarch/stay-up-to-date.md | 16 ++++++++++++ .../usage/maintain-your-refarch/undeploy.md | 25 +++++++++++++++++++ .../upgrade-terraform.md | 16 ++++++++++++ sidebars/refarch.js | 5 +++- 11 files changed, 121 insertions(+), 48 deletions(-) create mode 100644 _docs-sources/refarch/usage/maintain-your-refarch/add-new-account.md create mode 100644 _docs-sources/refarch/usage/maintain-your-refarch/stay-up-to-date.md create mode 100644 _docs-sources/refarch/usage/maintain-your-refarch/undeploy.md create mode 100644 _docs-sources/refarch/usage/maintain-your-refarch/upgrade-terraform.md create mode 100644 docs/refarch/usage/maintain-your-refarch/add-new-account.md create mode 100644 docs/refarch/usage/maintain-your-refarch/stay-up-to-date.md create mode 100644 docs/refarch/usage/maintain-your-refarch/undeploy.md create mode 100644 docs/refarch/usage/maintain-your-refarch/upgrade-terraform.md diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/add-new-account.md b/_docs-sources/refarch/usage/maintain-your-refarch/add-new-account.md new file mode 100644 index 0000000000..ec64462e71 --- /dev/null +++ b/_docs-sources/refarch/usage/maintain-your-refarch/add-new-account.md @@ -0,0 +1,9 @@ + +# How to: Add a new AWS Account + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. + diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/index.md b/_docs-sources/refarch/usage/maintain-your-refarch/index.md index 5c787ee72c..bfc687aa53 100644 --- a/_docs-sources/refarch/usage/maintain-your-refarch/index.md +++ b/_docs-sources/refarch/usage/maintain-your-refarch/index.md @@ -1,31 +1,8 @@ # Maintain your Reference Architecture -## How to: Add a new AWS Account - -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. - -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. - -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. - -## How to: undeploy Ref Arch / modules - -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. - -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. - -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. - -## Stay up to date - -Link to Patcher docs? - -## How to: upgrade Terraform across your modules - Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. - diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/stay-up-to-date.md b/_docs-sources/refarch/usage/maintain-your-refarch/stay-up-to-date.md new file mode 100644 index 0000000000..ef18693cba --- /dev/null +++ b/_docs-sources/refarch/usage/maintain-your-refarch/stay-up-to-date.md @@ -0,0 +1,8 @@ + +# How to: Stay up to date + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/undeploy.md b/_docs-sources/refarch/usage/maintain-your-refarch/undeploy.md new file mode 100644 index 0000000000..7bca5584d6 --- /dev/null +++ b/_docs-sources/refarch/usage/maintain-your-refarch/undeploy.md @@ -0,0 +1,17 @@ + +# How to: Undeploy individual modules + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. + +# How to: Undeploy the Ref Arch + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. + diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/upgrade-terraform.md b/_docs-sources/refarch/usage/maintain-your-refarch/upgrade-terraform.md new file mode 100644 index 0000000000..647826d06e --- /dev/null +++ b/_docs-sources/refarch/usage/maintain-your-refarch/upgrade-terraform.md @@ -0,0 +1,8 @@ + +# How to: Upgrade Terraform across your modules + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. diff --git a/docs/refarch/usage/maintain-your-refarch/add-new-account.md b/docs/refarch/usage/maintain-your-refarch/add-new-account.md new file mode 100644 index 0000000000..877f60de55 --- /dev/null +++ b/docs/refarch/usage/maintain-your-refarch/add-new-account.md @@ -0,0 +1,17 @@ + +# How to: Add a new AWS Account + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. + + + + diff --git a/docs/refarch/usage/maintain-your-refarch/index.md b/docs/refarch/usage/maintain-your-refarch/index.md index ca583d9eda..2b5e02ac4b 100644 --- a/docs/refarch/usage/maintain-your-refarch/index.md +++ b/docs/refarch/usage/maintain-your-refarch/index.md @@ -1,27 +1,5 @@ # Maintain your Reference Architecture -## How to: Add a new AWS Account - -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. - -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. - -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. - -## How to: undeploy Ref Arch / modules - -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. - -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. - -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. - -## Stay up to date - -Link to Patcher docs? - -## How to: upgrade Terraform across your modules - Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. @@ -30,10 +8,9 @@ Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wanna - diff --git a/docs/refarch/usage/maintain-your-refarch/stay-up-to-date.md b/docs/refarch/usage/maintain-your-refarch/stay-up-to-date.md new file mode 100644 index 0000000000..44e9ca0b33 --- /dev/null +++ b/docs/refarch/usage/maintain-your-refarch/stay-up-to-date.md @@ -0,0 +1,16 @@ + +# How to: Stay up to date + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. + + + diff --git a/docs/refarch/usage/maintain-your-refarch/undeploy.md b/docs/refarch/usage/maintain-your-refarch/undeploy.md new file mode 100644 index 0000000000..b61f4e7f8c --- /dev/null +++ b/docs/refarch/usage/maintain-your-refarch/undeploy.md @@ -0,0 +1,25 @@ + +# How to: Undeploy individual modules + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. + +# How to: Undeploy the Ref Arch + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. + + + + diff --git a/docs/refarch/usage/maintain-your-refarch/upgrade-terraform.md b/docs/refarch/usage/maintain-your-refarch/upgrade-terraform.md new file mode 100644 index 0000000000..cd9121c25e --- /dev/null +++ b/docs/refarch/usage/maintain-your-refarch/upgrade-terraform.md @@ -0,0 +1,16 @@ + +# How to: Upgrade Terraform across your modules + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. + + + diff --git a/sidebars/refarch.js b/sidebars/refarch.js index 5a4e9a26dd..1fe3c2506f 100644 --- a/sidebars/refarch.js +++ b/sidebars/refarch.js @@ -36,7 +36,10 @@ const sidebar = [ collapsible: false, items: [ "refarch/usage/maintain-your-refarch/index", - "refarch/usage/getting-help/index", + "refarch/usage/maintain-your-refarch/add-new-account", + "refarch/usage/maintain-your-refarch/undeploy", + "refarch/usage/maintain-your-refarch/stay-up-to-date", + "refarch/usage/maintain-your-refarch/upgrade-terraform", "refarch/usage/pipelines-integration/index", ], }, From 55105a3732d68d2b41dbf0a77e58830ea2309f62 Mon Sep 17 00:00:00 2001 From: Zachary Proser Date: Wed, 10 May 2023 16:45:28 -0400 Subject: [PATCH 34/89] Finish implementing RefArch IA feedback --- .../refarch/access/how-to-auth-cli/index.md | 2 +- .../access/how-to-auth-console/index.md | 2 +- .../refarch/access/how-to-auth-ec2/index.md | 2 +- .../refarch/access/how-to-auth-vpn/index.md | 2 +- _docs-sources/refarch/access/index.md | 1 - .../refarch/access/setup-auth/index.md | 2 +- .../{usage => support}/getting-help/index.md | 0 .../refarch/support/onboarding/index.md | 3 ++ .../refarch/usage/how-to-auth-cli/index.md | 3 -- .../usage/how-to-auth-ec2-ssh/index.md | 3 -- .../refarch/usage/how-to-auth-vpn/index.md | 3 -- .../usage/how-to-auth-web-console/index.md | 3 -- .../maintain-your-refarch/add-new-account.md | 2 +- .../usage/maintain-your-refarch/extending.md | 8 +++++ .../maintain-your-refarch/stay-up-to-date.md | 2 +- .../usage/maintain-your-refarch/undeploy.md | 4 +-- .../upgrade-terraform.md | 2 +- docs/refarch/access/how-to-auth-cli/index.md | 4 +-- .../access/how-to-auth-console/index.md | 4 +-- docs/refarch/access/how-to-auth-ec2/index.md | 4 +-- docs/refarch/access/how-to-auth-vpn/index.md | 4 +-- docs/refarch/access/index.md | 3 +- docs/refarch/access/setup-auth/index.md | 4 +-- .../{usage => support}/getting-help/index.md | 0 docs/refarch/support/onboarding/index.md | 11 +++++++ docs/refarch/usage/how-to-auth-cli/index.md | 11 ------- .../usage/how-to-auth-ec2-ssh/index.md | 11 ------- docs/refarch/usage/how-to-auth-vpn/index.md | 11 ------- .../usage/how-to-auth-web-console/index.md | 11 ------- .../maintain-your-refarch/add-new-account.md | 4 +-- .../usage/maintain-your-refarch/extending.md | 16 ++++++++++ .../maintain-your-refarch/stay-up-to-date.md | 4 +-- .../usage/maintain-your-refarch/undeploy.md | 6 ++-- .../upgrade-terraform.md | 4 +-- sidebars/refarch.js | 31 +++++++++---------- 35 files changed, 83 insertions(+), 104 deletions(-) rename _docs-sources/refarch/{usage => support}/getting-help/index.md (100%) create mode 100644 _docs-sources/refarch/support/onboarding/index.md delete mode 100644 _docs-sources/refarch/usage/how-to-auth-cli/index.md delete mode 100644 _docs-sources/refarch/usage/how-to-auth-ec2-ssh/index.md delete mode 100644 _docs-sources/refarch/usage/how-to-auth-vpn/index.md delete mode 100644 _docs-sources/refarch/usage/how-to-auth-web-console/index.md create mode 100644 _docs-sources/refarch/usage/maintain-your-refarch/extending.md rename docs/refarch/{usage => support}/getting-help/index.md (100%) create mode 100644 docs/refarch/support/onboarding/index.md delete mode 100644 docs/refarch/usage/how-to-auth-cli/index.md delete mode 100644 docs/refarch/usage/how-to-auth-ec2-ssh/index.md delete mode 100644 docs/refarch/usage/how-to-auth-vpn/index.md delete mode 100644 docs/refarch/usage/how-to-auth-web-console/index.md create mode 100644 docs/refarch/usage/maintain-your-refarch/extending.md diff --git a/_docs-sources/refarch/access/how-to-auth-cli/index.md b/_docs-sources/refarch/access/how-to-auth-cli/index.md index 7101a603da..42e12be747 100644 --- a/_docs-sources/refarch/access/how-to-auth-cli/index.md +++ b/_docs-sources/refarch/access/how-to-auth-cli/index.md @@ -1,4 +1,4 @@ -# How to authenticate on the command line (CLI) +# Command Line (CLI) Authentication Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. diff --git a/_docs-sources/refarch/access/how-to-auth-console/index.md b/_docs-sources/refarch/access/how-to-auth-console/index.md index 805f8d50e2..47f4a3847a 100644 --- a/_docs-sources/refarch/access/how-to-auth-console/index.md +++ b/_docs-sources/refarch/access/how-to-auth-console/index.md @@ -1,4 +1,4 @@ -# How to authenticate to the AWS Web Console +# AWS Web Console Authentication Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. diff --git a/_docs-sources/refarch/access/how-to-auth-ec2/index.md b/_docs-sources/refarch/access/how-to-auth-ec2/index.md index 701aa13a7b..7dde22a1c8 100644 --- a/_docs-sources/refarch/access/how-to-auth-ec2/index.md +++ b/_docs-sources/refarch/access/how-to-auth-ec2/index.md @@ -1,4 +1,4 @@ -# How to SSH to an EC2 Instance +# SSH to an EC2 Instance Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. diff --git a/_docs-sources/refarch/access/how-to-auth-vpn/index.md b/_docs-sources/refarch/access/how-to-auth-vpn/index.md index c575d4e4cd..615cefaaa7 100644 --- a/_docs-sources/refarch/access/how-to-auth-vpn/index.md +++ b/_docs-sources/refarch/access/how-to-auth-vpn/index.md @@ -1,4 +1,4 @@ -# How to authenticate to the VPN +# VPN Authentcation Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. diff --git a/_docs-sources/refarch/access/index.md b/_docs-sources/refarch/access/index.md index d618789c98..3ff68c5509 100644 --- a/_docs-sources/refarch/access/index.md +++ b/_docs-sources/refarch/access/index.md @@ -1,6 +1,5 @@ # How do I access my Reference Architecture? - Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. diff --git a/_docs-sources/refarch/access/setup-auth/index.md b/_docs-sources/refarch/access/setup-auth/index.md index 7bd1bb691a..2d8bdd9929 100644 --- a/_docs-sources/refarch/access/setup-auth/index.md +++ b/_docs-sources/refarch/access/setup-auth/index.md @@ -1,4 +1,4 @@ -# Do this first: Set up AWS Auth +# Set up AWS Auth Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. diff --git a/_docs-sources/refarch/usage/getting-help/index.md b/_docs-sources/refarch/support/getting-help/index.md similarity index 100% rename from _docs-sources/refarch/usage/getting-help/index.md rename to _docs-sources/refarch/support/getting-help/index.md diff --git a/_docs-sources/refarch/support/onboarding/index.md b/_docs-sources/refarch/support/onboarding/index.md new file mode 100644 index 0000000000..7a36b15108 --- /dev/null +++ b/_docs-sources/refarch/support/onboarding/index.md @@ -0,0 +1,3 @@ +# Onboarding sessions + +HAXXOR IPSUM diff --git a/_docs-sources/refarch/usage/how-to-auth-cli/index.md b/_docs-sources/refarch/usage/how-to-auth-cli/index.md deleted file mode 100644 index 0405392cc0..0000000000 --- a/_docs-sources/refarch/usage/how-to-auth-cli/index.md +++ /dev/null @@ -1,3 +0,0 @@ -# How to auth via the CLI - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/usage/how-to-auth-ec2-ssh/index.md b/_docs-sources/refarch/usage/how-to-auth-ec2-ssh/index.md deleted file mode 100644 index f535d493cf..0000000000 --- a/_docs-sources/refarch/usage/how-to-auth-ec2-ssh/index.md +++ /dev/null @@ -1,3 +0,0 @@ -# How to auth to an AWS - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/usage/how-to-auth-vpn/index.md b/_docs-sources/refarch/usage/how-to-auth-vpn/index.md deleted file mode 100644 index d8f5a7036b..0000000000 --- a/_docs-sources/refarch/usage/how-to-auth-vpn/index.md +++ /dev/null @@ -1,3 +0,0 @@ -# How to auth to OpenVPN - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/usage/how-to-auth-web-console/index.md b/_docs-sources/refarch/usage/how-to-auth-web-console/index.md deleted file mode 100644 index 7b718d5411..0000000000 --- a/_docs-sources/refarch/usage/how-to-auth-web-console/index.md +++ /dev/null @@ -1,3 +0,0 @@ -# How to auth to the AWS web console - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/add-new-account.md b/_docs-sources/refarch/usage/maintain-your-refarch/add-new-account.md index ec64462e71..bbf88a7a6f 100644 --- a/_docs-sources/refarch/usage/maintain-your-refarch/add-new-account.md +++ b/_docs-sources/refarch/usage/maintain-your-refarch/add-new-account.md @@ -1,5 +1,5 @@ -# How to: Add a new AWS Account +# Add a new AWS Account Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/extending.md b/_docs-sources/refarch/usage/maintain-your-refarch/extending.md new file mode 100644 index 0000000000..9a6ea96ae4 --- /dev/null +++ b/_docs-sources/refarch/usage/maintain-your-refarch/extending.md @@ -0,0 +1,8 @@ + +# Extending and modifying your Reference Architecture + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/stay-up-to-date.md b/_docs-sources/refarch/usage/maintain-your-refarch/stay-up-to-date.md index ef18693cba..ef9a43740d 100644 --- a/_docs-sources/refarch/usage/maintain-your-refarch/stay-up-to-date.md +++ b/_docs-sources/refarch/usage/maintain-your-refarch/stay-up-to-date.md @@ -1,5 +1,5 @@ -# How to: Stay up to date +# Stay up to date Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/undeploy.md b/_docs-sources/refarch/usage/maintain-your-refarch/undeploy.md index 7bca5584d6..2744869de2 100644 --- a/_docs-sources/refarch/usage/maintain-your-refarch/undeploy.md +++ b/_docs-sources/refarch/usage/maintain-your-refarch/undeploy.md @@ -1,5 +1,5 @@ -# How to: Undeploy individual modules +# Undeploy individual modules Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. @@ -7,7 +7,7 @@ Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protect Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. -# How to: Undeploy the Ref Arch +# Undeploy the Ref Arch Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/upgrade-terraform.md b/_docs-sources/refarch/usage/maintain-your-refarch/upgrade-terraform.md index 647826d06e..d8a806eff1 100644 --- a/_docs-sources/refarch/usage/maintain-your-refarch/upgrade-terraform.md +++ b/_docs-sources/refarch/usage/maintain-your-refarch/upgrade-terraform.md @@ -1,5 +1,5 @@ -# How to: Upgrade Terraform across your modules +# Upgrade Terraform across your modules Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. diff --git a/docs/refarch/access/how-to-auth-cli/index.md b/docs/refarch/access/how-to-auth-cli/index.md index a1b1fcb975..173a4527a0 100644 --- a/docs/refarch/access/how-to-auth-cli/index.md +++ b/docs/refarch/access/how-to-auth-cli/index.md @@ -1,4 +1,4 @@ -# How to authenticate on the command line (CLI) +# Command Line (CLI) Authentication Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. @@ -27,6 +27,6 @@ Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wo diff --git a/docs/refarch/access/how-to-auth-console/index.md b/docs/refarch/access/how-to-auth-console/index.md index e951be3dcf..6cfdf3d131 100644 --- a/docs/refarch/access/how-to-auth-console/index.md +++ b/docs/refarch/access/how-to-auth-console/index.md @@ -1,4 +1,4 @@ -# How to authenticate to the AWS Web Console +# AWS Web Console Authentication Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. @@ -27,6 +27,6 @@ Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wo diff --git a/docs/refarch/access/how-to-auth-ec2/index.md b/docs/refarch/access/how-to-auth-ec2/index.md index 63fc2d9960..db64d7f05e 100644 --- a/docs/refarch/access/how-to-auth-ec2/index.md +++ b/docs/refarch/access/how-to-auth-ec2/index.md @@ -1,4 +1,4 @@ -# How to SSH to an EC2 Instance +# SSH to an EC2 Instance Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. @@ -12,6 +12,6 @@ Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wo diff --git a/docs/refarch/access/how-to-auth-vpn/index.md b/docs/refarch/access/how-to-auth-vpn/index.md index f2910ee437..13ac872ae9 100644 --- a/docs/refarch/access/how-to-auth-vpn/index.md +++ b/docs/refarch/access/how-to-auth-vpn/index.md @@ -1,4 +1,4 @@ -# How to authenticate to the VPN +# VPN Authentcation Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. @@ -12,6 +12,6 @@ Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wo diff --git a/docs/refarch/access/index.md b/docs/refarch/access/index.md index f633b33730..4db98dbfce 100644 --- a/docs/refarch/access/index.md +++ b/docs/refarch/access/index.md @@ -1,6 +1,5 @@ # How do I access my Reference Architecture? - Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. @@ -12,6 +11,6 @@ Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wo diff --git a/docs/refarch/access/setup-auth/index.md b/docs/refarch/access/setup-auth/index.md index 3a87a735ea..cfc5a67892 100644 --- a/docs/refarch/access/setup-auth/index.md +++ b/docs/refarch/access/setup-auth/index.md @@ -1,4 +1,4 @@ -# Do this first: Set up AWS Auth +# Set up AWS Auth Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. @@ -30,6 +30,6 @@ Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wo diff --git a/docs/refarch/usage/getting-help/index.md b/docs/refarch/support/getting-help/index.md similarity index 100% rename from docs/refarch/usage/getting-help/index.md rename to docs/refarch/support/getting-help/index.md diff --git a/docs/refarch/support/onboarding/index.md b/docs/refarch/support/onboarding/index.md new file mode 100644 index 0000000000..1b78951057 --- /dev/null +++ b/docs/refarch/support/onboarding/index.md @@ -0,0 +1,11 @@ +# Onboarding sessions + +HAXXOR IPSUM + + + diff --git a/docs/refarch/usage/how-to-auth-cli/index.md b/docs/refarch/usage/how-to-auth-cli/index.md deleted file mode 100644 index 154d51ed66..0000000000 --- a/docs/refarch/usage/how-to-auth-cli/index.md +++ /dev/null @@ -1,11 +0,0 @@ -# How to auth via the CLI - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. - - - diff --git a/docs/refarch/usage/how-to-auth-ec2-ssh/index.md b/docs/refarch/usage/how-to-auth-ec2-ssh/index.md deleted file mode 100644 index 1ad46ff299..0000000000 --- a/docs/refarch/usage/how-to-auth-ec2-ssh/index.md +++ /dev/null @@ -1,11 +0,0 @@ -# How to auth to an AWS - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. - - - diff --git a/docs/refarch/usage/how-to-auth-vpn/index.md b/docs/refarch/usage/how-to-auth-vpn/index.md deleted file mode 100644 index 94653fb15c..0000000000 --- a/docs/refarch/usage/how-to-auth-vpn/index.md +++ /dev/null @@ -1,11 +0,0 @@ -# How to auth to OpenVPN - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. - - - diff --git a/docs/refarch/usage/how-to-auth-web-console/index.md b/docs/refarch/usage/how-to-auth-web-console/index.md deleted file mode 100644 index f16c9d02cf..0000000000 --- a/docs/refarch/usage/how-to-auth-web-console/index.md +++ /dev/null @@ -1,11 +0,0 @@ -# How to auth to the AWS web console - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. - - - diff --git a/docs/refarch/usage/maintain-your-refarch/add-new-account.md b/docs/refarch/usage/maintain-your-refarch/add-new-account.md index 877f60de55..71c6b21e59 100644 --- a/docs/refarch/usage/maintain-your-refarch/add-new-account.md +++ b/docs/refarch/usage/maintain-your-refarch/add-new-account.md @@ -1,5 +1,5 @@ -# How to: Add a new AWS Account +# Add a new AWS Account Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. @@ -12,6 +12,6 @@ Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wanna diff --git a/docs/refarch/usage/maintain-your-refarch/extending.md b/docs/refarch/usage/maintain-your-refarch/extending.md new file mode 100644 index 0000000000..6e2c048fc9 --- /dev/null +++ b/docs/refarch/usage/maintain-your-refarch/extending.md @@ -0,0 +1,16 @@ + +# Extending and modifying your Reference Architecture + +Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. + +Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. + +Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. + + + diff --git a/docs/refarch/usage/maintain-your-refarch/stay-up-to-date.md b/docs/refarch/usage/maintain-your-refarch/stay-up-to-date.md index 44e9ca0b33..13c7ea8dad 100644 --- a/docs/refarch/usage/maintain-your-refarch/stay-up-to-date.md +++ b/docs/refarch/usage/maintain-your-refarch/stay-up-to-date.md @@ -1,5 +1,5 @@ -# How to: Stay up to date +# Stay up to date Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. @@ -11,6 +11,6 @@ Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wanna diff --git a/docs/refarch/usage/maintain-your-refarch/undeploy.md b/docs/refarch/usage/maintain-your-refarch/undeploy.md index b61f4e7f8c..99952481bd 100644 --- a/docs/refarch/usage/maintain-your-refarch/undeploy.md +++ b/docs/refarch/usage/maintain-your-refarch/undeploy.md @@ -1,5 +1,5 @@ -# How to: Undeploy individual modules +# Undeploy individual modules Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. @@ -7,7 +7,7 @@ Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protect Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. -# How to: Undeploy the Ref Arch +# Undeploy the Ref Arch Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. @@ -20,6 +20,6 @@ Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wanna diff --git a/docs/refarch/usage/maintain-your-refarch/upgrade-terraform.md b/docs/refarch/usage/maintain-your-refarch/upgrade-terraform.md index cd9121c25e..9328acf44c 100644 --- a/docs/refarch/usage/maintain-your-refarch/upgrade-terraform.md +++ b/docs/refarch/usage/maintain-your-refarch/upgrade-terraform.md @@ -1,5 +1,5 @@ -# How to: Upgrade Terraform across your modules +# Upgrade Terraform across your modules Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. @@ -11,6 +11,6 @@ Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wanna diff --git a/sidebars/refarch.js b/sidebars/refarch.js index 1fe3c2506f..cec572b18a 100644 --- a/sidebars/refarch.js +++ b/sidebars/refarch.js @@ -19,17 +19,26 @@ const sidebar = [ type: "category", collapsible: false, items: [ - "refarch/bootstrapping/index", "refarch/bootstrapping/configuring-your-refarch-for-delivery/index", "refarch/bootstrapping/configuring-your-refarch-for-delivery/path1", - "refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli", "refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks", "refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts", "refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas", "refarch/bootstrapping/configuring-your-refarch-for-delivery/route53", - ], }, + { + label: "Access", + type: "category", + collapsible: false, + items: [ + "refarch/access/setup-auth/index", + "refarch/access/how-to-auth-vpn/index", + "refarch/access/how-to-auth-console/index", + "refarch/access/how-to-auth-cli/index", + "refarch/access/how-to-auth-ec2/index" + ], + }, { label: "Usage", type: "category", @@ -40,27 +49,17 @@ const sidebar = [ "refarch/usage/maintain-your-refarch/undeploy", "refarch/usage/maintain-your-refarch/stay-up-to-date", "refarch/usage/maintain-your-refarch/upgrade-terraform", + "refarch/usage/maintain-your-refarch/extending", "refarch/usage/pipelines-integration/index", ], }, - { - label: "Access", - type: "category", - collapsible: false, - items: [ - "refarch/access/setup-auth/index", - "refarch/access/how-to-auth-vpn/index", - "refarch/access/how-to-auth-console/index", - "refarch/access/how-to-auth-cli/index", - "refarch/access/how-to-auth-ec2/index" - ], - }, { label: "Support", type: "category", collapsible: false, items: [ - "refarch/usage/getting-help/index" + "refarch/support/getting-help/index", + "refarch/support/onboarding/index", ] }, ], From 5f6d5ccf74dd0dfe4149a20091ab1bdb89871817 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Wed, 10 May 2023 14:38:30 -0700 Subject: [PATCH 35/89] rename Learning Pipelines to Getting Started --- sidebars/pipelines.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sidebars/pipelines.js b/sidebars/pipelines.js index c083d55df4..8602e463e1 100644 --- a/sidebars/pipelines.js +++ b/sidebars/pipelines.js @@ -10,7 +10,7 @@ const sidebar = [ id: "pipelines/what-is-it/index" }, { - label: "Learn Pipelines", + label: "Getting Started", type: "category", collapsible: false, items: [ From 46b8b35eb0929fd67901c722bc05192b91abe656 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Thu, 11 May 2023 07:27:52 -0700 Subject: [PATCH 36/89] revert stay-up-to-date --- docs/guides/stay-up-to-date/index.md | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/docs/guides/stay-up-to-date/index.md b/docs/guides/stay-up-to-date/index.md index d6d6f16e0b..a332f9130e 100644 --- a/docs/guides/stay-up-to-date/index.md +++ b/docs/guides/stay-up-to-date/index.md @@ -16,7 +16,22 @@ import CardGroup from "/src/components/CardGroup" - + + + + + + + + + + + + + + + + @@ -98,7 +113,7 @@ href="/guides/stay-up-to-date/cis/cis-1.5.0" From 7c1f11b9763002f1f5784cd42e25a4ff877e892f Mon Sep 17 00:00:00 2001 From: Andrew Ellison Date: Thu, 11 May 2023 11:17:18 -0500 Subject: [PATCH 37/89] add overview to pipelines sidebar --- sidebars/pipelines.js | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/sidebars/pipelines.js b/sidebars/pipelines.js index 8602e463e1..729054241c 100644 --- a/sidebars/pipelines.js +++ b/sidebars/pipelines.js @@ -5,9 +5,16 @@ const sidebar = [ collapsible: false, items: [ { - label: "What is Gruntwork Pipelines?", - type: "doc", - id: "pipelines/what-is-it/index" + label: "Overview", + type: "category", + collapsible: false, + items: [ + { + label: "What is Gruntwork Pipelines?", + type: "doc", + id: "pipelines/what-is-it/index" + }, + ] }, { label: "Getting Started", From da4ab093a644c06aec0e7dc85bd28d048d7d713f Mon Sep 17 00:00:00 2001 From: Zachary Proser Date: Thu, 11 May 2023 14:46:18 -0400 Subject: [PATCH 38/89] Implement IA feedback on RefArch section --- .../index.md | 23 +++++++++++++ .../access/how-to-auth-console/index.md | 24 -------------- docs/guides/stay-up-to-date/index.md | 21 ++---------- .../index.md | 25 ++++++++++++++- .../access/how-to-auth-console/index.md | 32 ------------------- sidebars/refarch.js | 13 +------- 6 files changed, 51 insertions(+), 87 deletions(-) rename _docs-sources/refarch/access/{how-to-auth-cli => how-to-auth-aws}/index.md (50%) delete mode 100644 _docs-sources/refarch/access/how-to-auth-console/index.md rename docs/refarch/access/{how-to-auth-cli => how-to-auth-aws}/index.md (50%) delete mode 100644 docs/refarch/access/how-to-auth-console/index.md diff --git a/_docs-sources/refarch/access/how-to-auth-cli/index.md b/_docs-sources/refarch/access/how-to-auth-aws/index.md similarity index 50% rename from _docs-sources/refarch/access/how-to-auth-cli/index.md rename to _docs-sources/refarch/access/how-to-auth-aws/index.md index 42e12be747..38ff25b2d5 100644 --- a/_docs-sources/refarch/access/how-to-auth-cli/index.md +++ b/_docs-sources/refarch/access/how-to-auth-aws/index.md @@ -22,3 +22,26 @@ Lib void brute force bypass nak concurrently all your base are belong to us brea Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +# AWS Web Console Authentication + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## Security account difference + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## How the IAM roles work + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. diff --git a/_docs-sources/refarch/access/how-to-auth-console/index.md b/_docs-sources/refarch/access/how-to-auth-console/index.md deleted file mode 100644 index 47f4a3847a..0000000000 --- a/_docs-sources/refarch/access/how-to-auth-console/index.md +++ /dev/null @@ -1,24 +0,0 @@ -# AWS Web Console Authentication - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. - -## Security account difference - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. - -## How the IAM roles work - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. - diff --git a/docs/guides/stay-up-to-date/index.md b/docs/guides/stay-up-to-date/index.md index a332f9130e..d6d6f16e0b 100644 --- a/docs/guides/stay-up-to-date/index.md +++ b/docs/guides/stay-up-to-date/index.md @@ -16,22 +16,7 @@ import CardGroup from "/src/components/CardGroup" - - - - - - - - - - - - - - - - + @@ -113,7 +98,7 @@ href="/guides/stay-up-to-date/cis/cis-1.5.0" diff --git a/docs/refarch/access/how-to-auth-cli/index.md b/docs/refarch/access/how-to-auth-aws/index.md similarity index 50% rename from docs/refarch/access/how-to-auth-cli/index.md rename to docs/refarch/access/how-to-auth-aws/index.md index 173a4527a0..e20b88b93c 100644 --- a/docs/refarch/access/how-to-auth-cli/index.md +++ b/docs/refarch/access/how-to-auth-aws/index.md @@ -22,11 +22,34 @@ Lib void brute force bypass nak concurrently all your base are belong to us brea Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +# AWS Web Console Authentication + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## Security account difference + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + +## How the IAM roles work + +Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. + +Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. + +Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. diff --git a/docs/refarch/access/how-to-auth-console/index.md b/docs/refarch/access/how-to-auth-console/index.md deleted file mode 100644 index 6cfdf3d131..0000000000 --- a/docs/refarch/access/how-to-auth-console/index.md +++ /dev/null @@ -1,32 +0,0 @@ -# AWS Web Console Authentication - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. - -## Security account difference - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. - -## How the IAM roles work - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. - - - - diff --git a/sidebars/refarch.js b/sidebars/refarch.js index cec572b18a..5bbe89947e 100644 --- a/sidebars/refarch.js +++ b/sidebars/refarch.js @@ -34,9 +34,7 @@ const sidebar = [ items: [ "refarch/access/setup-auth/index", "refarch/access/how-to-auth-vpn/index", - "refarch/access/how-to-auth-console/index", - "refarch/access/how-to-auth-cli/index", - "refarch/access/how-to-auth-ec2/index" + "refarch/access/how-to-auth-aws/index", ], }, { @@ -53,15 +51,6 @@ const sidebar = [ "refarch/usage/pipelines-integration/index", ], }, - { - label: "Support", - type: "category", - collapsible: false, - items: [ - "refarch/support/getting-help/index", - "refarch/support/onboarding/index", - ] - }, ], }, ] From 354961cb867f3b820ac0e5e840b7b3dc95caa431 Mon Sep 17 00:00:00 2001 From: Eugene K Date: Thu, 11 May 2023 16:17:36 -0400 Subject: [PATCH 39/89] rework parts of the intro section (lots more stuff) --- _docs-sources/intro/overview/how-it-works.md | 53 ---------------- .../intro/overview/intro-to-gruntwork.md | 17 +++--- .../intro/overview/what-we-provide.md | 30 +++++++++ .../intro/overview/what-you-provide.md | 11 ++++ docs/intro/overview/how-it-works.md | 61 ------------------- docs/intro/overview/intro-to-gruntwork.md | 19 +++--- docs/intro/overview/what-we-provide.md | 38 ++++++++++++ docs/intro/overview/what-you-provide.md | 19 ++++++ package.json | 2 +- sidebars/intro-guide.js | 8 ++- 10 files changed, 120 insertions(+), 138 deletions(-) delete mode 100644 _docs-sources/intro/overview/how-it-works.md create mode 100644 _docs-sources/intro/overview/what-we-provide.md create mode 100644 _docs-sources/intro/overview/what-you-provide.md delete mode 100644 docs/intro/overview/how-it-works.md create mode 100644 docs/intro/overview/what-we-provide.md create mode 100644 docs/intro/overview/what-you-provide.md diff --git a/_docs-sources/intro/overview/how-it-works.md b/_docs-sources/intro/overview/how-it-works.md deleted file mode 100644 index 2afe3826f7..0000000000 --- a/_docs-sources/intro/overview/how-it-works.md +++ /dev/null @@ -1,53 +0,0 @@ -# How it works - -## Overview - -There are two fundamental ways to engage Gruntwork: - -1. **Gruntwork builds your architecture.** We generate the [Reference Architecture](https://gruntwork.io/reference-architecture/) based on your needs, deploy into your AWS accounts, and give you 100% of the code. Since you have all the code, you can extend, enhance, and customize the environment exactly according to your needs. The deploy process takes about one day. -2. **Build it yourself.** The Gruntwork IaC library empowers you to [construct your own bespoke architecture](/guides#build-your-own-architecture) in record time. By mix-and-matching our modules and services you can quickly define a custom architecture to suit your needs, all with the confidence of having world-class, battle-tested code running under the hood. - -## What we provide - -The Gruntwork product suite is designed to help you implement a world-class DevOps setup. It includes a combination of products, services, and support. - -### Gruntwork IaC Library - -A battle-tested, production-grade _catalog_ of infrastructure code that contains the core "building blocks" of infrastructure. It includes everything you’ll need to set up: - -- A Multi-account structure -- An infrastructure CI/CD Pipeline -- Networking and VPCs -- App orchestration — ECS, EC2, Kubernetes, and more -- Data storage — Aurora, Elasticache, RDS, and more -- Best-practice security baselines -- _and more…_ - -### Gruntwork Compliance - -An optional _catalog extension_ that contains building blocks that implement various compliance standards. Today we support CIS compliance; SOC 2 is coming soon, and we plan on adding additional standards in the future. - -### Support - -Gruntwork offers basic and paid support options: - -- **[Community support](/support#get-support).** Get help via a [Gruntwork Community Slack](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) and our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions). -- **[Paid support](/support#paid-support-tiers).** Get help via email, a private Slack channel, or scheduled Zoom calls, with response times backed by SLAs. - -## Gruntwork’s Limitations - -Gruntwork focuses on helping you launch and maintain your infrastructure as code. Understanding and using the AWS services that our code provisioned is up to you. Since Gruntwork is an accelerator for your AWS infrastructure and not an abstraction layer in front of AWS, knowledge of AWS and the services you intend to use is required. - -If you purchased our Reference Architecture: During the process of setting up the AWS accounts our tooling will automatically submit quota increase requests to AWS as a support ticket. These AWS quota increases are required to install the components of the Reference Architecture. Often, AWS will approve these requests quickly. Sometimes these support tickets will take some time for AWS to resolve. Unfortunately, some of these requests may be denied by AWS’s support team. Gruntwork can work with you to get these requests approved, but this can take some time, and that time is mostly out of our control. - -## What you provide - -Gruntwork products and services can help you quickly achieve world-class infrastructure. However, we aren’t a consulting company. To succeed, you (or your trusted DevOps consultant/contractor) must commit to learning how to leverage our products for your use cases, making any additional customizations, and deploying or migrating your apps and services. - -### Learn how to use our products - -To work effectively with our products, you’ll need to understand our opinionated stance on DevOps best practices and how to apply it for your purposes. You'll also need to learn how to use the Gruntwork products themselves. Our guides and support remain available to assist you in these endeavors. - -### Implement the “last mile” - -Gruntwork products strike a balance between opinionatedness and configurability. They’ll get you most of the way to your goal, but you may need to make some customizations to suit your use case. You may also need to adapt your apps and services to run in your new infrastructure. Our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) and [Community Slack Channel](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) provide great resources to assist you in this effort. diff --git a/_docs-sources/intro/overview/intro-to-gruntwork.md b/_docs-sources/intro/overview/intro-to-gruntwork.md index 85d8bac99a..6e02695d46 100644 --- a/_docs-sources/intro/overview/intro-to-gruntwork.md +++ b/_docs-sources/intro/overview/intro-to-gruntwork.md @@ -1,17 +1,14 @@ -# Introduction to Gruntwork +# What we do -### What is Gruntwork? +**Gruntwork is a "DevOps accelerator" that gets you to a world-class DevOps setup leveraging infrastructure-as-code in just a few days.** -**Gruntwork is a "DevOps accelerator" designed to make it possible to achieve a world-class DevOps setup based completely on infrastructure-as-code in just a few days.** - -All Gruntwork products exist within a framework we’ve devised specifically to emphasize DevOps industry best-practices and maximize your team’s efficiency. In the [how it works](how-it-works.md) section, we’ll cover how Gruntwork can help your team implement your infrastructure using this framework. +All Gruntwork products exist within a framework we’ve devised specifically to emphasize DevOps industry best-practices and maximize your team’s efficiency. In the [What we provide](what-we-provide.md) section, we’ll cover how Gruntwork can help your team implement your infrastructure using this framework. Gruntwork works best for teams building new infrastructure ("greenfield"), either from scratch or as part of a migration. However, it can also be used by teams with existing infrastructure ("brownfield") if they have sufficient DevOps experience. -### Supported public clouds - -Gruntwork products focus on Amazon Web Services (AWS). Support for other public clouds such as GCP and Azure may be added in the future. +All Gruntwork products are built on and fully compatible with [open source Terraform](https://terraform.io). The one exception to this is the [Gruntwork Reference Architecture](https://gruntwork.io/reference-architecture/), which uses [Terragrunt](https://terragrunt.gruntwork.io/) (one of our open source tools) to implement an end-to-end architecture. -### Gruntwork uses Terraform +There are two fundamental ways to engage Gruntwork: -All Gruntwork products are built on and fully compatible with [open source Terraform](https://terraform.io). The one exception to this is the [Gruntwork Reference Architecture](https://gruntwork.io/reference-architecture/), which uses [Terragrunt](https://terragrunt.gruntwork.io/) (one of our open source tools) to implement an end-to-end architecture. +1. **Gruntwork builds your architecture.** We generate the [Reference Architecture](https://gruntwork.io/reference-architecture/) based on your needs, deploy into your AWS accounts, and give you 100% of the code. Since you have all the code, you can extend, enhance, and customize the environment exactly according to your needs. The deploy process takes about one day. +2. **Build it yourself.** The Gruntwork IaC library empowers you to [construct your own bespoke architecture](/guides#build-your-own-architecture) in record time. By mix-and-matching our modules and services you can quickly define a custom architecture to suit your needs, all with the confidence of having world-class, battle-tested code running under the hood. diff --git a/_docs-sources/intro/overview/what-we-provide.md b/_docs-sources/intro/overview/what-we-provide.md new file mode 100644 index 0000000000..d4193245ba --- /dev/null +++ b/_docs-sources/intro/overview/what-we-provide.md @@ -0,0 +1,30 @@ +# What we provide + +## Gruntwork IaC Library + +A battle-tested, production-grade _catalog_ of infrastructure code that contains the core "building blocks" of infrastructure. It includes everything you’ll need to set up: + +- A Multi-account structure +- An infrastructure CI/CD Pipeline +- Networking and VPCs +- App orchestration — ECS, EC2, Kubernetes, and more +- Data storage — Aurora, Elasticache, RDS, and more +- Best-practice security baselines +- _and [more…](/iac/whats-this/)_ + +## Gruntwork Compliance + +An optional _catalog extension_ that contains building blocks that implement various compliance standards. Today we support CIS compliance; SOC 2 is coming soon, and we plan on adding additional standards in the future. + +## Support + +Gruntwork offers basic and paid support options: + +- **[Community support](/support#get-support).** Get help via a [Gruntwork Community Slack](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) and our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions). +- **[Paid support](/support#paid-support-tiers).** Get help via email, a private Slack channel, or scheduled Zoom calls, with response times backed by SLAs. + +## Gruntwork’s Limitations + +Gruntwork focuses on helping you launch and maintain your infrastructure as code. Understanding and using the AWS services that our code provisioned is up to you. Since Gruntwork is an accelerator for your AWS infrastructure and not an abstraction layer in front of AWS, knowledge of AWS and the services you intend to use is required. + +If you purchased our Reference Architecture: During the process of setting up the AWS accounts our tooling will automatically submit quota increase requests to AWS as a support ticket. These AWS quota increases are required to install the components of the Reference Architecture. Often, AWS will approve these requests quickly. Sometimes these support tickets will take some time for AWS to resolve. Unfortunately, some of these requests may be denied by AWS’s support team. Gruntwork can work with you to get these requests approved, but this can take some time, and that time is mostly out of our control. diff --git a/_docs-sources/intro/overview/what-you-provide.md b/_docs-sources/intro/overview/what-you-provide.md new file mode 100644 index 0000000000..720eb4c611 --- /dev/null +++ b/_docs-sources/intro/overview/what-you-provide.md @@ -0,0 +1,11 @@ +# What you provide + +Gruntwork products and services can help you quickly achieve world-class infrastructure. However, we aren’t a consulting company. To succeed, you (or your trusted DevOps consultant/contractor) must commit to learning how to leverage our products for your use cases, making any additional customizations, and deploying or migrating your apps and services. + +## Learn how to use our products + +To work effectively with our products, you’ll need to understand our opinionated stance on DevOps best practices and how to apply it for your purposes. You'll also need to learn how to use the Gruntwork products themselves. Our guides and support remain available to assist you in these endeavors. + +## Implement the “last mile” + +Gruntwork products strike a balance between opinionatedness and configurability. They’ll get you most of the way to your goal, but you may need to make some customizations to suit your use case. You may also need to adapt your apps and services to run in your new infrastructure. Our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) and [Community Slack Channel](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) provide great resources to assist you in this effort. diff --git a/docs/intro/overview/how-it-works.md b/docs/intro/overview/how-it-works.md deleted file mode 100644 index de6634337c..0000000000 --- a/docs/intro/overview/how-it-works.md +++ /dev/null @@ -1,61 +0,0 @@ -# How it works - -## Overview - -There are two fundamental ways to engage Gruntwork: - -1. **Gruntwork builds your architecture.** We generate the [Reference Architecture](https://gruntwork.io/reference-architecture/) based on your needs, deploy into your AWS accounts, and give you 100% of the code. Since you have all the code, you can extend, enhance, and customize the environment exactly according to your needs. The deploy process takes about one day. -2. **Build it yourself.** The Gruntwork IaC library empowers you to [construct your own bespoke architecture](/guides#build-your-own-architecture) in record time. By mix-and-matching our modules and services you can quickly define a custom architecture to suit your needs, all with the confidence of having world-class, battle-tested code running under the hood. - -## What we provide - -The Gruntwork product suite is designed to help you implement a world-class DevOps setup. It includes a combination of products, services, and support. - -### Gruntwork IaC Library - -A battle-tested, production-grade _catalog_ of infrastructure code that contains the core "building blocks" of infrastructure. It includes everything you’ll need to set up: - -- A Multi-account structure -- An infrastructure CI/CD Pipeline -- Networking and VPCs -- App orchestration — ECS, EC2, Kubernetes, and more -- Data storage — Aurora, Elasticache, RDS, and more -- Best-practice security baselines -- _and more…_ - -### Gruntwork Compliance - -An optional _catalog extension_ that contains building blocks that implement various compliance standards. Today we support CIS compliance; SOC 2 is coming soon, and we plan on adding additional standards in the future. - -### Support - -Gruntwork offers basic and paid support options: - -- **[Community support](/support#get-support).** Get help via a [Gruntwork Community Slack](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) and our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions). -- **[Paid support](/support#paid-support-tiers).** Get help via email, a private Slack channel, or scheduled Zoom calls, with response times backed by SLAs. - -## Gruntwork’s Limitations - -Gruntwork focuses on helping you launch and maintain your infrastructure as code. Understanding and using the AWS services that our code provisioned is up to you. Since Gruntwork is an accelerator for your AWS infrastructure and not an abstraction layer in front of AWS, knowledge of AWS and the services you intend to use is required. - -If you purchased our Reference Architecture: During the process of setting up the AWS accounts our tooling will automatically submit quota increase requests to AWS as a support ticket. These AWS quota increases are required to install the components of the Reference Architecture. Often, AWS will approve these requests quickly. Sometimes these support tickets will take some time for AWS to resolve. Unfortunately, some of these requests may be denied by AWS’s support team. Gruntwork can work with you to get these requests approved, but this can take some time, and that time is mostly out of our control. - -## What you provide - -Gruntwork products and services can help you quickly achieve world-class infrastructure. However, we aren’t a consulting company. To succeed, you (or your trusted DevOps consultant/contractor) must commit to learning how to leverage our products for your use cases, making any additional customizations, and deploying or migrating your apps and services. - -### Learn how to use our products - -To work effectively with our products, you’ll need to understand our opinionated stance on DevOps best practices and how to apply it for your purposes. You'll also need to learn how to use the Gruntwork products themselves. Our guides and support remain available to assist you in these endeavors. - -### Implement the “last mile” - -Gruntwork products strike a balance between opinionatedness and configurability. They’ll get you most of the way to your goal, but you may need to make some customizations to suit your use case. You may also need to adapt your apps and services to run in your new infrastructure. Our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) and [Community Slack Channel](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) provide great resources to assist you in this effort. - - - diff --git a/docs/intro/overview/intro-to-gruntwork.md b/docs/intro/overview/intro-to-gruntwork.md index f42bf7e683..1bf2ee5f48 100644 --- a/docs/intro/overview/intro-to-gruntwork.md +++ b/docs/intro/overview/intro-to-gruntwork.md @@ -1,25 +1,22 @@ -# Introduction to Gruntwork +# What we do -### What is Gruntwork? +**Gruntwork is a "DevOps accelerator" that gets you to a world-class DevOps setup leveraging infrastructure-as-code in just a few days.** -**Gruntwork is a "DevOps accelerator" designed to make it possible to achieve a world-class DevOps setup based completely on infrastructure-as-code in just a few days.** - -All Gruntwork products exist within a framework we’ve devised specifically to emphasize DevOps industry best-practices and maximize your team’s efficiency. In the [how it works](how-it-works.md) section, we’ll cover how Gruntwork can help your team implement your infrastructure using this framework. +All Gruntwork products exist within a framework we’ve devised specifically to emphasize DevOps industry best-practices and maximize your team’s efficiency. In the [What we provide](what-we-provide.md) section, we’ll cover how Gruntwork can help your team implement your infrastructure using this framework. Gruntwork works best for teams building new infrastructure ("greenfield"), either from scratch or as part of a migration. However, it can also be used by teams with existing infrastructure ("brownfield") if they have sufficient DevOps experience. -### Supported public clouds - -Gruntwork products focus on Amazon Web Services (AWS). Support for other public clouds such as GCP and Azure may be added in the future. +All Gruntwork products are built on and fully compatible with [open source Terraform](https://terraform.io). The one exception to this is the [Gruntwork Reference Architecture](https://gruntwork.io/reference-architecture/), which uses [Terragrunt](https://terragrunt.gruntwork.io/) (one of our open source tools) to implement an end-to-end architecture. -### Gruntwork uses Terraform +There are two fundamental ways to engage Gruntwork: -All Gruntwork products are built on and fully compatible with [open source Terraform](https://terraform.io). The one exception to this is the [Gruntwork Reference Architecture](https://gruntwork.io/reference-architecture/), which uses [Terragrunt](https://terragrunt.gruntwork.io/) (one of our open source tools) to implement an end-to-end architecture. +1. **Gruntwork builds your architecture.** We generate the [Reference Architecture](https://gruntwork.io/reference-architecture/) based on your needs, deploy into your AWS accounts, and give you 100% of the code. Since you have all the code, you can extend, enhance, and customize the environment exactly according to your needs. The deploy process takes about one day. +2. **Build it yourself.** The Gruntwork IaC library empowers you to [construct your own bespoke architecture](/guides#build-your-own-architecture) in record time. By mix-and-matching our modules and services you can quickly define a custom architecture to suit your needs, all with the confidence of having world-class, battle-tested code running under the hood. diff --git a/docs/intro/overview/what-we-provide.md b/docs/intro/overview/what-we-provide.md new file mode 100644 index 0000000000..a6b536fc6c --- /dev/null +++ b/docs/intro/overview/what-we-provide.md @@ -0,0 +1,38 @@ +# What we provide + +## Gruntwork IaC Library + +A battle-tested, production-grade _catalog_ of infrastructure code that contains the core "building blocks" of infrastructure. It includes everything you’ll need to set up: + +- A Multi-account structure +- An infrastructure CI/CD Pipeline +- Networking and VPCs +- App orchestration — ECS, EC2, Kubernetes, and more +- Data storage — Aurora, Elasticache, RDS, and more +- Best-practice security baselines +- _and [more…](/iac/whats-this/)_ + +## Gruntwork Compliance + +An optional _catalog extension_ that contains building blocks that implement various compliance standards. Today we support CIS compliance; SOC 2 is coming soon, and we plan on adding additional standards in the future. + +## Support + +Gruntwork offers basic and paid support options: + +- **[Community support](/support#get-support).** Get help via a [Gruntwork Community Slack](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) and our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions). +- **[Paid support](/support#paid-support-tiers).** Get help via email, a private Slack channel, or scheduled Zoom calls, with response times backed by SLAs. + +## Gruntwork’s Limitations + +Gruntwork focuses on helping you launch and maintain your infrastructure as code. Understanding and using the AWS services that our code provisioned is up to you. Since Gruntwork is an accelerator for your AWS infrastructure and not an abstraction layer in front of AWS, knowledge of AWS and the services you intend to use is required. + +If you purchased our Reference Architecture: During the process of setting up the AWS accounts our tooling will automatically submit quota increase requests to AWS as a support ticket. These AWS quota increases are required to install the components of the Reference Architecture. Often, AWS will approve these requests quickly. Sometimes these support tickets will take some time for AWS to resolve. Unfortunately, some of these requests may be denied by AWS’s support team. Gruntwork can work with you to get these requests approved, but this can take some time, and that time is mostly out of our control. + + + diff --git a/docs/intro/overview/what-you-provide.md b/docs/intro/overview/what-you-provide.md new file mode 100644 index 0000000000..a02ec1955e --- /dev/null +++ b/docs/intro/overview/what-you-provide.md @@ -0,0 +1,19 @@ +# What you provide + +Gruntwork products and services can help you quickly achieve world-class infrastructure. However, we aren’t a consulting company. To succeed, you (or your trusted DevOps consultant/contractor) must commit to learning how to leverage our products for your use cases, making any additional customizations, and deploying or migrating your apps and services. + +## Learn how to use our products + +To work effectively with our products, you’ll need to understand our opinionated stance on DevOps best practices and how to apply it for your purposes. You'll also need to learn how to use the Gruntwork products themselves. Our guides and support remain available to assist you in these endeavors. + +## Implement the “last mile” + +Gruntwork products strike a balance between opinionatedness and configurability. They’ll get you most of the way to your goal, but you may need to make some customizations to suit your use case. You may also need to adapt your apps and services to run in your new infrastructure. Our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) and [Community Slack Channel](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) provide great resources to assist you in this effort. + + + diff --git a/package.json b/package.json index 4512314a54..a19fd0e968 100644 --- a/package.json +++ b/package.json @@ -7,7 +7,7 @@ }, "scripts": { "docusaurus": "docusaurus", - "start": "docusaurus start --port 3001 & onchange -i '_docs-sources/**/*(*.md|*.mdx|*.json)' -- yarn regenerate:local", + "start": "docusaurus start --port 3000 & onchange -i '_docs-sources/**/*(*.md|*.mdx|*.json)' -- yarn regenerate:local", "build": "docusaurus build", "swizzle": "docusaurus swizzle", "deploy": "docusaurus deploy", diff --git a/sidebars/intro-guide.js b/sidebars/intro-guide.js index b3f596326b..aafc7bf2c6 100644 --- a/sidebars/intro-guide.js +++ b/sidebars/intro-guide.js @@ -1,8 +1,12 @@ const sidebar = [ { - "What is all this": [ + label: "Overview", + type: "category", + collapsible: false, + items: [ "intro/overview/intro-to-gruntwork", - "intro/overview/how-it-works", + "intro/overview/what-we-provide", + "intro/overview/what-you-provide", "intro/overview/prerequisites", // Temporarily hiding the unfinished sections from the sidebar We'll put // them back shortly and don't want to delete the pages as we know we're From 2ac57bcd0456cf33cd8f0456384e66fffee2c1dc Mon Sep 17 00:00:00 2001 From: Eugene K Date: Thu, 11 May 2023 16:53:28 -0400 Subject: [PATCH 40/89] Reworked the intro section. --- .../intro/overview/getting-started.mdx | 4 +- _docs-sources/intro/overview/prerequisites.md | 6 +-- .../overview/shared-responsibility-model.md | 45 ---------------- .../intro/overview/what-we-provide.md | 23 ++++++-- .../intro/overview/what-you-provide.md | 19 +++++++ _docs-sources/products.md | 44 +++++++++++++++ docs/intro/overview/getting-started.mdx | 6 +-- docs/intro/overview/prerequisites.md | 8 ++- .../overview/shared-responsibility-model.md | 53 ------------------- docs/intro/overview/what-we-provide.md | 25 ++++++--- docs/intro/overview/what-you-provide.md | 21 +++++++- docs/products.md | 52 ++++++++++++++++++ 12 files changed, 180 insertions(+), 126 deletions(-) delete mode 100644 _docs-sources/intro/overview/shared-responsibility-model.md create mode 100644 _docs-sources/products.md delete mode 100644 docs/intro/overview/shared-responsibility-model.md create mode 100644 docs/products.md diff --git a/_docs-sources/intro/overview/getting-started.mdx b/_docs-sources/intro/overview/getting-started.mdx index 3eef1a7a2a..f4c09e53b3 100644 --- a/_docs-sources/intro/overview/getting-started.mdx +++ b/_docs-sources/intro/overview/getting-started.mdx @@ -1,8 +1,6 @@ import { CardList } from "/src/components/CardGroup" -# Getting started - -In this introductory guide we’ll cover the fundamentals you'll need in order to be successful with Gruntwork. After setting up your account to gain access to Gruntwork products, we’ll help you install necessary tools and understand how they fit into the Gruntwork development workflow. Once finished, you’ll have the knowledge required to dive into our [guides](/guides) and make full use of the IaC Library. +# What's next ) for the customer to use. +1. Maintaining a healthy [Knowledge Base community](https://github.com/gruntwork-io/knowledge-base/discussions) where other engineers (including Grunts) post & answer questions. +1. For Pro / Enterprise Support customers: Answering questions via email and Slack. +1. For Reference Architecture customers: + 1. Generating the initial Reference Architecture based on our customer’s selections of available configurations. This includes: + 1. Our implementation of Landing Zone + 1. A complete sample app with underlying database and caching layer + 1. The Gruntwork Pipeline for deploying changes to infrastructure + 1. An overview of how to use the Reference Architecture + 1. Deploying the initial Reference Architecture into the customer’s brand new empty AWS accounts. + 1. Delivering the initial Reference Architecture Infrastructure as Code to the customer. + 1. Providing resources to the customer for deeply understanding the inner workings of the Reference Architecture. +1. For CIS customers: + 1. Providing IaC libraries to the CIS customer that correctly implement CIS requirements and restrictions. + 1. For aspects of the CIS AWS Foundations Benchmark where those requirements cannot be met by modules, but require human intervention, provide instructions on manual steps the customer must take to meet the requirements. + 1. For CIS Reference Architecture customers, deploying a Reference Architecture and providing access to infrastructure code that implements the CIS AWS Foundations Benchmark requirements out-of-the-box, wherever possible. diff --git a/_docs-sources/intro/overview/what-you-provide.md b/_docs-sources/intro/overview/what-you-provide.md index 720eb4c611..85b94b2537 100644 --- a/_docs-sources/intro/overview/what-you-provide.md +++ b/_docs-sources/intro/overview/what-you-provide.md @@ -9,3 +9,22 @@ To work effectively with our products, you’ll need to understand our opinionat ## Implement the “last mile” Gruntwork products strike a balance between opinionatedness and configurability. They’ll get you most of the way to your goal, but you may need to make some customizations to suit your use case. You may also need to adapt your apps and services to run in your new infrastructure. Our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) and [Community Slack Channel](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) provide great resources to assist you in this effort. + +## As a Gruntwork customer, you are responsible for + +1. Staffing appropriately (as described in the [Prerequisites Guide](/intro/overview/reference-architecture-prerequisites-guide/)) to maintain and customize the modules and (if applicable) the Reference Architecture and to understand how the Gruntwork product works so that changes can be made to customize it to the customer’s needs. + 1. Raise limitations of Gruntwork modules as a feature request or a pull request. + 1. N.B., Gruntwork does not guarantee any turn-around time on getting features built or PRs reviewed and merged. Gruntwork modules must also be applicable to a wide range of companies, so we will be selective about features added and pull requests accepted. +1. Adding additional Infrastructure as Code to customize it for your company. +1. Communicating with AWS to fix account issues and limitations beyond Gruntwork’s control (quotas, account verification, et cetera). +1. For Reference Architecture customers: + 1. Following all provided manual steps in the Reference Architecture documents where automation is not possible. There are certain steps a Reference Architecture customer must perform on their own. Please keep an eye out for emails from Gruntwork engineers when you are configuring your Reference Architecture form for + deployment. + 1. Extending and customizing Gruntwork Pipelines beyond the basic CI/CD pipeline that Gruntwork has provided to suit your deployment requirements. + 1. Designing and implementing your AWS infrastructure beyond the Reference Architecture. + 1. Understanding and awareness of AWS resource costs for all infrastructure deployed into your AWS accounts ([Knowledge Base #307](https://github.com/gruntwork-io/knowledge-base/discussions/307) for Ref Arch baseline). + 1. Once deployed, maintaining the Reference Architecture to keep it secure and up to date. + 1. Keeping the Reference Architecture secure in accordance with their company needs. + 1. Understanding and accepting the security implications of any changes made to the Reference Architecture. + 1. Monitoring Gruntwork repositories for updates and new releases and applying them as appropriate. + 1. Maintaining all compliance standards after the Reference Architecture has been delivered. diff --git a/_docs-sources/products.md b/_docs-sources/products.md new file mode 100644 index 0000000000..c39c55ac4d --- /dev/null +++ b/_docs-sources/products.md @@ -0,0 +1,44 @@ +--- +hide_table_of_contents: true +hide_title: true +--- + +import Card from "/src/components/Card" +import CardGroup from "/src/components/CardGroup" +import CenterLayout from "/src/components/CenterLayout" + + + +# Gruntwork Products + + + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + + + + diff --git a/docs/intro/overview/getting-started.mdx b/docs/intro/overview/getting-started.mdx index bc3f55cd01..7eb68966cf 100644 --- a/docs/intro/overview/getting-started.mdx +++ b/docs/intro/overview/getting-started.mdx @@ -1,8 +1,6 @@ import { CardList } from "/src/components/CardGroup" -# Getting started - -In this introductory guide we’ll cover the fundamentals you'll need in order to be successful with Gruntwork. After setting up your account to gain access to Gruntwork products, we’ll help you install necessary tools and understand how they fit into the Gruntwork development workflow. Once finished, you’ll have the knowledge required to dive into our [guides](/guides) and make full use of the IaC Library. +# What's next diff --git a/docs/intro/overview/prerequisites.md b/docs/intro/overview/prerequisites.md index c0e28c18ac..008f2dee51 100644 --- a/docs/intro/overview/prerequisites.md +++ b/docs/intro/overview/prerequisites.md @@ -1,8 +1,6 @@ -# What do I need to know +# What you need to know -Gruntwork accelerates your infrastructure. Our products allow you to treat your infrastructure like you do your application: as code, complete with pull requests and peer reviews. Our products may require a variety of skills to maintain and customize to your needs over time. - -Here's what your team will need so you can succeed with Gruntwork: +Gruntwork accelerates your infrastructure. Our products allow you to treat your infrastructure like you do your application: as code, complete with pull requests and peer reviews. Our products require a _variety of skills_ to maintain and customize to your needs over time. ## Terraform @@ -37,6 +35,6 @@ With Gruntwork, you can accelerate your journey towards capturing your AWS cloud diff --git a/docs/intro/overview/shared-responsibility-model.md b/docs/intro/overview/shared-responsibility-model.md deleted file mode 100644 index 7c8b1017bf..0000000000 --- a/docs/intro/overview/shared-responsibility-model.md +++ /dev/null @@ -1,53 +0,0 @@ -# Shared Responsibility Model - -:::note - -The implementation and maintenance of Gruntwork products in AWS is a shared responsibility between Gruntwork and the customer. - -::: - -## Gruntwork is responsible for: - -1. Providing a tested, updated, and richly featured collection of infrastructure code for the customer to use. -1. Maintaining a healthy Knowledge Base community where other engineers (including Grunts) post & answer questions. -1. For Pro / Enterprise Support customers: Answering questions via email and Slack. -1. For Reference Architecture customers: - 1. Generating the initial Reference Architecture based on our customer’s selections of available configurations. This includes: - 1. Our implementation of Landing Zone - 1. A complete sample app with underlying database and caching layer - 1. The Gruntwork Pipeline for deploying changes to infrastructure - 1. An overview of how to use the Reference Architecture - 1. Deploying the initial Reference Architecture into the customer’s brand new empty AWS accounts. - 1. Delivering the initial Reference Architecture Infrastructure as Code to the customer. - 1. Providing resources to the customer for deeply understanding the inner workings of the Reference Architecture. -1. For CIS customers: - 1. Providing IaC libraries to the CIS customer that correctly implement CIS requirements and restrictions. - 1. For aspects of the CIS AWS Foundations Benchmark where those requirements cannot be met by modules, but require human intervention, provide instructions on manual steps the customer must take to meet the requirements. - 1. For CIS Reference Architecture customers, deploying a Reference Architecture and providing access to infrastructure code that implements the CIS AWS Foundations Benchmark requirements out-of-the-box, wherever possible. - -## As a Gruntwork customer, you are responsible for: - -1. Staffing appropriately (as described in the [Prerequisites Guide](/intro/overview/reference-architecture-prerequisites-guide/)) to maintain and customize the modules and (if applicable) the Reference Architecture and to understand how the Gruntwork product works so that changes can be made to customize it to the customer’s needs. - 1. Raise limitations of Gruntwork modules as a feature request or a pull request. - 1. N.B., Gruntwork does not guarantee any turn-around time on getting features built or PRs reviewed and merged. Gruntwork modules must also be applicable to a wide range of companies, so we will be selective about features added and pull requests accepted. -1. Adding additional Infrastructure as Code to customize it for your company. -1. Communicating with AWS to fix account issues and limitations beyond Gruntwork’s control (quotas, account verification, et cetera). -1. For Reference Architecture customers: - 1. Following all provided manual steps in the Reference Architecture documents where automation is not possible. There are certain steps a Reference Architecture customer must perform on their own. Please keep an eye out for emails from Gruntwork engineers when you are configuring your Reference Architecture form for - deployment. - 1. Extending and customizing Gruntwork Pipelines beyond the basic CI/CD pipeline that Gruntwork has provided to suit your deployment requirements. - 1. Designing and implementing your AWS infrastructure beyond the Reference Architecture. - 1. Understanding and awareness of AWS resource costs for all infrastructure deployed into your AWS accounts ([Knowledge Base #307](https://github.com/gruntwork-io/knowledge-base/discussions/307) for Ref Arch baseline). - 1. Once deployed, maintaining the Reference Architecture to keep it secure and up to date. - 1. Keeping the Reference Architecture secure in accordance with their company needs. - 1. Understanding and accepting the security implications of any changes made to the Reference Architecture. - 1. Monitoring Gruntwork repositories for updates and new releases and applying them as appropriate. - 1. Maintaining all compliance standards after the Reference Architecture has been delivered. - - - diff --git a/docs/intro/overview/what-we-provide.md b/docs/intro/overview/what-we-provide.md index a6b536fc6c..f965c3796f 100644 --- a/docs/intro/overview/what-we-provide.md +++ b/docs/intro/overview/what-we-provide.md @@ -23,16 +23,29 @@ Gruntwork offers basic and paid support options: - **[Community support](/support#get-support).** Get help via a [Gruntwork Community Slack](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) and our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions). - **[Paid support](/support#paid-support-tiers).** Get help via email, a private Slack channel, or scheduled Zoom calls, with response times backed by SLAs. -## Gruntwork’s Limitations - -Gruntwork focuses on helping you launch and maintain your infrastructure as code. Understanding and using the AWS services that our code provisioned is up to you. Since Gruntwork is an accelerator for your AWS infrastructure and not an abstraction layer in front of AWS, knowledge of AWS and the services you intend to use is required. - -If you purchased our Reference Architecture: During the process of setting up the AWS accounts our tooling will automatically submit quota increase requests to AWS as a support ticket. These AWS quota increases are required to install the components of the Reference Architecture. Often, AWS will approve these requests quickly. Sometimes these support tickets will take some time for AWS to resolve. Unfortunately, some of these requests may be denied by AWS’s support team. Gruntwork can work with you to get these requests approved, but this can take some time, and that time is mostly out of our control. +## Gruntwork is responsible for + +1. Providing a tested, updated, and richly featured [collection of infrastructure code](<(/iac/whats-this/)>) for the customer to use. +1. Maintaining a healthy [Knowledge Base community](https://github.com/gruntwork-io/knowledge-base/discussions) where other engineers (including Grunts) post & answer questions. +1. For Pro / Enterprise Support customers: Answering questions via email and Slack. +1. For Reference Architecture customers: + 1. Generating the initial Reference Architecture based on our customer’s selections of available configurations. This includes: + 1. Our implementation of Landing Zone + 1. A complete sample app with underlying database and caching layer + 1. The Gruntwork Pipeline for deploying changes to infrastructure + 1. An overview of how to use the Reference Architecture + 1. Deploying the initial Reference Architecture into the customer’s brand new empty AWS accounts. + 1. Delivering the initial Reference Architecture Infrastructure as Code to the customer. + 1. Providing resources to the customer for deeply understanding the inner workings of the Reference Architecture. +1. For CIS customers: + 1. Providing IaC libraries to the CIS customer that correctly implement CIS requirements and restrictions. + 1. For aspects of the CIS AWS Foundations Benchmark where those requirements cannot be met by modules, but require human intervention, provide instructions on manual steps the customer must take to meet the requirements. + 1. For CIS Reference Architecture customers, deploying a Reference Architecture and providing access to infrastructure code that implements the CIS AWS Foundations Benchmark requirements out-of-the-box, wherever possible. diff --git a/docs/intro/overview/what-you-provide.md b/docs/intro/overview/what-you-provide.md index a02ec1955e..22a6feb722 100644 --- a/docs/intro/overview/what-you-provide.md +++ b/docs/intro/overview/what-you-provide.md @@ -10,10 +10,29 @@ To work effectively with our products, you’ll need to understand our opinionat Gruntwork products strike a balance between opinionatedness and configurability. They’ll get you most of the way to your goal, but you may need to make some customizations to suit your use case. You may also need to adapt your apps and services to run in your new infrastructure. Our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) and [Community Slack Channel](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) provide great resources to assist you in this effort. +## As a Gruntwork customer, you are responsible for + +1. Staffing appropriately (as described in the [Prerequisites Guide](/intro/overview/reference-architecture-prerequisites-guide/)) to maintain and customize the modules and (if applicable) the Reference Architecture and to understand how the Gruntwork product works so that changes can be made to customize it to the customer’s needs. + 1. Raise limitations of Gruntwork modules as a feature request or a pull request. + 1. N.B., Gruntwork does not guarantee any turn-around time on getting features built or PRs reviewed and merged. Gruntwork modules must also be applicable to a wide range of companies, so we will be selective about features added and pull requests accepted. +1. Adding additional Infrastructure as Code to customize it for your company. +1. Communicating with AWS to fix account issues and limitations beyond Gruntwork’s control (quotas, account verification, et cetera). +1. For Reference Architecture customers: + 1. Following all provided manual steps in the Reference Architecture documents where automation is not possible. There are certain steps a Reference Architecture customer must perform on their own. Please keep an eye out for emails from Gruntwork engineers when you are configuring your Reference Architecture form for + deployment. + 1. Extending and customizing Gruntwork Pipelines beyond the basic CI/CD pipeline that Gruntwork has provided to suit your deployment requirements. + 1. Designing and implementing your AWS infrastructure beyond the Reference Architecture. + 1. Understanding and awareness of AWS resource costs for all infrastructure deployed into your AWS accounts ([Knowledge Base #307](https://github.com/gruntwork-io/knowledge-base/discussions/307) for Ref Arch baseline). + 1. Once deployed, maintaining the Reference Architecture to keep it secure and up to date. + 1. Keeping the Reference Architecture secure in accordance with their company needs. + 1. Understanding and accepting the security implications of any changes made to the Reference Architecture. + 1. Monitoring Gruntwork repositories for updates and new releases and applying them as appropriate. + 1. Maintaining all compliance standards after the Reference Architecture has been delivered. + diff --git a/docs/products.md b/docs/products.md new file mode 100644 index 0000000000..8bae3f2493 --- /dev/null +++ b/docs/products.md @@ -0,0 +1,52 @@ +--- +hide_table_of_contents: true +hide_title: true +--- + +import Card from "/src/components/Card" +import CardGroup from "/src/components/CardGroup" +import CenterLayout from "/src/components/CenterLayout" + + + +# Gruntwork Products + + + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + + + + + + + + From 3924f689cbf66a3cf93b2e571cbeca5dae032b39 Mon Sep 17 00:00:00 2001 From: Eugene K Date: Thu, 11 May 2023 17:18:16 -0400 Subject: [PATCH 41/89] Update link to us docId link format --- _docs-sources/intro/overview/what-we-provide.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/_docs-sources/intro/overview/what-we-provide.md b/_docs-sources/intro/overview/what-we-provide.md index 85208df740..2bc92cc561 100644 --- a/_docs-sources/intro/overview/what-we-provide.md +++ b/_docs-sources/intro/overview/what-we-provide.md @@ -10,7 +10,7 @@ A battle-tested, production-grade _catalog_ of infrastructure code that contains - App orchestration — ECS, EC2, Kubernetes, and more - Data storage — Aurora, Elasticache, RDS, and more - Best-practice security baselines -- _and [more…](/iac/whats-this/)_ +- _and [more…](/iac/whats-this)_ ## Gruntwork Compliance @@ -25,7 +25,7 @@ Gruntwork offers basic and paid support options: ## Gruntwork is responsible for -1. Providing a tested, updated, and richly featured [collection of infrastructure code](<(/iac/whats-this/)>) for the customer to use. +1. Providing a tested, updated, and richly featured [collection of infrastructure code](/iac/whats-this) for the customer to use. 1. Maintaining a healthy [Knowledge Base community](https://github.com/gruntwork-io/knowledge-base/discussions) where other engineers (including Grunts) post & answer questions. 1. For Pro / Enterprise Support customers: Answering questions via email and Slack. 1. For Reference Architecture customers: From 9919138c96ae4f20bb83e7bacaa6ff08fe3ecf6d Mon Sep 17 00:00:00 2001 From: Eugene K Date: Thu, 11 May 2023 17:23:45 -0400 Subject: [PATCH 42/89] Update link to us docId link format --- docs/intro/overview/what-we-provide.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/intro/overview/what-we-provide.md b/docs/intro/overview/what-we-provide.md index f965c3796f..8424566eca 100644 --- a/docs/intro/overview/what-we-provide.md +++ b/docs/intro/overview/what-we-provide.md @@ -10,7 +10,7 @@ A battle-tested, production-grade _catalog_ of infrastructure code that contains - App orchestration — ECS, EC2, Kubernetes, and more - Data storage — Aurora, Elasticache, RDS, and more - Best-practice security baselines -- _and [more…](/iac/whats-this/)_ +- _and [more…](/iac/whats-this)_ ## Gruntwork Compliance @@ -25,7 +25,7 @@ Gruntwork offers basic and paid support options: ## Gruntwork is responsible for -1. Providing a tested, updated, and richly featured [collection of infrastructure code](<(/iac/whats-this/)>) for the customer to use. +1. Providing a tested, updated, and richly featured [collection of infrastructure code](/iac/whats-this) for the customer to use. 1. Maintaining a healthy [Knowledge Base community](https://github.com/gruntwork-io/knowledge-base/discussions) where other engineers (including Grunts) post & answer questions. 1. For Pro / Enterprise Support customers: Answering questions via email and Slack. 1. For Reference Architecture customers: @@ -46,6 +46,6 @@ Gruntwork offers basic and paid support options: From 2180bb2f3274897237c6d7c18cacac249fc591f8 Mon Sep 17 00:00:00 2001 From: Eugene K Date: Thu, 11 May 2023 17:41:14 -0400 Subject: [PATCH 43/89] Fix link --- _docs-sources/intro/overview/what-you-provide.md | 2 +- docs/intro/overview/what-you-provide.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/_docs-sources/intro/overview/what-you-provide.md b/_docs-sources/intro/overview/what-you-provide.md index 85b94b2537..d05c7fa073 100644 --- a/_docs-sources/intro/overview/what-you-provide.md +++ b/_docs-sources/intro/overview/what-you-provide.md @@ -12,7 +12,7 @@ Gruntwork products strike a balance between opinionatedness and configurability. ## As a Gruntwork customer, you are responsible for -1. Staffing appropriately (as described in the [Prerequisites Guide](/intro/overview/reference-architecture-prerequisites-guide/)) to maintain and customize the modules and (if applicable) the Reference Architecture and to understand how the Gruntwork product works so that changes can be made to customize it to the customer’s needs. +1. Staffing appropriately (as described in the [Prerequisites Guide](/intro/overview/reference-architecture-prerequisites-guide)) to maintain and customize the modules and (if applicable) the Reference Architecture and to understand how the Gruntwork product works so that changes can be made to customize it to the customer’s needs. 1. Raise limitations of Gruntwork modules as a feature request or a pull request. 1. N.B., Gruntwork does not guarantee any turn-around time on getting features built or PRs reviewed and merged. Gruntwork modules must also be applicable to a wide range of companies, so we will be selective about features added and pull requests accepted. 1. Adding additional Infrastructure as Code to customize it for your company. diff --git a/docs/intro/overview/what-you-provide.md b/docs/intro/overview/what-you-provide.md index 22a6feb722..5d90be6233 100644 --- a/docs/intro/overview/what-you-provide.md +++ b/docs/intro/overview/what-you-provide.md @@ -12,7 +12,7 @@ Gruntwork products strike a balance between opinionatedness and configurability. ## As a Gruntwork customer, you are responsible for -1. Staffing appropriately (as described in the [Prerequisites Guide](/intro/overview/reference-architecture-prerequisites-guide/)) to maintain and customize the modules and (if applicable) the Reference Architecture and to understand how the Gruntwork product works so that changes can be made to customize it to the customer’s needs. +1. Staffing appropriately (as described in the [Prerequisites Guide](/intro/overview/reference-architecture-prerequisites-guide)) to maintain and customize the modules and (if applicable) the Reference Architecture and to understand how the Gruntwork product works so that changes can be made to customize it to the customer’s needs. 1. Raise limitations of Gruntwork modules as a feature request or a pull request. 1. N.B., Gruntwork does not guarantee any turn-around time on getting features built or PRs reviewed and merged. Gruntwork modules must also be applicable to a wide range of companies, so we will be selective about features added and pull requests accepted. 1. Adding additional Infrastructure as Code to customize it for your company. @@ -33,6 +33,6 @@ Gruntwork products strike a balance between opinionatedness and configurability. From c1962beb4673ac709acb222416ba5dbcdf61a118 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Thu, 11 May 2023 14:32:59 -0700 Subject: [PATCH 44/89] change port --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index a19fd0e968..4512314a54 100644 --- a/package.json +++ b/package.json @@ -7,7 +7,7 @@ }, "scripts": { "docusaurus": "docusaurus", - "start": "docusaurus start --port 3000 & onchange -i '_docs-sources/**/*(*.md|*.mdx|*.json)' -- yarn regenerate:local", + "start": "docusaurus start --port 3001 & onchange -i '_docs-sources/**/*(*.md|*.mdx|*.json)' -- yarn regenerate:local", "build": "docusaurus build", "swizzle": "docusaurus swizzle", "deploy": "docusaurus deploy", From 7bf1f0e75a04ba563bcf0436dd6a697ca1d24142 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Thu, 11 May 2023 14:33:24 -0700 Subject: [PATCH 45/89] change port back --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 4512314a54..a19fd0e968 100644 --- a/package.json +++ b/package.json @@ -7,7 +7,7 @@ }, "scripts": { "docusaurus": "docusaurus", - "start": "docusaurus start --port 3001 & onchange -i '_docs-sources/**/*(*.md|*.mdx|*.json)' -- yarn regenerate:local", + "start": "docusaurus start --port 3000 & onchange -i '_docs-sources/**/*(*.md|*.mdx|*.json)' -- yarn regenerate:local", "build": "docusaurus build", "swizzle": "docusaurus swizzle", "deploy": "docusaurus deploy", From 4912a334847c79f0b072d3646dc1e7f359fbeaaf Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Thu, 11 May 2023 15:31:16 -0700 Subject: [PATCH 46/89] fix link --- _docs-sources/intro/overview/what-you-provide.md | 2 +- docs/intro/overview/what-you-provide.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/_docs-sources/intro/overview/what-you-provide.md b/_docs-sources/intro/overview/what-you-provide.md index d05c7fa073..ca6c5916e8 100644 --- a/_docs-sources/intro/overview/what-you-provide.md +++ b/_docs-sources/intro/overview/what-you-provide.md @@ -12,7 +12,7 @@ Gruntwork products strike a balance between opinionatedness and configurability. ## As a Gruntwork customer, you are responsible for -1. Staffing appropriately (as described in the [Prerequisites Guide](/intro/overview/reference-architecture-prerequisites-guide)) to maintain and customize the modules and (if applicable) the Reference Architecture and to understand how the Gruntwork product works so that changes can be made to customize it to the customer’s needs. +1. Staffing appropriately (as described in the [Prerequisites Guide](/intro/overview/prerequisites)) to maintain and customize the modules and (if applicable) the Reference Architecture and to understand how the Gruntwork product works so that changes can be made to customize it to the customer’s needs. 1. Raise limitations of Gruntwork modules as a feature request or a pull request. 1. N.B., Gruntwork does not guarantee any turn-around time on getting features built or PRs reviewed and merged. Gruntwork modules must also be applicable to a wide range of companies, so we will be selective about features added and pull requests accepted. 1. Adding additional Infrastructure as Code to customize it for your company. diff --git a/docs/intro/overview/what-you-provide.md b/docs/intro/overview/what-you-provide.md index 5d90be6233..04c8e848f1 100644 --- a/docs/intro/overview/what-you-provide.md +++ b/docs/intro/overview/what-you-provide.md @@ -12,7 +12,7 @@ Gruntwork products strike a balance between opinionatedness and configurability. ## As a Gruntwork customer, you are responsible for -1. Staffing appropriately (as described in the [Prerequisites Guide](/intro/overview/reference-architecture-prerequisites-guide)) to maintain and customize the modules and (if applicable) the Reference Architecture and to understand how the Gruntwork product works so that changes can be made to customize it to the customer’s needs. +1. Staffing appropriately (as described in the [Prerequisites Guide](/intro/overview/prerequisites)) to maintain and customize the modules and (if applicable) the Reference Architecture and to understand how the Gruntwork product works so that changes can be made to customize it to the customer’s needs. 1. Raise limitations of Gruntwork modules as a feature request or a pull request. 1. N.B., Gruntwork does not guarantee any turn-around time on getting features built or PRs reviewed and merged. Gruntwork modules must also be applicable to a wide range of companies, so we will be selective about features added and pull requests accepted. 1. Adding additional Infrastructure as Code to customize it for your company. @@ -33,6 +33,6 @@ Gruntwork products strike a balance between opinionatedness and configurability. From 7de742b99380fcd71995c1a805fc378cc09600a8 Mon Sep 17 00:00:00 2001 From: Eugene K Date: Thu, 11 May 2023 21:57:45 -0400 Subject: [PATCH 47/89] Added the TFC/TFE to the IaC library docs sidebar. --- sidebars/iac.js | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/sidebars/iac.js b/sidebars/iac.js index b7cd3b2cc5..2c84417515 100644 --- a/sidebars/iac.js +++ b/sidebars/iac.js @@ -12,7 +12,7 @@ const sidebar = [ "iac/whats-this/index", "iac/whats-this/modules", "iac/whats-this/services", - ] + ], }, { label: "Getting Started", @@ -33,25 +33,20 @@ const sidebar = [ "iac/usage/using-a-service", "iac/usage/customizing-modules", "iac/usage/composing-your-own-service", + "guides/working-with-code/tfc-integration", ], }, { label: "Staying up to date", type: "category", collapsible: false, - items: [ - "iac/usage/versioning", - "iac/usage/updating", - ], + items: ["iac/usage/versioning", "iac/usage/updating"], }, { label: "Support", type: "category", collapsible: false, - items: [ - "iac/support/issues", - "iac/support/contributing", - ] + items: ["iac/support/issues", "iac/support/contributing"], }, ], }, From f2b7e079f95b47850d6e7bcca3fefc367af8ba12 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Thu, 18 May 2023 09:22:56 -0700 Subject: [PATCH 48/89] restore stay-up-to-date --- docs/guides/stay-up-to-date/index.md | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/docs/guides/stay-up-to-date/index.md b/docs/guides/stay-up-to-date/index.md index d6d6f16e0b..a332f9130e 100644 --- a/docs/guides/stay-up-to-date/index.md +++ b/docs/guides/stay-up-to-date/index.md @@ -16,7 +16,22 @@ import CardGroup from "/src/components/CardGroup" - + + + + + + + + + + + + + + + + @@ -98,7 +113,7 @@ href="/guides/stay-up-to-date/cis/cis-1.5.0" From e247a341dc44f737faf7717bc9de304cd2efd726 Mon Sep 17 00:00:00 2001 From: Eugene Kolnick <34349331+eak12913@users.noreply.github.com> Date: Thu, 18 May 2023 15:28:05 -0400 Subject: [PATCH 49/89] [CORE-911] Doc updates for the intro section (#797) --- .../intro/overview/intro-to-gruntwork.md | 8 +-- _docs-sources/intro/overview/prerequisites.md | 4 -- .../intro/overview/what-we-provide.md | 46 +++++++------ .../intro/overview/what-you-provide.md | 65 ++++++++++++------- docs/intro/overview/intro-to-gruntwork.md | 10 +-- docs/intro/overview/prerequisites.md | 6 +- docs/intro/overview/what-we-provide.md | 48 +++++++------- docs/intro/overview/what-you-provide.md | 63 ++++++++++++------ 8 files changed, 140 insertions(+), 110 deletions(-) diff --git a/_docs-sources/intro/overview/intro-to-gruntwork.md b/_docs-sources/intro/overview/intro-to-gruntwork.md index 6e02695d46..e4aa497507 100644 --- a/_docs-sources/intro/overview/intro-to-gruntwork.md +++ b/_docs-sources/intro/overview/intro-to-gruntwork.md @@ -2,13 +2,13 @@ **Gruntwork is a "DevOps accelerator" that gets you to a world-class DevOps setup leveraging infrastructure-as-code in just a few days.** -All Gruntwork products exist within a framework we’ve devised specifically to emphasize DevOps industry best-practices and maximize your team’s efficiency. In the [What we provide](what-we-provide.md) section, we’ll cover how Gruntwork can help your team implement your infrastructure using this framework. +All Gruntwork products exist within a [framework](/guides/production-framework) we’ve devised specifically to emphasize DevOps industry best-practices and maximize your team’s efficiency. Gruntwork works best for teams building new infrastructure ("greenfield"), either from scratch or as part of a migration. However, it can also be used by teams with existing infrastructure ("brownfield") if they have sufficient DevOps experience. -All Gruntwork products are built on and fully compatible with [open source Terraform](https://terraform.io). The one exception to this is the [Gruntwork Reference Architecture](https://gruntwork.io/reference-architecture/), which uses [Terragrunt](https://terragrunt.gruntwork.io/) (one of our open source tools) to implement an end-to-end architecture. +All Gruntwork products are built on and fully compatible with [Terraform](https://terraform.io). The one exception to this is the [Gruntwork Reference Architecture](https://gruntwork.io/reference-architecture/), which uses [Terragrunt](https://terragrunt.gruntwork.io/) (one of our open source tools) to implement an end-to-end architecture. There are two fundamental ways to engage Gruntwork: -1. **Gruntwork builds your architecture.** We generate the [Reference Architecture](https://gruntwork.io/reference-architecture/) based on your needs, deploy into your AWS accounts, and give you 100% of the code. Since you have all the code, you can extend, enhance, and customize the environment exactly according to your needs. The deploy process takes about one day. -2. **Build it yourself.** The Gruntwork IaC library empowers you to [construct your own bespoke architecture](/guides#build-your-own-architecture) in record time. By mix-and-matching our modules and services you can quickly define a custom architecture to suit your needs, all with the confidence of having world-class, battle-tested code running under the hood. +1. **Gruntwork builds your architecture.** We generate the [Reference Architecture](https://gruntwork.io/reference-architecture/) based on your needs, deploy into your AWS accounts, and give you 100% of the code. Since you have all the code, you can extend, enhance, and customize the environment exactly according to your needs. See [the docs](/refarch/whats-this/what-is-a-reference-architecture) for more information about our Reference Architecture. +2. **Build it yourself.** The Gruntwork IaC library empowers you to construct your own bespoke architecture in record time. By mix-and-matching our [modules](/iac/whats-this/modules) and [services](/iac/whats-this/services) you can quickly define a custom architecture to suit your needs, all with the confidence of having world-class, battle-tested code running under the hood. diff --git a/_docs-sources/intro/overview/prerequisites.md b/_docs-sources/intro/overview/prerequisites.md index 3e4132f1d2..5f4119128f 100644 --- a/_docs-sources/intro/overview/prerequisites.md +++ b/_docs-sources/intro/overview/prerequisites.md @@ -26,7 +26,3 @@ To be successful with the infrastructure provisioned by us, you must have a dece ## Containerization tools like Docker and Packer We create Docker containers throughout our code library, and use them heavily in our [Gruntwork Pipelines](https://gruntwork.io/pipelines/) product, an important piece of the Reference Architecture. Containerization is an important part of helping many companies scale in the cloud, and we’re no exception. Familiarity with creating docker images and pushing and pulling them from repositories is required. Likewise, we use Packer to build AMIs. Understanding Packer will enable you to build your own AMIs for your own infrastructure and make modifications to the infrastructure we provision for you. - -## Time to learn - -With Gruntwork, you can accelerate your journey towards capturing your AWS cloud infrastructure as Infrastructure as Code. Although our aim is to simplify this intricate process, gaining a comprehensive understanding of your infrastructure's complexities and tailoring it to your specific needs will require a significant investment of time and effort on your part. diff --git a/_docs-sources/intro/overview/what-we-provide.md b/_docs-sources/intro/overview/what-we-provide.md index 2bc92cc561..03c5f27056 100644 --- a/_docs-sources/intro/overview/what-we-provide.md +++ b/_docs-sources/intro/overview/what-we-provide.md @@ -12,32 +12,30 @@ A battle-tested, production-grade _catalog_ of infrastructure code that contains - Best-practice security baselines - _and [more…](/iac/whats-this)_ +## Support + +Gruntwork offers basic and paid support options: + +- **[Community support](/support#get-support).** Get help via a [Gruntwork Community Slack](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) and our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) where we maintain healthy communities where other engineers (including Grunts) post & answer questions. +- **[Paid support](/support#paid-support-tiers).** Get help via email or a private Slack channel with response times backed by SLAs. + ## Gruntwork Compliance -An optional _catalog extension_ that contains building blocks that implement various compliance standards. Today we support CIS compliance; SOC 2 is coming soon, and we plan on adding additional standards in the future. +An optional _catalog extension_ that contains building blocks that correctly implement CIS compliance standards. For aspects of the CIS AWS Foundations Benchmark where those requirements cannot be met by modules, but require human intervention, we provide instructions on manual steps you must take to meet the requirements. -## Support +:::note -Gruntwork offers basic and paid support options: +For CIS Reference Architecture customers, we deploy a Reference Architecture and provide access to infrastructure code that implements the CIS AWS Foundations Benchmark requirements out-of-the-box, wherever possible. + +::: + +## Gruntwork Reference Architecture + +An optional end-to-end, multi-account architecture that Gruntwork deploys into your brand new AWS accounts that includes: + +- Our implementation of Landing Zone +- A complete sample app with underlying database and caching layer +- The Gruntwork Pipeline for deploying changes to infrastructure +- An overview of how to use the Reference Architecture -- **[Community support](/support#get-support).** Get help via a [Gruntwork Community Slack](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) and our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions). -- **[Paid support](/support#paid-support-tiers).** Get help via email, a private Slack channel, or scheduled Zoom calls, with response times backed by SLAs. - -## Gruntwork is responsible for - -1. Providing a tested, updated, and richly featured [collection of infrastructure code](/iac/whats-this) for the customer to use. -1. Maintaining a healthy [Knowledge Base community](https://github.com/gruntwork-io/knowledge-base/discussions) where other engineers (including Grunts) post & answer questions. -1. For Pro / Enterprise Support customers: Answering questions via email and Slack. -1. For Reference Architecture customers: - 1. Generating the initial Reference Architecture based on our customer’s selections of available configurations. This includes: - 1. Our implementation of Landing Zone - 1. A complete sample app with underlying database and caching layer - 1. The Gruntwork Pipeline for deploying changes to infrastructure - 1. An overview of how to use the Reference Architecture - 1. Deploying the initial Reference Architecture into the customer’s brand new empty AWS accounts. - 1. Delivering the initial Reference Architecture Infrastructure as Code to the customer. - 1. Providing resources to the customer for deeply understanding the inner workings of the Reference Architecture. -1. For CIS customers: - 1. Providing IaC libraries to the CIS customer that correctly implement CIS requirements and restrictions. - 1. For aspects of the CIS AWS Foundations Benchmark where those requirements cannot be met by modules, but require human intervention, provide instructions on manual steps the customer must take to meet the requirements. - 1. For CIS Reference Architecture customers, deploying a Reference Architecture and providing access to infrastructure code that implements the CIS AWS Foundations Benchmark requirements out-of-the-box, wherever possible. +Once the infrastructure is deployed, Gruntwork engineers deliver the full Infrastructure as Code to you. diff --git a/_docs-sources/intro/overview/what-you-provide.md b/_docs-sources/intro/overview/what-you-provide.md index ca6c5916e8..80b3ca2a1b 100644 --- a/_docs-sources/intro/overview/what-you-provide.md +++ b/_docs-sources/intro/overview/what-you-provide.md @@ -2,29 +2,50 @@ Gruntwork products and services can help you quickly achieve world-class infrastructure. However, we aren’t a consulting company. To succeed, you (or your trusted DevOps consultant/contractor) must commit to learning how to leverage our products for your use cases, making any additional customizations, and deploying or migrating your apps and services. -## Learn how to use our products +## Your team -To work effectively with our products, you’ll need to understand our opinionated stance on DevOps best practices and how to apply it for your purposes. You'll also need to learn how to use the Gruntwork products themselves. Our guides and support remain available to assist you in these endeavors. +You must be appropriately staffed in order to maintain and customize the modules, services, and (if applicable) the Reference Architecture. + +## Time to learn + +With Gruntwork, you can accelerate your journey towards capturing your AWS cloud infrastructure as Infrastructure as Code. Although our aim is to simplify this intricate process, gaining a comprehensive understanding of your infrastructure's complexities and tailoring it to your specific needs will require a significant investment of time and effort on your part. Our [product documentation](/products) and [support](/support) remain available to assist you in these endeavors. ## Implement the “last mile” -Gruntwork products strike a balance between opinionatedness and configurability. They’ll get you most of the way to your goal, but you may need to make some customizations to suit your use case. You may also need to adapt your apps and services to run in your new infrastructure. Our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) and [Community Slack Channel](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) provide great resources to assist you in this effort. - -## As a Gruntwork customer, you are responsible for - -1. Staffing appropriately (as described in the [Prerequisites Guide](/intro/overview/prerequisites)) to maintain and customize the modules and (if applicable) the Reference Architecture and to understand how the Gruntwork product works so that changes can be made to customize it to the customer’s needs. - 1. Raise limitations of Gruntwork modules as a feature request or a pull request. - 1. N.B., Gruntwork does not guarantee any turn-around time on getting features built or PRs reviewed and merged. Gruntwork modules must also be applicable to a wide range of companies, so we will be selective about features added and pull requests accepted. -1. Adding additional Infrastructure as Code to customize it for your company. -1. Communicating with AWS to fix account issues and limitations beyond Gruntwork’s control (quotas, account verification, et cetera). -1. For Reference Architecture customers: - 1. Following all provided manual steps in the Reference Architecture documents where automation is not possible. There are certain steps a Reference Architecture customer must perform on their own. Please keep an eye out for emails from Gruntwork engineers when you are configuring your Reference Architecture form for - deployment. - 1. Extending and customizing Gruntwork Pipelines beyond the basic CI/CD pipeline that Gruntwork has provided to suit your deployment requirements. - 1. Designing and implementing your AWS infrastructure beyond the Reference Architecture. - 1. Understanding and awareness of AWS resource costs for all infrastructure deployed into your AWS accounts ([Knowledge Base #307](https://github.com/gruntwork-io/knowledge-base/discussions/307) for Ref Arch baseline). - 1. Once deployed, maintaining the Reference Architecture to keep it secure and up to date. - 1. Keeping the Reference Architecture secure in accordance with their company needs. - 1. Understanding and accepting the security implications of any changes made to the Reference Architecture. - 1. Monitoring Gruntwork repositories for updates and new releases and applying them as appropriate. - 1. Maintaining all compliance standards after the Reference Architecture has been delivered. +Gruntwork products strike a balance between opinionatedness and configurability. They’ll get you most of the way to your goal, but you may need to make some customizations to suit your use case. You may also need to adapt your apps and services to run in your new infrastructure by customizing/adding additional Infrastructure as Code to customize according to the requirements for your company. Our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) and [Community Slack Channel](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) provide great resources to assist you in this effort. + +If you notice a limitation or bug in Gruntwork modules, we greatly appreciate and welcome [customer PRs](/iac/support/contributing) or you raising this to our attention via [bug or feature requests](/iac/support/issues). + +:::note + +Gruntwork does not guarantee any turn-around time on getting features built or PRs reviewed and merged. Gruntwork modules must also be applicable to a wide range of companies, so we will be selective about features added and pull requests accepted. + +::: + +## Talk to AWS if needed + +You'll have to communicate with AWS to fix account issues and limitations beyond Gruntwork’s control (quotas, account verification, et cetera). + +## If you purchased a Reference Architecture + +### Perform any required manual steps + +Following all provided manual steps in the Reference Architecture documents where automation is not possible. There are certain steps a Reference Architecture customer must perform on their own. Please keep an eye out for emails from Gruntwork engineers when you are configuring your Reference Architecture form for +deployment. + +### Customize Pipelines + +Extend and customize Gruntwork Pipelines beyond the basic CI/CD pipeline that Gruntwork has provided to suit your deployment requirements. + +### Understand your AWS costs + +Understanding and awareness of AWS resource costs for all infrastructure deployed into your AWS accounts ([Knowledge Base #307](https://github.com/gruntwork-io/knowledge-base/discussions/307) for Ref Arch baseline). + +### Maintain your Reference Architecture + +Once deployed, Gruntwork hands the Reference Architecture over to your team. You should expect to keep it secure and up to date by: + +- Keeping the Reference Architecture secure in accordance with your company needs. +- Understanding and accepting the security implications of any changes your team makes to the Reference Architecture. +- Monitoring Gruntwork repositories for updates and new releases and applying them as appropriate. +- Maintaining all compliance standards after the Reference Architecture has been delivered. diff --git a/docs/intro/overview/intro-to-gruntwork.md b/docs/intro/overview/intro-to-gruntwork.md index 1bf2ee5f48..91f0360ebf 100644 --- a/docs/intro/overview/intro-to-gruntwork.md +++ b/docs/intro/overview/intro-to-gruntwork.md @@ -2,21 +2,21 @@ **Gruntwork is a "DevOps accelerator" that gets you to a world-class DevOps setup leveraging infrastructure-as-code in just a few days.** -All Gruntwork products exist within a framework we’ve devised specifically to emphasize DevOps industry best-practices and maximize your team’s efficiency. In the [What we provide](what-we-provide.md) section, we’ll cover how Gruntwork can help your team implement your infrastructure using this framework. +All Gruntwork products exist within a [framework](/guides/production-framework) we’ve devised specifically to emphasize DevOps industry best-practices and maximize your team’s efficiency. Gruntwork works best for teams building new infrastructure ("greenfield"), either from scratch or as part of a migration. However, it can also be used by teams with existing infrastructure ("brownfield") if they have sufficient DevOps experience. -All Gruntwork products are built on and fully compatible with [open source Terraform](https://terraform.io). The one exception to this is the [Gruntwork Reference Architecture](https://gruntwork.io/reference-architecture/), which uses [Terragrunt](https://terragrunt.gruntwork.io/) (one of our open source tools) to implement an end-to-end architecture. +All Gruntwork products are built on and fully compatible with [Terraform](https://terraform.io). The one exception to this is the [Gruntwork Reference Architecture](https://gruntwork.io/reference-architecture/), which uses [Terragrunt](https://terragrunt.gruntwork.io/) (one of our open source tools) to implement an end-to-end architecture. There are two fundamental ways to engage Gruntwork: -1. **Gruntwork builds your architecture.** We generate the [Reference Architecture](https://gruntwork.io/reference-architecture/) based on your needs, deploy into your AWS accounts, and give you 100% of the code. Since you have all the code, you can extend, enhance, and customize the environment exactly according to your needs. The deploy process takes about one day. -2. **Build it yourself.** The Gruntwork IaC library empowers you to [construct your own bespoke architecture](/guides#build-your-own-architecture) in record time. By mix-and-matching our modules and services you can quickly define a custom architecture to suit your needs, all with the confidence of having world-class, battle-tested code running under the hood. +1. **Gruntwork builds your architecture.** We generate the [Reference Architecture](https://gruntwork.io/reference-architecture/) based on your needs, deploy into your AWS accounts, and give you 100% of the code. Since you have all the code, you can extend, enhance, and customize the environment exactly according to your needs. See [the docs](/refarch/whats-this/what-is-a-reference-architecture) for more information about our Reference Architecture. +2. **Build it yourself.** The Gruntwork IaC library empowers you to construct your own bespoke architecture in record time. By mix-and-matching our [modules](/iac/whats-this/modules) and [services](/iac/whats-this/services) you can quickly define a custom architecture to suit your needs, all with the confidence of having world-class, battle-tested code running under the hood. diff --git a/docs/intro/overview/prerequisites.md b/docs/intro/overview/prerequisites.md index 008f2dee51..e2b2e917c3 100644 --- a/docs/intro/overview/prerequisites.md +++ b/docs/intro/overview/prerequisites.md @@ -27,14 +27,10 @@ To be successful with the infrastructure provisioned by us, you must have a dece We create Docker containers throughout our code library, and use them heavily in our [Gruntwork Pipelines](https://gruntwork.io/pipelines/) product, an important piece of the Reference Architecture. Containerization is an important part of helping many companies scale in the cloud, and we’re no exception. Familiarity with creating docker images and pushing and pulling them from repositories is required. Likewise, we use Packer to build AMIs. Understanding Packer will enable you to build your own AMIs for your own infrastructure and make modifications to the infrastructure we provision for you. -## Time to learn - -With Gruntwork, you can accelerate your journey towards capturing your AWS cloud infrastructure as Infrastructure as Code. Although our aim is to simplify this intricate process, gaining a comprehensive understanding of your infrastructure's complexities and tailoring it to your specific needs will require a significant investment of time and effort on your part. - diff --git a/docs/intro/overview/what-we-provide.md b/docs/intro/overview/what-we-provide.md index 8424566eca..2913bfd980 100644 --- a/docs/intro/overview/what-we-provide.md +++ b/docs/intro/overview/what-we-provide.md @@ -12,40 +12,38 @@ A battle-tested, production-grade _catalog_ of infrastructure code that contains - Best-practice security baselines - _and [more…](/iac/whats-this)_ +## Support + +Gruntwork offers basic and paid support options: + +- **[Community support](/support#get-support).** Get help via a [Gruntwork Community Slack](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) and our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) where we maintain healthy communities where other engineers (including Grunts) post & answer questions. +- **[Paid support](/support#paid-support-tiers).** Get help via email or a private Slack channel with response times backed by SLAs. + ## Gruntwork Compliance -An optional _catalog extension_ that contains building blocks that implement various compliance standards. Today we support CIS compliance; SOC 2 is coming soon, and we plan on adding additional standards in the future. +An optional _catalog extension_ that contains building blocks that correctly implement CIS compliance standards. For aspects of the CIS AWS Foundations Benchmark where those requirements cannot be met by modules, but require human intervention, we provide instructions on manual steps you must take to meet the requirements. -## Support +:::note -Gruntwork offers basic and paid support options: +For CIS Reference Architecture customers, we deploy a Reference Architecture and provide access to infrastructure code that implements the CIS AWS Foundations Benchmark requirements out-of-the-box, wherever possible. + +::: + +## Gruntwork Reference Architecture + +An optional end-to-end, multi-account architecture that Gruntwork deploys into your brand new AWS accounts that includes: + +- Our implementation of Landing Zone +- A complete sample app with underlying database and caching layer +- The Gruntwork Pipeline for deploying changes to infrastructure +- An overview of how to use the Reference Architecture -- **[Community support](/support#get-support).** Get help via a [Gruntwork Community Slack](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) and our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions). -- **[Paid support](/support#paid-support-tiers).** Get help via email, a private Slack channel, or scheduled Zoom calls, with response times backed by SLAs. - -## Gruntwork is responsible for - -1. Providing a tested, updated, and richly featured [collection of infrastructure code](/iac/whats-this) for the customer to use. -1. Maintaining a healthy [Knowledge Base community](https://github.com/gruntwork-io/knowledge-base/discussions) where other engineers (including Grunts) post & answer questions. -1. For Pro / Enterprise Support customers: Answering questions via email and Slack. -1. For Reference Architecture customers: - 1. Generating the initial Reference Architecture based on our customer’s selections of available configurations. This includes: - 1. Our implementation of Landing Zone - 1. A complete sample app with underlying database and caching layer - 1. The Gruntwork Pipeline for deploying changes to infrastructure - 1. An overview of how to use the Reference Architecture - 1. Deploying the initial Reference Architecture into the customer’s brand new empty AWS accounts. - 1. Delivering the initial Reference Architecture Infrastructure as Code to the customer. - 1. Providing resources to the customer for deeply understanding the inner workings of the Reference Architecture. -1. For CIS customers: - 1. Providing IaC libraries to the CIS customer that correctly implement CIS requirements and restrictions. - 1. For aspects of the CIS AWS Foundations Benchmark where those requirements cannot be met by modules, but require human intervention, provide instructions on manual steps the customer must take to meet the requirements. - 1. For CIS Reference Architecture customers, deploying a Reference Architecture and providing access to infrastructure code that implements the CIS AWS Foundations Benchmark requirements out-of-the-box, wherever possible. +Once the infrastructure is deployed, Gruntwork engineers deliver the full Infrastructure as Code to you. diff --git a/docs/intro/overview/what-you-provide.md b/docs/intro/overview/what-you-provide.md index 04c8e848f1..c1922e595b 100644 --- a/docs/intro/overview/what-you-provide.md +++ b/docs/intro/overview/what-you-provide.md @@ -2,37 +2,58 @@ Gruntwork products and services can help you quickly achieve world-class infrastructure. However, we aren’t a consulting company. To succeed, you (or your trusted DevOps consultant/contractor) must commit to learning how to leverage our products for your use cases, making any additional customizations, and deploying or migrating your apps and services. -## Learn how to use our products +## Your team -To work effectively with our products, you’ll need to understand our opinionated stance on DevOps best practices and how to apply it for your purposes. You'll also need to learn how to use the Gruntwork products themselves. Our guides and support remain available to assist you in these endeavors. +You must be appropriately staffed in order to maintain and customize the modules, services, and (if applicable) the Reference Architecture. + +## Time to learn + +With Gruntwork, you can accelerate your journey towards capturing your AWS cloud infrastructure as Infrastructure as Code. Although our aim is to simplify this intricate process, gaining a comprehensive understanding of your infrastructure's complexities and tailoring it to your specific needs will require a significant investment of time and effort on your part. Our [product documentation](/products) and [support](/support) remain available to assist you in these endeavors. ## Implement the “last mile” -Gruntwork products strike a balance between opinionatedness and configurability. They’ll get you most of the way to your goal, but you may need to make some customizations to suit your use case. You may also need to adapt your apps and services to run in your new infrastructure. Our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) and [Community Slack Channel](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) provide great resources to assist you in this effort. +Gruntwork products strike a balance between opinionatedness and configurability. They’ll get you most of the way to your goal, but you may need to make some customizations to suit your use case. You may also need to adapt your apps and services to run in your new infrastructure by customizing/adding additional Infrastructure as Code to customize according to the requirements for your company. Our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) and [Community Slack Channel](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) provide great resources to assist you in this effort. + +If you notice a limitation or bug in Gruntwork modules, we greatly appreciate and welcome [customer PRs](/iac/support/contributing) or you raising this to our attention via [bug or feature requests](/iac/support/issues). + +:::note + +Gruntwork does not guarantee any turn-around time on getting features built or PRs reviewed and merged. Gruntwork modules must also be applicable to a wide range of companies, so we will be selective about features added and pull requests accepted. + +::: + +## Talk to AWS if needed + +You'll have to communicate with AWS to fix account issues and limitations beyond Gruntwork’s control (quotas, account verification, et cetera). + +## If you purchased a Reference Architecture + +### Perform any required manual steps + +Following all provided manual steps in the Reference Architecture documents where automation is not possible. There are certain steps a Reference Architecture customer must perform on their own. Please keep an eye out for emails from Gruntwork engineers when you are configuring your Reference Architecture form for +deployment. + +### Customize Pipelines + +Extend and customize Gruntwork Pipelines beyond the basic CI/CD pipeline that Gruntwork has provided to suit your deployment requirements. + +### Understand your AWS costs + +Understanding and awareness of AWS resource costs for all infrastructure deployed into your AWS accounts ([Knowledge Base #307](https://github.com/gruntwork-io/knowledge-base/discussions/307) for Ref Arch baseline). + +### Maintain your Reference Architecture -## As a Gruntwork customer, you are responsible for +Once deployed, Gruntwork hands the Reference Architecture over to your team. You should expect to keep it secure and up to date by: -1. Staffing appropriately (as described in the [Prerequisites Guide](/intro/overview/prerequisites)) to maintain and customize the modules and (if applicable) the Reference Architecture and to understand how the Gruntwork product works so that changes can be made to customize it to the customer’s needs. - 1. Raise limitations of Gruntwork modules as a feature request or a pull request. - 1. N.B., Gruntwork does not guarantee any turn-around time on getting features built or PRs reviewed and merged. Gruntwork modules must also be applicable to a wide range of companies, so we will be selective about features added and pull requests accepted. -1. Adding additional Infrastructure as Code to customize it for your company. -1. Communicating with AWS to fix account issues and limitations beyond Gruntwork’s control (quotas, account verification, et cetera). -1. For Reference Architecture customers: - 1. Following all provided manual steps in the Reference Architecture documents where automation is not possible. There are certain steps a Reference Architecture customer must perform on their own. Please keep an eye out for emails from Gruntwork engineers when you are configuring your Reference Architecture form for - deployment. - 1. Extending and customizing Gruntwork Pipelines beyond the basic CI/CD pipeline that Gruntwork has provided to suit your deployment requirements. - 1. Designing and implementing your AWS infrastructure beyond the Reference Architecture. - 1. Understanding and awareness of AWS resource costs for all infrastructure deployed into your AWS accounts ([Knowledge Base #307](https://github.com/gruntwork-io/knowledge-base/discussions/307) for Ref Arch baseline). - 1. Once deployed, maintaining the Reference Architecture to keep it secure and up to date. - 1. Keeping the Reference Architecture secure in accordance with their company needs. - 1. Understanding and accepting the security implications of any changes made to the Reference Architecture. - 1. Monitoring Gruntwork repositories for updates and new releases and applying them as appropriate. - 1. Maintaining all compliance standards after the Reference Architecture has been delivered. +- Keeping the Reference Architecture secure in accordance with your company needs. +- Understanding and accepting the security implications of any changes your team makes to the Reference Architecture. +- Monitoring Gruntwork repositories for updates and new releases and applying them as appropriate. +- Maintaining all compliance standards after the Reference Architecture has been delivered. From 128e5318ee3cdbd82ca10215aa7944ec6ffd2ae0 Mon Sep 17 00:00:00 2001 From: Max Moon Date: Thu, 18 May 2023 12:30:08 -0700 Subject: [PATCH 50/89] Feat(CORE-940): add IAC getting started page (#790) * Feat: add IAC getting started pages --------- Co-authored-by: Zack Proser Co-authored-by: Ryan Russell --- .../iac/getting-started/accessing-the-code.md | 10 +- .../iac/getting-started/deploying-a-module.md | 258 ++++++++++++++++- .../iac/getting-started/setting-up.md | 34 ++- .../iac/getting-started/accessing-the-code.md | 12 +- .../iac/getting-started/deploying-a-module.md | 260 +++++++++++++++++- docs/iac/getting-started/setting-up.md | 36 ++- 6 files changed, 567 insertions(+), 43 deletions(-) diff --git a/_docs-sources/iac/getting-started/accessing-the-code.md b/_docs-sources/iac/getting-started/accessing-the-code.md index f8ea975682..6ee170b321 100644 --- a/_docs-sources/iac/getting-started/accessing-the-code.md +++ b/_docs-sources/iac/getting-started/accessing-the-code.md @@ -1,7 +1,11 @@ # Accessing the code -Gruntwork uses Github to host and share code with our customers. +Gruntwork provides all code included in your subscription to the Infrastructure as Code (IaC) library through GitHub. -## How to access the IaC library +To gain access to the IaC Library, link your GitHub ID to your account in the Developer Portal. Follow the steps outlined in the Developer Portal guide on [linking your Github ID](../../developer-portal/link-github-id). -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Volutpat diam ut venenatis tellus in metus vulputate eu. Massa sed elementum tempus egestas sed sed risus. Urna id volutpat lacus laoreet non curabitur gravida. Sed id semper risus in hendrerit. Orci dapibus ultrices in iaculis nunc sed. Sed cras ornare arcu dui vivamus. Sem nulla pharetra diam sit amet nisl suscipit. Elit pellentesque habitant morbi tristique senectus et netus et malesuada. Bibendum arcu vitae elementum curabitur. Amet nisl purus in mollis nunc sed id semper risus. Egestas purus viverra accumsan in nisl. Arcu non sodales neque sodales ut. Tincidunt eget nullam non nisi est sit amet facilisis magna. Porttitor massa id neque aliquam vestibulum morbi blandit cursus. Eu sem integer vitae justo eget. Sed libero enim sed faucibus. Proin sed libero enim sed faucibus turpis in. Vitae elementum curabitur vitae nunc sed velit dignissim sodales ut. Amet facilisis magna etiam tempor orci eu lobortis elementum nibh. +## Accessing Modules and Services in the IaC library + +Once you have gained access to the Gruntwork IaC library, you can view the source code for our modules and services in [Github](https://github.com/orgs/gruntwork-io/repositories). For a full list of modules and services, check the [Library Reference](../../iac/reference/index.md). + +In Github, each IaC repository is prefixed with `terraform-aws-` then a high level description of the modules it contains. For example, Amazon SNS, SQS, MSK, and Kinesis are located in the `terraform-aws-messaging` repository. In each repository, the modules are located in the `modules` directory. Example usage and tests are provided for each module in the `examples` and `tests` directories, respectively. diff --git a/_docs-sources/iac/getting-started/deploying-a-module.md b/_docs-sources/iac/getting-started/deploying-a-module.md index eb1991c873..e27dfe4d21 100644 --- a/_docs-sources/iac/getting-started/deploying-a-module.md +++ b/_docs-sources/iac/getting-started/deploying-a-module.md @@ -1,27 +1,257 @@ -# Deploy your first module +# Deploying your first module -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +[Modules](../whats-this/modules.md) allow you to define an interface to create one or many resources in the cloud or on-premise. Similar to how in object oriented programming you can define a class that may have different attribute values across many instances. -## Create a module +Modules help keep your Terraform code DRY (Don't Repeat Yourself), and speed up development time when creating new resources. -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Hac habitasse platea dictumst quisque sagittis purus sit. Eu scelerisque felis imperdiet proin fermentum leo vel orci porta. Ornare arcu dui vivamus arcu felis bibendum ut tristique et. Arcu ac tortor dignissim convallis aenean et. Augue interdum velit euismod in pellentesque massa placerat duis. Turpis tincidunt id aliquet risus feugiat in ante metus dictum. Vel pharetra vel turpis nunc eget. Ac turpis egestas sed tempus urna et. Scelerisque in dictum non consectetur. Nibh sit amet commodo nulla facilisi nullam vehicula ipsum a. Ornare aenean euismod elementum nisi quis eleifend quam adipiscing vitae. At varius vel pharetra vel turpis. Mattis ullamcorper velit sed ullamcorper morbi tincidunt ornare massa. +This tutorial will teach you how to develop a Terraform module that deploys an AWS Lambda function. We will create the required file structure, define an AWS Lambda function and AWS IAM role as code, then plan and apply the resource in an AWS account. Then, we’ll verify the deployment by invoking the Lambda using the AWS CLI. -## Run terraform plan +## Prerequisites +- An AWS account with permissions to create the necessary resources +- An [AWS Identity and Access Management](https://aws.amazon.com/iam/) (IAM) user or role with permissions to create AWS IAM roles and Lambda functions +- [AWS Command Line Interface](https://aws.amazon.com/cli/) (AWS CLI) installed on your local machine +- [Terraform](https://www.terraform.io) installed on your local machine -Lobortis feugiat vivamus at augue eget. Est placerat in egestas erat imperdiet sed euismod nisi porta. Volutpat maecenas volutpat blandit aliquam etiam erat. Vulputate mi sit amet mauris commodo quis imperdiet massa tincidunt. Nec tincidunt praesent semper feugiat. Accumsan sit amet nulla facilisi morbi. Euismod in pellentesque massa placerat duis ultricies. Amet aliquam id diam maecenas ultricies mi eget. Et tortor consequat id porta nibh venenatis cras sed felis. Lacus vel facilisis volutpat est velit egestas dui id. +## Create the module -## Run terraform apply +In this section you'll create a Terraform module that can create an AWS Lambda function and IAM role. This module will include three files - `main.tf` which will contain the resource definitions, `variables.tf`, which specifies the possible inputs to the module, and `outputs.tf`, which specifies the values that can be used to pass references to attributes from the resources in the module. -Tortor at risus viverra adipiscing. In hac habitasse platea dictumst quisque sagittis purus sit amet. Pretium viverra suspendisse potenti nullam ac tortor. Nulla facilisi etiam dignissim diam quis enim. Massa massa ultricies mi quis hendrerit dolor magna eget est. Tincidunt tortor aliquam nulla facilisi cras fermentum. Sollicitudin nibh sit amet commodo nulla facilisi nullam vehicula ipsum. Faucibus purus in massa tempor nec feugiat nisl pretium. Suspendisse sed nisi lacus sed viverra tellus in hac habitasse. Fermentum leo vel orci porta non pulvinar neque laoreet suspendisse. At auctor urna nunc id cursus metus aliquam eleifend mi. Condimentum mattis pellentesque id nibh tortor. Enim neque volutpat ac tincidunt vitae semper quis. Lobortis feugiat vivamus at augue eget arcu dictum varius duis. Tellus in metus vulputate eu scelerisque felis imperdiet. Sed arcu non odio euismod lacinia at quis. +This module could be referenced many times to create any number of AWS Lambda functions and IAM roles. -## Curl the endpoint -Congue quisque egestas diam in arcu. Faucibus a pellentesque sit amet porttitor. Placerat in egestas erat imperdiet sed euismod. Duis convallis convallis tellus id interdum velit. Congue eu consequat ac felis. Eu nisl nunc mi ipsum faucibus vitae aliquet. In hendrerit gravida rutrum quisque non. Dui ut ornare lectus sit. Phasellus vestibulum lorem sed risus ultricies tristique nulla aliquet enim. At imperdiet dui accumsan sit amet nulla facilisi morbi tempus. Viverra aliquet eget sit amet tellus cras adipiscing. Dolor sit amet consectetur adipiscing elit duis tristique sollicitudin. Ut pharetra sit amet aliquam id diam maecenas ultricies mi. Nullam vehicula ipsum a arcu cursus. +### Create a basic file structure +First, create the directories and files that will contain the Terraform configuration. -## Tear it down +```sh +mkdir -p terraform-aws-gw-lambda-tutorial/modules/lambda +touch terraform-aws-gw-lambda-tutorial/modules/lambda/main.tf +touch terraform-aws-gw-lambda-tutorial/modules/lambda/variables.tf +touch terraform-aws-gw-lambda-tutorial/modules/lambda/outputs.tf +``` -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +### Define the module resources -## You did it! +First, define the resources that should be created by the module. This is where you define resource level blocks provided by Terraform. For this module, we need an AWS Lambda function and an IAM role that will be used by the Lambda function. -I am calling you to action! +Paste the following snippet in `terraform-aws-gw-lambda/modules/lambda/main.tf`. +```hcl +resource "aws_iam_role" "lambda_role" { + name = "${var.lambda_name}-role" + + assume_role_policy = < diff --git a/docs/iac/getting-started/deploying-a-module.md b/docs/iac/getting-started/deploying-a-module.md index c67e59c97c..a98cb1bf49 100644 --- a/docs/iac/getting-started/deploying-a-module.md +++ b/docs/iac/getting-started/deploying-a-module.md @@ -1,35 +1,265 @@ -# Deploy your first module +# Deploying your first module -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +[Modules](../whats-this/modules.md) allow you to define an interface to create one or many resources in the cloud or on-premise. Similar to how in object oriented programming you can define a class that may have different attribute values across many instances. -## Create a module +Modules help keep your Terraform code DRY (Don't Repeat Yourself), and speed up development time when creating new resources. -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Hac habitasse platea dictumst quisque sagittis purus sit. Eu scelerisque felis imperdiet proin fermentum leo vel orci porta. Ornare arcu dui vivamus arcu felis bibendum ut tristique et. Arcu ac tortor dignissim convallis aenean et. Augue interdum velit euismod in pellentesque massa placerat duis. Turpis tincidunt id aliquet risus feugiat in ante metus dictum. Vel pharetra vel turpis nunc eget. Ac turpis egestas sed tempus urna et. Scelerisque in dictum non consectetur. Nibh sit amet commodo nulla facilisi nullam vehicula ipsum a. Ornare aenean euismod elementum nisi quis eleifend quam adipiscing vitae. At varius vel pharetra vel turpis. Mattis ullamcorper velit sed ullamcorper morbi tincidunt ornare massa. +This tutorial will teach you how to develop a Terraform module that deploys an AWS Lambda function. We will create the required file structure, define an AWS Lambda function and AWS IAM role as code, then plan and apply the resource in an AWS account. Then, we’ll verify the deployment by invoking the Lambda using the AWS CLI. -## Run terraform plan +## Prerequisites +- An AWS account with permissions to create the necessary resources +- An [AWS Identity and Access Management](https://aws.amazon.com/iam/) (IAM) user or role with permissions to create AWS IAM roles and Lambda functions +- [AWS Command Line Interface](https://aws.amazon.com/cli/) (AWS CLI) installed on your local machine +- [Terraform](https://www.terraform.io) installed on your local machine -Lobortis feugiat vivamus at augue eget. Est placerat in egestas erat imperdiet sed euismod nisi porta. Volutpat maecenas volutpat blandit aliquam etiam erat. Vulputate mi sit amet mauris commodo quis imperdiet massa tincidunt. Nec tincidunt praesent semper feugiat. Accumsan sit amet nulla facilisi morbi. Euismod in pellentesque massa placerat duis ultricies. Amet aliquam id diam maecenas ultricies mi eget. Et tortor consequat id porta nibh venenatis cras sed felis. Lacus vel facilisis volutpat est velit egestas dui id. +## Create the module -## Run terraform apply +In this section you'll create a Terraform module that can create an AWS Lambda function and IAM role. This module will include three files - `main.tf` which will contain the resource definitions, `variables.tf`, which specifies the possible inputs to the module, and `outputs.tf`, which specifies the values that can be used to pass references to attributes from the resources in the module. -Tortor at risus viverra adipiscing. In hac habitasse platea dictumst quisque sagittis purus sit amet. Pretium viverra suspendisse potenti nullam ac tortor. Nulla facilisi etiam dignissim diam quis enim. Massa massa ultricies mi quis hendrerit dolor magna eget est. Tincidunt tortor aliquam nulla facilisi cras fermentum. Sollicitudin nibh sit amet commodo nulla facilisi nullam vehicula ipsum. Faucibus purus in massa tempor nec feugiat nisl pretium. Suspendisse sed nisi lacus sed viverra tellus in hac habitasse. Fermentum leo vel orci porta non pulvinar neque laoreet suspendisse. At auctor urna nunc id cursus metus aliquam eleifend mi. Condimentum mattis pellentesque id nibh tortor. Enim neque volutpat ac tincidunt vitae semper quis. Lobortis feugiat vivamus at augue eget arcu dictum varius duis. Tellus in metus vulputate eu scelerisque felis imperdiet. Sed arcu non odio euismod lacinia at quis. +This module could be referenced many times to create any number of AWS Lambda functions and IAM roles. -## Curl the endpoint -Congue quisque egestas diam in arcu. Faucibus a pellentesque sit amet porttitor. Placerat in egestas erat imperdiet sed euismod. Duis convallis convallis tellus id interdum velit. Congue eu consequat ac felis. Eu nisl nunc mi ipsum faucibus vitae aliquet. In hendrerit gravida rutrum quisque non. Dui ut ornare lectus sit. Phasellus vestibulum lorem sed risus ultricies tristique nulla aliquet enim. At imperdiet dui accumsan sit amet nulla facilisi morbi tempus. Viverra aliquet eget sit amet tellus cras adipiscing. Dolor sit amet consectetur adipiscing elit duis tristique sollicitudin. Ut pharetra sit amet aliquam id diam maecenas ultricies mi. Nullam vehicula ipsum a arcu cursus. +### Create a basic file structure +First, create the directories and files that will contain the Terraform configuration. -## Tear it down +```sh +mkdir -p terraform-aws-gw-lambda-tutorial/modules/lambda +touch terraform-aws-gw-lambda-tutorial/modules/lambda/main.tf +touch terraform-aws-gw-lambda-tutorial/modules/lambda/variables.tf +touch terraform-aws-gw-lambda-tutorial/modules/lambda/outputs.tf +``` -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +### Define the module resources -## You did it! +First, define the resources that should be created by the module. This is where you define resource level blocks provided by Terraform. For this module, we need an AWS Lambda function and an IAM role that will be used by the Lambda function. -I am calling you to action! +Paste the following snippet in `terraform-aws-gw-lambda/modules/lambda/main.tf`. +```hcl +resource "aws_iam_role" "lambda_role" { + name = "${var.lambda_name}-role" + + assume_role_policy = < diff --git a/docs/iac/getting-started/setting-up.md b/docs/iac/getting-started/setting-up.md index ad56b149ee..1cb7fc796d 100644 --- a/docs/iac/getting-started/setting-up.md +++ b/docs/iac/getting-started/setting-up.md @@ -1,19 +1,47 @@ # Setting up your machine -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Mauris in aliquam sem fringilla ut morbi tincidunt augue interdum. Enim nunc faucibus a pellentesque sit amet porttitor eget. Dui nunc mattis enim ut. Aliquet sagittis id consectetur purus ut faucibus pulvinar. In cursus turpis massa tincidunt dui ut ornare lectus sit. Amet nisl purus in mollis nunc sed. Pharetra vel turpis nunc eget lorem dolor sed. Mauris ultrices eros in cursus. Sed felis eget velit aliquet sagittis id consectetur purus. Sed euismod nisi porta lorem mollis aliquam. Velit euismod in pellentesque massa placerat duis ultricies lacus. +The Gruntwork IaC library requires that you have a few tools installed in order to leverage our pre-built modules and services. We recommend installing these tools locally so you can develop and deploy modules and services on your local machine. ## Terraform -You can use terraform +Terraform is an open source infrastructure provisioning tool that allows you to define and manage a wide variety of infrastructure (e.g., servers, load balancers, databases, network settings, and so on) as code across a wide variety of providers (e.g., AWS, GCP, Azure). Terraform defines cloud and on-premise resources in human-readable configuration language and offers a consistent workflow for provisioning and managing infrastructure. + +Gruntwork's IaC library is built using Terraform, so having Terraform installed is required. + +### Installation +Terraform is supported on Mac (x86 and Apple Silicon), Windows, and Linux. To learn how to install for your specific OS, follow the guide to [install Terraform](https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli#install-cli) on the Hashicorp website. + +If you need multiple versions of Terraform installed, [tfenv](https://github.com/tfutils/tfenv#installation) is a tool for managing and using multiple versions of Terraform. It was inspired by similar tools `rbenv` for Ruby versions and `pyenv` for Python. + +### Learn more +If you're new to Terraform, we recommend starting with learning about Terraform's [configuration language](https://developer.hashicorp.com/terraform/language) then familiarizing yourself with the basics of [provisioning infrastructure](https://developer.hashicorp.com/terraform/cli/run) using Terraform. + +If you want to skip immediately to learning, you can learn how to [deploy your first module](./deploying-a-module.md). For a more in-depth guide, check out our [Comprehensive Guide to Terraform](https://blog.gruntwork.io/a-comprehensive-guide-to-terraform-b3d32832baca) for a thorough introduction to the language. ## Terragrunt -You can use terragrunt, too! +Terragrunt is a thin wrapper that provides extra tools for keeping your configurations DRY, working with multiple Terraform modules, and managing remote state. Terragrunt allows you to execute multiple Terraform commands at once, centrally manage your Terraform state configuration, and set repeatable CLI arguments. Since Terraform is a dependency of Terragrunt, you can continue to write modules for Terraform in the Terraform configuration language, then reference and re-use the modules in different environments or applications. + +Terragrunt is not a required tool, but it does provide many convenience features on top of Terraform. + +### Installation +Terragrunt is supported on Mac (x86 and Apple Silicon), Windows, and Linux. To install Terragrunt, follow the guide on how to [install Terragrunt](https://terragrunt.gruntwork.io/docs/getting-started/install/) on the Terragrunt website. + +If you need multiple versions of Terragrunt installed, [tgswitch](https://github.com/warrensbox/tgswitch#installation) is a tool for managing and using multiple versions of Terragrunt with a similar feature set to `tfenv`. + +### Learn more +To learn more about Terragrunt, check out the [official documentation](https://terragrunt.gruntwork.io/docs/). + +## What's Next + +Now that you've got the required tools installed, you'll learn how to [access the IaC Library code](./accessing-the-code.md). + +If you're ready to get started with creating and deploying a module, jump to [deploying your first module](./deploying-a-module.md). From e335af03ba85f4b86e3a3737ddade4d999cce4c2 Mon Sep 17 00:00:00 2001 From: Max Moon Date: Thu, 18 May 2023 12:31:47 -0700 Subject: [PATCH 51/89] Feat(CORE-942): Add staying up to date docs for IaC library (#791) * Feat(CORE-942): Add staying up to date docs for IaC library --------- Co-authored-by: Zack Proser Co-authored-by: docs-sourcer[bot] <99042413+docs-sourcer[bot]@users.noreply.github.com> --- _docs-sources/iac/stay-up-to-date/updating.md | 38 +++++++++++++++ .../iac/stay-up-to-date/versioning.md | 34 ++++++++++++++ _docs-sources/iac/usage/updating.md | 8 ---- _docs-sources/iac/usage/versioning.md | 3 -- docs/iac/stay-up-to-date/updating.md | 46 +++++++++++++++++++ docs/iac/stay-up-to-date/versioning.md | 42 +++++++++++++++++ docs/iac/usage/updating.md | 16 ------- docs/iac/usage/versioning.md | 11 ----- sidebars/iac.js | 5 +- 9 files changed, 164 insertions(+), 39 deletions(-) create mode 100644 _docs-sources/iac/stay-up-to-date/updating.md create mode 100644 _docs-sources/iac/stay-up-to-date/versioning.md delete mode 100644 _docs-sources/iac/usage/updating.md delete mode 100644 _docs-sources/iac/usage/versioning.md create mode 100644 docs/iac/stay-up-to-date/updating.md create mode 100644 docs/iac/stay-up-to-date/versioning.md delete mode 100644 docs/iac/usage/updating.md delete mode 100644 docs/iac/usage/versioning.md diff --git a/_docs-sources/iac/stay-up-to-date/updating.md b/_docs-sources/iac/stay-up-to-date/updating.md new file mode 100644 index 0000000000..b961170fad --- /dev/null +++ b/_docs-sources/iac/stay-up-to-date/updating.md @@ -0,0 +1,38 @@ +# Updating + +Updating a module or service requires changing the tagged version in the `source` attribute of the module block. + +For backwards compatible changes, this is as simple as incrementing the version number. For backwards incompatible changes, refer to the release notes for a migration guide in each module's Github repository release page. + +We recommend updating module versions in your development environment first, followed by staging, then production, to ensure that the update and any required changes are well understood. + +## Example: Update a version + +Below is a module block referencing version `0.15.3` of the `single-server` submodule from the `terraform-aws-server` module. + +To update to version version `0.15.4`, you update the value to the right of `ref=` in the source attribute. Since the version number denotes that this update is backwards compatible, it should not require any other changes. + +```tf +module "my_instance" { + # Old + # source = "git::git@github.com:gruntwork-io/terraform-aws-server.git//modules/single-server?ref=v0.15.3" + # New + source = "git::git@github.com:gruntwork-io/terraform-aws-server.git//modules/single-server?ref=v0.15.4" + + name = "my_instance" + ami = "ami-123456" + instance_type = "t2.medium" + keypair_name = "my-keypair" + user_data = "${var.user_data}" + + vpc_id = "${var.vpc_id}" + subnet_id = "${var.subnet_id}" +} +``` + +After making the change, run `terraform plan`, inspect the output to ensure it looks as you expect, then run `terraform apply`. + +## Patcher + +Keeping track of all references to modules and services is a complicated, error prone task. To solve this problem, Gruntwork developed [Patcher](https://gruntwork.io/patcher), which shows the version of a module you are using, the latest version available, and the changelog for the module. If you're interested in trying out Patcher, [request early access](https://gruntwork.io/early-access)! + diff --git a/_docs-sources/iac/stay-up-to-date/versioning.md b/_docs-sources/iac/stay-up-to-date/versioning.md new file mode 100644 index 0000000000..5798549655 --- /dev/null +++ b/_docs-sources/iac/stay-up-to-date/versioning.md @@ -0,0 +1,34 @@ +# Versioning + +Gruntwork versions the IaC library using [Semantic Versioning](https://semver.org/) (SemVer). Since much of the Gruntwork IaC Library is still pre-1.0.0, most of the Gruntwork IaC Library uses 0.MINOR.PATCH version numbers. With 0.MINOR.PATCH, the rules are a bit different, where we increment the: + +- MINOR version when you make backward incompatible API changes, and +- PATCH version when you add backward compatible functionality or bug fixes. + +For modules that have submodules (e.g., terraform-aws-server/modules/single-server), not every release contains changes to every module. While using the latest available version is recommended, the version that most recently contains changes for a module can be found in each submodule's reference in the [Library Reference](../reference/index.md). + +New module versions are released by creating a release on Github. When a new version is created, refer to the release notes in the Github repository release page for a list of changes and migration guides (when necessary). + +## Example: Reference a version + +The git tag created by the release can then be referenced in the source argument for a module block sourcing from a git URL. + +For example, below is a module block referencing version `0.15.4` of the `single-server` submodule from the `terraform-aws-server` module. +```tf +module "my_instance" { + source = "git::git@github.com:gruntwork-io/terraform-aws-server.git//modules/single-server?ref=v0.15.4" + + name = "my_instance" + ami = "ami-123456" + instance_type = "t2.medium" + keypair_name = "my-keypair" + user_data = "${var.user_data}" + + vpc_id = "${var.vpc_id}" + subnet_id = "${var.subnet_id}" +} +``` + +## What's next + +Once you start using versioned modules, it's important to keep the modules up to date. Refer to the [Updating](./updating.md) guide to learn more. diff --git a/_docs-sources/iac/usage/updating.md b/_docs-sources/iac/usage/updating.md deleted file mode 100644 index e1c0da1f04..0000000000 --- a/_docs-sources/iac/usage/updating.md +++ /dev/null @@ -1,8 +0,0 @@ -# Updating - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Morbi blandit cursus risus at ultrices mi tempus imperdiet nulla. Augue interdum velit euismod in pellentesque massa placerat. - -## Patcher - -Checkout [Patcher](https://docs.gruntwork.io/guides/stay-up-to-date/patcher) you cool cat! - diff --git a/_docs-sources/iac/usage/versioning.md b/_docs-sources/iac/usage/versioning.md deleted file mode 100644 index d473fa7216..0000000000 --- a/_docs-sources/iac/usage/versioning.md +++ /dev/null @@ -1,3 +0,0 @@ -# Versioning - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. diff --git a/docs/iac/stay-up-to-date/updating.md b/docs/iac/stay-up-to-date/updating.md new file mode 100644 index 0000000000..bd09161552 --- /dev/null +++ b/docs/iac/stay-up-to-date/updating.md @@ -0,0 +1,46 @@ +# Updating + +Updating a module or service requires changing the tagged version in the `source` attribute of the module block. + +For backwards compatible changes, this is as simple as incrementing the version number. For backwards incompatible changes, refer to the release notes for a migration guide in each module's Github repository release page. + +We recommend updating module versions in your development environment first, followed by staging, then production, to ensure that the update and any required changes are well understood. + +## Example: Update a version + +Below is a module block referencing version `0.15.3` of the `single-server` submodule from the `terraform-aws-server` module. + +To update to version version `0.15.4`, you update the value to the right of `ref=` in the source attribute. Since the version number denotes that this update is backwards compatible, it should not require any other changes. + +```tf +module "my_instance" { + # Old + # source = "git::git@github.com:gruntwork-io/terraform-aws-server.git//modules/single-server?ref=v0.15.3" + # New + source = "git::git@github.com:gruntwork-io/terraform-aws-server.git//modules/single-server?ref=v0.15.4" + + name = "my_instance" + ami = "ami-123456" + instance_type = "t2.medium" + keypair_name = "my-keypair" + user_data = "${var.user_data}" + + vpc_id = "${var.vpc_id}" + subnet_id = "${var.subnet_id}" +} +``` + +After making the change, run `terraform plan`, inspect the output to ensure it looks as you expect, then run `terraform apply`. + +## Patcher + +Keeping track of all references to modules and services is a complicated, error prone task. To solve this problem, Gruntwork developed [Patcher](https://gruntwork.io/patcher), which shows the version of a module you are using, the latest version available, and the changelog for the module. If you're interested in trying out Patcher, [request early access](https://gruntwork.io/early-access)! + + + + diff --git a/docs/iac/stay-up-to-date/versioning.md b/docs/iac/stay-up-to-date/versioning.md new file mode 100644 index 0000000000..ba89804dd8 --- /dev/null +++ b/docs/iac/stay-up-to-date/versioning.md @@ -0,0 +1,42 @@ +# Versioning + +Gruntwork versions the IaC library using [Semantic Versioning](https://semver.org/) (SemVer). Since much of the Gruntwork IaC Library is still pre-1.0.0, most of the Gruntwork IaC Library uses 0.MINOR.PATCH version numbers. With 0.MINOR.PATCH, the rules are a bit different, where we increment the: + +- MINOR version when you make backward incompatible API changes, and +- PATCH version when you add backward compatible functionality or bug fixes. + +For modules that have submodules (e.g., terraform-aws-server/modules/single-server), not every release contains changes to every module. While using the latest available version is recommended, the version that most recently contains changes for a module can be found in each submodule's reference in the [Library Reference](../reference/index.md). + +New module versions are released by creating a release on Github. When a new version is created, refer to the release notes in the Github repository release page for a list of changes and migration guides (when necessary). + +## Example: Reference a version + +The git tag created by the release can then be referenced in the source argument for a module block sourcing from a git URL. + +For example, below is a module block referencing version `0.15.4` of the `single-server` submodule from the `terraform-aws-server` module. +```tf +module "my_instance" { + source = "git::git@github.com:gruntwork-io/terraform-aws-server.git//modules/single-server?ref=v0.15.4" + + name = "my_instance" + ami = "ami-123456" + instance_type = "t2.medium" + keypair_name = "my-keypair" + user_data = "${var.user_data}" + + vpc_id = "${var.vpc_id}" + subnet_id = "${var.subnet_id}" +} +``` + +## What's next + +Once you start using versioned modules, it's important to keep the modules up to date. Refer to the [Updating](./updating.md) guide to learn more. + + + diff --git a/docs/iac/usage/updating.md b/docs/iac/usage/updating.md deleted file mode 100644 index 7cf27649ec..0000000000 --- a/docs/iac/usage/updating.md +++ /dev/null @@ -1,16 +0,0 @@ -# Updating - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Morbi blandit cursus risus at ultrices mi tempus imperdiet nulla. Augue interdum velit euismod in pellentesque massa placerat. - -## Patcher - -Checkout [Patcher](https://docs.gruntwork.io/guides/stay-up-to-date/patcher) you cool cat! - - - - diff --git a/docs/iac/usage/versioning.md b/docs/iac/usage/versioning.md deleted file mode 100644 index 78ee4aa728..0000000000 --- a/docs/iac/usage/versioning.md +++ /dev/null @@ -1,11 +0,0 @@ -# Versioning - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. - - - diff --git a/sidebars/iac.js b/sidebars/iac.js index 2c84417515..fd386acd0c 100644 --- a/sidebars/iac.js +++ b/sidebars/iac.js @@ -40,7 +40,10 @@ const sidebar = [ label: "Staying up to date", type: "category", collapsible: false, - items: ["iac/usage/versioning", "iac/usage/updating"], + items: [ + "iac/stay-up-to-date/versioning", + "iac/stay-up-to-date/updating", + ], }, { label: "Support", From c959289d6a43a563194687855e4f1057b9c17b9e Mon Sep 17 00:00:00 2001 From: Oreoluwa Agunbiade <21035422+oredavids@users.noreply.github.com> Date: Thu, 18 May 2023 14:48:11 -0600 Subject: [PATCH 52/89] Add FAQ link to developer portal sidebar (#800) --- .../developer-portal/link-github-id.md | 17 +++++------------ docs/developer-portal/link-github-id.md | 19 ++++++------------- sidebars/developer-portal.js | 9 +++++++++ 3 files changed, 20 insertions(+), 25 deletions(-) diff --git a/_docs-sources/developer-portal/link-github-id.md b/_docs-sources/developer-portal/link-github-id.md index 31f9435ba7..ec520bafcf 100644 --- a/_docs-sources/developer-portal/link-github-id.md +++ b/_docs-sources/developer-portal/link-github-id.md @@ -1,8 +1,6 @@ -# Link Your GitHub ID +# Link Your GitHub Account -Gruntwork provides all code included in your subscription through GitHub. You’ll need to link a GitHub ID to your account in order to access the IaC Library on GitHub. Follow the steps below to link your GitHub ID. - -## Linking your GitHub account +Gruntwork provides all code included in your subscription through GitHub. You need to link a GitHub ID to your Gruntwork Developer Portal account in order to access the IaC Library on GitHub. Follow the steps below to link your GitHub ID. 1. First, sign in to the [Gruntwork Developer Portal](https://app.gruntwork.io). 2. Click the **Link my GitHub Account** button in the notice at the top of the home page, or the corresponding button located in your [Profile Settings](https://app.gruntwork.io/settings/profile). @@ -10,13 +8,8 @@ Gruntwork provides all code included in your subscription through GitHub. You’ 4. After being redirected back to the Gruntwork Developer Portal, click the **Accept My Invite** button. This will take you to GitHub again, where you can accept an invitation to join the Gruntwork organization. (You can ignore the corresponding invite email you receive from GitHub.) 5. Click **Join Gruntwork** to accept the invitation and access the IaC Library. -Once you’ve linked your account, the notice on the home page will disappear and you’ll find your GitHub ID recorded in your [Profile Settings](https://app.gruntwork.io/settings/profile). Going forward, you’ll have access to all private repositories included in your subscription. If you haven’t yet done so, we strongly recommend [adding an SSH key](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent) to your GitHub account. An SSH key is required to access the Gruntwork IaC library without adding a password in your Terraform code. - -## Linking a new GitHub account +:::info -To link a new GitHub ID, you’ll first have to unlink the current one. Although uncommon, note that any private forks of Gruntwork repos will be deleted when you unlink your account. +Once you’ve linked your account, the notice on the home page will disappear and you’ll find your GitHub ID recorded in your [Profile Settings](https://app.gruntwork.io/settings/profile). Going forward, you’ll have access to all private repositories included in your subscription. If you haven’t done so yet, we strongly recommend [adding an SSH key](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent) to your GitHub account. An SSH key is required to access the Gruntwork IaC library without adding a password in your Terraform code. -1. Sign in to the Gruntwork Developer Portal and navigate to your [Profile Settings](https://app.gruntwork.io/settings/profile). -2. Click **Unlink** in the description under the **GitHub Account** section. -3. Click **Yes, Unlink My Account** in the confirmation dialog that appears. -4. Proceed with the [steps above](#linking-your-github-account) to link a new GitHub account *using a private/incognito browser window*. (This guarantees you’ll have an opportunity to specify the new account you wish to link.) +::: diff --git a/docs/developer-portal/link-github-id.md b/docs/developer-portal/link-github-id.md index 7b2d228a84..344a9a22dc 100644 --- a/docs/developer-portal/link-github-id.md +++ b/docs/developer-portal/link-github-id.md @@ -1,8 +1,6 @@ -# Link Your GitHub ID +# Link Your GitHub Account -Gruntwork provides all code included in your subscription through GitHub. You’ll need to link a GitHub ID to your account in order to access the IaC Library on GitHub. Follow the steps below to link your GitHub ID. - -## Linking your GitHub account +Gruntwork provides all code included in your subscription through GitHub. You need to link a GitHub ID to your Gruntwork Developer Portal account in order to access the IaC Library on GitHub. Follow the steps below to link your GitHub ID. 1. First, sign in to the [Gruntwork Developer Portal](https://app.gruntwork.io). 2. Click the **Link my GitHub Account** button in the notice at the top of the home page, or the corresponding button located in your [Profile Settings](https://app.gruntwork.io/settings/profile). @@ -10,21 +8,16 @@ Gruntwork provides all code included in your subscription through GitHub. You’ 4. After being redirected back to the Gruntwork Developer Portal, click the **Accept My Invite** button. This will take you to GitHub again, where you can accept an invitation to join the Gruntwork organization. (You can ignore the corresponding invite email you receive from GitHub.) 5. Click **Join Gruntwork** to accept the invitation and access the IaC Library. -Once you’ve linked your account, the notice on the home page will disappear and you’ll find your GitHub ID recorded in your [Profile Settings](https://app.gruntwork.io/settings/profile). Going forward, you’ll have access to all private repositories included in your subscription. If you haven’t yet done so, we strongly recommend [adding an SSH key](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent) to your GitHub account. An SSH key is required to access the Gruntwork IaC library without adding a password in your Terraform code. - -## Linking a new GitHub account +:::info -To link a new GitHub ID, you’ll first have to unlink the current one. Although uncommon, note that any private forks of Gruntwork repos will be deleted when you unlink your account. +Once you’ve linked your account, the notice on the home page will disappear and you’ll find your GitHub ID recorded in your [Profile Settings](https://app.gruntwork.io/settings/profile). Going forward, you’ll have access to all private repositories included in your subscription. If you haven’t done so yet, we strongly recommend [adding an SSH key](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent) to your GitHub account. An SSH key is required to access the Gruntwork IaC library without adding a password in your Terraform code. -1. Sign in to the Gruntwork Developer Portal and navigate to your [Profile Settings](https://app.gruntwork.io/settings/profile). -2. Click **Unlink** in the description under the **GitHub Account** section. -3. Click **Yes, Unlink My Account** in the confirmation dialog that appears. -4. Proceed with the [steps above](#linking-your-github-account) to link a new GitHub account *using a private/incognito browser window*. (This guarantees you’ll have an opportunity to specify the new account you wish to link.) +::: diff --git a/sidebars/developer-portal.js b/sidebars/developer-portal.js index b56b6a1120..c9a994cf6b 100644 --- a/sidebars/developer-portal.js +++ b/sidebars/developer-portal.js @@ -1,3 +1,7 @@ +const developerPortalKnowledgeBaseDiscussions = + "https://github.com/orgs/gruntwork-io/discussions?" + + encodeURIComponent("discussions_q=label:s:dev-portal") + const sidebar = [ { label: "Developer Portal", @@ -7,6 +11,11 @@ const sidebar = [ "developer-portal/create-account", "developer-portal/invite-team", "developer-portal/link-github-id", + { + type: "link", + label: "FAQ", + href: developerPortalKnowledgeBaseDiscussions, + }, ], }, ] From 8eb562688440b4740b54796e13554a36890680a4 Mon Sep 17 00:00:00 2001 From: Ryan Russell Date: Mon, 22 May 2023 09:59:43 -0700 Subject: [PATCH 53/89] Add IaC Overview Pages - CORE-908 (#792) --- _docs-sources/iac/whats-this/index.md | 26 ++++++++++++++++-- _docs-sources/iac/whats-this/modules.md | 22 +++++++++++---- _docs-sources/iac/whats-this/services.md | 34 +++++++++++++++++++---- docs/iac/whats-this/index.md | 26 ++++++++++++++++-- docs/iac/whats-this/modules.md | 21 ++++++++++---- docs/iac/whats-this/services.md | 35 ++++++++++++++++++++---- 6 files changed, 137 insertions(+), 27 deletions(-) diff --git a/_docs-sources/iac/whats-this/index.md b/_docs-sources/iac/whats-this/index.md index f42d600648..4f53c423c1 100644 --- a/_docs-sources/iac/whats-this/index.md +++ b/_docs-sources/iac/whats-this/index.md @@ -1,5 +1,27 @@ # What is the Infrastructure as Code Library? -Qu'est-ce que c'est? +The Gruntwork Infrastructure as Code Library (IaC Library) is a collection of reusable code that enables you to deploy and manage infrastructure quickly and reliably. It promotes code reusability, modularity, and consistency in infrastructure deployments. We've taken the thousands of hours we spent building infrastructure on AWS and condensed all that experience and code into pre-built packages or modules. -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Morbi leo urna molestie at. Volutpat blandit aliquam etiam erat. In massa tempor nec feugiat nisl pretium. Vitae auctor eu augue ut lectus arcu bibendum at. Auctor augue mauris augue neque gravida. Vulputate sapien nec sagittis aliquam malesuada bibendum arcu. Bibendum est ultricies integer quis auctor elit. Morbi tincidunt augue interdum velit euismod in pellentesque. Imperdiet proin fermentum leo vel orci porta non pulvinar neque. Felis bibendum ut tristique et egestas quis ipsum. In arcu cursus euismod quis viverra nibh cras pulvinar mattis. Massa massa ultricies mi quis hendrerit dolor. Vel pharetra vel turpis nunc eget lorem. Tortor consequat id porta nibh venenatis cras. Nunc pulvinar sapien et ligula ullamcorper. Vehicula ipsum a arcu cursus vitae congue mauris rhoncus. Sit amet porttitor eget dolor morbi non. +The library consists of two types of code: Modules & Services + +## Modules + +Modules are reusable code components that are used to deploy and manage specific pieces of infrastructure. These modules encapsulate the configuration and resource definitions required to create and manage a particular component, such as a VPC, ECS cluster, or an Auto Scaling Group. For more information on modules check out the [Modules page](/iac/whats-this/modules/). + +## Services + +Services in the service catalog are reusable code that combines multiple modules from the IaC Library, simplifying the deployment and management of complex infrastructure configurations. Rather than dealing with individual modules and their dependencies, users can directly deploy services tailored for a particular use case. + +For more information on the service catalog check out the [Services page](/iac/whats-this/services/). + +## Tools used in the IaC Library + +The Gruntwork IaC Library is deployed using the following tools: + +1. [Terraform](https://www.terraform.io/). Used to define and manage most of the basic infrastructure, such as servers, databases, load balancers, and networking. The Gruntwork Service Catalog is compatible with vanilla [Terraform](https://www.terraform.io/), [Terragrunt](https://terragrunt.gruntwork.io/), [Terraform + Cloud](https://www.hashicorp.com/blog/announcing-terraform-cloud/), and [Terraform + Enterprise](https://www.terraform.io/docs/enterprise/index.html). + +1. [Packer](https://www.packer.io/). Used to define and manage _machine images_ (e.g., VM images). The main use case is + to package code as [Amazon Machine Images (AMIs)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html) + that run on EC2 instances. Once you've built an AMI, you use Terraform to deploy it into AWS. diff --git a/_docs-sources/iac/whats-this/modules.md b/_docs-sources/iac/whats-this/modules.md index 70de7d020e..ac0f59797c 100644 --- a/_docs-sources/iac/whats-this/modules.md +++ b/_docs-sources/iac/whats-this/modules.md @@ -1,11 +1,23 @@ # What is a Module? -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Est placerat in egestas erat imperdiet sed. Velit dignissim sodales ut eu sem integer vitae. Mattis rhoncus urna neque viverra. Massa placerat duis ultricies lacus sed turpis tincidunt id. Posuere sollicitudin aliquam ultrices sagittis orci. Egestas quis ipsum suspendisse ultrices gravida dictum fusce ut placerat. Tristique senectus et netus et malesuada. Ipsum dolor sit amet consectetur adipiscing elit pellentesque. Enim nunc faucibus a pellentesque sit amet porttitor eget dolor. Eget nunc lobortis mattis aliquam faucibus purus in. Vulputate dignissim suspendisse in est ante in nibh mauris. Morbi non arcu risus quis varius quam. Cras adipiscing enim eu turpis egestas pretium. Donec enim diam vulputate ut. Ut tortor pretium viverra suspendisse potenti nullam. Euismod elementum nisi quis eleifend quam adipiscing vitae proin sagittis. Sed nisi lacus sed viverra tellus. Laoreet id donec ultrices tincidunt arcu non sodales neque. +Modules are reusable code components that encapsulate the configuration and resource definitions needed to deploy and manage a specific piece of infrastructure, such as a VPC, ECS cluster, or Auto Scaling Group. Each module defines several AWS resources. For example, the VPC module contains resource definitions for subnets, nat gateways, and more. Modules promote code reusability, modularity, and consistency in infrastructure deployments and can be customized in a variety of ways. -## Whats a Module - -It's a bunch of code, ya silly! +Gruntwork modules are tested in AWS, in a randomly selected region, each time it changes to verify the infrastructure created matches the desired configuration. ## When do you use a Module? -When you feel like it, ya dingus! +The Gruntwork Infrastructure as Code (IaC) Library contains hundreds of modules that you can use and combine. These modules are fairly generic building blocks, so you don't typically deploy a single module directly. Instead, you write code that combines the modules you need for a specific use case. + +For example, one module might deploy the control plane for Kubernetes and a separate module could deploy worker nodes; you may need to combine both modules together to deploy a Kubernetes cluster, or use the `eks-cluster` service from the [Service Catalog](/iac/whats-this/services/). + +For a full list of modules available, refer to the [Gruntwork Infrastructure as Code Library](https://gruntwork.io/infrastructure-as-code-library/). + +## How to navigate modules in the IaC Library + +The code in the module repos are organized into three primary folders: + +1. `modules`: The core implementation code. All of the modules that you will use and deploy are defined within. For example to ECS cluster module in the `terraform-aws-ecs` repo in `modules/ecs-cluster`. + +1. `examples`: Sample code that shows how to use the modules in the `modules` folder and allows you to try them out without having to write any code: `cd` into one of the folders, follow a few steps in the README (e.g. run `terraform apply`), and you'll have a fully working module up and running. In other words, this is executable documentation. + +1. `test`: Automated tests for the code in modules and examples. \ No newline at end of file diff --git a/_docs-sources/iac/whats-this/services.md b/_docs-sources/iac/whats-this/services.md index 70d4e50358..39c39606a4 100644 --- a/_docs-sources/iac/whats-this/services.md +++ b/_docs-sources/iac/whats-this/services.md @@ -1,11 +1,35 @@ # What is a Service? -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Eu nisl nunc mi ipsum faucibus vitae aliquet. Cras adipiscing enim eu turpis egestas pretium aenean pharetra magna. Nam at lectus urna duis convallis convallis. Eget est lorem ipsum dolor sit amet consectetur adipiscing elit. Interdum varius sit amet mattis vulputate enim. Massa id neque aliquam vestibulum. Nunc sed augue lacus viverra vitae congue eu consequat ac. Volutpat ac tincidunt vitae semper. Placerat orci nulla pellentesque dignissim enim. Dui sapien eget mi proin sed libero enim sed. Sem viverra aliquet eget sit. Dis parturient montes nascetur ridiculus. Quam id leo in vitae. Tortor dignissim convallis aenean et tortor at risus viverra adipiscing. Elit eget gravida cum sociis natoque penatibus et. +The Gruntwork Service Catalog consists of a number of reusable, customizable, production-grade infrastructure-as-code services that you can use to deploy and manage your infrastructure. This includes Docker orchestration, EC2 orchestration, load balancing, networking, databases, caches, monitoring, alerting, CI/CD, secrets management, VPN, and much more. -## Whats a Service +## When do you use a Service? -It's a bunch of modules grouped into one REALLY BIG module +Services in the service catalog are reusable code that combines multiple modules. These are designed for specific use cases such as EKS and ECS clusters, VPCs with public and private subnets, and databases. Using a service can save you time piecing together individual modules and testing that they're correctly referencing each other. -## When do you use a Service? +For example, the `eks-cluster` service combines all the modules you need to run an EKS (Kubernetes) cluster in a typical production environment, including modules for the control plane, worker nodes, secrets management, log aggregation, alerting, and so on. + +## How to navigate services in the IaC Library + +The code in the `terraform-aws-service-catalog` repo is organized into three primary folders: + +1. `modules`: The core implementation code of this repo. All the services that you will use and deploy are defined within, such as the EKS cluster service in modules/services/eks-cluster. + +1. `examples`: Sample code that shows how to use the services in the modules folder and allows you to try the services out without having to write any code: you `cd` into one of the folders, follow a few steps in the README (e.g., run `terraform apply`), and you'll have fully working infrastructure up and running. In other words, this is executable documentation. Note that the examples folder contains two sub-folders: + + 1. `for-learning-and-testing`: Example code that is optimized for learning, experimenting, and testing, but not + direct production usage. Most of these examples use Terraform directly to make it easy to fill in dependencies + that are convenient for testing, but not necessarily those you'd use in production: e.g., default VPCs or mock + database URLs. + + 1. `for-production`: Example code optimized for direct usage in production. This is code from the [Gruntwork Reference + Architecture](https://gruntwork.io/reference-architecture/), and it shows you how we build an end-to-end, + integrated tech stack on top of the Gruntwork Service Catalog. To keep the code DRY and manage dependencies + between modules, the code is deployed using [Terragrunt](https://terragrunt.gruntwork.io/). However, Terragrunt + is NOT required to use the Gruntwork Service Catalog: you can alternatively use vanilla Terraform or Terraform + Cloud / Enterprise, as described [here](https://docs.gruntwork.io/reference/services/intro/deploy-new-infrastructure#how-to-deploy-terraform-code-from-the-service-catalog). + + 1. Not all modules have a `for-production` example, but you can still create a production-grade configuration by + using the template provided in this discussion question, [How do I use the modules in terraform-aws-service-catalog + if there is no example?](https://github.com/gruntwork-io/knowledge-base/discussions/360#discussioncomment-25705480). -When you feel like it, ya dingus! +1. `test`: Automated tests for the code in modules and examples. \ No newline at end of file diff --git a/docs/iac/whats-this/index.md b/docs/iac/whats-this/index.md index 3bcdd5d175..b7175bdbf4 100644 --- a/docs/iac/whats-this/index.md +++ b/docs/iac/whats-this/index.md @@ -1,13 +1,33 @@ # What is the Infrastructure as Code Library? -Qu'est-ce que c'est? +The Gruntwork Infrastructure as Code Library (IaC Library) is a collection of reusable code that enables you to deploy and manage infrastructure quickly and reliably. We've taken the thousands of hours we spent building infrastructure on AWS and condensed all that experience and code into pre-built packages or modules. -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Morbi leo urna molestie at. Volutpat blandit aliquam etiam erat. In massa tempor nec feugiat nisl pretium. Vitae auctor eu augue ut lectus arcu bibendum at. Auctor augue mauris augue neque gravida. Vulputate sapien nec sagittis aliquam malesuada bibendum arcu. Bibendum est ultricies integer quis auctor elit. Morbi tincidunt augue interdum velit euismod in pellentesque. Imperdiet proin fermentum leo vel orci porta non pulvinar neque. Felis bibendum ut tristique et egestas quis ipsum. In arcu cursus euismod quis viverra nibh cras pulvinar mattis. Massa massa ultricies mi quis hendrerit dolor. Vel pharetra vel turpis nunc eget lorem. Tortor consequat id porta nibh venenatis cras. Nunc pulvinar sapien et ligula ullamcorper. Vehicula ipsum a arcu cursus vitae congue mauris rhoncus. Sit amet porttitor eget dolor morbi non. +The library consists of two types of code: Modules & Services + +## Modules + +Modules are reusable code to deploy and manage one piece of infrastructure and each one is a battle-tested, best-practices definition of a piece of infrastructure, such as a VPC, ECS cluster, or an Auto Scaling Group. For more information on modules check out the [Modules page](/iac/whats-this/modules/) + +## Services + +Services in the service catalog are reusable code that combines multiple modules to configure a service for a specific use case. These are designed for specific use cases and meant to be deployed directly. For more information on the service catalog check out the [Services page](/iac/whats-this/services/) + +## The tools used in the IaC Library + +The Gruntwork IaC Library is designed to be deployed using the following tools: + +1. [Terraform](https://www.terraform.io/). Used to define and manage most of the basic infrastructure, such as servers, databases, load balancers, and networking. The Gruntwork Service Catalog is compatible with vanilla [Terraform](https://www.terraform.io/), [Terragrunt](https://terragrunt.gruntwork.io/), [Terraform + Cloud](https://www.hashicorp.com/blog/announcing-terraform-cloud/), and [Terraform + Enterprise](https://www.terraform.io/docs/enterprise/index.html). + +1. [Packer](https://www.packer.io/). Used to define and manage _machine images_ (e.g., VM images). The main use case is + to package code as [Amazon Machine Images (AMIs)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html) + that run on EC2 instances. Once you've built an AMI, you use Terraform to deploy it into AWS. diff --git a/docs/iac/whats-this/modules.md b/docs/iac/whats-this/modules.md index 07517da01e..52bdc43cd0 100644 --- a/docs/iac/whats-this/modules.md +++ b/docs/iac/whats-this/modules.md @@ -1,19 +1,28 @@ # What is a Module? -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Est placerat in egestas erat imperdiet sed. Velit dignissim sodales ut eu sem integer vitae. Mattis rhoncus urna neque viverra. Massa placerat duis ultricies lacus sed turpis tincidunt id. Posuere sollicitudin aliquam ultrices sagittis orci. Egestas quis ipsum suspendisse ultrices gravida dictum fusce ut placerat. Tristique senectus et netus et malesuada. Ipsum dolor sit amet consectetur adipiscing elit pellentesque. Enim nunc faucibus a pellentesque sit amet porttitor eget dolor. Eget nunc lobortis mattis aliquam faucibus purus in. Vulputate dignissim suspendisse in est ante in nibh mauris. Morbi non arcu risus quis varius quam. Cras adipiscing enim eu turpis egestas pretium. Donec enim diam vulputate ut. Ut tortor pretium viverra suspendisse potenti nullam. Euismod elementum nisi quis eleifend quam adipiscing vitae proin sagittis. Sed nisi lacus sed viverra tellus. Laoreet id donec ultrices tincidunt arcu non sodales neque. +Modules are reusable code to deploy and manage one piece of infrastructure and each one is a battle-tested, best-practices definition of a piece of infrastructure, such as a VPC, ECS cluster, or an Auto Scaling Group. -## Whats a Module +## When do you use a Module? -It's a bunch of code, ya silly! +Modules are fairly generic building blocks, so you don't typically deploy a single module directly, but rather, you write code that combines the modules you need for a specific use case. -## When do you use a Module? +For example, one module might deploy the control plane for Kubernetes and a separate module could deploy worker nodes; you may need to combine both modules together to deploy a Kubernetes cluster, or use the `eks-cluster` service from the [Service Catalog](/iac/whats-this/services/). + +The Gruntwork Infrastructure as Code (IaC) Library contains hundreds of battle-tested, commercially supported and maintained modules that you can use and combine in many different ways. Modules are versioned using Semantic Versioning to allow Gruntwork clients to keep up to date with the latest infrastructure best practices in a systematic way. + +## How to navigate modules in the IaC Library + +The code in the module repos are organized into three primary folders: + +1. `modules`: The core implementation code. All of the modules that you will use and deploy are defined within. For example to ECS cluster module in the `terraform-aws-ecs` repo in `modules/ecs-cluster`. -When you feel like it, ya dingus! +1. `examples`: Sample code that shows how to use the modules in the `modules` folder and allows you to try them out without having to write any code: you `cd` into one of the folders, follow a few steps in the README (e.g. run `terraform apply`), and you'll have a fully working module up and running. In other words, this is executable documentation. +1. `test`: Automated tests for the code in modules and examples. diff --git a/docs/iac/whats-this/services.md b/docs/iac/whats-this/services.md index 3ba24d303b..802ae2e149 100644 --- a/docs/iac/whats-this/services.md +++ b/docs/iac/whats-this/services.md @@ -1,19 +1,42 @@ # What is a Service? -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Eu nisl nunc mi ipsum faucibus vitae aliquet. Cras adipiscing enim eu turpis egestas pretium aenean pharetra magna. Nam at lectus urna duis convallis convallis. Eget est lorem ipsum dolor sit amet consectetur adipiscing elit. Interdum varius sit amet mattis vulputate enim. Massa id neque aliquam vestibulum. Nunc sed augue lacus viverra vitae congue eu consequat ac. Volutpat ac tincidunt vitae semper. Placerat orci nulla pellentesque dignissim enim. Dui sapien eget mi proin sed libero enim sed. Sem viverra aliquet eget sit. Dis parturient montes nascetur ridiculus. Quam id leo in vitae. Tortor dignissim convallis aenean et tortor at risus viverra adipiscing. Elit eget gravida cum sociis natoque penatibus et. +The Gruntwork Service Catalog consists of a number of reusable, customizable, battle-tested, production-grade infrastructure-as-code services that you can use to deploy and manage your infrastructure, including Docker orchestration, EC2 orchestration, load balancing, networking, databases, caches, monitoring, alerting, CI/CD, secrets management, VPN, and much more. -## Whats a Service +## When do you use a Service? -It's a bunch of modules grouped into one REALLY BIG module +Services in the service catalog are reusable code that combines multiple modules to configure a service for a specific use case. These are designed for specific use cases and meant to be deployed directly. -## When do you use a Service? +For example, the eks-cluster service combines all the modules you need to run an EKS (Kubernetes) cluster in a typical production environment, including modules for the control plane, worker nodes, secrets management, log aggregation, alerting, and so on. + +## How to navigate services in the IaC Library + +The code in the `terraform-aws-service-catalog` repo is organized into three primary folders: + +1. `modules`: The core implementation code of this repo. All the services that you will use and deploy are defined within, such as the EKS cluster service in modules/services/eks-cluster. + +1. `examples`: Sample code that shows how to use the services in the modules folder and allows you to try the services out without having to write any code: you `cd` into one of the folders, follow a few steps in the README (e.g., run `terraform apply`), and you'll have fully working infrastructure up and running. In other words, this is executable documentation. Note that the examples folder contains two sub-folders: + + 1. `for-learning-and-testing`: Example code that is optimized for learning, experimenting, and testing, but not + direct production usage). Most of these examples use Terraform directly to make it easy to fill in dependencies + that are convenient for testing, but not necessarily those you'd use in production: e.g., default VPCs or mock + database URLs. + + 1. `for-production`: Example code optimized for direct usage in production. This is code from the [Gruntwork Reference + Architecture](https://gruntwork.io/reference-architecture/), and it shows you how we build an end-to-end, + integrated tech stack on top of the Gruntwork Service Catalog. To keep the code DRY and manage dependencies + between modules, the code is deployed using [Terragrunt](https://terragrunt.gruntwork.io/). However, Terragrunt + is NOT required to use the Gruntwork Service Catalog: you can alternatively use vanilla Terraform or Terraform + Cloud / Enterprise, as described [here](https://docs.gruntwork.io/reference/services/intro/deploy-new-infrastructure#how-to-deploy-terraform-code-from-the-service-catalog). -When you feel like it, ya dingus! + 1. Not all modules have a `for-production` example, but you can still create a production-grade configuration by + using the template provided in this discussion question, [How do I use the modules in terraform-aws-service-catalog + if there is no example?](https://github.com/gruntwork-io/knowledge-base/discussions/360#discussioncomment-25705480). +1. `test`: Automated tests for the code in modules and examples. From a46d0e0cdf685de4ffa44c83c52cfc5435ae67a9 Mon Sep 17 00:00:00 2001 From: Andrew Ellison Date: Mon, 22 May 2023 14:05:45 -0500 Subject: [PATCH 54/89] [CORE-950] Pipelines single account tutorial (#806) * add pipelines tutorial, temporarily remove sidebar for multi account * add generated docs * PR fixes * fix broken links --- _docs-sources/pipelines/tutorial/index.md | 366 ++++++++++++++++++++- docs/pipelines/tutorial/index.md | 368 +++++++++++++++++++++- sidebars/pipelines.js | 12 +- 3 files changed, 713 insertions(+), 33 deletions(-) diff --git a/_docs-sources/pipelines/tutorial/index.md b/_docs-sources/pipelines/tutorial/index.md index 61f5ca168c..0524dbb586 100644 --- a/_docs-sources/pipelines/tutorial/index.md +++ b/_docs-sources/pipelines/tutorial/index.md @@ -1,19 +1,359 @@ -# Tutorial +# Tutorial - Single Account Example -Step 1: Setting up your code repository -First, you need to create a repository for your code. Just like how cats need a cozy bed to sleep in, your code needs a cozy home too. You can use GitHub, GitLab or Bitbucket to host your code. Choose whichever platform suits you best. Meow-ver, remember to give your repository a pawsome name, something like "Feline-Friendly-CI-CD-Pipeline" would be perfect. +In this tutorial, we'll walk you through the process of setting up Gruntwork Pipelines in a single +AWS account. By the end, you'll deploy: -Step 2: Choose your CI/CD tool -Just like how cats have different personalities, there are many different CI/CD tools to choose from. Some popular options are Jenkins, Travis CI, CircleCI, and GitLab CI/CD. Research each tool to find the one that suits your needs best. +- ECR Repositories for storing Docker images + - `deploy-runner` - stores the default image for planning and applying terraform and building AMIs + - `kaniko` - stores the default image for building other Docker images using [kaniko](https://github.com/GoogleContainerTools/kaniko) + - `hello-world` - a demonstration repo used for illustrating how a Docker application might be managed with Gruntwork Pipelines +- Our [ECS Deploy Runner Module](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner) +- Supporting IAM Roles, IAM Policies, and CloudWatch Log Groups +- ECS Tasks + - `docker-image-builder` - builds Docker images within the `kaniko` container image + - `ami-builder` - builds AMIs using HashiCorp Packer within the `deploy-runner` image + - `terraform-planner` - Runs plan commands within the `deploy-runner` container + - `terraform-applier` - Runs apply commands within the `deploy-runner` container -Step 3: Create a pipeline script -The pipeline script is like a recipe for your CI/CD pipeline. You can use a scripting language like Groovy or YAML to write the script. Make sure to include steps for building, testing, and deploying your code. Also, don't forget to add some cat puns to the script to keep it meow-nteresting. For example, you could add a step to "check if the code is purr-fect" or "run a meow-ssive amount of tests". +## Prerequisites -Step 4: Test your pipeline locally -Before you deploy your pipeline, you should test it locally to make sure it works as intended. This is like when cats scratch their scratching post to make sure it's sturdy enough for their needs. Use the CI/CD tool you chose to run the pipeline script locally. +Before we begin, make sure your system has: -Step 5: Deploy your pipeline -Now it's time to deploy your pipeline to your code repository. This is like when a cat finds a new hiding spot and decides to make it their own. Meow-ver, don't forget to configure your CI/CD tool to trigger the pipeline whenever changes are made to the code repository. +- [Docker](https://docs.docker.com/get-docker/), with support for Buildkit (version 18.09 or newer) +- [Terraform](https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli) (version 1.0 or newer) +- Valid [AWS credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html) for an IAM user with `AdministratorAccess` -Step 6: Monitor and improve your pipeline -Just like how you need to monitor your cat's health to make sure they're happy and healthy, you need to monitor your pipeline to make sure it's working properly. Keep an eye on the pipeline's logs and metrics to make sure everything is running smoothly. If you notice any issues, make improvements to your pipeline script to fix them. +## Repo Setup + +The code for this tutorial can be found in the [Gruntwork Service Catalog](https://github.com/gruntwork-io/terraform-aws-service-catalog/blob/master/examples/for-learning-and-testing/gruntwork-pipelines/README.md). Start by cloning the repo: + +```shell +git clone https://github.com/gruntwork-io/terraform-aws-service-catalog.git +``` + +We will be following the example found at `terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pipelines` + +```shell +cd terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pipelines +``` + +## Create the required ECR repositories + +Change directories to deploy the Terraform for ECR + +```shell +cd ecr-repositories +``` + +Set the `AWS_REGION` environment variable to your desired AWS region: + +```shell +export AWS_REGION= +``` + +Authenticate with your AWS account and deploy the Terraform code provided to create the three +ECR repositories. + +Initialize Terraform to download required dependencies: +```shell +terraform init +``` + +Run plan and ensure the output matches your expectations: +```shell +terraform plan +``` + +Deploy the code using apply +```shell +terraform apply +``` + +## Build and Push the Docker Images + +The four standard Gruntwork Pipelines capabilities are instrumented by two separate Docker files + +1. `ecs-deploy-runner` - Terraform plan, apply and AMI building +2. `kaniko` - Docker image building. [Kaniko](https://github.com/GoogleContainerTools/kaniko) is a tool that supports building Docker images inside of a container + +These Dockerfiles live in the ecs-deploy-runner module within [the terraform-aws-ci repository](https://github.com/gruntwork-io/terraform-aws-ci). In this example, we'll be cloning the terraform-aws-ci and running Docker build against the Dockerfiles defined there. + +We're now going to build these two Docker images and push them to the ECR repositories we just created. + +### Export Environment Variables + +If you do not already have a GitHub Personal Access Token (PAT) available, you can follow this [guide to Create a new GitHub Personal Access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token) + +For the purposes of this example, your token will need the `repo` scope, so that Gruntwork Pipelines is able to fetch modules and code from private Gruntwork repositories. Note that in production, the best practice is to create a separate GitHub machine user account, +and provision a GitHub PAT against that account. + +This GitHub PAT will be used for two purposes: +1. Initially, when running the Docker build commands below, the GitHub PAT will be used to fetch private code from `github.com/gruntwork-io`. +2. Once the Docker images are built, you'll store your GitHub PAT in AWS Secrets Manager. When Gruntwork Pipelines is running on your behalf, it will fetch + your GitHub PAT from Secrets Manager "Just in time" so that only the running ECS task has access to the token - and so that your token only exists for the lifespan + of the ephemeral ECS task container. + +Export a valid GitHub PAT using the following command so that we can use it to build Docker images that fetch private code via GitHub: +```shell +export GITHUB_OAUTH_TOKEN= +``` + +Export your AWS Account ID and primary region. The commands in the rest of this document require these variables to be set. The region to use is up to you. +```shell +export AWS_ACCOUNT_ID= +export AWS_REGION= +``` + +The Gruntwork Pipelines Dockerfiles used by Gruntwork Pipelines are stored in the `gruntwork-io/terraform-aws-ci` repository. Therefore, in order to pin both Dockerfiles +to a known version, we export the following variable which we'll use during our Docker builds: + +```shell +export TERRAFORM_AWS_CI_VERSION=v0.51.4 +``` + +The latest version can be retrieved from the [releases page](https://github.com/gruntwork-io/terraform-aws-ci/releases) of the `gruntwork-io/terraform-aws-ci` repository. At a minimum, `v0.51.4` must be selected. + +### Clone `terraform-aws-ci` to your machine +Next, we are going to build the two Docker images required for this example. The Dockerfiles are defined in the [terraform-aws-ci](https://github.com/gruntwork-io/terraform-aws-ci) repository, so it must be available locally: + +```bash +git clone git@github.com:gruntwork-io/terraform-aws-ci.git +``` + +Change directory into the example folder: +```bash +cd terraform-aws-ci/modules/ecs-deploy-runner +``` + +### Build the ecs-deploy-runner and kaniko Docker images + +This next command is going to perform a Docker build of the `deploy-runner` image. You don't need to authenticate to AWS in order to run this command, as the build will happen on your machine. +We do, however, pass your exported GitHub PAT into the build as a secret, so that the Docker build can fetch private code from `github.com/gruntwork-io`. Since we're using BuildKit, the token +is only used during the build process and does not remain in the final image. + +Run the following command to build the ecs-deploy-runner Docker image: +```shell +DOCKER_BUILDKIT=1 docker build \ + --secret id=github-token,env=GITHUB_OAUTH_TOKEN \ + --build-arg module_ci_tag="$TERRAFORM_AWS_CI_VERSION" \ + --tag "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/ecs-deploy-runner:$TERRAFORM_AWS_CI_VERSION" \ + ./docker/deploy-runner/ +``` + +This next command is going to perform a Docker build of the `kaniko` image. You don't need to authenticate to AWS in order to run this command, as the build will happen on your machine. +We do, however, pass your exported GitHub PAT into the build as a secret, so that the Docker build can fetch private code from `github.com/gruntwork-io`. Since we're using BuildKit, the token +is only used during the build process and does not remain in the final image. + +Similarly to the ecs-deploy-runner image, we'll now use the Kaniko Dockerfile included in this example to build the kaniko image: +```shell +DOCKER_BUILDKIT=1 docker build \ + --secret id=github-token,env=GITHUB_OAUTH_TOKEN \ + --build-arg module_ci_tag="$TERRAFORM_AWS_CI_VERSION" \ + --tag "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/kaniko:$TERRAFORM_AWS_CI_VERSION" \ + ./docker/kaniko/ +``` + +### Log and Push to ECR +Now we have local Docker images for ecs-deploy-runner and kaniko that are properly tagged, but before we can push it into the private ECR repository that we created +with our `terraform apply`, we need to authenticate with ECR itself. Authenticate to AWS and run the following: + +```shell +aws ecr get-login-password --region $AWS_REGION \ + | docker login -u AWS --password-stdin "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com" +``` + +If you receive a success message from your previous command, you're ready to push your ecs-deploy-runner image: +```shell +docker push "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/ecs-deploy-runner:$TERRAFORM_AWS_CI_VERSION" +``` + +```shell +docker push "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/kaniko:$TERRAFORM_AWS_CI_VERSION" +``` + +## Deploy the Pipelines Cluster + +Now that the ECR repositories are deployed and have the required Docker images, we are ready +to deploy the rest of Gruntwork Pipelines. The Terraform that defines the setup is defined in +`terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pipelines/pipelines-cluster` + +```shell +cd terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pipelines/pipelines-cluster +``` + +### Export a GitHub Personal Access Token (PAT) +For the purposes of this example, you may use the same PAT as before. In a production deployment, best practice +would be to create a separate GitHub machine user account. This modules uses a slightly different naming convention for +its environment variable so you'll need to re-export the token: + +```shell +export TF_VAR_github_token= +``` + +### Configure and Deploy the ecs deploy runner +Authenticate to your AWS account and run init, then apply. +:::note +If you are using aws-vault to authenticate on the command line, you must supply the `--no-session` flag as explained in [this KB entry](https://github.com/gruntwork-io/knowledge-base/discussions/647) +::: + +```shell +terraform init +``` + +```shell +terraform plan +``` +Check your plan output before applying +```shell +terraform apply +``` + +## Install the `infrastructure-deployer` command line tool + +Gruntwork Pipelines requires all requests to transit through its fronting Lambda function, which ensures only valid arguments and commands are passed along to ECS. +To invoke Gruntwork Pipelines's fronting Lambda function, you should use the `infrastructure-deployer` command line interface (CLI) tool. For testing and setup purposes, we'll install and use the `infrastructure-deployer` CLI locally; when you're ready to configure CI / CD, you'll install and use it in your CI / CD config. + +If you do not already have the `gruntwork-install` binary installed, you can get it [here.](https://github.com/gruntwork-io/gruntwork-installer) + +```bash + +gruntwork-install --binary-name "infrastructure-deployer" --repo "https://github.com/gruntwork-io/terraform-aws-ci" --tag "$TERRAFORM_AWS_CI_VERSION" +``` +:::note +If you'd rather not use the Gruntwork installer, you can alternatively download the binary manually from [the releases page.](https://github.com/gruntwork-io/terraform-aws-ci/releases) +::: + +## Invoke your Lambda Function + +### Get your Lambda ARN from the output +Next, we need to retrieve the Amazon Resource Name (ARN) for the Lambda function that guards your Gruntwork Pipelines installation: + +```shell +terraform output -r gruntwork_pipelines_lambda_arn +``` + +Once you have your invoker Lambda's ARN, export it like so: + +```shell +export INVOKER_FUNCTION_ARN= +``` + +This value is used by the `run-docker-build.sh` and `run-packer-build.sh` scripts in the next step. + +### Perform a Docker/Packer build via Pipelines + +Now that we have Gruntwork Pipelines installed in the `docker-packer-builder` configuration, let's put arbitrary Docker and Packer builds through it! + +For your convenience, we've provided two scripts that you can run: +* `run-docker-build.sh` +* `run-packer-build.sh` + +These two scripts will: + +1. Ensure all required environment variables are set +2. Use the `infrastructure-deployer` CLI to send a Docker build request to the invoker lambda + +Once the request is sent, Gruntwork Pipelines will begin streaming the logs back to you so you can watch the images get built. The Docker build will push the completed image to your hello-world repository, and the Packer build will push the completed AMI to EC2. + +The following environment variables must be set in your shell before you run `run-docker-build.sh`: +* `AWS_ACCOUNT_ID` +* `AWS_REGION` +* `INVOKER_FUNCTION_ARN` + +## Prepare a test "infrastructure live" repo + +You now have a functional Gruntwork Pipelines example that can build and deploy Docker images and AMIs. +Feel free to stop here and experiment with what you've built so far. The following steps will extend +pipelines to be capable of running Terraform plan and apply. + +Pipelines is a flexible solution that can be deployed in many configurations. +In your own organization, you might consider deploying one Pipelines installation with all the ECS tasks enabled, +or having a central Pipelines installation plus one in each account of your Reference Architecture. + +To test the plan and apply functionality, we'll need a simple demo repository. +You may create your own or fork our [testing repo](https://github.com/gruntwork-io/terraform-module-in-root-for-terragrunt-test + +## Enable the Terraform planner and applier + +We've intentionally deployed an incomplete version of Gruntwork Pipelines so far. To deploy the full version with the planner +and applier, you'll need make a few edits to the module. In this directory you should see a few files prefixed with `config_`. +Two are proper Terraform files with all the configuration for running the Docker image builder and the ami builder. + +Each consists of +* A `locals` block containing the configuration variables specifying which repos are allowed and providing credentials +* Some IAM resources that give the task permission to access the resources it needs + +The other two files have a `.example` postfix. Remove that postfix to let Terraform discover them. + +Next, let's take a look at `main.tf`. You should see a `TODO` around line 37, marking the location where the configuration might normally +live. As this example ships with the Docker image builder and ami builder defined in external files we have commented out +the default null values. + +Comment out or delete the following lines: +* `terraform_planner_config = null` +* `terraform_planner_https_tokens_config = null` +* `terraform_applier_config = null` +* `terraform_applier_https_tokens_config = null` + +These values are now properly defined in the external `config_` tf files. + +## Configure the Terraform planner and applier + +Now that the planner and applier are enabled, we could run `terraform apply`, but the default values of a few +variables might not be correct for your test environment. Make the following changes to your `.tfvars` file to +define the correct repos and credentials. Pipelines is configured to reject any commands that aren't explicitly allowed +by the configuration below: + +* `allowed_terraform_planner_repos = ["https://github.com/your-org/your-forked-repo.git"]` - a list of repos where `terraform plan` is allowed to be run +* `allowed_terraform_applier_repos = ["https://github.com/your-org/your-forked-repo.git"]` - a list of repos where `terraform apply` is allowed to be run +* optionally `machine_user_git_info = {name="machine_user_name", email="machine_user_email"}` - if you'd like to customize your machine user info +* optionally `allowed_apply_git_refs = ["master", "main", "branch1", ...]` - for any branches or git refs you'd like to be able to run `terraform apply` on + +Now you're ready to run `terraform apply`! Once complete, you should see 2 new ECS task definitions in your AWS account: +* `ecs-deploy-runner-terraform-planner` +* `ecs-deploy-runner-terraform-applier` + +## Try a plan or apply + +With Gruntwork Pipelines deployed, it's time to test it out! Run the following command to trigger +a plan or apply + +```shell +infrastructure-deployer --aws-region us-east-1 -- terraform-planner infrastructure-deploy-script \ + --ref "master" \ + --binary "terraform" \ + --command "plan" +``` + +If you forked the example repo provided you should see `+ out = "Hello, World"` if the plan was a success. + +## Celebrate, you did it! + +As a next step you could add a `.github/workflows/pipeline.yml` file to your repo that runs the command above +or try it in your favorite CI/CD tool. Your tooling only needs permission to trigger the lambda +function `arn:aws:lambda:us-east-1::function:ecs-deploy-runner-invoker`. + +## Cleanup + +If you want to remove the infrastructure created, you can use Terraform Destroy. + +```shell +terraform plan -destroy -out terraform.plan +terraform apply terraform.plan +``` + +To destroy the `ecr-repositories` resources we created, we'll first need to empty the repos of any images: + +```shell +aws ecr batch-delete-image --repository-name ecs-deploy-runner --image-ids imageTag=$TERRAFORM_AWS_CI_VERSION +aws ecr batch-delete-image --repository-name kaniko --image-ids imageTag=$TERRAFORM_AWS_CI_VERSION +aws ecr batch-delete-image --repository-name hello-world --image-ids imageTag=v1.0.0 +``` + +Then Terraform can take care of the rest: + +```shell +cd ../ecr-repositories +terraform plan -destroy -out terraform.plan +terraform apply terraform.plan +``` diff --git a/docs/pipelines/tutorial/index.md b/docs/pipelines/tutorial/index.md index 8f698035d7..2b5f0ee0ef 100644 --- a/docs/pipelines/tutorial/index.md +++ b/docs/pipelines/tutorial/index.md @@ -1,27 +1,367 @@ -# Tutorial +# Tutorial - Single Account Example -Step 1: Setting up your code repository -First, you need to create a repository for your code. Just like how cats need a cozy bed to sleep in, your code needs a cozy home too. You can use GitHub, GitLab or Bitbucket to host your code. Choose whichever platform suits you best. Meow-ver, remember to give your repository a pawsome name, something like "Feline-Friendly-CI-CD-Pipeline" would be perfect. +In this tutorial, we'll walk you through the process of setting up Gruntwork Pipelines in a single +AWS account. By the end, you'll deploy: -Step 2: Choose your CI/CD tool -Just like how cats have different personalities, there are many different CI/CD tools to choose from. Some popular options are Jenkins, Travis CI, CircleCI, and GitLab CI/CD. Research each tool to find the one that suits your needs best. +- ECR Repositories for storing Docker images + - `deploy-runner` - stores the default image for planning and applying terraform and building AMIs + - `kaniko` - stores the default image for building other Docker images using [kaniko](https://github.com/GoogleContainerTools/kaniko) + - `hello-world` - a demonstration repo used for illustrating how a Docker application might be managed with Gruntwork Pipelines +- Our [ECS Deploy Runner Module](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner) +- Supporting IAM Roles, IAM Policies, and CloudWatch Log Groups +- ECS Tasks + - `docker-image-builder` - builds Docker images within the `kaniko` container image + - `ami-builder` - builds AMIs using HashiCorp Packer within the `deploy-runner` image + - `terraform-planner` - Runs plan commands within the `deploy-runner` container + - `terraform-applier` - Runs apply commands within the `deploy-runner` container -Step 3: Create a pipeline script -The pipeline script is like a recipe for your CI/CD pipeline. You can use a scripting language like Groovy or YAML to write the script. Make sure to include steps for building, testing, and deploying your code. Also, don't forget to add some cat puns to the script to keep it meow-nteresting. For example, you could add a step to "check if the code is purr-fect" or "run a meow-ssive amount of tests". +## Prerequisites -Step 4: Test your pipeline locally -Before you deploy your pipeline, you should test it locally to make sure it works as intended. This is like when cats scratch their scratching post to make sure it's sturdy enough for their needs. Use the CI/CD tool you chose to run the pipeline script locally. +Before we begin, make sure your system has: -Step 5: Deploy your pipeline -Now it's time to deploy your pipeline to your code repository. This is like when a cat finds a new hiding spot and decides to make it their own. Meow-ver, don't forget to configure your CI/CD tool to trigger the pipeline whenever changes are made to the code repository. +- [Docker](https://docs.docker.com/get-docker/), with support for Buildkit (version 18.09 or newer) +- [Terraform](https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli) (version 1.0 or newer) +- Valid [AWS credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html) for an IAM user with `AdministratorAccess` -Step 6: Monitor and improve your pipeline -Just like how you need to monitor your cat's health to make sure they're happy and healthy, you need to monitor your pipeline to make sure it's working properly. Keep an eye on the pipeline's logs and metrics to make sure everything is running smoothly. If you notice any issues, make improvements to your pipeline script to fix them. +## Repo Setup + +The code for this tutorial can be found in the [Gruntwork Service Catalog](https://github.com/gruntwork-io/terraform-aws-service-catalog/blob/master/examples/for-learning-and-testing/gruntwork-pipelines/README.md). Start by cloning the repo: + +```shell +git clone https://github.com/gruntwork-io/terraform-aws-service-catalog.git +``` + +We will be following the example found at `terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pipelines` + +```shell +cd terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pipelines +``` + +## Create the required ECR repositories + +Change directories to deploy the Terraform for ECR + +```shell +cd ecr-repositories +``` + +Set the `AWS_REGION` environment variable to your desired AWS region: + +```shell +export AWS_REGION= +``` + +Authenticate with your AWS account and deploy the Terraform code provided to create the three +ECR repositories. + +Initialize Terraform to download required dependencies: +```shell +terraform init +``` + +Run plan and ensure the output matches your expectations: +```shell +terraform plan +``` + +Deploy the code using apply +```shell +terraform apply +``` + +## Build and Push the Docker Images + +The four standard Gruntwork Pipelines capabilities are instrumented by two separate Docker files + +1. `ecs-deploy-runner` - Terraform plan, apply and AMI building +2. `kaniko` - Docker image building. [Kaniko](https://github.com/GoogleContainerTools/kaniko) is a tool that supports building Docker images inside of a container + +These Dockerfiles live in the ecs-deploy-runner module within [the terraform-aws-ci repository](https://github.com/gruntwork-io/terraform-aws-ci). In this example, we'll be cloning the terraform-aws-ci and running Docker build against the Dockerfiles defined there. + +We're now going to build these two Docker images and push them to the ECR repositories we just created. + +### Export Environment Variables + +If you do not already have a GitHub Personal Access Token (PAT) available, you can follow this [guide to Create a new GitHub Personal Access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token) + +For the purposes of this example, your token will need the `repo` scope, so that Gruntwork Pipelines is able to fetch modules and code from private Gruntwork repositories. Note that in production, the best practice is to create a separate GitHub machine user account, +and provision a GitHub PAT against that account. + +This GitHub PAT will be used for two purposes: +1. Initially, when running the Docker build commands below, the GitHub PAT will be used to fetch private code from `github.com/gruntwork-io`. +2. Once the Docker images are built, you'll store your GitHub PAT in AWS Secrets Manager. When Gruntwork Pipelines is running on your behalf, it will fetch + your GitHub PAT from Secrets Manager "Just in time" so that only the running ECS task has access to the token - and so that your token only exists for the lifespan + of the ephemeral ECS task container. + +Export a valid GitHub PAT using the following command so that we can use it to build Docker images that fetch private code via GitHub: +```shell +export GITHUB_OAUTH_TOKEN= +``` + +Export your AWS Account ID and primary region. The commands in the rest of this document require these variables to be set. The region to use is up to you. +```shell +export AWS_ACCOUNT_ID= +export AWS_REGION= +``` + +The Gruntwork Pipelines Dockerfiles used by Gruntwork Pipelines are stored in the `gruntwork-io/terraform-aws-ci` repository. Therefore, in order to pin both Dockerfiles +to a known version, we export the following variable which we'll use during our Docker builds: + +```shell +export TERRAFORM_AWS_CI_VERSION=v0.51.4 +``` + +The latest version can be retrieved from the [releases page](https://github.com/gruntwork-io/terraform-aws-ci/releases) of the `gruntwork-io/terraform-aws-ci` repository. At a minimum, `v0.51.4` must be selected. + +### Clone `terraform-aws-ci` to your machine +Next, we are going to build the two Docker images required for this example. The Dockerfiles are defined in the [terraform-aws-ci](https://github.com/gruntwork-io/terraform-aws-ci) repository, so it must be available locally: + +```bash +git clone git@github.com:gruntwork-io/terraform-aws-ci.git +``` + +Change directory into the example folder: +```bash +cd terraform-aws-ci/modules/ecs-deploy-runner +``` + +### Build the ecs-deploy-runner and kaniko Docker images + +This next command is going to perform a Docker build of the `deploy-runner` image. You don't need to authenticate to AWS in order to run this command, as the build will happen on your machine. +We do, however, pass your exported GitHub PAT into the build as a secret, so that the Docker build can fetch private code from `github.com/gruntwork-io`. Since we're using BuildKit, the token +is only used during the build process and does not remain in the final image. + +Run the following command to build the ecs-deploy-runner Docker image: +```shell +DOCKER_BUILDKIT=1 docker build \ + --secret id=github-token,env=GITHUB_OAUTH_TOKEN \ + --build-arg module_ci_tag="$TERRAFORM_AWS_CI_VERSION" \ + --tag "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/ecs-deploy-runner:$TERRAFORM_AWS_CI_VERSION" \ + ./docker/deploy-runner/ +``` + +This next command is going to perform a Docker build of the `kaniko` image. You don't need to authenticate to AWS in order to run this command, as the build will happen on your machine. +We do, however, pass your exported GitHub PAT into the build as a secret, so that the Docker build can fetch private code from `github.com/gruntwork-io`. Since we're using BuildKit, the token +is only used during the build process and does not remain in the final image. + +Similarly to the ecs-deploy-runner image, we'll now use the Kaniko Dockerfile included in this example to build the kaniko image: +```shell +DOCKER_BUILDKIT=1 docker build \ + --secret id=github-token,env=GITHUB_OAUTH_TOKEN \ + --build-arg module_ci_tag="$TERRAFORM_AWS_CI_VERSION" \ + --tag "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/kaniko:$TERRAFORM_AWS_CI_VERSION" \ + ./docker/kaniko/ +``` + +### Log and Push to ECR +Now we have local Docker images for ecs-deploy-runner and kaniko that are properly tagged, but before we can push it into the private ECR repository that we created +with our `terraform apply`, we need to authenticate with ECR itself. Authenticate to AWS and run the following: + +```shell +aws ecr get-login-password --region $AWS_REGION \ + | docker login -u AWS --password-stdin "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com" +``` + +If you receive a success message from your previous command, you're ready to push your ecs-deploy-runner image: +```shell +docker push "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/ecs-deploy-runner:$TERRAFORM_AWS_CI_VERSION" +``` + +```shell +docker push "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/kaniko:$TERRAFORM_AWS_CI_VERSION" +``` + +## Deploy the Pipelines Cluster + +Now that the ECR repositories are deployed and have the required Docker images, we are ready +to deploy the rest of Gruntwork Pipelines. The Terraform that defines the setup is defined in +`terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pipelines/pipelines-cluster` + +```shell +cd terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pipelines/pipelines-cluster +``` + +### Export a GitHub Personal Access Token (PAT) +For the purposes of this example, you may use the same PAT as before. In a production deployment, best practice +would be to create a separate GitHub machine user account. This modules uses a slightly different naming convention for +its environment variable so you'll need to re-export the token: + +```shell +export TF_VAR_github_token= +``` + +### Configure and Deploy the ecs deploy runner +Authenticate to your AWS account and run init, then apply. +:::note +If you are using aws-vault to authenticate on the command line, you must supply the `--no-session` flag as explained in [this KB entry](https://github.com/gruntwork-io/knowledge-base/discussions/647) +::: + +```shell +terraform init +``` + +```shell +terraform plan +``` +Check your plan output before applying +```shell +terraform apply +``` + +## Install the `infrastructure-deployer` command line tool + +Gruntwork Pipelines requires all requests to transit through its fronting Lambda function, which ensures only valid arguments and commands are passed along to ECS. +To invoke Gruntwork Pipelines's fronting Lambda function, you should use the `infrastructure-deployer` command line interface (CLI) tool. For testing and setup purposes, we'll install and use the `infrastructure-deployer` CLI locally; when you're ready to configure CI / CD, you'll install and use it in your CI / CD config. + +If you do not already have the `gruntwork-install` binary installed, you can get it [here.](https://github.com/gruntwork-io/gruntwork-installer) + +```bash + +gruntwork-install --binary-name "infrastructure-deployer" --repo "https://github.com/gruntwork-io/terraform-aws-ci" --tag "$TERRAFORM_AWS_CI_VERSION" +``` +:::note +If you'd rather not use the Gruntwork installer, you can alternatively download the binary manually from [the releases page.](https://github.com/gruntwork-io/terraform-aws-ci/releases) +::: + +## Invoke your Lambda Function + +### Get your Lambda ARN from the output +Next, we need to retrieve the Amazon Resource Name (ARN) for the Lambda function that guards your Gruntwork Pipelines installation: + +```shell +terraform output -r gruntwork_pipelines_lambda_arn +``` + +Once you have your invoker Lambda's ARN, export it like so: + +```shell +export INVOKER_FUNCTION_ARN= +``` + +This value is used by the `run-docker-build.sh` and `run-packer-build.sh` scripts in the next step. + +### Perform a Docker/Packer build via Pipelines + +Now that we have Gruntwork Pipelines installed in the `docker-packer-builder` configuration, let's put arbitrary Docker and Packer builds through it! + +For your convenience, we've provided two scripts that you can run: +* `run-docker-build.sh` +* `run-packer-build.sh` + +These two scripts will: + +1. Ensure all required environment variables are set +2. Use the `infrastructure-deployer` CLI to send a Docker build request to the invoker lambda + +Once the request is sent, Gruntwork Pipelines will begin streaming the logs back to you so you can watch the images get built. The Docker build will push the completed image to your hello-world repository, and the Packer build will push the completed AMI to EC2. + +The following environment variables must be set in your shell before you run `run-docker-build.sh`: +* `AWS_ACCOUNT_ID` +* `AWS_REGION` +* `INVOKER_FUNCTION_ARN` + +## Prepare a test "infrastructure live" repo + +You now have a functional Gruntwork Pipelines example that can build and deploy Docker images and AMIs. +Feel free to stop here and experiment with what you've built so far. The following steps will extend +pipelines to be capable of running Terraform plan and apply. + +Pipelines is a flexible solution that can be deployed in many configurations. +In your own organization, you might consider deploying one Pipelines installation with all the ECS tasks enabled, +or having a central Pipelines installation plus one in each account of your Reference Architecture. + +To test the plan and apply functionality, we'll need a simple demo repository. +You may create your own or fork our [testing repo](https://github.com/gruntwork-io/terraform-module-in-root-for-terragrunt-test + +## Enable the Terraform planner and applier + +We've intentionally deployed an incomplete version of Gruntwork Pipelines so far. To deploy the full version with the planner +and applier, you'll need make a few edits to the module. In this directory you should see a few files prefixed with `config_`. +Two are proper Terraform files with all the configuration for running the Docker image builder and the ami builder. + +Each consists of +* A `locals` block containing the configuration variables specifying which repos are allowed and providing credentials +* Some IAM resources that give the task permission to access the resources it needs + +The other two files have a `.example` postfix. Remove that postfix to let Terraform discover them. + +Next, let's take a look at `main.tf`. You should see a `TODO` around line 37, marking the location where the configuration might normally +live. As this example ships with the Docker image builder and ami builder defined in external files we have commented out +the default null values. + +Comment out or delete the following lines: +* `terraform_planner_config = null` +* `terraform_planner_https_tokens_config = null` +* `terraform_applier_config = null` +* `terraform_applier_https_tokens_config = null` + +These values are now properly defined in the external `config_` tf files. + +## Configure the Terraform planner and applier + +Now that the planner and applier are enabled, we could run `terraform apply`, but the default values of a few +variables might not be correct for your test environment. Make the following changes to your `.tfvars` file to +define the correct repos and credentials. Pipelines is configured to reject any commands that aren't explicitly allowed +by the configuration below: + +* `allowed_terraform_planner_repos = ["https://github.com/your-org/your-forked-repo.git"]` - a list of repos where `terraform plan` is allowed to be run +* `allowed_terraform_applier_repos = ["https://github.com/your-org/your-forked-repo.git"]` - a list of repos where `terraform apply` is allowed to be run +* optionally `machine_user_git_info = {name="machine_user_name", email="machine_user_email"}` - if you'd like to customize your machine user info +* optionally `allowed_apply_git_refs = ["master", "main", "branch1", ...]` - for any branches or git refs you'd like to be able to run `terraform apply` on + +Now you're ready to run `terraform apply`! Once complete, you should see 2 new ECS task definitions in your AWS account: +* `ecs-deploy-runner-terraform-planner` +* `ecs-deploy-runner-terraform-applier` + +## Try a plan or apply + +With Gruntwork Pipelines deployed, it's time to test it out! Run the following command to trigger +a plan or apply + +```shell +infrastructure-deployer --aws-region us-east-1 -- terraform-planner infrastructure-deploy-script \ + --ref "master" \ + --binary "terraform" \ + --command "plan" +``` + +If you forked the example repo provided you should see `+ out = "Hello, World"` if the plan was a success. + +## Celebrate, you did it! + +As a next step you could add a `.github/workflows/pipeline.yml` file to your repo that runs the command above +or try it in your favorite CI/CD tool. Your tooling only needs permission to trigger the lambda +function `arn:aws:lambda:us-east-1::function:ecs-deploy-runner-invoker`. + +## Cleanup + +If you want to remove the infrastructure created, you can use Terraform Destroy. + +```shell +terraform plan -destroy -out terraform.plan +terraform apply terraform.plan +``` + +To destroy the `ecr-repositories` resources we created, we'll first need to empty the repos of any images: + +```shell +aws ecr batch-delete-image --repository-name ecs-deploy-runner --image-ids imageTag=$TERRAFORM_AWS_CI_VERSION +aws ecr batch-delete-image --repository-name kaniko --image-ids imageTag=$TERRAFORM_AWS_CI_VERSION +aws ecr batch-delete-image --repository-name hello-world --image-ids imageTag=v1.0.0 +``` + +Then Terraform can take care of the rest: + +```shell +cd ../ecr-repositories +terraform plan -destroy -out terraform.plan +terraform apply terraform.plan +``` diff --git a/sidebars/pipelines.js b/sidebars/pipelines.js index 729054241c..8ea3f1d3c8 100644 --- a/sidebars/pipelines.js +++ b/sidebars/pipelines.js @@ -27,15 +27,15 @@ const sidebar = [ id: "pipelines/how-it-works/index", }, { - label: "Tutorial", + label: "Single Account Tutorial", type: "doc", id: "pipelines/tutorial/index", }, - { - label: "Deploying Multi-Account Pipelines", - type: "doc", - id: "pipelines/multi-account/index", - }, + // { + // label: "Deploying Multi-Account Pipelines", + // type: "doc", + // id: "pipelines/multi-account/index", + // }, ] }, { From f2e091937395071b94d3979af6cddc9449b58932 Mon Sep 17 00:00:00 2001 From: Andrew Ellison Date: Mon, 22 May 2023 14:06:01 -0500 Subject: [PATCH 55/89] [CORE-948] pipelines how it works (#808) * Add pipelines how it works docs * address pr comments * regen doc * Apply suggestions from code review Co-authored-by: Max Moon --------- Co-authored-by: Max Moon --- _docs-sources/pipelines/how-it-works/index.md | 93 ++++++++++-------- docs/pipelines/how-it-works/index.md | 95 +++++++++++-------- 2 files changed, 107 insertions(+), 81 deletions(-) diff --git a/_docs-sources/pipelines/how-it-works/index.md b/_docs-sources/pipelines/how-it-works/index.md index 7d9a57c730..984d5fe3c4 100644 --- a/_docs-sources/pipelines/how-it-works/index.md +++ b/_docs-sources/pipelines/how-it-works/index.md @@ -1,68 +1,81 @@ # How it works -In order to maximize our synergistic value proposition, we need to leverage our core competencies in order to achieve our strategic objectives. We need to think outside the box and come up with innovative solutions that will allow us to disrupt the market and gain a competitive advantage. We also need to focus on our customer experience and provide them with a seamless and personalized journey. - ## Block Diagram -![CIS Benchmark Architecture](/img/pipelines-docker-packer-builder.png) +![Gruntwork Pipelines Architecture](/img/guides/build-it-yourself/pipelines/tftg-pipeline-architecture.png) ## External CI Tool -We need to be agile and adaptable in order to respond to the ever-changing business landscape. We need to be able to quickly pivot and change course when necessary. We also need to be able to collaborate effectively with our partners and stakeholders in order to achieve our goals. +Gruntwork Pipelines can be used with any external CI/CD tool. The role of the CI/CD tool is to trigger jobs +inside Gruntwork Pipelines. We have [example configurations](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/master/examples/for-production/infrastructure-live/_ci/scripts) +that identify changed terraform modules and call the Gruntwork Pipelines invoker Lambda function. -## Invoker Lambda +By default, the invoker Lambda function is run by a CLI tool called `infrastructure-deployer` from within your CI tool. -Oh my goodness, have I told you about the time I saw a beautiful Blue Jay perched on my windowsill? It was truly a sight to behold! But I digress... let me tell you about AWS Lambda functions, which are like the busy little hummingbirds of the cloud computing world. +## ECS Deploy Runner -Picture this: a Lambda function is like a bird feeder that sits and waits for requests to come in, just like a bird feeder waits for feathered friends to come and snack. But instead of seed, it's programmed to receive code and execute it. +The [ECS Deploy Runner Module](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner) +is a flexible framework for running pre-defined, locked-down jobs in an isolated +ECS task. It serves as the foundation for Gruntwork Pipelines. +The components described below work together to trigger jobs, validate them, run them, and stream +the logs back to your CI tool as if they were running locally. -## ECS Deploy Runner +### Infrastructure Deployer CLI -Hark! Let me spin you a tale of wondrous tool, -That doth aid in deploying software cool. -This tool, 'tis known as ECS Deploy Runner, -A champion of those who deploy with honor. +The [infrastructure deployer cli tool](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/infrastructure-deployer) +serves as the interface between your chosen CI tool and Gruntwork Pipelines. It is used to trigger +jobs in the deploy runner. Primarily, it calls instances of the invoker lambda described in the next section. -In Amazon's world of cloud, it doth reside, -Where containers reign with power and pride. -This runner, like a loyal squire true, -Doth serve those who would deploy anew. +Usage: -With ECS as its liege, it doth obey, -And to the cloud, it doth make its way. -In rolling updates, it doth excel, -Ensuring no downtime, all shall be well. +`infrastructure-deployer --aws-region AWS_REGION [other options] -- CONTAINER_NAME SCRIPT ARGS...` -### Standard Configuration +When launching a task, you may optionally set the following useful flags: -Its mission, to deploy with utmost care, -And make the process smooth, beyond compare. -With blue-green deployments, it doth impress, -And safely switches traffic without stress. +- `max-wait-time` (default 2h0m0s) - timeout length for the action +- `task-cpu` - A custom number of CPU units to allocate to the ECS task +- `task-memory` - A custom number of memory units to allocate to the ECS task -And when the task is done, it doth report, -On all that happened, to provide support. -With logs and metrics, it doth reveal, -The story of the deployment's ordeal. +To get the list of supported containers and scripts, pass in the --describe-containers option. For example: -### Docker Image Builder (Kaniko) +`infrastructure-deployer --describe-containers --aws-region us-west-2` -And lo, there was a tool called Kaniko, born of the land of Google, and it was a builder of Docker images. And the people did marvel at its greatness, for it did not require the use of a Docker daemon, nor did it need root privileges. +This will list all the containers and the scripts for each container that can be invoked using the invoker function of +the ECS deploy runner stack deployed in us-west-2. -Kaniko was a humble tool, born of the desire to provide a secure and reliable way to build Docker images in a Kubernetes environment. It did not seek glory or power, but instead sought to serve the people, to make their lives easier and their applications more secure. -And Kaniko did work diligently, using its many talents to build Docker images in a way that was both efficient and trustworthy. It did not rely on a Docker daemon, but instead used a container to perform the build process, ensuring that the image was built in a clean and isolated environment. +### Invoker Lambda + +The [Invoker Lambda](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/main_lambda.tf) +is an AWS Lambda function written in python that acts as the AWS entrypoint for your pipeline. +It has 3 primary roles: + +1. Serving as a gatekeeper for pipelines runs, determining if a particular command is allowed to be run, and if the arguments are valid +2. Creating ECS tasks that run terraform, docker, or packer commands +3. Shipping deployment logs back to your CI/CD tool + +### Standard Configuration -And the people did praise Kaniko, for it did not require root privileges, and could be run by users without fear of compromising the system. It did not store secrets in the Docker daemon, but instead used a secure file system to store them, ensuring that they could not be accessed by unauthorized parties. +The ECS deploy runner is flexible and can be configured for many tasks. The [standard configuration](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner-standard-configuration) +is a set of 4 ECS task definitions that we ship with Pipelines by default. +Once you have your pipeline deployed you can [modify](../maintain/extending.md) the configuration as you like. +The configuration defines what scripts are accepted by the invoker Lambda and which arguments may be provided. The invoker Lambda +will reject ANY script or argument not defined in the ECS Deploy Runner configuration. +The 4 default tasks are defined below. -### Terraform Planner/Applier +#### Docker Image Builder (Kaniko) -In the realm of deployment, there exist powerful tools that rival the strength and cunning of even the most feared warriors. Among them, the ECS Deploy Runner, Terraform Planner, and Applier stand tall, ready to unleash their might upon the field of battle. +The Docker Image Builder task definition allows CI jobs to build docker images. +This ECS task uses an open source library called [Kaniko](https://github.com/GoogleContainerTools/kaniko) to enable docker builds from within a docker container. +We provide a [Docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/kaniko) based on kaniko for this task. -The ECS Deploy Runner is like a fierce direwolf, swift and agile, capable of executing complex deployment tasks with ease. It is the tool of choice for those who seek to deploy their applications with speed and precision. +#### Packer AMI Builder -The Terraform Planner is like a wise and ancient dragon, possessing an almost infinite knowledge of the infrastructure it seeks to conquer. With its keen intellect, it can survey the land and plan the deployment with utmost accuracy, leaving no stone unturned in its quest for victory. +The Packer AMI Builder task definition allows CI jobs to build AMIs using HashiCorp Packer. This task runs in +a [Docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/deploy-runner) we provide. -The Applier, on the other hand, is like a steadfast and loyal knight, resolute in its determination to carry out the orders of its master. With unflinching obedience, it applies the deployment plan, ensuring that every detail is executed with precision and care. +#### Terraform Planner and Applier -Together, these tools form a formidable trio, capable of conquering even the most daunting deployment challenges. They are the guardians of the realm of deployment, and those who are wise enough to enlist their aid can rest assured that their applications will be deployed with the utmost efficiency and effectiveness. +The Terraform Planner task definition and Terraform Applier task definition are very similar. They allow CI jobs to +plan and apply terraform and terragrunt code. These tasks run in the same [docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/deploy-runner) +as the AMI builder diff --git a/docs/pipelines/how-it-works/index.md b/docs/pipelines/how-it-works/index.md index 09520a3ce5..97741e1870 100644 --- a/docs/pipelines/how-it-works/index.md +++ b/docs/pipelines/how-it-works/index.md @@ -1,76 +1,89 @@ # How it works -In order to maximize our synergistic value proposition, we need to leverage our core competencies in order to achieve our strategic objectives. We need to think outside the box and come up with innovative solutions that will allow us to disrupt the market and gain a competitive advantage. We also need to focus on our customer experience and provide them with a seamless and personalized journey. - ## Block Diagram -![CIS Benchmark Architecture](/img/pipelines-docker-packer-builder.png) +![Gruntwork Pipelines Architecture](/img/guides/build-it-yourself/pipelines/tftg-pipeline-architecture.png) ## External CI Tool -We need to be agile and adaptable in order to respond to the ever-changing business landscape. We need to be able to quickly pivot and change course when necessary. We also need to be able to collaborate effectively with our partners and stakeholders in order to achieve our goals. +Gruntwork Pipelines can be used with any external CI/CD tool. The role of the CI/CD tool is to trigger jobs +inside Gruntwork Pipelines. We have [example configurations](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/master/examples/for-production/infrastructure-live/_ci/scripts) +that identify changed terraform modules and call the Gruntwork Pipelines invoker lambda. -## Invoker Lambda +By default, the invoker lambda is run by a CLI tool called `infrastructure-deployer` from within your CI tool. -Oh my goodness, have I told you about the time I saw a beautiful Blue Jay perched on my windowsill? It was truly a sight to behold! But I digress... let me tell you about AWS Lambda functions, which are like the busy little hummingbirds of the cloud computing world. +## ECS Deploy Runner -Picture this: a Lambda function is like a bird feeder that sits and waits for requests to come in, just like a bird feeder waits for feathered friends to come and snack. But instead of seed, it's programmed to receive code and execute it. +The [ECS Deploy Runner Module](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner) +is a flexible framework for running pre-defined, locked-down jobs in an isolated +ECS task. It serves as the foundation for Gruntwork Pipelines. +The components described below work together to trigger jobs, validate them, run them, and stream +the logs back to your CI tool as if they were running locally. -## ECS Deploy Runner +### Infrastructure Deployer CLI -Hark! Let me spin you a tale of wondrous tool, -That doth aid in deploying software cool. -This tool, 'tis known as ECS Deploy Runner, -A champion of those who deploy with honor. +This [CLI tool](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/infrastructure-deployer) +serves as the interface between your chosen CI tool and Gruntwork Pipelines. It is used to trigger +jobs in the deploy runner. Primarily, it calls instances of the invoker lambda described in the next section. -In Amazon's world of cloud, it doth reside, -Where containers reign with power and pride. -This runner, like a loyal squire true, -Doth serve those who would deploy anew. +Usage: -With ECS as its liege, it doth obey, -And to the cloud, it doth make its way. -In rolling updates, it doth excel, -Ensuring no downtime, all shall be well. +`infrastructure-deployer --aws-region AWS_REGION [other options] -- CONTAINER_NAME SCRIPT ARGS...` -### Standard Configuration +When launching a task, you may optionally set the following useful flags: -Its mission, to deploy with utmost care, -And make the process smooth, beyond compare. -With blue-green deployments, it doth impress, -And safely switches traffic without stress. +- `max-wait-time` (default 2h0m0s) - timeout length for the action +- `task-cpu` - A custom number of CPU units to allocate to the ECS task +- `task-memory` - A custom number of memory units to allocate to the ECS task -And when the task is done, it doth report, -On all that happened, to provide support. -With logs and metrics, it doth reveal, -The story of the deployment's ordeal. +To get the list of supported containers and scripts, pass in the --describe-containers option. For example: -### Docker Image Builder (Kaniko) +`infrastructure-deployer --describe-containers --aws-region us-west-2` -And lo, there was a tool called Kaniko, born of the land of Google, and it was a builder of Docker images. And the people did marvel at its greatness, for it did not require the use of a Docker daemon, nor did it need root privileges. +This will list all the containers and the scripts for each container that can be invoked using the invoker function of +the ECS deploy runner stack deployed in us-west-2. -Kaniko was a humble tool, born of the desire to provide a secure and reliable way to build Docker images in a Kubernetes environment. It did not seek glory or power, but instead sought to serve the people, to make their lives easier and their applications more secure. -And Kaniko did work diligently, using its many talents to build Docker images in a way that was both efficient and trustworthy. It did not rely on a Docker daemon, but instead used a container to perform the build process, ensuring that the image was built in a clean and isolated environment. +### Invoker Lambda + +The [Invoker Lambda](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/main_lambda.tf) +is a lambda function written in python that acts as the AWS entrypoint for your pipeline. +It has 3 primary roles: + +1. Serving as a gatekeeper for pipelines runs, determining if a particular command is allowed to be run, and if the arguments are valid +2. Creating ECS tasks that run terraform, docker, or packer commands +3. Shipping deployment logs back to your CI/CD tool + +### Standard Configuration -And the people did praise Kaniko, for it did not require root privileges, and could be run by users without fear of compromising the system. It did not store secrets in the Docker daemon, but instead used a secure file system to store them, ensuring that they could not be accessed by unauthorized parties. +The ECS deploy runner is flexible and can be configured for many tasks. The [standard configuration](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner-standard-configuration) +is a set of 4 ECS task definitions that we ship with Pipelines by default. +Once you have your pipeline deployed you can [modify](../maintain/extending.md) the configuration as you like. +The configuration defines what scripts are accepted by the invoker lambda and which arguments may be provided. The invoker lambda +will reject ANY script or argument not defined in the ECS Deploy Runner configuration. +The 4 default tasks are defined below. -### Terraform Planner/Applier +#### Docker Image Builder (Kaniko) -In the realm of deployment, there exist powerful tools that rival the strength and cunning of even the most feared warriors. Among them, the ECS Deploy Runner, Terraform Planner, and Applier stand tall, ready to unleash their might upon the field of battle. +The Docker Image Builder task definition allows CI jobs to build docker images. +This ECS task uses an open source library called [Kaniko](https://github.com/GoogleContainerTools/kaniko) to enable docker builds from within a docker container. +We provide a [docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/kaniko) based on kaniko for this task. -The ECS Deploy Runner is like a fierce direwolf, swift and agile, capable of executing complex deployment tasks with ease. It is the tool of choice for those who seek to deploy their applications with speed and precision. +#### Packer AMI Builder -The Terraform Planner is like a wise and ancient dragon, possessing an almost infinite knowledge of the infrastructure it seeks to conquer. With its keen intellect, it can survey the land and plan the deployment with utmost accuracy, leaving no stone unturned in its quest for victory. +The Packer AMI Builder task definition allows CI jobs to build AMIs using HashiCorp Packer. This task runs in +a [docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/deploy-runner) we provide. -The Applier, on the other hand, is like a steadfast and loyal knight, resolute in its determination to carry out the orders of its master. With unflinching obedience, it applies the deployment plan, ensuring that every detail is executed with precision and care. +#### Terraform Planner and Applier -Together, these tools form a formidable trio, capable of conquering even the most daunting deployment challenges. They are the guardians of the realm of deployment, and those who are wise enough to enlist their aid can rest assured that their applications will be deployed with the utmost efficiency and effectiveness. +The Terraform Planner task definition and Terraform Applier task definition are very similar. They allow CI jobs to +plan and apply terraform and terragrunt code. These tasks run in the same [docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/deploy-runner) +as the AMI builder From c2ed66a210a62cf3fdb3b1106d3361be620bbbc7 Mon Sep 17 00:00:00 2001 From: Andrew Ellison Date: Mon, 22 May 2023 14:06:13 -0500 Subject: [PATCH 56/89] [CORE-910] pipelines intro (#807) * add overview section to gruntwork pipelines * Update _docs-sources/pipelines/what-is-it/index.md Co-authored-by: Max Moon * Update _docs-sources/pipelines/what-is-it/index.md Co-authored-by: Max Moon --------- Co-authored-by: Max Moon --- _docs-sources/pipelines/what-is-it/index.md | 22 ++++++++++++++++--- docs/pipelines/what-is-it/index.md | 24 +++++++++++++++++---- 2 files changed, 39 insertions(+), 7 deletions(-) diff --git a/_docs-sources/pipelines/what-is-it/index.md b/_docs-sources/pipelines/what-is-it/index.md index 270b11f1c0..12f7f50586 100644 --- a/_docs-sources/pipelines/what-is-it/index.md +++ b/_docs-sources/pipelines/what-is-it/index.md @@ -1,8 +1,24 @@ # Overview -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. At lectus urna duis convallis convallis tellus id interdum velit. Pretium vulputate sapien nec sagittis aliquam. Tristique senectus et netus et. Nullam eget felis eget nunc lobortis mattis aliquam faucibus purus. Aliquet sagittis id consectetur purus ut. Lectus magna fringilla urna porttitor rhoncus dolor. Eget felis eget nunc lobortis mattis aliquam faucibus purus in. Erat nam at lectus urna duis convallis convallis. Euismod lacinia at quis risus sed vulputate odio. +Gruntwork Pipelines is a framework that enables you to use your preferred CI tool to +securely run an end-to-end pipeline for infrastructure code (Terraform) and +app code (Docker or Packer). Rather than replace your existing CI/CD provider, Gruntwork Pipelines is designed to enhance the security +of your existing tool. + +Because applying Terraform requires full access to your AWS environment, +your CI/CD tool would require admin level credentials to any AWS account where you deploy infrastructure. +This makes it trivial for anyone with access to your CI/CD system to access AWS credentials with permissions +greater than they might otherwise need. +Gruntwork Pipelines allows a highly restricted set of permissions to be supplied to the CI/CD tool while +infrastructure related permissions reside within your own AWS account. This reduces the exposure of your +high value AWS secrets. + +## Features + +- Set up a secure Terraform or Terragrunt Pipeline based on best practices +- Run deployments using EC2 or Fargate on ECS +- Build Docker or Packer images +- Stream output logs to CloudWatch -# Secure by Design -This is a paragraph. It might not seem long enough, but it is. diff --git a/docs/pipelines/what-is-it/index.md b/docs/pipelines/what-is-it/index.md index 505328b8fc..a0efe52d90 100644 --- a/docs/pipelines/what-is-it/index.md +++ b/docs/pipelines/what-is-it/index.md @@ -1,16 +1,32 @@ # Overview -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. At lectus urna duis convallis convallis tellus id interdum velit. Pretium vulputate sapien nec sagittis aliquam. Tristique senectus et netus et. Nullam eget felis eget nunc lobortis mattis aliquam faucibus purus. Aliquet sagittis id consectetur purus ut. Lectus magna fringilla urna porttitor rhoncus dolor. Eget felis eget nunc lobortis mattis aliquam faucibus purus in. Erat nam at lectus urna duis convallis convallis. Euismod lacinia at quis risus sed vulputate odio. +Gruntwork Pipelines is a framework that enables you to use your preferred CI tool to +securely run an end-to-end pipeline for infrastructure code (Terraform) and +app code (Docker or Packer). Rather than replace your existing CI/CD provider, Gruntwork Pipelines is designed to enhance the security +of your existing tool. + +Because applying arbitrary terraform requires full access to your AWS environment, +your CI/CD tool would require admin level credentials to any AWS account where you deploy infrastructure. +This makes it trivial for anyone with access to your CI/CD system (usually a long list) to access AWS credentials with permissions +greater than they might otherwise need. +Gruntwork Pipelines allows a highly restricted set of permissions to be supplied to the CI/CD tool while +infrastructure related permissions reside within your own AWS account. This reduces the exposure of your +high value AWS secrets. + +## Features + +- Set up a secure Terraform or Terragrunt Pipeline based on best practices +- Run deployments using EC2 or Fargate on ECS +- Build Docker or Packer images +- Stream output logs to CloudWatch -# Secure by Design -This is a paragraph. It might not seem long enough, but it is. From f961659a0d84f304f9377ba36d74731f249d552e Mon Sep 17 00:00:00 2001 From: Ryan Russell Date: Tue, 23 May 2023 10:01:08 -0700 Subject: [PATCH 57/89] IaC Overview Updates - CORE-908 (#811) --- .../iac/getting-started/deploying-a-module.md | 2 +- .../iac/{whats-this => overview}/index.md | 8 ++--- .../iac/{whats-this => overview}/modules.md | 12 +++---- .../iac/{whats-this => overview}/services.md | 16 +++++---- .../intro/overview/intro-to-gruntwork.md | 2 +- .../intro/overview/what-we-provide.md | 2 +- _docs-sources/products.md | 2 +- .../iac/getting-started/deploying-a-module.md | 4 +-- docs/iac/overview/index.md | 35 +++++++++++++++++++ docs/iac/overview/modules.md | 30 ++++++++++++++++ docs/iac/{whats-this => overview}/services.md | 20 ++++++----- docs/iac/whats-this/index.md | 33 ----------------- docs/iac/whats-this/modules.md | 28 --------------- docs/intro/overview/intro-to-gruntwork.md | 4 +-- docs/intro/overview/what-we-provide.md | 4 +-- docs/pipelines/how-it-works/index.md | 16 ++++----- docs/pipelines/what-is-it/index.md | 6 ++-- docs/products.md | 4 +-- docusaurus.config.js | 2 +- sidebars/iac.js | 6 ++-- 20 files changed, 122 insertions(+), 114 deletions(-) rename _docs-sources/iac/{whats-this => overview}/index.md (84%) rename _docs-sources/iac/{whats-this => overview}/modules.md (69%) rename _docs-sources/iac/{whats-this => overview}/services.md (66%) create mode 100644 docs/iac/overview/index.md create mode 100644 docs/iac/overview/modules.md rename docs/iac/{whats-this => overview}/services.md (56%) delete mode 100644 docs/iac/whats-this/index.md delete mode 100644 docs/iac/whats-this/modules.md diff --git a/_docs-sources/iac/getting-started/deploying-a-module.md b/_docs-sources/iac/getting-started/deploying-a-module.md index e27dfe4d21..42bd4b002b 100644 --- a/_docs-sources/iac/getting-started/deploying-a-module.md +++ b/_docs-sources/iac/getting-started/deploying-a-module.md @@ -1,6 +1,6 @@ # Deploying your first module -[Modules](../whats-this/modules.md) allow you to define an interface to create one or many resources in the cloud or on-premise. Similar to how in object oriented programming you can define a class that may have different attribute values across many instances. +[Modules](../overview/modules.md) allow you to define an interface to create one or many resources in the cloud or on-premise. Similar to how in object oriented programming you can define a class that may have different attribute values across many instances. Modules help keep your Terraform code DRY (Don't Repeat Yourself), and speed up development time when creating new resources. diff --git a/_docs-sources/iac/whats-this/index.md b/_docs-sources/iac/overview/index.md similarity index 84% rename from _docs-sources/iac/whats-this/index.md rename to _docs-sources/iac/overview/index.md index 4f53c423c1..fd2a1d19c6 100644 --- a/_docs-sources/iac/whats-this/index.md +++ b/_docs-sources/iac/overview/index.md @@ -1,18 +1,18 @@ # What is the Infrastructure as Code Library? -The Gruntwork Infrastructure as Code Library (IaC Library) is a collection of reusable code that enables you to deploy and manage infrastructure quickly and reliably. It promotes code reusability, modularity, and consistency in infrastructure deployments. We've taken the thousands of hours we spent building infrastructure on AWS and condensed all that experience and code into pre-built packages or modules. +The Gruntwork Infrastructure as Code Library (IaC Library) is a collection of reusable code that enables you to deploy and manage infrastructure quickly and reliably. It promotes code reusability, modularity, and consistency in infrastructure deployments. We’ve taken the thousands of hours we spent building infrastructure on AWS and condensed all that experience and code into pre-built packages or modules. The library consists of two types of code: Modules & Services ## Modules -Modules are reusable code components that are used to deploy and manage specific pieces of infrastructure. These modules encapsulate the configuration and resource definitions required to create and manage a particular component, such as a VPC, ECS cluster, or an Auto Scaling Group. For more information on modules check out the [Modules page](/iac/whats-this/modules/). +Modules are reusable code components that are used to deploy and manage specific pieces of infrastructure. These modules encapsulate the configuration and resource definitions required to create and manage a particular component, such as a VPC, ECS cluster, or an Auto Scaling Group. For more information on modules check out the [Modules page](/iac/overview/modules/). ## Services Services in the service catalog are reusable code that combines multiple modules from the IaC Library, simplifying the deployment and management of complex infrastructure configurations. Rather than dealing with individual modules and their dependencies, users can directly deploy services tailored for a particular use case. -For more information on the service catalog check out the [Services page](/iac/whats-this/services/). +For more information on the service catalog check out the [Services page](/iac/overview/services/). ## Tools used in the IaC Library @@ -24,4 +24,4 @@ The Gruntwork IaC Library is deployed using the following tools: 1. [Packer](https://www.packer.io/). Used to define and manage _machine images_ (e.g., VM images). The main use case is to package code as [Amazon Machine Images (AMIs)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html) - that run on EC2 instances. Once you've built an AMI, you use Terraform to deploy it into AWS. + that run on EC2 instances. Once you’ve built an AMI, you use Terraform to deploy it into AWS. diff --git a/_docs-sources/iac/whats-this/modules.md b/_docs-sources/iac/overview/modules.md similarity index 69% rename from _docs-sources/iac/whats-this/modules.md rename to _docs-sources/iac/overview/modules.md index ac0f59797c..b79224b468 100644 --- a/_docs-sources/iac/whats-this/modules.md +++ b/_docs-sources/iac/overview/modules.md @@ -4,20 +4,20 @@ Modules are reusable code components that encapsulate the configuration and reso Gruntwork modules are tested in AWS, in a randomly selected region, each time it changes to verify the infrastructure created matches the desired configuration. -## When do you use a Module? +## When should I use a module? -The Gruntwork Infrastructure as Code (IaC) Library contains hundreds of modules that you can use and combine. These modules are fairly generic building blocks, so you don't typically deploy a single module directly. Instead, you write code that combines the modules you need for a specific use case. +The Gruntwork Infrastructure as Code (IaC) Library contains hundreds of modules that you can use and combine. These modules are fairly generic building blocks, so you don’t typically deploy a single module directly. Instead, you write code that combines the modules you need for a specific use case. -For example, one module might deploy the control plane for Kubernetes and a separate module could deploy worker nodes; you may need to combine both modules together to deploy a Kubernetes cluster, or use the `eks-cluster` service from the [Service Catalog](/iac/whats-this/services/). +For example, one module might deploy the control plane for Kubernetes and a separate module could deploy worker nodes; you may need to combine both modules together to deploy a Kubernetes cluster. -For a full list of modules available, refer to the [Gruntwork Infrastructure as Code Library](https://gruntwork.io/infrastructure-as-code-library/). +We recommend our [Service Catalog](/iac/overview/services/) for common use cases, but our full Module Catalog is available if you have a more complex use case. For a full list of modules available, refer to the [Gruntwork Infrastructure as Code Library](/iac/reference/). -## How to navigate modules in the IaC Library +## How services are structured The code in the module repos are organized into three primary folders: 1. `modules`: The core implementation code. All of the modules that you will use and deploy are defined within. For example to ECS cluster module in the `terraform-aws-ecs` repo in `modules/ecs-cluster`. -1. `examples`: Sample code that shows how to use the modules in the `modules` folder and allows you to try them out without having to write any code: `cd` into one of the folders, follow a few steps in the README (e.g. run `terraform apply`), and you'll have a fully working module up and running. In other words, this is executable documentation. +1. `examples`: Sample code that shows how to use the modules in the `modules` folder and allows you to try them out without having to write any code: `cd` into one of the folders, follow a few steps in the README (e.g. run `terraform apply`), and you’ll have a fully working module up and running. In other words, this is executable documentation. 1. `test`: Automated tests for the code in modules and examples. \ No newline at end of file diff --git a/_docs-sources/iac/whats-this/services.md b/_docs-sources/iac/overview/services.md similarity index 66% rename from _docs-sources/iac/whats-this/services.md rename to _docs-sources/iac/overview/services.md index 39c39606a4..dafc476029 100644 --- a/_docs-sources/iac/whats-this/services.md +++ b/_docs-sources/iac/overview/services.md @@ -1,24 +1,26 @@ # What is a Service? -The Gruntwork Service Catalog consists of a number of reusable, customizable, production-grade infrastructure-as-code services that you can use to deploy and manage your infrastructure. This includes Docker orchestration, EC2 orchestration, load balancing, networking, databases, caches, monitoring, alerting, CI/CD, secrets management, VPN, and much more. +The Gruntwork Service Catalog consists of a number of customizable, production-grade infrastructure-as-code services that you can use to deploy and manage your infrastructure. This includes Docker orchestration, EC2 orchestration, load balancing, networking, databases, caches, monitoring, alerting, CI/CD, secrets management, VPN, and much more. -## When do you use a Service? +## When should I use a service? -Services in the service catalog are reusable code that combines multiple modules. These are designed for specific use cases such as EKS and ECS clusters, VPCs with public and private subnets, and databases. Using a service can save you time piecing together individual modules and testing that they're correctly referencing each other. +Services combine multiple modules to configure an end-to-end solution. These are designed for specific use cases such as EKS and ECS clusters, VPCs with public and private subnets, and databases. Using a service can save you time piecing together individual modules and testing that they’re correctly referencing each other. -For example, the `eks-cluster` service combines all the modules you need to run an EKS (Kubernetes) cluster in a typical production environment, including modules for the control plane, worker nodes, secrets management, log aggregation, alerting, and so on. +For example, the `eks-cluster` service combines all the modules you need to run an EKS (Kubernetes) cluster in a typical production environment, including modules for the control plane, worker nodes, secrets management, log aggregation, alerting, and so on. -## How to navigate services in the IaC Library +If you need more flexibility than our services provide, then you can combine modules from our [Module Catalog](/iac/overview/modules), your own modules, or open source modules to meet your specific use case. + +## How services are structured The code in the `terraform-aws-service-catalog` repo is organized into three primary folders: 1. `modules`: The core implementation code of this repo. All the services that you will use and deploy are defined within, such as the EKS cluster service in modules/services/eks-cluster. -1. `examples`: Sample code that shows how to use the services in the modules folder and allows you to try the services out without having to write any code: you `cd` into one of the folders, follow a few steps in the README (e.g., run `terraform apply`), and you'll have fully working infrastructure up and running. In other words, this is executable documentation. Note that the examples folder contains two sub-folders: +1. `examples`: Sample code that shows how to use the services in the modules folder and allows you to try the services out without having to write any code: you `cd` into one of the folders, follow a few steps in the README (e.g., run `terraform apply`), and you’ll have fully working infrastructure up and running. In other words, this is executable documentation. Note that the examples folder contains two sub-folders: 1. `for-learning-and-testing`: Example code that is optimized for learning, experimenting, and testing, but not direct production usage. Most of these examples use Terraform directly to make it easy to fill in dependencies - that are convenient for testing, but not necessarily those you'd use in production: e.g., default VPCs or mock + that are convenient for testing, but not necessarily those you’d use in production: e.g., default VPCs or mock database URLs. 1. `for-production`: Example code optimized for direct usage in production. This is code from the [Gruntwork Reference diff --git a/_docs-sources/intro/overview/intro-to-gruntwork.md b/_docs-sources/intro/overview/intro-to-gruntwork.md index e4aa497507..dd81dc7fa4 100644 --- a/_docs-sources/intro/overview/intro-to-gruntwork.md +++ b/_docs-sources/intro/overview/intro-to-gruntwork.md @@ -11,4 +11,4 @@ All Gruntwork products are built on and fully compatible with [Terraform](https: There are two fundamental ways to engage Gruntwork: 1. **Gruntwork builds your architecture.** We generate the [Reference Architecture](https://gruntwork.io/reference-architecture/) based on your needs, deploy into your AWS accounts, and give you 100% of the code. Since you have all the code, you can extend, enhance, and customize the environment exactly according to your needs. See [the docs](/refarch/whats-this/what-is-a-reference-architecture) for more information about our Reference Architecture. -2. **Build it yourself.** The Gruntwork IaC library empowers you to construct your own bespoke architecture in record time. By mix-and-matching our [modules](/iac/whats-this/modules) and [services](/iac/whats-this/services) you can quickly define a custom architecture to suit your needs, all with the confidence of having world-class, battle-tested code running under the hood. +2. **Build it yourself.** The Gruntwork IaC library empowers you to construct your own bespoke architecture in record time. By mix-and-matching our [modules](/iac/overview/modules) and [services](/iac/overview/services) you can quickly define a custom architecture to suit your needs, all with the confidence of having world-class, battle-tested code running under the hood. diff --git a/_docs-sources/intro/overview/what-we-provide.md b/_docs-sources/intro/overview/what-we-provide.md index 03c5f27056..4643f9022d 100644 --- a/_docs-sources/intro/overview/what-we-provide.md +++ b/_docs-sources/intro/overview/what-we-provide.md @@ -10,7 +10,7 @@ A battle-tested, production-grade _catalog_ of infrastructure code that contains - App orchestration — ECS, EC2, Kubernetes, and more - Data storage — Aurora, Elasticache, RDS, and more - Best-practice security baselines -- _and [more…](/iac/whats-this)_ +- _and [more…](/iac/overview)_ ## Support diff --git a/_docs-sources/products.md b/_docs-sources/products.md index c39c55ac4d..bfb98b70cc 100644 --- a/_docs-sources/products.md +++ b/_docs-sources/products.md @@ -15,7 +15,7 @@ import CenterLayout from "/src/components/CenterLayout" + href="/iac/overview/"> Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. diff --git a/docs/iac/overview/index.md b/docs/iac/overview/index.md new file mode 100644 index 0000000000..1f52d6df33 --- /dev/null +++ b/docs/iac/overview/index.md @@ -0,0 +1,35 @@ +# What is the Infrastructure as Code Library? + +The Gruntwork Infrastructure as Code Library (IaC Library) is a collection of reusable code that enables you to deploy and manage infrastructure quickly and reliably. It promotes code reusability, modularity, and consistency in infrastructure deployments. We’ve taken the thousands of hours we spent building infrastructure on AWS and condensed all that experience and code into pre-built packages or modules. + +The library consists of two types of code: Modules & Services + +## Modules + +Modules are reusable code components that are used to deploy and manage specific pieces of infrastructure. These modules encapsulate the configuration and resource definitions required to create and manage a particular component, such as a VPC, ECS cluster, or an Auto Scaling Group. For more information on modules check out the [Modules page](/iac/overview/modules/). + +## Services + +Services in the service catalog are reusable code that combines multiple modules from the IaC Library, simplifying the deployment and management of complex infrastructure configurations. Rather than dealing with individual modules and their dependencies, users can directly deploy services tailored for a particular use case. + +For more information on the service catalog check out the [Services page](/iac/overview/services/). + +## Tools used in the IaC Library + +The Gruntwork IaC Library is deployed using the following tools: + +1. [Terraform](https://www.terraform.io/). Used to define and manage most of the basic infrastructure, such as servers, databases, load balancers, and networking. The Gruntwork Service Catalog is compatible with vanilla [Terraform](https://www.terraform.io/), [Terragrunt](https://terragrunt.gruntwork.io/), [Terraform + Cloud](https://www.hashicorp.com/blog/announcing-terraform-cloud/), and [Terraform + Enterprise](https://www.terraform.io/docs/enterprise/index.html). + +1. [Packer](https://www.packer.io/). Used to define and manage _machine images_ (e.g., VM images). The main use case is + to package code as [Amazon Machine Images (AMIs)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html) + that run on EC2 instances. Once you’ve built an AMI, you use Terraform to deploy it into AWS. + + + diff --git a/docs/iac/overview/modules.md b/docs/iac/overview/modules.md new file mode 100644 index 0000000000..3d57edc987 --- /dev/null +++ b/docs/iac/overview/modules.md @@ -0,0 +1,30 @@ +# What is a Module? + +Modules are reusable code components that encapsulate the configuration and resource definitions needed to deploy and manage a specific piece of infrastructure, such as a VPC, ECS cluster, or Auto Scaling Group. Each module defines several AWS resources. For example, the VPC module contains resource definitions for subnets, nat gateways, and more. Modules promote code reusability, modularity, and consistency in infrastructure deployments and can be customized in a variety of ways. + +Gruntwork modules are tested in AWS, in a randomly selected region, each time it changes to verify the infrastructure created matches the desired configuration. + +## When should I use a module? + +The Gruntwork Infrastructure as Code (IaC) Library contains hundreds of modules that you can use and combine. These modules are fairly generic building blocks, so you don’t typically deploy a single module directly. Instead, you write code that combines the modules you need for a specific use case. + +For example, one module might deploy the control plane for Kubernetes and a separate module could deploy worker nodes; you may need to combine both modules together to deploy a Kubernetes cluster. + +We recommend our [Service Catalog](/iac/overview/services/) for common use cases, but our full Module Catalog is available if you have a more complex use case. For a full list of modules available, refer to the [Gruntwork Infrastructure as Code Library](/iac/reference/). + +## How services are structured + +The code in the module repos are organized into three primary folders: + +1. `modules`: The core implementation code. All of the modules that you will use and deploy are defined within. For example to ECS cluster module in the `terraform-aws-ecs` repo in `modules/ecs-cluster`. + +1. `examples`: Sample code that shows how to use the modules in the `modules` folder and allows you to try them out without having to write any code: `cd` into one of the folders, follow a few steps in the README (e.g. run `terraform apply`), and you’ll have a fully working module up and running. In other words, this is executable documentation. + +1. `test`: Automated tests for the code in modules and examples. + + diff --git a/docs/iac/whats-this/services.md b/docs/iac/overview/services.md similarity index 56% rename from docs/iac/whats-this/services.md rename to docs/iac/overview/services.md index 802ae2e149..67e3b33970 100644 --- a/docs/iac/whats-this/services.md +++ b/docs/iac/overview/services.md @@ -1,24 +1,26 @@ # What is a Service? -The Gruntwork Service Catalog consists of a number of reusable, customizable, battle-tested, production-grade infrastructure-as-code services that you can use to deploy and manage your infrastructure, including Docker orchestration, EC2 orchestration, load balancing, networking, databases, caches, monitoring, alerting, CI/CD, secrets management, VPN, and much more. +The Gruntwork Service Catalog consists of a number of customizable, production-grade infrastructure-as-code services that you can use to deploy and manage your infrastructure. This includes Docker orchestration, EC2 orchestration, load balancing, networking, databases, caches, monitoring, alerting, CI/CD, secrets management, VPN, and much more. -## When do you use a Service? +## When should I use a service? -Services in the service catalog are reusable code that combines multiple modules to configure a service for a specific use case. These are designed for specific use cases and meant to be deployed directly. +Services combine multiple modules to configure an end-to-end solution. These are designed for specific use cases such as EKS and ECS clusters, VPCs with public and private subnets, and databases. Using a service can save you time piecing together individual modules and testing that they’re correctly referencing each other. -For example, the eks-cluster service combines all the modules you need to run an EKS (Kubernetes) cluster in a typical production environment, including modules for the control plane, worker nodes, secrets management, log aggregation, alerting, and so on. +For example, the `eks-cluster` service combines all the modules you need to run an EKS (Kubernetes) cluster in a typical production environment, including modules for the control plane, worker nodes, secrets management, log aggregation, alerting, and so on. -## How to navigate services in the IaC Library +If you need more flexibility than our services provide, then you can combine modules from our [Module Catalog](/iac/overview/modules), your own modules, or open source modules to meet your specific use case. + +## How services are structured The code in the `terraform-aws-service-catalog` repo is organized into three primary folders: 1. `modules`: The core implementation code of this repo. All the services that you will use and deploy are defined within, such as the EKS cluster service in modules/services/eks-cluster. -1. `examples`: Sample code that shows how to use the services in the modules folder and allows you to try the services out without having to write any code: you `cd` into one of the folders, follow a few steps in the README (e.g., run `terraform apply`), and you'll have fully working infrastructure up and running. In other words, this is executable documentation. Note that the examples folder contains two sub-folders: +1. `examples`: Sample code that shows how to use the services in the modules folder and allows you to try the services out without having to write any code: you `cd` into one of the folders, follow a few steps in the README (e.g., run `terraform apply`), and you’ll have fully working infrastructure up and running. In other words, this is executable documentation. Note that the examples folder contains two sub-folders: 1. `for-learning-and-testing`: Example code that is optimized for learning, experimenting, and testing, but not - direct production usage). Most of these examples use Terraform directly to make it easy to fill in dependencies - that are convenient for testing, but not necessarily those you'd use in production: e.g., default VPCs or mock + direct production usage. Most of these examples use Terraform directly to make it easy to fill in dependencies + that are convenient for testing, but not necessarily those you’d use in production: e.g., default VPCs or mock database URLs. 1. `for-production`: Example code optimized for direct usage in production. This is code from the [Gruntwork Reference @@ -37,6 +39,6 @@ The code in the `terraform-aws-service-catalog` repo is organized into three pri diff --git a/docs/iac/whats-this/index.md b/docs/iac/whats-this/index.md deleted file mode 100644 index b7175bdbf4..0000000000 --- a/docs/iac/whats-this/index.md +++ /dev/null @@ -1,33 +0,0 @@ -# What is the Infrastructure as Code Library? - -The Gruntwork Infrastructure as Code Library (IaC Library) is a collection of reusable code that enables you to deploy and manage infrastructure quickly and reliably. We've taken the thousands of hours we spent building infrastructure on AWS and condensed all that experience and code into pre-built packages or modules. - -The library consists of two types of code: Modules & Services - -## Modules - -Modules are reusable code to deploy and manage one piece of infrastructure and each one is a battle-tested, best-practices definition of a piece of infrastructure, such as a VPC, ECS cluster, or an Auto Scaling Group. For more information on modules check out the [Modules page](/iac/whats-this/modules/) - -## Services - -Services in the service catalog are reusable code that combines multiple modules to configure a service for a specific use case. These are designed for specific use cases and meant to be deployed directly. For more information on the service catalog check out the [Services page](/iac/whats-this/services/) - -## The tools used in the IaC Library - -The Gruntwork IaC Library is designed to be deployed using the following tools: - -1. [Terraform](https://www.terraform.io/). Used to define and manage most of the basic infrastructure, such as servers, databases, load balancers, and networking. The Gruntwork Service Catalog is compatible with vanilla [Terraform](https://www.terraform.io/), [Terragrunt](https://terragrunt.gruntwork.io/), [Terraform - Cloud](https://www.hashicorp.com/blog/announcing-terraform-cloud/), and [Terraform - Enterprise](https://www.terraform.io/docs/enterprise/index.html). - -1. [Packer](https://www.packer.io/). Used to define and manage _machine images_ (e.g., VM images). The main use case is - to package code as [Amazon Machine Images (AMIs)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html) - that run on EC2 instances. Once you've built an AMI, you use Terraform to deploy it into AWS. - - - diff --git a/docs/iac/whats-this/modules.md b/docs/iac/whats-this/modules.md deleted file mode 100644 index 52bdc43cd0..0000000000 --- a/docs/iac/whats-this/modules.md +++ /dev/null @@ -1,28 +0,0 @@ -# What is a Module? - -Modules are reusable code to deploy and manage one piece of infrastructure and each one is a battle-tested, best-practices definition of a piece of infrastructure, such as a VPC, ECS cluster, or an Auto Scaling Group. - -## When do you use a Module? - -Modules are fairly generic building blocks, so you don't typically deploy a single module directly, but rather, you write code that combines the modules you need for a specific use case. - -For example, one module might deploy the control plane for Kubernetes and a separate module could deploy worker nodes; you may need to combine both modules together to deploy a Kubernetes cluster, or use the `eks-cluster` service from the [Service Catalog](/iac/whats-this/services/). - -The Gruntwork Infrastructure as Code (IaC) Library contains hundreds of battle-tested, commercially supported and maintained modules that you can use and combine in many different ways. Modules are versioned using Semantic Versioning to allow Gruntwork clients to keep up to date with the latest infrastructure best practices in a systematic way. - -## How to navigate modules in the IaC Library - -The code in the module repos are organized into three primary folders: - -1. `modules`: The core implementation code. All of the modules that you will use and deploy are defined within. For example to ECS cluster module in the `terraform-aws-ecs` repo in `modules/ecs-cluster`. - -1. `examples`: Sample code that shows how to use the modules in the `modules` folder and allows you to try them out without having to write any code: you `cd` into one of the folders, follow a few steps in the README (e.g. run `terraform apply`), and you'll have a fully working module up and running. In other words, this is executable documentation. - -1. `test`: Automated tests for the code in modules and examples. - - diff --git a/docs/intro/overview/intro-to-gruntwork.md b/docs/intro/overview/intro-to-gruntwork.md index 91f0360ebf..b970d87311 100644 --- a/docs/intro/overview/intro-to-gruntwork.md +++ b/docs/intro/overview/intro-to-gruntwork.md @@ -11,12 +11,12 @@ All Gruntwork products are built on and fully compatible with [Terraform](https: There are two fundamental ways to engage Gruntwork: 1. **Gruntwork builds your architecture.** We generate the [Reference Architecture](https://gruntwork.io/reference-architecture/) based on your needs, deploy into your AWS accounts, and give you 100% of the code. Since you have all the code, you can extend, enhance, and customize the environment exactly according to your needs. See [the docs](/refarch/whats-this/what-is-a-reference-architecture) for more information about our Reference Architecture. -2. **Build it yourself.** The Gruntwork IaC library empowers you to construct your own bespoke architecture in record time. By mix-and-matching our [modules](/iac/whats-this/modules) and [services](/iac/whats-this/services) you can quickly define a custom architecture to suit your needs, all with the confidence of having world-class, battle-tested code running under the hood. +2. **Build it yourself.** The Gruntwork IaC library empowers you to construct your own bespoke architecture in record time. By mix-and-matching our [modules](/iac/overview/modules) and [services](/iac/overview/services) you can quickly define a custom architecture to suit your needs, all with the confidence of having world-class, battle-tested code running under the hood. diff --git a/docs/intro/overview/what-we-provide.md b/docs/intro/overview/what-we-provide.md index 2913bfd980..4f13e6f358 100644 --- a/docs/intro/overview/what-we-provide.md +++ b/docs/intro/overview/what-we-provide.md @@ -10,7 +10,7 @@ A battle-tested, production-grade _catalog_ of infrastructure code that contains - App orchestration — ECS, EC2, Kubernetes, and more - Data storage — Aurora, Elasticache, RDS, and more - Best-practice security baselines -- _and [more…](/iac/whats-this)_ +- _and [more…](/iac/overview)_ ## Support @@ -44,6 +44,6 @@ Once the infrastructure is deployed, Gruntwork engineers deliver the full Infras diff --git a/docs/pipelines/how-it-works/index.md b/docs/pipelines/how-it-works/index.md index 97741e1870..6a35fcfe4e 100644 --- a/docs/pipelines/how-it-works/index.md +++ b/docs/pipelines/how-it-works/index.md @@ -8,9 +8,9 @@ Gruntwork Pipelines can be used with any external CI/CD tool. The role of the CI/CD tool is to trigger jobs inside Gruntwork Pipelines. We have [example configurations](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/master/examples/for-production/infrastructure-live/_ci/scripts) -that identify changed terraform modules and call the Gruntwork Pipelines invoker lambda. +that identify changed terraform modules and call the Gruntwork Pipelines invoker Lambda function. -By default, the invoker lambda is run by a CLI tool called `infrastructure-deployer` from within your CI tool. +By default, the invoker Lambda function is run by a CLI tool called `infrastructure-deployer` from within your CI tool. ## ECS Deploy Runner @@ -22,7 +22,7 @@ the logs back to your CI tool as if they were running locally. ### Infrastructure Deployer CLI -This [CLI tool](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/infrastructure-deployer) +The [infrastructure deployer cli tool](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/infrastructure-deployer) serves as the interface between your chosen CI tool and Gruntwork Pipelines. It is used to trigger jobs in the deploy runner. Primarily, it calls instances of the invoker lambda described in the next section. @@ -47,7 +47,7 @@ the ECS deploy runner stack deployed in us-west-2. ### Invoker Lambda The [Invoker Lambda](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/main_lambda.tf) -is a lambda function written in python that acts as the AWS entrypoint for your pipeline. +is an AWS Lambda function written in python that acts as the AWS entrypoint for your pipeline. It has 3 primary roles: 1. Serving as a gatekeeper for pipelines runs, determining if a particular command is allowed to be run, and if the arguments are valid @@ -59,7 +59,7 @@ It has 3 primary roles: The ECS deploy runner is flexible and can be configured for many tasks. The [standard configuration](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner-standard-configuration) is a set of 4 ECS task definitions that we ship with Pipelines by default. Once you have your pipeline deployed you can [modify](../maintain/extending.md) the configuration as you like. -The configuration defines what scripts are accepted by the invoker lambda and which arguments may be provided. The invoker lambda +The configuration defines what scripts are accepted by the invoker Lambda and which arguments may be provided. The invoker Lambda will reject ANY script or argument not defined in the ECS Deploy Runner configuration. The 4 default tasks are defined below. @@ -67,12 +67,12 @@ The 4 default tasks are defined below. The Docker Image Builder task definition allows CI jobs to build docker images. This ECS task uses an open source library called [Kaniko](https://github.com/GoogleContainerTools/kaniko) to enable docker builds from within a docker container. -We provide a [docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/kaniko) based on kaniko for this task. +We provide a [Docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/kaniko) based on kaniko for this task. #### Packer AMI Builder The Packer AMI Builder task definition allows CI jobs to build AMIs using HashiCorp Packer. This task runs in -a [docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/deploy-runner) we provide. +a [Docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/deploy-runner) we provide. #### Terraform Planner and Applier @@ -84,6 +84,6 @@ as the AMI builder diff --git a/docs/pipelines/what-is-it/index.md b/docs/pipelines/what-is-it/index.md index a0efe52d90..2c2ce04377 100644 --- a/docs/pipelines/what-is-it/index.md +++ b/docs/pipelines/what-is-it/index.md @@ -5,9 +5,9 @@ securely run an end-to-end pipeline for infrastructure code (Terraform) and app code (Docker or Packer). Rather than replace your existing CI/CD provider, Gruntwork Pipelines is designed to enhance the security of your existing tool. -Because applying arbitrary terraform requires full access to your AWS environment, +Because applying Terraform requires full access to your AWS environment, your CI/CD tool would require admin level credentials to any AWS account where you deploy infrastructure. -This makes it trivial for anyone with access to your CI/CD system (usually a long list) to access AWS credentials with permissions +This makes it trivial for anyone with access to your CI/CD system to access AWS credentials with permissions greater than they might otherwise need. Gruntwork Pipelines allows a highly restricted set of permissions to be supplied to the CI/CD tool while infrastructure related permissions reside within your own AWS account. This reduces the exposure of your @@ -27,6 +27,6 @@ high value AWS secrets. diff --git a/docs/products.md b/docs/products.md index 8bae3f2493..be8ded9285 100644 --- a/docs/products.md +++ b/docs/products.md @@ -15,7 +15,7 @@ import CenterLayout from "/src/components/CenterLayout" + href="/iac/overview/"> Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. diff --git a/docusaurus.config.js b/docusaurus.config.js index 9355e84947..f41219cab7 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -102,7 +102,7 @@ const config = { { type: "doc", label: "Infrastructure as Code Library", - docId: "iac/whats-this/index" + docId: "iac/overview/index" }, { type: "doc", diff --git a/sidebars/iac.js b/sidebars/iac.js index fd386acd0c..73bf90bc8b 100644 --- a/sidebars/iac.js +++ b/sidebars/iac.js @@ -9,9 +9,9 @@ const sidebar = [ type: "category", collapsible: false, items: [ - "iac/whats-this/index", - "iac/whats-this/modules", - "iac/whats-this/services", + "iac/overview/index", + "iac/overview/modules", + "iac/overview/services", ], }, { From 005092c5ab37d55b75335511c4784d97028718d3 Mon Sep 17 00:00:00 2001 From: Max Moon Date: Wed, 24 May 2023 09:03:37 -0700 Subject: [PATCH 58/89] feat(CORE-949): Add pipelines maintenance guide (#801) * add updating your pipeline guide * add extending your pipeline guide --------- Co-authored-by: Ryan Russell --- _docs-sources/pipelines/maintain/extending.md | 118 ++++++++++++++++- _docs-sources/pipelines/maintain/updating.md | 96 +++++++++++++- docs/pipelines/maintain/extending.md | 120 +++++++++++++++++- docs/pipelines/maintain/updating.md | 98 +++++++++++++- 4 files changed, 418 insertions(+), 14 deletions(-) diff --git a/_docs-sources/pipelines/maintain/extending.md b/_docs-sources/pipelines/maintain/extending.md index ac12f43773..4db2a6e284 100644 --- a/_docs-sources/pipelines/maintain/extending.md +++ b/_docs-sources/pipelines/maintain/extending.md @@ -1,7 +1,119 @@ # Extending your Pipeline -Ug ug. Me type. You read. Me make words for big brain. Me use stick on rock. Me try hard. You see? +Pipelines can be extended to support building and deploying application code in many repositories. This guide demonstrates how to update which repositories are allowed to submit requests to Pipelines to build docker images. -Me have idea. Me tell you story. Long time ago, big mammoth roam land. Caveman hunt mammoth. Caveman win. Caveman happy. -Me tired now. Me rest. You like words? Me make more later. Ug ug. +## Adding a repository + +Pipelines has separate configurations for each type of job that can be performed (e.g., building a docker image, running terraform plan, running terraform apply). An allow-list of repos and branches is defined for each job type, which can be updated to extend your usage of pipelines to additional application repositories. + +This guide focuses on building Docker images for applications repos, if you have repositories for which you would like to run `terraform plan` or `terraform apply` jobs, similar steps can be followed, modifying the appropriate task configurations. + +### RefArch + +First, define a module for your application by following the guide on [how to deploy your apps into the Reference Architecture](../../guides/reference-architecture/example-usage-guide/deploy-apps/intro). + +Next, open `shared//mgmt/ecs-deploy-runner/terragrunt.hcl` and update `docker_image_builder_config.allowed_repos` to include the HTTPS Git URL of the application repo for which you would like to deploy Docker images. + +Since pipelines [cannot update itself](./updating.md), you must run `terragrunt plan` and `terragrunt apply` manually to deploy the change from your local machine. Run `terragrunt plan` to inspect the changes that will be made to your pipeline. Once the changes have been reviewed, run `terragrunt apply` to deploy the changes. + +### Standalone + +If you've deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, you will need to locate the file in which you've defined a module block sourcing the `ecs-deploy-runner` service. + +Once the `ecs-deploy-runner` module block is located, update the `allowed_repos` list in the `docker_image_builder_config` variable to include the HTTPS Git URL of the application repo for which you would like to deploy Docker images. + +Refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for full configuration details. + +Run `terraform plan` to inspect the changes that will be made to your pipeline. Once the changes have been reviewed, run `terraform apply` to deploy the changes. To deploy the application to ECS or EKS you will need to deploy a task definition (ECS) or Deployment (EKS) that references the newly built image. + +### Adding infrastructure deployer to the new repo (RefArch & Standalone) + +Pipelines can be triggered from Github events in many repositories. In order to configure Pipelines for the new repository, you need to add a step in your CI/CD configuration for the repository that uses the `infrastructure-deployer` CLI tool to trigger Docker image builds. + +```sh +export ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text) +export DEPLOY_RUNNER_REGION=$(aws configure get region) +export ECR_REPO_URL="${ACCOUNT_ID}.dkr.ecr.${DEPLOY_RUNNER_REGION}.amazonaws.com" +export DOCKER_TAG=$(git rev-parse --short HEAD) +export REPOSITORY_NAME="example" +export GITHUB_ORG="example-org" + +infrastructure-deployer --aws-region "us-east-1" -- docker-image-builder build-docker-image \ + --repo "https://github.com/${GITHUB_ORG}/${REPOSITORY_NAME}" \ + --ref "origin/main" \ + --context-path "path/to/directory/with/dockerfile/" \ + --docker-image-tag "${ECR_REPO_URL}/${REPOSITORY_NAME}:${DOCKER_TAG}" \ +``` + +## Updating branches that can be deployed + +Pipelines can be configured to only allow jobs to be performed on specific branches. For example, a common configuration is to allow `terraform plan` or `terragrunt plan` jobs for Pull Requests, and only allow `terraform apply` or `terragrunt apply` to run on merges to the main branch. + +Depending on your use case, you may need to modify the allow-list to only allow a pre-defined list of branch names. + +### RefArch + +Open `shared//mgmt/ecs-deploy-runner/terragrunt.hcl` and update the values the `allowed_apply_git_refs` attribute for the job configuration you would like to modify (either `terraform_planner_config` or `terraform_applier_config`). + +Run `terragrunt plan` to inspect the changes that will be made to your pipeline. Once the changes have been reviewed, run `terragrunt apply` to deploy the changes. + +### Standalone + +If you've deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, you will need to locate the file in which you've defined a module block sourcing the `ecs-deploy-runner` service. + +By default, the `ecs-deploy-runner` service from the Service Catalog allows any git ref to be applied. After you locate the module block for `ecs-deploy-runner`, modify the `allowed_apply_git_refs` attribute for the job configuration that you would like to modify (either `terraform_planner_config` or `terraform_applier_config`). + +Run `terraform plan` to inspect the changes that will be made to your pipeline. Once the changes have been reviewed, run `terraform apply` to deploy the changes. + +## Adding script arguments + +The `deploy-runner` Docker image for Pipelines only allows scripts within a single directory to be executed in the ECS task as an additional security measure. + +By default, the `deploy-runner` ships with three scripts - one to build HashiCorp Packer images, one to run `terraform plan` and `terraform apply`, and one to automatically update the value of a variable in a Terraform tfvars or Terragrunt HCL file. + +If you need to run a custom script in the `deploy-runner`, you must fork the image code, add an additional line to copy your script into directory designated by the `trigger_directory` argument. Then, you will need to rebuild the Docker image, push to ECR, then update your Pipelines deployment following the steps in [Updating Pipelines](./updating.md). + +## Adding permissions + +Pipelines executes in ECS tasks running in your AWS account(s). Each task (terraform planner, applier, docker builder, ami builder) has a distinct execution IAM role with only the permissions each task requires to complete successfully. + +If you are expanding your usage of AWS to include an AWS service you've never used before, you will need to grant each job sufficient permissions to access that service. +For example, if you need to create an Amazon DynamoDB Table using Pipelines for the first time, you would want to add (at a minimum) the ability to list and describe tables to the policy for the `planner` IAM role, and all permissions for DynamoDB to the IAM policy for the `terraform-applier` IAM role. + +We recommend that the `planner` configuration have read only access to resources, and the applier be able to read, create, modify, and destroy resources. + +### RefArch + +If you've deployed Pipelines as a part of your Reference Architecture, the permissions for the `terraform-planner` task are located in `_envcommon/mgmt/read_only_permissions.yml` and the permissions for the `terraform-applier` task are located in `_envcommon/mgmt/deploy_permissions.yml`. Open and add the required permissions to each file. + +After you are done updating both files, you will need to run `terragrunt plan`, review the changes, then `terragrunt apply` for each account in your Reference Architecture. +```sh +cd logs/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-logs -- terragrunt apply --terragrunt-source-update -auto-approve + +cd shared/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-shared -- terragrunt apply --terragrunt-source-update -auto-approve + +cd security/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-security -- terragrunt apply --terragrunt-source-update -auto-approve + +cd dev/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-dev -- terragrunt apply --terragrunt-source-update -auto-approve + +cd stage/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-stage -- terragrunt apply --terragrunt-source-update -auto-approve + +cd prod/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-prod -- terragrunt apply --terragrunt-source-update -auto-approve +``` + +### Standalone + +If you've deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, , you will need to locate the file in which you've defined a module block sourcing the `ecs-deploy-runner` service. + +Modify the AWS IAM policy document being passed into the `iam_policy` variable for the [terraform_applier_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_applier_config) and the [terraform_planner_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_planner_config) variables. + +Refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for the full set of configuration details for this service. + +After you are done updating the IAM policy documents, run `terraform plan` then review the changes that will be made. Finally, run `terraform apply` to apply the changes. diff --git a/_docs-sources/pipelines/maintain/updating.md b/_docs-sources/pipelines/maintain/updating.md index 23837c7ac3..4e72fb1c88 100644 --- a/_docs-sources/pipelines/maintain/updating.md +++ b/_docs-sources/pipelines/maintain/updating.md @@ -1,6 +1,96 @@ # Updating Your Pipeline -Is there anything more frustrating than having to put up with those obnoxious notifications and the seemingly never-ending cycle of downloads, installs, and reboots? Every time you think you've finally managed to get your computer to run smoothly, those darn updates come along and mess everything up again. -And let's not forget how unpredictable they can be! One minute you're casually browsing the internet, and the next minute your computer is stuck in an update loop, wasting your time and energy. And don't even try to cancel or pause an update once it's started - that's a recipe for disaster. +Pipelines is built using the terraform-aws-ci module. We recommend updating your pipeline whenever there's a new release of the module. -And the worst part? Even when the updates are finally finished, there's no guarantee that everything will work as it should. You could end up with new bugs, glitches, or compatibility issues that you never had before. +By default, Pipelines cannot update it's own infrastructure (ECS cluster, AWS Lambda function, etc). This safeguard is in place to prevent you from accidentally locking yourself out of the pipeline when applying a change to permissions. + +For example, if you change the IAM permissions of the CI user, you may no longer be able to run the pipeline. The pipeline job that updates the permissions will also be affected by the change. This is a difficult scenario to recover from, since you will have lost access to make further changes using Pipelines. + +## Prerequisites + +This guide assumes you have the following: +- An AWS account with permissions to create the necessary resources +- An [AWS Identity and Access Management](https://aws.amazon.com/iam/) (IAM) user or role with permissions to start pipelines deployments and update AWS Lambda functions +- [AWS Command Line Interface](https://aws.amazon.com/cli/) (AWS CLI) installed on your local machine +- [infrastructure-deployer](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/infrastructure-deployer) CLI tool installed locally +- [aws-vault](https://www.github.com/99designs/aws-vault) installed locally for authenticating to AWS + +## Updating container images + +Gruntwork Pipelines uses two images - one for the [Deploy Runner](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/docker/deploy-runner/Dockerfile) and one for [Kaniko](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/docker/kaniko/Dockerfile). To update pipelines to the latest version, you must build and push new versions of each image. + +### Build and push images + +Pipelines has the ability to build container images, including the images it uses. You can use the `infrastructure-deployer` CLI tool locally to start building the new image versions. This is the same tool used by Pipelines in your CI system. + +```sh +export ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text) +export DEPLOY_RUNNER_REGION=$(aws configure get region) +export DOCKERFILE_REPO="https://github.com/gruntwork-io/terraform-aws-ci.git" +export ECR_REPO_URL="${ACCOUNT_ID}.dkr.ecr.${DEPLOY_RUNNER_REGION}.amazonaws.com" +export TERRAFORM_AWS_CI_VERSION="v0.52.1" + +# Builds and pushes the deploy runner image +infrastructure-deployer --aws-region "$DEPLOY_RUNNER_REGION" -- docker-image-builder build-docker-image \ + --repo "$DOCKERFILE_REPO" \ + --ref "$TERRAFORM_AWS_CI_VERSION" \ + --context-path "modules/ecs-deploy-runner/docker/deploy-runner" \ + --env-secret 'github-token=GITHUB_OAUTH_TOKEN' \ + --docker-image-tag "${ECR_REPO_URL}/ecs-deploy-runner:${TERRAFORM_AWS_CI_VERSION}" \ + --build-arg "module_ci_tag=$TERRAFORM_AWS_CI_VERSION" + +# Builds and pushes the kaniko image +infrastructure-deployer --aws-region "$DEPLOY_RUNNER_REGION" -- docker-image-builder build-docker-image \ + --repo "$DOCKERFILE_REPO" \ + --ref "$TERRAFORM_AWS_CI_VERSION" \ + --context-path "modules/ecs-deploy-runner/docker/kaniko" \ + --env-secret 'github-token=GITHUB_OAUTH_TOKEN' \ + --docker-image-tag "${ECR_REPO_URL}/kaniko:${TERRAFORM_AWS_CI_VERSION}" \ + --build-arg "module_ci_tag=$TERRAFORM_AWS_CI_VERSION" +``` +Each image may take a few minutes to build and push, this is expected. Once both images are built, you can update the image tag in your terraform module and update the infrastructure. + +## Updating infrastructure + +Next, update the references to these images to the new tag values. This will vary depending on if you're using Pipelines as configured by the Reference Architecture or if you've deployed Pipelines as a standalone framework. + +### Updating tag values (RefArch) + +Update `common.hcl` with new tag values for these images. The new tag value will be version of terraform-aws-ci that the images use. For example, if your newly created images are using the v0.52.1 release of terraform-aws-ci, update common.hcl to: + +``` +deploy_runner_container_image_tag = "v0.52.1" +kaniko_container_image_tag = "v0.52.1" +``` + +Next, apply the ecs-deploy-runner module in each account: +```sh +cd logs/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-logs -- terragrunt apply --terragrunt-source-update -auto-approve + +cd shared/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-shared -- terragrunt apply --terragrunt-source-update -auto-approve + +cd security/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-security -- terragrunt apply --terragrunt-source-update -auto-approve + +cd dev/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-dev -- terragrunt apply --terragrunt-source-update -auto-approve + +cd stage/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-stage -- terragrunt apply --terragrunt-source-update -auto-approve + +cd prod/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-prod -- terragrunt apply --terragrunt-source-update -auto-approve +``` + +### Updating tag values (standalone) + +If you've deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for configuration details. You will need to update the `docker_tag` value in the `container_image` object for the [ami_builder_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#ami_builder_config), [docker_image_builder_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#docker_image_builder_config), [terraform_applier_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_applier_config), and [terraform_planner_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_planner_config) variables. + +Once you have updated any references to the container image tags, you will need to run `terraform plan` and `terraform apply` in each account where pipelines is deployed. + + +### What's next + +Now that you've learned how to update your pipeline, the next step is to extend your pipeline to customize the configuration to suite your needs. diff --git a/docs/pipelines/maintain/extending.md b/docs/pipelines/maintain/extending.md index 8218ca17e6..30b7083f33 100644 --- a/docs/pipelines/maintain/extending.md +++ b/docs/pipelines/maintain/extending.md @@ -1,15 +1,127 @@ # Extending your Pipeline -Ug ug. Me type. You read. Me make words for big brain. Me use stick on rock. Me try hard. You see? +Pipelines can be extended to support building and deploying application code in many repositories. This guide demonstrates how to update which repositories are allowed to submit requests to Pipelines to build docker images. -Me have idea. Me tell you story. Long time ago, big mammoth roam land. Caveman hunt mammoth. Caveman win. Caveman happy. -Me tired now. Me rest. You like words? Me make more later. Ug ug. +## Adding a repository + +Pipelines has separate configurations for each type of job that can be performed (e.g., building a docker image, running terraform plan, running terraform apply). An allow-list of repos and branches is defined for each job type, which can be updated to extend your usage of pipelines to additional application repositories. + +This guide focuses on building Docker images for applications repos, if you have repositories for which you would like to run `terraform plan` or `terraform apply` jobs, similar steps can be followed, modifying the appropriate task configurations. + +### RefArch + +First, define a module for your application by following the guide on [how to deploy your apps into the Reference Architecture](../../guides/reference-architecture/example-usage-guide/deploy-apps/intro). + +Next, open `shared//mgmt/ecs-deploy-runner/terragrunt.hcl` and update `docker_image_builder_config.allowed_repos` to include the HTTPS Git URL of the application repo for which you would like to deploy Docker images. + +Since pipelines [cannot update itself](./updating.md), you must run `terragrunt plan` and `terragrunt apply` manually to deploy the change from your local machine. Run `terragrunt plan` to inspect the changes that will be made to your pipeline. Once the changes have been reviewed, run `terragrunt apply` to deploy the changes. + +### Standalone + +If you've deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, you will need to locate the file in which you've defined a module block sourcing the `ecs-deploy-runner` service. + +Once the `ecs-deploy-runner` module block is located, update the `allowed_repos` list in the `docker_image_builder_config` variable to include the HTTPS Git URL of the application repo for which you would like to deploy Docker images. + +Refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for full configuration details. + +Run `terraform plan` to inspect the changes that will be made to your pipeline. Once the changes have been reviewed, run `terraform apply` to deploy the changes. To deploy the application to ECS or EKS you will need to deploy a task definition (ECS) or Deployment (EKS) that references the newly built image. + +### Adding infrastructure deployer to the new repo (RefArch & Standalone) + +Pipelines can be triggered from Github events in many repositories. In order to configure Pipelines for the new repository, you need to add a step in your CI/CD configuration for the repository that uses the `infrastructure-deployer` CLI tool to trigger Docker image builds. + +```sh +export ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text) +export DEPLOY_RUNNER_REGION=$(aws configure get region) +export ECR_REPO_URL="${ACCOUNT_ID}.dkr.ecr.${DEPLOY_RUNNER_REGION}.amazonaws.com" +export DOCKER_TAG=$(git rev-parse --short HEAD) +export REPOSITORY_NAME="example" +export GITHUB_ORG="example-org" + +infrastructure-deployer --aws-region "us-east-1" -- docker-image-builder build-docker-image \ + --repo "https://github.com/${GITHUB_ORG}/${REPOSITORY_NAME}" \ + --ref "origin/main" \ + --context-path "path/to/directory/with/dockerfile/" \ + --docker-image-tag "${ECR_REPO_URL}/${REPOSITORY_NAME}:${DOCKER_TAG}" \ +``` + +## Updating branches that can be deployed + +Pipelines can be configured to only allow jobs to be performed on specific branches. For example, a common configuration is to allow `terraform plan` or `terragrunt plan` jobs for Pull Requests, and only allow `terraform apply` or `terragrunt apply` to run on merges to the main branch. + +Depending on your use case, you may need to modify the allow-list to only allow a pre-defined list of branch names. + +### RefArch + +Open `shared//mgmt/ecs-deploy-runner/terragrunt.hcl` and update the values the `allowed_apply_git_refs` attribute for the job configuration you would like to modify (either `terraform_planner_config` or `terraform_applier_config`). + +Run `terragrunt plan` to inspect the changes that will be made to your pipeline. Once the changes have been reviewed, run `terragrunt apply` to deploy the changes. + +### Standalone + +If you've deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, you will need to locate the file in which you've defined a module block sourcing the `ecs-deploy-runner` service. + +By default, the `ecs-deploy-runner` service from the Service Catalog allows any git ref to be applied. After you locate the module block for `ecs-deploy-runner`, modify the `allowed_apply_git_refs` attribute for the job configuration that you would like to modify (either `terraform_planner_config` or `terraform_applier_config`). + +Run `terraform plan` to inspect the changes that will be made to your pipeline. Once the changes have been reviewed, run `terraform apply` to deploy the changes. + +## Adding script arguments + +The `deploy-runner` Docker image for Pipelines only allows scripts within a single directory to be executed in the ECS task as an additional security measure. + +By default, the `deploy-runner` ships with three scripts - one to build HashiCorp Packer images, one to run `terraform plan` and `terraform apply`, and one to automatically update the value of a variable in a Terraform tfvars or Terragrunt HCL file. + +If you need to run a custom script in the `deploy-runner`, you must fork the image code, add an additional line to copy your script into directory designated by the `trigger_directory` argument. Then, you will need to rebuild the Docker image, push to ECR, then update your Pipelines deployment following the steps in [Updating Pipelines](./updating.md). + +## Adding permissions + +Pipelines executes in ECS tasks running in your AWS account(s). Each task (terraform planner, applier, docker builder, ami builder) has a distinct execution IAM role with only the permissions each task requires to complete successfully. + +If you are expanding your usage of AWS to include an AWS service you've never used before, you will need to grant each job sufficient permissions to access that service. +For example, if you need to create an Amazon DynamoDB Table using Pipelines for the first time, you would want to add (at a minimum) the ability to list and describe tables to the policy for the `planner` IAM role, and all permissions for DynamoDB to the IAM policy for the `terraform-applier` IAM role. + +We recommend that the `planner` configuration have read only access to resources, and the applier be able to read, create, modify, and destroy resources. + +### RefArch + +If you've deployed Pipelines as a part of your Reference Architecture, the permissions for the `terraform-planner` task are located in `_envcommon/mgmt/read_only_permissions.yml` and the permissions for the `terraform-applier` task are located in `_envcommon/mgmt/deploy_permissions.yml`. Open and add the required permissions to each file. + +After you are done updating both files, you will need to run `terragrunt plan`, review the changes, then `terragrunt apply` for each account in your Reference Architecture. +```sh +cd logs/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-logs -- terragrunt apply --terragrunt-source-update -auto-approve + +cd shared/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-shared -- terragrunt apply --terragrunt-source-update -auto-approve + +cd security/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-security -- terragrunt apply --terragrunt-source-update -auto-approve + +cd dev/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-dev -- terragrunt apply --terragrunt-source-update -auto-approve + +cd stage/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-stage -- terragrunt apply --terragrunt-source-update -auto-approve + +cd prod/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-prod -- terragrunt apply --terragrunt-source-update -auto-approve +``` + +### Standalone + +If you've deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, , you will need to locate the file in which you've defined a module block sourcing the `ecs-deploy-runner` service. + +Modify the AWS IAM policy document being passed into the `iam_policy` variable for the [terraform_applier_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_applier_config) and the [terraform_planner_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_planner_config) variables. + +Refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for the full set of configuration details for this service. + +After you are done updating the IAM policy documents, run `terraform plan` then review the changes that will be made. Finally, run `terraform apply` to apply the changes. diff --git a/docs/pipelines/maintain/updating.md b/docs/pipelines/maintain/updating.md index 13c2a65ec5..8ef74d3d33 100644 --- a/docs/pipelines/maintain/updating.md +++ b/docs/pipelines/maintain/updating.md @@ -1,14 +1,104 @@ # Updating Your Pipeline -Is there anything more frustrating than having to put up with those obnoxious notifications and the seemingly never-ending cycle of downloads, installs, and reboots? Every time you think you've finally managed to get your computer to run smoothly, those darn updates come along and mess everything up again. -And let's not forget how unpredictable they can be! One minute you're casually browsing the internet, and the next minute your computer is stuck in an update loop, wasting your time and energy. And don't even try to cancel or pause an update once it's started - that's a recipe for disaster. +Pipelines is built using the terraform-aws-ci module. We recommend updating your pipeline whenever there's a new release of the module. -And the worst part? Even when the updates are finally finished, there's no guarantee that everything will work as it should. You could end up with new bugs, glitches, or compatibility issues that you never had before. +By default, Pipelines cannot update it's own infrastructure (ECS cluster, AWS Lambda function, etc). This safeguard is in place to prevent you from accidentally locking yourself out of the pipeline when applying a change to permissions. + +For example, if you change the IAM permissions of the CI user, you may no longer be able to run the pipeline. The pipeline job that updates the permissions will also be affected by the change. This is a difficult scenario to recover from, since you will have lost access to make further changes using Pipelines. + +## Prerequisites + +This guide assumes you have the following: +- An AWS account with permissions to create the necessary resources +- An [AWS Identity and Access Management](https://aws.amazon.com/iam/) (IAM) user or role with permissions to start pipelines deployments and update AWS Lambda functions +- [AWS Command Line Interface](https://aws.amazon.com/cli/) (AWS CLI) installed on your local machine +- [infrastructure-deployer](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/infrastructure-deployer) CLI tool installed locally +- [aws-vault](https://www.github.com/99designs/aws-vault) installed locally for authenticating to AWS + +## Updating container images + +Gruntwork Pipelines uses two images - one for the [Deploy Runner](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/docker/deploy-runner/Dockerfile) and one for [Kaniko](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/docker/kaniko/Dockerfile). To update pipelines to the latest version, you must build and push new versions of each image. + +### Build and push images + +Pipelines has the ability to build container images, including the images it uses. You can use the `infrastructure-deployer` CLI tool locally to start building the new image versions. This is the same tool used by Pipelines in your CI system. + +```sh +export ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text) +export DEPLOY_RUNNER_REGION=$(aws configure get region) +export DOCKERFILE_REPO="https://github.com/gruntwork-io/terraform-aws-ci.git" +export ECR_REPO_URL="${ACCOUNT_ID}.dkr.ecr.${DEPLOY_RUNNER_REGION}.amazonaws.com" +export TERRAFORM_AWS_CI_VERSION="v0.52.1" + +# Builds and pushes the deploy runner image +infrastructure-deployer --aws-region "$DEPLOY_RUNNER_REGION" -- docker-image-builder build-docker-image \ + --repo "$DOCKERFILE_REPO" \ + --ref "$TERRAFORM_AWS_CI_VERSION" \ + --context-path "modules/ecs-deploy-runner/docker/deploy-runner" \ + --env-secret 'github-token=GITHUB_OAUTH_TOKEN' \ + --docker-image-tag "${ECR_REPO_URL}/ecs-deploy-runner:${TERRAFORM_AWS_CI_VERSION}" \ + --build-arg "module_ci_tag=$TERRAFORM_AWS_CI_VERSION" + +# Builds and pushes the kaniko image +infrastructure-deployer --aws-region "$DEPLOY_RUNNER_REGION" -- docker-image-builder build-docker-image \ + --repo "$DOCKERFILE_REPO" \ + --ref "$TERRAFORM_AWS_CI_VERSION" \ + --context-path "modules/ecs-deploy-runner/docker/kaniko" \ + --env-secret 'github-token=GITHUB_OAUTH_TOKEN' \ + --docker-image-tag "${ECR_REPO_URL}/kaniko:${TERRAFORM_AWS_CI_VERSION}" \ + --build-arg "module_ci_tag=$TERRAFORM_AWS_CI_VERSION" +``` +Each image may take a few minutes to build and push, this is expected. Once both images are built, you can update the image tag in your terraform module and update the infrastructure. + +## Updating infrastructure + +Next, update the references to these images to the new tag values. This will vary depending on if you're using Pipelines as configured by the Reference Architecture or if you've deployed Pipelines as a standalone framework. + +### Updating tag values (RefArch) + +Update `common.hcl` with new tag values for these images. The new tag value will be version of terraform-aws-ci that the images use. For example, if your newly created images are using the v0.52.1 release of terraform-aws-ci, update common.hcl to: + +``` +deploy_runner_container_image_tag = "v0.52.1" +kaniko_container_image_tag = "v0.52.1" +``` + +Next, apply the ecs-deploy-runner module in each account: +```sh +cd logs/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-logs -- terragrunt apply --terragrunt-source-update -auto-approve + +cd shared/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-shared -- terragrunt apply --terragrunt-source-update -auto-approve + +cd security/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-security -- terragrunt apply --terragrunt-source-update -auto-approve + +cd dev/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-dev -- terragrunt apply --terragrunt-source-update -auto-approve + +cd stage/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-stage -- terragrunt apply --terragrunt-source-update -auto-approve + +cd prod/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner +aws-vault exec your-prod -- terragrunt apply --terragrunt-source-update -auto-approve +``` + +### Updating tag values (standalone) + +If you've deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for configuration details. You will need to update the `docker_tag` value in the `container_image` object for the [ami_builder_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#ami_builder_config), [docker_image_builder_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#docker_image_builder_config), [terraform_applier_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_applier_config), and [terraform_planner_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_planner_config) variables. + +Once you have updated any references to the container image tags, you will need to run `terraform plan` and `terraform apply` in each account where pipelines is deployed. + + +### What's next + +Now that you've learned how to update your pipeline, the next step is to extend your pipeline to customize the configuration to suite your needs. From e7d4f3daa81cf2fa9f96307425d8509fed36efa2 Mon Sep 17 00:00:00 2001 From: Oreoluwa Agunbiade <21035422+oredavids@users.noreply.github.com> Date: Wed, 24 May 2023 13:02:21 -0600 Subject: [PATCH 59/89] Fix Dev portal FAQ link and sort results (#813) --- sidebars/developer-portal.js | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sidebars/developer-portal.js b/sidebars/developer-portal.js index c9a994cf6b..d57d683f71 100644 --- a/sidebars/developer-portal.js +++ b/sidebars/developer-portal.js @@ -1,6 +1,7 @@ const developerPortalKnowledgeBaseDiscussions = - "https://github.com/orgs/gruntwork-io/discussions?" + - encodeURIComponent("discussions_q=label:s:dev-portal") + "https://github.com/orgs/gruntwork-io/discussions?discussions_q=" + + // filter by discussions with the label "s:dev-portal" & sort by top voted discussions first + encodeURIComponent("label:s:dev-portal sort:top") const sidebar = [ { From a15e8d3a7672224c22b4b3681dc8346508bbeee6 Mon Sep 17 00:00:00 2001 From: Max Moon Date: Thu, 25 May 2023 07:08:21 -0700 Subject: [PATCH 60/89] Chore: Address feedback from review session (#814) * Address feedback from Eben --- .../iac/getting-started/accessing-the-code.md | 4 +-- .../iac/getting-started/deploying-a-module.md | 34 +++++++++--------- .../iac/getting-started/setting-up.md | 14 ++++---- _docs-sources/iac/stay-up-to-date/updating.md | 6 ++-- .../iac/stay-up-to-date/versioning.md | 6 ++-- .../iac/getting-started/accessing-the-code.md | 6 ++-- .../iac/getting-started/deploying-a-module.md | 36 +++++++++---------- docs/iac/getting-started/setting-up.md | 16 ++++----- docs/iac/overview/index.md | 4 +-- docs/iac/stay-up-to-date/updating.md | 8 ++--- docs/iac/stay-up-to-date/versioning.md | 8 ++--- 11 files changed, 67 insertions(+), 75 deletions(-) diff --git a/_docs-sources/iac/getting-started/accessing-the-code.md b/_docs-sources/iac/getting-started/accessing-the-code.md index 6ee170b321..a8fbdc23c5 100644 --- a/_docs-sources/iac/getting-started/accessing-the-code.md +++ b/_docs-sources/iac/getting-started/accessing-the-code.md @@ -1,8 +1,6 @@ # Accessing the code -Gruntwork provides all code included in your subscription to the Infrastructure as Code (IaC) library through GitHub. - -To gain access to the IaC Library, link your GitHub ID to your account in the Developer Portal. Follow the steps outlined in the Developer Portal guide on [linking your Github ID](../../developer-portal/link-github-id). +Gruntwork provides all code included in your subscription to the Infrastructure as Code (IaC) library through GitHub. To gain access to the IaC Library, you must first [create an account in the Developer Portal](../../developer-portal/create-account.md). Once you have an account, you must [link your Github ID](../../developer-portal/link-github-id) to your Developer Portal account to gain access to the IaC Library. ## Accessing Modules and Services in the IaC library diff --git a/_docs-sources/iac/getting-started/deploying-a-module.md b/_docs-sources/iac/getting-started/deploying-a-module.md index 42bd4b002b..ab97257b23 100644 --- a/_docs-sources/iac/getting-started/deploying-a-module.md +++ b/_docs-sources/iac/getting-started/deploying-a-module.md @@ -1,10 +1,10 @@ # Deploying your first module -[Modules](../overview/modules.md) allow you to define an interface to create one or many resources in the cloud or on-premise. Similar to how in object oriented programming you can define a class that may have different attribute values across many instances. +[Modules](../overview/modules.md) allow you to define an interface to create one or many resources in the cloud or on-premise, similar to how in object oriented programming you can define a class that may have different attribute values across many instances. -Modules help keep your Terraform code DRY (Don't Repeat Yourself), and speed up development time when creating new resources. +Modules help keep your Terraform code DRY (Don’t Repeat Yourself), and speed up development time when creating new resources. -This tutorial will teach you how to develop a Terraform module that deploys an AWS Lambda function. We will create the required file structure, define an AWS Lambda function and AWS IAM role as code, then plan and apply the resource in an AWS account. Then, we’ll verify the deployment by invoking the Lambda using the AWS CLI. +This tutorial will teach you how to develop a Terraform module that deploys an AWS Lambda function. We will create the required file structure, define an AWS Lambda function and AWS IAM role as code, then plan and apply the resource in an AWS account. Then, we’ll verify the deployment by invoking the Lambda using the AWS CLI. Finally, we'll clean up the resources we create to avoid unexpected costs. ## Prerequisites - An AWS account with permissions to create the necessary resources @@ -14,7 +14,7 @@ This tutorial will teach you how to develop a Terraform module that deploys an A ## Create the module -In this section you'll create a Terraform module that can create an AWS Lambda function and IAM role. This module will include three files - `main.tf` which will contain the resource definitions, `variables.tf`, which specifies the possible inputs to the module, and `outputs.tf`, which specifies the values that can be used to pass references to attributes from the resources in the module. +In this section you’ll create a Terraform module that can create an AWS Lambda function and IAM role. This module will include three files — `main.tf` which will contain the resource definitions, `variables.tf`, which specifies the possible inputs to the module, and `outputs.tf`, which specifies the values that can be used to pass references to attributes from the resources in the module. This module could be referenced many times to create any number of AWS Lambda functions and IAM roles. @@ -76,7 +76,7 @@ resource "aws_lambda_function" "lambda" { ### Specify the variables for the module -Now that you've defined the resources you want to create, you need to list out all of the variables that you want to allow users to pass into the variable. In the module, you can reference these values in the module using the `var` syntax, as visible in `terraform-aws-gw-lambda/modules/lambda/main.tf`. +Now that you’ve defined the resources you want to create, you need to list out all of the variables that you want to allow users to pass into the module. You can reference these values in the module using the `var` syntax, as visible in `terraform-aws-gw-lambda/modules/lambda/main.tf`. Copy the following snippet into `terraform-aws-gw-lambda-tutorial/modules/lambda/variables.tf`. @@ -116,7 +116,7 @@ variable "timeout" { ### Specify the outputs -Terraform allows you to specify values that will be outputted by the module. Outputs are convenient ways to pass values between modules when composing a service comprised of many modules. +Terraform allows you to specify values that the module will output. Outputs are convenient ways to pass values between modules when composing a service comprised of many modules. Copy the following snippet into `terraform-aws-gw-lambda-tutorial/modules/lambda/outputs.tf`. ```tf @@ -131,7 +131,7 @@ Now that you have defined a module that creates an AWS Lambda function and IAM r ### Create the basic file structure -Now that you have the module defined, you need to create files which will reference the module. Typically, you would create a module in one repository, then reference it in a different repository. For this tutorial, we'll just create the reference in the top level directory for the sake of simplicity. +Now that you have the module defined, you need to create files which will reference the module. Typically, you would create a module in one repository, then reference it in a different repository. For this tutorial, we’ll just create the reference in the top level directory for the sake of simplicity. Create a file called `main.tf`, which will contain a reference to the module, and a file called `main.py`, which will contain the Lambda function code. ```sh @@ -141,7 +141,7 @@ touch terraform-aws-gw-lambda-tutorial/main.py ### Write the function code -Next, we'll write a simple Python function that returns a string that will be used as the entrypoint of the AWS Lambda function. Terraform will create a zip file containing this file that will be uploaded to the Lambda function. +Next, we’ll write a simple Python function that returns a string that will be used as the entrypoint of the AWS Lambda function. Terraform will create a zip file containing this file that will be uploaded to the Lambda function. Copy the following to `terraform-aws-gw-lambda-tutorial/main.py`. ``` @@ -184,7 +184,7 @@ output "function_name" { Terraform will generate an execution plan using the `plan` action. The plan will show what resources Terraform determines need to be created or modified. -Running `terraform plan` is helpful when developing modules, to confirm that the Terraform code you are writing, and to confirm what resources will be created or modified when applying the module in your AWS account. +Running `terraform plan` is helpful when developing modules, to confirm that the Terraform code you are writing are using the correct syntax, and to confirm what resources will be created or modified when applying the module in your AWS account. From the `terraform-aws-gw-lambda-tutorial` directory, run a plan to see what resources will be created. @@ -197,7 +197,7 @@ Review the output of `terraform plan`, it should contain two resources - an AWS ### Run Terraform apply -Terraform creates resources when using the `apply` action in a directory containing Terraform configuration files. Like with the `plan` command, Terraform will determine which resources need to be created or modified. +Terraform creates resources when using the `apply` action in a directory containing Terraform configuration files. Like with the `plan` command, Terraform will determine which resources need to be created or modified. You should expect the same resources to be created when running `apply` that are shown when running `plan`. From the `terraform-aws-gw-lambda-tutorial` directory, run `terraform apply`. Terraform will pause to show you the resources it will create and prompt you to confirm resource creation. @@ -209,7 +209,7 @@ Review the output to confirm it will only create an AWS Lambda function and IAM ## Invoke the created resource -Next, invoke the AWS Lambda function to verify it was created and executing the application code. +Next, invoke the AWS Lambda function to verify it was created and is successfully executing the application code. Use `terraform output` to retrieve the name of the AWS Lambda function you provisioned. This uses the outputs we added to the module in [create a module](./deploying-a-module.md#create-a-module) to retrieve the name of the Lambda function. Then, invoke the Lambda function directly using the AWS CLI, writing the response of the Lambda to a file called `lambda_output`. ```sh @@ -218,7 +218,7 @@ export FUNCTION_NAME=$(terraform output -raw function_name) aws lambda invoke --function-name $FUNCTION_NAME --output json lambda_output ``` -The lambda invoke command should return JSON blob in response with the StatusCode of 200 and the ExecutedVersion of $LATEST. +The lambda `invoke` command should return a JSON blob in response with the StatusCode of 200 and the ExecutedVersion of `$LATEST`. ```sh { "StatusCode": 200, @@ -230,14 +230,14 @@ Inspect the contents of the `lambda_output` file, you should see a string statin ## Clean up -When you've completed the tutorial, clean up the resources you created to avoid incurring unexpected costs. +When you’ve completed the tutorial, clean up the resources you created to avoid incurring unexpected costs. First, execute the `terraform plan -destroy` command to show the AWS resources that will be destroyed. ```sh terraform plan -destroy ``` -Review the output, it should show two resources to be destroyed - an AWS Lambda function and IAM role and state the two resources will be destroyed. +Review the output, it should show two resources to be destroyed — an AWS Lambda function and IAM role. Next, execute the `destroy` command. @@ -248,10 +248,10 @@ terraform destroy Finally, when prompted, enter `yes` to confirm the resource deletion. Terraform will begin destroying the resources created as part of this tutorial. -## What's next +## What’s next -Now that you've developed and deployed your first Terraform module, try creating another module that leverages the module you just created. For example, make your Lambda function available via a URL using an [AWS API Gateway HTTP API](../../reference/modules/terraform-aws-lambda/api-gateway-proxy/) with an AWS Lambda integration. Then, write a test using [Terratest](https://terratest.gruntwork.io/) that confirms your module creates resources as you'd expect. +Now that you’ve developed and deployed your first Terraform module, try creating another module that leverages the module you just created. For example, make your Lambda function available via a URL using an [AWS API Gateway HTTP API](../../reference/modules/terraform-aws-lambda/api-gateway-proxy/) with an AWS Lambda integration. Then, write a test using [Terratest](https://terratest.gruntwork.io/) that confirms your module creates resources as you’d expect. Finally, consider what other resources you would create to make your modules ready to use in production. For example, you would likely need to add [metrics](../../reference/modules/terraform-aws-monitoring/metrics/metrics.md) and [alerting](../../reference/modules/terraform-aws-monitoring/alarms/alarms.md). -In [Using a module](../usage/using-a-module.md), we'll create the same resources defined in your modules using a pre-built Gruntwork module. +In [Using a module](../usage/using-a-module.md), you’ll learn how to create the same resources defined in these modules using a pre-built Gruntwork module. diff --git a/_docs-sources/iac/getting-started/setting-up.md b/_docs-sources/iac/getting-started/setting-up.md index 1a7bae3037..6cf61a7c5b 100644 --- a/_docs-sources/iac/getting-started/setting-up.md +++ b/_docs-sources/iac/getting-started/setting-up.md @@ -6,7 +6,7 @@ The Gruntwork IaC library requires that you have a few tools installed in order Terraform is an open source infrastructure provisioning tool that allows you to define and manage a wide variety of infrastructure (e.g., servers, load balancers, databases, network settings, and so on) as code across a wide variety of providers (e.g., AWS, GCP, Azure). Terraform defines cloud and on-premise resources in human-readable configuration language and offers a consistent workflow for provisioning and managing infrastructure. -Gruntwork's IaC library is built using Terraform, so having Terraform installed is required. +Gruntwork’s IaC library is built using Terraform, so having Terraform installed is required. ### Installation Terraform is supported on Mac (x86 and Apple Silicon), Windows, and Linux. To learn how to install for your specific OS, follow the guide to [install Terraform](https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli#install-cli) on the Hashicorp website. @@ -14,15 +14,15 @@ Terraform is supported on Mac (x86 and Apple Silicon), Windows, and Linux. To le If you need multiple versions of Terraform installed, [tfenv](https://github.com/tfutils/tfenv#installation) is a tool for managing and using multiple versions of Terraform. It was inspired by similar tools `rbenv` for Ruby versions and `pyenv` for Python. ### Learn more -If you're new to Terraform, we recommend starting with learning about Terraform's [configuration language](https://developer.hashicorp.com/terraform/language) then familiarizing yourself with the basics of [provisioning infrastructure](https://developer.hashicorp.com/terraform/cli/run) using Terraform. +If you’re new to Terraform, we recommend starting with learning about Terraform’s [configuration language](https://developer.hashicorp.com/terraform/language) then familiarizing yourself with the basics of [provisioning infrastructure](https://developer.hashicorp.com/terraform/cli/run) using Terraform. If you want to skip immediately to learning, you can learn how to [deploy your first module](./deploying-a-module.md). For a more in-depth guide, check out our [Comprehensive Guide to Terraform](https://blog.gruntwork.io/a-comprehensive-guide-to-terraform-b3d32832baca) for a thorough introduction to the language. ## Terragrunt -Terragrunt is a thin wrapper that provides extra tools for keeping your configurations DRY, working with multiple Terraform modules, and managing remote state. Terragrunt allows you to execute multiple Terraform commands at once, centrally manage your Terraform state configuration, and set repeatable CLI arguments. Since Terraform is a dependency of Terragrunt, you can continue to write modules for Terraform in the Terraform configuration language, then reference and re-use the modules in different environments or applications. +Terragrunt is a tool developed by Gruntwork that provides extra tools for keeping your Terraform configurations DRY, working with multiple Terraform modules, and managing remote state. Terragrunt allows you to execute multiple Terraform commands at once, centrally manage your Terraform state configuration, and set repeatable CLI arguments. Since Terraform is a dependency of Terragrunt, you can continue to write modules for Terraform in the Terraform configuration language, then reference and re-use the modules in different environments or applications. -Terragrunt is not a required tool, but it does provide many convenience features on top of Terraform. +Terragrunt is not a required tool to use the IaC library, but it does provide many convenience features on top of Terraform. If you are using the Gruntwork [Reference Architecture](../../refarch/whats-this/what-is-a-reference-architecture), Terragrunt is a requirement. ### Installation Terragrunt is supported on Mac (x86 and Apple Silicon), Windows, and Linux. To install Terragrunt, follow the guide on how to [install Terragrunt](https://terragrunt.gruntwork.io/docs/getting-started/install/) on the Terragrunt website. @@ -32,8 +32,8 @@ If you need multiple versions of Terragrunt installed, [tgswitch](https://github ### Learn more To learn more about Terragrunt, check out the [official documentation](https://terragrunt.gruntwork.io/docs/). -## What's Next +## What’s Next -Now that you've got the required tools installed, you'll learn how to [access the IaC Library code](./accessing-the-code.md). +Now that you’ve got the required tools installed, you’ll learn how to [access the IaC Library code](./accessing-the-code.md). -If you're ready to get started with creating and deploying a module, jump to [deploying your first module](./deploying-a-module.md). +If you’re ready to get started with creating and deploying a module, jump to [deploying your first module](./deploying-a-module.md). diff --git a/_docs-sources/iac/stay-up-to-date/updating.md b/_docs-sources/iac/stay-up-to-date/updating.md index b961170fad..a356637dac 100644 --- a/_docs-sources/iac/stay-up-to-date/updating.md +++ b/_docs-sources/iac/stay-up-to-date/updating.md @@ -1,8 +1,6 @@ # Updating -Updating a module or service requires changing the tagged version in the `source` attribute of the module block. - -For backwards compatible changes, this is as simple as incrementing the version number. For backwards incompatible changes, refer to the release notes for a migration guide in each module's Github repository release page. +Updating a module or service requires changing the tagged version in the `source` attribute of the module block. For backwards compatible changes, this is as simple as incrementing the version number. For backwards incompatible changes, refer to the release notes for a migration guide in each module's Github repository release page. We recommend updating module versions in your development environment first, followed by staging, then production, to ensure that the update and any required changes are well understood. @@ -10,7 +8,7 @@ We recommend updating module versions in your development environment first, fol Below is a module block referencing version `0.15.3` of the `single-server` submodule from the `terraform-aws-server` module. -To update to version version `0.15.4`, you update the value to the right of `ref=` in the source attribute. Since the version number denotes that this update is backwards compatible, it should not require any other changes. +To update to version `0.15.4`, you update the value to the right of `ref=` in the source attribute. Since the version number denotes that this update is backwards compatible, it should not require any other changes. ```tf module "my_instance" { diff --git a/_docs-sources/iac/stay-up-to-date/versioning.md b/_docs-sources/iac/stay-up-to-date/versioning.md index 5798549655..423ecf3cc8 100644 --- a/_docs-sources/iac/stay-up-to-date/versioning.md +++ b/_docs-sources/iac/stay-up-to-date/versioning.md @@ -2,12 +2,12 @@ Gruntwork versions the IaC library using [Semantic Versioning](https://semver.org/) (SemVer). Since much of the Gruntwork IaC Library is still pre-1.0.0, most of the Gruntwork IaC Library uses 0.MINOR.PATCH version numbers. With 0.MINOR.PATCH, the rules are a bit different, where we increment the: -- MINOR version when you make backward incompatible API changes, and -- PATCH version when you add backward compatible functionality or bug fixes. +- MINOR version when we make backward incompatible API changes, and +- PATCH version when we add backward compatible functionality or bug fixes For modules that have submodules (e.g., terraform-aws-server/modules/single-server), not every release contains changes to every module. While using the latest available version is recommended, the version that most recently contains changes for a module can be found in each submodule's reference in the [Library Reference](../reference/index.md). -New module versions are released by creating a release on Github. When a new version is created, refer to the release notes in the Github repository release page for a list of changes and migration guides (when necessary). +We release new module versions using GitHub releases, refer to the release notes in the GitHub repository release page for a list of changes and migration guides (when necessary). ## Example: Reference a version diff --git a/docs/iac/getting-started/accessing-the-code.md b/docs/iac/getting-started/accessing-the-code.md index 04b7ba846e..380859cc4b 100644 --- a/docs/iac/getting-started/accessing-the-code.md +++ b/docs/iac/getting-started/accessing-the-code.md @@ -1,8 +1,6 @@ # Accessing the code -Gruntwork provides all code included in your subscription to the Infrastructure as Code (IaC) library through GitHub. - -To gain access to the IaC Library, link your GitHub ID to your account in the Developer Portal. Follow the steps outlined in the Developer Portal guide on [linking your Github ID](../../developer-portal/link-github-id). +Gruntwork provides all code included in your subscription to the Infrastructure as Code (IaC) library through GitHub. To gain access to the IaC Library, you must first [create an account in the Developer Portal](../../developer-portal/create-account.md). Once you have an account, you must [link your Github ID](../../developer-portal/link-github-id) to your Developer Portal account to gain access to the IaC Library. ## Accessing Modules and Services in the IaC library @@ -14,6 +12,6 @@ In Github, each IaC repository is prefixed with `terraform-aws-` then a high lev diff --git a/docs/iac/getting-started/deploying-a-module.md b/docs/iac/getting-started/deploying-a-module.md index f7a498d25b..f8fdb27ef1 100644 --- a/docs/iac/getting-started/deploying-a-module.md +++ b/docs/iac/getting-started/deploying-a-module.md @@ -1,10 +1,10 @@ # Deploying your first module -[Modules](../overview/modules.md) allow you to define an interface to create one or many resources in the cloud or on-premise. Similar to how in object oriented programming you can define a class that may have different attribute values across many instances. +[Modules](../overview/modules.md) allow you to define an interface to create one or many resources in the cloud or on-premise, similar to how in object oriented programming you can define a class that may have different attribute values across many instances. -Modules help keep your Terraform code DRY (Don't Repeat Yourself), and speed up development time when creating new resources. +Modules help keep your Terraform code DRY (Don’t Repeat Yourself), and speed up development time when creating new resources. -This tutorial will teach you how to develop a Terraform module that deploys an AWS Lambda function. We will create the required file structure, define an AWS Lambda function and AWS IAM role as code, then plan and apply the resource in an AWS account. Then, we’ll verify the deployment by invoking the Lambda using the AWS CLI. +This tutorial will teach you how to develop a Terraform module that deploys an AWS Lambda function. We will create the required file structure, define an AWS Lambda function and AWS IAM role as code, then plan and apply the resource in an AWS account. Then, we’ll verify the deployment by invoking the Lambda using the AWS CLI. Finally, we'll clean up the resources we create to avoid unexpected costs. ## Prerequisites - An AWS account with permissions to create the necessary resources @@ -14,7 +14,7 @@ This tutorial will teach you how to develop a Terraform module that deploys an A ## Create the module -In this section you'll create a Terraform module that can create an AWS Lambda function and IAM role. This module will include three files - `main.tf` which will contain the resource definitions, `variables.tf`, which specifies the possible inputs to the module, and `outputs.tf`, which specifies the values that can be used to pass references to attributes from the resources in the module. +In this section you’ll create a Terraform module that can create an AWS Lambda function and IAM role. This module will include three files — `main.tf` which will contain the resource definitions, `variables.tf`, which specifies the possible inputs to the module, and `outputs.tf`, which specifies the values that can be used to pass references to attributes from the resources in the module. This module could be referenced many times to create any number of AWS Lambda functions and IAM roles. @@ -76,7 +76,7 @@ resource "aws_lambda_function" "lambda" { ### Specify the variables for the module -Now that you've defined the resources you want to create, you need to list out all of the variables that you want to allow users to pass into the variable. In the module, you can reference these values in the module using the `var` syntax, as visible in `terraform-aws-gw-lambda/modules/lambda/main.tf`. +Now that you’ve defined the resources you want to create, you need to list out all of the variables that you want to allow users to pass into the module. You can reference these values in the module using the `var` syntax, as visible in `terraform-aws-gw-lambda/modules/lambda/main.tf`. Copy the following snippet into `terraform-aws-gw-lambda-tutorial/modules/lambda/variables.tf`. @@ -116,7 +116,7 @@ variable "timeout" { ### Specify the outputs -Terraform allows you to specify values that will be outputted by the module. Outputs are convenient ways to pass values between modules when composing a service comprised of many modules. +Terraform allows you to specify values that the module will output. Outputs are convenient ways to pass values between modules when composing a service comprised of many modules. Copy the following snippet into `terraform-aws-gw-lambda-tutorial/modules/lambda/outputs.tf`. ```tf @@ -131,7 +131,7 @@ Now that you have defined a module that creates an AWS Lambda function and IAM r ### Create the basic file structure -Now that you have the module defined, you need to create files which will reference the module. Typically, you would create a module in one repository, then reference it in a different repository. For this tutorial, we'll just create the reference in the top level directory for the sake of simplicity. +Now that you have the module defined, you need to create files which will reference the module. Typically, you would create a module in one repository, then reference it in a different repository. For this tutorial, we’ll just create the reference in the top level directory for the sake of simplicity. Create a file called `main.tf`, which will contain a reference to the module, and a file called `main.py`, which will contain the Lambda function code. ```sh @@ -141,7 +141,7 @@ touch terraform-aws-gw-lambda-tutorial/main.py ### Write the function code -Next, we'll write a simple Python function that returns a string that will be used as the entrypoint of the AWS Lambda function. Terraform will create a zip file containing this file that will be uploaded to the Lambda function. +Next, we’ll write a simple Python function that returns a string that will be used as the entrypoint of the AWS Lambda function. Terraform will create a zip file containing this file that will be uploaded to the Lambda function. Copy the following to `terraform-aws-gw-lambda-tutorial/main.py`. ``` @@ -184,7 +184,7 @@ output "function_name" { Terraform will generate an execution plan using the `plan` action. The plan will show what resources Terraform determines need to be created or modified. -Running `terraform plan` is helpful when developing modules, to confirm that the Terraform code you are writing, and to confirm what resources will be created or modified when applying the module in your AWS account. +Running `terraform plan` is helpful when developing modules, to confirm that the Terraform code you are writing are using the correct syntax, and to confirm what resources will be created or modified when applying the module in your AWS account. From the `terraform-aws-gw-lambda-tutorial` directory, run a plan to see what resources will be created. @@ -197,7 +197,7 @@ Review the output of `terraform plan`, it should contain two resources - an AWS ### Run Terraform apply -Terraform creates resources when using the `apply` action in a directory containing Terraform configuration files. Like with the `plan` command, Terraform will determine which resources need to be created or modified. +Terraform creates resources when using the `apply` action in a directory containing Terraform configuration files. Like with the `plan` command, Terraform will determine which resources need to be created or modified. You should expect the same resources to be created when running `apply` that are shown when running `plan`. From the `terraform-aws-gw-lambda-tutorial` directory, run `terraform apply`. Terraform will pause to show you the resources it will create and prompt you to confirm resource creation. @@ -209,7 +209,7 @@ Review the output to confirm it will only create an AWS Lambda function and IAM ## Invoke the created resource -Next, invoke the AWS Lambda function to verify it was created and executing the application code. +Next, invoke the AWS Lambda function to verify it was created and is successfully executing the application code. Use `terraform output` to retrieve the name of the AWS Lambda function you provisioned. This uses the outputs we added to the module in [create a module](./deploying-a-module.md#create-a-module) to retrieve the name of the Lambda function. Then, invoke the Lambda function directly using the AWS CLI, writing the response of the Lambda to a file called `lambda_output`. ```sh @@ -218,7 +218,7 @@ export FUNCTION_NAME=$(terraform output -raw function_name) aws lambda invoke --function-name $FUNCTION_NAME --output json lambda_output ``` -The lambda invoke command should return JSON blob in response with the StatusCode of 200 and the ExecutedVersion of $LATEST. +The lambda `invoke` command should return a JSON blob in response with the StatusCode of 200 and the ExecutedVersion of `$LATEST`. ```sh { "StatusCode": 200, @@ -230,14 +230,14 @@ Inspect the contents of the `lambda_output` file, you should see a string statin ## Clean up -When you've completed the tutorial, clean up the resources you created to avoid incurring unexpected costs. +When you’ve completed the tutorial, clean up the resources you created to avoid incurring unexpected costs. First, execute the `terraform plan -destroy` command to show the AWS resources that will be destroyed. ```sh terraform plan -destroy ``` -Review the output, it should show two resources to be destroyed - an AWS Lambda function and IAM role and state the two resources will be destroyed. +Review the output, it should show two resources to be destroyed — an AWS Lambda function and IAM role. Next, execute the `destroy` command. @@ -248,18 +248,18 @@ terraform destroy Finally, when prompted, enter `yes` to confirm the resource deletion. Terraform will begin destroying the resources created as part of this tutorial. -## What's next +## What’s next -Now that you've developed and deployed your first Terraform module, try creating another module that leverages the module you just created. For example, make your Lambda function available via a URL using an [AWS API Gateway HTTP API](../../reference/modules/terraform-aws-lambda/api-gateway-proxy/) with an AWS Lambda integration. Then, write a test using [Terratest](https://terratest.gruntwork.io/) that confirms your module creates resources as you'd expect. +Now that you’ve developed and deployed your first Terraform module, try creating another module that leverages the module you just created. For example, make your Lambda function available via a URL using an [AWS API Gateway HTTP API](../../reference/modules/terraform-aws-lambda/api-gateway-proxy/) with an AWS Lambda integration. Then, write a test using [Terratest](https://terratest.gruntwork.io/) that confirms your module creates resources as you’d expect. Finally, consider what other resources you would create to make your modules ready to use in production. For example, you would likely need to add [metrics](../../reference/modules/terraform-aws-monitoring/metrics/metrics.md) and [alerting](../../reference/modules/terraform-aws-monitoring/alarms/alarms.md). -In [Using a module](../usage/using-a-module.md), we'll create the same resources defined in your modules using a pre-built Gruntwork module. +In [Using a module](../usage/using-a-module.md), you’ll learn how to create the same resources defined in these modules using a pre-built Gruntwork module. diff --git a/docs/iac/getting-started/setting-up.md b/docs/iac/getting-started/setting-up.md index 1cb7fc796d..1ea95a38e2 100644 --- a/docs/iac/getting-started/setting-up.md +++ b/docs/iac/getting-started/setting-up.md @@ -6,7 +6,7 @@ The Gruntwork IaC library requires that you have a few tools installed in order Terraform is an open source infrastructure provisioning tool that allows you to define and manage a wide variety of infrastructure (e.g., servers, load balancers, databases, network settings, and so on) as code across a wide variety of providers (e.g., AWS, GCP, Azure). Terraform defines cloud and on-premise resources in human-readable configuration language and offers a consistent workflow for provisioning and managing infrastructure. -Gruntwork's IaC library is built using Terraform, so having Terraform installed is required. +Gruntwork’s IaC library is built using Terraform, so having Terraform installed is required. ### Installation Terraform is supported on Mac (x86 and Apple Silicon), Windows, and Linux. To learn how to install for your specific OS, follow the guide to [install Terraform](https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli#install-cli) on the Hashicorp website. @@ -14,15 +14,15 @@ Terraform is supported on Mac (x86 and Apple Silicon), Windows, and Linux. To le If you need multiple versions of Terraform installed, [tfenv](https://github.com/tfutils/tfenv#installation) is a tool for managing and using multiple versions of Terraform. It was inspired by similar tools `rbenv` for Ruby versions and `pyenv` for Python. ### Learn more -If you're new to Terraform, we recommend starting with learning about Terraform's [configuration language](https://developer.hashicorp.com/terraform/language) then familiarizing yourself with the basics of [provisioning infrastructure](https://developer.hashicorp.com/terraform/cli/run) using Terraform. +If you’re new to Terraform, we recommend starting with learning about Terraform’s [configuration language](https://developer.hashicorp.com/terraform/language) then familiarizing yourself with the basics of [provisioning infrastructure](https://developer.hashicorp.com/terraform/cli/run) using Terraform. If you want to skip immediately to learning, you can learn how to [deploy your first module](./deploying-a-module.md). For a more in-depth guide, check out our [Comprehensive Guide to Terraform](https://blog.gruntwork.io/a-comprehensive-guide-to-terraform-b3d32832baca) for a thorough introduction to the language. ## Terragrunt -Terragrunt is a thin wrapper that provides extra tools for keeping your configurations DRY, working with multiple Terraform modules, and managing remote state. Terragrunt allows you to execute multiple Terraform commands at once, centrally manage your Terraform state configuration, and set repeatable CLI arguments. Since Terraform is a dependency of Terragrunt, you can continue to write modules for Terraform in the Terraform configuration language, then reference and re-use the modules in different environments or applications. +Terragrunt is a tool developed by Gruntwork that provides extra tools for keeping your Terraform configurations DRY, working with multiple Terraform modules, and managing remote state. Terragrunt allows you to execute multiple Terraform commands at once, centrally manage your Terraform state configuration, and set repeatable CLI arguments. Since Terraform is a dependency of Terragrunt, you can continue to write modules for Terraform in the Terraform configuration language, then reference and re-use the modules in different environments or applications. -Terragrunt is not a required tool, but it does provide many convenience features on top of Terraform. +Terragrunt is not a required tool to use the IaC library, but it does provide many convenience features on top of Terraform. If you are using the Gruntwork [Reference Architecture](../../refarch/whats-this/what-is-a-reference-architecture), Terragrunt is a requirement. ### Installation Terragrunt is supported on Mac (x86 and Apple Silicon), Windows, and Linux. To install Terragrunt, follow the guide on how to [install Terragrunt](https://terragrunt.gruntwork.io/docs/getting-started/install/) on the Terragrunt website. @@ -32,16 +32,16 @@ If you need multiple versions of Terragrunt installed, [tgswitch](https://github ### Learn more To learn more about Terragrunt, check out the [official documentation](https://terragrunt.gruntwork.io/docs/). -## What's Next +## What’s Next -Now that you've got the required tools installed, you'll learn how to [access the IaC Library code](./accessing-the-code.md). +Now that you’ve got the required tools installed, you’ll learn how to [access the IaC Library code](./accessing-the-code.md). -If you're ready to get started with creating and deploying a module, jump to [deploying your first module](./deploying-a-module.md). +If you’re ready to get started with creating and deploying a module, jump to [deploying your first module](./deploying-a-module.md). diff --git a/docs/iac/overview/index.md b/docs/iac/overview/index.md index 1f52d6df33..e0b5e7552e 100644 --- a/docs/iac/overview/index.md +++ b/docs/iac/overview/index.md @@ -6,7 +6,7 @@ The library consists of two types of code: Modules & Services ## Modules -Modules are reusable code components that are used to deploy and manage specific pieces of infrastructure. These modules encapsulate the configuration and resource definitions required to create and manage a particular component, such as a VPC, ECS cluster, or an Auto Scaling Group. For more information on modules check out the [Modules page](/iac/overview/modules/). +Modules are reusable code components that are used to deploy and manage specific pieces of infrastructure. These modules encapsulate the configuration and resource definitions required to create and manage a particular component, such as a VPC, ECS cluster, or an Auto Scaling Group. For more information on modules check out the [Modules page](/iac/overview/modules/). ## Services @@ -30,6 +30,6 @@ The Gruntwork IaC Library is deployed using the following tools: diff --git a/docs/iac/stay-up-to-date/updating.md b/docs/iac/stay-up-to-date/updating.md index bd09161552..cefa6bc443 100644 --- a/docs/iac/stay-up-to-date/updating.md +++ b/docs/iac/stay-up-to-date/updating.md @@ -1,8 +1,6 @@ # Updating -Updating a module or service requires changing the tagged version in the `source` attribute of the module block. - -For backwards compatible changes, this is as simple as incrementing the version number. For backwards incompatible changes, refer to the release notes for a migration guide in each module's Github repository release page. +Updating a module or service requires changing the tagged version in the `source` attribute of the module block. For backwards compatible changes, this is as simple as incrementing the version number. For backwards incompatible changes, refer to the release notes for a migration guide in each module's Github repository release page. We recommend updating module versions in your development environment first, followed by staging, then production, to ensure that the update and any required changes are well understood. @@ -10,7 +8,7 @@ We recommend updating module versions in your development environment first, fol Below is a module block referencing version `0.15.3` of the `single-server` submodule from the `terraform-aws-server` module. -To update to version version `0.15.4`, you update the value to the right of `ref=` in the source attribute. Since the version number denotes that this update is backwards compatible, it should not require any other changes. +To update to version `0.15.4`, you update the value to the right of `ref=` in the source attribute. Since the version number denotes that this update is backwards compatible, it should not require any other changes. ```tf module "my_instance" { @@ -41,6 +39,6 @@ Keeping track of all references to modules and services is a complicated, error diff --git a/docs/iac/stay-up-to-date/versioning.md b/docs/iac/stay-up-to-date/versioning.md index ba89804dd8..fae7340975 100644 --- a/docs/iac/stay-up-to-date/versioning.md +++ b/docs/iac/stay-up-to-date/versioning.md @@ -2,12 +2,12 @@ Gruntwork versions the IaC library using [Semantic Versioning](https://semver.org/) (SemVer). Since much of the Gruntwork IaC Library is still pre-1.0.0, most of the Gruntwork IaC Library uses 0.MINOR.PATCH version numbers. With 0.MINOR.PATCH, the rules are a bit different, where we increment the: -- MINOR version when you make backward incompatible API changes, and -- PATCH version when you add backward compatible functionality or bug fixes. +- MINOR version when we make backward incompatible API changes, and +- PATCH version when we add backward compatible functionality or bug fixes For modules that have submodules (e.g., terraform-aws-server/modules/single-server), not every release contains changes to every module. While using the latest available version is recommended, the version that most recently contains changes for a module can be found in each submodule's reference in the [Library Reference](../reference/index.md). -New module versions are released by creating a release on Github. When a new version is created, refer to the release notes in the Github repository release page for a list of changes and migration guides (when necessary). +We release new module versions using GitHub releases, refer to the release notes in the GitHub repository release page for a list of changes and migration guides (when necessary). ## Example: Reference a version @@ -37,6 +37,6 @@ Once you start using versioned modules, it's important to keep the modules up to From 931b2c51006f09627f20a345a644021ec9995df7 Mon Sep 17 00:00:00 2001 From: Oreoluwa Agunbiade <21035422+oredavids@users.noreply.github.com> Date: Thu, 25 May 2023 11:12:17 -0600 Subject: [PATCH 61/89] Add related FAQ section to dev portal pages (#820) --- _docs-sources/developer-portal/create-account.md | 6 ++++++ _docs-sources/developer-portal/invite-team.md | 6 ++++++ _docs-sources/developer-portal/link-github-id.md | 5 +++++ docs/developer-portal/create-account.md | 8 +++++++- docs/developer-portal/invite-team.md | 8 +++++++- docs/developer-portal/link-github-id.md | 7 ++++++- 6 files changed, 37 insertions(+), 3 deletions(-) diff --git a/_docs-sources/developer-portal/create-account.md b/_docs-sources/developer-portal/create-account.md index 57472b19f5..45a3158956 100644 --- a/_docs-sources/developer-portal/create-account.md +++ b/_docs-sources/developer-portal/create-account.md @@ -30,3 +30,9 @@ For security, sign in emails expire after 10 minutes. You can enter your email a ## 3. Provide account details If you are the admin for your organization, you'll be prompted to confirm details including your company address and phone number, as well as a billing email. Provide the required information and click **Continue** to finish signing in. + +## Related FAQs + +- [Invitation to the Developer Portal not received](https://github.com/orgs/gruntwork-io/discussions/716) +- [Trouble logging into the Portal with email](https://github.com/orgs/gruntwork-io/discussions/395) +- [How can the email associated with an account be changed?](https://github.com/orgs/gruntwork-io/discussions/714) diff --git a/_docs-sources/developer-portal/invite-team.md b/_docs-sources/developer-portal/invite-team.md index 9946b64a9c..105657c011 100644 --- a/_docs-sources/developer-portal/invite-team.md +++ b/_docs-sources/developer-portal/invite-team.md @@ -39,3 +39,9 @@ This change will take effect immediately. Any team members who have accepted the ## Requesting additional licenses The number of licenses available depends on the level of your subscription. You can see the total number of licenses as well as the number remaining at the top of the [Team](https://app.gruntwork.io/team) page. If you need to invite more team members than your current license limit allows, you may request additional licenses, which are billed at a standard monthly rate. To do so, contact sales@gruntwork.io. + +## Related FAQs + +- [Invitation to the Developer Portal not received](https://github.com/orgs/gruntwork-io/discussions/716) +- [Trouble logging into the Portal with email](https://github.com/orgs/gruntwork-io/discussions/395) +- [How can the email associated with an account be changed?](https://github.com/orgs/gruntwork-io/discussions/714) diff --git a/_docs-sources/developer-portal/link-github-id.md b/_docs-sources/developer-portal/link-github-id.md index ec520bafcf..9d16d96912 100644 --- a/_docs-sources/developer-portal/link-github-id.md +++ b/_docs-sources/developer-portal/link-github-id.md @@ -13,3 +13,8 @@ Gruntwork provides all code included in your subscription through GitHub. You ne Once you’ve linked your account, the notice on the home page will disappear and you’ll find your GitHub ID recorded in your [Profile Settings](https://app.gruntwork.io/settings/profile). Going forward, you’ll have access to all private repositories included in your subscription. If you haven’t done so yet, we strongly recommend [adding an SSH key](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent) to your GitHub account. An SSH key is required to access the Gruntwork IaC library without adding a password in your Terraform code. ::: + +## Related FAQs + +- [I have linked my GitHub Account but do not have code access](https://github.com/orgs/gruntwork-io/discussions/715) +- [How can I change my GitHub account(unlink/link)?](https://github.com/orgs/gruntwork-io/discussions/713) diff --git a/docs/developer-portal/create-account.md b/docs/developer-portal/create-account.md index cbd8f60ccd..5f376bd69d 100644 --- a/docs/developer-portal/create-account.md +++ b/docs/developer-portal/create-account.md @@ -31,10 +31,16 @@ For security, sign in emails expire after 10 minutes. You can enter your email a If you are the admin for your organization, you'll be prompted to confirm details including your company address and phone number, as well as a billing email. Provide the required information and click **Continue** to finish signing in. +## Related FAQs + +- [Invitation to the Developer Portal not received](https://github.com/orgs/gruntwork-io/discussions/716) +- [Trouble logging into the Portal with email](https://github.com/orgs/gruntwork-io/discussions/395) +- [How can the email associated with an account be changed?](https://github.com/orgs/gruntwork-io/discussions/714) + diff --git a/docs/developer-portal/invite-team.md b/docs/developer-portal/invite-team.md index 26a30fe97b..9c9a40f7e5 100644 --- a/docs/developer-portal/invite-team.md +++ b/docs/developer-portal/invite-team.md @@ -40,10 +40,16 @@ This change will take effect immediately. Any team members who have accepted the The number of licenses available depends on the level of your subscription. You can see the total number of licenses as well as the number remaining at the top of the [Team](https://app.gruntwork.io/team) page. If you need to invite more team members than your current license limit allows, you may request additional licenses, which are billed at a standard monthly rate. To do so, contact sales@gruntwork.io. +## Related FAQs + +- [Invitation to the Developer Portal not received](https://github.com/orgs/gruntwork-io/discussions/716) +- [Trouble logging into the Portal with email](https://github.com/orgs/gruntwork-io/discussions/395) +- [How can the email associated with an account be changed?](https://github.com/orgs/gruntwork-io/discussions/714) + diff --git a/docs/developer-portal/link-github-id.md b/docs/developer-portal/link-github-id.md index 344a9a22dc..ce58e7d484 100644 --- a/docs/developer-portal/link-github-id.md +++ b/docs/developer-portal/link-github-id.md @@ -14,10 +14,15 @@ Once you’ve linked your account, the notice on the home page will disappear an ::: +## Related FAQs + +- [I have linked my GitHub Account but do not have code access](https://github.com/orgs/gruntwork-io/discussions/715) +- [How can I change my GitHub account(unlink/link)?](https://github.com/orgs/gruntwork-io/discussions/713) + From 7754a292c895ec8b2d36fde8fd93965fe57d72e0 Mon Sep 17 00:00:00 2001 From: Andrew Ellison Date: Thu, 25 May 2023 12:18:41 -0500 Subject: [PATCH 62/89] add review fixes for pipelines comments (#822) --- _docs-sources/pipelines/how-it-works/index.md | 27 ++-- .../{what-is-it => overview}/index.md | 0 _docs-sources/pipelines/tutorial/index.md | 128 +++++++++-------- docs/pipelines/how-it-works/index.md | 29 ++-- .../{what-is-it => overview}/index.md | 0 docs/pipelines/tutorial/index.md | 130 +++++++++--------- docusaurus.config.js | 2 +- sidebars/pipelines.js | 2 +- 8 files changed, 154 insertions(+), 164 deletions(-) rename _docs-sources/pipelines/{what-is-it => overview}/index.md (100%) rename docs/pipelines/{what-is-it => overview}/index.md (100%) diff --git a/_docs-sources/pipelines/how-it-works/index.md b/_docs-sources/pipelines/how-it-works/index.md index 984d5fe3c4..c5a8cf321c 100644 --- a/_docs-sources/pipelines/how-it-works/index.md +++ b/_docs-sources/pipelines/how-it-works/index.md @@ -1,13 +1,12 @@ # How it works -## Block Diagram - ![Gruntwork Pipelines Architecture](/img/guides/build-it-yourself/pipelines/tftg-pipeline-architecture.png) ## External CI Tool -Gruntwork Pipelines can be used with any external CI/CD tool. The role of the CI/CD tool is to trigger jobs -inside Gruntwork Pipelines. We have [example configurations](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/master/examples/for-production/infrastructure-live/_ci/scripts) +Gruntwork Pipelines has been validated with CircleCI, Github Actions, and Gitlab. However, it can be used with any external CI/CD tool. +The role of the CI/CD tool is to trigger jobs inside Gruntwork Pipelines. +We have [example configurations](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/master/examples/for-production/infrastructure-live/_ci/scripts) that identify changed terraform modules and call the Gruntwork Pipelines invoker Lambda function. By default, the invoker Lambda function is run by a CLI tool called `infrastructure-deployer` from within your CI tool. @@ -32,11 +31,11 @@ Usage: When launching a task, you may optionally set the following useful flags: -- `max-wait-time` (default 2h0m0s) - timeout length for the action -- `task-cpu` - A custom number of CPU units to allocate to the ECS task -- `task-memory` - A custom number of memory units to allocate to the ECS task +- `max-wait-time` (default 2h0m0s) — timeout length for the action +- `task-cpu` — A custom number of CPU units to allocate to the ECS task +- `task-memory` — A custom number of memory units to allocate to the ECS task -To get the list of supported containers and scripts, pass in the --describe-containers option. For example: +To get the list of supported containers and scripts, pass in the `--describe-containers` option. For example: `infrastructure-deployer --describe-containers --aws-region us-west-2` @@ -57,17 +56,17 @@ It has 3 primary roles: ### Standard Configuration The ECS deploy runner is flexible and can be configured for many tasks. The [standard configuration](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner-standard-configuration) -is a set of 4 ECS task definitions that we ship with Pipelines by default. +is a set of ECS task definitions that we ship with Pipelines by default. Once you have your pipeline deployed you can [modify](../maintain/extending.md) the configuration as you like. The configuration defines what scripts are accepted by the invoker Lambda and which arguments may be provided. The invoker Lambda -will reject ANY script or argument not defined in the ECS Deploy Runner configuration. -The 4 default tasks are defined below. +will reject _any_ script or argument not defined in the ECS Deploy Runner configuration. +The default tasks are defined below. #### Docker Image Builder (Kaniko) The Docker Image Builder task definition allows CI jobs to build docker images. This ECS task uses an open source library called [Kaniko](https://github.com/GoogleContainerTools/kaniko) to enable docker builds from within a docker container. -We provide a [Docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/kaniko) based on kaniko for this task. +We provide a [Docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/kaniko) based on Kaniko for this task. #### Packer AMI Builder @@ -77,5 +76,5 @@ a [Docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modu #### Terraform Planner and Applier The Terraform Planner task definition and Terraform Applier task definition are very similar. They allow CI jobs to -plan and apply terraform and terragrunt code. These tasks run in the same [docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/deploy-runner) -as the AMI builder +plan and apply Terraform and Terragrunt code. These tasks run in the same [Docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/deploy-runner) +as the AMI builder. diff --git a/_docs-sources/pipelines/what-is-it/index.md b/_docs-sources/pipelines/overview/index.md similarity index 100% rename from _docs-sources/pipelines/what-is-it/index.md rename to _docs-sources/pipelines/overview/index.md diff --git a/_docs-sources/pipelines/tutorial/index.md b/_docs-sources/pipelines/tutorial/index.md index 0524dbb586..b876280e42 100644 --- a/_docs-sources/pipelines/tutorial/index.md +++ b/_docs-sources/pipelines/tutorial/index.md @@ -1,23 +1,23 @@ -# Tutorial - Single Account Example +# Single Account Tutorial -In this tutorial, we'll walk you through the process of setting up Gruntwork Pipelines in a single -AWS account. By the end, you'll deploy: +In this tutorial, you’ll walk you through the process of setting up Gruntwork Pipelines in a single +AWS account. By the end, you’ll deploy: - ECR Repositories for storing Docker images - - `deploy-runner` - stores the default image for planning and applying terraform and building AMIs - - `kaniko` - stores the default image for building other Docker images using [kaniko](https://github.com/GoogleContainerTools/kaniko) - - `hello-world` - a demonstration repo used for illustrating how a Docker application might be managed with Gruntwork Pipelines + - `deploy-runner` — stores the default image for planning and applying terraform and building AMIs + - `kaniko` — stores the default image for building other Docker images using [kaniko](https://github.com/GoogleContainerTools/kaniko) + - `hello-world` — a demonstration repo used for illustrating how a Docker application might be managed with Gruntwork Pipelines - Our [ECS Deploy Runner Module](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner) - Supporting IAM Roles, IAM Policies, and CloudWatch Log Groups - ECS Tasks - - `docker-image-builder` - builds Docker images within the `kaniko` container image - - `ami-builder` - builds AMIs using HashiCorp Packer within the `deploy-runner` image - - `terraform-planner` - Runs plan commands within the `deploy-runner` container - - `terraform-applier` - Runs apply commands within the `deploy-runner` container + - `docker-image-builder` — builds Docker images within the `kaniko` container image + - `ami-builder` — builds AMIs using HashiCorp Packer within the `deploy-runner` image + - `terraform-planner` — Runs plan commands within the `deploy-runner` container + - `terraform-applier` — Runs apply commands within the `deploy-runner` container ## Prerequisites -Before we begin, make sure your system has: +Before you begin, make sure your system has: - [Docker](https://docs.docker.com/get-docker/), with support for Buildkit (version 18.09 or newer) - [Terraform](https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli) (version 1.0 or newer) @@ -31,7 +31,7 @@ The code for this tutorial can be found in the [Gruntwork Service Catalog](https git clone https://github.com/gruntwork-io/terraform-aws-service-catalog.git ``` -We will be following the example found at `terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pipelines` +You will be following the example found at `terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pipelines` ```shell cd terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pipelines @@ -73,12 +73,12 @@ terraform apply The four standard Gruntwork Pipelines capabilities are instrumented by two separate Docker files -1. `ecs-deploy-runner` - Terraform plan, apply and AMI building -2. `kaniko` - Docker image building. [Kaniko](https://github.com/GoogleContainerTools/kaniko) is a tool that supports building Docker images inside of a container +1. `ecs-deploy-runner` — Terraform plan, apply and AMI building +2. `kaniko` — Docker image building. [Kaniko](https://github.com/GoogleContainerTools/kaniko) is a tool that supports building Docker images inside a container -These Dockerfiles live in the ecs-deploy-runner module within [the terraform-aws-ci repository](https://github.com/gruntwork-io/terraform-aws-ci). In this example, we'll be cloning the terraform-aws-ci and running Docker build against the Dockerfiles defined there. +These Dockerfiles live in the ecs-deploy-runner module within [the terraform-aws-ci repository](https://github.com/gruntwork-io/terraform-aws-ci). In this example, you'll clone the terraform-aws-ci and running Docker build against the Dockerfiles defined there. -We're now going to build these two Docker images and push them to the ECR repositories we just created. +You’re now going to build these two Docker images and push them to the ECR repositories you just created. ### Export Environment Variables @@ -89,11 +89,11 @@ and provision a GitHub PAT against that account. This GitHub PAT will be used for two purposes: 1. Initially, when running the Docker build commands below, the GitHub PAT will be used to fetch private code from `github.com/gruntwork-io`. -2. Once the Docker images are built, you'll store your GitHub PAT in AWS Secrets Manager. When Gruntwork Pipelines is running on your behalf, it will fetch - your GitHub PAT from Secrets Manager "Just in time" so that only the running ECS task has access to the token - and so that your token only exists for the lifespan +2. Once the Docker images are built, you’ll store your GitHub PAT in AWS Secrets Manager. When Gruntwork Pipelines is running on your behalf, it will fetch + your GitHub PAT from Secrets Manager "just in time" so that only the running ECS task has access to the token — and so that your token only exists for the lifespan of the ephemeral ECS task container. -Export a valid GitHub PAT using the following command so that we can use it to build Docker images that fetch private code via GitHub: +Export a valid GitHub PAT using the following command so that you can use it to build Docker images that fetch private code via GitHub: ```shell export GITHUB_OAUTH_TOKEN= ``` @@ -105,7 +105,7 @@ export AWS_REGION= ``` The Gruntwork Pipelines Dockerfiles used by Gruntwork Pipelines are stored in the `gruntwork-io/terraform-aws-ci` repository. Therefore, in order to pin both Dockerfiles -to a known version, we export the following variable which we'll use during our Docker builds: +to a known version, you export the following variable which you’ll use during our Docker builds: ```shell export TERRAFORM_AWS_CI_VERSION=v0.51.4 @@ -114,7 +114,7 @@ export TERRAFORM_AWS_CI_VERSION=v0.51.4 The latest version can be retrieved from the [releases page](https://github.com/gruntwork-io/terraform-aws-ci/releases) of the `gruntwork-io/terraform-aws-ci` repository. At a minimum, `v0.51.4` must be selected. ### Clone `terraform-aws-ci` to your machine -Next, we are going to build the two Docker images required for this example. The Dockerfiles are defined in the [terraform-aws-ci](https://github.com/gruntwork-io/terraform-aws-ci) repository, so it must be available locally: +Next, you are going to build the two Docker images required for this example. The Dockerfiles are defined in the [terraform-aws-ci](https://github.com/gruntwork-io/terraform-aws-ci) repository, so it must be available locally: ```bash git clone git@github.com:gruntwork-io/terraform-aws-ci.git @@ -127,8 +127,8 @@ cd terraform-aws-ci/modules/ecs-deploy-runner ### Build the ecs-deploy-runner and kaniko Docker images -This next command is going to perform a Docker build of the `deploy-runner` image. You don't need to authenticate to AWS in order to run this command, as the build will happen on your machine. -We do, however, pass your exported GitHub PAT into the build as a secret, so that the Docker build can fetch private code from `github.com/gruntwork-io`. Since we're using BuildKit, the token +This next command is going to perform a Docker build of the `deploy-runner` image. You don’t need to authenticate to AWS in order to run this command, as the build will happen on your machine. +We do, however, pass your exported GitHub PAT into the build as a secret, so that the Docker build can fetch private code from `github.com/gruntwork-io`. Since you’re using BuildKit, the token is only used during the build process and does not remain in the final image. Run the following command to build the ecs-deploy-runner Docker image: @@ -140,11 +140,7 @@ DOCKER_BUILDKIT=1 docker build \ ./docker/deploy-runner/ ``` -This next command is going to perform a Docker build of the `kaniko` image. You don't need to authenticate to AWS in order to run this command, as the build will happen on your machine. -We do, however, pass your exported GitHub PAT into the build as a secret, so that the Docker build can fetch private code from `github.com/gruntwork-io`. Since we're using BuildKit, the token -is only used during the build process and does not remain in the final image. - -Similarly to the ecs-deploy-runner image, we'll now use the Kaniko Dockerfile included in this example to build the kaniko image: +Similarly to the ecs-deploy-runner image, you’ll now use the Kaniko Dockerfile included in this example to build the kaniko image: ```shell DOCKER_BUILDKIT=1 docker build \ --secret id=github-token,env=GITHUB_OAUTH_TOKEN \ @@ -153,16 +149,16 @@ DOCKER_BUILDKIT=1 docker build \ ./docker/kaniko/ ``` -### Log and Push to ECR -Now we have local Docker images for ecs-deploy-runner and kaniko that are properly tagged, but before we can push it into the private ECR repository that we created -with our `terraform apply`, we need to authenticate with ECR itself. Authenticate to AWS and run the following: +### Log In and Push to ECR +Now you have local Docker images for ecs-deploy-runner and kaniko that are properly tagged, but before you can push it into the private ECR repository that you created +with our `terraform apply`, you need to authenticate with ECR itself. Authenticate to AWS and run the following: ```shell aws ecr get-login-password --region $AWS_REGION \ | docker login -u AWS --password-stdin "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com" ``` -If you receive a success message from your previous command, you're ready to push your ecs-deploy-runner image: +If you receive a success message from your previous command, you’re ready to push your ecs-deploy-runner image: ```shell docker push "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/ecs-deploy-runner:$TERRAFORM_AWS_CI_VERSION" ``` @@ -173,7 +169,7 @@ docker push "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/kaniko:$TERRAFORM ## Deploy the Pipelines Cluster -Now that the ECR repositories are deployed and have the required Docker images, we are ready +Now that the ECR repositories are deployed and have the required Docker images, you are ready to deploy the rest of Gruntwork Pipelines. The Terraform that defines the setup is defined in `terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pipelines/pipelines-cluster` @@ -183,17 +179,17 @@ cd terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pip ### Export a GitHub Personal Access Token (PAT) For the purposes of this example, you may use the same PAT as before. In a production deployment, best practice -would be to create a separate GitHub machine user account. This modules uses a slightly different naming convention for -its environment variable so you'll need to re-export the token: +would be to create a separate GitHub machine user account. This module uses a slightly different naming convention for +its environment variable, so you’ll need to re-export the token: ```shell export TF_VAR_github_token= ``` ### Configure and Deploy the ecs deploy runner -Authenticate to your AWS account and run init, then apply. +Authenticate to your AWS account and run `init`, then `apply`. :::note -If you are using aws-vault to authenticate on the command line, you must supply the `--no-session` flag as explained in [this KB entry](https://github.com/gruntwork-io/knowledge-base/discussions/647) +If you are using `aws-vault` to authenticate on the command line, you must supply the `--no-session` flag as explained in [this Knowledge Base entry](https://github.com/gruntwork-io/knowledge-base/discussions/647) ::: ```shell @@ -203,15 +199,15 @@ terraform init ```shell terraform plan ``` -Check your plan output before applying +Check your plan output before applying: ```shell terraform apply ``` ## Install the `infrastructure-deployer` command line tool -Gruntwork Pipelines requires all requests to transit through its fronting Lambda function, which ensures only valid arguments and commands are passed along to ECS. -To invoke Gruntwork Pipelines's fronting Lambda function, you should use the `infrastructure-deployer` command line interface (CLI) tool. For testing and setup purposes, we'll install and use the `infrastructure-deployer` CLI locally; when you're ready to configure CI / CD, you'll install and use it in your CI / CD config. +Gruntwork Pipelines requires all requests to transit through its Lambda function, which ensures only valid arguments and commands are passed along to ECS. +To invoke the Lambda function, you should use the `infrastructure-deployer` command line interface (CLI) tool. For testing and setup purposes, you’ll install and use the `infrastructure-deployer` CLI locally; when you’re ready to configure CI/CD, you’ll install and use it in your CI/CD config. If you do not already have the `gruntwork-install` binary installed, you can get it [here.](https://github.com/gruntwork-io/gruntwork-installer) @@ -220,19 +216,19 @@ If you do not already have the `gruntwork-install` binary installed, you can get gruntwork-install --binary-name "infrastructure-deployer" --repo "https://github.com/gruntwork-io/terraform-aws-ci" --tag "$TERRAFORM_AWS_CI_VERSION" ``` :::note -If you'd rather not use the Gruntwork installer, you can alternatively download the binary manually from [the releases page.](https://github.com/gruntwork-io/terraform-aws-ci/releases) +If you’d rather not use the Gruntwork installer, you can alternatively download the binary manually from [the releases page.](https://github.com/gruntwork-io/terraform-aws-ci/releases) ::: ## Invoke your Lambda Function ### Get your Lambda ARN from the output -Next, we need to retrieve the Amazon Resource Name (ARN) for the Lambda function that guards your Gruntwork Pipelines installation: +Next, you need to retrieve the Amazon Resource Name (ARN) for the Lambda function that guards your Gruntwork Pipelines installation: ```shell terraform output -r gruntwork_pipelines_lambda_arn ``` -Once you have your invoker Lambda's ARN, export it like so: +Once you have your invoker Lambda’s ARN, export it like so: ```shell export INVOKER_FUNCTION_ARN= @@ -242,9 +238,9 @@ This value is used by the `run-docker-build.sh` and `run-packer-build.sh` script ### Perform a Docker/Packer build via Pipelines -Now that we have Gruntwork Pipelines installed in the `docker-packer-builder` configuration, let's put arbitrary Docker and Packer builds through it! +Now that you have Gruntwork Pipelines installed in the `docker-packer-builder` configuration, let’s put arbitrary Docker and Packer builds through it! -For your convenience, we've provided two scripts that you can run: +For your convenience, we’ve provided two scripts that you can run: * `run-docker-build.sh` * `run-packer-build.sh` @@ -260,23 +256,23 @@ The following environment variables must be set in your shell before you run `ru * `AWS_REGION` * `INVOKER_FUNCTION_ARN` -## Prepare a test "infrastructure live" repo +## Prepare a test `infrastructure-live` repo You now have a functional Gruntwork Pipelines example that can build and deploy Docker images and AMIs. -Feel free to stop here and experiment with what you've built so far. The following steps will extend +Feel free to stop here and experiment with what you’ve built so far. The following steps will extend pipelines to be capable of running Terraform plan and apply. Pipelines is a flexible solution that can be deployed in many configurations. In your own organization, you might consider deploying one Pipelines installation with all the ECS tasks enabled, or having a central Pipelines installation plus one in each account of your Reference Architecture. -To test the plan and apply functionality, we'll need a simple demo repository. -You may create your own or fork our [testing repo](https://github.com/gruntwork-io/terraform-module-in-root-for-terragrunt-test +To test the plan and apply functionality, you’ll need a simple demo repository. +You may create your own or fork our [testing repo](https://github.com/gruntwork-io/terraform-module-in-root-for-terragrunt-test) ## Enable the Terraform planner and applier -We've intentionally deployed an incomplete version of Gruntwork Pipelines so far. To deploy the full version with the planner -and applier, you'll need make a few edits to the module. In this directory you should see a few files prefixed with `config_`. +We’ve intentionally deployed an incomplete version of Gruntwork Pipelines so far. To deploy the full version with the planner +and applier, you’ll need to make a few edits to the module. In this directory you should see a few files prefixed with `config_`. Two are proper Terraform files with all the configuration for running the Docker image builder and the ami builder. Each consists of @@ -285,8 +281,8 @@ Each consists of The other two files have a `.example` postfix. Remove that postfix to let Terraform discover them. -Next, let's take a look at `main.tf`. You should see a `TODO` around line 37, marking the location where the configuration might normally -live. As this example ships with the Docker image builder and ami builder defined in external files we have commented out +Next, let’s take a look at `main.tf`. You should see a `TODO` in the `locals` block, marking the location where the configuration might normally +live. As this example ships with the Docker image builder and AMI builder defined in external files we have commented out the default null values. Comment out or delete the following lines: @@ -295,28 +291,28 @@ Comment out or delete the following lines: * `terraform_applier_config = null` * `terraform_applier_https_tokens_config = null` -These values are now properly defined in the external `config_` tf files. +These values are now properly defined in the external `config_*.tf` files. ## Configure the Terraform planner and applier -Now that the planner and applier are enabled, we could run `terraform apply`, but the default values of a few +Now that the planner and applier are enabled, you could run `terraform apply`, but the default values of a few variables might not be correct for your test environment. Make the following changes to your `.tfvars` file to -define the correct repos and credentials. Pipelines is configured to reject any commands that aren't explicitly allowed +define the correct repos and credentials. Pipelines is configured to reject any commands that aren’t explicitly allowed by the configuration below: -* `allowed_terraform_planner_repos = ["https://github.com/your-org/your-forked-repo.git"]` - a list of repos where `terraform plan` is allowed to be run -* `allowed_terraform_applier_repos = ["https://github.com/your-org/your-forked-repo.git"]` - a list of repos where `terraform apply` is allowed to be run -* optionally `machine_user_git_info = {name="machine_user_name", email="machine_user_email"}` - if you'd like to customize your machine user info -* optionally `allowed_apply_git_refs = ["master", "main", "branch1", ...]` - for any branches or git refs you'd like to be able to run `terraform apply` on +* `allowed_terraform_planner_repos = ["https://github.com/your-org/your-forked-repo.git"]` — a list of repos where `terraform plan` is allowed to be run +* `allowed_terraform_applier_repos = ["https://github.com/your-org/your-forked-repo.git"]` — a list of repos where `terraform apply` is allowed to be run +* optionally `machine_user_git_info = {name="machine_user_name", email="machine_user_email"}` — if you’d like to customize your machine user info +* optionally `allowed_apply_git_refs = ["master", "main", "branch1", ...]` — for any branches or git refs you’d like to be able to run `terraform apply` on -Now you're ready to run `terraform apply`! Once complete, you should see 2 new ECS task definitions in your AWS account: +Now you’re ready to run `terraform apply`! Once complete, you should see 2 new ECS task definitions in your AWS account: * `ecs-deploy-runner-terraform-planner` * `ecs-deploy-runner-terraform-applier` -## Try a plan or apply +## Try a `plan` or `apply` -With Gruntwork Pipelines deployed, it's time to test it out! Run the following command to trigger -a plan or apply +With Gruntwork Pipelines deployed, it’s time to test it out! Run the following command to trigger +a `plan` or `apply`: ```shell infrastructure-deployer --aws-region us-east-1 -- terraform-planner infrastructure-deploy-script \ @@ -335,14 +331,14 @@ function `arn:aws:lambda:us-east-1::function:ecs-deploy-runner- ## Cleanup -If you want to remove the infrastructure created, you can use Terraform Destroy. +If you want to remove the infrastructure created, you can use Terraform `destroy`. ```shell terraform plan -destroy -out terraform.plan terraform apply terraform.plan ``` -To destroy the `ecr-repositories` resources we created, we'll first need to empty the repos of any images: +To destroy the `ecr-repositories` resources you created, you’ll first need to empty the repos of any images: ```shell aws ecr batch-delete-image --repository-name ecs-deploy-runner --image-ids imageTag=$TERRAFORM_AWS_CI_VERSION diff --git a/docs/pipelines/how-it-works/index.md b/docs/pipelines/how-it-works/index.md index 6a35fcfe4e..e6af1c6481 100644 --- a/docs/pipelines/how-it-works/index.md +++ b/docs/pipelines/how-it-works/index.md @@ -1,13 +1,12 @@ # How it works -## Block Diagram - ![Gruntwork Pipelines Architecture](/img/guides/build-it-yourself/pipelines/tftg-pipeline-architecture.png) ## External CI Tool -Gruntwork Pipelines can be used with any external CI/CD tool. The role of the CI/CD tool is to trigger jobs -inside Gruntwork Pipelines. We have [example configurations](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/master/examples/for-production/infrastructure-live/_ci/scripts) +Gruntwork Pipelines has been validated with CircleCI, Github Actions, and Gitlab. However, it can be used with any external CI/CD tool. +The role of the CI/CD tool is to trigger jobs inside Gruntwork Pipelines. +We have [example configurations](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/master/examples/for-production/infrastructure-live/_ci/scripts) that identify changed terraform modules and call the Gruntwork Pipelines invoker Lambda function. By default, the invoker Lambda function is run by a CLI tool called `infrastructure-deployer` from within your CI tool. @@ -32,11 +31,11 @@ Usage: When launching a task, you may optionally set the following useful flags: -- `max-wait-time` (default 2h0m0s) - timeout length for the action -- `task-cpu` - A custom number of CPU units to allocate to the ECS task -- `task-memory` - A custom number of memory units to allocate to the ECS task +- `max-wait-time` (default 2h0m0s) — timeout length for the action +- `task-cpu` — A custom number of CPU units to allocate to the ECS task +- `task-memory` — A custom number of memory units to allocate to the ECS task -To get the list of supported containers and scripts, pass in the --describe-containers option. For example: +To get the list of supported containers and scripts, pass in the `--describe-containers` option. For example: `infrastructure-deployer --describe-containers --aws-region us-west-2` @@ -57,17 +56,17 @@ It has 3 primary roles: ### Standard Configuration The ECS deploy runner is flexible and can be configured for many tasks. The [standard configuration](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner-standard-configuration) -is a set of 4 ECS task definitions that we ship with Pipelines by default. +is a set of ECS task definitions that we ship with Pipelines by default. Once you have your pipeline deployed you can [modify](../maintain/extending.md) the configuration as you like. The configuration defines what scripts are accepted by the invoker Lambda and which arguments may be provided. The invoker Lambda -will reject ANY script or argument not defined in the ECS Deploy Runner configuration. -The 4 default tasks are defined below. +will reject _any_ script or argument not defined in the ECS Deploy Runner configuration. +The default tasks are defined below. #### Docker Image Builder (Kaniko) The Docker Image Builder task definition allows CI jobs to build docker images. This ECS task uses an open source library called [Kaniko](https://github.com/GoogleContainerTools/kaniko) to enable docker builds from within a docker container. -We provide a [Docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/kaniko) based on kaniko for this task. +We provide a [Docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/kaniko) based on Kaniko for this task. #### Packer AMI Builder @@ -77,13 +76,13 @@ a [Docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modu #### Terraform Planner and Applier The Terraform Planner task definition and Terraform Applier task definition are very similar. They allow CI jobs to -plan and apply terraform and terragrunt code. These tasks run in the same [docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/deploy-runner) -as the AMI builder +plan and apply Terraform and Terragrunt code. These tasks run in the same [Docker image](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner/docker/deploy-runner) +as the AMI builder. diff --git a/docs/pipelines/what-is-it/index.md b/docs/pipelines/overview/index.md similarity index 100% rename from docs/pipelines/what-is-it/index.md rename to docs/pipelines/overview/index.md diff --git a/docs/pipelines/tutorial/index.md b/docs/pipelines/tutorial/index.md index 2b5f0ee0ef..8e9e7fe4aa 100644 --- a/docs/pipelines/tutorial/index.md +++ b/docs/pipelines/tutorial/index.md @@ -1,23 +1,23 @@ -# Tutorial - Single Account Example +# Single Account Tutorial -In this tutorial, we'll walk you through the process of setting up Gruntwork Pipelines in a single -AWS account. By the end, you'll deploy: +In this tutorial, you’ll walk you through the process of setting up Gruntwork Pipelines in a single +AWS account. By the end, you’ll deploy: - ECR Repositories for storing Docker images - - `deploy-runner` - stores the default image for planning and applying terraform and building AMIs - - `kaniko` - stores the default image for building other Docker images using [kaniko](https://github.com/GoogleContainerTools/kaniko) - - `hello-world` - a demonstration repo used for illustrating how a Docker application might be managed with Gruntwork Pipelines + - `deploy-runner` — stores the default image for planning and applying terraform and building AMIs + - `kaniko` — stores the default image for building other Docker images using [kaniko](https://github.com/GoogleContainerTools/kaniko) + - `hello-world` — a demonstration repo used for illustrating how a Docker application might be managed with Gruntwork Pipelines - Our [ECS Deploy Runner Module](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner) - Supporting IAM Roles, IAM Policies, and CloudWatch Log Groups - ECS Tasks - - `docker-image-builder` - builds Docker images within the `kaniko` container image - - `ami-builder` - builds AMIs using HashiCorp Packer within the `deploy-runner` image - - `terraform-planner` - Runs plan commands within the `deploy-runner` container - - `terraform-applier` - Runs apply commands within the `deploy-runner` container + - `docker-image-builder` — builds Docker images within the `kaniko` container image + - `ami-builder` — builds AMIs using HashiCorp Packer within the `deploy-runner` image + - `terraform-planner` — Runs plan commands within the `deploy-runner` container + - `terraform-applier` — Runs apply commands within the `deploy-runner` container ## Prerequisites -Before we begin, make sure your system has: +Before you begin, make sure your system has: - [Docker](https://docs.docker.com/get-docker/), with support for Buildkit (version 18.09 or newer) - [Terraform](https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli) (version 1.0 or newer) @@ -31,7 +31,7 @@ The code for this tutorial can be found in the [Gruntwork Service Catalog](https git clone https://github.com/gruntwork-io/terraform-aws-service-catalog.git ``` -We will be following the example found at `terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pipelines` +You will be following the example found at `terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pipelines` ```shell cd terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pipelines @@ -73,12 +73,12 @@ terraform apply The four standard Gruntwork Pipelines capabilities are instrumented by two separate Docker files -1. `ecs-deploy-runner` - Terraform plan, apply and AMI building -2. `kaniko` - Docker image building. [Kaniko](https://github.com/GoogleContainerTools/kaniko) is a tool that supports building Docker images inside of a container +1. `ecs-deploy-runner` — Terraform plan, apply and AMI building +2. `kaniko` — Docker image building. [Kaniko](https://github.com/GoogleContainerTools/kaniko) is a tool that supports building Docker images inside a container -These Dockerfiles live in the ecs-deploy-runner module within [the terraform-aws-ci repository](https://github.com/gruntwork-io/terraform-aws-ci). In this example, we'll be cloning the terraform-aws-ci and running Docker build against the Dockerfiles defined there. +These Dockerfiles live in the ecs-deploy-runner module within [the terraform-aws-ci repository](https://github.com/gruntwork-io/terraform-aws-ci). In this example, you'll clone the terraform-aws-ci and running Docker build against the Dockerfiles defined there. -We're now going to build these two Docker images and push them to the ECR repositories we just created. +You’re now going to build these two Docker images and push them to the ECR repositories you just created. ### Export Environment Variables @@ -89,11 +89,11 @@ and provision a GitHub PAT against that account. This GitHub PAT will be used for two purposes: 1. Initially, when running the Docker build commands below, the GitHub PAT will be used to fetch private code from `github.com/gruntwork-io`. -2. Once the Docker images are built, you'll store your GitHub PAT in AWS Secrets Manager. When Gruntwork Pipelines is running on your behalf, it will fetch - your GitHub PAT from Secrets Manager "Just in time" so that only the running ECS task has access to the token - and so that your token only exists for the lifespan +2. Once the Docker images are built, you’ll store your GitHub PAT in AWS Secrets Manager. When Gruntwork Pipelines is running on your behalf, it will fetch + your GitHub PAT from Secrets Manager "just in time" so that only the running ECS task has access to the token — and so that your token only exists for the lifespan of the ephemeral ECS task container. -Export a valid GitHub PAT using the following command so that we can use it to build Docker images that fetch private code via GitHub: +Export a valid GitHub PAT using the following command so that you can use it to build Docker images that fetch private code via GitHub: ```shell export GITHUB_OAUTH_TOKEN= ``` @@ -105,7 +105,7 @@ export AWS_REGION= ``` The Gruntwork Pipelines Dockerfiles used by Gruntwork Pipelines are stored in the `gruntwork-io/terraform-aws-ci` repository. Therefore, in order to pin both Dockerfiles -to a known version, we export the following variable which we'll use during our Docker builds: +to a known version, you export the following variable which you’ll use during our Docker builds: ```shell export TERRAFORM_AWS_CI_VERSION=v0.51.4 @@ -114,7 +114,7 @@ export TERRAFORM_AWS_CI_VERSION=v0.51.4 The latest version can be retrieved from the [releases page](https://github.com/gruntwork-io/terraform-aws-ci/releases) of the `gruntwork-io/terraform-aws-ci` repository. At a minimum, `v0.51.4` must be selected. ### Clone `terraform-aws-ci` to your machine -Next, we are going to build the two Docker images required for this example. The Dockerfiles are defined in the [terraform-aws-ci](https://github.com/gruntwork-io/terraform-aws-ci) repository, so it must be available locally: +Next, you are going to build the two Docker images required for this example. The Dockerfiles are defined in the [terraform-aws-ci](https://github.com/gruntwork-io/terraform-aws-ci) repository, so it must be available locally: ```bash git clone git@github.com:gruntwork-io/terraform-aws-ci.git @@ -127,8 +127,8 @@ cd terraform-aws-ci/modules/ecs-deploy-runner ### Build the ecs-deploy-runner and kaniko Docker images -This next command is going to perform a Docker build of the `deploy-runner` image. You don't need to authenticate to AWS in order to run this command, as the build will happen on your machine. -We do, however, pass your exported GitHub PAT into the build as a secret, so that the Docker build can fetch private code from `github.com/gruntwork-io`. Since we're using BuildKit, the token +This next command is going to perform a Docker build of the `deploy-runner` image. You don’t need to authenticate to AWS in order to run this command, as the build will happen on your machine. +We do, however, pass your exported GitHub PAT into the build as a secret, so that the Docker build can fetch private code from `github.com/gruntwork-io`. Since you’re using BuildKit, the token is only used during the build process and does not remain in the final image. Run the following command to build the ecs-deploy-runner Docker image: @@ -140,11 +140,7 @@ DOCKER_BUILDKIT=1 docker build \ ./docker/deploy-runner/ ``` -This next command is going to perform a Docker build of the `kaniko` image. You don't need to authenticate to AWS in order to run this command, as the build will happen on your machine. -We do, however, pass your exported GitHub PAT into the build as a secret, so that the Docker build can fetch private code from `github.com/gruntwork-io`. Since we're using BuildKit, the token -is only used during the build process and does not remain in the final image. - -Similarly to the ecs-deploy-runner image, we'll now use the Kaniko Dockerfile included in this example to build the kaniko image: +Similarly to the ecs-deploy-runner image, you’ll now use the Kaniko Dockerfile included in this example to build the kaniko image: ```shell DOCKER_BUILDKIT=1 docker build \ --secret id=github-token,env=GITHUB_OAUTH_TOKEN \ @@ -153,16 +149,16 @@ DOCKER_BUILDKIT=1 docker build \ ./docker/kaniko/ ``` -### Log and Push to ECR -Now we have local Docker images for ecs-deploy-runner and kaniko that are properly tagged, but before we can push it into the private ECR repository that we created -with our `terraform apply`, we need to authenticate with ECR itself. Authenticate to AWS and run the following: +### Log In and Push to ECR +Now you have local Docker images for ecs-deploy-runner and kaniko that are properly tagged, but before you can push it into the private ECR repository that you created +with our `terraform apply`, you need to authenticate with ECR itself. Authenticate to AWS and run the following: ```shell aws ecr get-login-password --region $AWS_REGION \ | docker login -u AWS --password-stdin "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com" ``` -If you receive a success message from your previous command, you're ready to push your ecs-deploy-runner image: +If you receive a success message from your previous command, you’re ready to push your ecs-deploy-runner image: ```shell docker push "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/ecs-deploy-runner:$TERRAFORM_AWS_CI_VERSION" ``` @@ -173,7 +169,7 @@ docker push "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/kaniko:$TERRAFORM ## Deploy the Pipelines Cluster -Now that the ECR repositories are deployed and have the required Docker images, we are ready +Now that the ECR repositories are deployed and have the required Docker images, you are ready to deploy the rest of Gruntwork Pipelines. The Terraform that defines the setup is defined in `terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pipelines/pipelines-cluster` @@ -183,17 +179,17 @@ cd terraform-aws-service-catalog/examples/for-learning-and-testing/gruntwork-pip ### Export a GitHub Personal Access Token (PAT) For the purposes of this example, you may use the same PAT as before. In a production deployment, best practice -would be to create a separate GitHub machine user account. This modules uses a slightly different naming convention for -its environment variable so you'll need to re-export the token: +would be to create a separate GitHub machine user account. This module uses a slightly different naming convention for +its environment variable, so you’ll need to re-export the token: ```shell export TF_VAR_github_token= ``` ### Configure and Deploy the ecs deploy runner -Authenticate to your AWS account and run init, then apply. +Authenticate to your AWS account and run `init`, then `apply`. :::note -If you are using aws-vault to authenticate on the command line, you must supply the `--no-session` flag as explained in [this KB entry](https://github.com/gruntwork-io/knowledge-base/discussions/647) +If you are using `aws-vault` to authenticate on the command line, you must supply the `--no-session` flag as explained in [this Knowledge Base entry](https://github.com/gruntwork-io/knowledge-base/discussions/647) ::: ```shell @@ -203,15 +199,15 @@ terraform init ```shell terraform plan ``` -Check your plan output before applying +Check your plan output before applying: ```shell terraform apply ``` ## Install the `infrastructure-deployer` command line tool -Gruntwork Pipelines requires all requests to transit through its fronting Lambda function, which ensures only valid arguments and commands are passed along to ECS. -To invoke Gruntwork Pipelines's fronting Lambda function, you should use the `infrastructure-deployer` command line interface (CLI) tool. For testing and setup purposes, we'll install and use the `infrastructure-deployer` CLI locally; when you're ready to configure CI / CD, you'll install and use it in your CI / CD config. +Gruntwork Pipelines requires all requests to transit through its Lambda function, which ensures only valid arguments and commands are passed along to ECS. +To invoke the Lambda function, you should use the `infrastructure-deployer` command line interface (CLI) tool. For testing and setup purposes, you’ll install and use the `infrastructure-deployer` CLI locally; when you’re ready to configure CI/CD, you’ll install and use it in your CI/CD config. If you do not already have the `gruntwork-install` binary installed, you can get it [here.](https://github.com/gruntwork-io/gruntwork-installer) @@ -220,19 +216,19 @@ If you do not already have the `gruntwork-install` binary installed, you can get gruntwork-install --binary-name "infrastructure-deployer" --repo "https://github.com/gruntwork-io/terraform-aws-ci" --tag "$TERRAFORM_AWS_CI_VERSION" ``` :::note -If you'd rather not use the Gruntwork installer, you can alternatively download the binary manually from [the releases page.](https://github.com/gruntwork-io/terraform-aws-ci/releases) +If you’d rather not use the Gruntwork installer, you can alternatively download the binary manually from [the releases page.](https://github.com/gruntwork-io/terraform-aws-ci/releases) ::: ## Invoke your Lambda Function ### Get your Lambda ARN from the output -Next, we need to retrieve the Amazon Resource Name (ARN) for the Lambda function that guards your Gruntwork Pipelines installation: +Next, you need to retrieve the Amazon Resource Name (ARN) for the Lambda function that guards your Gruntwork Pipelines installation: ```shell terraform output -r gruntwork_pipelines_lambda_arn ``` -Once you have your invoker Lambda's ARN, export it like so: +Once you have your invoker Lambda’s ARN, export it like so: ```shell export INVOKER_FUNCTION_ARN= @@ -242,9 +238,9 @@ This value is used by the `run-docker-build.sh` and `run-packer-build.sh` script ### Perform a Docker/Packer build via Pipelines -Now that we have Gruntwork Pipelines installed in the `docker-packer-builder` configuration, let's put arbitrary Docker and Packer builds through it! +Now that you have Gruntwork Pipelines installed in the `docker-packer-builder` configuration, let’s put arbitrary Docker and Packer builds through it! -For your convenience, we've provided two scripts that you can run: +For your convenience, we’ve provided two scripts that you can run: * `run-docker-build.sh` * `run-packer-build.sh` @@ -260,23 +256,23 @@ The following environment variables must be set in your shell before you run `ru * `AWS_REGION` * `INVOKER_FUNCTION_ARN` -## Prepare a test "infrastructure live" repo +## Prepare a test `infrastructure-live` repo You now have a functional Gruntwork Pipelines example that can build and deploy Docker images and AMIs. -Feel free to stop here and experiment with what you've built so far. The following steps will extend +Feel free to stop here and experiment with what you’ve built so far. The following steps will extend pipelines to be capable of running Terraform plan and apply. Pipelines is a flexible solution that can be deployed in many configurations. In your own organization, you might consider deploying one Pipelines installation with all the ECS tasks enabled, or having a central Pipelines installation plus one in each account of your Reference Architecture. -To test the plan and apply functionality, we'll need a simple demo repository. -You may create your own or fork our [testing repo](https://github.com/gruntwork-io/terraform-module-in-root-for-terragrunt-test +To test the plan and apply functionality, you’ll need a simple demo repository. +You may create your own or fork our [testing repo](https://github.com/gruntwork-io/terraform-module-in-root-for-terragrunt-test) ## Enable the Terraform planner and applier -We've intentionally deployed an incomplete version of Gruntwork Pipelines so far. To deploy the full version with the planner -and applier, you'll need make a few edits to the module. In this directory you should see a few files prefixed with `config_`. +We’ve intentionally deployed an incomplete version of Gruntwork Pipelines so far. To deploy the full version with the planner +and applier, you’ll need to make a few edits to the module. In this directory you should see a few files prefixed with `config_`. Two are proper Terraform files with all the configuration for running the Docker image builder and the ami builder. Each consists of @@ -285,8 +281,8 @@ Each consists of The other two files have a `.example` postfix. Remove that postfix to let Terraform discover them. -Next, let's take a look at `main.tf`. You should see a `TODO` around line 37, marking the location where the configuration might normally -live. As this example ships with the Docker image builder and ami builder defined in external files we have commented out +Next, let’s take a look at `main.tf`. You should see a `TODO` in the `locals` block, marking the location where the configuration might normally +live. As this example ships with the Docker image builder and AMI builder defined in external files we have commented out the default null values. Comment out or delete the following lines: @@ -295,28 +291,28 @@ Comment out or delete the following lines: * `terraform_applier_config = null` * `terraform_applier_https_tokens_config = null` -These values are now properly defined in the external `config_` tf files. +These values are now properly defined in the external `config_*.tf` files. ## Configure the Terraform planner and applier -Now that the planner and applier are enabled, we could run `terraform apply`, but the default values of a few +Now that the planner and applier are enabled, you could run `terraform apply`, but the default values of a few variables might not be correct for your test environment. Make the following changes to your `.tfvars` file to -define the correct repos and credentials. Pipelines is configured to reject any commands that aren't explicitly allowed +define the correct repos and credentials. Pipelines is configured to reject any commands that aren’t explicitly allowed by the configuration below: -* `allowed_terraform_planner_repos = ["https://github.com/your-org/your-forked-repo.git"]` - a list of repos where `terraform plan` is allowed to be run -* `allowed_terraform_applier_repos = ["https://github.com/your-org/your-forked-repo.git"]` - a list of repos where `terraform apply` is allowed to be run -* optionally `machine_user_git_info = {name="machine_user_name", email="machine_user_email"}` - if you'd like to customize your machine user info -* optionally `allowed_apply_git_refs = ["master", "main", "branch1", ...]` - for any branches or git refs you'd like to be able to run `terraform apply` on +* `allowed_terraform_planner_repos = ["https://github.com/your-org/your-forked-repo.git"]` — a list of repos where `terraform plan` is allowed to be run +* `allowed_terraform_applier_repos = ["https://github.com/your-org/your-forked-repo.git"]` — a list of repos where `terraform apply` is allowed to be run +* optionally `machine_user_git_info = {name="machine_user_name", email="machine_user_email"}` — if you’d like to customize your machine user info +* optionally `allowed_apply_git_refs = ["master", "main", "branch1", ...]` — for any branches or git refs you’d like to be able to run `terraform apply` on -Now you're ready to run `terraform apply`! Once complete, you should see 2 new ECS task definitions in your AWS account: +Now you’re ready to run `terraform apply`! Once complete, you should see 2 new ECS task definitions in your AWS account: * `ecs-deploy-runner-terraform-planner` * `ecs-deploy-runner-terraform-applier` -## Try a plan or apply +## Try a `plan` or `apply` -With Gruntwork Pipelines deployed, it's time to test it out! Run the following command to trigger -a plan or apply +With Gruntwork Pipelines deployed, it’s time to test it out! Run the following command to trigger +a `plan` or `apply`: ```shell infrastructure-deployer --aws-region us-east-1 -- terraform-planner infrastructure-deploy-script \ @@ -335,14 +331,14 @@ function `arn:aws:lambda:us-east-1::function:ecs-deploy-runner- ## Cleanup -If you want to remove the infrastructure created, you can use Terraform Destroy. +If you want to remove the infrastructure created, you can use Terraform `destroy`. ```shell terraform plan -destroy -out terraform.plan terraform apply terraform.plan ``` -To destroy the `ecr-repositories` resources we created, we'll first need to empty the repos of any images: +To destroy the `ecr-repositories` resources you created, you’ll first need to empty the repos of any images: ```shell aws ecr batch-delete-image --repository-name ecs-deploy-runner --image-ids imageTag=$TERRAFORM_AWS_CI_VERSION @@ -362,6 +358,6 @@ terraform apply terraform.plan diff --git a/docusaurus.config.js b/docusaurus.config.js index f41219cab7..a1e2c1f636 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -107,7 +107,7 @@ const config = { { type: "doc", label: "Gruntwork Pipelines", - docId: "pipelines/what-is-it/index" + docId: "pipelines/overview/index" }, { type: "doc", diff --git a/sidebars/pipelines.js b/sidebars/pipelines.js index 8ea3f1d3c8..200e419c08 100644 --- a/sidebars/pipelines.js +++ b/sidebars/pipelines.js @@ -12,7 +12,7 @@ const sidebar = [ { label: "What is Gruntwork Pipelines?", type: "doc", - id: "pipelines/what-is-it/index" + id: "pipelines/overview/index" }, ] }, From fe4705182e3b9601ac8b3cd2d25e8c5aa275dfdd Mon Sep 17 00:00:00 2001 From: Max Moon Date: Thu, 25 May 2023 11:28:11 -0700 Subject: [PATCH 63/89] flip order of sidebar for iac library reference (#819) --- sidebars/library-reference.js | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/sidebars/library-reference.js b/sidebars/library-reference.js index 7403d80d86..06e2ef03e2 100644 --- a/sidebars/library-reference.js +++ b/sidebars/library-reference.js @@ -9,13 +9,6 @@ const sidebar = [ type: "doc", id: "iac/reference/index", }, - { - type: "category", - collapsible: true, - collapsed: false, - label: "Module Catalog", - items: [{ type: "autogenerated", dirName: "reference/modules" }], - }, { type: "category", collapsible: true, @@ -72,6 +65,13 @@ const sidebar = [ }, ], }, + { + type: "category", + collapsible: true, + collapsed: false, + label: "Module Catalog", + items: [{ type: "autogenerated", dirName: "reference/modules" }], + }, ] }, ] From 1dc5d2778096930c9903e71e9c1da19ae8896c71 Mon Sep 17 00:00:00 2001 From: Zack Proser Date: Thu, 25 May 2023 14:36:38 -0400 Subject: [PATCH 64/89] feat(CORE-944): RefArch configuration (#802) * Add RefArch configuration pages --------- Co-authored-by: Max Moon Co-authored-by: Andrew Ellison --- .../gruntwork-cli.md | 7 --- .../index.md | 3 - .../path1.md | 26 --------- .../preflight-checks.md | 7 --- _docs-sources/refarch/bootstrapping/index.md | 7 --- _docs-sources/refarch/configuration/index.md | 47 +++++++++++++++ .../configuration/install-required-tools.md | 30 ++++++++++ .../refarch/configuration/preflight-checks.md | 38 ++++++++++++ .../provision-accounts.md | 0 .../route53.md | 0 .../refarch/configuration/run-the-wizard.md | 19 ++++++ .../setup-quotas.md | 0 .../gruntwork-cli.md | 15 ----- .../index.md | 11 ---- .../path1.md | 34 ----------- .../preflight-checks.md | 15 ----- docs/refarch/bootstrapping/index.md | 15 ----- docs/refarch/configuration/index.md | 55 ++++++++++++++++++ .../configuration/install-required-tools.md | 38 ++++++++++++ .../refarch/configuration/preflight-checks.md | 46 +++++++++++++++ .../provision-accounts.md | 0 .../route53.md | 0 docs/refarch/configuration/run-the-wizard.md | 27 +++++++++ .../setup-quotas.md | 0 sidebars/refarch.js | 16 +++-- static/img/preflight-error-on-pr.png | Bin 0 -> 832131 bytes static/img/preflight1.png | Bin 0 -> 51427 bytes 27 files changed, 307 insertions(+), 149 deletions(-) delete mode 100644 _docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli.md delete mode 100644 _docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/index.md delete mode 100644 _docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md delete mode 100644 _docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks.md delete mode 100644 _docs-sources/refarch/bootstrapping/index.md create mode 100644 _docs-sources/refarch/configuration/index.md create mode 100644 _docs-sources/refarch/configuration/install-required-tools.md create mode 100644 _docs-sources/refarch/configuration/preflight-checks.md rename _docs-sources/refarch/{bootstrapping/configuring-your-refarch-for-delivery => configuration}/provision-accounts.md (100%) rename _docs-sources/refarch/{bootstrapping/configuring-your-refarch-for-delivery => configuration}/route53.md (100%) create mode 100644 _docs-sources/refarch/configuration/run-the-wizard.md rename _docs-sources/refarch/{bootstrapping/configuring-your-refarch-for-delivery => configuration}/setup-quotas.md (100%) delete mode 100644 docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli.md delete mode 100644 docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/index.md delete mode 100644 docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md delete mode 100644 docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks.md delete mode 100644 docs/refarch/bootstrapping/index.md create mode 100644 docs/refarch/configuration/index.md create mode 100644 docs/refarch/configuration/install-required-tools.md create mode 100644 docs/refarch/configuration/preflight-checks.md rename docs/refarch/{bootstrapping/configuring-your-refarch-for-delivery => configuration}/provision-accounts.md (100%) rename docs/refarch/{bootstrapping/configuring-your-refarch-for-delivery => configuration}/route53.md (100%) create mode 100644 docs/refarch/configuration/run-the-wizard.md rename docs/refarch/{bootstrapping/configuring-your-refarch-for-delivery => configuration}/setup-quotas.md (100%) create mode 100644 static/img/preflight-error-on-pr.png create mode 100644 static/img/preflight1.png diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli.md deleted file mode 100644 index 85f55be5ce..0000000000 --- a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli.md +++ /dev/null @@ -1,7 +0,0 @@ -# The Gruntwork command line interface (CLI) - -Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. - -Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. - -Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/index.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/index.md deleted file mode 100644 index 0e7bd6273c..0000000000 --- a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/index.md +++ /dev/null @@ -1,3 +0,0 @@ -# Configuring your Refarch for delivery - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md deleted file mode 100644 index 18cba9ff72..0000000000 --- a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md +++ /dev/null @@ -1,26 +0,0 @@ -# Using the Gruntwork CLI - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. - -Just use it. - -Please - -please - -please use the wizard - - - - - - - - - -pls - -# Path 2. Contact us - -Please use the wizard - diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks.md b/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks.md deleted file mode 100644 index 96570df589..0000000000 --- a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks.md +++ /dev/null @@ -1,7 +0,0 @@ -# Reference Architecture Preflight checks - -Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. - -Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. - -Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. diff --git a/_docs-sources/refarch/bootstrapping/index.md b/_docs-sources/refarch/bootstrapping/index.md deleted file mode 100644 index 7c5c7f7579..0000000000 --- a/_docs-sources/refarch/bootstrapping/index.md +++ /dev/null @@ -1,7 +0,0 @@ -# Bootstrapping your Reference Architecture - -Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. - -Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. - -Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. diff --git a/_docs-sources/refarch/configuration/index.md b/_docs-sources/refarch/configuration/index.md new file mode 100644 index 0000000000..136696d067 --- /dev/null +++ b/_docs-sources/refarch/configuration/index.md @@ -0,0 +1,47 @@ +# Get Started + +The Gruntwork Reference Architecture allows you to configure key aspects to your needs. Before you receive your deployed Reference Architecture, you will: +1. **Configure** your choice of your primary AWS region, database and compute flavors, domain names and more via a pull request +2. **Iterate** on the configuration in your pull request in response to Gruntwork preflight checks that spot blocking issues and ensure your deployment is ready to commence +3. **Merge** your pull request after all checks pass. Merging will automatically commence your Reference Architecture deployment +4. **Wait** until Gruntwork has successfully completed your deployment. You’ll receive an automated email indicating your deployment is complete + +Below, we'll outline the Reference Architecture at a high level. + +note: add pre-reqs section about things you need to know + +## Requirements + +This guide requires that you have access to an AWS IAM user or role in the AWS account that serves as your Organization Root for AWS Organizations with permissions to create member accounts. For more information on IAM policies for AWS organizations see the AWS guide on [managing IAM policies for AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_permissions_iam-policies.html#orgs_permissions_grant-admin-actions). + +## RefArch Configuration + +Your Reference Architecture configuration lives in your `infrastructure-live` repository on GitHub. Within your `infrastructure-live` repository, the `reference-architecture-form.yml` file defines all of your specific selections, domain names, AWS account IDs, etc. + +Gruntwork deployment tooling reads your `reference-architecture-form.yml` in order to first perform preflight checks to +ensure your accounts and selections are valid and ready for deployment. Once your preflight checks pass, and your pull request has been merged, Gruntwork tooling uses your `reference-architecture-form.yml` to deploy your Reference Architecture into your AWS accounts. + +Gruntwork provides bootstrap scripts, automated tooling, documentation and support to help you complete your setup steps and commence your Reference Architecture deployment. + +## Required Actions and Data +Some of the initial configuration steps will require you to *perform actions* against your AWS accounts, such as creating an IAM role that Gruntwork uses to access your accounts. Meanwhile, your `reference-architecture-form.yml` requires *data*, such as your AWS account IDs, domain name, etc. + +### Actions + +Wherever possible, Gruntwork attempts to automate setup actions *for you*. + +There is a bootstrap script in your `infrastructure-live` repository that will attempt to programmatically complete your setup actions (such as provisioning new AWS accounts on your behalf, registering domain names if you wish, etc) using a setup wizard and write the resulting *data* to your `reference-architecture-form.yml` file. + +### Data +`Data` refers to values, such as an AWS account ID, your desired domain name, etc, which may be the output of an action. + +The gruntwork CLI includes a [wizard](./run-the-wizard.md) that automates all of the steps to get the required data from you. We strongly recommended using the wizard for the majority of users. + +:::info Manual Configuration +If you are required to manually provision AWS accounts, domain names, or otherwise, the Gruntwork CLI has utilities to [manually bootstrap](https://github.com/gruntwork-io/gruntwork#bootstrap-manually) the required resources. This approach is only recommended for advanced users after consulting with Gruntwork. After all data has been generated manually, you will need to fill out the `reference-architecture-form.yml` manually. +::: + +## Let’s get started! + +Now that you understand the configuration and delivery process at a high level, we’ll get underway configuring your Reference Architecture. + diff --git a/_docs-sources/refarch/configuration/install-required-tools.md b/_docs-sources/refarch/configuration/install-required-tools.md new file mode 100644 index 0000000000..ed915bccb6 --- /dev/null +++ b/_docs-sources/refarch/configuration/install-required-tools.md @@ -0,0 +1,30 @@ +# Install Required Tools + +Configuring your Reference Architecture requires that you have `git` and the `gruntwork` CLI tool installed on your machine. You have two options for installation. + +## Use the bootstrap script (preferred) + +The bootstrap script will ensure you have all required dependencies installed. Within your `infrastructure-live` repository, there are two bootstrap scripts. +- `bootstrap_unix.sh` which can be run on macOS and Linux machines +- `bootstrap_windows.py` which runs on Windows machines + +Choose the correct bootstrap script for your system. Both scripts perform the equivalent functionality. + +In addition to installing dependencies, the bootstrap script will: +- Ensure you are running the script in the root of your `infrastructure-live` repository +- Ensure you have sufficient GitHub access to access and clone private Gruntwork repositories +- Download the Gruntwork installer +- Install the Gruntwork command line interface (CLI) which contains the Reference Architecture configuration wizard +- [Run the Gruntwork wizard](./run-the-wizard) to assist you in completing your Reference Architecture configuration steps (see docs for [required permissions](./run-the-wizard.md#required-permissions)) + +## Install manually + +:::caution +We do not recommend this approach. TODO: Finish this section +::: + +If you prefer to install your tools manually, see the following sections on installing Git and the Gruntwork CLI. + +1. If you would like to install `git` manually, installation steps can be found on the [Git SCM Installing Git Guide](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git). +2. If you would like to install the Gruntwork CLI manually, we recommend downloading the latest release from the [GitHub releases page](https://github.com/gruntwork-io/gruntwork/releases). + diff --git a/_docs-sources/refarch/configuration/preflight-checks.md b/_docs-sources/refarch/configuration/preflight-checks.md new file mode 100644 index 0000000000..e8c55344e1 --- /dev/null +++ b/_docs-sources/refarch/configuration/preflight-checks.md @@ -0,0 +1,38 @@ +# Iterate on Preflight checks + +Once you have run the setup wizard and pushed your `ref-arch-form` branch with your changes, GitHub Actions will commence, running the preflight checks. + +![Gruntwork Reference Architecture preflight checks](/img/preflight1.png) + +Preflight checks can take up to 4–5 minutes to complete after you push your commit. Any errors will be +directly annotated on the exact line of your form that presents a blocking issue, so be sure to check the *Files changed* tab of your pull request to see them: + +![Gruntwork Ref Arch preflight checks on your pull request](/img/preflight-error-on-pr.png) + +## Fix any errors + +In most cases, the error messages included in the preflight check annotations will provide sufficient information to remediate the underlying issue. If at any point you are confused or +need assistance, please reach out to us at `support@gruntwork.io` and we’ll be happy to assist you. + +## Commit and push your changes + +Once you have fixed any issues flagged by preflight checks, you can make a new commit with your latest form changes and push it up to the same branch. This will trigger a re-run of preflight +checks using your latest form data. + +## Merge your pull request + +Once your preflight checks pass, meaning there are no more error annotations on your pull request +and the GitHub check itself is green, you can merge your pull request to the `main` branch. + +## Wait for your deployment to complete + +Merging your `ref-arch-form` pull request to the `main` branch will automatically kick off the deployment process for your Reference Architecture. There’s nothing more for you to do at this point. + +:::caution +During deployment we ask that you do not log into, modify or interact with your Reference Architecture AWS accounts in any way or make any modifications to your `infrastructure-live` repo once you have merged your pull request. +::: + +Your deployment is now in Gruntwork engineers’ hands and we are notified of every single error your deployment encounters. We’ll work behind the scenes to complete your deployment, communicating with you via email or GitHub if we need +any additional information or if we need you to perform any remediation steps to un-block your deployment. + +Once your deployment completes, you’ll receive an automated email with next steps and a link to your Quick Start guide that has been written to your `infrastructure-live` repository. diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md b/_docs-sources/refarch/configuration/provision-accounts.md similarity index 100% rename from _docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md rename to _docs-sources/refarch/configuration/provision-accounts.md diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md b/_docs-sources/refarch/configuration/route53.md similarity index 100% rename from _docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md rename to _docs-sources/refarch/configuration/route53.md diff --git a/_docs-sources/refarch/configuration/run-the-wizard.md b/_docs-sources/refarch/configuration/run-the-wizard.md new file mode 100644 index 0000000000..9e6cc5f44e --- /dev/null +++ b/_docs-sources/refarch/configuration/run-the-wizard.md @@ -0,0 +1,19 @@ +# Run the Wizard + +The Gruntwork CLI features a wizard designed to assist you in completing your Reference Architecture setup actions. The Gruntwork CLI wizard attempts to orchestrate all required configuration actions, such as provisioning AWS accounts, creating IAM roles used by Gruntwork tooling and engineers in each of the AWS accounts, registering new Route53 domain names, configuring Route53 Hosted Zones, and much more. + +If you have already run the wizard using the [bootstrap script](./install-required-tools.md#use-the-bootstrap-script-preferred), then you can skip this step. + +## Installation + +Installation instructions for the Gruntwork CLI can be found in [Install Required Tools](./install-required-tools.md#installing-gruntwork-cli). + +## Required Permissions + +To run the wizard you will need access to the AWS account that serves as the Organization Root of your AWS Organization. At a minimum, the AWS IAM user or role will need the `organizations:CreateAccount` action, which grants the ability to create member accounts. + +## Running the wizard + +To commence the wizard, first authenticate to AWS on the command line, then run `gruntwork wizard`. + +If you need to stop the running the wizard at any time, or if there is an error, the next time you run the wizard it will restart at the last step it stopped on. diff --git a/_docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md b/_docs-sources/refarch/configuration/setup-quotas.md similarity index 100% rename from _docs-sources/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md rename to _docs-sources/refarch/configuration/setup-quotas.md diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli.md deleted file mode 100644 index a156e2e902..0000000000 --- a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/gruntwork-cli.md +++ /dev/null @@ -1,15 +0,0 @@ -# The Gruntwork command line interface (CLI) - -Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. - -Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. - -Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. - - - diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/index.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/index.md deleted file mode 100644 index 5c3181b142..0000000000 --- a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/index.md +++ /dev/null @@ -1,11 +0,0 @@ -# Configuring your Refarch for delivery - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. - - - diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md deleted file mode 100644 index fba6643ab2..0000000000 --- a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/path1.md +++ /dev/null @@ -1,34 +0,0 @@ -# Using the Gruntwork CLI - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. - -Just use it. - -Please - -please - -please use the wizard - - - - - - - - - -pls - -# Path 2. Contact us - -Please use the wizard - - - - diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks.md b/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks.md deleted file mode 100644 index 04fc6a8f8e..0000000000 --- a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks.md +++ /dev/null @@ -1,15 +0,0 @@ -# Reference Architecture Preflight checks - -Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. - -Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. - -Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. - - - diff --git a/docs/refarch/bootstrapping/index.md b/docs/refarch/bootstrapping/index.md deleted file mode 100644 index 2ebdeff3f8..0000000000 --- a/docs/refarch/bootstrapping/index.md +++ /dev/null @@ -1,15 +0,0 @@ -# Bootstrapping your Reference Architecture - -Haxx0r ipsum mainframe bang ssh data public root client wombat recursively. Hexadecimal snarf chown highjack sudo for suitably small values null default bar unix server man pages endif ascii linux kilo tcp tunnel in. Long giga afk crack infinite loop buffer worm foo Dennis Ritchie. - -Protocol then bit while bar back door perl bang shell client bytes ifdef baz. Hello world mountain dew injection malloc var tunnel in todo class. For tera port bypass function packet sniffer for error char pragma printf sudo over clock grep continue. - -Linux mega var alloc xss linux tunnel in gc stdio.h int win back door mountain dew. Float I'm compiling null nak endif fatal Starcraft irc. Stack tcp foad port protocol ban protected eof ascii *.* blob flood then cat. - - - diff --git a/docs/refarch/configuration/index.md b/docs/refarch/configuration/index.md new file mode 100644 index 0000000000..ce5d5c031d --- /dev/null +++ b/docs/refarch/configuration/index.md @@ -0,0 +1,55 @@ +# Get Started + +The Gruntwork Reference Architecture allows you to configure key aspects to your needs. Before you receive your deployed Reference Architecture, you will: +1. **Configure** your choice of your primary AWS region, database and compute flavors, domain names and more via a pull request +2. **Iterate** on the configuration in your pull request in response to Gruntwork preflight checks that spot blocking issues and ensure your deployment is ready to commence +3. **Merge** your pull request after all checks pass. Merging will automatically commence your Reference Architecture deployment +4. **Wait** until Gruntwork has successfully completed your deployment. You’ll receive an automated email indicating your deployment is complete + +Below, we'll outline the Reference Architecture at a high level. + +note: add pre-reqs section about things you need to know + +## Requirements + +This guide requires that you have access to an AWS IAM user or role in the AWS account that serves as your Organization Root for AWS Organizations with permissions to create member accounts. For more information on IAM policies for AWS organizations see the AWS guide on [managing IAM policies for AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_permissions_iam-policies.html#orgs_permissions_grant-admin-actions). + +## RefArch Configuration + +Your Reference Architecture configuration lives in your `infrastructure-live` repository on GitHub. Within your `infrastructure-live` repository, the `reference-architecture-form.yml` file defines all of your specific selections, domain names, AWS account IDs, etc. + +Gruntwork deployment tooling reads your `reference-architecture-form.yml` in order to first perform preflight checks to +ensure your accounts and selections are valid and ready for deployment. Once your preflight checks pass, and your pull request has been merged, Gruntwork tooling uses your `reference-architecture-form.yml` to deploy your Reference Architecture into your AWS accounts. + +Gruntwork provides bootstrap scripts, automated tooling, documentation and support to help you complete your setup steps and commence your Reference Architecture deployment. + +## Required Actions and Data +Some of the initial configuration steps will require you to *perform actions* against your AWS accounts, such as creating an IAM role that Gruntwork uses to access your accounts. Meanwhile, your `reference-architecture-form.yml` requires *data*, such as your AWS account IDs, domain name, etc. + +### Actions + +Wherever possible, Gruntwork attempts to automate setup actions *for you*. + +There is a bootstrap script in your `infrastructure-live` repository that will attempt to programmatically complete your setup actions (such as provisioning new AWS accounts on your behalf, registering domain names if you wish, etc) using a setup wizard and write the resulting *data* to your `reference-architecture-form.yml` file. + +### Data +`Data` refers to values, such as an AWS account ID, your desired domain name, etc, which may be the output of an action. + +The gruntwork CLI includes a [wizard](./run-the-wizard.md) that automates all of the steps to get the required data from you. We strongly recommended using the wizard for the majority of users. + +:::info Manual Configuration +If you are required to manually provision AWS accounts, domain names, or otherwise, the Gruntwork CLI has utilities to [manually bootstrap](https://github.com/gruntwork-io/gruntwork#bootstrap-manually) the required resources. This approach is only recommended for advanced users after consulting with Gruntwork. After all data has been generated manually, you will need to fill out the `reference-architecture-form.yml` manually. +::: + +## Let’s get started! + +Now that you understand the configuration and delivery process at a high level, we’ll get underway configuring your Reference Architecture. + + + + diff --git a/docs/refarch/configuration/install-required-tools.md b/docs/refarch/configuration/install-required-tools.md new file mode 100644 index 0000000000..b8d4147efc --- /dev/null +++ b/docs/refarch/configuration/install-required-tools.md @@ -0,0 +1,38 @@ +# Install Required Tools + +Configuring your Reference Architecture requires that you have `git` and the `gruntwork` CLI tool installed on your machine. You have two options for installation. + +## Use the bootstrap script (preferred) + +The bootstrap script will ensure you have all required dependencies installed. Within your `infrastructure-live` repository, there are two bootstrap scripts. +- `bootstrap_unix.sh` which can be run on macOS and Linux machines +- `bootstrap_windows.py` which runs on Windows machines + +Choose the correct bootstrap script for your system. Both scripts perform the equivalent functionality. + +In addition to installing dependencies, the bootstrap script will: +- Ensure you are running the script in the root of your `infrastructure-live` repository +- Ensure you have sufficient GitHub access to access and clone private Gruntwork repositories +- Download the Gruntwork installer +- Install the Gruntwork command line interface (CLI) which contains the Reference Architecture configuration wizard +- [Run the Gruntwork wizard](./run-the-wizard) to assist you in completing your Reference Architecture configuration steps (see docs for [required permissions](./run-the-wizard.md#required-permissions)) + +## Install manually + +:::caution +We do not recommend this approach. TODO: Finish this section +::: + +If you prefer to install your tools manually, see the following sections on installing Git and the Gruntwork CLI. + +1. If you would like to install `git` manually, installation steps can be found on the [Git SCM Installing Git Guide](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git). +2. If you would like to install the Gruntwork CLI manually, we recommend downloading the latest release from the [GitHub releases page](https://github.com/gruntwork-io/gruntwork/releases). + + + + diff --git a/docs/refarch/configuration/preflight-checks.md b/docs/refarch/configuration/preflight-checks.md new file mode 100644 index 0000000000..f5e3d2e5dc --- /dev/null +++ b/docs/refarch/configuration/preflight-checks.md @@ -0,0 +1,46 @@ +# Iterate on Preflight checks + +Once you have run the setup wizard and pushed your `ref-arch-form` branch with your changes, GitHub Actions will commence, running the preflight checks. + +![Gruntwork Reference Architecture preflight checks](/img/preflight1.png) + +Preflight checks can take up to 4–5 minutes to complete after you push your commit. Any errors will be +directly annotated on the exact line of your form that presents a blocking issue, so be sure to check the *Files changed* tab of your pull request to see them: + +![Gruntwork Ref Arch preflight checks on your pull request](/img/preflight-error-on-pr.png) + +## Fix any errors + +In most cases, the error messages included in the preflight check annotations will provide sufficient information to remediate the underlying issue. If at any point you are confused or +need assistance, please reach out to us at `support@gruntwork.io` and we’ll be happy to assist you. + +## Commit and push your changes + +Once you have fixed any issues flagged by preflight checks, you can make a new commit with your latest form changes and push it up to the same branch. This will trigger a re-run of preflight +checks using your latest form data. + +## Merge your pull request + +Once your preflight checks pass, meaning there are no more error annotations on your pull request +and the GitHub check itself is green, you can merge your pull request to the `main` branch. + +## Wait for your deployment to complete + +Merging your `ref-arch-form` pull request to the `main` branch will automatically kick off the deployment process for your Reference Architecture. There’s nothing more for you to do at this point. + +:::caution +During deployment we ask that you do not log into, modify or interact with your Reference Architecture AWS accounts in any way or make any modifications to your `infrastructure-live` repo once you have merged your pull request. +::: + +Your deployment is now in Gruntwork engineers’ hands and we are notified of every single error your deployment encounters. We’ll work behind the scenes to complete your deployment, communicating with you via email or GitHub if we need +any additional information or if we need you to perform any remediation steps to un-block your deployment. + +Once your deployment completes, you’ll receive an automated email with next steps and a link to your Quick Start guide that has been written to your `infrastructure-live` repository. + + + diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md b/docs/refarch/configuration/provision-accounts.md similarity index 100% rename from docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts.md rename to docs/refarch/configuration/provision-accounts.md diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md b/docs/refarch/configuration/route53.md similarity index 100% rename from docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/route53.md rename to docs/refarch/configuration/route53.md diff --git a/docs/refarch/configuration/run-the-wizard.md b/docs/refarch/configuration/run-the-wizard.md new file mode 100644 index 0000000000..a9bb1aaf70 --- /dev/null +++ b/docs/refarch/configuration/run-the-wizard.md @@ -0,0 +1,27 @@ +# Run the Wizard + +The Gruntwork CLI features a wizard designed to assist you in completing your Reference Architecture setup actions. The Gruntwork CLI wizard attempts to orchestrate all required configuration actions, such as provisioning AWS accounts, creating IAM roles used by Gruntwork tooling and engineers in each of the AWS accounts, registering new Route53 domain names, configuring Route53 Hosted Zones, and much more. + +If you have already run the wizard using the [bootstrap script](./install-required-tools.md#use-the-bootstrap-script-preferred), then you can skip this step. + +## Installation + +Installation instructions for the Gruntwork CLI can be found in [Install Required Tools](./install-required-tools.md#installing-gruntwork-cli). + +## Required Permissions + +To run the wizard you will need access to the AWS account that serves as the Organization Root of your AWS Organization. At a minimum, the AWS IAM user or role will need the `organizations:CreateAccount` action, which grants the ability to create member accounts. + +## Running the wizard + +To commence the wizard, first authenticate to AWS on the command line, then run `gruntwork wizard`. + +If you need to stop the running the wizard at any time, or if there is an error, the next time you run the wizard it will restart at the last step it stopped on. + + + diff --git a/docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md b/docs/refarch/configuration/setup-quotas.md similarity index 100% rename from docs/refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas.md rename to docs/refarch/configuration/setup-quotas.md diff --git a/sidebars/refarch.js b/sidebars/refarch.js index 5bbe89947e..8ed25a1be4 100644 --- a/sidebars/refarch.js +++ b/sidebars/refarch.js @@ -19,12 +19,10 @@ const sidebar = [ type: "category", collapsible: false, items: [ - "refarch/bootstrapping/configuring-your-refarch-for-delivery/index", - "refarch/bootstrapping/configuring-your-refarch-for-delivery/path1", - "refarch/bootstrapping/configuring-your-refarch-for-delivery/preflight-checks", - "refarch/bootstrapping/configuring-your-refarch-for-delivery/provision-accounts", - "refarch/bootstrapping/configuring-your-refarch-for-delivery/setup-quotas", - "refarch/bootstrapping/configuring-your-refarch-for-delivery/route53", + "refarch/configuration/index", + "refarch/configuration/install-required-tools", + "refarch/configuration/run-the-wizard", + "refarch/configuration/preflight-checks", ], }, { @@ -34,9 +32,9 @@ const sidebar = [ items: [ "refarch/access/setup-auth/index", "refarch/access/how-to-auth-vpn/index", - "refarch/access/how-to-auth-aws/index", + "refarch/access/how-to-auth-ec2/index", ], - }, + }, { label: "Usage", type: "category", @@ -49,7 +47,7 @@ const sidebar = [ "refarch/usage/maintain-your-refarch/upgrade-terraform", "refarch/usage/maintain-your-refarch/extending", "refarch/usage/pipelines-integration/index", - ], + ], }, ], }, diff --git a/static/img/preflight-error-on-pr.png b/static/img/preflight-error-on-pr.png new file mode 100644 index 0000000000000000000000000000000000000000..b73980f05843fc7cde5ef86ece3e66590be257a1 GIT binary patch literal 832131 zcmZU(1zZ$e`vy#Rib}JD3WBhNbgW1kl!Abih;%F=C9wih(jg_?Dc!M>i=;?*EG4~k z?asG6&-=aq_xF7>zu7rEGiPSbnRD*@x~}^U)l^rZBx54O!NH+?rmFY~2ZwM5yS*VH z!XEjGL!O3%Lt$^NprH9oL4jS<8ERo|XO4rT8v0F_Snu_(yXgk8(b2#0NK{E%NjXJ7 z$J4yU`Kwex8~fyGs1QfURDZU=ExlIhW^u@S1Kdh8-Mifj^yIvKO@(3EpIb;tH=D}6 z_q`YAt~Lgefq3aSFKV2WdBf0q^y7H!8mZt2YV!BtYHDWD#yBj$aR`&}?FBR*n0EIl zp&MusDix{~vh*3&cYP6Nw(X)CZFLl1ruiN)X~>Mq{y##FK*Sj z0G*L{u^5}k2Rb&zC)VMijM81Dw)GIVbk4(PbDKC}A;ZfqD)_66O z(<8&kJVCvwu+y&*o=mH}+1zTi!85*nQ{QlhpXkmA?tA#NB+8E4QCHl=iXJ)2s$P zJibfQ+)s8(+ZMIz-5~kx+9UrSL`;j3+c8pa3z`ls-GQgyu1%xirlQ-|LP2_k&_+WA&!#O z7gpo#yR|N&cd*O;&aq2ogO);xetLEWLg$A` zkp9F4dt66(k4_8W{(eKev_hM1_%?HF`71dt=7m*9oCV2Czxx#d7Y%qCOXPU+Bq2CL z?6kT5p@N?{<~Cjl-WkAgkr(12>~CkPV6!8d{V7mE&qCn3#2`UA6u`H{)IiAgbAFU) z;j{Vy?J+ya)2CJ>tU`(dG`3x|PD)83kX!zW94J-Z*vJnY?-e5lo~(1_^*;X~TXm=C zDHXd)^l0z>T*Ag+8Tpx*vtIh!3PptiHvTi2Tv`wMo^p*Se#A=&RF@C?O}P20hNVpL zEVFjg`k3q!xxLb2rV+!>F(ID;7MG4B2IjE#KNT-uejV(1ULjn1tE8Q2$)(M&_C4#A zWopQ%6VV=lyQ4(YL$8CTDKlf$2Z11Kc`${S>sp>XliN-Y^wj1+NA0e`Kj^J z_atmfV+``zwUA0%%vDB5-RSxJGg+lp74(yw5j!itn#XVD>>rkWbqhL8nkbW>beveS zIuNz6)wUY5F`V=$c{Wiq@xfYs?9rb`qcXXkI@JncrRF)^6Du}@e~N!gWxJ}By!ie@ z_PMmOw1!vcsl)DznevaSQesjZQr>BVQnMe2Hf3_mKE9CpK9nPKssDS+)!tRI zX}T$|$;t+WeCE1iB4lv=9y#eJN;%sz@=N z4E7ObaG=Hyc2AZZVb8*e}w(|^G6^}f~aZzUNbPc|u+Mon8 z`Z}Kbn2k-fODuRap~R36kOFkC;{@qKe@VrOJYdbg%=gQm&M#5ZNUHljGI%|xXi+k# zp3-WuDWn%}s4R(mlruUvB{OH}&^F#O-Gb#btX2ab?L9Pq%9)=u08fQ!}|!k7|mlJ<8=FmzR9m1R|mWM(x`rcw5YqKPVGaYBS{bvg4o7Q1~~DcxsT zlNoLty4Y1MiLvI=4Q~-VEC~yK@uS}@kvQk0vQl`8c(Li2moBkxx^3XLns|yq;jCT# zr+W9j$UVF>wLN#)O*S)`yPqC^I`;hJ`CQgkX12AoGm;1^I>Q z)+kTdDeCywndIhCL3tcBa^GQ5H^*LuTp0>N4-9uiZP$;Nk7q1r?7_R?qCaImGix#) zJpL^l4Qk*zxZj`tZE&XZ6Z7h=dz4Zv$DzBO>A&RegcAl6CK8ATZ+^KKSW4~5Vnds9 z=Pm0D<2tRF?2fhshm5ed(m87+X)vN_<)gBP(m=Qb^RtMTA%>uf$9){nnZ^Z)Sm}f; z#*>0aCPr2^n;2+1L-p?*@l1%hJ>MCTcyDNDs5BRLu7wg=0pI&g_u&4H`gsyVe8VG@ ze5_HdOp%bjh^M!+&S63PQvA1vWo9aoX_BYUi?xb*YULv06H@EA%4`jL8$^*aJzn8p zHkgREjWLvFOv6~>ES$w!Uwt!Cl^fzIc?7zxPfPw+@J8w z>`X74!!d=xnZT8fd~2%FyBc2lx8EN3fAp4uenL_lF}hgFB>zfjbiFIgXZ8kZ*FQ~e zQ9nrfz1mj5++k>LalLWCKyttQ;^7hV-K0lJ)l1VFrVt%^+uJX~_8%P^HF(mtsn!&F zR?e=thQSjKUI-*M#V33_67n?(7>j>V+ZB`REf9Ln@ zp_n)&?q>C8>aM9nQs`2rSI7Vnv*9@zX7{=a!_~&H4Ta&1#-B}&huMqWW{KVctc?RL zhVI=*&+X$>Mwb_5e5L1hrVYKuw{6g(`?i$)IR@&6)D6Cu$_Eig;*#R!b6?xWou&Vt z&PyZrYZlfPeO$q33(Z%AXI^Xro~j;thpO9J(`HD-H~1{jRz6;RavrzDt)@YjF6YtX zb-LcT;|ZPhr>~(m2M-#*X?6B-EtRc7&ulxD&n~Dg9DlqGWT6p3^=?oYTI66jf2cCe zem{5rauIy-?%Z_4WDh3l*6k*XNjj_Cc>S#2^z6s*z%YGVuD9p3NNwVn!Gh)DnDAV!hnY`(SO|TJfywh zALe?`EY#F+c(G*?90FV>971df7rV*fGXJ-Xr2{zl{~X7|!3nm;A^6WV>e&6w5{=z% z>ioOMj}5{h#{Rp7-8?e!{@<$!XEO2sTYiH*ha>-5;n_3n{@yZ3K4+-I-u9boT2Wv#9EQBUoqlo`}s!1M$3y}5vgz2nV&aAZ8Butj_G zkEZM%_I3^~QXaCL|6C!3E#DjlbF%+)$wymRPCYeEb_J-jIlGvEpnxE!92q-1yNvS( z3#nI%%Kxd3{U^(5_3@*l6d3I8?k?aiA^>%^1Pe(@N`eK2!NS7)*em#5JRLrodhk2A zaQ%Ce|MxzM<}PN=){Y;op$_af_ceVFb^R#I$$9gj|1ST&r@4pq|2@gU$QAu~lVmj!J1-dzjnlD_YxQ`waUGIUx}-F`0iV{Qpk<-y{F0s^0%peJm;Q zzg7R|)c?1tj*Gdo0@NP+(2sKe_rd;C`F~ITr=kq_rtSaJ7yowjKS!}WEk`B;{_j_l zBTEhXIEVd^EY^w|+SomInB6RRCD8m(4z*5{Z0 z!e4pF@W^_3)T~pAT)yWjtj~E5AC zd;RVsb4x}(QK4!V3Q?_K zs{J!-vU58u@|oyph74zd5TK9wNjkG#w``oI#SpXyLvOeI9ju1~gVRitMN4Drn9v*al z)L9TcFyO*zrA;1}9zW?eE`wViy%`D(izu4y z?pH+~YF5&@i+W^@z{1l!aTzjpQz%5u%!wkA5|&|iL*G60<|JCW;=&TWkz-+VCafvL34R6!N=g3NwZ2unStdZNM|kgrr7-ks3(o73dV+A^f}OCvb_|fhj;k zvxBH4B``EKj@MZ$st6DZ%<+0nAQWOhTUS=9=VFu$JCHYDCM7S%c?!xC{+i;4R9rs# zp|Eu#Gnw#c-BT5yey{W~rRM}8X8$zPNH08CP`stIbPF%tYMfbQ#Ax!X`lY!%ml?&j zWD>Z6YvRYL-AHN~6g{3h|Jb0lZIk}q?dg{QlO|m`VN@6Gs+N(nuDclEcQ*mD4ca!D z&3N2fQ8xDdrKz($jBp|x(&6}3IvgGjf2yLYOJh>|8NX7-HUbDBqhbC-OflN0Q_lpu zSrr(5bqj;_g~wic2n z-0G#5ekuOv#S4(5a}|MPo`@Ps9f~`mfm;u(Hg(k|FU`Dje7I?H#?lv3SIh2=PTtpI z;mX$bsmluC^;0tvGmv}{allbvZ`PyrBA{OmXUm?oMgRAc;>rC@f5YF&HdDv+`~xs- zvoeb5OJUY(9qBip=Zzi5UqOr@Mi`_0g`DZnIkQ^_CKwIA%D4lb2HdW3rDB}e5GE|J z_t)yCjp@dY*S}EpOJBFlMb3kOGt+BxyY+DAZff0UV16TSvdxU59*EA)hV2!B&NAhz z{-Y|Vo&B>v`AV{^8!?Y%OyP6GlYVsCYIT^Ye14Le$@({$zNkfyRxv{oa4bQ(A58k9 zpf{Bjj7ZxKCN<_PwNEHgRlhn?+9&*YfH2l+V;xq z%Jv%jCfC;2_5ha=cls_YkSnDv4y_@q^wT1>qo4-he=dPpIuAo?+zK2Dd8I3XSwEkR z62$cC9Uk5(F)v9FkYjB5rMMkAY<$~S@=%Wg<;#)rRKXGb`!1-t>(dR@;LXndOy7SIPJ(FxC5hj%YW9qnXQ+9b2 zedOUoLkzJ@6847&CSae#`(ni$1x1 zaCZ2Oq{eJ6wws*Gf`wN(#loGcu_?XhiRs5?3_=mB;$}ZyxEWUWM3yp8^=RrV zlf%bZT)VIt?5J8!XM;^QnR!jOIJrz$5pL`nkh_cKOHydk3`6ATBj0wzZN5uYnt>}L zr^wJ2W9RgIPvgdX`Iqhp@ndM(35(njv_MLXQyQ7}Gg!IC+Za_+!vG7}K9#%UqiR5M z(&1-(i$wg50bUpC6a%WHP$pRsBigq`_mf#*)03#gHQn-<(nllAyW{F{;P_bau{^mr zE7CgE^(RJD5$hArAY^qtGoYh>s?#f*!PF0z6DpZLDY&=2ZL0siX!wG73b0iZqOI#!7xjM4*UFd>vTBjCoWgu|_9!XZioej1z)9w3L={n0=l`O4Q3 zh2V;jAb%w2Y66(4^HFI$IhF2XWfqrLu4T0E<(;nmW5U>7_cY}s+_BdKoKZ-_J`UMx zbmHKA@`&N`(EMVNw?&z`|xZ*-@49Zrp2m|lD<6RQcnajt{gRj*l zs4*K48&g@-d(x@U!)0dY0b{YR>76J1x=v~)p6u??6ZKFV%4~$ZVI`JwJJNVH@7fTT z+H+)9xWoM(l_SL49kGTt*O_n4KIb&|k>~EZ83}W=Z9vnw0_pOGqE)4D;*a1-adbP| zI;7u(hwg7u{_|2;uJr5rx4<9gDGbfjEQSg8rSCC@2`6zp@=Jc^4?)ahOdVhfl(=Z^ z!rX3G0M@`!`Vwr>36byIA2iFENpLF1&_3Eo%%*2CoUUUrlp={kE4Al-{THEyao=G8 z8`L}SeHViY)FZ(lGC7);psR)8LGaN*P&1PHxauKurXmJUNnF8Sq!n{^N0;L_)g@TJ zrUIN0vtL#YVPf1BvR0E*kkdo|l++*ofwYRU)`L5+aydIA7#?z#<^J;Yq=-9vy&G2S zi~i|al^IXhlT=D+A1rlD-l5ctZR%eVo@C(OyBlX>gAmX$3jONadIF7ND^gJ9co?6l zpOckMSy+v(MBfinjXghoZcZ=!bvKHj?-X$wJX8JR(TFvzSIw4R)d@831uyn`u7q6; z3Ew(+9sD-!tVtmeGOD%Pq<;RBmwuG^v~}wGV44Ay><2mj?XlJgIOlUF_Sp>Dt7 z_n}^WQkt@KvP8G8Eb7lv_hh>3V|7{>TRP5~wK2?Y^sXIi=XlaqhZatNpQ>T`ix15n zyLwp1T;;Rm`&hunV<$i47NGc!JAau?hktYEndZQY<#6N0V{t%BP*@*R3d6dgcsp1o zogIw%KoFzK>{pGV*ZzXymh3p6#d@Lgv4~U1L&{S)E3BcQ+eGaB_oVNWNHw=yFOXO{ zi}!E&zFEvPW;YbwY>(`ziiFYPu6{gkT~7=+2vAGJ&UIbvT<6J?)U5 z_1K!OlKlCl3tq&Vu&-NRNRMAAr#siBX7a_kwzmB(Uo`y3tAcoSw-*H!G6Qz0(+Hiv zyev8VK#Ogh{9RT0e!MzA1}rrB z7&Pt$ea~CjckSgcUuY+(lE&P7ZF!|4{PEP+eFuyDMuKLkM+8`W#%RsOPVMS}Z^p`+ zj!o#{I@ba8U8<+GdJanr8ZPI_Zbr%mLAFiK{pJsb=Ra~aZVG!MM($?5+#R8!V4@=1 zk0GEu=)MzQP!l=oX-Y_S?k~)A4!Lz%#Y$HJw&i+!%k%UdBw=QUXJ;%Sxi)Yui2~iy z_7{qY;|%E1!xZ~gVk$A;p0&51swj)T%-=0X5lgh6zo@Hv`_fd6G}NvT#jR6-az7E+ zgiZk@@Q8HAzt|ZJ<~UT)H^n+Ies5F241NM}n67A>b3$0`Amr-jn4ugZpESX5gw@7- znAq+ZWw%vh>M@h$H1CKGJEPIqX{^xbL+3%}ReLn(hJXa9U-4r4pGbqc{&aJ1zwBow z-4-5ha2ecUsZHMfCS@Ik3P4O0zvMfSGG`rrIa-Yc9BStbym<7|sCva$3Mq-jymztj z9{m0Z@{mc5>hgsOIxT+za~8qCa{a7Gll=&j$=}}%2R~t=0(XyGWo6Hkv<$ z`8{4h7%{e%T#ddTqG~LJDV)Q#h+z}Ldb`J%gwq_#t^^GP(vcavFa- z;`VDLF#G7h4+FM_BvpwGE0l$Z)Srte*Q0bGg{4_^QTxMUPEnIO{h=n$dE(w zp-MW5W6g`Wobs?A5cKL88NMS8-*Jh;YT&+;Z3_3cOU$Re^-ZQ0IV;?%@0is`M<&mM zJ_J5Bzo2_2HIJL32j~H@9Djz`p;rn*m1t4SXI8bw==B|{G^*XLaQHp39+S+^s6>>d z4bfk+e*yii&>^=O;9Tp{gxR4PAM~WPbwHX1S`BiuIwFh!e&zQ7UID;lS@RueE%agV zAf#|00|NH1n}A&@0{kZJ;xjKs5SoO|uR4oAB?j;OQi-FvzY3@7r-~a8{yj&=FY>GK zhm_Zz4H`?dumJ4VegxDQDyv)ReDpj_C#q&Iiy#Te*){&vRVpbSVj&&~4+Iuce{Nqg|WFsGUEww__k z4@1{fbc>#>QsR+hZYSDD$UZ z=bh*M=OUP{>2v0<@(0s5Cf0_>u?k2gihEoM@beNp%oSvTk=(9@^q5Q-yDLolS-Q%| zy_G!r>>>HMG1(FcLBfkx;H*gGTFN#QXLgte0dk2)MqLSFnpphY{HyPWX^^6J|1N5g z8#QM}t^AHZnt;p@MK#;)xbB|VPA6!=eIJ_b6>p0lTZBJ)L;?vaCV@y*f$6};pC6-m zNW**1Hw`su!V&KdoYz zpwsBV)@-G#m8j8!*+UlofV>~#^!+5Ry?1BcZY2Dr-gLJ*A*q4NLkZeFsaaGC zDB*@(vvDUqZ_hS6-n;F8TJjepg|y_o=rru*EeZ^n7+>- z<)M$dV&?q$;yJ7d1@Iowqee*)Y?N~38Q(1tpnP$R1JbkWY%Y;0nH=xSiNt5S9M(X9muP^Y9^ zEE&gx`@F$LCLfjU?Y|%35gfVb5gbU;`GGfVA3g}{R$uF5E##l4GniiE84MW( zDK~-M4TEO-8T*Z&w<>pxChHA_(HY<4f1s=UvtPGg(W%^gs$J~RTL94eIvzP`p?;?? zU)KVB6&lC&@RL^O(ZTJ$1b&0hj4R+@Tx~kEig=`tCeTT&-=-grT&7y%`qx6PTwe57 zBG{1Ux|c2&zdw&K7|t#33~$-~cpZM)Wp=k~d_1^xyOeqcH7x%~|JSRGoxSD#wNE)d z6b6V#V+{g!^J`2cA1oZRO3P%%zLv4fUm<>IfIEKlIgATT?i)!f$#@rys4uqXShs6#H#fBWhUGro`Y6&KRx>V+`Dfyh58l|FHA+LRChsQ&%!1+RD zZi~l(|ITB$_VeF&Cm>lOWv~ExE3Fmcg7o__s0uW#J&#bka4c&RSsgqx92Jc9r`#W( zD(vNHBbIfk<;dilu*W1Yw~0(2xYJ5WmL8iMYh1?m`zKmz7at&tFK2w(9ey-rrL)h){_OZB8v0U@wij%&8faX7{iM~qQ zKy$Mk-tMd*K6m?)5Dz{N;V z!Z{ZjFq9dC;tqL_)pf8|p+^248CE;Qdg*(^KdB;6?^cHZVz*GPGv*KRS zAH*ql$ZcFzCeK-uiXgqNe;oMaImE6++aEh*5>W*N{)g|b)lykCg=-Y^NXdH^Sp((* z&%H$JBilc5vjvoy#mW~{V9XOSMmX|=T78lmGPMag*~37ky7Lp+dMdg^aN8zpL)#D_ zfga#~@2kCwJf9q_pEKO^nKCu+nHumrVTE{61%}sY*mrv+nCU;f6-P zz*CdQBp|OyyxCr87)`0EBkb_5r0-lH=dR@i1gg@BHQvJB?O7Yb?6?-JCY#?SJzl)E zn)ZrDzuXoVcQ&OkI(mZb(fGDbq+cZ_IG?D;#m))%BNMr9=R>4uF1 z83^bFNW}4<4;dLrrYpkjMe6?rPdxmyjP#=VE`KK}`c8Xm;4Gwa+O2lGc zCB)7!%9V{OZ15Q6VqE%ro0+v$PWAnbfaj>=@Cd8ltq@u}{j1;oBhn8m&h;!hpW;0@ z_9oMw!onqU;I(hdKWye9Dsg<0lZFg&PO#&pejlQPhD}$w{~A_Ta2jg#$dRQxR;K)9 zt|l8L7Cxak8AfXbB~4R@U0OHn{X&|6&U+Dk1#(B8O7r8Uo zGnD;x9eyPB*UOwvL#k;ZH!c$UvR&C8IX)#T?!Q7G)p*^q3=;0O{g6|vuVp!C;-T06 zr1gQKL0i!<<`Iuxl(M8UPrYx7%!AX*eE5Y1o)+QYA^q3Qaqf+>?p(DC6PJDVNFSe>GonvI0)tz%vxwQ?C74O({4M8t zjVLo~nExOLESH(p^d4l*=)O^@(;d+%My-gqwN~kM!G|QaYm9o}6VNHm^ph6)Fbws@ zMFv0YbQKah&W(Z%OKmioALS3O^>R^x%jJN)w?~k+<8Oxx)ZT?GF30|d+4QLa^+>-6 z$AGi3^Vu_)qmt*m5_F`xVd)N-mpoE2v-OW{F$$qGBSqxrhK>$U5hO(i;O7s)B%Ka3 z*iNHjFu%&o_M*znHV0kL7N6_Srg^QnSso%bhI6^K5hp>2)Ix?l;JCE>NwdWyJ^OLP zHevUSl(1?f-;&b7q@$MqMZ;;N;MN=~@2t-Ku1kh7hl+)yNn)dyFch8Sm!hgSxBpdC zwoQ16Z_xcAF2D%umCGO0&T<#T{28X|$yf?qilJdb?mx$RNWX`hQ`6W{itDLr@Jh{A zj}8mA;HR$vThY4H%%wxK!cJ?AgJJW;*6QVFLq{)nM$)TjC~L>UHx6u?1>m&Mnxjw7 zF(MVN6n>%aZQ?c;kBoig8;PLW!|5(h8h2tR)wTemQ2y5f9=pu0xUd7SC;|A%Ha!12 zeGZV72aY06CykFSMo#crMtsM#ruGOG_t^A*!@uo+!Q9Jk!~JY}P4qea8+usq7AxP` zs-oQ_l~)I>U-!o!m;N%d8IeDBt*^kdcT;R0Z1lN6)7y)UixPKT;iGo5QV;$nlrjiB z54SXOw5_l|HFv$15{tBmd?Ic{a-@Zjdx>wR`CxPc#F)aqDy#XpMb4Tvw1%8B8Pm=z zPZisJts-Cb4^-{L#^IiTrm)f~18n5MhggR~!ZjyB42A#42Ij}|-~JWnPvJYTAm3c| z8i0}sM|Tg3IoqnO3_eAX)bzWl(E=uJf18ghMloqFL!;Ub!H;9hvMsb1ZSAHLXtxzJ zWq0^g(tYoqT3OQP?o6k3V!SaXKbT#p~EGQ4}?7;iRIZy6j;Gs2eFp6hvAE_j+_T14W9GW5eQ-F0M#IkFX1ln!}mZyyejj1fG;oi zvN<;#%Xc!~k^iM^%Y6rM9S4qC7f7F~Tr+}7x+a7WEcfk)U!;GMfEW<3)6al-%y4FKY8(L7cFj7X94dd%wgGIEj z=b0Bo)1l?>-CvOXy#{2|Lu%h8{Qex+hWJ)%&k+p8Hw2zEa#y(cODva}dIHPH-6ly1 z{}$!55~sH@YEJZFBcdFkqDw7PQ5W@Xceegp^^lJ*D`vO46KmATbFbxj#mxpz5U)_uLZxC(i`VL9Qz0||z zsLMg;YZStCJ4t*SQ|n5xV6|v)H4IN;_m}wFkaOyJebfp%SH0)~ykA^y(1Q-652sYn zL~j;qubl?Og@R~jgE3FTN!wOboqB(=cw_dj*e5P}#D(6M${cgRHQA1&qpoAN0lsqM zoQ*mHubP7J<&JM2kak-qi#0{pEg9$DbhH*)J=`|nmFtM_{?0d7&%NQX@_tOf#->o6 zb-&mS`LI3OHc;K$PES8<^3$@;8v;jrcVkOR@nDtH<)moqJ~wS8AHE3+_^a)cn|Kk4 zVs98WHb{IK%PVqHbpqa$_n*Rq2z8{!%43z}0QMdbtJ&`YVT`{=$US*_b!U1ZK0W`JBJftCZiLUXY{Q**Up2rleVj`h1N~s=SO{XFy9U7MKFD< zb@F=Kfe!eO%G<^sgdFPc;YbufXV}ybvwSlAv-Nr>;KGX+jvR044kz9oog9F`EK-RPy{Bbotp2h z%5lr~$s+ZEvh<`$lNE=06UhSJtHJu>gwSIl&hQ+1O_cNISn`&0HnExE*Jj~zS|>#@zAZ^k#yP3{`x1hdsVKz= zavJ8gwi!=yJsu=z5wk$u$1LDk;+-xs?ET#HKm+pbCty13-gXs$#kt{CSl`I!n1ZVB zUmRZArSB`nuRvUVH(5-8qt?Iod4eV3cAW`A)znF^*?sFUr87SGNiXm^65=3#F$05Dd#{>h@EC|e$3?M8a315H zYgPlT^;isaL5Z_B(ngKmug*B}ulgIQ)=sq~^9Shd+z+IlZ7ZDz4lXSr+ZX1@2jRHz zdl=ajl5o#EJukC?hM}Ga=1M$I3R1HuiR+5PnWo63HUw-dz~M>?qyW11L{XH^+@U>#w-SFzT2OhH@Zw3RHQ2%eJQ@xMT<8TTtXJD=xZG%HW)QH zVjj;b5-;ytxCVLUDh;_jB&#{wg!Skb{FNGY-sQz~@0!&)%)h!jeHf;GAh<>qWee1kqxUc_$5=<`gf_ouIgFUFv?BctK zWb;`ug1wCa<)46P1SWMmh#AUD-H{-o0YN`pfxBe57&o3w81!E&Pzlht9p;$}_#ZT4 zD8(1_hP?h>G!(F|wL^}69v+LN7mJG9HPp&%Uw|iM9lgHmwwzxqgAUW5#C+q^P1H3! zxJ)9R^jhXK374H|-0<3GoVeNmDeXI4JB`<#PYJBQ!1QqsZl|eV`>ab2^L-aLBTs9> zvG(n1-8VA!TJGmQ0fyx0+b`6;8%F*FZ+sf4_R?v=YtCs@-o79&%cHR+gpgL@?XS*ea(#;8O1Mq3zz*!C0-# zA6TY|K(wV{cfJ})&Gy@sj;XGA9iyMY)WVltv_8=zCz&wyB2?i9`ChbZEyB(Nk0 zcZmm9n0L!_WOY*!W(L`^; z*u~y+DfTMSQU*QT1wb2jpnWi8#9=VxIbSrtoo#__{j&xb$bhn9Wn$Avy zNrv0oi@*#YO;dKjS_5`BpP3JK4nXp+d&=d!KcK}8o%JvF&f0XTR5C9_VHdZ$;cZ_< z1+XJFdw<9o^TI^$?h@sZ>4jIn`92STJ^@C&>DySKHDC$nay0PG_Q&MH5w}&;X{HuS zC57~a%8Me+|~n5L_S4un*5kz=gOy$<&KV z++Io?@5xQd9d{8zBez`D{;@;FhI*JnwWk?RUVmok3zHh-oPb;g62@0x2s3V67!yp} zXS!4WCc9BE^(oy=c4H>T4loVm1y%rQatTQ46~bsUSOie|!z%!rf3t;IG@r|9?P1`- zpObnZ^WqTi^;#fLmy>_-4!xSh1X|!&NPD1!uS?2O4jtMY0r}Cq+=J!0@LRT#-?$;m zsI|ljnA8RY7^k<^IJ^iR;G;h>D-e=?i{mkZJf!w*@LqQTzS^5xd^5*7!=A--?@N)} zEo&@i`W~;EtH%KGd2jLs2{`4vd%}k7Hlw)^-k~=JbP=qP5CtGD``U?z`4d}~@#eQi zQCXvE-^CM;(qZZszk`8FZ{RCm9~5#p*}o6$?Z@u}OT=rn(4TeU?8|v1$HVEO&DRIP zkVmkKl(1S%%f(TJ>%cPCwn^>#Z$C2XQK$9U;EFA;#j~@u3}7vcK|JUBq$=!jP;eUn zSbH0uph1^~yeC3qIkZ-bF97I?sCewoT9;XcD6PmPu|eqE!DZ+1;%nghG5SwpTehe# z?bX}{LbGx8!{M10!3KcrX9ytwGzDJi%)k6>BLn=J00jMyOnMj=Iu&Y%pr)aqGBo@a zv?dO~rpN`xmxb!8rih#zX^Cj*oQ5q(ytydhT2YkbMuz7ui(anzwo#>K+EksOgtQ4} zw#5i>MGo|z%jqq!i?kFnp4Z30zV;@^ctp6yeE7^#(j)b#$@IZc`v}3Yq!_oUNjY^> z^!PK^(Zy>^ti{QCzY5t@-!}Q(j@9|Fv9ANZEV|(y6I?|)X+~J=!w$Qp+ev@U4dN^Q z3AGm}W{Gf)-8scde~W5JYFjKSqy0&W4GEcXV`D5(gC6l2Yats~HW<9j_J zyr=KCY=~{MYuyzQVPIeBbtQ3jb#?letf|JMHcci&^G zhdkwo6BjQdRM;!fn=w}~fcRWl8gF-MVy#NNRUK7tFfsos{mMTPQAE{UZ`5?+QE)crlFs@*s zT;?jZ`q)%`kNF3`gMg>K=QLsY!$~6-pNj|+VEnLQ5f(l%9M$X`fsos(@AoJ4a9~%3 zp;5cD`dSu4sakBuBGf!0j+kb57!F7WO>H=*=ZUBab7eb)$pwJ!oZp3H0EFcp9CeYB zHs#2u5=V54Bhid!mbcrd9to=QsC?DeOK{NH`J(eqm!+dGMSp?@xJf!d&}~SkD};qmUW2mmo<$~9ax!Eyqn|XUSQ`b z_eaH?h#N$aj0^nBX7JT+;`8Q!2-+ic?ftS901}Mt`GX?vAi@j&opc4gw!Dv*)uL?A z+8OqM84()gRF7H|ZW&>d4`L|8%8eZ#TA#T%Ob9DAPEd&})4MipMnDmd5vg#>fibNRA-wjunD!yMMu7cIFvP zu4U^|xB2{~K|j9l7I(i0aDCiREUgbg!sy{^<$c)bZQ7v-$>&Aqetz@r@sj>H^{dXq ze(EcwGGLCrwPo(hrAWqUZq-itVkm@WO5ZpLjnt6%D^Uh_-F`!`oq`3)u$- z{wTQHqQS5=c;D=TpXHZr@4=EGJ{6XB>NFzs(ZfeqCGH93=(EX_mjd41o@+dItXwHe zjW6#2KiY^u3QAJA(7(3wrTgcd#|TgYGQv%+;r^$b);K!aj4v6AUD=;vdl*V9FSYJT zP}bH$hB|PkH8$+b{5{!Q?SGRVuqdub~$WL1FnSdSOQW~KW^(`{~N_w42oMQZS3KpnUq$2xcQ{0kDIzi2Pm<-}Bl89(ipy zue85sF}aq*M)W^y{esM{Tv#H147X66!q2nok!4#yO<3B?%r33n4-mTW)03*5-TkpI z6wil}B;O<$9sWOTy;WG0-Sr4>-m%Q zeIfYgR}*ES2jrKz`)NB28%Uj(G#%OR5Xoz6U7so6Bf?nBjuv$(+NVafR8iu9tmJr_ zG8qfH5FY%d2X6v(Hio*DG+&vvIG0q(dgtD~+8)?m7;a_Al_Q`OQ3-e*eSWYgV!=!k zLFs6$p3xd`x#eo@w{Lyc=fBH%Sb}e_RVcmx5AC&!_Q!8%gtBO-(G~vy#A}K+#=I}2 zHk^5kR&0yObMh?A4qVn645KBk;*OL6QIDO6rW77a;6*y3){uYJr%_Lf3!P2PM>v>W zYeN4Vp;|OI@@Ag27MxC2D!)@QmhPUiup`U)lfQOt$^Cxzi?My9ZzvHpbr1!LegwJi z1i$hfzhIITTbjE;IRIGDCrD$Zpx+fP*x=FWl~5)YiIhA@$-@K>fhxkQf*l?GntOQ6 zI=XN8O=W9$Dr7is2MK=nV(-z&_~|j`Jj3q}nO`V!QdHK-B^chDTPf&$y)rGh)-)o^ zdshCbNp5oBw}|n16;l&(4Yez`qiKy?Ek6KBJ=eLK0On@K0G^AO#sLY>FBWh9e8|a3 zVz}Z8fj})qNw}GxyPLIN(4WIF%tv@;8o~&iMj5u{zdiqitnb=Ytq--kxhp?8v~tq5 zY+L*}TQQ~A0yQ#(vVL!u#XL5rQW^W@cmlUIgbzZQf_3(@hJ9%-Wh-*vz_~yX8O<&K zZn%gm&n9IFkQ?Bbk9do}?eeCw3GL?qwAaCh$Eyj^^9PPMeF$fZ`QOXhpAvlbR}3|Yl1NP-o!C4$Gu{~FCIJljy} zE={PUPJKXp4H>k4?0Z1_`>bzK#IO$xj7T8pxa4XOnfbwJ=~KryhP`dRVh#_coBg#y z2&2G`R&S6a#ULhr7EZ>EXbriVxL zj#YzHuy|3{*K;Q0PN*I0@%)7)TYmqZ<0QhJ9_~W#;FnuPNPV*xC-{`Zs4p=oO`*G| zs2ZfuO90vfT6AGDRL}rtPPP~H7jyxcoggIO`+e#o;lR63U=Vy}WE=`bFzf)J&@98D z1?+46ZV|v&WPU>Kk&c(dOo7Z$*9TsFUV#VJz|1`Y(O3b+c`2fH8&OZpt_>@*O<*&I*?+$1&TbK% z4sOHZrEig*uAh)sX`GpOy3t>Q)}K3l4@i!7UwpZ}>ycWIw|AloxuRk2X>BlkuMc3x zYyk@DP#uc#SK53vlw4s=wL09)GCuyTxCelM)mmcYb~s9_(MlRCdaURRfP5-xX3cJ5==HQGDI9HfsB@J21ca;BH5QR*T?c*;2El^Q3_JL(+>%meHyEW>0Mn za_v)Oo|w;mllx4K{C?rF)`Z*_MWtRX$M1UMO#O04ta)|UfA&7r-sxNMoe;Uy>_4Vtp}4YENTv{{ylE0pJ9x(OzwZ0^|DVL`F}O* zYH1hFUIg)f)H;*;nF1Q)!<<73#uKQeCgr7(5FEOKC|VOpl~th_WUgUq>fB~VEIFek zkvI4MlzNehnF45!%`)|dW7RT~N6zjX&KG#nf^N<4eRXKJISkVdrFws&WnI2rtz zeM@Myj0rg#HzG_XbN;cmD*9%3x zfTS}p3P4MmWd4M&j$Bu|E^7d-kB{;=K_c;<-M=n69AgZ37dV~F?5zPqXb-y-=cb4S ztI!MXg{Bv}pTQm5FJ>CdM-Fk2sAb3_^M>9FnKA6nLbpda{bB|$%ElM5j$ALTH+}VT zeJs9C7g9sL8=iHz)HJu)^y}}4z;4tgHrC})bzOJO=f7SZGhk>1@As3hpL+GQ(7^v} zGedi~YT8SW00*1O_sxMScr#>i_oX-0QSbmNw@_CLfBgrj8m)Vu{`pY%GrQaAXHd9E z@AVVBQ3s=V;k`1j8tqi&JVRq9hj$QS~L4Td4U4#OTBX_zzoCFaY8h zz{4uTCa!L>jKUgb;k@ISDsur%f+fLNDX9_$=|(qq`@|yT zHyUrsXGcI-%{1S3U%DsX4v2c0-r{8XJnr?GC9PxE&C;j_jkxV(8R+z2XW5>njap3d zJH!qocmTWwa#U=+eL(g$xwFZPL=p5MmmG8goCm^QA-uAFAK}%OQ<_quaahAr6|nTL zbpA}2DTj$G?`iQnz}uXzZ|Q&WdEwfgK@yk=IKD7!1hS^i2#GB>3EoxwrY;W;tlT(Q zo|15mR85gkm@z+Z*YP4%)?LKbEmgXh-KrY_HWj+j{}l1)eY4A8`7_&LtHa8HdeY}v>el=g7GvT zkjCsneJPmWKdq!ZBaEHJKlTnA8?wQ(ZqRsC-LSQ^Fw%Rg8M2kPf?72}e$N7spQE{S z6+-nLt_PWAJPR^o)*0Rs8|t@O`}YV2X2#xb5qD74>#b{ow&ywPuUqODZaj$N!#I&b zg<-IQ**t+!!oCrXa+5$4-CcL6-9TM5yHfq&;5#;&D2@lO7rvgmT&oa#0v)p56-9-! z+7&6pr=p2lA6vkVs?@!r*#T=SIM)r%%es;uzGVLg`;5ix2_|Pt>S)cJ3{+cqWO2ArxA(P<@$tlW7cgR~AIzH>C= z#qD!Iy9S-H+gL{J;I(~97cdLf@NO(1dupzFj-Yrccc{Bz9k=;v1X{`6KFK0%p<%H4c^iUUzUB7)?|XA$a-TmPq7x9M zLq*_;wPy(qqtL+a-%g_Z__H;6_g;TKI733{g~l4X!<=q5Lem z`vNW=alY~X6BKQe7~CLg!wTSQF1UKKAgglFaO1Zg6IA=K|7)l*c;jQ{JLh%(qQiun zuZtq&@MKmh^|u8qw3#(^H^$C&q2c$6UXW2zn7$|z_%90}EoN&+EuG8CKjl7%j7*XG z^#3&XX-nKk=#!vg^n@mV@H(cz=GIQkpM(K8Z57yNRB53&*=Qa2TTuUC8G=;C@&YzW zh*omHB4mW>xhn*0F;hX!eD7a4kF?5dE|=AzT#)W4`By&xhMATx4W~1i+{4!35Sohj z=>Tex7Sxs!OeCJ_F{t7)ohB-^=vexm$vo!qC&!li)3c(c`+>gAiFz^aCH4NEdC0KP zn8zvdH}}p|!*c%gJtNBBHa@*PfBVJsfZ5V?@~0)K1sT_7OsAhqE}A*Bn zAIBjsvx2H?%N0bOY6OGAk71k%0MX!8a*hjrxS+NT zN-g5o&j0Cc7Qx49&gh}iRL_pIz(LdB=F5dikAA;0r{;Y+C^ohjlERu6swl`p8TY+5 z)99x#@}7UygG0b|hlY)TUI=*z{p>w)-STo`(Pyxia7j! z*B#lf7wd&^r}8Y5AHu)HYpkN~m?-pd*c;Eh9Y9$$NUn|mfc*!)0TF(aaf{!+zodBf z>TUm#nRxaSv_|I8VlwYv8}KgFYX>)`ZFkc(OVaj$Ho{YctdG+&0J+ioa!S+214Ebi zgY9>s`IE`VZ_dA~(T+FoPv7fMm^s#zfok-Ti(A^|jUBwAV2cI}c!X9>@F>Bw(9}o3 zDZH(T;0B3?6y>8Rv~H8utwhN}iKY%R&HA!iV|{OF(cn7hw&CKzH>;~(Wxk(Y`LPtfx2s}2p_ z9y{28_be9>R4syyc{R8cot~i5X*UArT+maIlV=bn{ik+Cq}!n024{FD(3J+?B)42d zzwR@Uow)OR0kie8u&tQ?;1DXJimRcOfm-QE&SRPR(rS=)Gz)VYzPo0+FNb>i%V>#y zKNnwz-SV1x{d8mf9AI9e>7?-Qri8oxo^tT5W!hz6O*ef*mgIyXcKz74A>226`9tP5 zwSY?Xd-r>!Tx%-{;m@ajovUE|%XO$D@GHo!(`0C}{^v;>tQjt90a&q3NT2*Fip7r1 zC@eTtV1bn*z($TlhFvJr5pWm+(HZJW%SJav&mpMOY+{D-;iT8ifDFoYDe+iEI7n7DYMZ$J{etI+Vg8 z``3>-KevHHy(e2SGQO7=8=5%M+pZR%<8gOVD*k8SRXo~WCVq9ZbW26l0b*)TyysZfC6q{@k+pcofPz@|C?C7x;I^R!*Px3~tD05c4A*EMVQN zdS(^4|H1QQe4uXc6O1s>&$64Oy@7Zyrxh(!?^W?3lF=fA=8prd(y?lHf&OQs_nd={ zw0KUv4LI}ee-a6B#@tA=_s{u8`b<$unpoS?_k52x2WgXcaGjRF0uOp(!2uv7==hW8 zeW6AJwl|cKcpfe{45nT0ClgS#yJSZ(G%Gh6vM{GIShyT-|1X_8n@v-loAd4_OeM_ z!_qv5;pftYv+mjbEporF+P)!bJUk4OkI4gh>_0q!uk&p@;f`8vRQx00?^{z%xM*)0 ztVNw*!w3lo5m`NWjW%_G&f?p!sIZ}?TH;CwimqYc;cun+U72qm>()+zx*Nc)x!jg)w zY~;mivBvvMstl@bf$I+vbgr#t2Q!izB!85b5toTK^8iA@n#-)8k$3M&&i_h8BWly?NOH*oJi2yD0_0Q_JgA&}^PqO}1MYnflsiz2y&&Ep2if(G4=(Ir_Mh(k zRvqL>kvdHE5xyKgfiC@keU{lpF3WHolD8#MY4aQ7%*$?`wD>v%Q6FZj6uz{fz5>zh zH%m3kQ1Gc9ZTwYZk1#y4kgnWOX&YpbZV034w|+GrceTnp(uNc_9ANGRT%n9_MMj-< zn1T73G*r#1rjEM60l;z5jyD5oG;yC!df7-H*G6Y6&{cMfE6*9LEQ*s9;as1XcuaGJ z=Z7ZdA|I9umL#@00Kp~bkNS=c{N2X3?$4FbgQFL+FSoOqk*pMUTg_W+j>md08!n3E zmYI8B7>NkqVfPC}(kfZmun3DD8ao+3en7OP+X$K`%E!;)>qgBKL2;gq_Pq4ay?Bux z+>{Lcd2spbB&(JqMw6z9t)Al&a##M?2m6l^Y!-j13)6c8D$hJ>VuJ@$UP8XPt z5=bVo=OoB2+s8p23aH}uZwx{jdb#UWC%|+sf9;^gsh7)`sFLKnV+-p*-|=hai?6Nh zfvI43=fR=t-P2cu&GWy^%(<%!683|V?yrf8tPOuO=QzJ^eUhyFG!d%UU-z_>z(#yO z_eaG)FU}y*&;WA8w&+UIWIh=4JL7Td3oVLIn|M*%=lttHCyhS-AlDgzbJvm{F-N+~ zA0MtF=boa4=i#J@;HZvjhC3#I9k>9)XVtGmqf9P)@rtjNYpqClv;(Gq+Y_cvA&o=^Zb5hz+5N#fofm-$reFP&1_p;<()6m zN=a#6CUk@;A{2u%9KA0`-@^?Hjh?txC0=2{lEmr~Kv`K?$*}*o$ zkyiMARuWbS^JmpB_#OpY$a*g?<){A1YIezP8SQz2Zf7mhDz%FLmlej40Az(}svl30 zoefzMTRES7Un66@$G)8|M&~-*gd*R_NRd3;-)U(iVySeT_AFl_eUgjJN|^+*!ft1i zzlt)*kRGu{I5(OCj;rpcAX)jH-SGS*4ABKzFnV1g!+x0j5M?shvk~q24;$}V;DiX_pWm1u^#47< zS2?d?1uIM7VXFyydY<;TWK+eS>n`LP7d-)BQKL1!AI1Ld{|DrBpfE{4{B>Yc3&{fC zIiVlhwnZ{n8i>r=4yA4UO1kG_Zd=%P@ir6N4$jUDw}e*`3Ax_I{jDn^ZSmk+@O_MY zduqHbJ-?m$sy8^vPvzzKy49DL4h~FSmzMyePb*wsIj{;M1gFMWq5y>~qdmh3f`#|F}FM-;`m zv&`o!9|)CeLaywBkS?M*v2>+`DFO$3=hRwah%xd@CnOfNJT9wbXz!e*N00(GB#Ffa+T#zUn#Q8*+VBKkQ`CJr!OguFqqJJa@G8U1ewI! zLc>aG_{>SbFOtAY^od|<-mIs>ND}jA?#rMnjrX&U9$$(W4J9fK-IaU3ojXq>NkXNH znANe__&vinsFX|lQed?J!69xCnK`QKXpH-U`Lgg<$ zy#wQ)Y6ZanW3suhxj46fl2kJZO)191pm|TJ=0f$d7sTznu8@>N5I;-VF~(J5n6vwm z3@y(V9srSKr~^JT*bGexSaC$HQZ44}OjC@QQI?oJD}omtobjsY(#d{It^=$PU;Lkl z`qp%N+qY~A2qGaBtBUkb?m)p3&}~` z4k;kAbdgc)QVfhJK;x0~(9YT-BQC(YrIq^7r3$R6N&kQ-NXaaT)me8YZ=U=^_C=WwPkZV~w99q%g^DpO^s9_7$;C{h$lH%>QIY?b zjr9>~tO2;DgwdX?3cbHNlxTaj}EnYsEI~_0@8Yq{mC!vm@ zM*iwYKu_78M@?5QhSHIn{--jEh5g~W-n1zJxgcX{}`;32-| zL4aBvjpRV4k|*bf+q-6kj|-d`B^7%tcKR|UWe8i>{&M6)<~5v;yg!G5i6TFWw|V#C zQJu3tqH#AdAFw*V^NN-%*H-F|3I*tKJd&q`l=5b4^!P}rTAGeN({W=prDgA&L5{vK z!@=(EC)g}brhzCBzEY)7Yt@1*(Q&K^%(@=9?!1<-)>2@0RIkYYlu8W0KnY`UiRZ- zTO})ZmBg(KPC)^qrAi_)d)xC6O63v7XH!EVPf0M3={{ND$P~UG%qBOB9 zhD`pv8z3w)3pfHRE~+GS4PusIscq{M(pF_KOZXmRHXzg6Eff3G`q_w_0aNw{98%H@ z%mb;!G6=PL7sQ%ACL5b{NrvkU<(%COAss#|>u;7AS}1mxrY*VlmOTFcS;F5F8NF$$ z#+#}NL(8X#5)6(A_{$a1;U5v^K-mWhe>H7dB8;Ezj+2RfNtYBYRQDTH;N8Xt7UL9y zft9w88UBeE$g0i!hR;5EW4_Q!y+>VIU!Jw$ydN508{Q7mbywMf5U^b`QQsGeNh-IM z@9p@39j)+^h@Oi(e&!`HWr^8%%sQ=%A}ewF;)foyTkr1l$&w!lmEwdsN>2`54bh}e zq@XbJ4*IkO3iRK6F4+ix5ey?qY@ad5OOMR+``fAJYe^yTh?|QBt(WSpSPR?zj>p1( zlytM{=dey+>i!!b{G&REWrRHOK-9tX@j}jNbINU&1Q}7BKA!0~)s#5lW(z!x5%76< z)k9Tq*NWz;(TYi1p>p;ln2j({6=0jzsib(tXsEL$Q2(rl@##x7x=EAg#}t@c=X$ zc`gKf(S|57T1HaHlRe-uCQ|6Lg_E1c`>~oO!sMfv_a%^Zq6Ut`mkgrl6p);=3bbpy zjV2j*ogFA9vVOE}2V3n%0@-AHzHqXhE${?Sz@VQOK~w%s2~&Is^7=asQ^3nZbh6a@ z6sd=PHubAgdXhuufB{f_LMBefl!K;tWww4na(+dAqvE_4r|@K4npU0tI8~Wr!Mord zusKI?dP2!MW{r*PoyUN@zBD@5;@Ml-2*7X2VYJU&Jmu7lH1?odvnCt5R8lK#jy|U8 zf11jU6YXvXCuGC0FSjCJqP>Noiwng8t!@d8Toov;-9UFSLdVuP5msX<4jf)$$N)Gc z{R8ps$m0!Sw+7XlsTPN0-r1CEC8Z|-p=A(taPku8dpDAVYZj$LAmT}f<2=lI zHRF8b@%p1FHPl8`tBlq_ zGbJ@fvv*&vS^ti8wu4jFDZFKQo+?>7e9>76;qyoY^QD9_4}*%MfI}|ln5I4&`01pG zx9yd$PCFW3o(Rhz;~+e_07sC3NseK}05u5$V;y}+9R0J5S+Pk~-~IDb65Y@G6YN(v z#)x1^!`)K<=)qvI0`u5kn}mv>6eL*WSa2%_|9x@xH-u56s3fp5?*D?A z@iG-~3LO58W$izv87X3fD#4YXmZ;FNf1ypI9s&Kyxjg9lTo&@pzKTxdu`&@{AUhj1 z;AHxs<|j$ULMxp>Y`~%niqbz84;e;j;OeHe=&3$ghJVcmMP$tRMa_s{CiZJE83zcfgVgY7$1m` zLY*^t`lw7Zb)xVCN4JxGv)}GRy-d3m4F$~nG%zwHWbfs1>|D!*`ds^BwFtx^A>xPR$H$z?A5l;)!j{^u$Jop8Ntk7$wrxrqchirA};Q~ z=KMJssXdw_`HU%p>~>kE>ZyC)^SInPH_@$4GwwUUH6ywueRs5 z2ZE4X(bPG7#;U{Mfx0QrxZr3LlE=F(anN&&1N0=>Jy|y3&ID91_`l8|D$;UCIV>Tk1nxP!mEc}KP;(M zC=UY5$vT3D5v3`hZu<=GVm(r{=ys4>==cLj9;>K{{C>q)+~F`%(Rk@>TBh;4eyXMp zx5IdSv5|Rv={b>b!FwudRs*kw(Tn6>34f!PO9%D`xzDDo|8yo?navcL^S_uH?((q` zYpk=PsLkESr<|YI>6+Ef6FD4t1D%^P#zRU)TLL(y?qhaPEC`(_u}^*g!o%iJ9MAd? zp7<@&z~H=c)s^Ol!GU$2=FHFq#GMVu?LdQ7BEJPW(a@y_3aeCas2^G6ZCr61#`M=~ zO~kG7=q*}1WP`mj_9F${R&UP*RQ2W<$9wF2LLji9QvG_#FxYf<)%@+^`S^NY|7Uc7 zl4Y6of~s!MBOpue&zQ&^=GaF%@%B9;wCvPV)&0!tj5m+j=bfiS^fc&}_2i;`ztB?t z$yuV<_O2s*iSE15zL@?Ivnr8lyK0WKI;aBP8c0;Jy#ihPo2cn{aAad2p!=vX!pMa! zyf^6n<;=>tv__r+x(B(zpud30=q6b+}`}PYj5V_?A-XffA9VyJ3Zt2_T&d=ujG5IFP2`24KM3`NIIB_8)%2q zc0l#;LtHtklN$4K+119_hs-Rut$H5qr7B1P54-d&CY?>X9o{avS=)e)8wKv!^y>PhUa^ zo+Y>#)lK1@IO{5&+z+_;mZ~N$oUHacmrIeKz9Mm!bvWR(d0Hpb+nCs@$d7sjttGHz zoG6m7Z_`@PEK%ZNnGs(E&(xrKt_67XVx;qJhiUYe>-q$+$#{njDE{Me^kPZ|OCh%| zDeKDYfObC@Ba z%AGu%ud`cP+=;$Ps_*hB(8RtraKmoCG;z32rSKw0ahpy*tZvBwsTq5l&ZuMvA7)fc zCMFMMes%uIz>oO{*zI|$V{k}b(=EVwXwG-%jrnml-7bY(Hmm%tVoQiwpFg z|3B8@WZ38c8n*?iMrh=5=ee5+S>~pF6=Bp$q~!r6YcvCo69St!Bf!HxRiUyEob=C9Bgvc1SWn`o?`3AN>*l2M%WN314iA^h|PO$k)7Lq9M6&cIC)zQn9Dub{vgfQgW zChggxUBVI#wKDtdE+{i7mcqbJx((s$(1UCld6XTI#)U&!B9DY(0ojHs(7%t?)hM3W z!g)JVTL56h5?CLL8OsFR95>dbcSsZ{x4lGh#{Sa)3f)-a^S%C9KGuX1_dq&%GWkN? znG9{?4pSnA%g>do=Zdt`j*R`X+S5EH?;sXDm3kL+k4?@UoX%LB-w2#@#kw~}*tf*C z-Z@gV@G-Ji#XLD2eXxqBBP~c$XKyRq&gZXeqBW@hMAx6^hv0$teB3kt=K_PlR6hD^SuIQsK@z6^eeZ62rX2f3HuP;Bav*gn8(#2Nb!KYPCYVeN%Tp} z`?v~j^Iv&*B~x;p-rIA=8`DYMi1-sy*EBq`IZ73F~iY?6ra^KU3608*PPxtcP ztqrWO>R3YPv;wXPzin;au<27ho8InCZ=)6=+#l1AkJH+hX(V>PHe%Q>KaSov!>3uo z6{4T6ciHdMKV9t&4Iz08mZ~&7%u49f*oCEj%zU7ytdowGKT%*Ql#sOF!q5K+!|vjs zhY&W2QsGpZ7k@JfaPePR+#OdQkKQIlFL_ZLA!ivLfn->u3Hh_TdJg$px(tsS$$EkG zD|+6lhW{t9WqkJlf4IQXEfY6|vQ0;?LZs%Gc!&GM;5EP3T6q2@%f}gWyp%P z@7|V*vqW+FgLBLz0`C_uRqgh~uKxcBxl7HC&y1%Y5)uima6W9?TG8%kK)uF zHwtfo5AUd z`{}|z39>Su%KTp7amFYIm>8k2Sz@<%-{Kd?^~ATc z>#{9KC9g!+I46gJ2nalf+@BcQWSu(y#Bk%Qp?(mL4`flJQBw6ywTZpwhSc@Ys^_wm z8vsC!8$n)b2Y^7VR(gGaNI!-f%Z45rK{8K0yuon?S^KRoZwwie%g$qu5_+LHug2g8 zSC11xW_DmW(E@i1RC;3Q(n80J>7mg~N53Pr)c3T-Rl1Ky1~1*1zBoHg%&8DQ)8I>s z=CyJCIqsgX==y+N>7Rj0ifWk7LDbt&xuAdCk zj~>)VqgR1K{cUYO*#Ax#QSg7aKPc%?Gu7t*cTEb`eE7D|rcyYSA15QUG|n5KJ4U)C zkpBQflS2 z9>T%o`a8NwfRN;#7HIomNZ;q@BNyYI zz{IHc#f5TuLt^5&*D~Q6D9>fscp#GPe>Yb!VXEAK1_3Y2A@t4zOzveA zm#Gh2!Rl>rJa!5`>k)Ju)`GIEP~IItRywF;&mT|IHx`nhg4Xk?S@^y*?HIDATli$`I27h#R>Dw-KT%Vw>M_-&F#g=IvOl@sXmG#AaRxuy9 zl9KT&xT*f}m!q8#@+}U#Kh={ZlPeO$xiECN|Mgs!9>+tEi`dNL`V|R4d01xw9TeL8 zff>XvJA0_o&LqZBl_7_}V|$~i$QqSIy^si&2g1%pReme|zB|rSGYs$tXoYBvC|aq5 z!>Rrf4`DjpE6Q+)iXl#u6G4`q2m@EI#Zo-f2t)(ifRL8p0Pv+7Iz85pyL2LE{Byvo zfDoILFcLAE*IUq@nQ1hD`_nIuFduFEaB>_QMT-)YU|)N^`z}Nje{GK~^tPhr0ru$e zy&$>)?saMYI*%LQr~ay>Nsi_rpRmt)epD6QihoZct{S;dQW;zwCO{4YfM~(wqMX?s zS|wP)aCxuwcGLgMBHUQZPevw25TLt?2LYStyLXboj(+{eo%`|zLQ=>}_BgO-AHxxm ztB_@|#&oMLiK8*tx?4*x3sH&>d8GU3OK44VTd48381BQIn=2Wgh?=oQ(DtH;&$zcZ zmDJIB&C3`5m|AD2XF70R3Fuqq{D%u!!*gSe&nrClnYAWEMZjHEFwn9a zExu6m-zzBh+-jKMwKS_fp4snQPRkF)9`6v1izZ5BMJZ($efQ0w^v`eE03|dtwlEhMf1r-w@zwmS2JtaO} z^s;glr&G<&s#rHF{Pz`bA4Q5O#WW_tD)?*1wW3yLW2Dhf!Xfz(T?22U^F3S^aK)I> z8^?Iw21R(%$Mfsa30ShuvgGmsIGUh2VUY9r17adNo2CesL%)D~g3s?H`Ky3qOvuEzvlFzjie@&YxRV#pe`jI&}akH4ct z*BqKy+gHBc)k_wmy@1JDsLw5<8qV+@J%f)N3-$9fVNJ`R+bjJ%MQ+B6LDUo2g=_OH zMenR&0%NesMFf(%%%6MVgiP~-##7r;b!jeDhhbTWvN+G2l zqx#q%_;28oPB40R2iwkIh;s+PksR>XF;{7!>vG3S*9-g@_`~DC?IXijM@$(zLB>Iu zOtjN?3}dN9XKS|QA?I_p>H7@>h2O+N7d&3nzZxd4fa||@w1Nm0_rkmQ4cX%;pj}Lp z>(4H+Yc&{tvwIx~M(tzBAf|D0+$y}QZ?KpgbOMf)>B%qwlt@>h(9v6*f0 z)~oNh1e2=>)#c>Hj=o3x)Hj^#GxvO93H{9SRM~#g*o)rrW3|T4YU|0h0_klhoN?WZ zOrz)k8ZP_;=bN=9!eP)i+|uZ8ggY2}iLl}a3OL)k-jTUwC)l|vJfAMRHAwahZJ#@v z?$g}PdEp4_xM&1)1RTj5DH!NO?sx*o)J7>XZ*T317Dj&NM1E0suo5%hH+)PVU3B23}tyQ!8X-BRUNHX(s!f=fFd z`ci4sNhBIK)k*gIjyV50%`B}%aU*b+@nhwoYU<=m%L`i7^uuR6Zl@142u~mr89)zU+47*!s)H7|oKj`pQC-Bo2B`BtA?E zSK&*1D=Rft@S!@(h9IaPeBYu?3oBb;y=l#-bk;knx5lNFQl1lTpm7Yh$Ta#$GX6EP zb%|RVJ@%J` zASl~_v=%03(_&5=y}49@Wo)x~Gic>ROX)-Ru!H7Oy8-s&2kwf^t7#@X=Y4vG1~J98u1m-NT+0 zK3f{`pU*k972rC*ehYjmQZMJo$rMGSx>UTRi?Gz#Ce}G>W3TeWWn|bx z1yF>1GjVbUY>+XFei$Um2mH0bXPywf=cyrhhGbe~FSbFt0({f2j%o1iQ83Y1VU^#S z|1^y2K)PW+0yr;4gT?_nf00Na8EfcnjH79EO9~Nk+D%~F~iwLVbP&B=j7xEvArYWFuVzRxzkxWmZG!Puh^s{UwB zdRaAT7aXg{X-+1ToDH7AR91W6jKnV?uLT@VOhDK+p_E$8i8F#>{L>}(i;@%ckONuO z-xhkQ;b&ehRUvDPw~z)|G_2rSuSu`p22ukMd3I?fa^OVsy=1vBN|9nTHl+{{7N{Bc^ae6Md$1pm7V8cWKt;iygd|q)umQM zr?}$%=1_{&AT~yT!Po8kHddDxve;egn&$Yv^Y32J-SQ`x0DnStSZm+&2+#J~k2xCCz38z{3edgN&7jiJI%bHFsZU+b8Ircdr$BpHgYj>XK)DP24~y8iavQ*g(7 z&wg<88J3&&_Vqf$QMqF;eqocEpazz*QYMV7Ieht+IN2X^5svZZV5acRi+Cn2JBPCW zC4*7VmwfR^z_dwH*(e@|@ZyVnlBK<_otP^H!cYJ|07pg7oh6&&tuuxATl%uN-apJi zaaCz-rcD@jDw~K6$=24Lf*=r&N^JMTpHowlKM$ua% zI`Li$?KIBA=8#QHHk40Rt$!qHpeVZy4@@*s=EERIxbbk2BiwQqRNy(Ac|~&*DToD@5`r zby-fcgfQ%@VUD%nQ@;-}_U9G|?GR&^YS~Rf8;nR1{}AS@`(6hkeWM8Z7#jwd=p z>{$%hxrC19Xg)u|#|)&WdFaf+hHa`4Ri&Nnlz<%Fx}rAwMuRAW7whd!B^V%0os-N2{0pWr?XXbQqa7sdv^DK9;R6Q-AyO`4msKeRef|8{0zJB<9bQgDxh&2a=`+ zp8g;d#1ZK&BEx@T{6Gcuz9;h}rmJM3c^-T(dJdU+(Rl{0K&hbmV4_Gexy)k|I%xLs z^E@cPhNoEBvHfrmv7|AChy;#q(hl*#FN+Y+-< zJ3T+Yo%1K#JG2->F&j@W=Y6L#x)tRyo+iS9Ys_?2)%H@)NCTIq;%bjXOSByb#=7Nl zehtRXSB=ZHY|+q)_WxGPH}Vn$Ovi}8Fl0Qu6iP+FOH%s?)2|u2 z7`A6-UMw9b>=U)=UxUt?D^QN7X2YQOS3KK|qDX;luQOstr2ejT=<3)#g}b_r$Z96X zJZRPx_sEjUF$vFari0WG>kiuPEe)ld(FBXtd2=6 z!Ca|~UNRlD4XGrJ!SlWre`*Gu$~HdH8?CX!vSD33EGYB1^6^iM{Aw>h%@-$&x2EuR zgDEWbB%w+9PBuP1+&y>DtDH9@6p|gU{;L2}Q_X^k^}|Da{T`l{QKA2~%^uTX1>!y; z<(H7{=5&``lm?0+hQdnH5w4&DtR#|feJ6+5YH`TDHxrkwiLePcRuZ;W9_p$iecYym z=X4tVa{l|F4Aol%&+_|Vd~A+@(^VmM{HDMo+xxV4zkK@ToHDUUen-jEkEdw+Yfb6L z`he@#f#QNgD%Io~?{KDiv3;oTd%i1MZ@iGT!cjVJwg~5w*-5eS|H@idJk}ts_u^0f z$!x~etO{!!+rvE(iQjQx5NNu#<*UgZ-V?w%ERcEPOaE1FM;jfkGJb5~Ljw z6?L#;d9^&A1JXIS-?#+4r@!*Lk-}CD$u9nG3(QJcw)f9c?yiMWI}GG6M3ir8^P%J7TnCEq$A*h;d?yU+1}6PC9>X9e{Bn()k&Nu92DxMDPs1!Wy(}Z zoqgM7gpp2^#W;VO*U|!5Fx=9WnN@@_;#2$3EAT$ML2S8qvo}Vn&j*98iIf?Qt5eso zWDP{dE(HN_N_gd##LgkJk(FmKix=A%z@8qztW5+v@>DF8B*J<{$KkK+qeW4Cr;Vbh zbW)=N<=WM zv8cxr!E~DXAIgFakW`5tombRgV!3EC?5gJS*l8h9O36tO*PVVMBW8$=c=!Xs;u{Jj z!Zd2D$6V$-mB9vIJ0ev4o!f#VdtMiaDdy;C;!t1BD9wV$iI^*G%;xMiCp37W2F)4> z`!Sv)QuD=sA10Ks-?Q}Jhncu!(8e5A7ln~EO@jR<%TGl*GQ~=PQz2cNhP%rVX|`MB zh_qaUj$bR8L3s~!t*5RTp11jGzx!Te=@|Us89^Xt6qdYzb_AK;I=o`@QdRrggHiYG z*bW1Oz%VSE&-jY+{--%_(}LfXS>o=oV97t>WZGAcacS9Wuysr*))KlJ0!Ns@oSU!= zu(lgxz50)_;_klSm>GoqDYLEOyW$^U0dWUv)7U1!m7yxA3b?u)?|EYzm~hHAFrAMA0(yBxjLkzhWNT z!CHafJ@P`=l7xV;R}$cBmP9KoYs0A20SMms#Ue>Sj8Ab3$ziJvX+im(0({-qW>P?vvVU*Atc&`zJqP1ng=uO zzk1Dt{)x5ffMCf}p005Cg7Uk6&rPA=sQyuT!}~7sqq{t-2oxrF>iK7ifbXqYQ`vv}G-AUb2CgZn*HEVsE~vof+OGO0p9hJ3 zfWm_9rLXUi`ZN6;X%vvG(IZ#>H~8rpWr$@d3W$~D*i@&}t=VKpb`HU@=`2hXs6n+5 zD~Qm@NxjdAEgOWUcozLYq+TQK#Eo%yU4k`C?kk4=4+jUhqi)}i=yFT(XB6GxxSu}Q zl-jB5@XL)SNc8LwYG%TGTa&``UVb4#j~3Es=dN?uBPw^Dz;NZ$V+_u8b>p-ev&6wm zLMLJ>)oXr=(Y~kntdE~m!-U9ctqZUbFrUnT*VXcd3u(ZM#lr;it+`=5+hY#hho#d% zN0HKaB&hrNFNCll{@M_y`U+A?ZVlD!HMNFP^)6aNkG0qPH2*c!{>utX(uRo!Z|*Op z-j~cp&T0N-8=E0Md88o1W*MnKHkYU8mL^GZ8OC%>*1ckElGK+K4rBhO?x}MX3Iu))5i^SBQH&%j8hb1i{xJ1{0xCqTuNEwoZoFXC{3=fi|MnqbftO zWf?H}Q8+5;2w&CVI={ij+QpGl%%h>KX zE(xdOkOS1AsWmL2?OS{~G(vpUxEhOWP&WW7Vt$1^@lt(hqO#WWgK8YW$>*&|9~H6nFRjvX6Uv2{hIs-0C6L0Ug~ z?>ZTBVj@@t1!S*ltjr|!v|sn*04ZbqXTIzWc>H)uDnkxa5GsbIJ=l6Gd?mFvwdx9; z)La11kNy%LKva*GjQ2zZq5FUkgtKq*HQ;^Z)uTa)LE@s)C_#8#vgTi3 z!`=~XFie!t8h+TP>nh#z5R%?~SP~1F|B`y0pg~*Yk>{U!-pEHWuBwkn)tXC0&%ktADp1+j*jx6CwqK0y;qjS+-%{xyaTB*xkL zr5u+De}M$je!Ozfm<4zcplZ9Y8_$}~E2LhR{DkYwt~QZ!1^njL17)8bVCzWt(H#rt zb3DsnoD6pzb+wXUK4X=|BQ*pX@bgSiD*S$*PmM)1#RA%Te76<&sjbMQu-ml4E+~;2 z5umuafuTkAvsTVWWJ0p@-OCsUEP^9A5h71$hj{=!5&F`H<#nb9#r^dE^y2=exDHqh zOKXqdVT!#XdzuPYdQ_qDNQF~u%S);2{g1`a?_K?sXRre}5*k9P7jQz(0#AEq)yNqM z@dSsG1w^j%H{a07r`=}^^9@3$=APZq^K0plvS0F5@L9uq;OL6oUx`q_-f$78D;HAE zBfDGN<7bp;juzBBV5M0i;=E-34|WP+xzBN))KRemq!wz%N1I%lO}?jQV3e4>w5R+* zP59~uZQa5_JE`EQ@%?(9DHzj$yrIX?g<4Ya!>7;woSzRg6zHD4yCRfHz0f@XaD|F; z7sJlKC*E{6lH|9cXw5Kt*@FU_<%SF%0DB<^iKhF;zcn8~oQl`T6Gu5{7a}xx{`M7M z4c*SdI@TMyQ^-=W7nm^n{C4KGUofES<7;yjzk|iuNrXHb|3Y6>1M+E8?$!f9}&EL=x`zZCHT?y47(qNGAdjJcUYcPx9DnA8rtMT;cm`@L22 zs{A>p+BruPW*8|8Yz!|kL29AowQdBnfWBRyo_{fR;i<~YkQgqq3o=}Oj!yO#FYNiA z6N3d!1v4x_m!)(Xp!$wwOSE;R7WBw5Z7Ts?cBp5I#RO= zZVY68{V65)`Uy|z%w=K0GX0DPF&f*s6Bh~OVNv8T!squaslNS#V(qH)EU?YLPRhb+ zUFs>*mL;2Ph?seekJ88Z372G3K`qUX=hT#(nHZ*V{AgEB#Eig#4;Mw*HBE^H{$YYl zavN;@{iVsBtcafVLd6bFV@a+Q^s;qj{*F=A`>&Xv;ckjqHDg%wR-1`LAgdoB>L2TWZB)!fz5of?C)Dr!$hBWZvBH}9 zL)A9^S0uFr`!Y!MyTEjJsf8flm%>4Pnn4Z=(K3)6S*#Za=z7>8WZip^BTeR31$qAd`p;IPiv8^a#g`3XyugN{ckey`XlUj6s!5*4g7!<@4(YE_K9k+gvu6Zuq{TtLAfj?@ z*e^}D%2z(a1MVj#86f&{(LLojl7gxjNYg6!?yBn3S-qi0D#u`oxrm%nMA?fkAW6H= zaBV_GgcfB{tQAI2IhM}a!yhjp!6=mFKowUG!=- z0!hEVP?V*9RTpa-e37yB30(!A0p;6VX_xJY!D}irkr& znhX=@d_pUeUJBv2`K>x?XY;**tN7!Q*_$-0uz{~4aO@tr7HP8sheUanJkqYPa+rho zI&oN0Rp3h2!rZbZe$`(Cn;w%7Kv6zPrVBuh7JOV6dxWMYwF73@Bs|=vs3uwYk*yeM za*7cOOq11g95AF4Qfwy7O@{=BFy~FLP#NSzOzL^0eV+N{zwmo_2ofvRj@(@$WpUSF z+@RcR>gyv=6ppLg_xiy9(bAFhn3jx&eSh1{V&g5&D^V$atEk^eLA_aptwV`6H15@D zW>!dl@Km)FWjo$WvgwYE)(ZpMPG}n@#6vkc|7dry{R@v?OSF7W>gF z{3r)U1T{`f$v1;xM0CfDtFzxmw}0i!e=Gi%JpUDn|68h1Hf?J{$vad&Q*P-7S+Ray ztI&bTj#MX_YZZMEenP&%$6yrREZ{ow~k-e=FzQRfhbZ%E*VwzBZ*5OIYS;^}O^B!sC}p(#7~^xrI~M zl}p9FSF-qX^a%=;nHOW#Q_g>uwe2=^(syD#mB~n!Q3X4WUYd}-|7ZF8`0ont5vs#f zPS#&&RzZKFTRBVrS=P>vHq`$rG|Qo_>VegdQcL2it?|!txjaeZPhs01@4jd55hSA8 zuw8u5`)646FRhdvwS+;zNjzt7n_2xj1)K{Vu%Mhovet+AK^MC6xLWU zwI^w3ggM(IeItqk|Gz)F3!qfgI-Fuy!pM_I^zURGbj?Ex>ODFjH0_`@<#{}%tZ%VE z<$DEv_G`ZP808*1@9J_hhd%yaDojJP5E|slFkJ0*P!0TV26>kXdSiB~$@n2t4UHDVskSoMn2n6Z30oycT@7={lixR!KL7 zmiHP7nUGCA?k)z;n-D!nUqVVuDH%k{Y!fPdpRb6NGy;DX%BZ|_LC-VqdROFHV5-jA!YL4(O^x4G?(_ofE@0pEw9Sw^*J zRRZWQ39Po(uwRTWby#P!&K-4pz(Y+!qmmGRk|-qRLRB&#B2`VT@M7!5D}s2Gtzmql zUVFC@f*-v^L=uTfp-dT%Gg^84tCdEAx5g1QSq8 zaquz|hzRNrj-{nV?f*j46g#!`l}@iyqeb$S%oknj5tn)md6&0Al<6<-YTlv5Nn8Dt zR*1+NxQN6Dgl=EYo>6iZ@^fw5{`|%OJ8hL3MIOm>eR3_flFCQx@MEPrz_QA?ZH&@S zo)0282|Kxfyg~Y?IdkZ3V9?*Cuk1IcvOjFAYJ8dKULMM5bU7WV%go5_mzpQ)<=!W};Me+?jsupTT#of+cY#(blg6i+{gFMqQ#NKn*n*+Xk2jsdb6;&_v2jdM(D)TD z5uHi^cfNMvC7x+>xyHFU?~5d5D-3=Vq4(_+dNt4VQSmw`k`ZHv&YqiWvEIuqm3s~I z9)+JNrVfJO;Tg+ujVq|8YqnMkuBzi3vnGX+i%wZQBe+M? zx*?Upe>=Cv8hDo9vQee`#zo3$amZ8OHJmRMAyR`%Y~91oCXVEJ!xbQe^!at#J2&0G z#GaP_ns#yeYZvvlYY5?q%Tt%Q2wIg9=8amQC8GHJmGg*Q)}oFe81eU+t<``8Zhp;SB=6t zE9Gz^a+Y17HD5F->)t=M><4IF)j$;0o)dSYu;WDakQ+|Z`E4OOD_$m_$oZfAI%N=p zw?&WUpF7*njq?2Lmv?G$Y;?CdR?HT* z7`oTf_ZrlS@Kl^Q^|u_-^O0bDTQ*8;=C`u2___b;&{l9porgW4nutenIb}KNL9(=B#(j-76m)DUorQR* z)YNC zuu9Zg+z~L*H2lVMKG)&?S$Ul@Sq{mFJ|Ej$s5&s~2s0-jIE&x4;0l;(cf5+D1lUQ} z|L`XIrAWhu6VW|sT9*I|l24BGn>oJwd>6LHvizq!0@s-aOz`I%9u+EYruh|r_lo4+^*7> zD&bbr(ahgT5qc#$0)I(FlvtqEM7=US33P&@i=7Q$_AH9FiMqF(w9;KsE0Fd}B}i@K z-R`r2KeRJHoUWd-H?ouK&}8X&Upn5J<-;m76YvPX4Smj8RtIG}i)v|_JoiEWtajc9 zMv|?lP4ZJL%|opU_Ag`ag;~c%znEB4?6-l!KPU_SN#uA39mfoEB+x&bVQA^d&NJM}5A1)CrK zQ|~#2!sFU?W^RQ{HSs8!xpGY|!jr%Mt|A8N8JzDd$D}1j3hP z?uRe+<})`WEuJ(?-59p4nz|NqyZi{EI}RXtq=y>1#>vUtU%8)50)q(=?Uxm8OP>y} z@LsBbUZCgk0!#Uy1RDnLjDNoXzFi~MPt5zBmS1P2*fl)`Ezf1$-h|sK zSLQ72`R##&vzzxS0{gDQg8_4`(D}P(@XFZLh05qIS6t>|YQ`Ok}4WxVtU+ z3*dh$HD4?SguZ!=$CFuJ)kY-UF{E27dUfj7`MU*YBhw}1;dZq|W%5in^xZ3gbbET-cH3b; za0?lb6Y-GcvTPo2x5F;q$j6tK;2E_kKV2#oFNE?P01rB~%8CWwHf!4K zUR{RnbSKD$8##KquNN*)s_IBznsdDoTnx-EPx-mc6Bd8vUmjT~~n zW}Zr@pK$IcP-jXUulhoo&;hHa?(XZGH_f(JxD{Hd4&%c~fT7?)`&5JxRKk6auVaD0 z@haV^?g)c3lHuh>GH0EHSp_e-EMhLsu5Be{O8pV7t@1{+AV=b&JnWtGVB%|OoaiHGTn_ruHrhR`# zmv7g)D?OEC3|)J+Kj0plh;yenG-$c$Zm~krAewf35e3U@ckYcj?K=(oZB&%S&x`0$ z#0Yu*{c4JBEd5{!l(I;~n|lS&4UPYv&+>>2p=@k!1YzNnCSuyXvc-~rXE)pFemlJ< z6HHSuObRo+M{uS>EFW@CSV5A1Jky(3^V!i^5W8DY#8?bp%PRCFVN$8iVU81^PHv1& zqbhK^?37ipL@lF}{yDc1)8O{L#-~GnHy^vseer4m9rw7M5O)~0y0>d_b(u&H{4u%tjJ^Q#B9oIJm(h(-H@}%7Xf8mN>CH=T`sjDk^*+`-2k(P+{+OS5>q6gl^&Y=) z+Qgq5u=<+VO(-+(d8+p18IFQjoqK#K$b2-)#XtT5Gn-e|{Q_`TVC&UiM}=2WX9I*E}h#51vEgHp_A6v1|BSRl;T1W*cZ@O|I!^#f(Gd ze?|1S>KBA;V}6PR7fd?m5}aY;MMtjJLDz~9lh5tlc|Nw>Pn4f+*;|4bsc~+p9c_D! zzR)+$F2nIX#5+}bg3O??hZ4C%FBzpyTGP+oOU}n;=F3E z3FkD{3;l1{~MWEDUJEf+U<0c;R zg~lkxo$4FD1HrkC;Zl%RX-O?~ApU0Jj{j@+i$P1-fNex(-~&U2JKOXrlRo5fys(`y z)m;?~CHjCZj1v4F1F37ESHqC4P+T#6o&-YP$P$3j_l2tT!~z6WK0@#KV$ygHUbhd1 z!AaC*6@SEeEYK7mOv!yIK^L0z&`#Z;ZM$EtpT6EhsIuICXy?ykgqP!k_NYcZv|;b!~cY;i6u zeJFu+;-d7pD@nP3vgWSq%Yi&CUV38KK_*Y;=u|(oI$h|>!TU{8o};m2We5upc=UiT zZK%P;oglYk9?6XMLgkCQ`q@Dy5Ju{*S>=y3LTu+ZXojr+~V7ynh*< zHYtVtv5%}+z7Y(b#MbZs(D=(86e!?j+Zx<#RKAD>P!V0V3Vn`fkUI68TlSA^(mh!j zq4V1FCKBQS8QJZ|d!2OAxb+S&3~pAh!DC|h+)vGR$x|lk51*d&0|Ir!9}~yA;}bRK ziMzsK0XOqKjtv75`LQmjX;SHb&?=_sTAB!CusbuSvBOdDtHZu5E^5~`&!~akCG>7r z_gCT`Lz7#F2-=qC@`m_rKOC|2Xkk!6n%@mX#LzRnB3}U3hI=he&`Y3^wxN>-|C`ih zVw+k<)1Sh$oPyo?f{hfj3>{$sXffip;F#rP{zatbsx4kWA+4t^=KLLgv#6=oKY7~3 zR5Kn=C_!Ew_6+ph&b>Sb{t7tL@%_Sb_!*GgC4^B=F-t1#W7D2UAL;#+4#M{cG+8vZ zl&r$L^FZepRw^`SHJnfY(gDB6t+`U<;iyc7*mHs2q>v#u<7mNGXdej{_P~~Lbv+=w zW4cN97b5w&2FUL^z7oS9Z6dwZW(Vz>+&PHZ4AV@O$=8{jYF`$`<{~cSW+8*&cWoR&p< z!CMEEQy;(kcK6Ws3(P=mjkXUm!KRG*EV_MH3ygGv;dvK{7Ncra(B~aN-=8N`6^zKR z4FLwrEs;y)>5fCyPfIxJ!@kIVV}kWT*3>n@RTAxVhBYce= z3-(y|BsgG_x7}FUsiBrzRtnrWX&-s-ov92pRsSL4A7uWDcyq=JwTa#J&mBos@jGH( z-n=XH+?%KRNRkYKn54 z#vqT&2}@$Ro$DqxhPr0IZZ3C!m|^FZ81iU}p19=fbq)$_1dG(~0#tsf0g(Nj!%xa) zK}-kH=qW1}h`!{PSIkdS^7*)60RJ;$uaAV}BRk%8LQYW>a62T$jHDE9pInYaz8!yu z4jGrnEwtR(ym`ufV+KXx&dd(-=iL`SQx8k&4N- z7QgHIxg`>H8MY7ezLAbwpF@$(X;(#?4dGkPjjBHxc>5{BoS9HoVHE^^F# z0>JW#WdZ2vru=<$iNyrq`>ukzE!ZpBALaG7d)FCNJVzs1@-6WNz2~>xmqv8m37GDU z-REy;y>%6+E_UOO#jyLbT#NCcIX=^b%YschQ5QhCN3s-gU)q2ep;a#0mojr$3X{8@ zkyGUH1zuJIGiL1b7-(Ov&um*r3aMUsMr4U-kIco8r$MjKa1#_lbxOG8Gqh}yVfYyC z6@#%+kf;8Hc0=c0Y-8a|w2z(_OE$Wm<+b(_j8J+fm+q#3=5|!P@k&djsiI*?n3m!a zwJE8vx4-Rd7A|wOw^>S4;Up)$)pTP}&U8n9G_8F=U0!uCtLM3$M?-wFeQ76fngIyM z>3sANcN}1$Ku&#mq=kRRclQ#q9bd><9P`kAlzJ8)(4@mWOy4gF3DRPd-(ZgbW$C%xM4Db zWQS2meiO|ZLxgT0zqkpV5FCbclBAUDfuNI}91*%*a^pK#Fz2>Uz{|d|uTpBS?}>}{Bj5mGVst3{)O$XmZ-A^JW#~DdFVCEfkA}-c_*sxk|CrA0 zxe~YuwCq#9_bI1d*IR5gFd>T{wdHk-x994-rP%HC<=9XQHehXQ;Jc4%0$Y-n<;A`D zxy-E$H(EE+bM51a4F_+RfgSU~;p9OSKvihSJ$O*~4pJ5CLMZ#djPy*FnCp1B9k@1M z4v89?H|FxyajJptXM4I6q#3Tk;pd%7^duOg3Eup(`tEV6d@ZNHWLA>wz-y`>oD3hP zF8Zp=EN2x>&IN9bc=o_vnsp`i>@I7k@qY9!&JYpO zkjsZM{W^}P&%}pq>s?)E0`&2X|4|@4VQ+jN@vP!m=|-*7h7KG{^4^&*skhWWvJGM2*5NvvY)=}2X=esju}$kx9oK#)I0o?{^$MS;9t@o+nzNjLwi`PAL2k!r3voMJ z0-0QOeo!t$c+MG5d7hx>va-HK0IOQaPO)X!C8?syEy;T+8I&tCfYD+6bxnopUGZMr z>6J|z7fq5oeuxj z9`0Vt&285nx8OPpwLu48-|l2t3YdJQvD{Pp`RAKM#^~E2uzK@>JXvx-irzlxwg1t8 z?NWb|Ws#H9qLd@W%wZd$^ufxfN5|H}pQ&}GGw=-8w*8xyrRof&rf46HFS=LUL0-Rv zF8qc@#9p-X#RO%((j&Vk5ty}<)q*dUGWq}Zz^Id3+=P{dO9U#ben-^IqqwmxRIO*) zRuj2wsyk;#-Jyv_X(HUMk>)Y6_d>*HQX?urLha=s<)L}3-yV2><1Wv0&}zEkUSP)- z5voIBU!XRt*M_x&S89v>I++tlO%0PtAQ^OSy>EDFtsl#C-w^6#;lK-wQ~3&S7zAuz z5}Zq&ehYln>_rJaPdcm+C|Pf^`5iSO2wxAF{NQ#E_J)p-(9(j=v9EJmoFXL#XfK`dqv z2M{B$9APWs%S8f-bfZtMjf(`PLp$JBBu0?-xpz)|^j__0+UO>9v8V_=43psWW~v(U zugKKY3kx8+q&!4OG+5`30ZskREI+a%Jm7t9)zn>Y`hdy%8kg+DtMsqL>&kYE(~YJ* z4;OkIA)b80t2Cq?%=B@Sgf+uX0#AEa)n#+TE*_k(ruZy#&rK+Gt7R7KVD$p(`lFEq zz_)`C+wrqbn|KF?=VY%N`2ek94<#-M;~#t0d%*;@H}5XuW+>@HD12 zqUr*O0ucK!@evi_4>+TWEvN7C$-IomAlDneHnPIf?bC=+66G_M~@q8Kged@(&sFqluo@m+-8%|L*BT#Ov2Feus(tqL)#r}cX{#aU|Mp7KM*I41HxfHa9!H<5!e zV=UswYLI(a49Nj_KK^D+F_go-uxO!aG4wKW;&f`PHR$omm$t0ObN^@S<3K_?1v90~=sm=%$}+f+3@w`}Fltkc zvO|b}Wn#2&l-3MiVl!1a@^lI8!Urp)EPsr9nhQ*4lXwR99^t;u#E$uyR!M9u zo}fD&d6KU>`{qz)jbPoH3ih@G17rM4f7hO%wMVQ#68|lRTzZ$BDTq@?0lct_Pk5~Y z%2T)YZQB=beU(0o*3G>4$k-ZPC z5>|<71fW;@Srlzo-*+aL)M^I`g4u%gveZN8=JIc#^C*;^+?E`vyT!*}BC~t><_yDg zD?U^BuVBPz*5B?S(^@f>sCRTPfepaJjm?qZ$5Wc{C!c6jLV@eye(B2}?z3+=M>})RZ5}krJ;m~LD|o0O^rE)Po`T>^ZTqU3>^`oD`o+W zfCaWG#0=us!185B_jdZy<; zeUyl1t=SV&JnYVUhyPG2c9!qY+ej_zB^yH+K6BBijGT~;jHEA;!=mFH-~Ekx;s04T zq<>fG$Q>((wuf>HcCmLRr1!e!q3XD34(Rh%cC~43BY5A2oBZYIRz068)3eMQAS>w5 z#NW)pFNOVP4OipD1c2)r_XvIuM_rvKalA74g4i|nnSkxwg3`UdeiFIQaRJ=9`r~Q4 zyoxeu4tjJ?Mdh{8UIe&Rge5ow@vfQEA?{}{9uFz~M&c4G$}4_7t1O)&M2jsMKn4jZ zeHp(+`?Ih@>e;_Vv6~7>o+Fp2H3Z|DJV`7DVSCpxoy6{b~R8Rme38kuGZh8l_5|lmHoRmpk~{2&th$ zeNsDFX%HE&)z0gMk14+qbtS9Pt~F;>J`SNz2$w+4`er|yXw+Zh5#7q(MYSA!rD2I% zmAW&mWK)ZuG&-LvU$(qEW89B?!i{L`>@sEFEg-ok2F?JMC*nmhwh`0qOA}5pKg+rZoEU)4Vc5MM(ST#tZwXs{*l zeHuct7YEXMN9e>@^{ME_zcW8q&$MB|-?ER8&Vst1ke;Y|uc=o7EP%kWq!-x1pMJaF z{lK#Ry)UpNCp5tqVBSd*pl8kdI{_v1{Or(HZ<=(o4`To5eiKA;Mz7*m9J#8)eFlsa z`&pSjBA@(z`K z`;h>6cY^x!`SR;PJQe>LP%=ALQcOQz(-7Q;MHV~HnJA9Y3VV0nT65TT)z_Q$;#ZCo z7VOJ!jU$9YjUj$hPBNka2qTI4f(~m%XR_=A!|8p;Lf#j_j*MZV6Y-z^g5$++khK zFg}p@zR~c37*ZFR0$un; zkvXJPCE+p8m?P0=&iXd!qdu=ilIOk@rPEym44%djp0!-Aj}pB?X-|YsjkXifFs}4q z&HHYn{q{ROUobk}RBdnN$cP0odz$=+#L)g5BJCNE`LXi_)q2V|B48YPqLBh=;D#Tz@#DIJYW-8Wh zjKb$1Pst3fRNT1bCko|kRQUg><8?!^R!}k{(HZi7-K$u_E98l7WrtaL#gwTc$}Q*d zE(NALXizSbo}<4P1KEF53Ve1UJcL+dGPX18{`sU`5a2m~E5ay%9^6!zLs;e}_mM*w zN_S?r<8zd}{^XF0Q@eBp zs!jJ91lQ~RMSk3L;e8WYi%4bLI{EKlQBN0OOje_1E0Y&p;GjekShS6_XI>&ki5jHUDT1 zx$yR(oVXsnEW8&b-xKSSZ|lXzCd`iODG}q>&nwW^@#6$+PB`;q=gGTB z0=hGnPxfLr6|PRSUJ^uO!TS|FlnYOfE9fFDZ1M+^Hz_-Ben02B014a+rlXk$(q)X?S z6^1v7i}!37C7#=DTQOMnt~1W`tVc}RG(qmRVm#?raL`4Qf;~N6wM3#tF8@heb&HMq zk(G`@nGemz7hCHmEbby^lIFVylkF5%D8`nlrNI%b$u){CNh_1@ELVHKhO zSbz05c?T62VVgyDxQpY9{u?LPY)VSm4|N2+Nhj7dDpz;14deOdMsbCQw`N!vQo$_5 z6l$5xE!%I8_$dN3QJ#Gw#eDBC9&?YNW~~k7yQ?n(170?DtEX)U{1@q#%PcZ&_76N^)I!pE!1I2K$U_(i5u6qxxKX>YcSA z%qM`Wo%0`r2(0W4&V80o6TeLivzFZ&SHEC9?>(s+Xd2Jh2Dem$&S0?4&dkfX=1vNW zPLh^7{dTNN^hCv{!V!xUp$@zs4jB~zYtwvXR&CF4j|rur?Ba%7a(X7GHpgV@L9H>7 z>30Ob6RLfhIk&PRRAswyTu`El-w>e~P8j3_IrPZhqsK53t)Qlu%I;jFva%Q6qZ;_o zK77roM@0 zT(Sd)yiL?DzB+c6=!K0_Hdu)L`6+l`O*xfr`2emDfyl_p@RQR>|<1$mlhk zGC@NS)FgEvq?)|*K}?KZAr7F$oohx6yanEswq{uzgQWPYwez!dsZ@6&1)98j7!MoZ zzr-Wd+rTk`zoDk2G2tp3!ZQWp65{kJ?`NqbRHMQ!K1;|1=O^FG4yf?8F9o0y#>XG5umv~dURy}26zDE@egj*U6Ok|!K^EWCbh8#FlxYKKLIqA-VEizX~+tn z=F@QyJg4NocMx^s#eZ@E#0OB|25mCKj?d0-vZo#g@3_;(1`ykNVK#={{LRr8Pw9`1 z$V)IX**KgNakj|r&K@Y$9QhHuuk=kZeVe!+YR<)ZM4qGlhWY=jo|GXe$WNt<|nYlw%VP}_}M~limS7z$O>ag)?HG( zz&cv1<@tHSJ%opx!>h-#bn82MG3sEI)(?a=qC1X1=3-N6D=4_SzJ%Oc<< zU@obXe4Dxo+;!45w-cu9h^drYHpbQhcqUO+|5jc(??ncRGYgf;yp#f zEn%!aPi|1E+ymy}jYpQnoRe_HNo!2t?kjWd0olkbzF!-g1drkC^UaQz2{Sr7O&d}h z6`a5b>qIw7Kn*J98NJ6iVmSYEn8pnooxm$vi35>*{YS2Zo`o4n*)TpycssczT&lV` z;+XJy48dgi5lC7CG;gK5AjPJzM9H|DC4`JWcyRvwAmO@^kfFP zrz+O`3H3}XvC_k&f_u&5)n9tGp_U2bc704sgmbbK)A;}5u1iqpr(S5C*Ipr`dGC|# zT{Ml_|I)wxHpjVHq=uO1n|gpo35D5_qVa{txsqOj`D-Y4O@}{j|F_tLYJCrdBmPyw zO_c`_;CP$Ej&B?14G_NWh<`P7<0g0!=I>{={wu?@>6>uw6DSM-=X_Ydvt{nH6E9QW zapJ0^oP1%zTUQlN()&TUQab;!LjjTgFgEhs*?gt%0)j7Va@3nZVUar5kyNPEg3J3* z5xal4zAx@_Bg?xlBi(BWJdpt7q!sT?ftcS z_C0@A)6#GLVGvR`?_U!=`JM$4-T@+`ha2y{!1$`-&A*&9f0$bXo?&*hGGn98jF^7q zV_db!45RfRN5xc#h~H zmi(hveCQTM$jFY5O!}x2QoMM?*`B|cxH4MtvVT_vA{!y8Cz#Zy`Dmu(H_VTV8%IRG zwc7b2TDt3K8x+)gD33=g{>IX+dERrfCUQ(*KZEq4E<2=i^QCZu!&OIN3D)T@tGQC| zIczlX>ICujXtF2iI4_&32$?m0-R8)yPfb0Y%0#_(dDiejS&=ig|AVKlImKGQJVt-G zmuy(i<5GaIeBIsraljHC{vd(rVccV_A1>jk-7a!lHQv#OmNO#kgmrM>4F;pPE4Rtn zg!0$&>cxll$L1Edr>r+k2{gD{_V9ObZ4=f@ke~mTZ^Iw%fxA%CUt-mZYFPPdJ{}Z+ zC)m*_s#D{Rubp>w&X~OGRzGE+GjzfDd5-1W_e_9$;VYLCm$-`Ekcx9CRa&7({Tex-2G9 zG~98=G|()BfyTg-j}7r;?{d6Ag3V1D?Ccs~E^ zQ@|mmOu~K=AGlt@g5S=lm-F!mI28oL;JI7#_x@xEcP#NO1De+`ndO2LleFdL8@j!A z+sWO8@_Uo)`ftUu~Zh?v7!Jd;Pp$K*J2Zj!@Z^>B~Q_A)p^?GfzH! zh@2SWqRAl#eH)J*t}H=*h_S@!=UgCfq!7VtQn<@U^`ip$VRBlO#`n>`6oUmQ)fMKCEWK8zz#(41tUU& zBzGP@z;KetkFLC)O<0X=o|s8V{ZDx~xxNg$FG*ei*A4LDMlN!g;k7w`zvc$_^o8sojB>aq1PiQEgr^n9bgVm6s6X&g?vP_WKwYY--f5)H9HxxdV zw)(g}$On<+nY|_LB~Ab_j`N`p>wD~xs3!}GF2~_$I(KA!f-qSB`XAp%j`N#X)|1!x zF#zH6nk9}KB~K6*AGQ4Fb+-s>&ox$a-#d_}cn~R7M%4;#@xY%p^dEQ(@M$rpiOAi? zr1lV;kQl?0gK+Zdm_<;gBzop4k$*HEL*-@^hP(P|E2AI#wsE;%{N^(E@_$E)U%mmf z-a0)Sqy_AYR zLwY;0P8xt~3GsoA*Xx~x54su#7#fs+F8Fa_hwa2^Cm-W^VKHmHVI3ZD)&)S}Avr9x ze;o_$mi`dgM80^1`q(RkJb5On+jgI<3)S+9=aNzo)e8i0l3 z?cAz|o#a1RU&W#g7us$7xzpEr$@rX+;9BI_=U;^DVBQkB2ky5|c8$O8*0Iyixlnfga>w?WXb*ToWO~cLo%Cf`vN-L_pCy#njedv)t+1or>w{yF z6EHp?A0LZ8z5j6*Rq@L4^Y1y%rh~TnI!O`7|X1_s$a-L*w4K% z3}YFL^$=RerSZ|6n;eiw6nn{~f0ip7SlqV3RbIR8{524`Y{q;cVu?RCxg zxCeYgw;{cqST>H~6$NWE&IItZU*bnW1Bto(c*PQY_u}SzC*Xj=a?zi1) zt8jdvk$MhSlU;l%%Ylw*k3%^SuRhMi%Z_$zKC=1WHn{p|w;fp~Km;@AL^ohg#PO*Z z;4l00RT$^5gDYb(u1Lb74o*AkLN{*0IPuKW8!Yq26IcNpd$J$T;(8l-^xEq`<*{_~ zL%>;lLj`qzUW_kUo)^dBzQspQn9JM`8<4ix)a|j`b|SwjxKY>|1}GKzGOqaN^*AB4 zosKJ1ngsbi);;{|cx@Hf#0ex)F_u0;n4~E&~e`1-^xNS{9F0FNu?n)FoLT$Mt9g*2gtt zG(VR~Y| zsmM3|Q-)_v0F&(Pz|fZ4m~z2}jY2F8P%7oG#$(Y4ftX*|l3}Uan7o}>&%7{P(ze!W zT`feo!7z*DOH_S)LIh@@d|7ChfRjLjAOI%Y?38A3q(#VRW(%c8P7t$+{Fkt!ov~U4 zJKAY1hGq-0@)Kzhs<3D{HFAQOj`Y8ePN&~MULDiwUu9cN?z1j(Y?h-Jfx# z3WFblMHt?R7>)U4A^`hJ9qBP`31>qwe)mc$|EAlxNO!l4OJo-zuJNG%ldz+mUy-W|?GiTVoVXu-(m({&A`|Ab z2C!p+Onl*e8pjS9w>_{^xfhP8sxhB#Om&-yYko&g9Wne_tjg zjldnE7ySD75*|++a7Vs|&hUJI06FNkh4!Ox?SmI5HprRb(Y6==s}rare|WI#CfEE# z7JlgAZZY2Z&WZehen&^5k2x3W-@>9Gzv%W@xtsf;-vvWP#=9-~DNp1kHa8NE1qPBF zK^%%Bh*0JZm@snE*jD*Z7uwguuD9=ebI%}v!Ja8QP~Mi^Q-e>(K;N6YvD5gPYi|1j)cH%jJk*1KQO&5+9U33wd>DI|&P8x9>oom)z;j$soDDhh5xjt+Be} zyAi+o?G=*3{lB?~eBgT(ZvhOw=n~1#6OP8UDp=IG`~F9vpBqK~=D5F*4;80|Q632W zaABB>nnNr4A+JwX1`(f{H2u7P`*-+Y!1QAdN##ds5^7TaB3;w=$YW2qKmYAt5!h2K? zJ$V1%ou{{+zz#dM6JOtDJGb=~n`ve895=Ad=DQl8Z?+Lm7wzRIZJ?in{N(Ow-U-Qm zBZ;Z_wnYkFH_;yxH%)cq`nxY<#4LziJlxSleR@U-Bh9(A{qaPx%!}D6&EWpn@jn3z zy9}@Y34PpRDD$b|&Rt%e!#MI@|ktEt$}w3Cm6OJlcQjES&iKO#Dj&&SJOmQ#2w`mwlyd~SR=6AL<&8y4ELP}LEG zjgYY&hlTb}(FgHf)cQv{<-ZI&P@jD2S;_xBFoEZt$Y#iKJWE^IDkC_!|5y}`WoC=xc zX*9|c%kilv#zo!KuX(YBc24}y9C#we74rl(p5nOhSC@(uj)!*MZks?eK*I5X@#6AjiTZKv&~sr}>CF?Zuc z8S6N&*2!!&CoM(#R=#*Dw^S`}=rVcOPP2V;JG zL`)4gDvZUvWiDLBGDODwnx4DyzLAb;_3aXlX{+fUa0bc&PRg-E7<%R@sy{Zw-V8$6 zZ_Av>>4`&}{EJlMQafrfLOF-SIQt=Y&A)Dzc7@{#`53CP@`1oF#Z_tsasJBdF%gr~acY|%=TgJ>1TMHp z=iNLhdCKuNzHBU?Yf;?D!uH47%Y;*c<`plG;Yv^@{vfoMdaY)a3*!@x899zeyTWn& z=g~hunhn4y8|G+OXipR7VUs!(^AOHQ*#7hF0&b4u1~aZj9D|Qko$wag=aJ9gEo`$J zhz~rGyUr#4Yk?$)Hu9h8PdICVM_PocOhT!VBjTC=ydrfo+|lj>Fb=b;;nE#x5vuYD zrAAH=GdcZnp*@XRB45x|ci^oP>X^VB0Wh&~;-IymsRmMY2TyfE9TS)%0H$X0UmQLL z#8$UTH(h8KPfY`@6Y7{KHb8C2Zz!*6pi1}QwQ<0wvXv$h)YNr2&@|p&k6CTCmZGXgZTb8P`Pd`bH0dfb$bJ*3#V@mSX zodV!(M$4Clb}ZU3M!R4)tX>^MVY#{Z(m&x5lb1yPKD+NCkAvhKnAqNYhr1cOVDtQg?0(otC^2A@+t=%5Ah53VwiBYH_<6;hO0TIqW`ey5088-Z2h&d z*aD%!&3E3$vHfRc0677R z+)OF+?A2F!?0+(@lfktrr()+mLeU-V&?U@|aUB(Rhx4U-F6PnWp}5C(4cza@1v-9^ zAnq`{y|7Z(E;wd=m3!Rlhr5M3;68sjl8eC^kFc^7@%SPiSmNTt5%`#+Z#GaGW0fkZ z5r%xZ;qHr@ZogB~A9i4-EC}|*f!Jk_-O1bueinAvRm6DiR_r3g1I*mf&K*FQpw?rQ z1{}O)<-f*J4FqoPG~&lEK2|meJM7f7x{I;f|M}-%5~u9A!h)V@WGHr%jKaqay3a+u z6jN(>a87CADIVjKv2y%w(Y;v-gwlq^c|Az+quo($QF4@Y_Va-Gi@-Px#ZOdc`$ z2!<11Y(G!IPQs=J-iH4265O%;8m{@!$GMktO zt6o1weC~hfQMr1GN6A0sF=n)TW8ZlTJBXQPynW)wD)cYL2Vx8D40K1d(YyyfH&tnM z`LfWCMct0L4?J8`0&i*l55>LH%m*4C#b?u#=0DRw-7-&BMjvsrRk0_?r6uy z3!E;i#z?L-g8#*^)9(~~z!6iCugK)L8c5Y0SnGs3CNM_;OicgK3on)j_vk0PqrDmk z+;(*gKdi-Zg)(yYDi_6RHo)c%Zt`f$@Py?jpH0FQYPdIFuEMHtd-($~$>$YQR4U(+ z;61o2ck7Zcd&V{~3DH1!OY@)T+wZ;)AIEM-wzs%`I4QEk5{t=+jQdb_Dc?3#@D#}T zI3~}+uI<4|C3KU zSFRVUjg=8dpOXfJbZ@-=y2!)L;yu$Ly{R-@d5N*iV;IX&BmA(pAjf(b!*IOLG&22f zW6_*%C$an;`NQwYM_(>%vVPI9d`tV1suliD!gz$IrMS>MBsapP} ze#^@A%xr(^uh_jqo*>pn@8Y#>>4wJe%EA^Z|f@?h;$ z^gtqG#BvbEv>fx}idy2C|H9$>KYrvP^6(#}V_IdAwFr!t>E)E;eu8&j7NzHkAvG;1 z=vomT-zgh4`ZYP>&4o_NHwW@m@s|D%6L#1uNRt(a>c73`9VPp`QWLMe4}Skvq06i{4!m<>-L->zZuH^8u^NpSA3DA5PLvav zAAJ7+%%{35+5gIp_Fr8p`dJazW%c>dA#JArS!@ct1RD}5Wq$0O@8nNTQ)jIxJ8VyQ zeY=7$-dZb+}bkg&pnq*r-=dA<$_|KQ}k=!yx&$Mf(@8j=O>8htZ~4>E>eA|%M6Q7iC>zpo3MR$xVPLoB z>bOegpl{8z@^?LVF>psX$}6v(*lz2sM1HmW{pG6b@H+Y9k{3IGZ%6E`4hHdM`mebb z_eA3hJo9s#UR&rfN-*hhJnU%4)g5wm471cLiy-eZ>_2FzR6Cgv@=62H|N8f9-Gh&E z2QMDA*^V-M2|n>IGVjK2LdxGZIl3vHLIf*75`cmUf~@8gn?FQNz5d^f9sM`+j&`Jf z=N;;&10)~~EK5H-U@q`*QCk*xYzJK;|EI?f6qT)m7w8Yf0xXgn4fvS;TnC-!TtA)< zmU=OdK+u>|Z2l0{g7+A(gB3fyDT_OQJENR?qRNNkG#r`a-NR^X@Cfh8O0WJRNGt!m z6a1JX4gm)v?oAWD4n zan~dBpT|ghtlCWisLD^YCHZCYl^NkNfM&*v>vO^Y$!gZg6HqsU@$?sl@$HU3NKl(@ zyrKIBcN!vCi)}dC3yhthk}#UozkmGeMtAQ6k4OMK7QQ-mmTOoRA{J^+;K{01xyt4k zX@^OpmlpTX!;iabuDb~j)qVB z;V8Y%NBE+AmcR3`SjdlIyh}4&!v_4+^ndQpe}i31dOBc>|7Y(z0QM@1wKtT|L+>?U z5?Vlt2m%74f=E#i8z`cJz0twY2^|sfiU;jStVVTUsim~V$7$2l^Y|%gJxKqS;H786tLEWWa z)iJ-*vcJg^fxN1Vs3Um3ka=U2JpMREe6-(BinxxUJEC6t4}j~KS1=}60cQuu%6y+b z@UO!@G|&d?t(!mWYIYj>55Yt`S34FTKT>*LKX(~i@bmwXTuWIggGmnVrsAQiTW*Gr zQ0ZYsRjQDJxHQ<%-_`%p)e9%~sh5Z%-8L*_*nwp5 z_V@blM!l0mctPBVXDH}y(yT5-_a2YS?uApFeO}G@`y#lGxfHw8Xf=*2mgSh=UFYC{ z=Uc~)lgGr5to;2&gL9EWJo_S=kB?C--=qG2WVfAg?iI%Tkkj((xm6gvVf>jUsGV*> zUHOS#gM|&h!;Y9Zu86{2_3s1k=eZV}rQEtik;nm9&|wQlOP-|ee`?OVeY%CSWJ|cfS84DazaM(N50! zVZI^6Y}*9_%g>2>o|zWgKYlAylES=vyp#aXj$wbP^)CwI4!+iZ>5s()iYw_SEu!!VkA*$oKI@0_fsu6k(Do|q&vZJk4*i8il`oJt=5zYXAMIZ} zp)wnqzNAadju4f_>`aG#bse)VT*sJ3*Z-G_Q^=`{s3Xjven}D0r>Ff{UYxpV>5mib zE`lafl3d84Dm!4PX(@CGl_VE(s1qL;s%a@iD&r>Ji#tvYhmUr9;JyMm*?}o_u{14( z9jr)l0uEJi@zE}>V{jNM4xF-yb`|IaHLV1B_{1~#Ld$}4t07lH#7hMca%it)r<<;6 zDRdD_k_$PMUvI@%p2mxBbjhQ<@b~~hlPI`xn_?eUlF&8Bh__(kL(@{I=`b4pX5{(X zc0t73;l1$D{;n-uY8mC0LQcvvZTq2KDhofw!CBYy5G-7DwXp>T^~{Z~XqU+W|H2c= z5bnfbDBu0T`I31aimUa2I>m=C(%52i{6N?_P7YWhq5r49iaMFE58>jFV;V@ELY5Y9xG?AOK!nvV}2~!-me-5P5cgH6&%~9wyPpn zP_q9hoaumrIfo3vjwenwq>HX&xT2l@ZBLa+ic}j@#$=KLTU;0A&KXYXHZC59`uFQF z(GEI&xKplmX(1Ilfs*7x4y8ChGO)km#k$Im5Y6izOk{BNE}!B0>#Z3+wa15}NJ>k7 z2*ITmpRMl3D%H3U(4YV2_ptrHB#kfci;qZHZQH!|!$kX3B)Ae*v>%XMC{Tv0=g&O* z{P@g~7FRkik1e%}!2Vnr_&6r~#*V*J+TYIb)5}Asw1V(s*8Nz~9-j#(b<0aWe(;%K z)iDoJ?C;{?pZrn81E^2q#6)_$8po9wq!{|mA8^*mRsR%`mHmo0jpU%5vx0+EC0X27 zfKTG3;G$}wg*Y)e2wTo4h~HE8zoU8X09O6^iyE~bW8bjdw(+c%X8ZGTx^Q(r!ULA+ z3%9sZArCtWA1JV*w!imJ+~tKsSux40F0+_c^q-6mQfw#On%%hgOz1n7hg!Cti5gj< zi(8Uh$e~VrKq%cG#lvDT(LM^UV~|I^N;UZd{wgbCTp=G6RWd@3D|qn({$3x)xT2p+ z-T80_lRT4BnZ#7m80^OU&Hwvjpl@E%;tde>hO7O)fUztOB_GhGN)qHE1@1=S#KmXf znu+c-(7{D(0Cl{(d`Tc<5-WJJpN^x`p}sgeY`J=vCM7w z5PbG|KNZ%dJkRDsJBuz~e*VtmxiRI6c1dvHH?<`oCs?_1Tz#}FD<{>2xI z{<4_~*|L}vp9>@GHV;u9}0>ANmPQ{pC7HQxhP%t>A)!#pi>Yu-k z|5*=~TXreo>P^nA!Z@6VYoB~97PM$;K#s+w8vU zPW%a&FHK8f=2+GuDGTu2m#Z+YpfaY#vD4BxRCpn{Yhlu3)3}21=*Fdao>5FM-8ET- zj_FA}H|KHeI+R`VN8|UYF9YK6{2n=g9k`vZ;L?&Y-&yB_!bON%=iUCQL}7|USHIUu ze;ESZ@hr2<688IN5LUEj{W0R&a2XkQSUaT&758u$$2VP430w6lbkRvt_h+m#ESJ2) zI%Hk6=w1viWLPg)|3|z92cUlTlU^j_nwG-M>G}K{3>RYnsOnYdk|;?ohoILuN?-c({&X*Qh?)Emt`?Bh3u`G4T#%9VFHNJPtWMj6ML-uvcD5Cm3@C z#klpJKHPXIO#-<68;5(H&%?cd55|exCmjUjTloM_(y?5JO(65jByG2v&w_#f$nc~B4!KWtuSV$y??AC&(*zSPQAECde4 zp^`7W#O;&#vdjZ-cuC@NLmn=J&*3YDyy1FlW5xFFf^*XTXP8K5-qylP>2uH-V+dPr z--XUQCfqGK{@iEw=ya#iX)vc>60(F1FS0v!lsD$50u65R5f1U8D9zTfn2OB3$xk6bkO(cfw&O@VKnoJiP^M@1R z6W)|%#4w+P$LZtlQ5jUK-%rm?syawHUyf<0A)WfU>iZu+IWK02EhSgKFx*?G-`jjtNxCM*s6D z94B8n3CotKQvbk2`-PZjN3#uk)2Djc5-Yyl`SAh&c$n}gY+1E!k}0xI-tq^4^pT)H zfGvzC;V@M8G5ev;@yFW3u&}CgUVI`e?t3u48Z=hr@xzB~X@XCMRgS=zzo!p& zl=)*H+69v;>u33t@HY-Q3OaBYYMN+gmdH9o4sN?g-hZF`=x*?pn%%B|Ek7cE^ZzbF zTN;EP#5&O)Bg^V(eAE(G2s)`N`l3>q)Wydv`S>9dNAa1YEEQ$`7FM+1g9GH6TkV;L zE@S`uKd>RT#Peg@LYUy>;hFKkLWr{=HJ<;0_<-{=4qoOe&_nn85)Lj~ywLwWeC!%8 zKm23;SO_ko@)gswT`^$r(DCixyLA>(OhnuIwG5op<%hu)FzImM*VCbMi0fjYot%kD zf4B@p8N{_&!HtUe-Xwp871&Nb7m2v@5a|0Kd;sN~x6w|b2A*X=pR4o(eI!0O#V1ng zmlgl0e3~b^ZC2mSrbwAaNQlrK(@;Y!-Asx4Px}rILq!`W{TSqpJ0arbB_k!SXonAH zj4O%{_#)aDWTzYoM^|^Bl5tl~LotQ@e*6%1Dw(na@Dkkb{09fmaVN=r_urp(Nx*#{ z4wM^p@RuQxENf8>=~;e#7OLfB?4IEH91AbJAhx@|FZ}oy|1F0fQa2~g`L6gOw)E4b z7~Qjc%~p+PU8?L!xJf#S2g%{u2CGMR+2Os)5}J!4VZHJ2+{^xUwY2}@17)uWLXS+2 z+j!Xds$9|j#l4YaETKkKNL?OR-5GXpLE;BXo(IBIH{M{qum@Kbi)fao3s3Gao`3#% zF&>P+p)R}f>hOCU)Xe_%13O|hEmnNy7+Gt^I=CGqkr%pS8cMfLtl#)poZPJ#3lWJQ zinD|0PSJJ%Sq8jh^x1wRenVXSkAH>7pTeRE#z$c`#cFgO@~-{gfBhi35@9kY9dodZ ziHU1!3O$WD4};}7G_=q9>#P~}{vTBYQokhv+0p1P>64m$l&rSy=>P5ghn*nw&nz}WTun9Sj@p}7$>oR2!_kj2 z_S$Rl9GZ{k2qM~t1svZBJY-u|9m{XSn8vFae~XWHOtdr4qYnD2xRc6?1IGN^#X26@ znu_%VPL~B#z@0gtCBsDL7z~2TR@by^;G2J-PPWNt{N3lb3$?MR6@R28k$uGVv zZT*C_=qAhM2#P7}kzC3_4{nOA2R?I`CU;;ix%lEJW=@%YqNJrJ!SQZzh48_gcn0+2p`6I1e?7byAw=n{0MU9_s^GS!^vuX zpNyw#UXhh6?mY!3Ql$lslxr8HEJ{EIV7HIFn z0^VsP*h%o|ifj(Yigvv;*9u8jT%pRgp_lNu zN)D|2w~f0aJb|x_O!1|cCd&_B=9^pDqknL|=D31wZTZ?sZTsO1?6UBgw)Ga9;t;%5 z@Z)buyv!aAmtT2pxb~kn$d7eag!f`KHhnVcrMXr}y5b5|whg_6$5nD*hrw}`W4s2gpG`(f z#Dn!Nfsb?QFITjy1hw^vKicDPxCq}m3*amC@kbums{e}wwU7uL1T_S z;y~1yyuwaPz{66<<0Z~GEa-MP_-hz;1~4DJFO5wJk86y!{pmL5&zD>->GGq+wy2NI zvT8~SHMMvcDp$0tk3BEZhl%!MF-_v}m8TS$ymx*9;uhJK` z-5TzRFsbF!&GF+?yXY@zbqg4WW6-_C5{nnlM9&@|(XVddq}f$)p}~v((AOG1Oz?bb zKmS)-{yag2I{Kb>x|Pnc{G4e2IX^rhvwPFuJPt2qAHqW%e~<05`1&07z=25{Z!l7_ zsaE3v{2;h0q2JN@;5vqfp^^6h+*zD_Mm#)p|F7r<0c4`R_pVr8VEUi`<#27q!}3_9 z9Z_HZggVIy=GBL;BEJ27s>FFv@p!E8;UU9EU>C*`SUoMqPlB9;pgR)MMy@jgeI{Lt zMTzg6bza~hq5N@i8h%{RJj!Eq9tg;eb_iC%W}nUE#Oqg>XusxKx(J(^Ru*w0)u)gI zL2LFuGy44b0rth7EA0C4qvg^#c?De`|L_OH+cxCHxL$qoQJ1UC`QG4F>1jo~PE0iG zKc)5J5B`&|qVg3~HvYinHu|NpI=!i1<>fFhLvJZ55#j5U@0GT=kqMw`9$C5 zTs7O)f6%BC@V$5qlo7L`*-*D)Mkz7-$v%N6Y^!L%aIiT25u;9L&AXZcKg{rA#QyT;1!X?y@Z z67`1$lgW=>uDv7ypQ6We>Z<>@a9PL$EwS%249BYWu~=!$vs<1Yn4Vyw3|{Mb*g{r68FiljS5 zW0L-aV-69$KDOct={ooM=Uyz&ViN^XLR=yJ=O!3ykgQDJhAY|=-|LTO4o$%a<>)Gl zBC127(s8++XdAz3Y`7;(jxNtE6Gqf(otNuMKN#VvFHS{gc z>v*haUoh>U6M~f_hLq;Z@5`uC$DVX1cB(usv3Y3tVyJ^EM@UyT|Ge=(^8WkAmp>z3 z6*Mk0%W?D>m}qDJ7k3kEp4p%^^-p4dc@|vFKx*R+)(;>5=m)0x{9S?tN_STG!nLRD zf)p2!({KN{qWui!FuZH)&5-x^N&R+U8#S(VK@)C1~{+q{66q}BOkM=iW`Q3{4^gsl3JRBn# z;-A)Z;}#nT`aEaU#1UXpNY~S;#`C6ItqEFeAYJ;$O}G!4@+;bBt^Qa%%VjRFks@*g z4qf1(GIGI=Y}~w}TZ$OqeQ!)Aa+M7)u1borqZLWZKQO_8L6${laOnPDB!_HVDTYSW zaAeN#-6zv!|LHA%Q}Nm7{Vd#e`yFXD+kV34_WtLw!foWbYvKUMj|gpM>DSfdwEqrR zdDiPNRO&wl2WWB?2d@LZraqEm&hEGalN9Hi4>RCdU_0HR;&Yb|IId`a5nH^uO0M*k z)(3Yp(H|`Jb3%#kJ^Xd_@!t+lKJ}ECSN$@p{qMw}@l5EP*7H9ZJ|DSySLz0`#KYOR z(r!ksSW3hIqWWX}!~yv8|6PuW_A5k-mO8}v?DL5* z93T9e*B}1^Uytx7OxX?BUk@K!Kd7Y?{Xe+iLcBA^OEgXd(GO!3=)($d9O8?W;3OQf z|ChpYOD!FBBK-GjZ;%fpl;!H_mP-u8(!)^sD38O(RBr9%#Vqp)5}DERTf~Sk6}e=4 ztek_8C#RH0C@xia@EDYi!sL%k3^@Ih@I&a^@S({J?aXb}_)(E^DRBgM8GjiQxBTck zRqEs1vTBX4L-hI%ek4u23#-dOXu6J(j{;Z`%X3Cf#)Qe-?qDq*=*4qLrqb^z%1FP? zTuG$*NQF;`F1NBg2f7J|E;>;_2lMX1F%{kzded-UDO3F5>Npi=0w zv0LMa(Wi$Oo}>K+VVBsh;)k1Q^}6^mTn-O~z%p3OaM*!daU3tE%#T0cJLe}tVE;QB z9~>53h#$5QaQZp1zd!s=lRgr=Up|9#9W3*aW7hxxKmbWZK~$d-d)had)Wu3GZZSWI zle&^xOh)S;CsZzh4{1LCjou0$$!I5%7fIe9I2@mev=iacbxi#D5&b}aGf^|pj~{eT zaTInLbm`{-bew3XezuKOR>6U3U;1oHB*pL%MJnr<5zHr}2Ocy2QJ9$Jgrm2AOgF~J zE81~xOOJ5{koZI_|=TR|A>VQ@sP_w;qU`>MSIR$T+u#GOyw8X zs7^{Qn?A-cZ@erv5Za$(h&Vx=I0E``ZWY~Wa-tnON4Yb^N3>cK)8t)td-Jed{JuIF zhu7OqRPZL_-E!CwCrSHbGWtyX^H&9`JyJvNRZ!tS7Q+o$|1iO z`u*+4u{%FurkVw$OMetFsjLsA7x8iSP@K8K6qZ5z;zurj(QVB4&;4nNgK?)Un2Y01 zm9vy*K>x8PW1{`BCy>OTu*t^jg^%sdJ~>~9U}ZlKXJvoO14sD`{5A0|_-Oy$`5^U$ z9Wl=4!J;f@ukyb#^%X2=LVt;Vljp{8x4>ZRn2V3yN+2ruo4Tpb>*m-v?&{%~@vs@P z{}Y%m;fD(<-WI!%c7ktz$#~3&R}=mMPXhl-m%y;WDl20*J;pD$-vO6c=iqsuesF;! zUGA~}N3h@W_xk-~5j*r3ndv8B*6YXqvqS$)SkX>Htv6yQfaNk8isdzuA^nuHH_KuJ z=~e$`hJH8EUS`fRq~u1%II+Z+BCjaxVkjz*--F@+I!fmlIo!rH3FCm^4KuU!kH=xC zRP>g@M>}#ci}Y)Gr&WG#72`o~(&iwntF@(0YGgp37OwvOOff!cZ_*TTnz4~G|Do{S$fC%_ziVNdwt-l*83-b!87 z8f-~`&|mrge92$K#h2p8Dr~v~4wifmR{KOFw(I}@U2#?TG!>t6YaXH$;D7qV7vS&W0IGy8&|adZ(7k#f1x}yQgo(C8FX6s!3RU*|0+0~j6ONz z&%!~nqKGeF{#f7di=Tx|sb3B)L+&>mxvm_B+NGb9ru4hb=CS4GZ^w$PcZ9|9BfRVR zb2aawN1ce(Fq0uYD7+m$33va%PWVB9A4@3zlTSZ|vRoPd^`9}~$B+Ieo8{-~4X&D$ z12*yFjhC8G0*TP2Kg+rpiV7^tAJdBhT(wMp_8c70cRWAH$)S7@(j=lh4yeIO?@Q9b zNV1}xt6OLwT$KGGCM|Ed6_b{roqocR0%Ib5I6&-2@}-}$+?u-&+@>tD(83I2hsI>t z)_FM&K%?7~Zyxj&p*Qt2t?4cQgAZXf`RQ=mf;ij1XDhgl*;<~ZB#hg2H~u^P;+MaZ z^!DBpKH8J(81aeB17ab~A1t52$2rzNUcUUSi-Y-5RUhVsj{`nuo#{k-BJxmIG3U=U+lRG9%4B!9Z&*Y;J_0xwi zCxj^1W&Z=Yr(g6Yl3lKaIIzfZGTN;7}ckd*)69^V8 zxVuB3kpRKnwQ*~_k#4$sI{)W=?>u+Somul?KHORB`BH1uIdyjJI<>3LK3jgfY4gEU zd)OC(nt1OoZ3kI@E}Lw~dQ}kM&w%R2)m}jLkTD=2jwI*$>bD#7OfmQCFZT#0 zw|*9s3$1Fc8%N+>1I?b0oj+Z^17Zu;v3_slJPn*E!8~i1C;4ia+Ic=2iav`u={^r& zw0U)w6Zw)Wp+y-5Q30&I2U2lH?!IOyz{N7Ty?% zKGVH$cXkPFFt+Kj=tg5>r|P_AvQkO@T$@WBQqQ~Z(4UZ+1sq=Z+)MBS5{`;r(dB&* z)N)$3lY@gi`O{t><{&KVPm+>M9R<9 zg;w0N>bFNt+pjCVZACPqvBOHi&t$%*dpg)p!b{PIL_5Qa4=0Wc+Ew-xY{*0?X~m`7cbU) z@5yOrh-ezF{r30qTm#r>Chy5GcFsF=P^+Sgr{F6n1-e~G%KHtoW9#C}c3xF~d718tkny{KXWLUe?mKV^Y?2yMpuQiZlM{^7B)pd-T{O?&Y6! zlV>@ro1+2i=Ad0$PQ?@p)aY>I`c-!#lr)NVm#Rh)T!{t_v{2*0#b%R?$h>>RqRh({ zdt*s};+SNwP{zu*=!%BRgkLAUB=}Zq{vF0y$E#@L_2VBdv7q%m$-@WfPCLeClkn=# z;T2aoEnc%3l4ao14_1IapY*zqt<%**TPK}B%-W58nOsJ)vA6Q|8{)3~we`sHiYyX> zHGkhH#P?9d9`~yp*GB|YbX<0nX3wwSsuT)I3oxFBm)kE)_l3ew8~o&+o+AUjz9lV~ zA{3jV{BT;?>L5$D=gM(&&zu219dT6YCqR3x0EpltR-17_zU` zC}+|?Kju(g-4HZ6`UT{`?BNX>h~ohFyTN^pj^SLGA6?@D9GV%^9gWt})d9i66LMml zZ_nwnCY_&c8hbh`MY+UMC75HIeN-SG-&FyHi34_D$?3oKF z0~o2!iEo~CI3N=$%>gu~JFU{Wv=N6yZ{UwCFS#7RuHW9!?t!goS%E$jR9ZT^6qvDsd;JIE(QeoC zd*nobZ)Ic5+Rsp^l(*3E??9m(LUOM`$N+5~(9fF>M2t$5~9}qG}Mjkch7?GGdiU z!6wIBeV-#NBs-rDkIz2G7pO?`>(u3ES5hM4aND-a7f!o~-H;ZmfRun-q3sZnS7^OIi-|4xpRLnM=VqMQkZ|_bAaKy zhpk8TeGYog4Ju7k=m+4_RY-EDAnIm7SGB&iYjzCXl9TbK`i9bTuTX)R{w2vOwiG0t z(4#A|iTyah4BM;v0Si;4C23iFq-o4N^o+ZZT*{WCrTgZ&j;3>P%?lSqv&-71V-_Xb zY(YUudBT`Hh9jkFMU`Z7Qo0u5bhc*&%ApU8%LC&!Wq9!rPuQ7Ob8%@8$;FTTl15Ykv2$wcCPbqGy+W`&Lf^aasA#e4I2b`l-J+$sJ zHzt@SvFi25i+lNR1TH3feivFC_#N@wFo#RTiQZW|w+d-Cv%!D3?(wB3@QXwZ^5qEE z_+#fBdd`JY<}fVSb&aGUKF<2NA+OoTB^G8p*6^Z{3#4}AFrsls&Vz`SWtKe(hP%A< zvK8wqkVWR@xyy)62Oxhlza2(o`5coq{}H8lO{% z(p5*}R_CDdCfj2v3e9rpu{Ef2jVrX!2NkNJ*^+#03*K=t3+K-pNN1dPcg}Zk$pe(2 zJ!GeS2nz9?n<+UlYaeQk+97OI9-rvh33F`dhVxs>gI!$-40}`Q*8}Rqw@(G1lEdD| z0N>8)e@e+yK&lBLF7M+#fu8_$-HX_p$Wj}2@^2E~9wg!87pELN|M{+?wW{Zo@RmBB zgY!ayaBe4wQue#$&0g=eYt{a=M&cR`>k@19Yn@A@Gx4ty)17vD zC0WZP_(R@RBJr`V5fK)IkEx!7b74csXZxGPLJzLzh>j1J!UvaT;5Pv+8>K3D#{pNf zAVasFr7*=Sjze%!)~wNWHF!-ITY+$;hVNK12Eo?Vc4vdXhW_nqA{5VBAkU%zkfHbm zBm6v+^+~%5ED*_Eha*Nvc`Nqwpw%iP)=yn1$;@O*ti{6YVrJ#xs1cciDm zn`rsvW{c?+P+W|KlyviNfQU}+*8N?Lkd8M&=&)0DRV1L&6kE!L%~&Fd8zTNSuuFJy z0QAkurRf$a*Yy)ZQXz0XE^6YRBG4jm3s<;qObm;!S*r{K?fTfR@X`RRZlNzA?4C;QdpoU}3HUyz;$OW!@M>=Di~4;~K#;~M4)SmUmKh;-%u6x_>lBs&*FhII z0U!EcT{=!;e-sY@Bu1MN)h;ag3-kbBRbXg^+vaBjB?+c}9n^*>307%-+L=rVGwo3Y;GgmS!r__vCRE-Ak6+3k1m8n3uKV181rn%aZJ`CgjtBs$M|3q|S$8Cd@!iz+m% za)*|1Z9 zU{2l+zP=TeAM|uc7m57VtYLB+;JIt{)W<#1)Vn0Pm1L7X#HSPrIw%VvbEY*T=VoXT6Xs1<#xAsHa>iOL5T305*pq5@>M7Id6k451 zd^qZ{q{zV%fm0YNPY0E2(yl5Juqo|(C{>g5B?fZy1wJuY8Smn3G(w{2Q=Ja{ox|G_ zla2OzsktqIx^M+u6tBJm_r$t3J?r-A*umgaSz2TI5Z!fY@Kk?R5>L38oVn!b%6ABP zEBj`gJG)06&=a^jmqDcXSjl1v~RO$^9=*`4#e*!+){QkFYUJ6n@= zkVC&7CPvH*93{5VN7TE;PyHU15Pr#q^}U=rkB6L%lZ9m4U-x<3C?EQ)G1e)|(3u9{ znoF3tDPLD`gM9P8ZG{Og@RKFRn(p$XO29^6lu7ZNUr~o~iDBB^yGWIWjE7$2d(XsY zYToq>6rW{_Xa0Wg+hh2-RN<}8hm<`{YK%4{ECF{RLcH`L!F%h2Zs&jpj9XqY{Z)cG z!4#9xH*uc(=1b9Emnp;?0S&#O;vnG*)l!t=y}g;5WGjOfTinRaS{$?O#)(?VCwPWG zSsdw@epGb*p86@7&6aj=2%~&@pJu ztuG^?<__QOzJXP_U=NTb&;*0s%yV(hZjkV|AFdA=pzlEMssVaAa9dcvm1f7ivpgzu zg*JM1J*PQ54}RCpo8dka6l>-Tm}o_h14_#-Wa$bTnRQx!`KEDyNpx;`^gXsM%&GQ0 zu2j3Fsf+&iZ%26d@%lL(Ui?bRTAtXK(j_vzSt>ldiNMCS#FV#8D2NaylEY3l1lJ|- zPKAsdmrw9+pII6VM`4p0=ES-HPHO-l7q9a)WTl1L4tn5o?nAM|k{*5kh@o>WZqKHL z&)WfR$Z^;(co`f?0EK#VHCE-IKn@8}5)0<(MV&yfs^h-nKQo(Cdw?Nt=rlpa9yoW* zD{9PMcY*G%e~~;eK(#(91@k~TUQ-;tZ;H`3x;5T0N=KR#wp8zjB-=6DzsMU!o`Vqt z&c{I@4Zn~o^667i7beS3WlyacD1_q9CW%JF^^`|;ejY{pdF-m5NH!U)^P>(kukXfK zl{{e!ZV#0YM)GA3Dqb*WH;+|FG%UV^t`Al`ie1wunn@IjgDPB;SCM7*h^}#Fb#wgQ z+LY_ER?5^o)&*krI;KA<88#S8#o>~<%EZr*S4f~q56MZsZ`~mybuLCT>XEi!!$IgJ`?!LBx!mnp113*q@p1EF7Ynzch{a#6|rB7nLuW@d=R;s-aC81-s_;& zb^O1gW;}{XJCR4zHQ-Ik`h3WYm4Zvu&URNGj)GBQx7Xnb&3;F9Vr+Im_&5pW=&IaS zY(;H#OBR5=9(CTgC@0ZWdqI>=p$1-4Mr~J8;bEgb)~cTA*cZwvP`b#cTS_~L7nk0$ z``o485r(uqDz#ec#c!J7T$iFUdG1Gf6q(c&$^|Z_1Gf0lmiBwYYBqekbgmimykV+9 zW5)DgiCE5AlZPW$JjOwXcW0Sb`(m{NoT^`((|{X^nW?}53QkBR7YB3^WF3ABP=J!M8~F3vE%vdh)~6h~#qJpP{ZiK#@1 zYd#%MNb|io&bz6Mm|M+l8DJ_G0l3O#t89Re2w}SYoQ;hwzCRyzo_lKI>sNGs$NPrS z7t6lMZ3l23NN)MaXP4uEM)W6@)te5I7Kro%VFs=;@>g}3l4~z?G*5tmG_n+2UWZ`J zJM;>7+D|Rn$})#IALOZ@LNu7?IE@9$^9_#$9aPp zwr+txM@?ZoqmTUt!prY&rP6_$WQhvF$4gG5Z?1CD9UM%Nv`nv#{PbYR&Wwg`;ufN~ zuwwFGkz?8c*@Dy;kYRMZcaCBOsFVap;>FTuJ|PsH=1tP^-1EbRb7alS4^OgVOc1l2 z`EQg;(a!25B#(|JMy2I-ofv>a9uB&TC3eD;ta_C=p#hyBg++AmFMH2XuMb z)i}@j&tCOOS~G2K#J*D*G4Y#E?1`cBN1tz`x+K$%hK?7RKnlKmG|-Jqe&oh>8VCUO zaR6HijD~{ct4WSqT(6mX8{L2dfe|+h(+AaTnZNtS&Yh?clQmw_FaQBwBd-%p9oxv( zm_+>PuYiDb36j!EM_OSM)-%m5K@{Df-F;m`LuhQnRM#1A=j18l#+Oir82hh#If2Ia zBPj|#Fr8Mk9(7B*TS3DZ3A2f^}LU>Lb|u##0GE3 z#RE{A$>Y()gt>54JDm2Z`%yNcM^{g3M`EwVorI2rqK*-=-~1@5x3ry5fB5~1bPp&u z#_XSheNnUXJIn&_dqu=QXiglwztBNnO1)WY$~-nL$1u;D5bRu^+&A!c7GBZ69`3l` zb8~C+Xj;{8K0gT$uw>E7n*&{`N)E`%-##yl1`jM_(Nj)xB&x+8nx=iYA_01t2Gdtf z0TC~*t>sXUMVF*iBu|Cf5OUq_L%Au|S>X1Yt+;t?NqNQvVmu9?r-VO>6Zw5ZQC@sM zTk%y4&&{o8XP*zccSGwkFkqq`W5paD*lldbucX={i%Nyc3&n`$6 z$<5*H^|8?-Hq81tJ37f#d&!XeJA{Q1im1V`$St1EVV-TLDyPIU?p+7BWO{rQp*Z}a z7Men?njG+T1K9F|uI5kIq&B)@2SEA#%4AEomPh$9z(6)q_{;P+b(}R_I|L({p(xp3MqYDd454P6gJzA=V@rabgS;# z>Gy8piPGt;K}C9#FMXu})o(-Pr!2n(BhyVVV^qD}s{F=sWikCC6@J6XJU{zPm(O=> zhs914y~!R{d?GX!B^1n1rk6N8)hz_Z5Z4*+OzhVVQeYz{T`SP+da0tMc>=H0w^(@I9sxnDR>iaF964weO1T^^6MdJ(f1Uviyb!k9k(^63YT_I&@ z$cWTQQU}QfsiVHs(&JPICjM*;bl_5^$p;@IxvLY*>DN5$l@KlTS#{JHA3g=d0froZ zCiseUqTYH{wBg5KgeNqK%u3Zl8+DxB0C88ZH`r7<@;b@AW-C~auTw!76NEoXIMqfR z%y80+{#^QL_GtwyFSo`sZqD+W5O%b%da*Cu{9S?2^TollHd6R%v{094m!`-EH@>Fn zwPsw-^-A7Ynqe-WAp$V`eQTWveJiT67Sn6N7o-1aj+e^~8tJ+K&q|ozsK&q2Z<^D` zPY`k|?nC=nUVziRHrJm9Xg%e#d*QKEen&96I%q1Z=H02(EJf!ctyLMI#k;G3_|>PkdcUiON?sH;u^q|*fp#&?TRQW~z1sI;iRk1ES*S&c% zE3g9ApW!_5Y7BUpl+*H!Blr~KivFJ|D5>w(bj#G*#+(FIyVWMcnNW0hDt5$xLiuwB7_Z1I! zi@V64)ASN^^Lj5NpwCuB3pV~QY}o9-Iud3#KWDF?y6Vu^)Dn;HElCk-IL zySl|&Tx0Vksk1MA9R%x^08Q_h9zZ@#R2vK1_NLXKCS@ieTX7SQC29^-K()$EIkkSw za^20X)WnSo7}4C17xfHa1nU+KtrNr@Xg{;@;Vt8c(5LW22$b4zg2zlks z@tC_FQ;GtY+P)u72@C+wo%rw<)HEbbbUbFE4m)-E`}`4ygdp0Us7JgNGl*2acV%u}YmZkqX{{0QLgpv?yicN>UqFhJ{=@H5=UUa~7v*EIl`Oc&^z&B-7ST$fZ?gL)ajC}d0Ged_z!Xw9_k0SSB^xF+o%ChM4aeohQb`%VnU@!dQGpXD zcO~tlhfhTao%pIa^mi_CBwE~fNat)CU5}o=45fNy4jUCLc2Qci{a{iP12)_)MybNU zCb%e)X+V|79wJ^(9=jqK|kx&bkOrEaNzU#IbOo+EF^0*Pz zM+sBSIU-7;gpK=bwH0Z~{QPcS)KhVJJd3s`XkZUkj_eTl*q?d-5NNsdfJ=n>d1$r* zHeVLL3;APfBJ(Zst)|Q66yzN?*|Z0KL{?f@HR#Ob`!d+930G4Sr#^O3S6CYQapNGVR&9#dO_sl2>O^cpDw%hCB7cs;F|+lO$jcA$ao^w(J(lE(s)Jev-Tzp?RlL!FbP(&ZI+c|y zx&*^us*{oBlg3}f$-seX_27EU0rV<)W>?Q&ztwyCG`0aYx00*vRSCcC)r%v zME{X(9BA;{vmvsYN%tuDgGw!~D1p*_&UOBdL41m4mp=R3=L{hwSLK(rA&viFjKf(t2VL_LH;RpDKa9yRF}ksD&?WhZ>!I`_24=w+hw!d zF12u?vA}ekf-jV(G;7*0089!ev?6 z+InZ^F?h8V8)I$6Q@~GurCSOK1JWaYFv;BB{SFCRRq}h?C38Egh6yk9CjoXakOME* z6Ytt=l(C8WxmUjNAQ8WlGCMQ@q?f5gl%hVNr08F?7&b(FRRd$>0ora_0vf-3;u7B| z>-{&U^k8|5xYrt5-#;?kVZj_GV*=0bIFN`7BuN)bHW6hyI?dT2JqJNiqB^|-?P}C( z+6Sg}QsrO`n!FeaN|sdI4;RIl;J_I`VlA00z}v}EiB0FZA@&*rdvNjP?*->c82QOv zQqG0hrwb+8GAJA8Lgg3hqZNoy9GJTMw=~&p_AXP6JI3u>v=cJCY>V|i1L2nMjqfWsUDM7fVFO}g1#7FKB2$~zc6C9z=v-fGfzj~ z4q$Exc-GZkG9(FR(WxCw{^@R+?Ykb`Sw2DBe!}P?A;LY!z)$B4#V|+%Mzjb8d1ayS z)AX{RN0pefOL@p>PI=~_zp9nTF2NxYuSg7|*=iv-1C_Dd zI!6X*VMA2qC{X`{5F9v-o<^HtpJ5-_7y}%mc#RupL;nMw#L@-LH^~^^SvoDWY>k1O zMA@R`+;_`5>d{wqgw*vYL*WTye_IS24Bs+kavN~iIelsh!yF(ht$4D0ct5?w(LiGC zVn(3d>9d&F&Ipgoo`Yz;H`^$p8BFQ{HM_AKj9dQZZa=}VkK3VXAzub`tncA;;?R}U zu&@VzFH#F8k`1Y$6q;k-ZF<`yCnkao`=hJfYWeX|FhWvM@7o`>2Fb0Y+>d?kMFUBB z6dE~_ltR=r13Ggb3V&|A*0NC4z-L#_#;1)UwBWR>(j0T9|6dR$)}D|5E~%hZ)b)^A zY962VkiyLM1OIh}ly<}O{5UeolB!PZeY+lt;n2@!a~Q^J zybs6Mp8N3eg&`;~<7>=;S|YbRd!BSKhaK;$@8wmUD)0Wo-hXEAe{+e;|YVywZcZWLq|St0Y?b+sapam4x{25cZs^@|hRvd5s^^Ci6C{ zKzKC5cPq?!YfYMB_=ZWtbEs-N?Nvq+mcI{!x+&D>6a>k0-aB>*70UPjJx`gguX-_I zST$^;;WEc7L(x!YDM_)%J-02uE^3#;gkRf2MJ3}y&>*U;KulW@)|E7)6votsvzX4x z5=x{g4bqwI`gd}36F>0&PgWvc4DB1}{X02B1AfMc3o1L;AK&SOlt_d1jR_+Eot)w) z)_;F8-qKH?eWGaU5q+*-PGbNxFx?()>f|ITe$MX=1jPgMSY9{zvFH&4kw%hw%x zx$xWSCd^r&;2V+6f6GUb0d4qS`JfZAe+7UgWk!&mt@}8vwe%^>f7|ycV3%UtXyDnv zH)CWg5|A{h)d3p!jU`W?WINF_&z4PRv29tY-jt%}4KXFCQdIe9DT;(k4QaYZzViHd zbpbPt9$oN*VQjGq0C?)|1ztU7bopNBgK-WGv4ObDtZxgyXmuYGi1Ou=o|SCG8er6( z*dl8SenzVpD%i0-)u1jOZgs|~jw9E6%2>I8wna)A7r{nCy_3%^ke94TMiS1!j?LeQfOCinkpEMQ--;qsV4 z_89fosY}yE%z^!_?#vq9zIr#K+A0Q)TFv$NMGVGlJ~cIaqo8*Hw#O9Re`70$rO|p5 zTQj|*7RzR|h;7BXanU^R`^}JNLd+1Xr_VpWF7MkXVs3Kz>{(w7Gd37aQm-R!b7QQ3@I{-f{F&^FZ(r^2 zN-02N;uK0uf>}%M{io$Wv+>`OKw9HX&A}r|2qzN3Ot{dK+iMsU{H!l~afyx6o+Kj_ zUd9=tEFMdIfWM$L^Vj~6Vs%j4t(F?BUkn)&q#ZDYyJiX+Fs4Ezz|>uKuM!qb%fTZv z^{7akh}Y@|rnf(`GbRNCOX_>wu4AeIszuOupPWj)Bl#{VsOZ;SdpDF(b?bH zau*O9?$Q1*v@(Peb|!T4w0<&DKa&PqUc=6oh<*60+B5)ZRIO%HaQ*pkg=aD^qVSVC zA*m>!rvQTO8>9N)PBhm`+^2aa!%pYw(mLf7cf)k!b@O1<{LxKA*)fAWSwb2 zg1ZZLpo@eSGV5>mPW>KOWPIeiY(=w=UF^&lp|^1(q*vN^o+VKxYHRfB56rZnvF`Ul z*r7bbC_6hCxS_vZ)2)nHpde9`f(w^Bgw1>D0b%$O z+CoVrk>#IDcjXy`?@BQ>VzZno5FmU*N@AnK8IZW@nO8%e*|$YV)Ih_h(*OA`cGIhM zNkL*!JJ=g1X>qwAlhx;KF$ML{m;R@5I!NJi7AWzCcYI$h3uPqsrdkaP5F2hhPwLSG z@l5Vwz0FIW+?r{$GPXQ?w^!!oshxb!Uq%wkFC7gOyXbq*pT}A$a{TjTcJ<&%12Qb) z1)I0Hp++_K;bkpKQE4;rPNApb{TuV~5i$;#R~&}0|1VjaY{0IDyxb~v2M)>T$pCx! zCzUppSWaL!&7>natc`p+P$?rQJLDtkD?BHmSUi}|mL@`A>vy2m-`49#9lqo21=!Y- zkY44WSdTdDKb`&6Gax6NEuUBmHH{X3ulMOiNl11`6GF1?$?~~E>Z{F!Qh4PI!~kQ9 zbba%e2yyOTDUqQcgSzC}rq~a(XomQuBhbaiS$_|JSt)AUuw&lOS2>zW-uUKIuPAH= zieZ(1WzvX%Z|d>thyS--sg$r|R{e2e0Ia-QZIyZhtW>8O9K9UNRNKV3vX5h;Q1mYT zeW&y@QOik~kZ86f@9h23$NDwliF~HCScgo9JK+$Y-!8t|&f$bs%*oJL7CE=(v09c) z@Xf+^Ae#Yv7HhW!>$Ykd%uCuLBY8GIW^{=>`lW)vEMTBF@>q2KpE@`9lE~`OvxreZ z&>jbe9CkIuNDX&jME!3~k>EP4w$c4a2DhNi;I3jg0$q9x`Fp@j$xviS(PO4gRp~Jo z!f0B4s?hA5)F`^UvwV&nr=jK6j>KGNRgC66F9N^h@b@pV>UWbOd}Ah+xIPW1BvToY zJMjMaNaQ=LFsRNPj5T-Vg@SV4v#p9&_}4{oIC2p?*|R| zxASp$a;aP8XPko24(gwawDK&@xwH1m>tol`U~K_N6@Vkd_a9ulcUW`WpG3~y~OrK zSoQ{%_KP!@)7vg4=1SHVU4JW+pZwY+3)p(kD%b#1?pOu`VC~0JFpMVocrx&r{r%Rw zmpy#=TDr|Mr=f=AyNHyqme!5wOI-7?H@3)97|F82_-vH}b`h_WABQXayo3}9P54it z8_{Ta`Y_)<*{Nmv%62e_usT%W=K`i+pWIh};bG8M9pq{O&OWlR9b48XBg}Rjcb0Fs zTTSyS{$b<9^dIFI!}Vu?C?L7T%gu+ehsE1D>8F0n_ZEf)!M30y76W;;Krcy*(> zb-}o#Ft#Ca6gD6|G`pQ<&{4HB%`hyJ_x#Wl&PL$ns*CKtxALqW-LER?NH*(qxRY~A zl)8a5)s0%fP~CUCA{?jMKkxhgSvb5@q#j+kM^+olh}GWM)8CY>2>hizb*cL=J>-eM z>}iZ8ARZAC#@c=$_P`x9;BL%Ks#^5djbn?^L;~FC>M=GKne`a|H)u59EFTv2_w+8L zeHHAG^M)#qOT{;RjH6Eak8}U1J+QDKr7I-{vLhhS-v2b`EasUt;rWQ-2C`o?I-6Gk z;ky|Xe2~)ob{ka0`YCKc?CVdyA+bu`+|_&|cqwAG^D7G`O(wvU*{!oo`vigh>4Rv{iuW|)2~6$4w1O>yU5mhiS~SzKiID^L=xZ2)XO_H&q9piL z6y2!s(&I#r2k*>NJWcA+GGbGR3giG@U+h!9o z_ni|7OXt(S8>8ON&@Bg#6W61+d~#AG>*FL_V)nXAF1|5`7@+v{{|8UQ;c!*f1@6U= z--O77$S8~V@#_ecw6Mp$n&I5LeMzi0WZ zTiH%2}r5NEWzivt=696hD83 z)uy^^s_8+*<3I+^h160gHbG9&wMZ>2+Hl*VjFD{epH6nLRr@YUH4*Lx<|%~k0d_yLU_@w3pl(eV z`q8A9&QR?iO8-*o1=E!MF`Z25m2PijRB7RC+DO1$wS}}?5y}w;{)Abqb#&&=FI0ko zeGKLQA^2C>udT+=xMDL1xqc(N%oo60k|CFx_)iQVN**c+^v(a7$wvb z#D6dQudk>QzRGhmGMw8E{y^aPBQrw*J4mFJ!{F~PWF-6CR6`~$v598JXKDY%f|M>f z{Czp59xc3&Q8s6DQVR*c%!VmkJS+llNw*5zxr*828+5eqrFoVU^Olhae>3_yp(B~` zd{>y#!fVKeWgxmb;fNAdljAS6o3*@EiLi1+r6pd1ZxY#|j=IKAj@pjDoM4?*InI~C zjFH56fK~tGx#yoyauz4d4hO~Y{&&d4E-j)NlmqX1r=24q`ubR5H%qZjpI^buo*5=4 zp?}U`7SQGXLZq{wnfD(Rzfr`z__$(=5iX3yzFb`-@Zfa+x-tf{f33S>m?3=Cg2fB} zoosxl6f|V$kD0z&O@D*Y{%bV?imhPwUt1bC#iY_BGqxpE@*_zySxw%B zG4%E6m+ZeM3jd1}8rkFKtM-$O+7Xg;yVy1YvR;h$PO4b?E1&P+_4kYH?z@DX_OfGj z6t4sR7o-30>HeqZ|7q6$x0oHOHRX+_oHwm8>N-ku!E~>A^Is+v4BF6avyfK@KBvnTE65HRibJ0|(NBhg_jB7ITv#Yxb<+{w z=`5}>P`oWz@9p7wlsOhL7LJ)q7=08Ayv*|xNb_9r?yec+qTJ5(J*v8nV+2*c0R{z~ zTNT(@bq*}vf$uCOVsr3u8v~!$XagA%`D3y}+$1nV*iF9S&+gasc?OsdcdH}+HcugN z`KyJ8so0&1<$8t{S+V%2B9fj;Qbc@hsTy!!LyCe?S?>Nerbo+sM1pw>fTS`w#Ll(Z z=0nTK;P-&7oyiGtVY7szxYF|$a{V{B*q?|(-8ahrzlHFnF1kr_D-Pdkq~bDPrV z&1yjQ`omQczRMVI6AC_0DyVd{H3eKo?h;oIjre>oh@ruOp&DtVWS1DUQ zS(jtl9bP9zyG0=d_?H=XM>U>Hj|OySJVc`@Pu`&R;+NA4bF?;|VQF)gbfjo~a; z<-h*|G?rXK;3&;iARI-G3_N1UX$ND~P^9vNw&}(2M1{KX1RTZB_6zL5Af_&h&kW6d zqueuRK2=x{N7zI8!-?ROj6t_k|NIsUDD@rhu7p(P$dGrYr3WIr=b^@R;Dnn@M_!Et zGtDcMLPlQC!-;(G(gSSnCS{JdjBf;#xuN8%CNI$x+hjiQM`vD~!8A{$K7TmlWR;un zqS<}#+67E;VJ5L0J-CJ1`dnEUzZLA%C;Nt}dH^GVXQF3~}mAk!_X<)C}GF^Wi4{8U=cb}zqc z#?XOkM&DJB!^CF!iK!2}5i*vxySy=$MD-0y$!jmaA2i-WMZ{UzWaPCNauBMm+k5m- z7h~dgnt#$7`SP3g+CgQbN7FT?f>8Ah{JC2tsl=~?7%0%(fhZY+S~xl69}N)<#kK~8 zA66h@%b!EfAjY&uDZK3B*JIr$u@b6!Hu+oK+m2vEJ^T8^K@k-o0bed0gP?W9Cudt8 zPJzzvWD=M=FmS?bZY+|Cq;!qh=UIYeo*0YRHNs}fsb0GeOr0ciqC*6Z@MD1pX=?G+ z+p5tsD1Dj(wT`|w%jWdFmiiZeCT1d(O-Z^Vj|QZdx^C4O)BkSy{?W$~0q^BJjm5En&Cj7XC7ES5U?r!Au$l044 zvh)hn_U%(}^bA0Mcd{cI(=Mvif;1`SIbQK`Wl;>#3z$ii19%H?wO&ks&WDAl0_wDX z0YiV81R;pegSc1Po%M(jy-Tl!ZqGx&p~xff;~Nv+C?hNBIfu0JuAez7(%P}W(~s9; zZcF~FC@A05qW2gZSM$_5D2-c)pgW}8p}t@q?bvdY^+ zl|y-9OIJ^?we4p$iJpeqdZrH$@4XOI6t1F$}gyh`&gwgz~m{p=={rYY1vzs)_{A9T+>5rL3 z>mI24V}3Op14Icax#Kt&yxX7)09K?PD@EDq>odXdd(ovVrYF-%_~e>__!**xd&8`# z4UzGfPuC?WM$_Mv2HJ7|r-buqG`H`_+BtA7tuL5e(*%#x%q5+CDc$XuK=bs`xwTs# zY=yF+N7_=z*VO9-D%UNKjXKM_R#T!wSa^NiUHs)*TXjx+T+ikQWVKL5U+O0{SSC8{ zNH4NJ;7P&SPhHF{jcbV(2?)MjVmgbeY-2~uu(-sa{u~E zXe_b6X5o5ZXBRX@9hWz|clt@dNp4o?-vUZ!V4JMAF2fl;>0J);}AS_i*QL!Jt2j zI}&Z7N*^`f4uS_f+W|)q45Mh}nid`Y(l1$hR~IiTKr~e_EEc_uR`y8wOrpLjdLaJY zr=n^Dxk8B!fWe{RY*{(?u!Ym@Tlzzwxqx*Qvf@WMmY^zhJ=XPy)xJ=aZ4o3> zXtwClU+RRj#IhhWYc&uI{2^rlQ{z#$py`j9x>EJWl2O#;UrDRBKOf8+old}<;9c?Xg{ z85jMYjRyT263=Hyt#k-<~YF0Yt^>_H1Uem^NeP- z(L0V(SC5!e9$;q9hvNK@e;r5yBn0mIgHC=0cFXrMa5xtybGpS+`~S!r4sCm(b6F9h z4IPDCn@xm2eIx@|@@}o#vUJ3)$jJ7HRLcM5mqDr$c(Q|OWr_j-@0PuT_9UBpf8{jc z_@|2?G(WlPfm2J<0y4q((81f{hUCrJ?-Mc|7uOKi?BFMlNE0;tVbqTdtxC+J=e0C(fzs~W`hw>|*D)nFbce)M#2=n=+(UD%Ud`4_etPz?IL zTV?F@h%f90#EA{{JjU!6LNBYU08DghObJGn3R<_5U$rT8aU}TA|M47@|A=A(VHb~Sm z*=UEQe~L9w!_DtFoq+cgD8K(Fz;uPJEQ<1SWT}G>FJR6YN-3Ux1KJ^v5pP=i)T<4l z6yl4hyY_K{9}8olmk|rJ&)cwS#53{GSf2A|tC2rpPI3=*KdQbHyX{)>4IyQoiKEy` z?T~HR_iElcRZ2485I?)#_yUXVuMGkCy!B%(0l(5Y2Z--`@lhP?n^`Awme<*((2|^V zVn$aI@9Ya2VZ7%bx6UO$Cz*d7k;7e2QLfQSm4BI^WDx&iKJLBr^CExFd=w|QtqsgT zvA9ja4liDh4EeH}#T&CK%D*#|+WPBBESK5KW-H`yy4X%;DzfcnJ1tUs%Mm&lemT_` za>-MF9Oe45lZVin%d@H7qk=P_{vDd_*9C_uVEO9ky1t(g3ERsEZHSeGWCn#_Ucwfe z)w>@iojH!l=PqgaiONFas9#m7zMwo}$veHC{-b}b5wU+f=Nursm7of3>>N+#rhlS$ z$F$5p$dtuzUr6st>{`RZcX*QalpwYBgn+Qc)9syNuIkIyLk$NGR=BAzN_pxW595+I z3PP5unyF9+yzb=~An6mG3=4-hQ14(>QkE+kR%mg9L#aTE6v+}neF3iT*%4Wwwmh1= zV?W`ZcEi1i`0^$hX-cQb zrMoYSBl9jwN-Mat#04{m;<*9>_vZpYNQP4u!*}YBT`>tM+7Eh5&aM;svc%Ct*dkmN z)>%)Grl14r#oy~E#&!Mgd(0a|z0)&o9{#-Eqeu`IZ#7f!ZrJS}NFu@E)H?ff%9;+z z!#I<(o^N?OY1n4aP=zS<4SUJ`Bbt28F z;tzPCz;csjhu?+MF29Dd{q2cdbr-8AuFm|58xq3HIKHXV5##{rCeg?;uM!;12e(8V z?1^A*k2c9;Wd!&2H@k>9ry(a^1*sDM2m_im4Opj&VJ(ixuSLj@xcdBcoeFTL*tqYqJEh8KSO zgX^i`Rgi=yKC1(Yl>VZ-{ibs#Q6RAs(dOPj^1wii2qpnKiGTkpeVYvUsP07vJyn%h#*lML=cH1ARtMC zL0ZEdP0Y*STvLr#$ND`2&NQRLt86@Y-kaM1)`?T+V_gDM-?m4&WyLGG1xwrNo zOi|ryJ-vGM3Qzd`p5-4&=rMBb3jbBj38cTw-as>UHF*c@93`&V&uNdjSh(a@Iawa9 zouTP;1KF>NOuEHq(2Xn4>5|gM6Ui!6sTEIBdz*+_VJ3}=HuL6EkCS$VHu25z$mVjZ z(X4o<)+yu$^D?W&?7N2eZp1pm(p|X_~*4Tx_ ziTmIgPk*l-n`Sr~ysRjru$!zqPPe46g|mAHlTPgvp>~=ZsyE}YBhqV?_-U#NCcshL z-SPBWQBT@sv*?t&IYda#&ez$=ZXZ$j6snP72cKG)kH)uXIG%13E5^m?MwM}>B&i#Q zK;8z!GS(5T*a47(#|hA|x*9M6wu?r$BAPO{XXbo=Jp8OTx(gi#uD%H1{L^t0pcBaF z_Co?#*x`!Awkf=U)55rQ%DjAl*B5zZc2&KBh_v`LGeg7gxOPss?FD|Ys~VK(v&a6} z6A59YPNkfXntmeI&(;&3qbkg5(QSA&yS<*6^_t1akkwOsHr>X+&rKuUeTo_RmXFbb zb_L}O#g-eNZtg4ehm4E!AZ3Gj<`0 z&3L`sDpsBR-)@xI<`(>C_2byBG<$0mj;Hlgv;Ki$bB21PC=aTKOWT?NIE^fvZ+loZ zIzNWMCTdqUur1SnJ6}l!7cgLq<_L4o$?(CzK)&{Yu ztLTpQ2FQ%JfQcvQSeQq%@*M|J@;ZnJdJT*wSfS&S#=fK2)eLR;a?K2B+FZW)k0Gw| z7QR#rhQJVYVa20LMVywk^DKjD;$QqnU*HSS^De_7XeOQ)=JN`PaI?i@|RC9+JnQ`v{wz{mxdN?qH$D3R_G1a z{BDOHzOmYvW$Rw`CKm4mpEIYqw^Fl(kHLM`ci#p2BEE_O{`aD=57icAHE2MD(SgVj zQl&129&Bb=)Xj-8+6&$gc;9>g6a4KR0yiBqYX;i5Sc8z=rNTO`<7`G=4Bo+g3(N70 zc$4$k)nmvAnuv;~s`9EjO+2&&oqKRFG}VgFk7V>cK6AiE^s7vS7kDi=8LR}A5m6Dd z)~w*}F&750d)z@q<`PCA%=Y=hzIpL_1EJ3ubZaPiWfN+K7Oe8e# z#_qjK7euvAXIrJSNDZ%##wE`u)B=_VXAn>Ojn{+52UMLU1rwXspDIQ@=BB^%Nzs%u zCLznrX{$p!R!A`=Sl#aj*x`rMlC__iML)BBEObBjqG@bWuLCXPgQ#n;h+*mSj-EmxJ;-^8GazpLwQ zXVrfFluWN%vC4g^YtSNh_iHws^?@T|((KuBx{T@ASnQUF)x*P?)W8DuP9^(ii?s<) zYByU9M6ZjRo%f_sc}y>^2OG;^8BcI|wEk4m`cdEdjxZ3O_fo%V0b%@xpHmMb<4s{N zYP<1mrh&`^@mg=2sL{c(e_^WWIzP-*POuq#FKZR&V0j20qPAw@FX9B;4p{R}wddHR zmz5JqXpDV>IP+g_wT{32)tvkuDbY*j!b7iPRLS?XncDuC>&~@TL&`-@=V}M71rQhT z`AOSO!lep$1CKY>G^FHGo7}@BaJfbH<0BbQ;IdA|^qV8^M`uAdXvL(l?*KV}O75LQL!#<2>=5S@4jYPLdzS-p|g9q7p zEeDjl*ctlGFBIE#k5_QPobl*Jq|;35jK}5){RDBmp>&}kN`(`Au?MT#npbAT|2Did z_rkEMzXy;k3;)!#_!M#CG0Ce`jG0+%J&VlV`Rt4AMJ*GdPMC;Kv}!s`1bs}U$7jMA zrPM>XS>BI4ZKh`qz5DIGxZ_OUS9);&+syZFEb}SnFvHf#vhy-g$Tj(5CzP7x{P~*i zv#tqDGkYGu;AL~-o5W=M%Yf{M>5*_2WSP)hs3|3%+2@qZ2s&ZrjPcoJzhJZ`!Y%E{IGiA36DE(Hb zrR@qX?mC6{X(`fZ2$jrI;t}3OGO(AaISiFykM#SH|@y_MtvCuq|9rIku?5_ws zJDTh&==&a&LGl|tb>?uWj9j(?`pdh7p2=r~?M##54PiCYMf+vFt|vBguTI1o=N0cw znROdxc{(|mY#m>N@?ZnyO&s_k)2!kGjpGc+;W{jfN`Z~zKFq*}&L%48?=hTm8EW~D zzdqaA4LPtnFhoL`XQzZx%C&aj5^*{Shc;{_QGOm`+z&`h`BQ4fFed>;6(VLE)@)A5lAIu1%Y9W2`)fYH9jGPHRbWf|7TF+*N+1@my(J--_?DYz1n}fOpQ>UQ! za^-0aPQui_;>69JzKk}_X4Ix9Wpb>xM3vgZ4x!Bz=i8ER;$K1%VYLtH+J4{vc_Gq? zB4{1UwdFiz2!yx5S*>7h2az^uq2^e+6OhcydfR(~1}#*{#x+lWMQ`J2^YNo(TqCez zRGq&7dHM{>p=Hu>VqG}(E!{3GoxJw=P^c-1G!I>v*~T)7=0=lz=Qxysd4yr!a?)VQ zU8#)&Lki60*B+y6!Jjem=8uO!M*hVTS8cG3)#6j0vBjqigMeY^Uuq$D_w-Jv-&>DHnNh*zgcFhG5kv z%sNW|{UtFrDXoWitAK>jUY-VjC-D0xPT%&k9{J|%u%sv|-@HJ|$s9ac7`cOB*4|MBj(S8nTMG!x<;*6dkp+w+n2WR&7nZ4mNBt@KEA z?q)f)F{KjUw1P>I-FaYX7;lp0LchKv)yxtZESk72`Fd;e&DL>VvE`9}sT>Kjo85X? zJnP+h*FDMKpG75Qd1LKR5{wjZ|&7inAH9t+V>aVn1Ca9`z{I%CC_^%O}u0R&&3QVM>lO? zcVO-n)mx2ZJiek<)5xkpPq)U}1|QsrPT<`mOM|mtc6BRM_01VnI&}R<_xE>y{}?u$ zY>nJvH`N47)4hjT(DL1q5qZ`Psk69UCDd1Q4jlr0WYr~ zqwp>JB)eVjiI}WXB~P)*F!zfSdt2ak(fMESfOzhM;jI~OGStRXWOB3lOfdUNbHhFv zX$aS6YiG72CfdV^)(&(KS?+S&bjFkz`&fkbS^(6ECQBX>LKc z6xl*q4(z5Y-MH}|qs`xm# z%|~wB++9*1ycT()0N0)L>JRra&!L{jTs+iRywc0~!%!(yh)3-_%P2Nd_Wj*fZW1j4 z|A8F#&%}5CTonbRC`Ex}@?>_!^mp5D|K$eg#q0z)3cilu2&QhhpqUZz_IgF81c}Q6 zVbAf`No(6r(P$2(D^yRy#m+yUiQeVtjoRyJWy8U^F5sR-bF)d@6kfez<*VEt^GKl^ z0Sih-|4$wgKtSzQ?j$h%3^_CopR(^(e3OCEf53yB$J`?k7&89z%!f!3(3SFq^N&6i zN>xhVWoAvXxKL3YCT#6h0~vM!jqd_XXOWFV_gq|X@o9pg@@Ui;?0Isu!y`N%qLx_~ z?uCpL66JL+ekc`N9ib5ovQGEjk`(A;jW8FGMo`e~+l`gEUN~imh`)Z9lk*Eb0Zx>v|@HjGgj(BIuk5}?}*M8m|MxA!a*s$6Xo%`JEOTV zOz+~b%>dYRV;$+!JSZVxyORN{z?{7ZT^P$9^EunO{VUAcelf1Pf}L_oq$E#$9`6RY;6%C{6P6|tG;<{HFWA%YIxZs(}E$uK|tEA0ZL zUVzsSxy{d;mVW(4Wz5 zK0pVsa(}K9b}wHP(8geeqwlGI)#Qu>-w-gZtsobs`LQ^#xjvbp(Qo|e%}tQ6EP|wK zzU3NHGXH_d-EHI%byoXan$VLCe;djZbSktdKX6~G^0M-@xX^hqP-sB?RVs5_Gj8gz z!var5&!PRmq|gREP1HC+zTVdjozQfjZ>({#|2lW9rcF^m@FDUP8hVTHTCM07C|T#) z?BTSHh+SPN`d1sak>iH(r4aKQoMYC5+crhDz6IuYXPmsz{=shfR_F_SV`}y7FRH#P zyrbKIWdQY!XH6SKrgGJ2{kg11!rL#FSrf<$!nW^pq9Hv2OFn42mayAlnp^N2n16a> zMXK?^Z5FE^!kmeVR~XjqYgQ29*O)&IgiHv;{xrc8`IQ+o zId>w42Zi2Upd8HHM}*GrM^7j`B3_ zQ4#Cp&uixn{7Mf21Coc^%4Mmm^Mu!mmlwwM9+UeGUiI5L-u^ zbY8yFm#uMR*z+F%SoGVCL)urxUw@%Vz=B$E6g`S)NA;i^RE)`VVJ#O@En|JU5KBKkV zqejJn2q@FV>7C-2k#XL*lvXM9>d?K3DghwD^y~Jc&_m~v`y`!~*CcD|=F2o<=d0m#ceeT{Lv2~i^LsBT#>)IKGp&*ClxgN2^cdBn;2Y7R z6`il1RZe@SR*OsI^VV!z&i&2ioz0q1V8L};I9Yf5 z?k~8q1RYAP-+SGrEJE}XQb37sti)9%{_e;YiuBM5TH-1aFC5mhZs_$%vCx=fS-b?d zP9`a1D!I(*T!P$Kyqr~0Po&}QS#gJsH_6Y{lN@AqjWRXe(K=Uz^@S66Ka6DGH&-bI zT|&ERa<9B|qunS8kC)YCKb%JC4x@ggj!`^OKx(Pf>oB^6mx8C%Bliu?X&S-S`<~{_ z>Dog!l^01pQJ*}CQmAimP>Bo!)Grj<^sU$hD`Mft#LNwm z&R{odrzbr+QhG&9G(9Yi)}4=qFYu1q;WmoR2;%v}w|*j>=esr`P{r(_!+Y(;YFq4& zAs(NAr%9JEdOz|PeK}?qG$6W3lAIiUFU8usP!VB{@v{;~4|t z%Rh!5n_m3$5rivk3adYHb+4p7^txK-(Eyid4}#0#b}G0mksb`PA6p(sUN~jdd4(-~ z&1n2+qR@Lhvnn0kBBRJRUR1Rt-{Rw*B0QN|y_vIUU$ybnz18UGJ7&ww0%WbuM!qy6 z1o2Jwn`2rfZJfsK{M)u+fo-n`P@{3f6`j5Mv}Q4YV6VswH(dV=xYSF+IOFCX87LO_F@Y2_0w4en5iGk z;Naq7TgJ|9Dj!8zdXHryY(tSiLs0Cw58se8^x_*OxEfZow{!c>a5p$s1v~QgoaC9A zzp>t(AYadOqBL3RM0^LA?ve2)_*>-%(%F6`jphy@)yoxmuWwb){McML-{hJ0hsQix zKb2~su}-#hlQGYfIO(e&hf>;komC36>(2!)_x*QAKXLv5G}=l{DAP+Ab&CJ%G#f1T zQ`MHH{&&;<%bM}Ox7Vh`mMTdI?iP+~38l7wMg-sWmOo2I{^=1PU)X>CX7>l<(>R~= zYqVt!#oK((XTvtE=Q|CZfDL6Q&kYy-pe2$5W2Xb`Lh%3pl=x^~41{ zV`R|$!f4#*Gj$a^28b)o0s5%tmUj$>_7GevkVWH%$L0^SH# z_#$t5A~>73Dz}L8doi$>z7f*Pln-^!%c3m6LysCgdZyr*R8E!gIWE-~58 zVoR!{(21M2Ec2n!mAl12_S2Il3T8LnGVsy8*bKtB>3G4!7bZKC_P~~0&h~Z^cC8Yg zz2UWD*G~Ttu}eo@BRkmUy1B*RLo>Q>@e+fjze6gx@aqw%Z&!5*ZI+m7a3*ykoIh>} zgO(C0h8e3cj-lDh^gI`^<`aR_2J{BSgmd^AJUr9bb5Yy9%|bUFtt#iwG+~Tde|NSs z+)H+L-utkEX4~R=T~2z!`u2BBh3W$W>-g63aBU4vJZ`NwErscx%gwEWyTPxwys4_! z07tS`M@3uq!L1zGVt)0@N6cj_mB+hz$F;;-eP*F|7M|uq>>PvEcfhyFA%hB-T@71r z^ZUp84;i_nT0EqC3vY;X%d_mvS%@u%79t4KNCBNY3#ZIw*d|)7twc6VK)x6D**{O=Y#(`2L=s3?fi2xiJHFqIQg|jcGcHHS%c=!1o}GF9u_okq2puv zU*Di~T}PNzlj@E^NFp~MSD5;N&P$0*R=u*nC#FUD*MF7uwOnwX?cnFPteoI)P7PQ1 ztF^=bMV3}=9K*lP&C!Ba|0-*>pz~jw*lX=d*? zga5C+@||RRmi}4|5P+i&8IkfzA2t5@MV=S_{Rsp@-$_1KbfEMNPJAi(v!A-`3`fjas=icXGAxW55@InB1C{bKs#p=#lE zWT28rG*rf%|9M~CW#bWs-K|Tu-ZC*>zsan=(I&}Na;p69D{zR^Zb5qOh~hv2&smOI z@`Hon$(;M}1;J9+P9?p7(b056tJJd@Q#0OPrEc1?5Hz&^v@9ytS zt~u05cYB5S|1M+i&+gAeJh&yzHuimW{~Fip6r?4H+UqJW#?<6nO}|41l5)+?{Cvx$ zq~I^U=chc`L{j8&&GPh?pU#p^=j+K<6ARGEBg*zlzFBY@-G;}CVC%x`e5-8MjSFmb zPuPN%)6tiD7LNCb%1+V>^rRXu-i5s$3bg0tw)-wUtU?n~y6XcW3(hs@vUf`-O)P(h zyTur%baI~lkS*7)u4tqjX_Z~vy|JRLCUuryy{?9CjwjKgn3l{pbXYULsPFZ=F3DOL+Z0WH zDmK-J|82orD|V-2hft(@@6*WrwJTyd!HSQZ<=n>SQ4MdU?gaSVq^Ke8 z9K|79c%SzH8LHOllB`Z~fRnZpJPfnk-HN~Ya;8J3`=;Sd?-F4a&p0BnB?jv8Kcga8Z;>1%%;^_&<}55*r+JZwV2+S(#K+^TfVhOQ%cxm?`Sz$;Lt)&PCKjUa?SsH5gnZep<@N z_B^fZVtZ)=!hyv)wbJ795v=7LeY5_7}&%9cVtQBQ`|odm0F{rn3@ z(~Si~DTmoFuME43>y%CJ^q@+@$yE#cY+3IH-X*11fVX58ygZ!fatLPQU)=SiE>IU1 zFduio!|X()$0vG!04{r~6KZ7>7bO(f3w}O9Hv>4T-iv&k%xy`Sg5=rj_3!4Rj?L2g zsg-Y(S~epJtS}K}u8ke)RN_{!!k;bR8Y}vXd0v=u(Qzp15=Tv9HZV~ALjTnZHwECpc34Z#HxpT9V{ zAgl=)$j5hn?EkjMZItbfqb`aMU-oHQu{4haj|AEj@iUOE)6ABt88bX}^s~`NndUeh zPE09j;t;4vSn*pwi(jJwk(@v&?$jHUX8lR;kk!ODW>a{#6hlD!*1Z|U0CTA<`15LR z&OooWqlRtsw_oWMFs2Gs3nu!~nS1+fHVze|-hu}-Ftz0?J#qq$b*t?uJ6WTJ$Gf3A zKJi=K85NPbMyL$1IiwO4GR2CNMXuI*Myl(3o|z*PX6{z)lLCX6a6FxM+l#;9Zev4} zE_*B^)UUo8xb(?Qd>|@?i%nY{fY2#D71Jpw9^}@cfw@6qIQrapXEUZHl&HFqp{m4aU0a<^cNeCE9J;Uz=QO~Wd zf)DDFtwezzR_H+SYH&PieRGkc! z)n!2lc4&lOEl`(6C1MazF$@AY5h{;Fs7Z-LVKQq`55A;4d?GB#Jmk=_7q45&6|OG* zsXfpj>*kK(&YpuWul%{MPd+u}`w8+?$WSi~&!Q)ebt@?*8Fk-sRR#0IklEm|NYX&! zSvf6H@PKY5_^gD2c%uzCG}x-r)?Hb(O80V`1k0zrBXvuCAaAoWypp4+9mx!Tm}~^x z_F=Z9i|yNvd3np2R&m_?PGE40@uY6O+jSOU3#=01M|Q4(#Q>Ux{Z~3VnydCO5ki2) zJBHt%fM|Wq24wsrj=q_^JUvQuv5LjoemC1-cDgcn7i`#u>Jrj~sC@mKa%CZ3{=ygp zn&A-+inaVs+CC5)vPuTL4nR@Tj0jbGHnHJNn9{o?pj?XqU#X${R>H1fH$!)HYtDWC zOoffv7M!Io@k{ck;^H%_&JI{e<T!-Mb6&nw~6vl!oaO(X0bfq~E&1 zB!{~BRBu2|q55Qhy(Glo+cU0OA+t;gK7Rp%z zp<+YTJ}i3u_Lvh}#$Jk@M#G97Mc=&ng_ceii1P-#9(5Q{eWNR5n>wcg;^iA zS-#B65yJ7ljiH0{C0%SuuafZxQP2rkBy^mqwGgq~dGS_VuAKwArC3iFeY3epJ%IEP z9S;OyRp%tued0%pm7(K3r=6){rX&4{){u=vlR&DSb51KtFj$}1Li2S1$CDjCt+ez1 zZwdME$v9ByGL}3JQC+J3z7P0IJlp?8{CRcA_e&q0&YHNa^ux+kSS3GHGJyg}fa?gk=_Gm3$1d*ta1pO& z?sX8g@cb=DRWe!>w0dCug$g5i(ULOz4|FiEjkqAF z(;ht)hCs+=m5H{r^8s2M`_Z1wuS2eM`QfObV4W2G(PrO6wQejO=a_fmr)59kDnE{U zmXAs2dFOKV&EM%GpFd`3(YMw){*yzDF|f)VI;xg6Jik?l@p}W7(sxzo)97zt9UqbS&C@Zl~q4bzQoTGXo{tGAc3^994$gAWtYN3}=W(H$faWw6tk`N)$C z`$GnHOJx(b=Fc$2)-37#&-|b1Fa#R#OoO7%P}-v`%$wuX5vFHVC0&dZV>7YZoYUyX zKjqnR=x$K-9)JV3g7W|LKnH}kKm(ogYOHAP^KS@U^A4=&z2gov%_t&_ux-`d#mJyQ zvq9T7CHeltJn+w40J?{ZrSApv%YTbl6L?fggEDtiRe>CGURkdgyTw6;Q(>N_Tz7^7dG&DFA9}OiMkVq~>D5M+3 z*-36YzkT;!^gkNBbo_tjr7~tH4imVV9_)5@i~ieo3FmB`F=$<2{Ho3l*^PZ#I;_hJ z|1EgMA}(r;y!5Hs%My|UIZYm|#utaDFcBhDX`@4V3tgjJr!iQznA!uJg)*xIa_6bA z*}8iA1*_&ft}J|pJH{R3=@VZCTCH;5H`v?4Mj{r0{dlZtw09u1`cf7`Xn`vK?S>%; zj2yU@Q+-!3R5b@4t(3;d`6po3V{}r)!_1IWJhS#)bWBr)cXZVWibwREIAAkFC-Vx2 z2Uc>C(4)3&a%1txut%)uzh`a2HBEhsx!3iEDXC#*G^?RsqKAWT|JjF~!26Pq^(}0J zh>+P_2_x@L({mSG%}yTdW4YeQi62_QYsp=wjtTz3hYS_1OQ;LA^X((msoOj<=c#W7 zUy~V0(ENyR4WTyalvVxp{*IG%TTv@mu>(0*W|yZbBqlypK#9as=>YRA>kYb1_SkTw z8s0o>6kP|3f_bMY%fDG6co+ESYI@AY%MBtg2tD(#O_)1=;gV82myp~7^k!=44}t88 z5fk9vaZu+^&>4>dC4dZYX$L0#*9UK*UiFlylzdwjcDmkGqh%;S zJ9x{WCp}cIHV^`5q-+KTyMZIgwSV%;4F3vNwXVEo%llRCa3J*ur-0vX)nC=ToL#@#DTuGa2|1S9N?)mqi_+L&1$5L1FuIfWdzOjtq zUve%pnR9+=IoC%$uN&P-dAT$F7kh}(fj9B4C# zgXS$yXT0>k?+a=v@?i|U4sCNt&v!Vx15kR%fU6wgY)RVhcpUS7&%LZN+-QIIDlC7I zRE5Nh4#M6-{;2r0FDx$(kB7PS-1AFA^oJpJ=<&}$@mAQiVxqQ_Rz%DXwtFlJXqh}W zi>1?@9wGKf^sECVjK-O&kAC;86_fdZgVWIo2to`COSLZmJ!t|vy)`@nx8G|+?v6ja zu7w?XbNSt{FZVdYC{iih?z;)tylBv7`BMO5j6gB$wt1>c5fT8cd=KRMz@qC2(}*fp zmFCCQYQ+wRd&AHvMS+=JJm{x9!ii)}-(EzTtL3XcOsiu>MYukB)6C26kzq2_;qpbc zeY{PYhi!m;W7MF5nerVw^@k1e_4)BDDhd%0 z?8;_$`tbuCW+9q_G-!xB;Xp8D<<|*r{=*)8DfqR_ZJ8*~&>wt7VW0n&l8lBhS)f_! z6)vq?w7KPa)w}Ii#{Rcgld)b);3V*Vb&r(qf!xS`ByTv>=PUoud+C zNp7&od1u{efAq|3@Aoh-mdBstHamO71?@-9-`;Arre{^Psy20~JGwYDg&c~`OutY( z#LP!(G*U4=P>5kBSutLve}40v-gS%5Joi#m+RuGBa~9xm%6bTC9apU0a=1U5r-3hg ze0yG1u^T}WxkO7_2|5Z13AI1@aGrma&qCu;VstW^nw137<(K|3I&Pj96XIs~fBgBM z?Mi-s;kDfsr`a6a6j|gyKM+AYc5V0Co zmlsp~yE+BK-o!;#^w9d?4ZhT%Q>0;^JtLg~W2-Sq)DIGvT@+1{dRc6z{Jr>NG?a^M zoH&b9fQ-KWLpg&5(yK_dHd|U}MLb^-lah0m-20Njj1f&iCOLbo)PU{V+cGi* zs>fEL$s_N+WxaS1!VEHl+i5aRfjKYUtJ}~>jospUkY>yCDf|`=Qs|P=zl~y*sIGmz z)cDw7A?%a>pC?D*k(=mBkgi(Q2VlD;gtV3q8M`4I)ILu&r$?Hu0liZs_6?zc#Xvu zkr(>StRwK7e0>yA4hcrA;i;4c+^{4%{mw%gGmSwR;zy+n;5?^^oVeeVw*{iFyZIF# zKT|v7+QaRxG}LTP&HzOOP?oz%Dt1MEvTf*TzdW|!w0d#q!Hwg{!%H!F<4Q>P({O7;h4W0#r?+u zN(SB9+}Bx8PW<&odIuoFDF%B=C1LUt8&1Ds&%teEjdiDK$WNkmVD z=nQ(jNp}=cWQDl^;9T(ELD3|%C?E=)G9V%mPcDTAN^!>Cqq^F|DCd#7ZPNWptm~`? zGXXk-!(lyVh$BcJ+^H~nBiLAL8Qws3=p$e%oU(h2C(P+=JZpbO4lfcuQ74@+oe2vrnE}^+;o@sf^ZchkOn{9g!r^-57&Uhv;l{{P%#y|@VUW&mZ!RI zoQ}cB&Al@PfdwuZTKe!9!LK2V7rvKhP2KYUCewU9fkuY;ZbaO0Ew4(@fzu0t>J8iX>^@n4l5H_7T1-d4tUzG7ycUfk}vp| z9}Wm&elK}zQI_g{(=Gq1e~QnU&S?Ye?x@VH`5WoJJ!r{+N(1j-`2b(M@4i$J#cRIs zR{9peC-{RWPvy^=TnVyWHj8}nW>vvFwUKq>vrnX3Cb0tJ%vCopkG>K+4E zC{vi|!q(1eI`Rl@8KW|DuI6juA zNXw)*&N1ouBlp)o__xqDu`@4yaOK_>8t{I#ev$PV3SxdQRVnS2ie9fxoz+Y3WC0Ezl&*rswIh8B@%344hXbo?LBBe4y zg;rFzZR<68Z(QatE=%MErN~2M>_!n(_Zg`zp1*hbp|9-UwsUl$B2w!;IZe1`H)Q>P zxZtsGt;GFovi^B5B&!l!1n3c30i7o4`q8bh6^}nPm#qh1@>6jB!&wmHL+yEqX5;o> zN}~l1%0A4tR1zA_+MRsBaXc77uY+Sf>6hTBIEEDnN+1&6Y$- zMrk2s^SV5xPoLC0{Re)VytD+8g58{jOWtVcR|w!!DbYJ)?;c(+CY`=<^X*QcX51wv zNe)92q5z7{{9RB2a;-+_s2*A!#Y>12l&>yn;lHC{zRYO+)%FuLS)EPr9@opkNnFS148AuBccf_PyMdKp0==d$v3M4nxy0pZ%VB%!Ev^0zimEpqF~4 z-w=9w5Qtk#IJ6JYql`fxTjV^kd*1i7RpN-yT6b@NQz&16#U3R{M5;i78M&<@jWV9Gf*^{ z_AB<(=KKeur&agVH(kAX zaVML$XH)`M4mpI#v}aAYTwwZtn9z2j2=lbHBf) zX?aF&MD_0UpM(+^L_mSLEsbc`>)&@R zJ-*FyH-tk;7Rs z!6~>s&tngqh*wZ48N&l6$gy{D(tNIAPz={L7$=1ea-=gKoK# zC+AO57JtO`=?0G7ywVrNg$CL&h$wbwarm8;lk~Uc6n8l=t=Tdxjvp4Hm9vnxp!yI( z6x;5lYkCJ+M4W|W_U7hgj2hQc|n#y>wiZ@LH4SuG z;X#k%5utOKGyKH%z4DsjZP8W)4pNoB|MA&HvN+$tw8Fw6f8!oB>7c>a?T1C|?zKue z-zmy)0PyU8A_aei3!tA)S+;M^{RB%7z1g{jJ21p=f^&G#j#U~fMJxh8q&H=A+)3>C zY6(Ed(QM?{LD6*C`q4GCP7eZ4x4{g9aaiP53T7}SPBEuBxx9{gyzPm)`)Sa+!tVB4 zexoifIqI}9_$S3{Q!e6e4IIU)g(!B;G2GlC_HZm|6Fv-1)(SaNixdYJO;_IKE0~Fp z+CMkF9I}@E)Vt3D?bai8B$0Ue+--!*0Kf?x=GJdi%|F=0uN8^wmSa71V^E1#ifuC>~_worh`qeb%4AM%sVblTZ zA6^o3o^JM@4&EF(9%*Mr{n5bo(jof|DG?!B+Pf6$VMZ+RO+x<=mAI!SD{b1b1Lsl; z=WNS`c;VcigqKA@sAO3(dT}AQk3%%>%HsL|Cq!6-ZmiSpfK_y|(mN;LXnp_Ge?03% z_h~AlYV@;U^}FhVHoZ8AFv%d2ii53KO+{+leT@hadG zr{5d1cvnqjYcijLKKk3tEENrm^u|W!`vH~fou?47C|xYo>gc=w_rbpjvkGIt_+~}N zq$jRcg7VG9?u5?FiyIRRG#fzy!EVTh)?gNz5X!XI`Q1w2-{u0UCw0;&Qk#iQq;h8- z>DCj*g7c|sd|>Z?Fy#AV4BJI7^KSE#an&&=X>Vr>q9D^1K!9^(?t_COyG1%~qdqp} zGv~=F;*GrrC!MEd?dyrft5V9xLy8i;M)UXM*9~aj%>6!ohDS8GiL=XNXl}g|WCKVS zAIMTvF`Cu1+Kd0>h@ycN9Bmb;rPHm(ylUpAJso90JEF!BTW;l3K2)Kru;Jgt*z2OJ zAI{P+<>PS2&m4V+c&ize$`9jEMsKc?1D>s(35KjtlDAe7=x(gTFC5j=p#@QClCaD| z#hql3HYIUJeR=uUA6sSu>{DBqy>Ut=CJ%+va+Xb^nu1FqgOkZ@?;jIL1Pv6MXTlV^ zME|Tf*yqOtIfK^T`(H$gtjaOZmcnuH>kd7S_8Qblo+8XM&oY(lu6BJ_{K3)7Rzj}! zx`pErRfh9_u+B8*!INOfE%nLDa>4chR@8z2;_P(x0S@j7Z|-oVzFhvT3}5j%omZV) z)HQ7U`8C*$2VAklR1$H8xwy2BmpjZyG_)VleMDXoZo&5;%&jx(*^X|5`2=dNogTR- zpJk0a_%Jk|gZe7vS%`=?XB9B7b&Z`RZPX;K-`Wh<)mATjgRtp6;m%}k>&t-@QcHYz z^ksuXa;7)ehZ_-BJ|F%HAkE@Chn-XEsICiw{Tgn(G569GUz_1k7Jpy-Of8X+n1Q-? z;ps}xCp@diFX67waDSbKcxik9*}iToZb8PT5b@PAQTgj_-v|e3g14;s^KZ%HTaD3M z=qFUu;>YXyicDF;uYN$(Xo#B1-a6gtdwJoQ5bj9w@&kvDhGf5?rWACMABX$}!?1Wg zrM~?|_dhx>YJO|}10M0;q3ntNw|RjYzpz{wrbxM5ibD4yc?S_(W=&tuout^Jot}h? zH*AVD6dsW!7bU&aS+Od7@JaFFmsbw>B|_7yJRP-!=xbK7zA52AD`c;VRqb`CTVlbP zd$$7)k*G#h`#I&9i5~X}MuX=3 z?h|f&BlfdqpC8j$ zvjIZ#HG7-*&CF*#3v_EN+qXuwnW|-!<7RF?GT~W6xfsxu7{d%556CmlR+LXgZYNoo z|8TAY4_F>{sI;%X@th#C5eOq3)OyU5LVB#pQl?E-&cI(rK28pp$A`v#j-p zF{-D|zra0c&XiUf3@^&|^D*_VR|r*)Z*h&OEs8hujaftj^kqGCR9WFyusFRslXpTT{60RmI}5;5K5XksxYyVkS{707+8uf#QjJG@ z?y+@c9U+V@e@%Ho(L(bZ`K-61m~C@PokDaCpgindSg z|55FQ&JVW5{ZW^faB7h64+n9TmU>_wjDLtqiDb{ex3&X)qLJRf?*j7**Bi$n?vj5| zhrF#i|KjQp1vgyzpD;FvJD{lO+>zChv(C(H{9!Pesalf!6Q^(SS*TCy z3SXIGCf%lw0p+Bq>g3ts@wH876)`xJH*Zt7dTV*JW=-m-A#{Gy5~JoE3NOo9g8)R^rlA-Rc{9|6tWX)Fxl4BSNVC?t+My-STI!;(+ql_NUTr zoKcUqZauIbGYO`8F;-5_l+`~Fw;L~YPWkw}q2Pz7T5MFiX4!4f0ed6`QJP{*7wN|8 zp62Rv`?gBlACe3mJS>$4aP<|cNNqwt^WK1zeI2L2}pLe+;!t7yXvkb`?x|QKLjon?U;_=qET~vy8i7C#ly%M!WkOZ3Gb&u(M~ zh6}Gu`tqK;$n|dy&R;CN|4cRcH*@Kql*0c5=s^;-niFE2{7ewvZ!jca2jZ2{<*Cg7 zS9aw6XWk62(g&&IRGzCc+|ri&o3ikqI6q{ae<2!ZlG}#v1@LXF^XnI{x+M3}m;6N} z`r;CG@Zrh;-A2V`H{kd zKeDO}wDV218v3&k!+p4C+D`kb(6uy(O_XIt3`vtX=p^$U@;)*R6zAQbJB{>EqgZE#XAclVyHb{%jd!HDO^cg(cBuvjs2~`k_ zb>jlb2?aLOl;1arc2~GCmGzAZ)$qCm=y;GzN8?gKRTd>wSZ1sw@WM-fmzc9omdK0Z z34APbcK~R)n=;9Ed2?fpJU~9xF%@+dUS8AGd?gZd?L1asZhJNe=6UpCT&UDh_R@hX z*=$yci{YED>B+`OLi~K?D#Q}sgR8u#J%9+~DU+t#JjmW+GWoVPn^OvAC`n3jZPW?z zTeAQXNRdFen5#<yyf|3zFEInGi!b`v*!H=R&q}E-e>Q7pMAIMx&b^7|04j0 z^fzcpr+vTM->_Mw_{r<2J0nE7{{(AU)`5FR|Aj>1KQ9Uacz?Z8JO2qy8TF{gi%T7U z;rs_UrT^jowuM#9DMK#lyFbV=0PM1Y8k7F*pDnKZFL1@C*ec@ht@5`a1h4#;R<(D9 z@m}9I2-N-wdJ)Ez-QD|ptE28vp+kd;(Dm7NN3kA$Q1`^}zn>zp>e3&eN}Nf{gYBO} z{=cO{sGe9PZ0$e#SR`;5Z*<2Zmp@-S{%y{cSArrRi!QR7SfMpSMw^u4z^8TTl)-E8 zEl4Mu=79IYoBEw6$-L_x(*^el?cte6Dj@MztaD&Q%MK z_i|UaGZrd*YIr>2-UiyW7eaaqX^$>d8;@Wai29vT#z$Hdl^Vq&P*#7}RIei;G~I1> zax~NmF=+qgOfQQ?w2FnoVA>0PmSuxM#r_IBztvh;+2~M+yi4RyolN7_dIr$sMJ``c zF7&E#x$uU3#NSUn`_<;zc1B^hTaUkt#1}wnh1DUp&8WP>Gk=e@fwo%6;G6KP!!Bt~*HA}M-Mln*=ZXa#(vO68@=&TK z6=RZnf8!A&08oG@LFi1o-o|f8Do=nGhPtt*r(cZX7W;}(F)tthUF%)OFp&4v9>9=< z9DRF%ThI7GAF%e2PX*=87@=Im{eKYY(Em2X%IS{>s~u>>Oe2n>jozJ#Q@{@J#TY}0 zvO;ivNW35GWAmbvy*c%b9E&$gmtPV}RGn*IQO~6&bM(#Vuv|br#kPj!jg;L=G82%1 zOIQbto~;%b+o=WtdGarQ8-BXeJi7k6yYNJ*;e^2laIX@FvQ93)jvU4Nt7cY{DN^^0 zfzhyHxoQZqsjJ^CkS0DuvrdgTzK|%Zq3!-*epTMqk;Ps zXp5N{oX7S`eVkwqt*F`agyFdpOiSoa&1QZ_2Q#+3?5vGPlJ-n=+IvZ0vcv6;L-NK? zw7FmG0i;jQ)oC-o?qm0zaexot-su5Xkpsqc!rZcAo^Z2DXSbFHzcb%Bqp`g~BKB1A zH`te_E%qi*L?Co?BBVU>E;pKDJW@JkdDa8(rA|sU9Scc*i31e)lMaBNfW+f4j7~gm z8%qccmfhv~WEnlAMCDsOS-GhA{95EOv{y7PLX8Da} z9^gPYhu(fXvgl8%Z~=0$00XiE!Xw;(41cPJu!P%0pQXd8Em0Vy6WdNCqPT@aW2kW& zcVVFb7D?-u#<=h{gzYrO)SW1UKktIyBe9*yd^aUzAZPw#8Gdi<$9`Oi!3Yo^R^oj7 zDt_1)$ka~Q%BYe~yGj0;Q-zf`FIE0#;g72T1fTOAknm4sNhd@X2{n@hvN12ElfLDq zSJB7Z9Etc_>h)k7Je`*35^Tb!H#v4SK-R*CE-g1BjCMio7p-ISE1R>Y;ZIU<_M6E& zP}iBh9^8a_Voi_Gab7}M3bk}6xaJ$D?%$CG%-aHxt^KCwBpw(eqKesS%PN0*k4C+- zF&b3Hj(HQ2QDeD#-d*C@cj||G_fKsRivV1XJ{4O*{%dcm=XRzpz2f~KgYD`_9amcS z%a$+9)K2CMv-VTYqU=0&i%V-TftJd@t3qj4T_uT*o4}TfKb;?Itt>?V_*w?n8IX-3 z-ebGIRA*Jx@@X7v5*q^Nm*LfEUh_~yvC+a4UGhHs+XE*_!qY{0di%+$9iY&L3!Jfj z_b$+!rQd#nT%OehCJ9v|A(6*a9bYbOeK(Lub$^bv}cdyvHr|<-RhHW@a$a} zK!}#?mWFtsIpu0*S{^E!3*Lq62me82{5&=o!E*+d$aQ8(q!(}{-0#4J7pL_tqY|Uc z8KN%`4RL|FTCY|xT^Aw-Sy|n03nu4#Nf~WI23*rLWBFTHE!_Sk(JiV+|F@;{|4#xI z+>QtQtxkJg%5Dew-z0)h*j@!1q}{yxzn1g+p9e>I>wnxo?w8WYeVvzQXr$LY|1+OG6qvg|Z)V-@bLeWi|1e~Z(YXkUd4OWE}iu6HF zrv$?!^#1)*R(%z@#o^F#mye6YLUYXeR>`W~WbRA2BBB8_eGWk&ta4QEtqV1GKdK z<#dr;M|mb+45e;9vt}&U%4ncYD(QUMD>sM>D<(RdV_-US*J$igK4&J|9>CkP1#7oU}59e{oNGvk~1>ioo-p%9>yeC%FGNCkurQ?x! zz>WD1lEOBk)c8|`whii(aBkKqV-un;HjVSx?X5;f=ICjeRK~q2kr9QxG0pE6N8g!r ztS$V=p;nG`Xw%yPFssKV1CJ7ZAwOj7Ccexv!5;#FEqANDgKOoM^CuZ{xH-!AQfuRe zo7^**H2BYFsu0%{kL|LGX}+$<>!F*Dl$+AYUTFXr&beag9=P%q;+Sm2)MyaG$clG6 zr~|Pg2U7A18>G&e!W@Utv~EwmuNCJDMq>JYKYp%|I&^h5H_xRZ=GnO&cD=*k;r0c8 zRPk}J-T+;(!VYnMHvN|XkDD+allt1v5l&9&#VHt`ar?_cTfWE=NZl_@!#Pg{7H3&Q zyH3s~GcJ2flfYXbtg7z87@!t1Qg7Oe>P|=GO*}yxYbF zQHMOM^dSEqR8{!5cW%zezMistr`14tu}-sc7qNVR<{y=0B`Td`DqzWP2B2T!r}1|# z(}esh7h#^af#mi_sbi~BX&=GoCeemT(JQchf7VHkNcU6SsylpB3${Bboj5Zd{;LXw z*sX_j!se8o!MVM36a(F_-v(($FO#PRR|tl^wOhBS(tT~HKM*QCB<1l|l9e75i)=CqxeZ#{0DxI)%iMzBZ_g~uMofkEzgvceWL=caTI ziN^nL0Cjq?`@pnhbMp`En6fV=7}KciB#w9|n-w7pOVWoQ0Z6WpSEUedFjZQ;832*_ zSOip{_$4Dc?Ftay0S54tLqIT8h5xR~=rh${>0XZjn8#H|(|j`!`e}aQs8fi*tWT`G z{%M$wp}C!oReAW-3R_}cxP{1JEqDgZgJ`6x2f~6?yM+qpfqiw`Q2sLkA!@Q#_|L?m z2%Cr8yDsCFzHF0P4ff_=Q_7pu@Fc%GPXyeZi9)w<{XYUF%$?7XUb|jG_klOGwfx$0 z>iW%X^yKr(t%{Diqs|YfHI9&?F(r%KU4S*zzUy&als>R)k@L9zK*xkf81mhQP-|Uz znjMchL)Y!&3JIYmz%d-NBSX_Ab$(&a-Xfa^RQfwlo}u$^&E!QQ?ZD33)5I@UguVwl znkM6kg!W;vGYjL2E2v+|!AOx6h}|SdND^)={kUl zf~jzfN}+%n1)x>vIzuO?v1stR@il=U73u7@pAp=^Yw0gw68$p?_Pk))r@zP6Z?Fnp zES6ic<^|vms6;X(8Ku_hLb>-Bc8VuKPMAaXOxpV!|I%)Ll}Pzm9CQ&x+W`7FXE!F5sBc{EatgKG9c`b6jVzT<0fwj$G1<0hl0UW+VEr`De-83JheFLDv>r*u>2*+KSh6}?DG3#* z6RZv=eSVWT01#(&>(Y_1y=y(Bk_2ZeGmgf^MR@wc&;3h+(?CI%u5uj@4+r~tY};*d zDxF#RL#~x7@2{*cAFS(Ld6tk_!}356C`ke>%s{^ZXP%wzx2ew17oxas4(i#P4W-*C zdAeO7zj+^;Z{{-oU>rPYbI)e}@eLDn3@dAPxaRdZRX4C5hmgmQJ!<{z5lyHTf1TTo zgRu?N23diEc%ug&2d-=Ow_WLkeZN4tI^cS?RzcfR#Z7L}E}SNe@ZYfSe~A}B;`j6o zvk!qU<_wzUcz}dl_i?$`8O{7QShJrZMQl0ZkBU_Q!39$VxxM(QyGzIA2oea;40qFy z{M_drzBc8b z5HqM?=@>%y?Gd$b@m*TaL971d&&5wq zb@1z5b2*Y++2(^Y5aa@)0^OoGRlQq;IMJQ)Hs=z$eMR9!JV+M#`hj+P^7Cw-JR)M+ zy{x;%7&y^1mzWvq)%`Cim*j zAt!|d@59o~c4IH4xn8H0ko|E_S?U_>`kS|}8lJGXkfaZSvu`kjgt7--vr09}(Dc6l z`t`N@zLz3C`^MaHXJ>#fokQd6OkGZPX0PhY9$Y(VPBi_PGE+4(HFI84v70jJBR@^= zF}U{h5T@mhKOHCLnyd)&fQJchZW?lm`&A#vaeXr;0enr?o0Mm9?CNlEQYpfl0odVz zF7oiMs}*p_Oa@S17c%c7d7FTQa$=o4kt&88(?aOhYjdD>3&4(wes!#ZUBOwquXEHDX{vG-;xu z(Ah^Lc~k}HC9PxDGW+n}{@4Yiuz8>&wau>+>ZH@Wg!f2J{Ee&yCa4l9!^0FD-Swg7 zVIc2iF0#M_1i=Z8opn;^9les!^rvU6$~a6aL1f#5ZXb-$$t6n9jXI`X^9ggja`IAs4fBD0dxR$17w|i$kei6A4eA1* z%CG^;LzlhPe0;LVN#6WG8~s@Hn8$Xp<&V09c%=EN?&ocNy5SedqgI8+XQ$fue{ul; zd~lfv^-o*HY+tRo4*B(K->7x*(4350w*j?IQO3RE25cz+aR|Q*y-TXTzg5+F$@EL1laaObT4To8zJ z^DwU-os)Rp$G1K+N)y!<#(Quuwy46h?{>a`9djQLDbvp1@jOmwK9j?OX(Yu)CJ`e^ z{N5O$nhZEd-M}1j5bHx%81{Otw^svA&ndZ?5sV+9=d{TVujW`Jt%=HuyB)J%5scX1 z*GmB{pQ)xGmUl^qKcCZZNw~VyADmKL`~-tto|4B9NN#*=K%HA+d}Sxs`~}7RItx>U zgdgxWYDyJn&sOXrbO!YGgkGyt^14e3uU=zKt%GFylUSGW6m z%Oiv5Vh3GN;=Dq>JKk22j;D3=wYK^{sY=5-0(ath=D*zteSK&3+E)CN`cuPu=gCt* z@qt3)+vTD0K(v*Rq*>~m0pO%fyq9bSN(ifq|w4LtFHL)fN60#24=^nk4X@sexi z&acmjH3vfZPh@@xl61qtS`7`5YVNKFiRWTiLpW#9dvq|>ycFi1ac1pY_`8TZ{=-9A zr{~vCdX#v4pI}>}=ZnU$Tp|tOvM3z(K`W81!JvV`o`pDmLg{L<*;o?45H}t$nCVpu z%wjJQJkVke4i9jtyI=DZJaP$`qgoMc(cK{$&*xb(K>Z^UfL7d!q)6j3B8HX`YHh=Em!$s|91%pg5%czC6 z&;txdA9TYY_oV%)G7dMEYj-?f6WRv!7qx2ZhO4jcGnf*|G)Wf|?7CKitqM5N{89V7 z2N6m0ZS*Qf0V?n8S!xu`U6bxMs4AVjtuDcms83^dmljFpE-UV;6|E146qYjgHE-&~ z;?nJ#8Ba`waj~c;tM^-I1in6F53WvH{#4h3AM06cBK-xbdblV}SHyLQz}A5q3o4Lb zu-&mYoBU}%IDU*9G^4DcnJHl^oV@n^Fav{J}9WIJ)PwVW7e{B7=C~@K=?h;Q- zn5Tr78;)89UY7i|Ht*4Zq7=&)v7L1A-hGk!(FE0fX}w;Dr(S@r^xriCs7tWm529Hw z;$|xe-?;qMp*$4Om{g=olK&DA=6?zZa8f#OFirGwkY)-MUXDn9WjMV2m}n>~`$kn% zxYcSD(GbnprH)UMaapU&w$tu6bQV4a!Us4Zm84GX$e|*H+A1`@dpTvWdqii^%?`%)XItNppWWvyU{T=lCbxTCxdRol(4Z8SJBxux&+_`aT z1UWk%(_zc6V=dQ=XyOa7s8Jm33gf{-M8q$7jLk$g4*S!!5UIr8$SW*&&@?Vn%X?WG zw8~ChQiF=PrOG;Y(0e_4=H92|R=JhNYlhT!R`yY`6>0Z?5}BKuX9klHfs^m-eMmlB z%xaj+_l>tRp3yrKfy`_=?l2v z0YGv`1?fa(Bxf7b8&W)L+(I+SMt6VPT$@4~h>6H!h%H*`LW&|16<{X&~A6T8U2gDk-IU-;Ec?{L{VtGMz~G z87->KU=^Gb1zGM`ggdp3=~~7q-pC5!h$SA8I{*HBU{+gDp!#6=%`J;FEyhmmVhh+# zH|KI2@^;9Ey`T6b&h1;&GET_y(TIYCbIe5p?59Xv_K9;Fb^4L`!V>tqxZFi&${UDb z$Z?oRIaRn7L)5GcFvbCyoD{z)D!Fs6?IJkHg(7l`A!^0$(b+u*n{R&xe=#|7_&nFd z1B_%yy9$kvic@~ZL~$p|$KC2(`m@^JHsn4&oP3*MoNil<%b57BAhp4$plIpvkez6g zZXq7<)Pm<0@~R4HD%Q=kgOe`3sWWr7SM~oO_^$6~p(}H5VV({ni*q2z{+>EKW00sw zr(ihx!{O6>Jg%FSh41mTyW4T`Fa(-J~6TjY{oa^SBF;kvLg#7DqOryUS{G%k!fo7Bj8M!F<3!<^UQ$|G)eJZ>OpM>8Av z4D|4>6Tm-F;k!^prJRDC%*ymq8`ZptKzHpoJ`azzB6V1&xhVidOTJkVMS7u*?8Qic zOZ-J$P$l^0wPqnrcQx9NXWM~#IgCz(3~$vq*mw=y>q>?SLf4|I6?<&Oo1u1n1k?rq zwYWd(um;0|!&pPS3UEAU!hakY>s=WDZ2j^&K+lONGXU3(xbv$;J8Ya|5k(^)h)8C% z2B_G(OdpJmJz1spg_GxUF26$?7~sz{f&q=1i>v*J9Rf+`)wKSl9?4Blf(y|X|CZ0P`nE^Opu1?@So_H}U;u+}Hw& zf^Bl*Q5i?8s*OW}Pv|V|2mPogvC~WZM6`9H?X~RTT>w!xlb#E~)_{%BwEJV-&?!CT z*g&_p<(26jcON<(?L0b6cdA-q%@ST)n|ZbJdflNzLD8{)pvI>=XmB|qF=-_=!<8tW z0@lSMB;4~#W|xGIM=ti30_Z~ToZPf|X|Q%9L*^kF;bZvsbMQFJ8X@0xSQpdZ?gjt% zBh!0Q)nQH|;_mvx?QONLL*&r^>B0P`ga6@r{g0>U)hypzbvO{=Sqr2R?P=KgTK%p& zsHElCqNPs*u9GS(E%-6%lZ&Shp_Pq@)(XGDcD!2lgGl$`og_ly+H{mFz%8SX3G;yK zyi#@fm_V~{yu#g}Ezcru@p7|8E%X&Z(Hbrm9ZUVjnPM|z=BGGJr2Z8_j7|w$`j>Kn zK6IQHcukn>u}P@#s4Ee6M?DT**&O_3s^0p~E}~G`>~7|X7R+sG#G>=@(N!%!>B>a2 zUJ*PH(vtHupeS4r)o{tWYT>HrLnw#MPzRs)o$FfA_KX6MB_Y{kGwCNnz=exf?GXt6 zWtho9_xLH>i&DOdxZwSfdNL{Vyl!!$JCgfs)6cY4 z3kU)F6;gcx*mwX(hqYYaUR-y*8t#N^3zKTISo-0uyI~x7wJY^40S3u zuDNEP_g(%S1+K}w`{ITf9F>B|uX6D)sl-tT$oTDP`mbBhi{5DWU19HoUf8DeF3>+WUCFArHFh3%vJ3_j zE29n8Azm>2%vbVl2O&Qas;hH9tMXB7*`fUq>V)ZMHQPrT(sTXc98f(#t&%@B*ea5kA>dZg9< zeZ!Foj9;G$LVYY8)Y1DT)6zxb}-8 z{QMGKUmYr^p2aV0-9Dg5pkIY0zjUqfjC>Zag5TPOVT-w2W=99dwdLhiC!t3_2l0TK zx8F?4A(Ee}cQgP{A{5vAcs!Kx-P+fUm&1o0e^@=h^d!DB$FDJ((ZcXk-@{*e1@8l$ z2R=}xf*8TZt1dh-91zG)25Ds~$e&$*D4wQ`{j%X4miLo8^8gbPZL}JDhN0!5mu#uz zcWQE;@!BWf+W)G77a7<=YB&2aUdu^Q)E3VZ>y_I9q{0DS3QxFP30oim9OApjmePk?w^BU=C4(ax6j|_txHb z_$A4kvzk>}_s8S=AT{@^wjA(@LPb6-HCge4^8I!?u-J23HHH!ONrTdTr(YkeIaL#G zP}}4k4dU`Se@@DsTMDL-#N;cO$US@2WF4(P303>{PRAV5(>l};QI_+k?Set@d1>ws z3*gwB_#~oPA{folbCtM4&D|WLPOf5IlyM^Dy)dI`HBZd(I(i@EqBXrsQa2L4 zQ!Qn3qR;TU&L^^}aVBVTvpA+nms)2}CzLm5Z|OI=%k{fGv`M_hnO;@<$Hv+1ifoet zYqcS^*G4R39Xfb-I}H{ztYtUrh7szL=8#ct&&?mz0q!ORqQ=V{>&u~_ZeG^t+so`& zh<*qjhVx>20-Vf%3LLdxadA4aoj+qH33}d^_4>GbFO0-kO6Ba_v;lR>vujrCwR}du znRc;-CBbic9tqw`>O!%NsI=loTN~8BZU8%Z0t8S?QJPC9ZUnkG@r(V`>j)P~(Oe@} z8s@T`;kYXN9*R5;YndvwquNo3;CWpu?~)u*K_$vWG*qREK_rgMkc1t~6ZjB@GZuSSmggL$_HNm4?Y*L} zaO&eac84f**s=140gX?2cz)Wu5rTn+r0b3^wcOt>v2XK?0`oaZ2@m-|49lhaPO>5u zN6a zQSmbYlc{p|nYUyER9w$V7nJ~SrNiyfu(aNDlv=ZHchkY@7w}mbpoSrA(12yfE%3*{ zD~eo&fH&Ld#fqQ^h}@ZuMd~!34;Q_^>%6~CC zbYS)(OFn^YyXYGPQf5V~ss>jteD84_IrC+rCukFVuS6$OBgb^iepMACx@?@yen_~P zuTEZ9cBvH7#oDqskWjlD1C6DnsW2gZ93mS$q?b_+)9a z8!auh`*Ot5Fg>p40RHs3#&&<(Hut(WzM5yPKOtb$_B;ER?<7G^B+TVEk zx0W_vCDZ+Fh)?usrT^WMiCFf~--bBYlGpUNmhy?5-TyYk>QDc9*#GBNmTY2_*N4a% z6<|>PInIwGGCBJnaupF@*8XSF_82s$GG_Rg6@EU9bB@utG`;wF$ISUw>UwGvyr-%5 zro5xnq*N!b?PAv`FHq*a!3QV^Lw6|XosbCyE%WTJ+MaVA8*Ct3YXJk8uoIPM+_<@P zrgPzB)PnLX8c+e|MVR1c-n3x6x#kbh4Wk0H&31uM=zumTQR9nwsC42R;Z7ty44cLs zg)`Ork{l|=azbVi_4n%+b~veZ+7W2;W>E`{jb1YP3dxLJ^6=`H{Qg@g?CyF?go}KI z#lxMKW!t)@>!v4f6W$Cny5hlI5=>&eYTb~R^(AD%F1ZSI{wxq z65@7CQQQ9kiG&+2b`|13T6_t2&Q^wc=*(_-VZvq*I{}6gmdEap-mOSU+h0`o;&(t( z`$g15gP$1IqA};YF`_#IDe!eap96VL>sRy;r`I0p*Hv%BA57D9G&_=$KFFD450U&z z|i!?90Sp;*!~U?{5H*PZQ7qJ!xAZc7V>?SQLQWuw}soMGb!6U z1h$LYvc5qv2Z4KYKBQ?29*wOu)_25fS9i1tGZ?wtM(n3MjMWBn#%@GNEu^uut~Ytq z30c*zxAOO?AINFh$bqH)yME)R?h^=Cy=IEE=LnJe&kg^XhyVHV@W|$jGWQ{x_g%7Y zk|d)^8(DlX*!=#z?jJtg)`4G=rqjbaDx;*Yr2*_d^36ZP6DFvuG+k(4c7pFJV#r_W ze0{9`y4}iA80RY+$y+yT3A{+aak2ZQnx!20s2oyY%Pa)i?bea*T~RA68>OEA;Uf;z zx7Pq!s@pz48V3^KFBjk`-xvh8pINrRZTgD zz{0==vTrdY0KWTdO4kOjm7nYVOecVc_GfN32?RX% zD+-F*H(uW-o)b z1TSawU)-Axz ztLTj0zCOxfiF<;%p(i_kLG~C`}j2=t=Z1p5Wz&6{m-Wc!FtoA0HWH({I%` zR|z6I`}~~(=-YIwB!^Ny@jb4Y9yBY-PyVE|D2(u*jWlk1X7(~ipX(U90XeC$J=5;8 zd@=U0FZIiq9u|MLD>N4?LTXXvI_aJGtMO*nx*0!^zw4)CQzbSxV>s@)M$`DCVYAQh zw78b!P~IuBoefbsZ<4&L(tduR47TF>G}f9?Nh*w>#MUE^6xEjvb-D~XeP zpPpOJZ4>9+))lro4XrR25ymbABK;`zKQTOp_e;zZc+}RE)Oc9;e|D%*O#dJkn-Cry}V08f~65||iU#)}(aowS6!0f^MVyM4u14lMR?5632Q zE0|AM!w#pVf@UWiRdPjij$@ju(`m)DSSNL+Ihv~OBioL~uaQt-_Xh2TP&&>k&MbC_VI0Q#95SzEi6eKac#^QkyBq9+pRmr2U!b!UeKCkSsT@E3 zPx~!)9k5t)va{dkNZJ@p&tkh>Y-E!FBPUr|M2%gvE`z4r3{tLj0gtq5-AnX0~^^gdcQyLnTI>p z=R|HySz*Kv zeSQDza=KDmVJu=i@r9!B-PgNY!b>ID0R`+i(nqXeA@3i#oA&WKaDZ|f)lDv2)|I_W z5pqkih+qf4W~i9PyIbeXs<_QA+2_ipuO*B5PpjaMCspcT2eloG?;@oJL_J8VV7SdP zm^*mcEwU|#H6Y#fu?J7x(!j_EvP4O3OP_ovesbkSJM26yzT0$o-Db0F}P?cB!( zMcgAgoPEI11Z3~mm9GBK*+A&)1k4h?8R?>I<8I)V$+eEJk zeJ#&Kv)v?f-OJnfaAj=X4UHiVHMW}jpT#?c$t`AEq0a$~%3_2dC0x4psje;NM_!G- z4qKk;FT3t%>PBj%5pkYV|^up1r}`5Q&z8sbJ`Tqb7rfF3KH+!=>+W~A{)p0O*Qdi zSog;4$goDKRmLaM*MTZqnv}vjd6N%fwcG>j4xTEWU~Tt}PkRr)vxGac)toLT>4Jr2 z^^f=2Opw4_opS|&9+GW`DJA-W*C8IiK$H|_^ih*8(WK{8k z6@xPaS&aRvCzE_UpTOf`$ox~ACEhpa&Q^S{fFQmLpx(`yKXOETap@;3_ab7QLXYeYYKiDYJlC1hJ!Q= zKPT@5{aVWi=5XYmT;o`dMdnmd^O^nDptNJF=?A`-{qsGb;3MFmG0EH1d$fd=k$PrF zZ(Dy>J+MBC!f9LtvI_kv`R7D$|CitV^&ZqEntGpZ(ak-S$LdJt8lhzW2t z-lWuBoqLtXkdzneZnx&hZanTM?YhWniz(R_C8L&?5E1X^-~Gp zXX_WWjM3jX=z2^x3uK5liC7lU?X+=j?pMfPSEWm!7HpG4Vy$4ic@#(kdGBwBnHVn? zAXvFWVsJisI&}TZmu+j?8Ai_!MKg;m>d}Yo#$o=dZ7CVnj`6VAn{2cm+4Xn8%k7rM zMHL9A84=x|2aAmp_^3$oTXGcJ5L9+)6WLJ8@Yc!9xz9LjCQzf-SRRga3Q||ISS|9# z=EDXV#h}6h!vU}TQbNFh0s`2vxNksW$~uIPL4$T;?h-5rf%n`sD%bzW0GNii8X|~-rT}@MXnFN-KghS+ zi0Ly{%0_j?JeO0IYDD90RI?5YoR19}iy)^&_iNZ{z4CZg;F$@wSu{N)E3wl$Q@?%8wRf_MZ^z2XPTzuS*#}=4U zjxc=kF8+Bi;+Q0a_xjXTul3&q3%M3SbiW)RMxP#>Q?JsOnuzXc%-FDL<3SkEXt5xIoH_s5A~5IoMXd(T)Bfy3tG#R3CPR9lnts*&|ZuXyma zmG~x^WU@>Jk1G(SBVR8N?p1|zcV838mb%EfdLk3|O~p##xEcn)g0e>2W?z9Vj&BT@ zMo=X(eErj(j$DEcfIPZaA@L-jz^pB0(O8M<sdbL#PwvR{=(Y|b*O?7nr*=>Km3 zSYLreEG2)1Jo0TIxi~{({nJe@Sh2iFl0##-VF$~DG4QH$n^BdcubMqG z;hg7Vyl()WIFjD;`WOSG_1Lcqa!#b{ZcACxP;I#9zWMDuOa6w?jA!D5)tQ>D&o>6V zQNI>$8kQ;u4)bA(jzLA8_^r}De?z9$&fceKSr8@6d+sH!03I%1{NAc%6ZRBDnc}^% z{;RtL>@T2UAXaPXZ~Y5`HOkJ&EnY|g>OL>+h0)mD2ET_aM(;Cp0;PxP4OuxY^Mq{a z%8@R4dpe$Gd#w=UJ@n}&eR=Dx1nb$8nEV0*+-6>5Fjb#F15F_XVIiFHq#Z9)xw+%9 z7e4c?vD&hT%4Hh2Z3qxFeE~P;R^V4tJj8YV#}5YIPpS?z-RkSR-u0wLSJUfQtx*SA zsik>~3$++tfk0w#O7rVk&>NdYH7?_yG8*P55m>Hi5ksR-3&m`Wom>TX%4a_2{o41V zd1s!1YC9G(*Mcd6d}HO^%@R+331RjV5dQwW_VvT}z`n<$20Cn$yq-oiq2BYb_=rco zv=ts6F&%g5aK!wF{M_TVMJ4%LkoprpJ0zCWm#w(39P`_3 zIa=elm=?EH>9J1ZpyoAt9+ni-7pD@Hm`?ny%QgB|p|UGT?0mu=^UgYYvw-Hpy)+*) zWkU*)5>tZWZcpOf=OuR`wk}GPI^IZ75<|oz-7O z?=0S`-*4SF9K@c=kbKv%K4YDZRV(G^B^k#zq1bfVUhFUNORe2FHw-)JDRvHS#;5HJ zcn6ga_XxU4PBZ41VBB`jRvUK<(csF%6pzNzz866T=lOKy-ct_@?LAB9TN7jX!B{p3sT z)5BkSXNh@bg~&i$G1?;U5&j*njSh0<*eki!bJa!1e>p}=yEw@k3xVA1dvPeQNows9 z8RF-Qm}mO6Xe(1AGo@({TW)fhvI-Hb5sw=IsfKSm@`%$vsafD0XO_M$G~@0O_a!z6 zt4wO^(Uq7^YYKq4hzcpo+x%ZbWuRzs^v~dMoiC-M)WxJ_$Dj^XPE;Tgr(eNJ^L5wd z7tX{M8~;hY{nlj7+lsIZTjJk5X``CX0=3yQjO|^spW4e9A}!wBojO|Y^W)l6(P)i# zwJL*o|8&AwyZX}D)KVRbT{G^#XE+q%@9S!fpw-uG@#P!vmM(Md7Tx0=Cf({SFlKI> z-GhqmNO;Yp6_09}_Uy%Q3zGSV(jw72E$%nKn{?YbyJupPeU#2di?~uugi`)Z*HC5M z=Rbq*aBuUV4-PCNCe2-rdEQY7FWf_x<){D&xM`75xVA5iAx{Q{I#G*IP@w~W28*4^ zs=3HY{R8Z2d7g;XV{HQeBcH^e_t5nM|7GBJf&a207mZC}iX!nN2;A_h!B>%Q@0V;R zk!N!L7||49nVpkL5i9JmP0hWZrSqHGOu5!@r)4$J1#lgaYw%dlHdkox&9B^npl?rz z5R(0R{(*133n*0PMrk&T2ecwTd($@3o{kS|1OBu>&*0+x`4TJo*tWUnHDDWkWjbh{ zaI`-np$sdFFs8f2R}9oDy+cC@5IOLxKkxLOpe4x^s1RD(4@plwxKYkb$eB2F*eq+Q z?B2Bdw3s_`O63>v(*XCmEb+IN8N6m$IJUgcJh%>?rhKhuujEND<*=Q7-|!w!F^&vb z=pw2*>GF0|t3)RtS}Y?b1m2}$Jk%G8N;-c(b>3*2a6BTT$G-eDv_jK{Cffdy;ZJbt zN6s5BP8`|5V^~9jy_ESO6osYOxB;E8wN1Vg`f9;#qbbafH_O=IFs0JJMB8$|qRsc@ z+{Hs91LIFGdL?qUw2?aQ2L!#oKHrfA9o;-W#n;vB+;Q<-6?|~80LAg?;)@a+Zp|Ch zd(*RS2x>f5YnBv$&NW3Ud$zp%+yBJfHp$Fi+-{ki_pOLt1*`Ul`EQNvS|j?{Cj3BK zary-y8v~1JC87#z`2bayAZ6vm2g{CvCW8nAcm$YUxjzk`Amw2`X_DJf5Q_1*w`p}# zpFKo$bF-gWM$`TtN1Ghildu46+b?AbamwZTdi&ClVrmS*p8Df)n_4$dR9ZPfZE*v` zi+S*Mtq^=bn4t=d4k>RyL@w%UThdwC-rTUvW1NjB;@Q^M4zq(#)*LtZK7PEJtpC5T z_g+y^b?dw5CkRLoB%=bQk~0VjNGMT|C{f87iIQ_JksM1hNX{S`$*IU0$pQs}P)&v3tL zlWdFLgd`Og9LT6M!}{P*F038j8ofUzQG}NOH^mxxjO(r(%3toVFt}~gc5!l5F5ZD~ zUd$vXa{{I}5#O^wpP)$pGmUl1z4x3-L+qExs0lVJcqpS6bCe|d20Y0NF0@_@ z;H#qladjP>GM6cd6Ts`gnR#uu76mKw6SSRJ4H|>R&!xE`pgF@wNxmcUXTgV`nrC zp7|oaXW6b>3;1a}OjG^SNH#n6G(4Jvy*CN;$9HCr$BUXMSlQIGe{IpW!UXaK9nL%~ zjndE^jNj3CmrCz*JAO7Lg%W&+tGvoo+oZs}yPHgck+J_nl`}$Wj50>DM{@x~M0o(| z;uB*|4= zG_U&R`nL6sHyz~;nHhB*N|Aah(d2AUHsluWI#aGw?;%y0F@wjUa876yw_#XW(9GE| zcMFMTJ(&8i{bs2VEU|h}vsRxn?pw6kT^mZ)oxd@X`rhx-GaL%2S!mj1vjS0~8$*=M6Xl4D5ZNmDVvW@BUAJ1XUN1)wqoBW ziH1WrH1$dC+^di89M0gL5Z|Rg84%x(%p(0*R{eFCtV>dp74B5tXwbOyzKd#qlrOXv zGU)rP^|sgX<0h5wU0q0#J#8h_cW&Vvv@h9#oFo1`^1Qb$&0Is%M zs(vT-q5m{tQOFhxjYuS4yQem=maJ0u3&G$#+N9_rAU`@lp1*8;I3i(;hw@ulJcX5> z!;q`E{5sgydTc>eoZm!m@*Nck^gB;duG8g{&CxDd@R@%!;;$k1Yc0NUu0{L3h7bvX z3EnHr-S{)`Rc~bgqLiXF;hHGZr?j&ETVa3ziU2THueE^H{WwqxW=Q^Wp_c{!Vgc+= zRB%iwb}*g=3ib~S$5~tr)=9^eFm9H_71XZ&)O)ukfLGA`UE^;LDB-`}58stc&4?7L zH)Q|*oa0}g|Hn!CAKxzS|1-O>eunuTUFy`F>%b#Lz{IY!`nN5*Ied)ERdfNCN)dJy zUkV?Ns-!$fY6{?dohlQnLrA~*RMm-n_d@e;Yh}sP3^D}UQXn9|(TU&Tf^WU{omDV& zM%oE_dth?ccQOfc;O zalc}8mfKQ8x8L0E>rFWra^A06V(5i?33uH6GSvy^O|96ATeg=0-e2rYm)cHAHJ7q5 zC$lTMO1kol4@nJ$eGN5-)*4ADJ0U1RRyg_5J*A5wO-jr3n{vnH^*LG6>k+nY{JpzG zMlHW{9k&cFLu6^2iA5gH?5 zZR>j<4~qI~%w#M7WFxuNq1T;d8MD;u%}`3xLmc{Ak}TA7u^>QvbHCC|rbTI8_Oe2| zvz!ag^!_Tzdiom)T}fP%qm*gxp9pI!G7fe9B&e50Z`z;b(dDJ6uZI*VM{?PR3&i>? zA-F5Tk0Y`5Hc)X3*GxAGqGf>ALPh*0Ypg?)e;`$t5MMD;T=V7*dmjR4;1{af0~f zYireNZ6s442ySSxjtl#D<2Ukwpy6L;y=Z+^8ua1{*H^ z`4Ak4#v{y%DJ;^;t8&qPEg@habi0x~*>1A849RiqNd{M5!fo<76BgM-Klo(J(Cm-} z-5$6Rwe1w5g!$@N<@lSB*FLU(+Wt}k*tXStbdDmsbFD!y@b@0z&&hM@G&KCfPi>AeIj^$$ zw||S^nepquTci|;Wea+LS|+9q^7_mVg)bw;Sglbx4s;1b7Y`m_CnMaoir-DXyPT0g z@OBR-e-Y)%{^Lo$mP3gFS<4kR$B*_WVgj|~O8Vd&R}|mWP9R$;QwVJ62{>>tXsznA zMuq0375E3Y*!V-U@tC=s()KWfmJIz;O z`Shd1-3M=gUEa6W+Y3ghJh;UM_goM1`>;PH=A>cIZF09(!&Fxu!d`FrC9&hFW>(N% zBK5&cuxW0qFufB!YcHb4QcYhYJtax*s*@|9>d5OwH3YiJwIIoCFCHU-Q~5co@%=?c+wjo|O1R zOMETxM%5g0sbcoz9XRB={D@2Hq663T$1L>;#`F!h5NDtS_T@yzS$tO-}L^Q%oX_MU$* z|8>-9!gpeS^T(xdv$Bt~#|Qr5Cmq1fBKcnX*%i7g z+wEtCc(LKVqxNJjctK;^3NnxM?yw06<&FOMB%S$a5ZTvfZE2M4WgmG&Gf?@i0`+U= zn<7>c=h8EHBdK)GIdSxLrJBmp7D?TW3eEk5TAx&3LNA!{KUe^(mT2fX00_wcHN37k zaD!L+XRHGX9Of5t?4q0Im3&JwFc&Y0HC4I~Nd93qg&Vak^!RsUrjFmd-jyMoDfw>! z0RTjS>4cByzX1f8K8?ac0d{=ng;k|ZD#_5B4a>_yK}CtX4T2*Z2=Lq58;VAxO~qcH z-HWd@Ol*It^Vvu!uP}el@n&^vV{&qT`-_63L<1EbU!_Z%DCzl2WTK*E(**U?(N|r)5DFo0Wh~5ZE$Z_`>FTPjr7ci|}IwO+%4Y6sJp=(XcK7tHa0N zoS0HStV74`s(lF_+_e;qn7e;x2gm@~0rpw#ePIazPGdPo6SoH^8 zPtMVpA`$O@4HsyhLx5Oo(BK^F8;TD%%v!-;-WSbc)~+8dI4k*_$nOh856VUL0h+m- zr~CEkfQ2TVn6tL_?b7#N+y1kjCXYbm5>534*i-GtJn>}|*wMMKuUHGvPDrPxE23Q7 z0W(uY>7Mybyd4*m4a-hNL8P+uC>`{1(R5H3`+ufwoy*IM-d|o3Yk!H@$ z>x8oT)CY1cRIGPG0U@mPBwat^NoXEB)9I|T{^#ZN z7N;o%7u-VTuU5s&I>TnBj@H}7QfVGLd`?8w9E96Ko>Y@!7Tb~In=j^`Zd$Gs>e;_v zcxlV_1mt$m%SZZwIf=R_u4o^@3yM#y@!vVU33Z#*QM_{3AeZrX%BHtgP5EMUUyo=o zNy)imwZ!IQy3q9EL+pkRbxoYt%L{c5gWjvuilcYF zOuxyegA=xbm|*ltM*ccu#g3fi%C%a0f(H>~Wqsvl>T!Gg&j&Bb^N$W;m!aK-Y4%}A zRYymeo2Qc&&|VKF^?E7zzFI$2eKX1GJ7^4U`(#)8X1(M(XJu-f?FGZh=;wIlSi3lH zw}k?O<5w?PPscjld7aDJHi7g(TyTLf;@AY?L-5ePiqU_g26{~fdamBkq+>%^yRqg} z{{H@S_|&smLt6iEfmao_W0waM^$XW_t|jTNV{Of_mL4O^(PwTg$x)9KIFp(`=%ow( z==~`$89Hu})pTkli&Gv-Q^fU@3gJ`8@w$P5w#xFxrJQC^hOmU}1$5NadDXSE$XFvk3pq@vt^*!20GI@O30s zcXPuGs=3|+>{P%L|gv| zj=Z<{crh=7x=dZU1ar<5t!>R^y(+y;zM6h?zWny8w2-phZw1VpdShb67hG6uLU}e$c9W?!IQ@)DB?5T{IS+i;Tdqjr$C@WSAUQ7 z?y450zd{bFb(8aK`!8qp^c$7#YAgqXk=97zdfQmU&KEufbVUUMI!@@Rv}9)9k$ zC?3=?jNe9~t=zJN6U3U_}&|{o5x=BwUJ7-M~!}(m_7R*#slQDFcf^{uYC_m z*C}D`^KExoq0OdgzbhAa$SV4%+9+>;@%$!t6uz=LJWT6lUB_?88`I6_ah7dV zkZy_wMVHrpP%L+w)f1yf&7;p~!8LW!o;N(x;PjYsOUAz8EVYwd`~!zd33uWJ+qQy2 z@a<)TFa4`FbGqAdS4mPcDW=6s{3cJXgHg>mAq{y41G0f;Qf9seIoNaJXO%n+i{ifY z%U`Q-seZ!X%=dOrZzb%x`p#*R^~9$OaetZ)omQ+(Wpgh1mJpwxadW_jKWmJ51u$`5 zmtX-Z98t*xZ{*j65hg$g?>$01bV8v}ESo5@es`H}YK;dhxpxguC=?G!r zM(I{tcsm6>|ChLz23r94l4)PfBr^A3VK2-EmsYdoW*?yLWpeA%VuU;=xgb+@MACwr z@h|HZkD$xLdb7TvZjsSWZYg0R01M;w2Mfc_6(E}x;1}y9*Pnpy)3g;qTb@y2-d6Ub{Dz3yd2TcpE2SnyQHykQS zwa^H@=43G2BkVDoQZ1H-@<7hFubA@S6_D;Ujs0pBzk}Ph+2{WQOxm#MPaqv^COh@fj(Q^iP@D(`gJ#SpVX z<(Hrczm2_6+Z?7|f6AfDL8!^3`obNOFZEe3j*ZJ!(KwojU4`{549=kqj$7zKqS&n) z{XJ>1IMSYeAwcI5HSGH4qw|apD195rBS6|^cwO{6I0@y{aHg(Z?VDbP6BDZRK{Dw5 zl)8V(TAe^OY_Vo|H`HX~0X7(_*8YjifwY5!TQwuVV z(~1c!eZM^>E+|1CYV=YLAzA03zaeRQCc1*KM$mHWnecfW@TzxGkSur>Pg9Y%yDXIR z6Sh&LzxtByC_;A^+nowLnX?BXLhkM3%#plHo+@q!o^TVbs4(<5F!A`OLwKf+?=4-1 zN8bwKv#6GB*(KjaLg%huYu0A@VS;tjYVQ7MIhI;0tD>Gy#`@bbxZwMvpF9^G4Asc; za&N9Tn$N;Y`*x%*SY2tm^pL#Tq4-~A9{t}lbpC(HF%={8CN?o3XKF-@M=GQ@?g76> zjfgHya)hPk^A!JZ>dl(|nuJ{*JzE+{)&)8C8Q>Dfp&Xf)qmi}t_1?p2U9!h36YJ4e zM%rzjv8~V-+!ZG?5^x}d0n!HQmO2hC4Z!-PTj-mA5kGAPatT6){Z9#WP?3IZD$?eW z4O(D8yUheD?)i!w4g`Krp}>A@ENnS!mpuRy1+1?gRnpg(2P?h1+*=0I`^-rJsZG_` znwH zen#Dcks`OEg;(Nys>rT=&blimF~CM}o&P*mwku`oIPT7cdG(2IJ)1n}NldT=&4Scm zy=o+B2jfLeF2f?n+(Uy3`Q7s>K0nO{A8$Ino%D!S<~~|*gORqwID945G7~8Mv*TSp zxg_k>{pI+5$q{ymX+B6p_BZYANTg)t^zJ%m+9pkW^FQEIbLEOj`|eLa$7kxK>M3Qc z?#WsUu=2*(y;+wbiB~_tgSMi+7(EfHkCBSd03=&m7?aN@=>3>xOH+?TNz7}gcp*?e z92I+@?cV*(z0E{KaT2_uM^Gc&OkdN0DNM0SzIoJd0&HGrSgSW?$((W}$XM+(N$(F| z{<^`9ILMziRH_9Mr&Fwsppq_MeMx2v_+9c^>Bl0#s4HED`gJk<{&evN@%!lRv|}gZ zdH=m~y>>15L<~(9!p6Gp6jQb}2@ySKK;|dwy48o)T0D(gb`cj~^ z&TOmUaySbs<&(OcJ1{T_J*cnGW$vJwIC*(4@UCQxT2r5wJ~CMs)=B}RZ@Tc-_CD@h zH}9@uYNr}Zntn-><(AnBWE}D=(Zrw3{K0koVQH0IzGD(qK385(O)UTKP+Dc@%zCXn zh3eSiTjjJ`qQLPNp*EaoFvvxHPp*wOhsGgN{_1bg)_>t?rC&3|T58t+i`S*S_<;lA zXHfMs-WE}x0uZ_IYYp``=!B|X*1`}T#!z=EHs#u)j}6Z!Om(vl!57=T>2K5X6NnwS z$m|j_x9oI}`vwKYS;;AL{n#-(p^l ziZy#b)MBQTJ&~qPqkl?Ry(|g3lV;cKB=k;;M=xmmIsS2F^);vV{m28NZ}-Fgu(U#* zAHs-|dZQE`wzQlmD%W5yrIqjp>z2=s5Obuf%icLz62=bY@x#0@BE52@8FY;~UZYa` zFbQ;Dj7N|A`0KU$&Bw|dZ7kV9B;Ne1Tlq3T>cQMfzphvr(bN;~zu`U72whsC%mwdtKhLVT zn~bI5^ZtZ3+zVxtz_D|((59p8buRZ_8N%ri@SWDtHj%hneQn0#yZH5u#}UOPKY*3?TJAVN(c)@<7qFKnx0migYI0bw!le;4DSooS0@`19su!G>2w# zRvz;@z>I|nk|>0{KM-gGitOwt_+4f1H3$Ceu|eQ+v-y*}zlL`NZ~;*CfY#g7m!~Uq z(+#zC1xfnc;?K}J=RAQ&x6`A_&DMd8sE>&1`DNVm5I@NpEzi@mkZ&1UT!2_DZl50$ z?ObVIqvd--K3R>VE72cVnej&e2@M`p7gWice#f*IQ+ANdzB$LPJE>M#1t5oCbT{=z z*QH$Db&zfa`+W3121EvAp$7Cp3J$Oy$lo6q$G}T!soIRKOOM(xo8c@J(Ebmb=gU9B zJjQRrI8xIF<|;CKF5aMzo!8lwXinF1V=^>X zFK*#>6|czd`4x?wTKV8#B9SX=XRns)&3#i@#5X+$3u>NCy;b$;!lYPj5ycIsetwTuFM2SCa<=x1kx z#Kof7tmCHFGU>2MrRNo6*LU`KU;Ue5WN?Che0~zynZnJX5N2RF2)tVGnf}K20|2dj z8=#$Qm|+Db06?aX>uy>+`lN3(;eD2us3uV9(O3tkZ#eAWr$evi^A=9V@FQjM>p9Be zw9Mm+^7=a<-({bUV$kTxR+JVDJ#%`wp^^efQi(BOb(hxCgtF1XGZN?^_a7$->c-N2 zjnC(9!5O`&!bRcVU;JzD61gUIbB7#ja{|!cVp#t%`~Hdkvh;_78AsV(367Z|a z-s#u0D9n*&tybU{BJd-x7OG!2+SGhTx;B4}h&C#mJN*w}IJUK1RKx{mu*!A?+#Fq# zJyyu$UuJ0bcIDDzJ+gZWkU zmn-+&h)`>WG(>jZBpgR5Cq4KL;ebeN3s)^)LJk{=Z;Xqe#-tAgc*So zco@#_&n(So0X`Xk{{D6hc%-{ptt7FoS>WH4CIi3S%FmV3F5Zb)Pp5vhXfjVCWg9Sr zKiXwJ56|n^>s;F63Nj-D%N;0*AS$q?ELUVgD%BaE$znG3`g@?y3THaY0@&RqDO4}q zeq35XJuGN0h9plsukL(kwXeU#1)mezvVG@Of3qY#|6((3c~*&lRG%CeNiU`l8AoP% z=?jNd$wun)ie|ZJW&klf6EM>#Yz)3M`gpaBsORY>Sb{w)JGQ!LTj>Y4h@;T>N+Vs5 z;@ixQ5qeI;j0bB!u0u@cUs&7)a@%jLhly-O+s}fLw=`0%l9QdDUSW37V4CMkj*iHq zUzb5H)oiUjMucuYBP&Ml$_PuH1u%+pYxjLG|U=J^!Qpp zV(MtWo8LroaH_n=cn0>a9VkP?b;puX`%hb4;)Qxfcam6xuI^%9HnMvTcf3SUi=BPG2U?AC( zFg(4}rORPU{X9NEYx+>We)_M|8gxszyP-mYyOhu@uM))G8s8cdB%a^`M5 zH@~M4d1dk#C-*2V^;c>}TMHIO;Vd>n|(DTdP%yQ#-DVz;+F%yx5#+s5V5&trytSUUN0(p|3Ew zRnn=2@i{|Cv*L}$J0a514`y=2cu6#V94!mLPRzA_eHLqTk|Mo(&~SM;PU;deJb~-s zjJ?|8wjayP@CbS97|Oo^WyJK#DJddEP!fB574bxueZdz6{IX&OmNk50@Vyy5+-48A z$Ru}+XgKZbVUuo}QLh{WTV2l^39{}jRIH{wW6}F&D)3L6e(b=6*-Dbw5nFt#>H?+5 z8$l^*6Ak~g=XX64i~<@@!8>ZYMTV9cT|~=%P*7Ta`ckoCOCYp|*7R*!+1mn9;fude z9o#f4hKOM@C5G1*uqzsk{@<^J&vz0iIb?n8vhvVx-toEs=QL}1Q``L&<-Be}V7!~c zs(<-R_!r?C+bThpTCzJDYMSQWp}!#Z`*Ya=?DScY{ojG*TH=%=FN{ z0BFr*QTK((Z(bI#M<-lDFR^oolsl=<(88PUd)ELtekEoivSN~swaaC9_p7-Mtz_}MF`i@)mg9jn^gX_Q zBaWF*hR7$StOe4!eJ(7KKTktNIxe!j22u=AJ1KEpCD`paS9D|_tS{oWKEA>o4zXUN z2N02>$y$Zb5m?lkd?qZ+{j{P(2s4Qs21A16R>KA}CQkKXelyjKd=FJ;(6owyduQA-4ke+7!^ao`bc zz&C$2t$GAR7Gsw^(@rE{K>{0?{T%u02!_{}QUFS2r_R>9aw>Hm!Ccyl% z*_R~o^CBWW@E57k>Z%mC__yD@J1|U-1Fq`S#4*t@57}0R*VBdMeuU*QQ(5JjvUg!q zq`5D{&g*E`cl|OxhTOdh>;%F*wZl?Z71px6epHP&2-znKS794-A@SaZ9cYJOQMf_- zN45sU<+x8??N zgD;33AAj)+u;7DTSQu8(U^QZ{VLMN1Du+ZJo*(=yka74y8S`u+=3;oqtk}~}`M_Oh zJog)LMXR6G`^%zBVhfegxE{1dG5)-`7}i^xRz=>B&cy>-BY#{Vpq=y0~3)XzG+&Bc<8$V_bs0$nA;Sq^;rr&mr-d@XT`_Y#mvuYpYcYP5^CW#69sNi+zm5UrB8bf&7mz8wD9lfl_6iOR}LC~aUy1;Av^fum%Fsk88)ef@snC! zzhkU7@?@Z`>`_a*RG*}+*$cbViVr7XDkmn2RgB zEc)+{ZeZ*{lJP*1BbG_!Hx5|`b>nF>Cojpe+cMKJ$Kj_WGF9Cy=i~4!;@e4eRfZ6S z&X+s#g{C(2&F=^7Wxs-wyV5sqjN4c5Itu8J?o#q7FT38L`Ay<(NN*+P80W3L1&!~2 z-cj2Q4m!g&B|EO%o9cO2s(Y7q@rQ*!WN`xX^w5g0yZ6~(>5r>EC$&rz#Z!QO>5uT46l@XiJ9_7Ap>A97NQ`f11Q!ta5( zz4#AF3uWwix2KUxW#4yR=Qq+R&Stsi@P%@Om+fv>_H~YWEcRdG>J}Gdz&;p}y~{i~ zRT(FqN~n_JZtHSx%pMejXV7e%7xsGV&TS3Fz7_uRZTkrAl#Kl}yL20Vr7RZBcPEjdxCC;{Ar0V48u=^t4<0u6TP4e#n3nXj^POl*aeS z>sSrxyKc33eoz7C^1d17YoK?vg%P^WeLk_w!wQ~asU^>;syUY2m)e&+@U% z=sn+D9AQ$N1Bgb}ifhsx$IwCxPxt(Jaf^|MjH-`8E#li1@x zgI?d&olLv$Xgis+q(ZTxhhe!kkHKhHzi*k=FAMLF-pw)KfGq z#2`R>m4}SgKj|V*aSrx(>ay$8AVcw=bNgPsBRkE>inK*L89G1&ccw)r&`i7{Aa&gH9hN@2-g1dtX6kK1LfIQ|`TB8t~S{$0$C zo0~0j;Fg0L9@j11YT)qu|}d9*KEii>@PEyASDl!!KBYS&Uv zf>pi>-PhQ>N_7=jS}k!d2XVCAv?l9_MOCk8W@*-V)2GYh*n{7FOG%<){OBB8FJEROUqi- zr)g!W=(vnWqy4`2CD!pFj4TQ~Qul=~W?yxk9TJ;%!h7rT9@cbE4z;jp|`Renv3P-vmNR;T? zT1sx~?z4}koRmJ?J(sYiR0zkju|`5lftiup+9p>UCK;^J$1I>|Yeug`Mo8!TpIbDS z5Ae!@1u)~}i0Tx5tU4mA0ulic7D9*<0Of8)YH;C`G%9OZ5~{!Bgs`GT+oHWjzKTU1 z@|U19`HRAln9lf(g-BLFp+!_d;S;dD8#)8mHAud){!^rcx6JE zbd9stuqfEdnZUbNzB=3bBtk-;0G{@30|@X)9S-!f)n!q4LvMHo zWwA+}{uv$t?sj@6@9hymyGm=zUP+6biV8_HhAlbs}~Z1^^(9AAwWKlMj_T1J#7p|`4sXMJB3nV zlpBN56A00x#ux>e%yNvdzb~f3AI212wPI@60W1d%Twqi0`N!XBZJxcbg^5f;i6 zhtmG1zsQV_znJV(Udxr_-;J$L{;ZY(^cqV^X?E)p;`ANM?w@5sa#(*@Lu<^aN+yfQMEV2rD;&}47ZSZ$&7T*OR{22UEFx-3GSclYmCKZk91+64 zRDNcqQQ(kf5e!-*L^NTiA8*sR(g&_jF;=gx?(9mKGaa$&d}fH8%a~SAm^A#LE+%Db zLP!~7@JgHT1_e}uh@pkgZ=>oe88+%QfW-&|t#aYVUA-KSoxhtH1&jB&SZ$q&p0)q0 zpV4pNl>}z2ZJQH$&`=^Wef;$%OOK&;nXzgDe{>32x_<6a9cbykgUZ0}JiObDczD-) zs$vzsa>%q%wO=!AdWb%h3u%e_=<~x^Ij0Hwm85 zCT@XuVxOnSx}vAf`(NHM`Q3#(#(^2+u}0D2hf2$T#ZIDNVP%kksLfZ&ea{$7R!^CJ zRU`JT#zu)`h_7}q4%o?ivH@wmAw9mepU0FjA!OiqPY~7mYuZBpJOO4aFSWY@qSwk z>ktr__XUz3PvK4_#eTLbj@ZTs@yZbl6Vey`&@{#!*pw5zf7AbJ6QTpGoABn%lXYm^ z=bau}MT_O^6x(8(9P3f9;E+SJ@R%fH#Y+p~yc6kh0ca&w4>=r^Z0LtuXwvSNR#;&} zJ(AY$?;_%u^~Ff(h*}HC|`7ZxH>lm*^h-FVkJUXf+9xF&HKL!zhlN&(sM)m(Z zLI{%qLhTPpM$m8c-chIu?6R#Y7AJRQ#)^TNu`c|MQPKgczXG#wi?NU3M-EX+$wq*; zLa8A1B=k&b*`Ak=*gHvyzIWyV=NG#=cJ;UyM1b2bN5#G*@n0ItN4ogSA^JP{ZF}ez zsY1ozv)0>aikDR20EvF>cm7hnAbTs1!n~g!u3vH{7~Kgls2#APj?01PHh2`usR}7U zf5_hC@w<^QyanW$)8+OCy1=VB?408+*yqs|)<_Vefui*^CXd0wjwMdUz}U|)P2^ph zN;Tr74yvcY{jZ#{9QF^N9~wDh-=g`BJD!MRx~g=AGO1q0qqL%la6B$ zI9uUPuz~hs@*7p>75`iFptnF}2T5Uj)qan*DqL#VM&99|nzrxC0ZeECPgpIOK@QEg zbDt`IPbFY2rt4T9F}6nZtEy@g;ygcz?2qiO)}!mN#&o~rxF8{#L=|-x&&gY36i-1h znL^m28&HVUig@!Upy)_A*SyLlgmk29TWJiub5-QIluO7gf!z_(-OoQmC1+wC4d0GI zu2I7D9<@`ta>Iomo2tL3NI%FUvT`6SZ;r9;)7_!4BhX_ zo(xIZ;4mSgG7naMWEyb4nk|}2?Z-q6MRFc`c^11L-RVitwhA2ZuAgZ2_7fU*^^(4c zH#Vvh(K?wFg)h}Kw}B5+$bBZ|?s7H@3~O{zu@4btyzIddG*x*}A|)ei;iZs*Bcqc; z8K!OgW?!D^S@Cusw+f*~HanLq4mt5in1ppcKJ~Bv{v@Web02;eXHg2sEgL74=H_R* z$d7&S&ebfbD2PKff%-*27@kE>rjUAIg#E}#0zY0v%`3Kh)g4iD@&7rw|J=F%ug9G7 z3*R1XL&K56nDAk5V7%9vN~HsHK&JWSPY_VLWAZ@&{G0gdI|Z&y79HhmYD#Hipejqc zf^}~z^DtqpDdYWT_<(Mk7R>GzrRyH1F%x&cgje>Vzozhb1mTnMgde%e1+}JzaT~XF z1*C3UL_dI+BxsH()}+7WVhwv~#uxb_aWcY7K8ez*_cnRTGaIWSbzK3zL1&!ult(zx zZQQ&6wdbG3IT`=%`STs2i<)8$j`Eb`5268@O7{YE@3#d=yxY_>E`P}e-I{(jY z|M!3+E-W$oDs%>87Q`1U=3-(Ie8v2)p~7!e{`Z)^4Zd9}3KyJd+@y%V_->{)=wxgo zP&`HcYro#=TOUX_guFmHO4alBP73S-SgQGf8suLqF?9E%>R{P7S^Io*NJWeaW>%DM z6uccEggr?==4-+hUh$1WUTjXGk~d*OSTmB}>0dUn{5<1K0jET=vPy%foyPg^3is89 ziV2~Q7}!9zb4DeHb5y1C9h4ItOT(LCLn*-pF0O=@^^ssM{C!1o-5kxW#~k?Q~WAqA`N@C zYW_tCGliVJY3K`)4t`0^AJ+$YfQ^Ko8qs$KaFVYSe>ueNV2qx;py`A`UiI{Ahcgx; zRn|ae+0w50NTcoXHi^;>0C+d zam+PfeLAxN_vm^k0S-&QTYC%gv6Wt6o(zV|4;O z5Z1>{JW(Wel9!eDs^(I4laabFKoOp(%B;zoEv>On^zOZy>YFHOQx>Z5L}K;{surC0 z@2L{VnPRmGM@T0J{>1{2G2OsX5bCXX`JNijyhn~%^Hr>N(p~*xBcb5Lb>_0@3@wK8It!gV-?&B_I?x*{;x@Yf9rPR#Otq7D;%TP zv#9sJ(k{_j;hxqQ`BRmzkO%^m$FtFl6apbdf2)?T;6N7tpXZ#|kQ*}KO}80L^Y&p# zU14uAHZ}NypW~W~cPj5q@Wgn=-pF^H8Jhf8IqZ*xydyZfyp!TA88>wTN+xosiK5*_ zqq>6Kzv8C}bub)=KkPB*dB(TDM^zR=wc@VJIWOz5^2{_#yFZ0%cbq8r&B8XvH@OqA zcZWAquTcaH2wkGOT|Q^fjYR$X>pOcooTK1>p0%fP6=h(m+9c{VWAV6XpWYi4H5u(O zb!*JqQ-?oM&f&j*y!!99ze2`we*$XC+tZ`fr`X9?Vlp0)79X3gUg8?W%6OwJY2bpm z_gge~N8_#f>>VXJUx>A3k7_@v3p3Zzr>1h6jBtB5uc9iIR{iqZ6F@3Zo_ggIpnXm= zi&>D=TXbE_Q`W6kW>1{4XwI%O*Abs)PKnnnV`{!C?cE?E(o5=n{r0n{b?=MZw0+CA zUe|zA?%~zW_5TVR%EP(n^BzO@1_Q^It~H` zzr}}ZJdg8@f$n0qS+W0HH&*M!SP=6#js|W%Iv*CuMD6nDCVIupLhSr#$es~C_qcG& zX>%<&d90C_Q~bpASGT$^MWj+T7llUq1N_rjOmTHe9>c+N`^G|t9#ox!&*AZhWk0!D z>9E|04~v=+DmG6j*$sKm)j6)fS6PzlwyQE~GU_N9M)nO_b&AxNTKt8!=D;oF}Q%N&!Jgy zWdEr!pjJjpBzfHFBip^V6_)F=&*>C48xp1&;_5aeg)un{2Y2_3 zDWi>E1yV=qwR@g{8zl}i+~JR^-|WI#9{Ui;{E#vw568Nq5!Z++C~tQ7^{2iE9Du$t zg?25fJqIGSr)?PQRWgVS=8O>d$5B^K7{=FgY}OHV+}n+#b-h$ zPgT4zies>yD-fvioK^mk$Rm$Vk^&qOVHH`J^1?#E7xRRa4cFqg)bCZQDr~v5c8=)q|?+ zz3RrWi0`&J47HX#pTn#~4XYmTmyUYsOZV#3kCVc`(@06z((`HGO_{L}=gnQ^*0Ulw z(20EXL^p=E41dH%kdao+31~6!qDaCay)@eQ0E{$S@6D%ID{ku&|^xywY3W z;ZglE@6yeQ53(gbl1obuBR~19GE%nD@@W7c*cy>_v-uqI(OsM-m$a~MI zCZg|cRH-6OrGyqDq9P(qItWn^P*941NDWBuy+Z=hRGJC`(gK21>0L_bK|p%%MLMCE zK+4?s`@R4BzH8mJ?x*|he$C{}>^U>%%-+v__Ol-}YKgB=6kVqM^|cJv9~sblP0wy; zjlc3;@s4gR35?5e>PX$>_ zdAV^NMBC@I5(>_UAz zrn9$hB{>%O^+*!_K7vQ?B90#=>;gnh=4P8ZrWpF;sD2g|ORcHZWFpaY9|7d8Lm@xc z*wI;Qj+UFm$bK_K&cE19xZ?ey+m8x72odoyI zBXqNWYl=m#RbK;<4>wOfKKC2gxV-&|8G+{u@%q3neX;(ohs9uH9Xb*t4k$A|TjN-M z^K1eF+^!Z94T)b~0P0JK+P7m6-r)z4T`#GA7rap+eFpyPE4lT*-yIT<#MZZFnL4jA zsL;RkS60>NeE9Dhg8b(_QS-%$1D4hU;y^A6u}0j3yael%4epXT4mATQ;ocLU>*UVY z6O8lfAKz0y6gdlHXUgf$ZC=uZuvm_u zwe<9_4@uFffM43k5+S(UHA`5aU3we0rU-vqeGs#yq(A+rH`mh}_1%drS~jJh z6m$N=^Fhl`MM9RdE~R($u;@Rnq7T(p9r+f^jOb_NCn~00xvTYvIWzuE{qo26HRd8) zwz4DtO%TA|GqqBDjHGzAmFzzIb^g1ZQVe8F@Bbc8O56HonWPrKcPJycCw*i-kR_|Y zD;g$qceQl=DAI%Lgd`-;y=ObsV!8ianP2jOabduyG>M1B{gPuj_LS0W;py+da$tLO z!R+^)q<33mg&cfQj6*!f@pO-V#(kIcAIn^1H*6VhI~JkpdY|wl+!C42lhJ!V)o>p@ zLAI8EvrwT@dN!@6Ze*bZr|(`&I#W%r+bBu3K-4nes++w%qX9kmGz$D zL!<$mNALxsg<15o^!!iDaio*cf^MBd4})c&y`?tyT|O(nqsHBJvlCgT%7qj5CFZgX zISbqp4T}~B%EU$`K0f>OzVzB!SL)D``>V-zwq#l!ukVV7P&uVXpm$@~L@mAj|K5FO zCWG!XqD|z-b$9sbZvR1ba1-~xoA?bZbD!`({6|tyVzjlrck9Wrc_Qo??MOQt8}BQ= z`*`(b7wr4;Ss-y+oG#WRIs<5n^&Tl09C5`2y?FC^`3b8Ci+|W1nR4?7w@+19V!iG4 zm}ZAGBCE7+iizdjqh5pb z^DTjbLoM}|FN8_*oo{IYbiC&<7yEIKWuB1NcYQxmzOW=S_(Hn$A>t5)$p4bebMN}C z!5#|6ir^0~ZvH#LzXu`QiKGLCKUAbBY`ICg7hdaxfA^B}&l%)EOqs{;A~vr3Bh0Kn zeo-iVCP0FY&}mHcynj&ti6DO0cSa|Ck+mc8W9}sW?T9!KMj|2*PvoX~{@R{t-{roM zOsil?VbD_H|KRrrdJAqG^g-23B0H|Hf4DFe^jD^k>zeL;bVJ6#UncB3D}mp`-))Q^ z{QOe*{c#x?F1u?v*4xuRzIs+s4kTb;XZmUVO*?mK3p}gootm9F;WHmH{DA3hJ@pls z*POqD;@L{<1Cgya6LbDj(VTKaI7s|oGgyKD6#c7eH9cv|uC54rRhuH64qN~F%FQa=UR0RX;N z*Y~)dQ6w6Oi15-6$IO(Lg3g-x_9>^2ziDOr>q!S98G7PADgV6yL5k79jkKBWRD~5!qK;e5g4W48mp9kvEw&B0oedDE`!1aA^qj9 z$fW0r3RVZ@Z|w5^xBHu-UHdW<9BZp7D-ODY)>{ooUGKP)tab|8JQp?|!jJWPysLS; zd6Bn``a~q~9O-y639yg)J;}({hJ0cM{`tQv*8~o7lEF_63{_u|CNkgsu@*mpQ0rO( z>?`+}c04H7e<=}ab4n=X(JJPhKVTY zMX%Y<#KeoFl;1HbIq;@mt`!fe1dxAM_lc^ZSpzEr753~U#u7$(qE!ny^wFsz*QuJ$ zXz&*^E<3>2L>PBJ#_z^>91C;f>JRnK$kDhkCHhe2Fw19rZ~x%75k^43;`tNdmWc(8 zV1r6)cd0_XBC0=}rHm#%7&1(Xb06``np?Z^3ac+(a03hQ?d*9Ch3s#S!Vc7ulvaMd zTqjf9_eHH z?|2Bps|p_nV^;g#vwq=8XN}w53v5kyo6y(ZEStD?2-yL=&Kj>Yl?HsAgR3Q(ELI5} zw~?E5gI3HN2m!n(I>X|HYZnVXDs>7#X3&Bdbq?a0%&5pSrDqYIY7+?fEMjV?e=6!2 zUzx7}+y(;vWn{Y`1kt25M0BVp;8C072b|gbC-Uchc82r>o}VFQegSG*$!p275yop> zj0~B|t_1BA7l7zVi+RYCuY%R)hEFW!>(q)!B=LFAM>JFIdXp4=igUQdPl=#{<#cUoA9JMWveFY(-HZ42I%Y#;uwfw9^ z3SMUx@LIF?WU8bOu_O9}c}o;n6~Hpdb{BPIf~W4+WqI@(##07?W%z>$2LmmezK01< zOzr?^gRL93g&+U7(c;w|50uzP^Hpt&0LN(l55zWQ?RB8Rf1aLG%ARHO+EC55^*%b< zPCB>8Y;q3y^l&mdi;jaOpN_|iM%?SaWAz!n{-Q`Re4Chc4J_$S<`^24QgyBBNmRuC zL!qi(ZJTV1rBW2p`mlkgmZpJCt(q+6^*?iB{8zOK)H4gh-&9%?C>iBX7#NK5T(^}< zTarZ=o}^C;tSI8{s5E@ZpJcHu{P6!Y`F}3^Iz$HtXD~ob=3b)i|+hq zVw>FmJ>k(Cm2_5G*`_kOq?xn-e=#F5i_U&jAX3eQ?4{uUzb_N+I(ct;i2D`#eYc+D zz0lYF`TTdhXdYZ6=$x*AG4{4KiF#r`-&%u~mB8<4a@trKztX(EDQH$Mc@(3itvvdA zF`)*^p@SYA{`uE7iPi2-&;AvCd;8bA*9AGGe_$F6i*u`2_W3gWE_X#Eui!lA*|$pT z@4moUaHRRQvfvN%c2gW4pRE9)AF~)*h3ftqVmH@ezUhssXF_#io?ftea*(OF{EODK zy-|RB?pF(kmpx^@?hR=Mi{|V13*Xn=c6HpYV7cKW(bO2+d1Fm(NyEnL-SdTLo70Et z!sG$ov(%CXwSs|Cs{w4-^P9eYT8R9nX^uhQ3tXACk%x@3>*^chmPtlW<49%}HuZYl zHA{)6{C{WS%=-S()`cvuEHan=wZ|@|R`x1ry4NPlM2b(maDp!5QE6OFsQqnPjB8eq ztWXt`!j90HdzfW-v4HI>EeSY9L8z- z3lKk!=LBxhko^u}jRPAh8WvvqpNDrFHx42JkBrQ|dBL4Ol3l_+-v6@92v!z*vi~gF zrU`bhI^5~V{z`I>Ti~Mo z+Pa^`iGwfyVRImrr#rOi-pu7G83z9|ZWybiN;-lze$N1cwX2%NdOtOiG@>0auoI0^ zuP7YS*S%gW=z3Mq)oa&MLcSqbLjSZ^^s=+e?!B+z3*{3U&717kj5A#{E|+nzg7on5 zK|B>u_t}ZYkP4bz+ax7J!B5zCw9Iplsz`_b04QLDn9N{f;>upzVA>?%swzjS|G4gG z>T#4VV*Y3?6RnL{R7f{lq35slC__-~+LDT%?vCp)Bpu6=+Y6Ob=--mKayxgC%%FVV zQsRM7Ppg94M+r4e-S0rxe(h3+gT`NJQ@3!vr2^Bq_K)hqkTEPqbD>Qgf})Ca_6TOP zId5Y|3`0g9pM3aABQ&^$t{W?>vn7ZTlcui>$DX1{_F!zN`*=0vW*~Baw(aX$(cumc zRZc@&BvI~0RrZ`<6{yzrbON^3r(~4fseFXoLyhialGwyUDFL_yS?g57y_eK27lIs? z-c>#!28hq;?$`{_bn(k5{dtA22`Ln6PJXr|!&5xwfp(217E@mB2E{{>>}Ma@;CqHiqG+-_bZQfGT``BtmGr^23)>lRb0=93 z5a9z2U^K;VSS1G&2z$anxZZ1HN>KSkxL`_cJCIr^7}cn7?8GK(&Gxeqf8TZgHLlG; zY2jTG)Q?_4*%b42yQPNHnG#op)>U*wv*QAnp9PAFUMk`bCCu#6RKNZXlg36Q_bhOp z^Uz)FC~-@ncRVQ^z40WcjA|q)L2oHZ5_|8mV5%bpV;bD%Ud&jPjI&tslLCu>$pgXsh7I!J*P75RET{v&~2m~s?DSl3vfu+}j#mv6_NL=#u@v4IlMM@#r zuylc8ZX$2nKxxp7WwX*h-jTV^zc?*yGvY}wfj>BT3pOhAS zLDa&{3S6cEXF6}}e{YqE3MF#a!&Kk+|K@n3Rzf?b%K)K=(C!6FlTjgLx#8%fK+c~N zmt<><7$s+t@$pb@_?k)b1&&n7a(T21zeO-5UNJ@Nc?5pe2TRW6^Lx(2E#6rDuqw-( z{QUZr3Ad^%wxG6^wiHgn=>;Oe7(b7`)>`y_>%QoIk5PM>3$&$nf$$DxZE!h7s)#z( zaq`Nv8DPB*7_hYuWHo83YP?&jv%ryflMyQP`k~-ymrF)YHKsJZmsU{3%ck%EX*!}K z*NYT9>`m?Ol)+zCyt_8+xhu;7+^06)r|BVs2*LN=btdtHLA3JBFQ=MEcO--Z7b zgx6P-mVZkucs#P101eK&KwOb1)C&(iog}N7AFZC4=yJY;LusbA265rf-(cU4TIL(s zu-I0c22BR6dzaxW)XkaR;wI(@w~PY`BfbTsEppXXs=%UV4tVSQRsiq(7{G1nv!3%h zAcI=%$7AiYIu4%?_0%mIr&o#J0^)%6o_uYMQ@?~Gs~5zx=0)uO=hnyB6n7FeKfdmw zT;Iz1as4@oQKETNN(Yha_e=;o$bF!kvuON8Fy`66jL?q*zIJpR9hI!wFg707^y}$$ zx7q(3{Fh9sEbD`|lPofcNqot9Yw(_lV;9Q6HV$2cxv&0^JRW|F8$~H`hr;SvuOr;; z$x9N$!u^>BIlK4UWPK9Mg4X)2m3>cDPSQnT3Z&Zi63Ej?WmrG{j^DB(eX$!zzyZe- z@A@{Wy*xwWTjJ@1J_0~Yf|$?j z&bR{l9m?xcB^{khHwZq24^48{q1}G_KO);Tp@hXAb92M|?EALm*p8rIt)FMW-w&jA z8)(Xm1~l$<_&26MOyL^Li{UIG&ql{Qr5O?mM`sxAF|Kp7xwHB-n?YU>#5fY$jwO2q zo5%t~qmCVW(lliD#icEa2+0F{`tpwciUG-|a`39x^w|k1OBk2wLV07vj-D16N>mF> zsd{$yNg(!J7O%p)6p5sFPBV^-15F<`A$6GLd%>~Awc*>bUc!#~8-t}0tvpSPR!0qv z<#NXg_`r3hhrcBaD8QO?+`0H;ux_y-xk97YHOD|tBP=cKif-v^aLsHPZ{s0ReJ9UG z7(;!cU#$M)0KqO?r3tJs=8{0;G3ib8@3Ij)Id#SltF9TYWm0eObxj)YvVGj0JgUF8 zcbQ1Gb`G-7N@k=r0!i&jv>nJ(v~Ee%PN_i=PvantUsFzmyR@CO1nHr8Y_Tb#FqPqO zSTq1k3ejc1*v%ly7tVg$EcR6nw38&SuC`>Pdq=AKBL|3ihfA(^$kNg79Nn4r1>73o zN*9;AlD67N(6k+&sOXksnB24t56J@nC_Jig+sNt#*AeHsZdowHe3AU9iG|e*>O=8~ zm(5xJ8?)vkUQ6Yv4LlLl4|6U0k4J>y*SLeWOpfDRq9^jOa+ybKuIJyV6;BHF>YX&g znw>o!^`*(s$~rc42a5j{F!lsO*CE`zwhrH{62sPaWmv|Y8gnaG`_4~&S*M{p;>Nb< zQBkkgXfQ^Y^ad^z3@*1!n&oAPu!HKKqhnYKBgGFM&$kBDME3e~UmA057LZi{OI&A= zKW9zGo*=Y$-j>WFD&N5mM&8a*?f10rQbtxICM-&o2Ik|+08zv%OVqinSJnVMU&~g} zgLMvV%gH0-bd}5OTke+7_Y;{o$}`?IaVtDiQ*RAtdu3^0H1sabDQ<3teA;R7USZJS z;*jeija2JsfjHINo%oByE{DTOLB6&w?2QOU7gDMc7ESVYFFdxAg&N#xBjQMW1f2GK zAgKz}>H-=}iQ9vanL4>|JxK(`KsQ4wqpaeCJf9yzV-Qd=Y;ccq5{-D| zn)s*B%bKce3l;(?h^eLjWS7?l6zoyc(YSdoX4s6+t3K2^xMZFk~IoU(XR16 zla8P|e77mfDYT9C#lYK$XM=Z2NOj5t2z(=L3)?% z)r~-6vxs%uy%XS-L{h{bw-9{Z0z4!R${BW=Z?fu&w)1&BV_iIznrfI9_j3g4`)dJz(<LC?54reqcUI z>4(KOW^r05$$Tq0##J>yMz_e6{sKlMa~uH^BF3C5h^(#-wcFJOPH{8L#AJ=Al1oba z7Ws$k-F16i2T^q2C-UbmjT>4B=2yOQ!dmy#?)USR9^FzfN!X=MyBg`_@u|jcMF?Yd zS13RJr(OG+2sh%Jh((0a)7!X{31d#g<$YfKsQ^6h65)8Oy0qnfZ*ku$;@hc!=Oa7L z#t6hi69SYp zw+!Z?e>B3Nu31e_2xI%?zZX2zIZ92aIi&I_7w{sKRE%J1qbeinj5>^Ebwlq`QhQ`5 z>TlwB*Rf!F&CHd;#n{btsz5rXyTtAw>9;_v>*glTuc6;;P7=MOD0ji~-0W4jn z#JvlFME@m985gnA`F{sBq1xNe(dHg-!gHWCZ$3iDUp`nbp>?=-H0;!AqIHgVTy)Ln zL6h#wN&l#m#i^wC`V2U)X}S`*JuMJ}?P;hvthFT4G*@tvy>wL;`+cR?ZJ}*MxRFuX z>4`*Rjgo0I-D{(7rgU|otkc46To_%OxRM6NxNIM*5Q1|{1YUGh>`k67zFuAboH(<+ zYG^(1s`Rli)2qzW41X~n;=rcSkzpx^JE_FH(6j=1WJ7rbkrB&7;$0ryynJ^sDvUXq z6tJ)C^3?mP9YmJ!dm&z~2!n*Jk3ahyt2iLF-5t%Dv10$_Tz%KJB5}qZ4it^c{7ZNW zFZi?(!rPUeg>dlE5{cPz(*#Ai;-v=~0}!i(?{f;YgOo$tkEK5l!d%V+m-_hmdPN@I zPO>x&X{lJNC1_jlnFGD9Sqz}*gXD$Nsk<3}uls21j40v^>IOBew#H5hEPgT-K(K&| zac~21JirX!@w~C_d4p+EeltZLSMmv;(Cy_XQO{Mu-Z#Y^DkMid-XfXB*4(4hjC+`` zJaEw1fnuk5UC))0v$?k)Ij#dOzXQ0W(5JY@d5}=RH6QAgcX~x$GcEFYvu)&QTmFc@ zs;eHKXu83ImIwu!KM0AR#$Ay+O;Hh`flE&dqndeJ`Cb7XfvdBvV zjR0Ai2im~+EYoN{Shiz&Vg|ng2QPsYz|{?1xNsR{5dG(AUm$sUvS`Hc@ltraw{-Xd44p7!8_!$LG?ejfA z&3@cJtuA#lVHR_Wb&90j7Bfp%5nLL|IBR7@5xRek)>UswMC6HT;`c`KTJMsOzOw=7 zmg2^&Gw5`JM(QNERsl|F^oGIYO!oROv#VUP_lUVK2sAZNC%)tl3&L-{Tfb!UC8RbQ zAzAPrcK$UO8H{J0=J$2YaxZO?ZS4fzilP4f!HIE=<;sI1UA#^YIR87Fc}Q0 zH3hcSFaVHBo>} zk0@?fxpw+dxALUdx)Ks1KHO65tsvCmsgeGXB%iYReE)o2%Oyr{G0bBx1bwm8E8=)& z6o+Ia?YkjjLYPoHtNGxF6aDZrWc~YMt@Kn+SU%8@4ouTSpK`PD9J&5EsLo!QuRs1jJMIY`Qy-O;TOh#x3 zI%6kNfZr;aEa$%QM~Ko7a7>o`4-9VnY0UkKQh#9oWbb7E$Kcsl)q22&%m3~UYSlEH zAY6eOF-SKXu3a%WzAs3I1NUpxaxpYj(9(5*j}nBwGYXBC7?tvOE6Q!oPOnH#dZtT? zu#NoW8pnxL;iQa5Fou)%1cv?9zrt>{XY*WJ!i)X860b}CjCm`N6nb88{c&o%;`3~8 z+}Xyazt(?`mhqjo1+-mVpJ8uN1G}1N$hum228fZnnFAUxY(gxyBjTOINXof|6M&fp z_(=3@rC)6K-FThD0yii32$fE3Ul{#_9qrljyIi@RrCKOF@{i`^m-*qAUon!w3O4ga zo%fJ_+a;;{LWg>y2wahVx-T}^A1gg)eD zl&_FiADuBaH-mm9{L~R52;O(DJr16L28Pd=>-1N3jf#p{6E6oiH9^um7TIm-5eBY* zRc3S3MNaCD$X$V_DzHe(In$0ie3Y4kK-YQ3D;4(U*01_H zwzPK(ho)-OvrEEC(^)EsOq!4AZPGlr(L6EbO=lz>7~1@2f%x_VWC7Rn=eI)@#8zM@ zgYeKlZdu@?-1s%#+B6EVlmV!-6|EsPNLm)uUC}s(*KgqL*yFDPnX*E=MkiTy(hXpt z{#U2~u3EV?f94-Vx6|!vIfh(|Ew)>zKpe*#hLJDbcumn!*CXfTaT_Y)vKb3@-ym@F zhiaK-xQwbCg3jwsQuf?OF)NY)1SJ8%epCaQ#i$r}2#4B;{!lZDe`R%V?QI_XQxm3k z`qD1yS5awwOS1V%I12KPMc&7_t=2@x2fqNiJW}typaQGP z>b_4^vIDlseDhNzILyum`^?g_gk|s-g~t zP2~xS{`&xVP)3+$1j7m(Q)i-TY&$*d^YA#~0(>_9`@Jx?Tb)b*?r7@*>E$Bqdn(u` z8bg4dy*Djex30=}h`qW~+d20KvG~@#SZ^XYNjQL;w)~;uL@zuPzbr8?BD8O()P>NL znf9?EXG}l3RAoEJr4mG7*$LXsFy3XrZ`g3+vFlO*fwg9@oJo}dky(9N(3)%~q`;#2 zAJ5)Zp?=!}Z+^M?)=;@NgAcv$r4qzn4#(&0vxv1O_?iEEsQpT?=6ta5-I(AH$-+ea z7l0xr{cxKx83L!6+3?bJnQWTVh}KDBs9%PPQ0SmPu{Q*yG27y+p>__~)mmicley}w z1xn}gSX!Ma0Z~jJNC?v>C$-!Ld~wd(?G0TB=9bC`V@YT|z@<^BVqCAVw!)|uW4+a2 zigIhvUzi|!q1}Awjfhx0MWJp1nF|b{dJrYdIPKjD#*pN2E1)~OJdUwn*#$!Fl22Fb z&o0_0_t0&BA*c{LvAoLSp~*e|1Wia>oCsfF%$5YZOOT_HY4;<`_4cI%c@4{X6?9do zL9&MRf)it~*x6odqa@n-BkkeH!33k~VJU=asr1UP#nLNf-|A@ntZbXT)t#x%k)~yX zv~fsL!2#D7luy-E7d3G4-g`Y4yM=XczI|xeL}2%rYo6q>BpNY{_&>ljgi)Sw6kX+| zeM=;zK2e&HhSjfwvj_(hH>V{J$-wXgrVoVDN^SkwVgl&F2ma@$bH#$;LXc5JAa#4Q zZ`q!av2)SspR9osK55EF6Hb^{=qg)Nh^gNd#L{P(*eyTm8zL_^U69lp6k)r{kP{7sTgN zGb>fmrl~>Crmx`{I&|?Y+7ik8mkF|$pv!?9KlTM`qF6hhC&@n#X5iAd{MC3hJwL*I z^2&?{`ECwkf73@q6-Tbc1oM4?Z8_g*Zgy$01D%8vj`f%ws@A%*#L1s2a3RJ`u-Xgu zA_q!&K7UC5^A9P7cEW<+488f-*8^qlZ#Uy7UyD;Ji75B)4;-uvcL(Mz_zl*x&hUK z&rT2e^Ufmr9t?~$q^^kFXol1^yffC%vkB^z26ev3q1{XA7EkS>W|F5^2b{by)(a17p7ZPMBcH zZ=m#uI8$VJ8t?k_udd&_yCttt*QOvcrw+!(_ag7oyJeYhChsXFGI`0|sz`B`B^?J4 zr$_}$f9ulTNiD)JhnC+Yi5S_@OYm;j3%U(I1tE>BVm*BWc9P0Y;I#l;JCu{sM}GgF zGo>2V(uC#0+)u+v_8ao)BP?jHWa|!2$Wb3h@y->~z)81$cS)cF~Z-pKj z^@Q3}sg}Uys=6xE_>-k2vE4sYkVn>RT+=wM=noI2-_`<;Yc)*F8v(Zaf-MSOOYvpi z=@B9a=u-3b5m9;?Zbsw?b&ADw68{MN9Rr_Z=fGJl3Enp{4$RAD%8OxOFjzFC2#Fjj0k-^M3Qw4|DHu}p{LS1vx$lD(( zFU7b@k{2) z&^H(BzD7i!x=w(5PTt^VTq>B1Lxdmh@XW8fUpKGj%3xv&ErqQvBkg0hqOaJDWIUfW z8(}iLsQOlBFk`*{w>UYni43=Z-=}pf!`L~7r}li60UYp~Ut955htkU~XYz3bl|ru> z?nwS1>(>66s&@hVpj%UG={_%EbtlB6DZqky?)^litdT3IHOn)X3o~F5dm>>^k`z=A zy;PpBaeF=x@Q^0r1C|0{c=fKtp=Ip_N3Q^451w@ElVhfby0 zOJa8s4Z7puDn7Htocu7{)Yp8DS(TzlTFVk~$XBZ<5xA*K;sYH_uq4}D0gcEIyIIjB zP3=Ex5e|5%R!OMYFOhI(hdU!t7asH3w&ekzAV(Y5A(MMF^e!}8YQI`KxY3EeJNCt}@a3SgePvw+=5u6gXKfb`?-1GE-Fu|c3ukND_Bzb^Ak zBD%Dq=cDUu#_0o29AaaCU}-**TgjXKXOnl3G;u>Ih@NHUY=n2BIO&ZeQ-^b3?>4Zt zIFW^mnX3mHyf)}S-0mgSro+Ss`2E!g)#|0YwRZLFvmu+Wmo*aFlU=%=tXG~cKAX&5 znRlIUwP~X;wq0QHsnVHMnBoLYJ4gkW0yz4eQ45=9T}I>t^?1<)9lVXv&Re>f-2U<` zoC-c!^}8$jU)Bd}-)3v9Wz0b}f2`4EwYtAn=Cc&$5N9*T!mB~CE5CB0YAZ1K;YVx+TCJxKty zJj;jiu99y;J3YZUR4&6?&YhpylNLYe*gj1!x{m+&2EpDK1K}gwfZkP?_r>Mb;u&xc zZ86Y@X-bb{NL2mB=HlFTofy$I@VWadzS_a&-!w*xXqUV;_zc%2dAB4SOB{@r@dO2V zX|cQY+URlibW9yd4%fzvE2(vDyC(dlh{-i@NpJHC_xlpX1%$~Yvno$cIBZK*+VM`< zNC-!U(~sLE8Co9x!I0%0tV5ZB6qeklYA*`%yQ;qHhYBgjx}J@SU>8%_h>?7n_6RVE_ zQ^3A@l4APUf$Y)J_9+3{NG()_l4bL#D$S?Gl-z|Osk6~RkbpI>2f2C_6xZAuD`XJZP?y}Ou2-MM^r=LSJXX*zlf%Wr*IrtKA|iKQ{L zYlwmSkz)>mj3x~8v6zYh!kiu5}WCUHx)Z5r#!S&E_(Td5bCK0Y2RB{rx-Hw2AUsKM&9k zO9%A*TKk|}FMccd-#mvh7<_nnRkv;PQ~i+J&*qU+D@Sep!Sv6_8($h@{is&&>!4WD<=m2?hY{VC4vh?Sr3#;UCh_;)HtVI%If zZC(knAwATpb?fk)$JB>9cmvI->{s{?`lO1V&gW6q^de@gsB;J~-gUcvQndLv@cZZM zkUNv*uPAkOGp@*XBzfnneAI~PzeDOXBS{iUk~~$7%Z|(HQEVuZz7ORzQeMu-JMK`U z!cx8;h7_}{+Cn*@5o+|phPFwEd1-z;h@2a)2Z!H1G{b)+8Q$1-eI>gP1cP9YqqM8$ zuYhM`=A3A~9sa?q=K^FA_^jnheY@|;w7nfQiz&eY1S9V<|DX>TQq%_`z_Ku}7DG5bsLZdpO9FPM}F z{%qR@j6PLBwA-gSt^d&ifb7m5hB5fYU#=U;i_hxvY&L_kiJ9Nd>tPE-N7~-wMrbaf zl?PC?FxJKJIy_e3fIP=pdpCJoBls+$x&5S`YbUi{<>KgQ?<`WxW$!mwfzzk0S5fW+ z(89BA4St4afqg=32q?Wc@DeI{%bMQU7V!i$ZPKYryo&E^QNs3KwgdgA!=1^Fq%QKK#5rcoanA?-k~R{GoQN%m)pVhXGyKCa@<#g7JTVI z(+C^>AC*f|-|{Da3G6B&MbmW#9wE*>lBEz|2aQJ+&TGUL$If7H=jEhO^u6Pr1&(Th zRhp#Ks_L#kGr$qTQAtBusHdDe4Rax`Yw)}lroGcp+Fe=Xw%l1a7DQpIF{9~g#jpuY zy7P{~{R%{*XZ@M>-=i)PUZK&F@LcR*B`39A&j!46@urQaJA2-Inu}ego(bGg052Y9 zP=|H>xm;tNy0SR%4WStMC$&9WYLHgp(F;Hm^^IobkPDuLxC4PG-=}kove7^Qg$xIE93ay|kpXwn94^}@7flgT096#|P!}9~Q#chsz z=3!sWsKckswEb>vJUfG|Qv;r@{~sxxwFdZ1z8A%xA)>rE{Na~A17rcQ<@xw`htU76 zWd=uc3Ub&-TaJG0)^Zw};ncZxk0V!gJ)59S;;P5qC8d1MT^5X@pF9Cnqc5%!<*cq! zuY2NKOi`fyl}~lA>hbQqZQe$;=&2B{t7Y)swX$fK7V7U->QciV{4Z_Y@?q~v>`A-X z>Q}eCTin9Uc-cn$w9zX%|BPXl*Cci7L{Sf(W+HQ&(=X>(zuG*v09d{CrJoT|m7ZZ` z_hV6luKFjX$*F+_KN3TpBqJUL%o3O7U3mrXS&YJFFtQtU@PJG%OapT0!@{sa&~>3I zQl4&>zIkP{ZZK9Ag33;3ot{BXhLjFr@)j7JTt!p5G;B1$VjsO=4ZC`8{HDG-DlILm zmPDwEYRXj;K9~k&xq*9_OsM{`I7-jYd`-4mg4L1hho_!Hyh$t6atBtIx!1W!?-B{8 zzs{FR-K!Yz=f@(sq3r;d5s6hEr_2QP)rxt<$7s-p?6F z^7%^qruj9OYSeKWgSf#X;|HnOnbov@k2FW;Nw9GU*~AxI>>&!7&=4W?WX{t~c! zbe(sx9F6p3KtD{aaiE@Y-ZuR*NSRn$t88_m$U?I|2shWZe1)teN#FEA>Vo0>rbaDa zZ6M5@kfIr;={)fMh%0qqgXGK11#q6BUAS~7tVt4Wv6cKytD#>_gxRCWCQd%K`RcqM z;`W2^hDtPjqk_Qr_QHwdtP^oIpz#`T5?M9#s8lWO6lZ#cS4AT%aeFNCax#;`3~2#( zajj11L?^Y%>qBVehGM;;S{dj^TahcJVz!$rUFxx6O+JoAr_b|72`&JWOPKxvZ;|?< z^PyXvuL%pxdU&bGY6sa!Op{%EhjYUV(!dU4y@ORV+QAr`1zHj#fhvBU1Vo#}Pm@bNq1nhC8%aT)Y~Qpc<5mEmj2)CWoBpLQZ2|E{+-M*(Y`T+&%a zv=exc;YRu3VA{QNNV>%?%30x0L&1Bd*_09hDg%Jdf4xt_!|?cclEDEhoqio z0BO%0J#v8$N^7vawjY7!79dfCqlq$M*DNqXo>YX`-g$Td%84y+ zed&8(;ibItP9M}^65bhPM{$SGncMhifoMxgpr6*eg~~Q>hl53E?+t5{7X-L7vjPAP z(I2kgGP>YqK85>q^V^|Bz&6&rIrOxnie_7sFfxE@QBHylL}mVr={dgKc6f-w8hq(p zF8I?`Yz8!Wo8;plXH1Kd#@A5i2ix@kXYmB}iKt6Spw>M%U_tu`Itr%SW)4~XM_74oe9u0h(U9Dt1BT;Gb;CC|9k%0%-AJpH@ zjcxUm7)G!ojF2_F@NOobs#20N5gFMz!)(SJXJ2~)#rv?(wPM#I!c643VL0%7?R2X3@IC- z@OmnD`|ggM|7DSluG+zM33ozX#qpCtdvWV)j2S#M&CGtw{2PA#=OsG#<{aWQT-{u9 zJR*f(63}WDCuRO2fRlvssh))}Guoz+N}*kuRa1E{&qah`Eu-f+JGgP!NfAMKz(Mf!~}c7<5$kC&9Q* zQqFXQ-JPY6);ml`J#rbLy)OQV7zQjP07ka|Tzhr~a*LZS`{|<_*H|gXEk0<&qBToa z{TwKidCkOwKQ1eab6jU^5##>sdyD&hzFD-kxV_fVXoo{mp2}tV%**sQ-)Cl4lm+9O zWH0nh#>9>=hc-!sH})L`Fg+47^((i*rkOaVrc`jUZ40>Pe`4{95g?x$Z{-y7<{d;j)*vbqbE^y0X z)n#K$w6-C=IXgY{fC)2@r;nc9O57b2g`G1r$wtf%36VND$xRQO{~qWm!ExQeAT}}( z#tIjbK|gLx->O&xel7gz9ocVHy$ZhAIG?D9l^=!+1d&f855$0Mlc)x69|p(loaulH z;LjuAFShqUO18>(b`{&cBR2Hho%p%qFFy51_~otaqwa13f>YOI8|}ZX5&U=ZZpSJyp|`DSqybNe;{-k zZr5gQ3pt`c-AvV`p8b^GP}r}oH9w@m9i-Y&E$yyNF?^p&i*#VWOYiEs*MI)|LBEN( z*IR1$S*=F)4TnBLeodMhdh*+9Dky2%jxf~;6^1Bm>a2cO7vkYex+!$xYAU`;*`cc7 zIB9h`OJbmpWOMGuXfB<|MtzgAzcYJo)36A!$$vWLB>ahhPJDcb2exw zzi`lDR4-)Y`-RJEm_hS-D9h>zU(<7i$@B0DMAyYR;{dd1$LB9`m}oQpi6OC+~u{Nv6@Z0I;XLxszU+&e%Q3Y zzt30aeNg)6Eb>Fmd??un$Gw%ftlggwr69aE?kkX+moEe0t8ulD&WcyF5EXnuSdW+I zsb>)F=D=yt?fz`Y;pAaNC`{1nOBQ}?0rIN(tldRt_WUp>5~4-)-&3;se7+1LG(N(_ zXbOWytgy0DN>wmv#-%M`rw z%D5RjC!Cbj7?ok2i+#lJ-U;)YN!lb$*q7lN9Q5e&7t|lS@{5M!a(x(eWg-gud9?!8 zN%Xlm01BwpP7X z(`+Qa8|10i0ku9Od{%4|j2ZYG8Yn`z>2^n62DQ-6@JS!NFGJYSS1_GFUXps&P(uuD zNc3r1#8_=g%Bg`#pKzstIMWnJ|NRApMEIk}ZwH6pFH3i|inYCY#5pyJWu z=SZE(^$pmc*&431E}O(vgbMV{*eTMd_0B35fwz}gf&fi{n}3tO{y3ZLO8H$HyA!w^Rtnb(nZa5JTKQfiE`+-)|sn_IoGO;dzSj#JJuS;?^I_ zv^;&wxq2?bcfLfNu+goba`SL?zm&AzN4V8JVI-al^~J84>);(a$!4b(L@3HI`U=Az zN?8HxsHQad8Zamv?J2H%P95jx?I%uJd^H?95_@=EKQvDBtIU#udaWQI_fc8}eN#!q zHc0}Sr6qO#=-Z+2aS3)0etI%aT+oL2wPeFgg}y(UdwW!W_z?xa)f5>dd_ELX)P(=I zFwC?r&|A(2&*HjBVib;4ILYD|sU4K^-uQ~W@yQo*emv0|6+23LdDKZlU@=HrXmo}x zYOL5|*FMsg`k>^f*;kVf$N5z0hH5JsBF!z@5-uPR0eKyQf0| z(Oy;`c5(54vG?9#O?}>GxvufkH682kp{!S@{-xGJaN1>Fi{kw+qBd{pS@l$6vj_ zJedvdvpJ*XWI)&)mRrz#wYx<{MpMKwa4A)E{h};5HPcJv5j98 zF-DdYpvA7(2x*ZhC`GCk;MsHy=xhCDg#Nw3`iK3H7S0Eanz)NrD&p@3{fkNePwOGA z2GbO$G>raKlNeikF?h}A{663h{+<%nQLz0lKd^2#SQF(%aT~{nabnKT1#a#tqa+s} zR<__}$C@t;jp`=ZeD-r3Xm~Q~9!1<=kW)6iO)hN)jX<=Zk`rZ#(D1rVLC4ih2j&akumqP>;W>61UY=^J>kz%IUiyw!ak=XY0KKjg<-P zUkl!|Tyv7>n}=;X_4bP-M5NhN9S9q9E=zz5Xdypz-b~{96?~X5LcaA3m(2`)zFqfo zVA%n*-`nLw0}wjTonMgjh>RZr&fb~WynQ)w>(jyR6?1zV$I}FY{V2^-DB+6yI&b|6 zdReUs!27kg-3P~Mi_V*QL4|o&1oocm&Q$94m-aC_^>W*4mt<>a?jH8!jTRcwmqomC zmfGqMirs-9Y=H&7o`$x@;TzIvTE1osnJ>5N-`i1!yuq4!mwHwG+@aoIr#jUp!>m(z zD|&=vwhfLD>Kb~_+{{eJx;hb8EjHw#Hr!`^ZM|e)wt3Ca zm0a6&+6883FnN|3f88^j`JP88A)z3Y^B=r@S1vf* zsGyD&P^ESM>(#XT=d1bmM$kU}mvn;f<~YANcjD={k?Rk8)3Xyvh$S0x&h1}uCF7GG zA^X(~t;?r)$y+vfBySDgGCU@tC|kHtrPH1r@XP0&mYA8r#oREyiO%UT8n_`{YY3M( zcZPOnm-Avrf?ifXHC(_Bivp4hy*1NLejww%4M@gNM7$f;aetuIs_qEEOqdRh4iF-Q zs&Ge@>JZ&%*hh-(=LmuN zC!&Vib&J@Z-ovwLhwp`JYo4cbg=yaJCXW~~Mm{!#IPA9`7;d-RVMEt8zcf55x9SiY zo7U0vepaxl|7Rr_ok)`jnCR3E1zL`14H_}Paq!vGaPJPwUMW)V&{uP|zL@>XRD+hYhvxJ*kjv2zH5H;Tc4)>RE%)sU_%D`o1 zBPw&r^JIw=&K(5V`)KirOMU8SZ`r9-l2)gfF}fPdS$mk zebb)9#!zQp>um18&vwM6-dUW~x!{PfYKl;@vDO9Lu18gqs@vW-dfhZ^0%@FBMLHP| zcHFkdaZMj(i0vTlE)t$acR*OYs2U0a7I}aAdViR&uetO7{lj0MgAw{L=ppaiJzm%4 ztIOA8(T+GQ)mz!h8xSV8)MrjTX2TaZq&Z+nc@BFkV(g^>ci#Z+rp(D zNY3SIQb4z6TMWne-t;>5>-%NAZI=jCJs#vGeFKum|5&ePoHZ(4`lJ09!O{z(w4}oE z_3b#MzhAzDS)|3*(aP;tNmnYJA2=6yhmzQ07!(b z6HNkE99@y=Q8yJyg_Niz{8QcVKdrca`MSgnPVb@XM4~t=j-}(##EXLRWB)w9-(qu- z8wpQ=edb-l7|FiYOo4$bk<5J8kGGlYkYKdjSH)lkhy4hPT|-q}M;=Xw3BC#ts=Z*) ziqtmRm6N`LW$vR9D-BOLsyN@W&&tt9yth2g|L*A-`xHCVlke_~X2sw9Ke0C6-hSAD zc-&dez!f=swg^wvZ9H4t8SNCPx~H;TDcNw%n4R?o-QtfUsFb0p;c-^W&c&u)x=J3> z^ma>6Ge?O_MUnitu@e|ZLp>K9**;J(@4RUA?gO|H{f4@Y@;mBHn~0`+z?l^65yauA z*mJq02s;wVNvuC08X~peCd`epRU|q-%95|wz24h51Q5nO!&}&qhZr}+N_DySa@%OB zc^ru>Nuu^vbx1U~kR74RO>xiKAPU&on!E%eo`x?oJM=KU?Eti?9PRCF(aSTD#|e6S zL~DczxYLoct<*|Racf6)cPNnh=7Koa2GpCfi%DL5LB@HO#141U*D%B3M-62x9JeWO zD!qDWQU{$%^3MK+C@d#AX%d$l_P#I4>b>jT+dJ3r4tAP^ z*XNah9A2}|40!g+9oG=}26xO(*$Y(tTv0QbRC7VJdlp#fpF+Y{THrtdW?qqUcAvy-BhmdYKeh4L1q0-WJpJlnQ@+**0~z z1bt$tIncCba5QB>*mrP2E_YQbCu^;gi4G^&m?AyIfCu2Bjv{dz(5dNOD`4V^ z{Bs7QA1KV+{x)op+G?tenoTAg=$>>-1y`ThtlU&r=)#x+SyFtnFb7=!$x&`4ZUHF~ z!S3!l022k4F;!RlfIRpC`C4~xJkMV1?5?U8rk8vx<7O_^mkzayd~1zQ)5zWnNnLsS zfuUNJ|3)|SolhT#%%9!pyW#5smkm+GOn(noIUXm(D7Ho0qFN37FjE@W|~M!>;{5xAF49Hn8DVKICofcIxdB zFEUj3{fuO}-R7fjn$%FUoSqW1->bkYe$)TU7x9St88NZ(8H8oAy}oC%`h7Fp%?@881be|Q*JTjt04b*{+A-Ldl5DXP6X zv`!``?vZ4dE%!kS+g$0p2=}6gJ#m)6=6WWyPCXIZ*t2+g}lM7pmT8wpa6D(ZRNl{P=M$ZCaC7@Z#h$(2D% z8YY}5I6LqBGJ1%)u77=vS;1PiZEj*~@R+6%ki>n)f_kIrMxjxQOx=bh0m%#pwh0RG z0`nTnhK+~jbk}0XMtt{W=30qUBv15F3(WO>~-AN7aUs>4l(e0J;OkD!x)1IGH!Vg$H|H*0VF zb~@UZfvuQv#dvy&pYisiopYPP_Npg7jn=9~Iz5GaoVyiME!!Duu(Wl2rRU)$5Ye&V84PS;#MVb;Rw5Mi?$R0(#wv-=l z0lkF8*(i#sgEF_pj?TUE&m_&JU_yfZ!Q0il*jWpv3-MDrV}TO7cK6ekaq)cK?vpX~S*Czjyn)L;eqZLZVv05SpM-#db{J z-9wvnZh_-Bs`pxLy0FgSHT(UzFXrWQ-Z3uL@3;}aRy~uaP6iKy)Oful2BGTsJm5sz z+NN($JyrTtb^vhtFu$N4?I`P(uldpO@`pS<1~02DiV=?kIXC6?E`E6?l5xTT zwfI0umI58cMNSJuY)v7Jvg_Mh6?m=r|Ox!;W7Z#mS`n|N7fYaa?dlB;Phv4PThv6{g zfL^dn%5`Fn*+_820LKLfT#hKSUY6VSd`JJ5br;8=hk1gwRy0rQ8UJkUJ_%wAPl44= z3L@u{7v`Xc>z|?moF$t@wl?6P8y48MLcBvx5Eg%__}g0AZZGQHH4W3VZ`Ir1m9fq*S|o_8z3cjrH6--IOvZNiG-7o?eFRSP=LNN6rh|7lhkU`}5K zRCr&y987#apMFQg>Vnn(rVB-4)<3zq-}RatP$>ea5Emu}7@j!IqARJ+;9$+}*EBo%1p*&wVM?TBpr0xVtQ;sR z_>+*}QL$(p9%|5a+)aJ3ScEplO)eX#=(Hyf9VgeJ3M^N-g~#4l+yXLvEMstJJe(<& z*pH(A$G0hPzB0=<)N#WE}ujh%R06T*Un0q>!KJ)L>h zHW)}`f- zqC3RceGi$;ssg{1!v!@3-#UHcTr|af1D20RC#Ca9lLW28(?#Xp-cEb6+QbKZR5l$? zfj#gQ1uO`AHb{@~>1Exp{pYt|wm|@B6pPe39Kny^Za^vwSek>0vFxrOof;&w$ zyi2EqVec_#TmUZH;5#| zF;RFXpd|>f3r%Z6AMZ%rSUdQ+`niZTclTLxCinC>i%51B}ijY z?2yItkzV4I4jId3BxP8UGZ&>P#JPn?Ki7W!fp318I zgsktyx5ie;J`Yh>6F-Zp?*-*9(2GWss$LcaruI3=v(&=fuo>R3wP|aH1^P#fFCZud zINk*&spmiLtMA=VH-Mo|V-S#}E5HBQBJg}U6vlJ&SL~O&!}!yX&9MK#$m}%~}Q>aj(30JT7hbSMbHKF>~n^0)dg;bS^%_ z_a}_bjQk}mvH4cy0-ry$2`!s3j$Tztt=DDQ)81}OrY%Y_D!(l0zrW07mf=;dL&8v_9t;zUYFE;ojCb zf9>TG%dUDMwWhjPboz+6je&;$WrsD6TECHacVAg zSZs%eQB388?W?ef$h&m)(t_iUU$J$}VULMz6@|5u-J>;Au8e0c%XBp>IU3K z&ioKR{n~l@!KICb_0Pqv`vvYa(|s^~j{d;8s7b)W%OeU-lX0A?qPWFRmJM0qr3?!7 z%xs)Y&PXA!O@@a}72!>S17g~z!93+vjYdBm+TO*i!?X>Y?iX{7mWlPt%}@}adTs@d zkm=j4xNLMW)lR(2i_zv*QCmj1XG`er-*oLJFD>e2-qbNzupg7Z1#73TQ#m`iGVE=B zu?lYGQ4B&^d_NBTJ6St~`6iM4)hXKjzl4mai0(^gR%YxIM>O{xCjy(WV@kh8W|mGv zD1uQv@{?-dh@b?4;6Ge1MWp{8H4}0!1-AH8@boH637hO1HNAi0xqrEIz+MUkhcn{P z!AQ`IZ`f|qtg=T|Ctc4mbtQgl07IXOYY#}ANhEs24~tK^6`hbY5JY=@k4%Gn1$X!n zHVUjf*Y_f6piF~W77#M3C-!Cv+}GC8+p3*x)&pr?zI$ph(P%+vChFFP09R**xI4 z4NPC{dy=d}IjvF|) z!gKH!NBNSn?+?gO?&2{GgV#z0zl>aVzzu?Cx^-x8u}?vn#`dj%j~_xs$NZ8g&H)3G zv%C4svhTy9X<^l~x{rt%?Eh>7&b2nuKy^B5Cac&bjH6&8Of8Rn%1wB}1j))G+<;c! zF>4Cc8BbF{XzhO0Zo3iE*v6yB^IH3=Y7cFLltKw@-z#!Q#FK^>=FDd?;8Z}6Hv zL_QKRy7aN{e4Oq&|JXg!`NUAqy>QW=*bRs~GNe*;0}_wm$s^c2PvW@Thu)c~RjM{P zU8ivi8}j>)li#wdQ*@iZhJ&VH_TPj zDCfPp+sOZ3}2y!?iWWg zvrq}3d8r?YF?<6wbl!RQ>>>KuMS-pg-p5>O)ccf3OT>K|v-N;$iHi}a=*0-}&UEOx zU=@^XpDNknJ!A-mBDs>y#)xhUfc~e-0CYx_0L%I31sHa7G=@^~`ubm`C=<(&S;43T zcb_D9oSy-Nqj&nva24!R8!{fQ(bZ~j1LBSlm#KOS@?!T4nLD$$6A5@1hR1Gk-MyF3}5rwZgq+yu)^>R2XtHZwcjsgkO&3HzZV;*7anw{w?U z4uXVG3ujR{j@Dp34nW!HaQAKh6Q@^H#~N?jeyO6E6(y-`6{)&>O9kH*+#;X;(3&hD zb#T-N+u&WbOWpT+8!E9&u5878-L?mpfCXhX15s@CY9Qzya4=Rkb)68#SZ=Tyc`5$h z<3!~A9e2bnC$wpZq!S zx3(vY!7Ref=5BS)(L#p@)UA8VM7Zy6Xtt!hFnCw0$`&`bSOV*5VZY_(bE~ zcw8K!qll4wu$X*r6{wdhBp9*xBa#2=jz<&o{}^ zAxF0+U4ZSN<5RcKMEOZ<&MI&hxKHO1(Px^~u zq=T@aQ_V0W$3OcpMz7H!$MsVN=aA&a7Y=8STt1I?4(z1MgiT52bbZLC2UjQ4S|MrTCP#E-p8|m3XhOTbfF#h(~!;cHf%(IyL)0qW5CL5eOqPk z&ekW&J0Oz7Y9JdNV5jpKq22lf&+S(N`yHJZ@ls5YG$mrpX&+pFB|r9Zfrd(3rso@4N8`r_SKL&!>RTKSMvd+Uzn<}3LIb>1at)(}tH+=YtvZ~%QNv|c&Xutcm@|AIVP&sl&>Fxvhc!uW`vodP_ z0{2Ah{>)Uee4`f!b1$U{JK(6*(#Yfa@(4^`yqd4fHU+*tvzsadNW=%6&zI^{~tvu(7-3fIZh&wRFQLX1z zQocOcoWd_}4CldFB{O5H2Yd->ym$85n`LCviIe%o^oA%jM#bUyVke#+Dn!5wUBi8Zc=>XI_n^8j) zI4&|vkhXbY)TcWDrE$mo((beiH9^UVFY8vSvIAh$`+kK24FzS-qynA>#eAZMIg1{; zf>ej(J~Z`})YHy@97jh!0Th(R$A!Pmum)*U;pJ*gT$KX-P|zuQAm@QtO0T4dPP{$q zDI-+p`dJri1L+Yzt8IBAwP-md092fr?L>O5aumC$exiBJ%@J!FP}SG8k}<#)ofY|c zosIvs&HIY8&2yBJ?2mk}}5!b)RJA96YRsEL)n5jMz(?M#(K_VOG0m5u-o| z#gs@gSFf{yKuWuaF9sx9cXzXhZeDdONJ+jMW@HH!)#A~hdQG$#dwcRpM!c_-A zT3E~}r7UK2T}Iq6UYDl4*a}SDL3MnJaDOMO;T#@qVNN!Mi_)>cvES`F*34gi_7#Mk1FWa<6F|Hvb0&V^|&EDfi!A|rGw75Q+q7uo&s-J+PS|RRNK5N zkpyZR2ijsCW;?%~DJrV*#p{;|{q_K3wgU z;U`f4G&5wykiPS*w2I9e1W==;4XU8k0rmC^-2CO=)m|bGE5k-hA{vO)2cq4JsS2N} zao5{weeT$?fG3dVLQG1dM)|q!rlEF z$&Zur4z!Ex-*Cn^Y$hDc)qXh1q@;a{Ltu9h6hev%Dzy39mWGIfL2%};zP@EhM=tve z%s3)hKRnMyyV5*=>))p?aie+)OMaQyVk`W?!YCxX2ee-qNZC_F7CwxnW^1UW#8McE z=RfnK95UDRjeL`-KU#rnCpR>p)AR_sViAj@NZ1ib(p(v(XY%^J&)K1o`%Y@ zvMvLJ^VbQUjV8IM13d%a_NnKj8`2}5nG`lm@DeE3?%XVAp%tH+&!P9S^grUK|10_9 zFiuRLbF?iZ=y}aD-Bx*KC_BPwQV-TYZZXdug?@5W;yIC22ZdzT1raLuGA*oAU2<#*i)Z2(zXtIrzXaL3s%$yfv_b|1reIksjH_bmU$j7^*4w)M{Mc3JYp!A&?me)qzx?r$I)36I?D$CdjA0Yn3nMqN+Zs`FY zR(#U|m!UT%s$CX+&V&i6IpC~Y{emuA+aLN6Z6 zAl}=LpXCcrr)KLfJ+{1@JPu|7oVz(s47*M`17!xFVuEdxcz3cLP8-gdYqN9a8VO1$ zm~Vh@&M{VcicyB0(*(av~T-y5jX(uz3YZ%$07^!2MEwcB` zV=Y4r`f=Bjw0+D2zzEgtow9cxQ99z3GeW0xGX+{;sYRU!@I05AE~ct-BBHGqhx9^q zY!4wY(|DH4(BQ}(1itsq#|9uziW=1Gs_)vb9RIu*!h!oJ3C6e`cFo8|6jWze>a$WA ztmBNH7Ed^e7h}h4czBZw)k8ArZv;A|T;wvomjFfvCjr;7wFnNW2`23wrtU}Y0pNoN&r-=8b5jG0 zT2I@};hSH-h(O{t_P=>E9r=TRaB$o+Yo<$XZqLD5&6#IVkV_*ar};r!o5N{+4Frjr z(Sf;p_0U;DZH*I%u5KY#?;{sbNdL&Qfw^onZ9Y#**-2 zw$ilWG`@_M$4w9tUR}eZdn|RI8m^|>@6USes=#m5_iyU;?;iNi=>gg!AAiy~Cl#H7 zd+e!CDBGo}ID2!?xoeP(V0)TlpOG3?EHOorZ=eW5=d{6~RY(T4SyCzb+cazM`Z;mzV@TmbqWJQqKB9qrl(XAFszss^q*zKqK= zQf}Vxez`N-O{R(x!w{b4Nj1Qb_6HGKo|_fKdCuX2 zqJgIN5Fg@)_id{`Le!3*pv}AW)z`@kQ|EIl&?wu-J|sdUSrAwL6_lXj*V{ZrHgH2`9o}SMcLC(@hqZHskP#oA4f%woH~BU>klnQ?_qL* zS1N}5%m?yhF5%csQk3TJpVqU%UX-Ypvzx^R8e# zi@($aGeydI9vWzQHi&9?`?1xzQ_$?;HFs_>Rs_W*%bvd9q4MXcOdtJ9H<<2w9+HBG zol`-7NGJd4 zNwDh#*vEo>DW~`~QbNHT(0NQN(NjkZRijHSi2hydycW<}QoYTS#Y z?IY0Cd1oG|b&gn#c?;S1kJEPh1I9O`l$_-HyDk$z&8xp?=Hzbb@p?wy;j*ysCp7)c zmaX;L$xUi;Z7PY^A#-J;_s|r_&pZD0ZECyE4&OO(t^uJ+PN+#vAADF={89@ID(~mA zpyE!i11>JHIrloAcMF4riRm5BNF5>Yob2cHJ}u1VJqRBY693{99|gJOObtyMi9c~U zN9MNli_lm9H{|hzkEo9!`YFN?EJrI5r$&@~Y#HB~QPecDUVF$>5c0!>b@1{QcDro~ z_>PQHM?jZ3-H5=2GmQES=9-%Ri6k$4(7)$TU}J~LPZClW@x%b|zq`}J_B+zw?*_MIir>8YoaaO-aXNJU$9>l_K{!65+I686OyuujE8Lp8 zP#zUgB{@96z5DYjolJ%?m2l z+!nHF+z%-DU2FqOMs|v?T>LWjBU5;3($DCojmTJ`c+ly>@WlTRv(`jTxij~$=+xf8DqYT`p47N{h^pm zjOMki#5Xh>_1s{*&Sg%2+6VSjI&6`7E;J&AV)p1k7??5^_PseI)yXESikt#68P;3* zD==?nx|=n;P$gqp9Nxj;-9aikdQUU6$d(j+U1bIGGsweztEeQRCN1yh$VnMs4>{-K z)CT}uQXHDs)CU<@k6Vn+^mq3)Nwh@J5C zU;_`%B*eJU`|F=@MxUMBOJkDX&tBLQ*~jL26UQZW`Brn!5Tq5ad_L-4aH~kK5sMgS zeZ4X&J11PF{Hs#0kM2dPQ-0FGji&WHam}O_c`{I&Yo&|xHva_A>geWJO0hEn3%FhF zgY?6W}f zXJqRI*=P_DuS*m>H|!ZTQ62&M0wiE~;ps2ba2UNN;Vs+WL5ANS>61)5P^+G2k>{Zk zdvpWvVE()8T4l(TI=V%?(IrXPA4)v=@3`Q}@r48Go0A7)9s^!RHB z{p=G1ij56rQ-~pzJlP7_Q?*N9o$T8Tzn+x@(Ems{L~HEzI_|ncH%`Ny6=ohy{pPg` zf}Sj1l)lElIkt!mBuV%A3(EHFmtAQ(AZJiA{;Yi9+VmRlmAL=Iaks%gL9(VF>OKrn z8EoU{$M|d!U(!NK{uOc4fnM~J3ru!a|h+sa-cU7nLJw%(94Ba5s0t@6OQPQIE> zJu=RtIEG@UnBt)cDorHzNMZ~>zpoMr2Dna9WvK}-{vGfBHaNn_>3-F7_bfTPKM?xY zW5>dh746PvA{TM2??w27O9+Y|(Y<(Ynx@sGpb^U%_tc~k!{hxjF5!`JM(Sr*GreoP ze#cx#*)HWOi#1La<6}GnH<52oKE_p~Zo25^B$+%5`r5;BPp{Db%E9||mh0UQE+~8s zJm;>nx{j41mSc$%Vcmf_9T%d@pTHbxIfGiX6r!-CYtmDEYmqiQcnn(qig@$>E8^XQ z^+8C3eD@~EcatSALeFs=6QPMAJ|F1?B&F$wTW0GElUt$ygQSwtpQ#RWR&!wBMdIjx zfaOaV|9ysvKjg~bK@x1KH78ck05+aC=)_0&5TaaMO3sKUIi^QxFWLaX&evf_xD_D7 zW)I1v4HUD6Bw6Ro{0NK^iV%xC=a`=QN|XL}MYdM`)i9ujYc1IMC2^iYH~B_IqN{>F zO7ZG9;TUO(Zj-^pY=`@Kp({%)RrrTb(t4lXMLGWF&>m-r&i_!aUpOs-YvSV z3J#0+R`-R+JW1}CGMzWfhrk)X*=KVmQ`k@zTyJ)`WD*(kusA0jwe9rMFRx`E!k$RZ z_`>4Xvc0=ZDlN)AG0EnomG&L&AICbyW3BD`Mg{xV-`(vDLR3GRc>#)XU&ZOjL_U!g z*k~;ufgL>?WGsUw7mfOjBz6>?aZ~eV08l;r_j$`u6Qf{8t5I7$+2FD)%RA*|i zaqJ%AFQ=-x$h3@sBbw@QogVBo3|NNs1LZffz~kH=2L*=nCk>5b-+`fUor51qj$+J8 zX&gahJapzl6bi??1N{D&%AS7$4c@QS2nxrNzAFtE^)*Bbl<5ziD6VH~whyc2=FLqD zheFGRDl?*v^Wa`Q>L0;;MLE2a68@KKU>jbH5hyH(uxB(z8;GF5|8pd!nHh3#Aj@9$ z5p9k=w9LBqVB<~oxT>0NP)P+UHeWF>ChwV&RBeK6MP}C*qsxFeIw;ysSe(7kS|#p(k*ecs{CPyIayM|R>YMLp)!J*f#AG`{6FAMEwb0i)BX`gGF2O4 zsVGLy!^4SKPp5d4Higxg!@rgxRWK=KB|WS3_Ee$K7n>3?l_ebmiWJrhz}se!VJ}tB zE4^7b!DSo%d?{{n{S~Ec3s|YnFeco{7DU(+T*}c=qr5L2>JQQ@`W^S>&aRpJZ!M+U zFO~5BD0qEVUBvZT>ptHC9sgCs%>nZvpLUD*&>hEN)O8{7I};oyUNmI_?K!Hhk@OB{ zhWH#$w=c@8c+QbC{^rQh@RLE@{|dr>^M4D%PGgPPvov@>Rces7-)y8y$vWn4+$M8P zeDK~fWrD$T9M+PnhrUj-+R7`hIMi)H8F;3KUC{1rJd^l{171|g}&SPIO;m3TQN}r3q$GS z*BtlP`~;iy;P9oRWVP8g_V0!@T8;E<=q_0gugeB4sGeGhmXZoHCkx$sd)hrUM%G(gpA;CN>bOKoRzdO`V+Xx(Q(*BVsA}(K z^kOM|Ba&UIe|BOPWaLHu14h1r8he>cJLV5v{|}A{)SvALI!wEM3oM5u`{YV`szJXg z`_iTj^eGpJU5!00P>)B{AE$VDwxVF0gi?BqhX=NkQ_IQ_Ps+QS*%52}X70Gbe}m~a zo)TXXWoI!R=RcBceOAkDQzyx$;~`2%$twArQyvQr-!4yjvMjt!{RBwsof3E zA@A#qCtp$j?`eA2e;Q3MiG+A7*5SgQt_C{;zn=DgGl~BWvTXK{W2F-p9pi+sb+@I~ zgamNO0G4q?8T=zm3>4MAHS>t`GQPf7re(#3XBjNCT{&|3t#uQ;q9cpAct8Bm@`3T0 ze~h9O-9_GDq9T*(Ep&3e{1>_$`qLR&?(g5iLcRspSbo0FR5#T=7#s@%`Oi0=MO40K z?l7z&1dA-|GzQ+uD88vRfW337@v1cLbe+n^$n)AmG(-P|Tlrg6wU?x0hv^FV*s1R= z8~@3|5EFY>RDBbVL!c8fXe3{i4*oOGQpJtrU1V{F6*GYYrIHQKiCvjcmaQKPh1qtU@ z7&&p<&oZ$V)yjr|wthv@v>eH3?&K0{$WrV}fn!8V`mbmyHcfu`t^Ck?jwXUrrHsn7 zR()~!t|jq_#Y=C3ONq8T%}$Zc^(@)WTw*iJdB4W_*A+)I^2X=!&y#%@2kx(d1fFQVhYgYAS8tEF>M<>v0!NOlPSLc$ z>t}8zd!xXenBVYj)jJOV+l^tQlT`V@Wez%10+aUnWM)mA(DI z@|spftH49W`on{~BhUFZ6lA}|*jXmI*H28hltg zM4!g8ZDHzUSMTe8;rFeyL&mDokbfl$kadb*&!c&auACo0s*Bbl+?2u7T4^tnBR`2`HAd;G)ne*lML4T^{tbi4`0^yVkn}Q1) zU8zZEQj};km2J;?ZUG23Sb`6cnrC!;_kl{SH*a01y4log{Ri zTBvmB6sZLw4&joxHq@3aTur5B4Dz|pro790RWL2EAka~h5{xLMOcb<2hqr5zdybPA zK{`C&`sHD6_By!X?eB~OE$EFN=i~QGL?e9*s+Rd&o6nvb(0mIls-GXYtn<0@!M<@F z_Xuw$s8xY$>aJ@%%8S13Y+kl~)l4SOegun0+k3UwroN|htO>Zx8Mlq%Y0fUp+-EFMW{54D z`4#TMQ8gbNS=9%a;b7j~ygmBco2TZVNEOA-KA0B)rQnh=rvp%oWQ^r=Lv0(ULhk)~ zBRCSak6D~yRMmipPBOE_YEW(=77vb2(_oE=#QQkg()uzhg(Ib^hJI^HF@-zgZ>FA2 zm4<;MlB*aiO)VCo=g6%eBZ9z*J1EhJdDGCm7r?zzV&Y7?Gc_mI3B1_?W3ze$=ZQ`< z7;0-l_2aYYgF8tvA7WszpxDnNq#UIldLiMT9B_#238_+8tEdGzJ?sqP`gwqR?BXnJ zQ@1C+Dz^!8Dr%99J-w-AAP492*gTv^73D$W2qryi9LC3&@7s#yVg}U**i*TZ3QI#W zW6^x8ciu9}R=pMfkhShu%)$N;W`FmXP;cXv64G8unY zc`}srlOcX3phF zR0&@~#c{Q_5|``M^tW(WJvKgEZI6?PgJr z%Ox&6bu%93FKgfBIc(Hk81HOa8tLsJ0uGf5U?ue{%e*{C)t$~{PVvVM-=9W0i|_$n z7+HheXoqFn(t8oGnXF#&Be#12ZwShmqnunM7Yw~mz@k{T9xgSzej&XT2yDp=ilT~x zy%Df}Y6~&UI{8Fzx!NSUFut4#*Vl8N@Sa9ZWf{CBJjgYg)o+BIlJ-b)Rw*`MSU1Li zx52y@a~QUMIN~ZQY7v2MR;tCa7Ofr70~JGVh}6jCs+s$jRk4k-M!I98;3@k?#nsno;%(d_y3Le@qYKNT~(uMSFKvL=A0`^ z)Dgrn0{f5pSWsSq9D4|HldJvAPQbX6cNC=5gEuJwe822Ck`Q$DRB?UK8`#S4Rk*2i zs{e6KI2GOzDS#q1)t`Q2_i&4nj)N1JRISX@W$~$1AnlF`R%ek=1lILf3Eq;lYV2_vQVou-wfG>o`|d$T#iKl9p`C4IJ2j{* z(U))srEY3py1im^aMQ3+;*C;%iWm%N`>|wG&0Nn3%*vbI?ry4o-<{>$i7c<;%xBRI zLSlzE4O8$CUKuCN8y(7KhELKacl*!Qr*Bm+KH<&Nm~f8Kc7uy^X47R`mA|-8YhFCj zanK8gLb8ZOb#OAO@asbDP-|Hu6LNR>f|oSQ_nQeE@Ictq7OA(??r7TO%LnR;_*Plu zyL*wg>h;ihhn1A3P)GEFw|dAsGdX>^#|-}Dqafd$9o2Dg@9$xb0n#?qJMw%HvA2dxH~1?a)_e;RMiUocd@T}te0Dd>ezyc^^Z@c z(YmW??#JSQxO@i*O}S#>A4p-h-*29;uTZ%}HI&)#pvtRTOX#mg!KpHJs8{zAIQ)ME zy>Q>4b?<BgUQn}=Mb9vQf$eIGRh=MwL`gCwBJw#_Q;_QH+yH>zI7P07_a z2HNXtN4~~&AAf zVbj6`+pIdqUP`@rtx2W~ti;ehO*umP2%c{hnQofjbC|cz6+!f53>05SX|g~5{orK$ zns>)aCpXTxeqJfbv-athYtc&I0btl4)$iQX$R0@4;4u7mhLu7)Yv)Ec%TaA;y>744 z5KZohiKRkbe)mJ4-hl66s|?!mTz0AB*jp8wBy9sWsz3R(?!e3gt&v-h-GT%zxZm2; z&K>I51UH|uVS1eMqtwfn7%|LTpKF@z2G(;Qm&lSW6|jon>qXSXa4w$;^FF@MHTfch zcrnD%)0;?$_>gtI|G09S*!qL`mTi){(2!G-tgldp4(*97UZWi7$AS92MVX~F9cshE zYOJjZx&kNdH6esqzE9(_2|^s$)%&a&f}9{IM*m}$<)Bs_&rga~2G_d_C4NSD9Kmxf z&bqple_e2NCK&4Iz8~q;d7@9}^`R1biN!?)=?do56#Oe4t4EJlPm91#cLXyXj;^3z zR`F7G|H_OWXzQibs;*- zA;35OdXTa(R#XPhx}Y4+JYg^lN!cjAp*}w~LA|3|xng2Msa21OTJ>v+8hJFG*}Nmw zlG(Ipw@+9{;n;gM_OmQ5K&ny$Bepr)A6z8VS1g0>&+Pzuf0+Uj9Tw_-?qd9d8=V42 zdmW$+3+p1H0$Pr^m$PDIQ>gO(Q&asjmvp5sL@QdTr$owv!b}6Xv40m#JToNA`^(5i zVfR_vO=^P4W0N?!o%5EsOO=4>UCnzppi#$7(ubCeb0CQ#D!eW-wvRM47` z(n+GQ7|i2W#2a&YB(Mho&$-Ux!0k=!KwUi!l!S~D$Q>v9K8GlGXru3xUIGwmYBVX2 zaQ!RR$ge~P_i77fPPBs+8$IK%#Phri?>^u%qfU*1uH(Ro(Qk*6_4Wq?rby_48k46+ zUyOg2W@Xk>JU8aHn%H03a`n~a#mJ?#F+GE=oMLNp=YJs~U<82G3#*}>T3dF-{_M1I+cM;`pVr+~#$GHmuGsqxRTv4Cfg z4`|HSEY`)Z6c1I3N0Vf}f8IVV1)N^#uHIHKr*H3hU!SgxJILpyu;g42&p(#a;` zoyP#5@mO2Ljz4yYPnj#YGFK9r&gzUkSxRMmiVPbgz@r#kiSgGL@bx)07stMGq{O1& zUG`Qr^JK}lxBbh|44hqS8-f}<+lJ&x1Q9HYJFi=h0|xMyFZa7{rt=#x`F-Sy_y(Bc^=PdyjO+Xb0Xj-q8{t_ z9z+49gSTwAih3KFpVNLTy{}q07T%}~-0qLFJ*yFf=D_8W^%d*!vMlPNH+#1e#F~@} zWh+oGNk~-UvtEWtH7_GeoJZJ7m`CXZwO1N-;T@4|!i%3#ra9_&9{zoYYN3NDtJ6Fs z%l#?eXoF_A@0_9BepXSWiEW8M)X{btIy)oEY=9pkh_`$fcR~dF`K2vG*;Zi36RGu+ zJ9nZ`$|WdTU|OuHa?flC#R->*<}RJs)MgIqd~vf^UBom!M2KX)vXi}R+qA$iTc}ZJ zS1()pdiMCx%~YWEzV;rR05Tsq6z)o#xU=I%b?n_t11WHm;c~apUVPar|NZ{7b6X1t z94epq+EWWp)45-vsl7jVXd+rcUjRy>&c7i1zeBy9kSa?n#C?aQmynCG%OwxhTtOA( z<1tog#am*IPkH!}$sN0458kXYF@nRCti%70=crUtgIj%QgjPMg2;c{OKvknAXjxYr!>`gwypM7htWL|fxWOaxMvs%ZCPgQ>liy02b3?{X{HUe`T)zJ6(11{WNPBB~yE!;#lh7X2W;uZZDP!BDhH$1DfkUXDMD2qZ{mT3Rk78PIk!o#)jnq}8{BFw&wGus zd9JtEWiF3e<+kyR0joHGhPXkZ%aD5!}j+?!RfMa4$RiISLAsp0IIIv zDS{2OYJ2-@A9cH}RU%L&10(n)O{7x~9z!t!?}v^t!05_JmyXi?TFz}Wr1F#Teq0Od z4BSDafqci+U{mM!X?!*WRG@B0X*^JF0>;S_` z=BYa)K2wWUw{*k&z+=Fu7p{qA!Eyr=l1jqj{;8b2i17-tUBvt?<>kXEFgb8=oq5Wb zZqE{MOX67hLKEfNXE?Is5e^~8C1wKtTm2Z?FMnDEYkVSgpL`l=<>p-;@e|8_0XV3R z_(j{=sGSzeP44BK5`I$&JH5F?;kGGBxm_PI6Fy=|UOtinGBB`xgXd083a%Vh#Nz4!EZDt?NUj*ZrQh)eV$C% z_C}r|xJ$g7bs)rhRTW44IAIBMX6_yC_D&H+N%Of><+X< zDqwlQb8_b0eb;_}1Z{jfyinrMd4aSxiJQDyzvw5Ma*F)dNp@?FQid)b?lfx5fEs z0m}a-kEiJM5gmP9>Uv?aFM?qjb*H~-9X^qp^m@xb{3F&DYyBB<`$V8pk5Z920^EnP z1}ol!?H&h~-yQ6=Aguz1liuF(1Gqag039fI!O}~!y9}E;o1yo6c^BL{zyl=s5e&3a z<9tLuf*+6?xj}${YTk%v2N_V%uMIk(1PH3uFX?sd6Lsk!mf1cE@%!7{a7HD9bQEAG z6$wOIu&O*|HK+ee6yGw`ciNiPWy^B(@ohb5>o!jnbGnt(0vITITumq`^Jhu3Bq zS3`-_KfEKU?#A8vEuy&|q29w^anm+n>XLVIi{VK^=uo#bw_gI><{F;Z`^J&qB zIu94!MtKG5GYW()g_2Tbu)EWlAE@S~HykafC8(X65{yfhXQGVnTvv%Wb|2ntgek|W z=OLdYqPBdAPvTan;V&8$x|r^??3}2r5czzR5PibE`)h$-f*NAUxp_vKfvf;)UsuHRPp9Zc+QnZ;t_}ZRqxD1rh_n}SQ_%d z*mG{TraWGI4=PO*@rgYq&IfNfY!c*6eR(Yo!P7crTomT`-f8IVDo!E6;5({w)};;L zI@5k*w!q~2IpAu@BcqfzQ$!vT{6y4%t*!*bXYsSs`+_9zdbdZhR+H~+8{(Hb2Rcnl z47QCdOnVro@$to~Sw?OhA+v9@+t)udr5ZGYM-03FTMOWd^_bUnq_wm&vs(l|A4Q2( zS!k|lhfm)jRI?;2kk*`9bwBZ1qLZ8JE?^&#CVK3_nY|q@Md<@``Kvp#-GS9)mq0W0^&!?uRa) z0P%%9g&vhBy>}jgl+7PTmxvY2ixJPgjH%C7h@Y}FBr2lnAyks!@2wW?qOJk4Z4>;0 zkY<3H&-oqnecN*we7jyCPv8?EPXM>P6aBo!E|wXT1mpCYc%6?(k2Xe832LDI|^ zS#m!*V4D%Q&+gZ9#3wy++LU!P8*`5O$$tK1;_f9gR2cCf442N;h?%&~QY$n)C^F`WT~^@Zx{9#6_9o=*zYb8FMtNcf6$-}_rLsuvfhdbmU{SIFiRLu=}084EDf z?gktCFyDJxNcH0oNEJj)@EtNwF3?`C*I-`wk;qcH_g0KOi8bkfR{hyx9{F#aB8qKCj&hi=$9^TX#7csMASxBuI4vkBhvI1KpzIzLs0hKa`jyJS zJi5s2eS3nSR|%#4Hk(^|Q%vkb7E1-R{&q$4!=GARcoEL;J*A>!U+;4|JDp5;ynB&g zgZv3|2Cc-DOmw!6wUUL`m2qzt+<71-{5F(+xVG3{-IhTk(#)s>ObFhCzn)v#CO@B? zraDRXXG}uJH=WgU0KY&spAbHmX@z~lC^|+su61M?-1X^~9HKvD@WG50`SMNE)@!Cn z(3jS07}lFq?ec)zmA)IK@VJ*n&FA;!;dD9>PYrMg>!|c85UsLdZOr8H+u(!cZa=S7 zwC(i?nbafmIAG{21?%BdizxDJUEkj8WL*pE?=cw00)KHLN;XTuVSj&pVm+*=_7O7^ z@9W-&%3c|1l33ttCO zo)a>2t8R~TD@D~2f2UkDION|lSJDX+V_dW6e$&L_|205V+oK3p(dv~39*B|$Q+A_| z^G|x%0F~}{w2o|>M$ms&NBj5%&!&Wux@Z!0kJuwbHH*!u6^V>?th#oU2+@KNoSI3s zrTR@2jrCU|rYG&b^{)MS?kIqa8YLUv2U4nA5N;_R<+rn1gZ_3r(`_uFNbh~{-*9^gs z-Xtqb;DlmB8Z{V7`coyGN+FBdnVf{^TjFFTM~K1)DC~iE^+Zq-)d>+x6(wZag4!Hw?F-CHc1f3cKcpB=Pi*PY?3oQ3+rM4I zOFou8gAOnOzsG^?(!^fQzU-)|)Jj8-nb~9fRAa6nobPK_4jWOKs=hmIbG;{JVA-z5 zuz;10e6k(|%**caNbIyBX&v;rUY_oWI*u~%N@sXWELs}TH#yELZrJ=Rm{?25p3;ZQ-m@;TBSLEF*pK8Mx?^oud;NE1HJC_4_?Inf zPIp8{S8{9utIZO8Lm_7LsA37kPbG8EB{K=rt?6gpFJhS}Uy+Ig%!)#gfrGUCk2!+N z6gh~=Y;&<024v}{@8%?hP0?(D5tEY9Nz50|DOPJYq)Ebx3$?uPAnuNtQ4>q%SjzS7 z(?RMf2(y>RcryhazU1#$)6$#K@g?KI>zaw2YH| z&%^o_D}SrM-uS(+=qGEY6%5{a37z941&9B=)#_R)-_-s`(dT`9G|4#sf6@QfMxfEF zYs=>1lFvbk&2-^E<_uDU(I_7)I{)F3#$o3FnxOAMlO}SY@YV!&(XCP@mFaD(xZ)O* zF%ja|OM(m4I)q#5@`sHeRZJCPf=T>$MV0TU7V~1^#i6X~EPS?%(oG7^)KKO`5ctic*)?TOflmrRP7?4}esLV|30`je4pb5;Z{*HE z|M!A8j(&O}IanaYg0MUgZlUWrj&1>GJPd@!7D(rJEut zx3R}Zhf7X?hpRjcOxp85@qXK-?)g4s`C*PmW_$J@K>H2#-_dOrPIOv8*WiHOx$6%S zZ@-IVa*{og*nYES>dI`n{p~qQ9>w&9prHCe{-GT$e4lkdLySKpZ)aCWmC=Gv4&{VL zs+QsB+TmORfeQ@o#H0#{?hq)b0jl#6W_NvDGgaF;w!-vZKfLu31ufjI+ke=5I&Fwf zw4ePI(IE+a2qGgW{~q;ZK5)^uIXDXwuix5pn2}VP5D=}0-0Zq7aunV$L_n>c=tS+X zeKt&P&cIfsx5E8W9`!di2ZI`ST4UD+TC$Elk@F`-Q<{_UR3Dq!6-|ryBjiu7W;BJA znZ1CAOVqvLWbm0aHJHl@<6_UVu3wsOjXF;*Q+c!UX`0I=Hf3pPBl9Y6=}R1K6*uZX zxH&GgO=kmdXsS#_AWka(@ykUYZPeI2M#jCg2j`Sng`Uk!fTM%Gd-|^}HABSTkjU-J z+Y7k}x^~{3Z`bEOKYsQ)HiJCu6vU=OKk(Z&IsM|EV+>G@b`jdO6M@@bbuz`~^YEGFc z`Qp9Rueik!m%Hiy=E#RxgtIsP8MiI4)3+(()Md|P?0Uh(B3|zBZM{d|dtnCJ+B_Dv z@-JO9$9H?PljB+a8|b7o#~d|{ZYx`ZJ*4F5#(f0-v2LH|=ea#?9vLF;+|IG>Vt*~S zTtc(_nJH{czO;}WOf)Fh(@DOxKNYv8V1950JUhB3uy;GH*TNP?tzkDyhIykA>+PRg zGF&}xy*#EMwa9Ebcm=iO5Ck0k_%%k8-a5M#h~M~_8ytB~g?EykE8sx}#n)GguefBH zq}prcF|yT4r~Eg13`QX*D+XXhs~I=*I0{XJhkYaUgfP>4_ML5lvXwxTM6@);HEd%}(dCU-|9r3%SJ_ z=g(ei;HPhWCC4pb9nd28pkOwQTai<>WDKe?CwGaEVUMDy0N%Z(-eUV9``P50Qhi_} z&?q95o<4d*+Gi}~HXg`(%M+6A8rexMIRIYBwHfu+H*+Cb1=sm8HBqx^ zv{17}by^|Dw>6^QKYU8|>$14SK|2yE{4)1A_L@4!k?XX+$&Z-!HbFit59%^lzW!DG z;rIGHZx->`^k}nhiQmcV<9ZHy;kLY9Y{3OWi*aGE(y}sTHI1eA;o+`q>u-PiWrX)$ z3!^s;F5bvKXR&7wCh=1cfA)fFeP{~$3hzgmiP`Tr_~{&6T;uamtFor^DAVRUz01sz zG4w^ij_vYC@lS2ZrV{(Rp9?plnR}E7n$saG#B}pnQEqe&^G;I!q8A#rbgNMWt)e1i zke}k`vKC5nq>_WiUPy!Pyt~s5!Y6MjGcTxn?0Eo1)@l$TNlv_*$)M=MoCAjd9A()I z^O6Kzk;*l5%`a}F$agDG~rgM zHRt-8w)i03-$4rJL3v+$ReT3+#s5J)RWQdOY4rOv;|KX|C*oF_*d%dF+jm0j@BQDR z$LZetd34rsxT@HszViGHilUg5&^nX?U#N`oyo3IiO?wZ}BKb_UJND=Q7{a}GvVo{n zWj|rA`d1mxi)D*~`#DjUJHa+O>pzD7&v&`AGk2~A$>N1VYDtnh%Sr_H2-FYMy4Pq( z$~Hi+{;cbNHcMzSR>$GTYMUw_!z{LZPM3`#g!7;(4#Zd?A`ibzlau{&(Igf0IV&fz z5mgi^A*PJkYlH46ZQUEnCE4Lkv3=@xXQgwN-nbKNw{lmy4|ZQ3@}WOYB*G<)&)ZfZ zn-QeK%2ob}kr%VKT(^IqhJ99s$1+b+U;I3^1Cv2mw#2>xK&&B+Eav|a4iy_6q@S*L zoUFo@?F0M_TJ(^`3tLbiO!oO0rD&c>w4wy0tWs^VUr_#=y50_=Sp}DK2BVTGV*#Q4 zOjzXfU$$|sds9Vl_}FYu7$q6)Crc{*QY7KWGgdneH#>6+5Hhj2b~=pN-xT?Zmq9xc zmr_+D!XSqrI+18n?A~0VofoE0N8&Nx*WThe$x?KGKNSYnw`{c0mQXqA=-Ml@xR_oo zbvE{+&_HBN->%$SssP@rCW>0PPref=S^s8&-DpoNzl=27D;7%=dzR`j`LgMb8sfF$ zoN`AZ(TK7sQ{v2S3J~`rU(HmE3Q!ZD54bSQ_O$KG!u)9 zf68|&zs?`wlbu8qm(?T=2|{7sr#XJ}`r<5FPhtcZ?_q^}|j z!rSP^{64T+vsa1)Mtzo($)f@G#2?5! zC*EYX)NV6L1;}7ox)z*Ddg$iYQ8VuY~S4Hq2t}qCC4Ce z2{*T4RUep?`L$@z?jeA@&Js)iIq8%KpO>D_grL@tO234?9ZinZMX)t6uPCt3I3>w` ztN4os*h@D#9th;*uQ}AgkEfSEuKSvaqpi$q5F5#VZT=J97{)%wVxaZnpYtTWhkxZ`es+0Obf`5ew#e@7kfFFLK?f~&Ul6;(%-B31+&nSiFOQ1kvRxA+j;X5Jcqx6ztW(hWbn$IGG1ap;+SwE(MJk?9$g|8t^L$$g(O&PzDYko_Y zlXE2zQ&$JFh1N>g|1%ad_pro9m+_-PjBW$qt=6wVt(KP@FYV2m@n~UZ;BGpBj*r2{ zmpoW7uWU`m@A+#MKOz(FBGOuX_ZEFU@Yla*5j-or!`YD>Fnosl_VYso0i{oST_7}I zt5x#GewCvo$4ZZnbHkt2=BB{!2Qi6^MI9~_Ot3@Y#%7Xu@Ks6I=b8?bc&&pU1-dy? zIihQcn67Z9rjK`xQ~_vodS7pYZ~9k?Of9bb1YD5Hwtqk!vOjVzr;kGQt8cuaqqL>B z=x3=+V_#~8U;A>~?#q~{>q!z^6SwH?n-enZ z;VIJYnAKbBltrVApC;b?s)3&d&Ninp1^|;$K|CLfbZOOW`+L#|HgwT*p@Oz=4@QjC z?oLY;rBKJilPS-%`aGQtuC9tPZa;=^_`XdQEIQ&h0j3ikAh**L|DhIhSUUXe-&@80 z3b_A(9>66(BhycGfV}iQ26#ojH)Z-%`JvZS9>tBAFleP3*JhEJ7%N_#1{XEThIDSb2d+C9+4j?`kvc!V}o z#vZorww4kqO$BU|MQw3!;W;5V2)4EnD11$%iz5MU#9(Rrg;oB~!AQEM@Wk6zrm>I* zJs}h64};XCv!5Q#H=kKUGnLHYMh%ruv8m5aNv3Y&G?rq!l}!apIN4d|;te<=GQX~N z1M3fDZnaeZctsBb4olyR(j#*lWKJESN%)h%Cc{@pD`6 zeLb%|a^_*Albw8=z|Zxj5=dXF0K9r(3i&;G?Ky^P-zJJ;iqCGo7mVPO^VDf zaEh6rqM>d;(eQ`4d`|Y|9t)O@${Jmhaygj0t0<~p=HE?>8um8quK9+fQYsRsCJ)GU zynlF`p{n}p+TFZY=1ZiVC{XcD$6Fd@J}j74mOrQcfZ8W#nRwvgkEl0=?aU&}?By!b zf8(}T&_qbfU=l8GfD$0ym%NAD*!JJ!837DOBGdsV=(uI6W+Dp;l{ZQxRgpc|1Ro{K zK}-UD0(;8BLC>)C2Xl#Fy*VuQ7I&uxDDm}UEErk3cqrRTr8ixjjL3Qcjq_JnZAaSO zfomxqXPrg;t~qqoqN++9P3=cun+HZAt@15-4qGW4TiuSZrQ|I#`oH+EZw4Zbh0XWv zFK-aOwQPhmRd)j6m;CgA2;%^q(rm05Y>8Q&kn;JIK&3j|uS@Kt4mb7}oto?Q2>G~B(f9*CJeY+3i|+Go1k0FJu(^T}hjoNq%>FYgbzcTWIm(%}hjT=Y%LuN=|~-Xddeo+Y+T4k)g`5 zWBu23eT?^vZYOFh*9}KYcf(3Um*cXmR)|2H4YE^A`mIg3>nij$XQi*x$!cua7j$yG z%*oqv=)2%*EM|HD1T|8v$jxx`1aF|ieWmQDi%p!6fj7392CWOtkg%=sEvj%nCo7^l zz89V}eXv2vK`0%nH@xU@S-9m;it}`$Su`EN`8nb-izj`}Cf;MaX^Y?flt3VvlTIat zx1PJw{g{NA@geyP@!gUoNP%MI8G-i>!?L8&fEfBk!aP0*UMngj6bFJD1WXJMRik}n*hW){NN zAh(QPf3XwocqVj&35za=oddW%b7^7H8UCU7FYO1UH<9A*v*xwi6G+E=V8YRnE;qfu zh)e5~gRao3qUuGPL7DLu64js`IKTl7>kzU&jQ9uD zr&rl-WK!pLXr{BZG7Vcwe?kCrHR+0=oL3QtfZ3o4Bghn5(?T<@N`Vb-Iz|{&Hm7kq z-281G?qA;X*6;$GLZeX~)ul(>vFa%q&FNacfs7%RvANHgR|z}!@ay^?0HdQ07BoL? zd3>X>LW)zMKN!dvi1JZv^p_wdDMe`Qnf*gfKMue!gIdX$*HAO3TKA6)V6AS5*(zVs zlbe44VLIhESx_p_X2i8;y7yEEqMD}=vV<`_-WEv2y^1JVL7_?TUf08WmzKom{0K6)+Ww3X1 z2}X-tPP)z)9XfA1nVhM(-SVWlMSsvs60Fy{x$U~x-_}Y~lZ#Lhnd(e%*C1csi(&r0 zP+u(Qx9uc)DqmR{H~Hz;otDTI+$mk>52o`vq78-1SVFwP-gi7sF=andgd#+~2%=kP z0|YZ4rR4>QI_8hHQrUX_A%B107fT%}|BMaWSkF-k>gc(Fp2A88+vm#B;)@jiC}nZH zQvZuV=%W4L#gu&l7L1-z$xK4?DP{cCNzK%W3(wiLq4YE$y@y145ajT!wUj?4Sb(?Y zpcR<%Ud(8n_#ZFlGNBpYBZpZBkBFo+i?}C(L~niN`m3u;%I+|L*n1(%x}qciz!hH{{e6#u&O2cMZYVhtXi+j|9#o zadamGT3w43rBI16MNx+BQ4D#bS~9G&ZPgjZdct_*0~3#k?@j4EuTz22^E#eUc>(R_ z?oL6E_=iV*Ay2oBOWsk+ik~-9jSe^kC&<*U+~AK1vh?q=qQcYTLsTBVn?7L#f%h%c zV{g)Jm>;_ZPL)C&MAI`D(R78Gy5IEHPk_;cseLLR8SlRow$qaAR~)=p;U>t?@9`Q{ zm?IHjSP_Yn+RDc#QwI=RFlgARzrdHX%-(#U1}&noGF~tr(2rhz7JTL`buEymU_T58 z1K{LXTZv`E{RzzK>;a4-+WkB zLBM<=8F?08LU$PqAuJ@J-}yp)&NkfACBDpz66~i}TO0Op_y$FlxPz#EN(poCQo`jyScpJRr6L?A}hBb4? z?7JL8@st)0$~7fH?^W7ZT~`#twno`8M3C`Sw%`4`5;+okNo_#}%s8KMFtVmxOQ97< zP#IfS^q2_y57B$z(6o(&JS>*TUNUUJ{~Kc~#G-TVlnI4a;2_@rs|4a|3y@Vcci-Vr zpZ^r`CYQ9OHVj#lvBRC~ZBi_yE z6OrQgc9rt-yEL)rGJMsFltx@c{1uc;&a~0^tCA;=OtURh8ZT-Tbh@mX83Wax6*|%= z#itvX!}Yt>P>?1OEBVIj7z?2Ee|WyQBB;@a-WYFWWjPjM04nG)U&lca_lj52XNwC* zC(`p&=^lOY6uV)zkR+5@VZF4BaOY;BBi;AP?7*vPCK|UWIIs4i0SsX3AICYJrHUNAjR#L>rdV=^OZ?t&P5{EVf2$4#^d(xJv*AJDgV zQ$pmj`36&@IYK@ns&N`ZrTsOZQ{aPc)K(GixOUI`Ax&Hd8-urbmy@{4XEg52pN^k1 zMzh+z6~a;!tyW!D?>xmN2d zbA0ye;`I0WRtbOc`411hVDeYi z5e;Jik|2Y(nL0`*!k|XS`fYu~4>WOR%rb+T48XeFzWBo$nN&M7g6w=Bp>j@ZUp$-f z5czgheFsgfvqNUeTbpr7v*98J86?rYBF9J=l=SPIG4iZ`&Icx|)0Box8>itqmu_mu zyy+uF0~d+WDi9%OOz-Z!kNU)Fo~S`10D=Vt`4<z1IF_W)SyjB#y`TXMNv8Hx4<&txXX?wB=(jiqAD@ zB8DuWNpqt?N(;P*mqOy+kL2&(G4nlPZ)pPc0hI)C!&OjEy!8F21c+8%h&ARSGCJ68 z&l3&=M(YwDcM~T->@l7pntkxXdHq=}EsU^$+~B=PWkar%lMJFpX|r<%pQ3nj{%Fqi zk3o%FZ7IJR5&!!p+z#OrnNbd+U(dEx-z*O`Vn58nQN#$e)v2V+TZz>!|MC!cDzDec z)CA9?H4Th%-5cEuuvFw1^DCA5vtqKnDgzsl1WDF)*!s;Aoe@!xbEVwlj)8YZR^%8 zYl`LWC?*w8B{CuQTY$rIAhgWRl+1tkdH!7{jniocKN;h~e8dt?ueYNa=EGKL|6j6F zJ_d~KPf;7&oDe`0O4pp~0wo|CwqtmJ7w03jQ}Iy;8`en4NF@^L)6oI!58z#b0>A+A z`G5WG(vEU=*YNVOpHZL0D>FsqWk_pBKa#93Hte)&oB);civd2b!khmbj{%qk zEwxWO>0^%Q-74e-ROh>t&&oPU7D6(9UN71uNFlUmF5=xP9TU128$}5n&4t4KR-}=e zVfWFxds@squt~}X14aaU@#M$n4P6i2G@`C7f=|ZniqoEd3kx={jz9mB-ZY_j%@YnS zMwiKb11Vkg1l+p>+D$54-(b~FkzBqGFw1d!`>~R%!|J>58&5-#H4nBM{>&worc|Dg zcNx-^8D;40(wQFqu-yj{8!4>c6fx49E{h3E`+Ki0BnC$v5yu13UF{Y=MXx~PQJE1E z&Ab?P-Bu?jdkzl5H^j@O>Wk*crLf*TWr1>WKMgU=TS-E0-k@ z>i^NOkX=1&4Y9C0kN#+V>$^3Ns<1oL>?Fjma$LzoWkcwXN+p<&CNYs(p__>kekBkl z!MWFxUh5CdejA$x5{O8FOvsKo>R`$j@3!#`eQ`op+Ypsp6w}YtGgSBF8B_|o^E^I9 z)KJ%DPJ1$lm}IX|_U*s~V_D9(bst*Q2l%nBd|ngv*Vs*hTk2Y9eE1KUuhNlGi2*3M zdT%8qmIGbF4r7;4D`3-~ARv=MiUevk>qGG;iT-H6|mMv;^R{3 zo2<0JB}~JkIe#x=8vI{EITjym#omXYvnXfOGdrE)XFEp*r{c;oi}rkMJSSy9_uq5N zS7E$4{SFxCN>*yGnQxRbKmUWjh*4sd{yV?ja1Jx@we$DJ4Tt66%;4*M{K13S3Jtr< z*Wn24&5Gm3`-WnYr;P0p7^`^bFB$Ao!+4k9KOBeMWjg+$8S~S4F0f#xCM;4#P|kK= zb!DJP2g`bzg*FM~KI;?i0L;4B#;3t+?cI^#6y{wYfomrh4>-;Xub7uiBHo`_Ixv^0 zumTWv*K&*%)8h~it*NC1Q~Bc~Lhcg{IxakQiEc`i6#UC?1Q_bSP-3MER6mo*IG!d9 z^|8l3VR#NwijM3dkm{D%8`V|DOFZ_UK$0B>)_is%Aq@$1tV@$|P#m*LZ;~LofvxmD zc`6Q75>-z$x)C9#+6Uq>SNv!0`7K-f-qd(S2l+{jB``%oNyck7>MX6Xe{qRF9r?ny z2QpDDJYp#4ZL$wyVFy2%I%1bBf&Ow;?L8UvVFWLDgWkk052%}vM#WHn=-gKfXDNET zWeN;vlmJ^r+DAwQl!p-5{lVTO@>VaJlKX}+>MEc3@fDkWf}t6nuJRho;3iU-%nY(PRFe!XffkRP~5RsB|mzm#D%86 zNm}0xfaFDdr|}*v)$P@bx(t~|Id?DP=y-8=VP=0kM}^5C*00edGkzOOqMC$%Kev@s z9$T>FFp9O&*nScSl9qcAHOF2yfyya9EKzcwY!Am3!jfLDfQ7~`g*&|r~%1sf@_esI=oc=6gbXE5^gb{J7WjsywIfb~Z`=*YPl>uWseA*@a zp6vB&iX`omM|zl=!COP}nPFB%gs;8yeWBrD{X!7)UAkqCmjuJ6%PKbNQlBZB3%Bq& zJLOTpzR$NtfhVmp+K0u~OnKMxY4*_kF>E~)pifjA3(EU%q!h+OXT&l4PJ-+0mkAhV z*Zr78HtWt*O1WVj7ROoFZ@x7ESNba-k0_3J$b6~)P%9e|UTq|XV7GXo7tAb5315Op z?buUT!rSRH7;0&7B%UmDw-<m>!PKho)E^m*EMOD_5E(zp#!>LT5yh@8j1OIJCt4N^WJ zNs|XoHAG*ZGNH!n@&D`@=jaT`qss8x0a=!!F-0TBwqnuZhE#n7OO`6TAiKKh5oSb~ zA+VXGy!B$WTBNeh@I{H9g$3Mpg|wP#lSFe2xLjIGvGaoSU$A(PK32TPAZh#^3PWl| zy6lIZ#fSr7p)uA^9GaAk;(@|@-Lk)FZti=0bOv)(^! zf(6|uv8p~`Re?1NUnrc7B{g-k@-?RZC=D`op!(*Sc&>8EW-wsc|M)6_fj7%c{WC=| zQpQVFb={g8gyYY|3*J=YC)?`~TF3Oi(tvCNUd2$CU!0XVV169z9m9>GlYhOqx>hNc zB@03Q^-!yWow>ODs%BC1y$__tvd4ri=pqm1unBPqiAW;iWZ(nm4=YND;97r9PKDt& zBB$H*sy$>!KAcp6KT8;>mT0E$gOFKpKn%T*`V}^lYSZtYcrkkAA1Nk2+Qw!iyavh+ z(4vAzVTvFB3_rle(aWa8`^8o(gY$Q&o}ydru5BMpC8)kk*Rd;iXPwuWDQ)W?JhGU7%#${~;8D`wD*nficqZD?wvM6DOVXyv1734AcIQI|(JKQqVg5 zZw_0wry@^Obm3)^wLRU~z)a!u_3j%Efl%YiuU>;RjTGIDr6!>LFrz@LAJCaUH^Wfj zwL*e3|4yxfT|1s`;Kz~6(h=+ zGy2eNVaXLloS#+&QR~`kJ<}R^Gg66b8Bbw$Cd?*l<^`a{t!66=s%O1F3Y`~ef~TLa z2*=d91ZIFb065%+K<#FL^)CvC!hq18lPl$O6h|3O?S3?~d=dx6!>82KIJO*R+!7x* z&^^^vW&(!g)EP|u9-G1t(pCCCeWq9{;nk#vF$3bzB&yA6%*sV1kJiq@rb#YI1FMcL z&-M1j>#S>HW@~%BB?F(!jcUAwC2hgTc3kpP+y)d0UN9ZdGLJdylnkmlInn*pY=lk3 z5KR`*vb<{3WnWoQ-IvuF<}8lhpgOt!W(Qy|a}u)h$^`eXZ{6Lxy%8!{fAAnO7Q=gR z2#t@bxAjQPn^DPlEe3U6dZ{ruk$$8P)j44)VM3C241Kee!k>`#)kWMo(iX#g0POQS(vWPF@(}s;3e+MzB1N?KgkSR>`xf zlj6*$G?FjD4t?^$HiwOlgaW&u1pS1Go;DacdKDIP#ir=OW@c#OYJv;#UhpS6N=FSk z{Z?Dbe&vVUos=Sky=fQBM8bv@qoI-duuw;)Wz#m^bOlpI@RtEKm{^6$gdSM`jNf;8 z!4Hf@Ri@JJ)3mnYkne%L><{#K21CmuD2~P|!Jzp~4#`p-E61=%SopJ8d#a@9g7!`fEwm6!@w4!VBi zfk+7AN1m@2I5nB}q1kSNYuitqTN+C^!ET0x4JzynXMaLUwqMr@4PKvsk=>&2@OU#~ ztQHzGqvBtoTQ{tDGAofhE;#P#IcsAr0Xw_V!Bw;l$lxVwa{e+i6=6to*gINbaFJgk zR#xOO7)9#+D5uAgE)PzCG5!hS%1{Fe6%x=))A{s)M2$_B(rcJz?f^YI-)^n#6K~|# zZaRve+xn7$-t*r%imUXdVgNLHmlwFv>sJJ*W5o`abdDj`Klg3KMxn%~dA7*@o+iNi zXd3>hk3Vf+uCK^v^U!K6_a&#WOXJ;d;B7pmXSs~J-VFLr0h<_vY_hA{AJhA3*g|Ez zK5N!QhVZ~Ef6SJ-Ec2>6) z4K+1Vt6qOVeWDS^2Rk1|MaVPg>9QDN_af<=@ci5Y{OWX!xqCm#z6rq9D)NgbKOKHx zjJB5bQuT2zGD)(Soer|Yk z$E1V-{?rac;8q#AH`-KRe25I&#<|-~EUpTQy4}fKCoB-KS5s$ zXXp&B)#_TAYn8wX?!tyRH!=$Psu{(a6aBpdr3{&g+JPXlWG$P^fcL^-ZSm*%ruA}t z0I&gM&GHdEczrZ8u}`q^D-*i*glkUJ_3N0_%iSjX>2X#UKgm}Nfiz>` zJ=9P72fxlDkeVCqY*!T?M?2PhN3no(kk3rGyU~e(bSK3KR{WQ@A~YLaR*0O=dCBM^ zqi7~%aeX@e-FLAJNqsJum!G>$w$AGkYu9aw@~`G~3?#K^`h-}$g&d%r`6aFlV?CL6 z_9hF@j}@qItYm^hRmlYtgg82^*9_17nZw1Rnv!gWyk1bEaJAAgR6F53Dq1LdI)A&b zjPrL>j*W`cx=&+^4=NIHNgK0-NMxyujNyn~NVF_Ko^KOdGyOGW?QujsZa){fTd{fLi(qGXXr3h1>o^J z6N<#I2>>e)^!f8yoUfr{{SbARytJsD_0r7q<1x9ToACLB-3AxPOxk~F&DXkz+(+Zlmjs>xm#x}R{uiz9_ci36z2N$7W3PvpW9XWbT!QO zX0YcGYg3e>ljlG*6?}Ols(T1H+tWlFW2CA`k*;e%J+hPIKg`7$>)X5=gWYfxDK9y` zE~M#`cS8ifxpVp!x&UYU=Ic=b&`Z{5)`mg0XX^kIUv7BPZU)j;)BKDKt_Lc zqUplf#UQZRXq2s=xlv+W-GbWGN1c0vDc9|IUMnGJyi7!DrwY$a#e7F0Y4oOcTKqu8 zokFI3C&SI~TQ4<)1h+xwy2Q-Js`}wj7T6%w9k6XbeNQ|MWb}Cys#{k>1-F|S-1@OD zU}Z#mOd&K{LC07Dm6U_wrQT9-8jpVgq}1w85v9vI#Y)z%2k3ytr*^LbuZCb57NjG!W}t(f-F* z7o{e?CPiYJ9+ML>S`C%H68`o3&`8QRWj8^c<7{lE^7L*$PMEIud&s_@y70nL(LYgG zHOS^F=}XA4dB-ivC$g(P&?s|9NaQLG4)W+^`y0*A64 zR^zwkZi;pGGM=ctwT5)isVHBU^7Haq35WE!;57v9W$=A9(P?c51~@+Rk~yf&vm8+4 z-#1m=ag>-jDE}7z92xZUjW}AympMVR7e#jAMFa0mp)VwYg$C&PN+4iLl~HUU7H*!J z$(*6jFm}FWcD^r~WgcNe)A{wU>k|};)6uNFb{=^-QXbz7PwI^PXM~s6OAMWRfYg!X zr&yEytbkJ*M-2aMCWLVaU9B{ZT0q*ppF{0k`tyIr0+>ff$oD)sSkZXH34z5V3u_@? z5PF#-Fn)S|C#bcmxQ13U41$||Qz^^%b3fNvxVFJ{Md9)R@A1R9cZYy5QI*l%x94eJ zK}6-w3?Ys-Q|hi$xJDi8rmZh>>(pN?(r;3$ZA1;SuY^wTZUv>JH9JB- zQ{eE}gM)s(+*=))@bju+NIto9D-9kz!CpccG5L8^D2(I=g%~6pAuZ@>RuZH|F)Z+r zn)2uISVRGdZOEMQ9~dKfW6!~DP2)>wcWKd?0_1i5%BKdub(_o}Xk1gBu$Nu!ENJUu z5EgG?*gdwS%CQjsm2^is!tMIxT!l~7vgO$&?!8U0-vbYiO&{VF8@3{+k8$;;-0D#? zTAJK5@=FSp1MM}EZG)wI$TyFhu}pk(qHz@m!xMDnt&4m&K8%;^@YxzP2@&^-R)Hy( zv2wZsmt+*DXuU>(V_!p#=WVb!USqOVW~Ot@UR}qa0b{rXF6k_Um(}UTH6-t)&|*}{ z0(fzER1)B(2rX1iO`i~3{l(fA*+O&{!{CVCr8V;PYOTlC{}9*BmOEIGk+yO-A1hEe zNcobM(lnJ?ck+PZPU(~WzNxJQ&x8Kz99d*<|6N_9AW3!T>;}d}72WB`ICeF{+=X6w zhdM?X!eWL4x_7=ay3&63b?i9-qMJDvl8>c?S{v)57|oaTvhZJI+f2325;jD*L_Aa!F)9X-6OtEUZxC69Ab}%h(Bn(4!Tj&-Ky+RQb7JQ>pQ*fAJLu0 zLnBi&a&&o~Uo@~v+{@-wx;b#fL!(ITwS7BAssS6Z!S8>Afw5UC5r=7gbR{!8RpH_1 zC|x&-`@=U}XE4u)?+=u=;@1c7uJ%^0c3+IXZF=rm1L2%0FR232cp zlGeJ6vmP4#g#nw2#`DB#^Cz8))bi}S{u7B^C7lwG!j=C%r_V^1%oj|GpuL&P~ zNqFBff0$dK+33q%#hc%j%9p{u__`NzX>jG5SLD~FMQJv4`R*HWjq9}5jQbk{x)!TL zK=TM`*^yIY!5dXme!FCXbKSe1+}wFw*|j=##a+S3ZaxnH)BDdvW!`3`&N|G# zzFJ7U-Tbx$ggGO^oW9Dko1|_Sov#V`-doBk^4j4Mtt(qWLAkO?0#(7 z-0i;>oB9$@n={SAQoCn!YEJ+aA%$guqQir`(w#o^c+`VYM)it#iSGMC^VjR!vhOMB zizoU1SZYKG$rU}PT9q6FYCa`R01RX5&a?Lg)A73uR<`m+@k3m*7B5J2Vmofw->NKJDZp$Av{UJF%|erEvH%aq0NV)8UIo zVlE{MQ8(M9nzETT3qNDTu~~Uxk0yiNK0$D%OAkqr4|#YW%BV_FP{)X(-MVq#2r%>Z z4qRLu5AnKfqkLZ{EY@q&=CyqdeAu!2vRs=Vul=np;_L%==3%k>Esv4twcqmHfN;r( zZIiJ06ARqd&)47a2u(34YqlcOUv^F`#~a9SOyZ`WIN(;c^c!s?nXfo4&nproSA_&g?SrO9q`0BP|#q9)*O|MeX4U5mC zKST0MN-C53-1Dn$oeNXxaXCS$`MOVxiALci4yA5WGAS9_2kkD0jQ%k0b6mzwtnf=< zs1D*V$B5BN{VwQ_*nl%-%QE?6mz^&xxrIq2DVA{$MA8QF=3p)j6IKTLna7l$ zN)FTVxTfwM@DNXZ1W_8lQJg9~x}sWyN;;JBnzJEo?`M2nIdQX()Yorxyq_Z`V@)Aw z=;aM0YFLyA_aW#jka5`m^J3hww=a5FU(Axsl5t!0$1goxvST;S=|gnYjLa`ruoo?2 zjbYw&^)HnH_!#LXRbI*cu6kIEAwn<_KRBCb&U_`Kv2Gr?pLW#q$;P}z=+>Re1fE35}a{yvIwFZ_wo+ zBE0#CCS<)1Ez5XRg3Qo<8Ii{%-u!D=D71_{L6`iNgq`PEyJ=*|r&|9StAWA+Wp0jk z?#YE=Zr_ZzWK$J9lsd$B+c39#7i}7Ft?Is{RO?Rw9PK9MiJ>UsmL4-2%&e{(kA88T z6m`xDnkmsx>ewuY<<6&BunkMO)gibRY@B`?Qsnwv?1&M@f9&25&vc>VS-RF@`l^b> z?&ttgapP&MWLaj}g_vP&$PsciRqcNH{tIK>v>hLKnzmr;S2A1 zV>fHfgmZSo6YG;%scv;tz0u^vJwx&oiz!AYRtE>G3C=n)Huods;%@z7klN&rpAZ*~ z-{nnHg`;L3&mN(yIRetScPOU53Ajke=JD!R!L@U3%l0hO6NmE1^N&59!&R64hQu40 z=}*^+&eDnBqJRxN0(escVUCFw;=$L;1Tm>f1$jAV=3X70)hW2scO3lSO@U&#g|WFb z*sg#O-{S(Ot5F8-e$H*v7fs%HUj)NenZv#5)#;TUrs#wY~XtQ?O4%GRHvT<&08Mxkw-mx#3rT&-|4TzBO5+MVb z3p0>3_2lsLc(6wK4CD{odP8}Hk-?5CGFF*1;6nu%x8L&-s{Sl5SWjwM> zMlFoZp)G<#<;z#_z~-zDe4Z{pM*+D6U1Qe;ONU^3l@&#(su7Z(DU5_QV(`+d!HWAW z^TrZeN^u_|xCo1@|1MGgpCa5p<$~$Hf22|<2Ad3CV_?JP2MKQdSvrgH$nOKre+Rv} z7YG5nQqWfP;wU{t4+G@blsu_@&lG9_yz%hezg$pa4Fq|1*0pD_20qBx&_6MDu=SQ= zWt=>-MvlYxqb!O>z{zjr!os!AX`Yf6bsmTy59f>yU4#x=O(CatGXK1y#6#H~upi8q zGEa|DzT!4}LSf3R%Ob|Kn%&al^gyXF7_~GshvhLWrxQT?qSMhwvwaddMlvX1 z9i!RoATWbfk_3uHQ#7$gtQe8Y%rT zldgFWil-A8`C{M1kWS&Dx!G3*g3LwQx-ICqqSq&scuMaTpc1IdG~T2EZfQvA+{9q# z7@fvt1IH~H%On>Dh9;FMY};4sx>qdqxO#C7II5a-^r4c4hLY@vX<{EdoTmIgI^@A$ z!Lhp(GEgH5dz~3hTpzA+4M2But2lj7qPuANa1~k}I-R>;IbePZ_9ST{S_?i*5F6=o zQR@5y#A=5jb!;XDsFEG@IQ7^RY-A}WxOS9dg@<8WQ>(?EK}N=x0Tz@1oHy)(r6CWK zyU>)tkhoMPWWDo-ytn?(i=RQWqR3T_8EyF?GT`Y9m4u#AYuZ)Y_f4)45l`ou zW0W#Uxx~0bZ{6uo$r0!j5+FU&G!j$da`&(c`n^TB{Up+q*Tv1^xF+Xvt*Hg?m)k;a zr4%*eCK|-wx4(^(C=d7pCIG)dCv9tCu1;BLDs?9@Ir{vze7%FpoM-KK`DtdRSFO-g zzm1cmLvuU^e_d!-4l4M0A>M-hW+ho&%KIRUOAzsSq!aW5 zBmmSEXf4K8ayZR(eV*NDeux%W=Uc!0<%iw_LhXwcdvu`mH84}&6C^*WKnk=}V<=Ae zB8B{P@oknsg&WXs5{kM6%Wuff_XkJl;JsiH^&msPf#wdTD>=cot_0)V27PQ<4A&wbQmv}>{n2sF=4?U5d5N=#pj5wa5~dRmhCtoK zcSm$PT?6`Oqst4%5)3=>+7}o)k@@NO$m@^5ai1u~Sodb_H`*-wV-fo3 z!;Oo!rZuj0-@rhU31vbJn+bge*Nx2gr$Yof_c%$e8^7az4R#-1NOJw`)mw#Pkg%J2 zl(|eJ?d#&h+b^-(`zQxkz0Pnn$^PM$+^-xvVM7LWn)-u0TXhFlAMjM)U>vC;_J9a% zIm6f=o@$e!Detemvd6SD8T02CP%aKGF$;1DfWXAXfG&)S#^S?r)5IXB8C8YsW3F5U zVwCQ-z!;-DK(`C;y|OPX1TN=Yl37XDgAM=VF;KyJhWBc-r`Typ**8(#UOdZft8=WF zBsW#Uz_wwr(8u!;>6LE+WGTGO@HXOnJ%iV&zUwA>BKZ(y6Tmqx8(P-roHFNpUCL$E zS_uLJ7i%3ZWF20Md|0b-1^NVlpbAEJ&}B6k?^c_UNYJRF%eRqNdw-L^$L&*18 zJ>nL_BVrf&O-hvJz#7mo=KPK3La_@C=#SsiBT5EUJXQ8@p5LlYG3vakY$2GWI7B2@ zNMQL1O4g#ha%afJ9(qwh(GurMViqW-BQ2&|akN`rioLj!8)KQ-ZDJXS^3E(NMlm!{ zme-doiu2ujLQXjpJ~Lxvg|v%x>D+*;No{X-{s4E5Pw4#774OZsW^$sU^$9i|-g1mB zK`uZ@SY1EAE@oVMoxTN+-)0BdGIukT49r`jMn_7Dw5@*jY7MBJxSd^mINSflOVCI( z9W6n|q>fD0UF8>7{h@9Px90?}V!-qJ@mcIdXLKfi=A?EtZ+}-P%tl|L2P1D2dpDz?f52t)2sgx}omN3CPM^CC2>RX*2XqgQ$fiqt2jCzk)IG2wYdnFIRu2U zISU zpzbdrCc5M;&Hd+*f=q0$+ZN$NjzP0~%72q9mmp$?-Uj8OP`5oVJgo=$Kv~o5^>MBM zPaCw2xV+c()2b?kY`BjzHaeTHrA-2`oR>SfF=`iCb*8*0iPQML<1T46iN%Wf7>;A{ z{OAOUcB;S_%iQ$RfXC5A} zh9zP>Vmpkcj0*u}qIJ(1U#eEtJ!ZeB> z)5nx1S${e=&vL0Qo-zj`F^o*lPv=g~ElQ68hES;f@p@*=@M~Zb>qe&+L~5!7kA8!; z)+5_E-Ae#UZ59U@%c@Nea7W)@tA43Z%Q#yVOfy9bTp%$KQ;h58_9cCTJVvgeipu2< zQ=;C@C1NGrSUjH)xq8mkiq0;`h|tC0OT5qAOYBaDi#R8o(Zw~x(Z^5mT0+pH8^WC` zc`%nd)E6&$j@=8FBxemRSV{@nrM~quMIn0y=FP=Ce6IJF+c)A>g|!qS>~DPY?yeSv zP~=}N_j7lpgrNnV1#tr-`Am&(O4$98EU|OlaW8I9M!qJNv3Q3pzAI2EO zp(0dLXZpdhPii-J@aDgUs0S#fxsa!eW-IL}{Z}VA|IvvC1U9oPjtoY0t4hiU)Bl)u z1eG}|aMqi<=xXwkE*ms0sxD`?t46qzP`lbot#R;fQ(&CRMGclV&n-TkF-)_iPm#6Fyp| zE=W(Q5SH??vz@|S?`Oj_7nGHVuSn@2Et_fN&L&TDIN*FPr!sNIuX;R&l(9b=;1Ta6 z8@?b@y*(ke(@e4Q+oQ#u5TRK0p$dEv)xrGLfN75`0dx&MMG8#F>~k!dF^ z_w*WvDIqfP;nQr!;g$y>?lixD+yuxZ#EJbI9y8R8@*H!fB~b8LMWN+&3ykEI>T+R} z@*=1e`i%8-hP-M(D(wBvj-kr0-Z?F@S5)*m&bq`fQid4{MTR_CoWcK=ijSWm`QowQ z@m@fFmuM^MOxchArr}5Aw)*3X`YqGS%$e$6r$SlnKqGSMDe0{(bKifB{wel{?5E5> z0I2dLb@H5~fZ{+bdejw)&TKDcLgeYNjbr6RX@WnhV&LHR6 zqW9~&TLEl3N4qfMk6qLildWZ@U%9?uSwbCA@}UFer5{kxOhE8g+4|A9Kz7^&E(LAG zelAKC8OOLyGRm5AQu0AXTNakcyf-;X=7cC@%sx*61W}sUR#{9b=32xO@}kVcOxWBS zkkV&&nq-GR2bj}>?=%HjB5B!XbrrZH0;6E&YgZiEpjHF#O4bi%M!0b5pAeDyUn$7L zy7 zhC-*FQ(H3rF^s$7Xt8~27h5X7>O<>9lrM6D4qlEJo5sceV;BeZfPShCBR?JRpg6Td zm?kQ4bTTp#{_m3kT|8d#gKrjjrFW9PN1nRkbr9=L+Na;e5rAJ)E4#3`A<>Hdgc@ ziMj17ofLoq1s1Mr8LdOyd&pVsFX@hC)TQnL8rLz2VTm`h9g<%pzQoAJz|o${odJ&0 z0uut|N_>LH0>&s~DdFEM4CeZRX3y*&U!wVg;S}s%|4+k!%HQR>K$jhFbMI2UN2Jjt zye#^3znd&3Sal}+ot>x?BHZEGXXq4go%Yf>If!R-km;2rE9PDMhx}BjU+Rv-dViMs zS+NR~RL{dWZkLMLOPX-~{eFKmYbcxoQI(iAtS``2QUC`1)V8tGVx~6+CX0{)qnKui zz{o*T*lhl69_i0btLh1Lg21i-2^j?=BZU!AIgkpT#uojY68R zoAha!h^!_9p^$idxmhW+iE?vR>g-G-fkeWZbzx3o0hC4a)^*HvIfops zW-ZX<*YH%f%x#_nJ4q6D_2V0j- zM3c}Rvh69p1bL)4pDYusSRZ)dtP*3Xf*_)4F`M^0RLAeHQ_*HT!9bnWbplp;UhJcR z`T#9B{zSDf!BY07M^C>!u6(KX;n^Y(G(8hNqx!Yz@?;V`GJ zP^|UIQL6g>-QEAs%$$SPxfA*M63T*%UVU&_oC!i-K-8#wFNv>U75U36USqYmxLH#! zQZc`oh#6a2{|#Es2BDQB2mad~pU(8<^z8OuAi2-+DC^XlGVYe{c5Y{DtB^a&qdAcf zYeRHHHla~Z$KkW4f<2<1dAe z&qmK2-Maz3YElZ%bV?&HjJeJlE`1Mg5wK>EiAhX42*|DF!aMOn7SD9ZGhss)HV4HL z$@M-a9RE~>Eh}f4u0Qqs(mY4DLWp!tKMM*W*LcQ}O@6W$-_vlJE96*=y3|HW`=@-X zrq75B6z0$S+Nn+aRr?+^_Cny2>|{EodW8CPy$2FY&XaQIkZ%;Gb|)wwW8-=B{Y}J4d}x6tJ*l=p@9XlLCEGI>@)ysWtw&z&!Yz%qEIY-Q3dKq!KX&J! z`B?Q6WjJA7kW=gQ*X%*o`M;fboM5Qt@+HfhvpB1;6#iP>9@_U7;@Vo{3QAz2PWZCl zAR_p>_TzCSD^d|Z@I#Pxj61_qn`_i(J?kG=7&mt3Fom-jJX-1f6h!mq2~7o^0%;m? zQI6`!=P$vG6m>K2BYZ$_+jGYiht~(V&42j(A*$ky+k$REc@z7FjE&Vbwp8~;oWtpS zb(Q(;iv5!=bOvC5m9Wbetg^6Z3}69~z%)+Ml_M?i=aHULKw!SIPX~=YSM)N*U?TG? z&|Z7b+;FprJp8TNu8Hd8hPa&EJANsA6D?pyR)AEBs%J%O@th1Jn~Rx?r#r1OJ>}lL z2FI_^71>;enO@*nI-*TJq$32Wm3{KyPS+T8*`0p1^N=o!RT%iVwiX;5pwB8FxQ0p( zuPREJ^?~tsc$rk70Wzxd<(E{{a53hR%oI+9+~2)tLtw$fUav{Xd=L zvbzt3qM)Sx*vn@L>Nv09UuH}rwW1&&f}GBKv$E!th5|7|O_|-GuMg23&{%4om>#@t zmT9X*62@UieS}_nj6%cx^S2gGaA|G`=18p#hF!U+W%&HBhrjLYFvFiIx)DDm082~c zJsRt!P%VkI8;%#aZq9=hMCa(y_3IMb_^Iw0(W(}@GddFAc9uMTsw|Rp-?hFWdODP6 zxT?bC16c?k83(JE74>X^1ZDO@GXRRu$@jCF>imsCW&MgJg$PO}ge>K?Q2@b`C_qGv zo@nwz>E8tqPGCtjH=tNjKv3Dkq@`h!4%$rPhQjvvR{7r@!ggh!C3u|2|CyU8+n7iu zKLLI88DlW%A+?~8SoLr9nT{Y79C4cloYcl2JcLC+Y5SHx{*`|^TuVN<3;TMii}(~auIYF2Z=D#s@uBN{)~EiC=&l-!n$ErHluLF+eG#z?_N@;LDPLsENVsm z`b3HB8_OBaACF{tbPbmBZ{Th9LjPjdFw}k1&ihVs>$ebGf{&$17p2a!>7Y3T-+&vB zbkH&a7W*_QKHkJXQf|JyaTPT3Qo0JdVc0fymAq*f9R2%i!#^ZWtt8BW{cha}%64ZY zFgVlP-OO~CyUM8ak&#f_4bpD|0s`NRD zM{^n!9S;6x@>&=eXlWE?KlE|>Q@|q+ENA={=!~crw(c)<_GkbVGgC}g9ICjY?IV<< zv%pKG7HBO;pTJ4Q0bcj-bgEFz7N}t9n}&b!W8_8lOVEg6NU4ta#fgIOnr4GT#Yp_O z)%1!!*glwGMuTmHzoPNjl8BsQ_aWC3HRrQM%&rx$XNf4Z{vWz0pWjf5*Ka$p+|leO z1s`V3}%R8ch zE314MmJ#I~kfUJwR%ExVoQ0c?FAP2VXU>E<=-_=NuymjV8GXc_2HZ>g2AmnAEBTm& z=X#ovMmnt?qQT{;)*gVYqHQTNm;BX~hnz5+9TvhrBcJZk+fWFF@fi!Op2Ra$jHWR}#$)onxFN&azP%5Buhyv6S_BYtlf% zj`czZCxiSFSbkgS zS$6QCqHG~eawtXMHNuqKX0hM1p3w^8(xD%g95S=ZNCw9bEf$G-CTKpCCDFM&*s3zt z0$hwiRvy=IeB-hA68EIvX`nM#2b4GQgbJ4D55+;rTGETKcwS^&sHK6`%E)Poj3!OE z---MBJESu_qucgdwyF;l8Bj|L?>qa9h>@wpG2GCk2SyBp7<6IzhQ73md^7R_E!Z;r`xNBjb9|ioIrG5+3S5gyu05W(`;UgdeCab*+jN*U=h- z?(C4r#d&Cnz;cRt8;V7a`&7Czpf-6JST-}E%?f5UoEVyustwQU75UIs5!ovJXX2CR zV6Fi#tIWNl(|3tZ-l9UY(jCA(Gda(*>J#x6k~WN-elVlM%~l9Rgp$k z|C7hJx8`P_9%_ysVOhV+``gm8#P!H2Bpu7JcFaALnl=3tq7+`~-J~g|JFzA`zh9YZ zK=FQ)tkcVwTtw&gP*`qM|B{b@ELUHYxT*u?&TB3BeV31>WA{;>r*nT9ihL4c>H16uKD{uo__-QWB|8{tcw3jGBsJHz;P%O zx&~i9tLFf=)^qz)5awR)j2Rpb_F)my_UlapCQ6A*sx9qn0lL76= z_4iF(P{(6Za^Ge=`19{hM=b6!&GW;|N0PyuVm}-e5NY)ClhoNM=**@PQ5fUhk)L|a z3bO4+%W-COwx$Nv4r#OWetQ7b@%dT$XW(X_A$kQ+eJ!<~f0AncmDdjhGMJBd?foo1m zcq_05SFV=+Smi|-rTDkSvIt4|g~H{#oR%zygRJkk5x3U%`#8mtJrx^fR&ij$?-$3l z07Cu2AqfuBTI}46vh4TzC^!`CRNSAnCgE<<6lR6WGb7N`Hc>;r+f76yaT9(2A%Rz> zYa&f4&*)lqv{xy|teMY3LFgYrq}>_kouaLicf$(t1^7GaQE7#++Hk+cP z@+lVW4~Q(qDmW@Y^kI~+SJ?xnGaz=%RuJQ zHZM0cD^{@{jiH?O<9jrh9#Wv~SP%2`57UmTrTr>1Q@1R5;kRe6iU17-hI+Y=dF>jy zsaite{7QJidY=#olNTaf<&zVEy@cvZ#yX!0X7uXV%boCT(_W*`>;Aj?-)#B6zZ|O4 zY^kn#*RsU5^_A5|fWxgah8nwXz?{;A3l)4ZWewVuigCMpV&Hi7h2-M|{?z$ZEgr@m z=2=lZg#=IRd<@_N3f6%WLk9ju<$KCKMM=YnK03pNSJM;vje`t$%D@?8<$_M@r(TrX zRNn(t5@2|{Ik;TthijAz^0zH~V$x)1>68fui@vg=xOpiXZe%gL(7dq`by>c7G)GaT zkuY@@WG!k5;fR+lP@iNtfC3$ckB#N=NUQ7`#244glX0;yCq1BaggLW&75}~Y_Y1<% zAaY{fHx4`Xp&IDYrQi6O>1BlYcJYb|{~|%S7#7dVYD|*=Zk_|BcugT4^FtdAnJ5Kx z{)+ghe@??Fb!vMwuzn!%>2$ebNg7PT^MCspDQAwQ{pTQzW4fuB13EA(BmC+^a+GX} zz0~v;0+xv#7*vZFv>*J;o`t;cSRC%A{L8uQ!A=%s=+b@0H1vR)^`dpEgVi>EkyUuiiowo~M0& zM0GkrIVJ&)zI`sA{s1mwdYfYQo#?3kHaUP78*pX5L2$sA6pcB=f5fNpSSlZhMK8&E8gURMNQm&^8IBX2&e$Exo(OP+lpfcFvM?F?r!S#Ov4CAQ_~xr6XSI;b zcH|iNd*TdQ{56z+R!nIX_AGIk^^|cH_BPjT_Xeo~um~7tBFS%gaYzCDy3ERR!jM` zNs=`WePAeF$tH-d#R;J}!&)c5{CfbG(;ET`6S?Zu_vIzvkHGKWjiV@s`(#KHSOwI+ zm%9;Vd}kr0m*uX*3)vaLO0xcL7+muG-(>#HoBxaJhK|bzGZ`B~%CdhXUW)s5RQ~Ty z(NzE6c1r#fzcnTd&)G2lqEvK+e$&XFrJ0J8kl^y##hmXO#c-StKS&peU6su9T3f=J z5t%dYmY<53f>C@ky9+V}{}NwRtiAcQ%9|E13c2ZLKGZKT1WVeiWnUfQNqdvamE{es zD3%sUrt=)AFzmO+`Y1f#PpV?{^CedN@s0QWbf}4F!ZGCWitlbb*yw?c@P?F&fhrc_ zelhri6h!%13x#F7)n7&IX3k`Q>2@lxd2E&9Ws`pM2HJfMqfP5_6;@40}87Z~KJ%W@GKuQp%=13~}64mS&4 zdB(VacvjlV+b*B|@jYojKT@O#iWMiNVDOa@n<0%`yC7qH2oxQl;rb=_I_GBdYeZ+Y z?zs5NyWhRu?O)I_ZZi2Wb*ltUd?Z=&pLl=wR@RRbx4LGcYmG+swmRWIMNwGGO(4%N zzi{{zIIo5F)tIVGs!8cCYZgPpSR$l6N}@ncl6*Nyx9Wv$3p>9=7I~f?*Bw2d;x9N@O$G^ZcOpi4N z5M{g%?;dBefY9M6%?M5C|I_WHrqRx`Vz`^NWo|HW+-(}2REO3RQQ?GzQIyZJFftnc z=R?|sonWe?{SS;Q`G}0lM}2b)@{ig5eFZ_9N%L21ToSQ8Nk3w&Q?fKf21?Q2Gv$(B ze_SpV1Gl_Ph@aN?`A9)$VRvr5L&f&aow(;RYaX^SrRjRn9A+-M8TsQPjgPh^6zENhF`F^WqyW=@we9A+$@f4sA2J4*k0Fjw=57U zRt6Fn7Sg5K;>3aD;L@llSqB%OAgS zomK=#y`3Qx8{IB34wGZ7G8;K@rl~Th&abuf6rC?hgB2CFie^PZw?ER>)UK0f?SGJ^DXia zdEYZ-Fp-gn;IPP5tLeV;h^>U;|3PARS1+pigKCCJz|^eV6nWR3C6cfIjlH*win8nD zg>U3mL`pz91{4HEKtMW1y1QFIrMq*KE@=d*p*sa>7^OzKJ4U)=$bqSM?)!Ppd)8TJ zy`SE1XPs}XHLQK@Yp;F%_ujwSmWS79cQFoCd7C#9%u7(c6lWGCztr&4Y#cbz;{vwg*#n+`&$1`CP`Y$L8 zpNvOL(sA-~T@;aqb$->W?YWW9QcD63CRS!pVGoWH0XO!3$5->MMFQ$TO+qY!`5}=G-Fm0}}TPWu^WcwC^LhE8M zy?R<0%)GeBFQ-DU_YtRYauV~LH&_qsDeiLctwvstqbuXbrqDB4HD+^?b;FpIF(jSg z|HuLuV*=rbaxWRN=e803Qjzd?td zPN7YIa!SKR6{7$9kN59p)>qKJ3b-&b1$4v&nNUc6!FsrTci8xIbDD{ z6S%LSs`|U?fz!i-F^z$NZ_fd}N*{^h>n1RYfDp#DVC?Dye&BaaM)B0kg=IxgpIy0* z=%$L)cFYX>!OYeGENQqUS}G}J3Cpv(UsPSxQ{6a5{V~%j!2YcS$P|V3w!~V4WoP^6 z48<|A*f=a?>=ws7{-e`!xhun42ZK6)uW#StCpw`JDw<31iX>(jzaDLn&-bxQl<5w{ zYm}|iy+8$J%GkjQF8J_oQ3hrW4x=njK#S_&U1i_h3{$5zY)9auRh#uv*Z)-60?K3D zBG0w7?>29wYkP3*y#U2k^ewUAc=IP^Ei%wnsexLY^7 z5mu>I@c`l#kI+cgR&;E5SzY0$u-k+ks;Y}51SgP9-(&*g0o=8lhjpJnId(!H7)>%; zTJ))oNrF=lMQgh6CW*)}lX$u!pP4-tcTnw|-OI^{F!afEa|9W*o1*kY%o{Q0yE9Ai ziJSD)#Q+{Zwh!7L#KI60DhT{f&c~%71 z{bwDICV51V%}sXV zy?<4fK|>+R)QZ`w-#XJp<%Uxo>wsqtkA06Z(zIXnk1s|94fiIC2-=322BQvu>u>uX z>-!QbM3f3JnXJ*wP&|^K2J7Pf^div?hQ8CY6PqsBjze#8^goF$Lm9JKxU{lXp3=rY zQnwY0#rBi2V{~#jOSL4^{@0%Vhuu|mFU*v=(h7YF_vj_jcK%Ou|6y@?`(vyh&B_wS z_6?H=%l%*q(=OOo`(o1*ut1N#aK&91mE1;}s3t?Xa2QT-t)D@@w6B43*LpN)L} zrt1Bc)#5RCg*rczyc#P%z5NG;%rNXACh#=)vDDpO@9Rx3&nP~CZ+d%^^OBuuC|)nU z+#h%d`iXeAzna$l$MvLbp*(+6ZNKT7F6$|Dpou;BF8lI?uQ&V*rn&Y|U`#|d)BCG& zO=p%M(nNz-Z11aBDG{4cn6UxN%hxp{4?X|H+tG0b$<~5AlA4+7cM_*S?kXYcvs~VQ zuZNbnkSpzB+L+!NW^vqh_f|0sKM7x{h_i<=4Vl=kxN2~M{g!_ICM;Fyo5*_1@`~RSloawa{m^b zJl@#{pZ8r~t5|ZKMAtb#F=+DSXUyH8I^5wosbc`!zI z=liK&wTJ)9xc1*zok*35EO!boQe>|o?K{zTE?=8z)Qd$G4Vub~Sk&%PY}yoNlw-Az zXm|c}7CUf`l*q6f_f!VFs)%9Q1T|qFNQH{|tYp5HZMnt&D~R2lb*z9Z-mgH(2Gqmz z?9rr2v*u&0Y*f*(^}Ui`Wpd(Z73-(6ZOnSEuTt9M+p~{+Pv@wm=&>q$35kVc0^=)# zwCPXqD-xpZS06b((tCm}8l)R27H`ndiKl=fLXRQHla6(qH zI6~-BwdJ&ZY!ADH)#OlnXfu$oE~Vw9Chj~w@q?(@rzg2R{WW##G}Zy)Jqja6+CaaM zZ9>0n9>Sko>5&H`isl7n+$YT6?f4ff*bd=EZVc zo?NY}H56U9F*@jE>eI)tsT%1gvI{oY1pT^jZ2$-6BLKQ}M8fa{n>0jN*nvQNfRYun zzCLgBoVBw05p6%VA9u)d=v7sW?#a4GtNgXTl3CTk8p`<}X=r8dz`$3A7u?<`rRtYB z4OSjR?BZhgcbUC>pi*EH^sl*AL!&Q_g{iNs^d-N}^d-RAVIZeO9}E}0&x zCdu75&*3rZFV@_)k2NtCu)&==2fJ#!D`-#HFwoeU88fd+3oX)#MA3X1` z#e6Irl-m9P4L6iAL>PBfHjiT8QiVbrQ!II3aikO4vAG$}ZD(y>2r`06CR1t>qPIT*=)ikTL z=xvo6n6M3HJ9Vr3?X4@m&FAmytGDuv`eqvqc-4IOROg3bi8_R*+*3`IRm#DL$d&Bqab*H zYwVTK3Y!FSg~;l9(U!z_%_mh~e0`eG>TIYgyk#wbi1((O(xu~8Ok*ND^eNZ|GDkR% z^%h=uBXNVesFxIXf_V+AuC@DS89Z|Z&cR?e!8Z}PKC5A?AjB^SnPW{`mQRg`d^aOf$FZx$Tcg49 z;;)=bhy`{7bpBRy=^!WTrp*YBrNN?>gXCkej?A2!kP#3f5DB_P8d_IMEzgSn*yFmu z?JWL*4>Cr9&+>wknN^bQPR&8p4x$w^_q{cCGePx*!Hi`uZh4=p)Nh^|Ag9v>HdBaO zc4U4#S@&5eJ0w5+*4ZYLlqJp{{8Z%h5i7@zbT;#>yn*;-TSFeH0;euA_UJKfZa0M2v$k$dDq2v}`o1>MHW$1{A^!9jfA)XR9sF+{vw#JZHS zE!Veg%kSe*wu3$!=j<9SzA=Jl#&R)U`4i;WXBJ9*-@IH}a|*>DDw%1Q=p@iK9poMq z6b)h)nhk%s5)r+ch`X}()?t~mk#L46H43n2E5!Th+z}8ivIRQfe19La+z0B7U{VDD z3O&ba%rGwb>p~`R1Ds|5KMd*%+aLt9?Y323<=9ie; zHD(1zgbtkwupU6dY^Nsey=mKI&Rf{A?!^bSKAu)gnTF_yx1ko4MUWj&cqvFV1g}@W z=l2=G38}!?8_K%_(!F5gYxcbgWu^{HZ93sB=JT_1o20KP#QQVuNQja1@!3Wk@A<(= zaw73=dv!={O9-0A(%LvAMqX+cGo4Ama|3x?`bz~4e)WS5I%VQmP5v>Cey_{x91a?c*o|b*K=9oJ{?P<6uLa@5Huok4B(Bf!M~ZmXJa2$Kq>x3b;J+f? zwr}-ZXq8%ak`_<8V?C{M9@Ji5oDCehM%o8n6DQ*0OZh%kTw`&85m%_n4Q#$FDNzRc z$^p?Txe_o9lR35MTF|si4?fREs7Vru+($#MnwNWdI*#v`wM4+M*PrV5OBq6nP*}({ zxNC=z6Zfv6xObJScHKciztrV5fmZ5V=MY@;z=$$)1G8~g9P;hV1Hbvwh5gqsz|hTq z{~rxH#E+*RLQD2AS|bHC@%+QY{d(NgjaA_6j5PX#BFWfbt&#r9{EkH~uG_!$4T z%f3>5hL5&uQ|!13c=XsiT*mN?t>{pJMwd`CV8ePh1XzGBBiXaqcFCjsnqU!NX^s!XJw*gyimDX;mPxu zD>WmHUj-VHWwjbuwmgQwo@1i2FaS4W^Quqwglj|hkj7*0nuf6l>$rO%8sUoQ zf((2^GauF)#k5@QsM1)mXnUN2Nl>&(GACp}biFTClhC=dP%=DKLqe!pCFUBtt@Vst z=PCGTg0^bREGTaId_nf6gCaFC&wUQu zD+-dzI0f3~x;q#Z!Z!Fx&8P;S@-g9NfK>mUGy#B~2eRR?;7ruA=4ZaQ8i=V*ScxxU z%%a+RSm6D_%X{mUqWtAo2#ndML{8iqc>`GnIyDa})LyeD%LitTjHpL!CW` zLE{9Ea@|wfN?a>HaIO4*4CMbbqD9nx&DrLR61z$$Fv*ZHR2}n3lg$l)YSpL~RI&e` z^B5wxK2Mx~#+j+;X~lvz>2apEp~|7o0?S?D(efOh6zpk*w#xnAzeH(W;!8=kH8oR) z4kQ*|haE--G_`-DAP%rYn?2wds`12RxuNPjKI5*16Fa(KKA!PF;f-9|JS#SLHky=5 zYfmC|kpPF=mb3oABwMGHR#MEdIKOL<`X8RUAo#UqU#yQ<={FGo&vS~y`dB6kk$yR@ zl3B3NC|vflkaqO3?BQ9W?pgJdXEJMjZt8l#`;SyPRmUHyyajg?y=@8!Z%IePom1>i zS387hcEubyPAfR8>*xAoualoO6f*gI0Q$M8dA+&`MaqAfg3B!r<^;~!TeW@2hzYKx za}iQli4Eo&L|xa9V+bN3=DuBv*kep!6nD!){A^RXOwGv`;kAchA$O{^Stxc7`_o`- z>$4H5Wv7oj7e~YWpW5m8`ix>WXHxD*`Kw!jL&OZ4z(Fr5xArNqpX89d$#%B-Wv=C{ zsm@@EV_TNV+Idw;8HFSHXHLWErFZUs?li@n6Ws(;in{`DJeaaQkmcOW71bWqlmlm# z8Za%{*1hNd)C8Hr+$9ZYJ#N=Q%)Z2ss5jR~^6D!ejF3dIFDp-EO#S1}XBGnI3`Ume z=)ltsAj)AGb|&cv3C5*3F9pQS7`bFP<`f)%rZ_HAOq9kh_cC`J^@ZezdXcP!oaUab zH1eMLNa=+Sz?>S#sWCpY+g8nsoQt)Fk2skO>XLju{^MMXrc%$Dn1+C#01S%SiQw=&#Hu1R1?x0y|Ve&DLE>Yj$CDpisY(o zjjT$dI);5P)2OKCWB4Dx7oph%iAe2}42)Xd$s=n!o=qm)p8g5DCd+mxT)iZ|)j2Y? zSycP}VSvIqbDBSIHkH*v;1RC%|C%jTauT4RIkl&)I{$PCXZxfaEggI&s^Kz1R!7H< z8{XId4)4)(jfT_UWMp1B&Xie&ur%M!u_Y09er*u-s(^Jp=nEZ#JFE5ZP&6oHgq{vbEvs3F3G& zlQc$-#i=yqnLnjOc(6V!01K3TROvBJ`Q{H`_p>opDOKQ0FA2jK&9k4G0ob*yRLLeO zEo>WrPXe2CvHMA12ZA9lz7hRzMon$kOQ3s};6byVX2G1nzgEoK{)IBCV=pg9#X_dM zf^c6NGd=Yn=w2*S`0fI9L)syIFO-DZeg998ILq#45mvNR%K*5dI;(Z$)^BEXw=jee zS;FQ1;pS_pjELAA$aoS{Y+eT>5oHa+2EI}L4aY4dk%6aOz#Lyp#JePU2fK%jWBjUq zf55)--1nFodAqhu+OB`ht-hAHx@@#2$RRlCN_A!@X<&C|l?d0>5Enr0r%fYt>ao9c zX-*pFPpmpDo$qT@N;@}iGMqJ#&0%b~iteCX^?F z61DV$7-f){V9o<^dSA!tW)-90SxXO;dY{yC-DVi%*_p?7B!lZCN~vsG)2GZOWMgZw zU0?0lT|@k`nGI{+gGEN^simE!4+ZxfNAJno6piAnuR@|5Og*e?t&@Ty$|ie2#>r#fldq&Aq+!2xBN z^DsZvW>;y5osVO%-HWNS)~~;hg&m6#Wo*DMmLoi{6zQ`1ok`={I#$FaH1FNTxu|U} z#e-Kc;F_$-kJpRy-3~R6JhSu8=?QnKjtzARbFb|nq>%bM9vT(;3exQtY%v>;Qhlf{ za1Pq87Z;FgON!$_PjOPrDxT3~cY%S?=e1I(evQrbkLM94rvI_(Hoz8lExQ~Z?GL@E z)vEjWU;i#<`);#>U&CpX{Jei0OCS7X@ITR0_^ zTR`9K!Z`ARW5D}&?-G5`4A12Egt3_Ae@(n2(p8Bc9($z3q-O2$+=!gBFUNF4Km2BU zrY*rXsA#}uv4bo}bwFFQY?J-&M)eGL3|ru-pW z!}wQ|mT%ve55J!*>VM!O*@|o8`t$h6c5Lh7{%JN1gt?=)QzB8Ad z^S)?7w|IU!MJv6JKZhQNmM;L7xAie&A8>ngY#FAmMSG>lygK}_w(I39MDJW+$$i=I%czG&uAg$5<2>$fs&PJOj?!DqUjQrg8wtcjnAJiUS%k|1 zk8RbcFwwNSF!!;p6WS42xzF#sqW!yN|$T+}`YqQY-YC>lbblZ=E9_ohcfD;KNUokjteK`y$B8vJI)eFf3v0na+ zy*mv)MOvNx#8_2UlsfP;y+6!UoD8`8L1@qfi>k5tcpcbOc8Hqf07NXGwsN3$XR+bF zuwda4{)<=95dYrTFvGr=+jQDl0Xd{gGW%#U%&=3t5YWWS%Be&^RmW`scpAvkv{`b0 z6g#tvH_S^@GKfKFLfwNpKS@r)f)3R?UuOwk-i`V8Y8uire$33Xe$k>y)rnmru-ekq zl#%%!vmOORSYUaT2lN%Dp^*N4*NbDGkbIdg!k!M<&p^Pq?mW8QROl6NqFr) z<#pN{Ly>QM2|-WebNw#M%R)E@p#cE6TqYgzi1)_~#aLzjWg#3`*G-QJGeUaxgulkk zLU;ZauDhRWp4S}K!0SZC;GQdh^c_5GGA(AL~-==?JP}a9H`SXy3?{;fhw?Q*<8Cq*tcgyNbRA*fcM6NWh695q*nON}v-iXZ~ z?_|EW1JPdh#>@1&OpwYJEA zyZH`3K9cJ?_uC7ZV8L!|8`Jd5>o_bqK5p;xT=*gP_fKgE)uPUL2rV7)E0zEHn$vFQ zOBJKkPPjRy8^7IG`iB5Zl=@(57OZ~ruj${g=rpto@0H50e@y>_8v!1KxT;na4?3EZ z%2Qhc3&!W)PoYS2(cvgRJvQI_{x-wSk^SKlha$DV;7Vae#p1~rrTHu)Hk|37>p`h? z?#qw=n*RU%)f7$<)23NIPMQ3~!aWnG><<2WFv{=kSb}t|HB?(&TmMls%f{%>+2@bm zWe)$^ce=JzkV&$}iEtccMIV>1R$x0^{qT^*0qBaMO4LWOY6?ts6tv~mO7lJyqBOJ_Sg+^J{c6xlg z9W2Wu#eKp=QXlVlF8H!?fcH4UG{ld$CW7ge*ODB;{@0?Izh3qm($L$^xW;marV;fa zid1;o_E7a(i49~8Ovg$tD6Z<}xqv@f-yRDsdlkKQIchzduX-ew~@%mlBa#^yW18YG$Mv_Z#|3)y&4_J}MOxF5dR3$X}d%?VhdD`!6iwb-{uLCgdF zjsA3WX>~P?&-Y6WInXT2CjBl;teuiZ1KnUYpXAAglDkRoE~k*t8^x^@V4>DnO=@(n3*}bqgdjZ7pQ| z`Cbw8NX0znYRYYsL^!H(yo+TFI0bCSNCv1eXec<57%`h#X~`A^pOdjK0VZ+ZW#CzN zATC_t9??lOjN!(?VJI>QWFM(nO0?029k6WZi z^*R`7%)IPHHp*?jX}Mh8k)ffvRy&Iy*LBj4LXN$0)^M7K&6Q?HyxnYf@fqHpn5ZcJ;XWEJ+ggtFom?T=YHj+y693 zJUiVa6nz~9%1uE{M@B`V1&*3`*HAj8!5e?a0R#9Nq0Hh@By+|bjSz_)u5&*9BPiI9 zwcho5C79-Us&LVprTMvoE9@x<_%Mpu-KlkdCwsJe4016pY>7C=LxxL-J!rSk2|ixW z4J@~cG+|dpj-#_ZRs>j5lh&RYm#>8nnxZxm zQMb@kO~o8AU?72s%-)I9Oi0+`9rHO7pW)b1U2puc)1dc>Kg}O@dwS3Jpk`y+^{#o} zCHKH8gJYP-A(Pd-B<{?5gvR(1$hhMF(T){^MOn_71Qb?pz43>cwI|})` zr7)i0g&9D%6DWdBzG(D!>bCN`d1aiu>Ql;~Jk#U0FHOnq?`B)7u;-W5O37Rrw0+}y z=B6_9SaC~jMq`OLLR(rnA|12a9hzbhZ-UMp4{62)s%T13Bmc6T)TO`cSRSBprc=KWF*D9tx;pPgGuJ#t_0u~>!8ff7 z!(*RL|3WT#3Kq6p>HtZ1!M+;#vr98;w#jyu_=ChXiY!WuPgD=4Re8mDU%@v+zAcd} z0%&+z_pG%CZl~hLclC=+UAk)CFkQF6T(awL@|1Ff8C@Yr4cbpz`PbNvi}CTQ=@-Vb zQA?29NJsyYr|{agox6J2Dd|SHG#sCD`Amb?V<8%n)$$^iIuJ~ z2(jCBlND_5Rq1-SUq&X3Ij$?W;i-9g2>L!wVr5BEKy_@J^8pQf2kFu+l$`CMy}jNq z0~0#dsB$HjT>V`F>H3-4{aE7Yw@pt!jpdMo7?vGr#x(CXdAn;ZA7YlvxaoR|CMBLX z2NlfCsWcH4EA zV2YlZ3|xq`u@MQJ<0|4c@~AQDu(s`~i~5ru65&;f>y<#P9dEcrS9e^-oB0pd(&3Hc zQoM}7E!-hTc+IWLjWZ?MOAB<;dXaa=5TGrqo)wOk^y%d#@Ig?`6d&v51<7?!6~Q** zq7(sv#BBQ$ufm*bO82Q1B!pJll15_fLUXR9p}F zLW|iQzC{=oEzDpC_F97G8e|_#fzn1`K*XqjxN zeMt_!!n%l`J_Ma630~yO))(ed9 z&p@&L2CD~*yu%Ap3n`#2Fqt=YyjlpENd)1H5pNe2tN_5_8;6?{c#vgWP zSN*~KYoHDN`sU}mCyDf?bX!?NetGeSyqKvW$(aBuYUB}~cT^9pHyal&R4L<287?ct zu)U2-gY}Waru=?!iH?|8aKjB;Qk0VcT+X@EuV9o*XfpbrC?LZV ztRM&j%mz8h2dXt4!eGWmqJ=xW9F7RtUB^U7^JG!7-EJUBZuzYTCl|W}>lbCF$u$4W z&CjYs+;PLQpK> zUf(ABn;v(QA3w>x@r?{d_nw;|!J_*A1oqhc6WH^7UdkE&)9{zXf)GVsVIYTx+%H#& z*ME8?g*uahKd8KZzWOYxB>_k%Ihov;Ry6=q&TzKU*X`0rHYtiT5nY~)9xK72PEzU` zSo=gDyL%AP+IlBQXM)&T0Crso{^e#=w=c!j2>6F#rwxZ$aA=*$Q zHpGk+yMr(+Xwz-tGtwAYu8H|$pro6r&b6c|TbK(4iVz&N*e*E4jWQtXu3oL!60*hj zoz7r46U845cIl58@8;ZOxUInV2oOg>n#=|ll9A2(mWmC&(dDM;M52%|bA zvL$LMZ8#qf8A6AowB#@L-9hf?A;esy^x-v; z?Ka39B!Y%2t(b#B7W2t+_8m{bAy$f_h}Q~JTI%%ucJ7n2m4%a|R}WkfPBhMwkL3Q` zwY;w7ahy+uL#Bkdn+nmBLtjNuct)K~-)zU)dRBecdV=#QXM+htMm_e(p>mbnDAX=j z1ek<*1n?OR1)h=^S_Vos-`##XPGxdfnSRFHaLTO3lx7E_tlIZRjmL3+Y5rN~ezz{a zL9md816s#r;=eQ>A(_N1TJ{ao7Z2BCAL|@ei?9k zj_`>eeh*Hw_r@0a2WKDq5Z?e`Uu;D2AHok+3?H_)5?;44$$h9S3O~6A>lu zq1Fyy47X%AiB3YwHxmzI-rHmDk6cCXa{U8LKwAgoZgv|r$%c6$uUd2u zTOaeDk^;|-o|j4Aewnk(uzcHn^9#9ty?jF40`sO>K8-zga~T+JvAEb=J4z53yYtLP zl&aV}RW~2-_KrVRrL6B7t1+?y;db&-gy4{YYvE<5)Uyu!8$nz->0n#J;i~A~=Lp)D zw?~l7#5pri@7aK(D;%-xS9I0ON-)@}2d)jb{DIm9)_up$8+p&xUEv;ALIX^q(g`z!rpPBS-SFnYUX=fni!ZQ0bc!I ziy91bJ6~sq6-vMgnN0GS2L2h>U}Jx;k7sUlC-BCHjt%W)j!D!0Hj;KptVSVL{_6Ne z)eFFy(8s5(X=g0=QQm6wP6S+sZ0>SS(5T3T+khi7Q#^odx`9qv+vrO10?2$)V|86a z+p|#?_1<>u;rmCN1oo&+)(oYJzKbSkkpjLd1N+k)$WtUPWDO;B)#rap_H6&@Vn(gb z`^g4^=7b7!P)b8xnFPlA$E1d-2>ko#b9<0Pa{?=}DOVZ&xQ@NMOp^ItjU7Prp0cci zZ~`t-;xb&EFUM=DVtvGO>@&lJ;_DZfDBxM*>&^J4ERlEYXCX%9@y80kCGBWxBp`^; zi=?+775tFLzP&?LwK2!E3Jp@Xh?Ijz-b!;Ow!LR>D3qJ#(!CTU#25#&E3`Rozs4=u zBXGdyXmiiYRT1WS>7JBk{DKE3Z8v!93e{R)8vs3)ybzJg0AjVt$Y?K_bv(I5lar|vJkI1pE zgS>7oJ+I}W`N<`#vY1_oXmEAfodUs+Q$tf%y1k;BrXPQ^M_n)8w5&&(x>zx#=;~b7 zWteYdkA5)y0yNjUgs;BjQ)Z6eVZvkMuI{=gKnZ4POx?F_L% z#7{{h+$0m|JYPCoFXNgX#{167yq0dbZaw_)Wqg>y=+uGnDHie+zS6?mukd!t8L)Ho0bba@_@RNU*ZX=jy@8^YwXMp*T! z2#o~L#wJFdyu03KAGIMP?e`@vE!dEzJaz!r0*)<1&XqaBL(tSj(`o|h2q$at5Ry=g z7O)80R-appRVYmG7G8;Oi7vEEmVhHjYGOB=&Uy+__GMMosM-Yx0OC{7 zt=-Y?eaNgJ6}rXU(Z$q^BZfV{SYStmSJ@aZP5u4l;7?Y=y48t?UvkeMAz%0 zvB^0;qe)U&FCGFy66146dyxGK%m6WHV}_V~!{dEEJ;`ifZqs$fXz(qSi1(M73atDL zstsiXU_934%P9zt8Z}7p&vbN2ceOtHEp6g%Bx%}=%vbgrZHM!U>}3-zX-r9Ns*M=S zzP2s6Rkf18m3LoeZU0KZggYx5n)PD#Lgf(ph8B#}zq(HbVXTZ1mUO85rbk+eJ}Xws z_0U>z&#Jvk6vX0TRc$xVGDo|ZW-9twg2Zz(KXQYiUW_#&0!l>#)~sYy)s#fOI-yHr zbI%~BQN_=L9ELuy5bh$@dH<;8JlsayM;osc24;Ut8fULaP zrTOpOZPed~aM!g9GMq(2P8@Sy!j@dTmsI)l=b!LLtZz8mC&FJW>$}m||LF^Hyk{|d zUQH1fL+?;1ruB*Pz~n17A0O=XPuL{>RicYSc~h=b)&QD-QNoF~B?raAlO!-XM81-% z9MQz}tAswsPl%37R_@x}?JCGR%}9Hy;s}D68n&D7d##Q{E!mCzQgLn4RBCdK2UdTR z>tyBOB%C<7o92Be;)4@RX|x9oD=z`&uk>9EPuIEz(}TSFu>a&^F8W9V%Eb?B8+|ev zxMFS(STxo`khyOGLM6c!{=~`bX01Qw%p@6oFUjTHJzB>TGZLyEz#ac$TZ~-wy}NNZ^=43M3v30LG=%IJ;tIR*}n z18<0{f2Rc$-xDQcxPG?~ROPH3vHZH%Yud^*X89~x?|`FCaR;2LDJhT>bYNddfZc6 zb{;fu9zy9;%FXr?df-@-D0u;vwLee{qz!7?zemg;p7b{2dij7=E^WqE##HOvEe@=IbnR%~OO56Z=x>ROzbD0^O%<>5iV zq=F3)5sK*y%OEMv2`9N%=#Lqzy|B~PY_#U_;`>dKdXuZaXzhs7UairavQ?nBGfahY ze6Q)==N{rfK+~QRzl!4P7WAwEDkZ${yF*~=2!@Kr@@?S=rU43${(JZSN6T*SdWy8A zBs&Np*HQ_$7ur5Mv%?i4Iuc9f>;c$&@A+!piK7eClixix8415NHhKavvV)?gT^ss) zKV;+p*opfD;YXsOx`j+Qw(!kK4ApE?hJPxWzzw))pCQ@HdDs7!)0D-0S}PmUOX9QT zU)7D11ADRzA^S4O6c`Qrq~K)t4fYe>aD?YrpU6~L2OAoAmM`0*Z)iSTQVXqfv+Ll3 zVF5hfX|pZfuSc9oei|0QR@pwN2`5Xj*7ql?wgaJlA>YX_sSI86f0)VC&LnD3L^8Fg z5NVw?KmlY7PN5kFtq-{VFx=Z^`Bf9uf@KNWZg}B3i~r&db@W?N#?-LVasU7#rmEUk z_PPF6c19%b3O>Uv=u#7mitvsbi@@;XdYv3`iaIQgTmK|E`eJeohnh0P_%taRj@B~^ zzq*bQTYZf&wD>T3HU+_sUchkdJ9X++^+?IS97Jx(1!@leJZ*TpSwC;x!5&~GOHgA6 zK|MN}B=r~`73#M*LGr_v%TC`B8{t6=-lDi$Ml^f;ck>3tX1?2KiV)hY2Q`EKV36V5 zE%_PLZNUeypXq1oCP((;FphlZ)D3B_b>7ZBie^nfb*b1^zSv$821~wdzlyq9*77zL z!Gp{hdnHF0%fwup<8atf?321GtGK+Yv#Dgm%3e#z?G>q&?}%@ZTe`?E>>C2-@B0QT zQ|uXgG(2r*ov$!K*czuWtn%}&bb&(yB=3k($%5h6C@D;A@Hq!lY657A6T`uqj%YL* z43Z|NAR~Q|Q+kFOE?Ml_u&I48Li>#!vp}=K0B?du^xFC`YT!!oKas9D8!|id`a3+6 z9ndua*$XLnkZdPEw%&FKHQd0`urB$uRs15U=RX0kCAT;K1iHTeZ=mZApxO=!)tb~s z_5b}gw-=i)Iv5Ic6H)j%CD|N9P4kDG(qnyER@gB%wUxOtb;vl~Y|P$RGItO&@fnws zjmei4d&zl4m`fMlr!-xF-gruY1XtJ5wGs+i+#LTOpb31dHOo%P0TcvGbDc*Gj`qJ40kyUdY^0B2F!5etbA1(uOSx zQN8ftXd?gHS@i8Pm)DoUYB*TqVceBzASzTDdDnc{X#D}cLyu76*h%yaE(T> zO!8O^L=m<05(vY8$x6|18N2&c9^+4Ladq2%T%TJ$p*;!wE9PC=GbEJRU*xnZhbL)9 zdO6UkqgP|3RJ>1y2+d;VdzJpGm}(X{P)9xRZd+`2nu=>oQA&!@R44k>cbn=|X+a*@ zvf`(XusB^ayY9T;Ayx#tg)Uk?;7amcBvcmbeoJxjq{A|ieBIIbM4O-j08jLL%>4q}n-l8?l_)+v90#>i6Ix@T z5xcCQzih?Js&(Uf0~2;?yDhB^Q$}V%SP6rFO22E`{J<2<6&m9G7ymVuAnsip?L>|p zB+H;_o@|vPx0yPC7|>Yq%ty3#Bav(AG(N`X_lt($HwJdPMWm95pY@ZG3~%lLx_?1d zJmeXl|Bozy{NqfeUs91O3U0*3H8y_ofu??Lv>|kF(8ME#$gNciLUK4-HEX4tuw5r8fR)Ta=!F9S={|F)_NNd zWo+=H?t(x+h{i%E=FaSRPxibgY$swaG5zu;O^L+Dp3Zyt)Tm`sgs(pP}H47{FbWRh7$h_IZu{s}b=N z?wxlnv4SUR{cc1lLzCLa5Vs4@Qq`vdCO069?}F*G-^j1{1>G9}ya8}X#Jvdh80_6Y z;miYi3Nu7AeLI&Fpq)n^rZJF!v!*}q`O?X+?g=)CcJ+bVLRSnn>X;?CMU2%x$aTF{ zchca6+t#wQq$8>bG>J5*b?LNuwJ5{*&P7q&p%8XliW~Um#;|MP@`l6md)DVpId!#o z#7$j+-WE|O#<>Vr^XH@9|HaWc$RaXDt4x$6KPH*_^pcbOH_5$*N}()4#Ddy|RAn6OdVlz-V8g8iCJJo%n$~L-E&P`eR zAdfufs(z2Q^oRjm2$8J7aV`OJMP`~Y$d>gM#fM_X=)bQGnskC5p+HOfwo$Ac;CtYw zOkwX3y>RGRrSmaF$mQzCJkhum$FhPJ7+fePp3=1hvQNE!3c++LiZ=)T(U8$@PEdw# zA?t!ogPqwr&$LaXCLs7X^W9d!;G-@q>Vo&|3LJf_iR6|3Oe+n1UO07d1ze{+y6C>E zEKg}p5Pgkn%}zgh@&$N%YpU^U%Ll7@QkE_+73; zZRYKePjQRpwfr0G|HIyQM@99#{i&#^G)3uE5m0)OURI?^N2Ir^W zx22b*_adxx=^#=Tq%E-RX8k2^@;yoZN#2|!=Oq8^IWu?ez0b_-eP*6#KA-0)4=Y$a zd4;aME8F^Oc*J+BRA4aPNphZ#!h&U2HW__bc#Z?EXO;S-~8A$9h4Zu*9xngJA2O6x4o_e_`2LfErrW^W{?X;(xe3- zX`EYjME5|*OZA|ln*o^9DUCEI3z@b*lE)Epb?D%xCwj1aQqF~{Dfw0ti1y=vkb6W` zZ1d`il0(ZUy;Kj+>5KEVm)PTP4IIFU3F=fh-XX8O zj5aLt12^tk01V#6e{07&&p-oJLdU;mb{efayN-8>pt&8+;_m8=d%C81q_}bDSdJ~G z;4WsH=_BpliC~IbRd>vkWBJ66KR-H}$*k-d_AHiTuO*t+**NqGXJoD8z^n}lqM(!ipyMu9WslTa|M#s(_T_>R8md+b4q0{TMLG+8b-@`#`+c;q3 zX>r&aK`7?3irXxVZ_?$c`dB5Thu)!l+yhat@6j%vewe zXE)ZVv)B_YrR@yTpFLVlJ=$hdXPWlwXCcI}rKy{E+3q^o5p?u7?z*R@BsHKI-K8pR za!aE#K~aaO6C~U8K;t4{+T^|h9cxg{l}{rZ6fcDOt&?EFb1Y%W@jo8fGs15@2c9x+ z7?q`PFEqc3ezUs<)SRY<{% zFH>p@rZl)pz+P3T04g-qLj0#qz6J~)w4HUCC2=A>ao#?QiNmyvZTOF)(j|nq)6=&x z*@tbyR}6l6JzrH7q^f=^`qK1@>T2ofqd_W`K}aWv0%1%Dv>^iVbWVTU9a3L~pObv& zvp>l zhqv3=5Taw@o0t6cbZ+MT8D#1{GgL$JsOkNa{jPAvl#bJ_y4-l#WXHrn&h&4IBg45q zR_aU#dH4r<8GG`rw+6R=Q$Vf|_sGh8jR``Hi%vQxG8SD#KO;*Lr+#fKB4b-vjX%G~ z*nn16g9+n_2_c?R+k6jAUXIiRtOSy%Ia@(|?N*NSM+B9aB9jO7D$^Ga-piR)O>Vm! zl;iboG)K?eDWGI-IF0sUMxkIddf4H!qDJ#QTD3YKz=GTdc;bbfe`{)_19?q&NupFNnz2)djT_ z)@+(RJ(_hOv3YKS5&1jTByJd!tO|(voSmcww@rqf_cXkjP;a&9!<5eLe)}>aJ%&N{ z+08DYrndRRt(iSp_3lxa@CWadxe9DMR>5ENR(%G^;h`~3IkMr%oX7X};B*`d?7CUD zho2PmlSgECYWtG0RH|(S<0O*zk%{>CVjU7eds!ziT+r+Bpt+YE3tP26cUUSB9^UgZ zrXN|V3Px!Fl)i0}Hc4xsND!VRqr5Ug4F+N&+7d6BGLDUhObN81i4KBR+`=f&vZuoT^*lKhaJ z=)RzZKoVuR0p}c!IJ)%f9mHb1(Yfsk3#2(|1u_YcoG-93p~+AC0{_0wYa!ic*V|kl zz}Y8LB@M7VJ=2hqVGH`xemEnmU#Ne|)T+Bv2Z>JFw9;$W?_9U~)N&=IlW=2vblkVg zS##T%(&u(xPXEidJ-zPYW{cEh2x&+t&E5R-K1PeCld_4c{g!(@%I1IiO3zPKKExp) zEV}Y|pfJ7^_ux$1Ll!)B`mlNmfN)C9wssejU2A$9BAB(m|PS^kz^@ zSMzc6Tp_qyVCgY<_|Yft+&6u|ensQE++=&)vnP6c2T|TcaUH^pl(d)yscXjXgWlgH z#LtoLzIs#J?t$Bj@|OPDxbGcoC*AxU#m+dvLVSHzuO+^<0cV-f% zxQ~>`W(q@_t8*mqg`<>B`=><3Z8gY&FL_59G8h{>XllnxFKwmtK`D9E?u|kJ)IzGo zGlO>DiTYXXMWZ>WF={n7wc=Wzd~1O`Iy%^{?15^1HSb7w=+0zZkdQ!L@`wuCIjxn0 zRaipph{Y%OC)tb<1E}*jhZ?UKHJA;tW?=Wm)DY2qq$U3QYZm1JCZCVaTdYaVm=09( z4jE<(7f?v+z7?qU`{!%G3PgYb3EXprs}*~a>e&#|Z7r!b=rnBtc#4gfWS}w47Fv0~ zK-C!-FfZJy8DLJ`qa~M1Zu5M3yYGjMl^GXO zUEi1K*n09^N%{^~0G@lp@bWr6ETH4ceI&f!;+yu>FDKp5FFjg53GR4u?g$SiO_{BW z(+ge}+N%0*c7jeZ5uB+<{4pp}gt#%$#___L< z@D*3up35xUZ}{RT=g-cukU;sWIR%Rq)|#xP8fRl}wl<0x8Vt7p?^b1bWxRbY1G%B$ znxt$qpC2TGv)CVaRmp21uJF{>8h(p=!8*^>@O)lJsCGrw;V_k*^0GR zR7th;f*n9}7Ju=~v&dEz9pdK(_xa%02=SccOe>ds7DbrcE-Y4uPa5SEHADFr!!mHH z8Ozfp0I0IYDdRdP?zGJVzO4FEVW{DPCexA0>OS%|aY?XA6RnZaabB+)t>3qeToHu@aO?o2}0W)_X4;axOU_ zH4nExVh`gWQ9;;k`(Qn#@)pQXD?|yWg$eB+mXovya3Vz0_gG37b8-?ef_!0BAhd3;>o( z4p*9Ktn!#nLWD&Z3qUcv#5jHzCN?>-o0fFFTSQeRMiP_WoWw%Zch`J%p-JiCtd2Jy z23~&)1A+ z6H0T(^S5H%$@+}FL2y{^_(`hK9`kNgulg>9CGq6#@Z>l@3ZG1q`|5U(4Cec1LcjWS z^K$Ne#~k_%f5OK}dl>gh69mJb)KO_p*MGXeM0p2wZVYiOuvi+ht`G>I#5?sEWL1Yj zIKNe`26@s*{R}U;x9^OH2ibsNZYl-q7n77#u;snX6t!Kv2B#`7#t%Lmo_q7VAsDaX zzxeR*IxBea?ShP+E6~ivHFEv4L^WwFeibuS*S(1snYFCFZ9G70D?KldvEj9P%Ezo%LdSgVOcEhty$Q0f&4i(fJbl7sdTQ()^v!JVg zXs_@-p2cPS^4I(WM41@|?TNoZ(`jifyVKitE*ao50NHvB0>mt&9?VNBT0TBXqG~ym z#cKUpRSpIqkWOlWwD)4>{?{9RT^!TESG%UC=UbFo*(W0je7_kq+-Nv*h_6WI6iK|H zH7?_BH1xgF1$vTw8YaeEAg}|8Td-6_ukQ$17*@swV+|N9(RNSD$F~FbxOc3@!K*G1 zTxJU7WK2{Y+?N}l;a3T4Ps%QP^#&{f++h5a=jv7QczshEpf5U9+~{o_O3Xt+>Nq)Q z-%BCjy5G$!uYTR{g)j%pC&}`Or&ojSa&K-Vdqk9WN8d};NL)Anjt76`nFnEjwrIYY z3abKo{-7b*9bSU_uCfw1XNn|}t(k4t*<&KMdc+WZyz520#~<)BzSJ=|bwjOqnphqm8J)N$w(s!Otw)a{6hP*Oc|{ahH$kG6IxdmxfNKi?g*-J=CB#~n%$$a@4Dl)gR+_{IzU zD5$tj*RX!|Px{=!4h7_bt*Pb|>9X1uLhP)am~R$r_|Wv(yPtUbRZ7NAQjA@3R)kXm z^BXIUZ}2NY3Q}0m?rY-$VYh}(<%petKUPtq8o%LD9`d4)xp!V2T*_D1XdlPIXDzrh zlQb`-`_U8V6Mz7-T_bMy3h>)x^!K00Nx65%ay;=kg;?5lp^Fq2)k9s7(tSjKeQPSD z7cCq)#oi0r)?#;% zNp0VrU2Dc^+q~?0N&KEr+oPMbxAR{hu0O0Et<8|)Y zsF8;r_XmA0Tp7h}O?bwk81;r^WFQmmh@Z{1_ID}KE0c5ESi^}xNgm5Ss$6ruqqaXO$3ngSBND^D%W|gIC=<`;r-@WZ zH~>;(?IJdM*ns`*$i()9TJ6n)7kZk^zX5lzIH)x^aiZ1}_2rCnqw?xjBdOa%!^Ji=EkinXIesSD9ET9-iG`Nn;;Rmz5jwq6QYo_i2TEI4rkUIhGNF5^ziHe z0cIf?w70m;rP06TG%5Nv&as)Wh%<(9rTzfa#UJZ(EcB7>eN}AMjbgoyLJVZ5#Y+BS zTfi5Zj?BEui5J(NNQHKC zN3?a?*OWbF&7VTqp4T|IyL|Qt`n9p3tg1s10|dFw^w^hGWV~j5_2({OI*?G~0RajF zvMY zZu*^!Uf~up+;KgoP8MdYy!u3ON+@^8xYY75NK=3(2E~*cBO{)qD zg;P=j6TvgWi14_;6?0tNB3^_i3L)cpTO|7VBb*g#+2D1jXrJncvH3K6O3DfF5@weX&pABC^h>jVD#$nKawKybNjY8!J?r26+sP1kQj zeFNWAr}o39D?J1!g&JsOu6C@;OPyeEFAPV6kGZ~<&=GjUzmn|ADsrwf4M*$|)mHRJ za$dbg%3(2M;B@A>J2bEtrCkH|!NI4Dm(eKCs~pVx^aHsO{3lH z8gnUT zTZR4J)EDLE*(^O|Fw4PwT)~E}SQdadEP=gm+ zK0Q4B#OV~$9&gP+8Yz^+)Bw!6tms>OMCk281D4Mb_&K-{$}e>r-aU6mdA$w2n`H|z zMu%y@qUD09lB=04Kfv^eLw^@UGfpAa+k*?r}cQhP~;0sDM z7{E0$myhFY@QN`9KHIc!Z8T~FjKCKEgSQO%>S95!TGo%br@~|Lwgh53oC4Mdw)c?b z&^`>m-FZ;|245q0HpO2rugH%T#4daA{+8!U*=GIhcqvEl%l%+OaJuq!O72zWH>n<} zfiE*=Ef(X;q{S{tK5)vc-L{{lLe5R(oIy@92@C6pSzg0BdvuOm^`Bg8^rO?od5?Dv z7=RZq`L-{)NZ3td?0Thl7_}6sS1#UM>(E-G*A^I6(}OL_2dMA|+(zRvDQHh2Qo%6+ zJm|9hIKE~$YMNh@xGfl-_4zU>d9JFPj*MpY?z`q?pI#|MW$S^Z<|7*AhS+<3J9fI~C4#uC%4jD|tyvxJd7LKAR9Sf?z&J`4MI*m-^#)fB%t1@}su5RA=6cPDwLH zR-aGbVBZHVpO0&b@wd%q+)RAM(s7XoUflH5VDH#soyna(9la2O%`*A;S4P#2P2CHJ z6SdWgz1{_zGGgrN4?oGeKfoIeWXi{e&@27C?mlA(R&fFCn=Sy>QwIG2G3Z-xao}o? zQsG8i>iMLv{~huhvPVstzZeP33T!9)A^b29Q)YMHnF( zT59=cv87SgDt@xFqp<90t;gF}7-!Re7MF~nf`hi^D^t@C<|Tv*f*LFTSv;tipndzS z+GWQ+YM+sAs>68pA4To+8JmCf&u-;^M|U>^_tMnGBEi!?ZQk;by-|!l`p@02`;UV{ zJ!-kjjJ(LRzQ3uhq!D$;qyuKL`--DNAotr!#M||^^lvf5@(pZ6UB4cb>c`vDwq~_n z^nB`24>Rl_c#T8rHqDq}sEPoy=tEhW_>h8LGH6ZJ{uqPUH^1b|Y0<+?Q<~f58^;2At-~afT#w%s!WC&kx z@aj zljpdu5AEPsq*XjpFF zMwSEjS>mu7goS8jOt`Q)V*2FVHy6V)3!=JeQuzmK2fuch* zd<*0Pc*c`lHiWS2Z`-4{lhr+1f)<&)@ScY$LK3|rRz)$Y_Oj@FXlHJjG^ws5;V|#^ zhnn~`Fd??dw+5TPsrz2#uD_YZ#6ZM+<+vu!M@|9IVIEJ0h#=*yxn@^1g z7zz7lem&XcpH>5quGQOJC;^F0>ZIAJVt6dPWA!3`-ljMwm7_>LBeDD-g{sZl_K6;N z!@W$1uVl>m$8Gf?0;NLren(b#ZtNeRY-MyLd|YK%aNiA=21AP0Rqp~Xb~GVqRmrQM z-$N<G3ji?<)&+e#_{)Y@KaIvqJf-mn zE?$m8(hfHC#nYb_f-ibliaaJTIUUg69R^g8(*h0Xu26^v{A3Bng0f9LI@C(H9RODfIP2%)rKC5S z4+17+{>+Mmw=;Q5Yhuk&CXA0qwgIfE&kT$4W>r&V=O(}@d%5!%vc?w69D#HlzwDnM zKDk7|H@Cd*brl+w6}fs4rkRYjmt*$#Hn_M*-oB*Or;%$z`~7Q9oyuQeDDpXARluY1 z<(2wkd#f&8>a`fjT=)8m#*2Jj7;4+}MeB9{n*mYY_fzdF=7*OmhMRP*=*s3fE@}oE)IRRE6@9hl zkgGn{>~Ph52-F>g{ez;pUz$V5O@;y(s>fWQbaEo~# zgY3LjLK-WC3U=##qYPlfg2`4X`&e;v8OS-!+Lj){@wZq%)EhiZ;=|z%J-jK~d=2^A z2JRrH(u=dB+DBMYKJ!eAb1a-sRmjcJ5J>l!C`54pCdmm@*?IkoKrO8UBXg)ke*(XJN1+VH4AV?EGKIBdZxIKWOjce|p0)$P*!9$@hb;<`GAvAd z1)tUKm;a!>Zuhz2_yxn3^9OU$y!PIF{$a0v>0z7>Lltb>1xT?&-z2~pmubuN{ zrYE?6+Y;()_(27roRvB6Cxn6wb`tO0#-3i2GSN>mLi?E4@6dsJ?cW4ZXP962#)N`&X)@E5+1}Cbwr3{Wh&?ki_JyW@N^Hu#^y)N9@xM@;JL#9rEZv zGoL+L;!_;tFffa(rYf7v0`xBRq7GL9TUXf`0ZYor$a5siVc8ee3F9fv=*%RifBLw# z!Zx)>i%@ZpWL6&6ug6(i8Z1+83v~GrT(b-kQ0Nw_M3V(7>-Y00V(eOg(pNw;)0?6f zePhQ9(;MOp$uVbJi%*az#;+o+o@5OU7d{j>k{PhSJf6a=RV1J?yn_IK& z{*V{&;~-a2@eoQpJtsQ#NU4F|UpQErzJ-9}bOr|o_;<+=S21skFS3S5Kb<6NSU z$>ZW1I#}_V(n3XRPwa=&$vCD=*`pFo{SB8!07NkNiYP1`(vNAhYn3qPQ+wyBC)fI? zEaoJC-5}r_J>Ij>^0x^fagP{JvoQc>*++hXDm;JK>!NkVW>Hx=fw&)X1V=466mJ~O zf`yrDnv3Y7AUi&6<=N+&F`&H_Ct%lcRkWKZK5_4s!wF~(U^n5#HxJk&=$t_{bmVN` z*grqLyD@_|!Z7#(e?90>QGCOZK8Rwc%<2MnZ-t}hmc6o76bf&52oBsc8a|)+sapA6 zb4r-GMR_Tr_E}zNm;d<%wt~P2p==Z1Hh_pI7GHfH5=Pc9<{xi4|qFPOMeY-HY_*Zk#2G`C?b*cHBi3kB?Q~Pu zB9g-)`6>PqqT8+tV><6>vP!y$5?QOdmq$rxma;T(-}`p*NUC;aAnCsG;=42aw_+Pe z?P!|HE1o)p=cNy=W>-tdu$CeENprM9bCCO1)=6%_Q3T z<5t?SK}SCDOT&zu#@GbiBhB>C>Fs&==F`P1<&nwx?z$pg9~Q?3OV6;Mw7jL{J$TD) z;e0aIzZ$9u5$r%)k(z3p!6<~PBT!q5`<4$1<288aV06OYTmYL?WGG5KIO#qGN!o4P zxc3VE!zNZ!DTshSF&Jd&Yk2gtHT9JrUJA5A9$J5OnPb6g@mf$(hVEhi>EBaRi>4<`F}M@Jvkxkbuk8+|?&mW!^#{lf zQWrr&sU(K&fBN`UL9Ktb7w{bZ_?52f8RcBPKB7!^=917YDkJSK;E@t)`40Zgh3P6^5jzsQU z+>1;tAi&p{C09E`>gv9b%l`f>E`6$SGm<>*$@gK>H4jc`;xgs~#nbgVC|*9JS)^e) zebo|uaIzhR5}AA#9Q?2`c-N-))ZVR&cHRd&}Tmb+hk+RRg=!VUYb@1w5=)_ zO!I*55SH0@>nGM7KoJH4P)kI0fPB)00O#gfd=8!xO9Nj4E~vf8(j(hlZhZ$A2^&8 zo{2g^9Mt%d#SS)ylKygCH-b8MPa+-cnoY}Y3*IkAZaU4^i_y0@4C zyF_=eNrH}K($FCA$uNw-i7MQ&*voe&oNl6TU^{&o8`7G`5yKJu#MK?X(Dt)|B4_&f zUpDaBHDV^6ebaC_Q^1;4atnG|sca+8F_ObLzXpd}ZF4CmJ80~9#~x4(zkmM#G8X<= zSX!t<1(L*~+uGTe^*TTv3H*D_mU6^x{+)_@DxBW%UiTUQLEVPP^RK%Pwq6MRSK|eo8t!d}sbUQE@+coLNO| z{<`~+s>II&QUGYfOYYa>syx^HW{dcl#570p$BIs{aa}X~3*K7f>7<<>8@RF>23lYh zZBh4-JPn|w4JJJo$htCj*vxIP%iPI>IHy?xyjGBnkV@cO*`c!iUCTuKu>2d+oOim7 z>#fi5jX(XlIau%?E1p#<(3o81W)f4|t8A_OLEHC(T$h-KIyin}$NUX>qtwPFMT_26 zHE=05HapY;G4qjY;cO5{s32+rs%AxO>?Jk>i)=CA1vEIE^Z#J-}lTDq!z#A!?d5;@$88B9mYnQIQ%(&{%8J@ z>vq_Noh*j{aGVNXi}?sCO4c_MajG3s+{tmMX!pdIsU7;_z(=J) zCpqW0!-MeGkCHt|4}y`J4IGKI!%`O=v~n|jU@6xr59JB)KnCMLsXE`-2}=Z=aSk&u z!lw^#S4uP8A7Rjaa>xDR*ov9c_<-j}&=CK{vV_F3j|SGIXa1Jhl4lY#%1@J#oI4e? zXY#GE1YYh8rw56GJ&>SDjoEInnp62<;}8liMGr}*1&D*2n&^!MhQN+a5l7F*5e7!U zlp_8^`%mjbT(VwP4)Z6L+eIrq4L^-C(A!#M@z|dRlo3ZbHstyptoakG^j=5x{aH}@ z1%>!{X(Y}Eq3c!QK6t5Ci&NFhAabt3k3pC|Py<7sL0%8?zbx|VRNx*q{0l_H5`3^b z0h(en1{`n%q$=`66N8;)fouurM2^Iai5l{OfIayDzn!^op^m%zPLIKBZ=;xKI208U zA(EVNpfNoz@5^f+o9!MR)qc66LY^4OK_g4_;+c#3;})#Qh=IDRJ{tO&=w@L|TY0}8 z$>qc691DhK!P`@L{(k8~Q@1}~rF9*b%x`+4&JIKi2)a*;=ocsJo5+0T@BS3};0p~@ zWRnObexnF|Niu3_UyqP-7G>Q+ajGy<+kt*wiM!q)^0A2vdH6(a)4}ZHb}}JL@D>_o zJBfucqo&NPlZBd<)2J3y^0v-nYRRAT8fyq7uUF~v^zrCw^QE*{mG-{(m`OL&sK7Tf zJreTK!%|59UOg3I46`S5;R(7ytRu@vtUD}1wZRYh>?S=TzBaXf5gs^;Jh;H8j1(0X{`fk8$i zte{Q0M&c}sQMoECz+5qwmBzIcUQhO?pFa6+g20WgQl*R(0B zjfwHyxp?b6T3uUH^qF-#2{Mmhp=Rs~WtBVvf6)2;YfedCou=aWeaN?{z|j%kI>k|F zO?Ib~K|=cs*STgi^%eH3Uu%r`9pqwiVY6@CVc9}Bd2*THr8c|siM#ZX%Z#tsUT@mR!#rK)SB$y|{1OSm zd%d)lhE*T+DkI2aN(ZGn>FP9M++1TFUU2Kn6D#U&GOflKa`uZ~IPU>tl9PPg3vRh@ z0?*2Yr+#IQ$YXw#0zaeqR9vJsvv=YkP0~vp7oxnC-fzF07*5OyGM%kaY$mMu!%~7* z*A#R&J;FYud0DD`@R{VIc-%pX2{>#*jNdwJI*vT zHk%fS7K`{Dg0!x8brTM4>}Mhc*^^ge`%>g!TXQM8Y5LPU>!9?Z0B{$%bH?P^&e#DYh{|#9hQNv{_UdAm(rKx37+mF>v zN1@?qx|@!;4?CEs?(4MwrjY#}b4web~?kXW&gH{zyX@_k_nbgs$`w z61L?R9zXw+$92q}xH&2*7&b=@IKy<9Z0+pv6?V;F1m_eXZA^?*bjf%f+D;pB4*SfIZaPeW{izjMGEqwqW9o3{l_ zs7Jou;&Cc?S6X;wBB8$N8{+96(9Zy5SN1`nRkc&4b~WYpvsYBcHfw7S;RDLeW27KR zNfs+zTq$m-S0Y2L5$7i**OE_w$!eEL{rdEldnKNFIWXx!-7z2uLA09kDE0fMdt*wF zPXvTVc*E3l)4)X=F-uwV(ikW4(oapsV7&Le-6-Q?O>YX5V7|Nmn;hF&6!G_Yumqco zqp%vx0mGbZ|HbT%9773Jb&6$f>cJ)C93%e812hkkK9^v(YAGC}(YQ1*qQSV%=Ge#8 zdk)|R9u&sbd)pCw!Z#SN1omR?7S@~&#jzyiv@G##83PoWgN8PeADCzO4XRn&-@$Q+ zeF>WNGq6?EvsmG$das~;FVft}Uot>aDuHQ=ukv*>(eex>5AB~8+2d2UE>;%)0#9*A z0lC4ypUS1hS-Z7S2A|sMIf@jeSO!<%>QS=`U<{T)@s>??B#|NmWZ@!OG=4=lJ7sbi zv@cvh{k6FzkBI=^BbPIkU4|3fLZ9e26cV?UJf|3i#~S>bRtz3XyWcard+U}^LeQwl zvn#`G-z;)J2yhrf<`|`ae5A3w3gyDvSS4qhNiI55nKKo(St|tW2&FuCFl|ZI9Z?hd z^U4yNv}-*5MeM}c=`NC0aY^UQ;)VL!5Wj55;QV4ar$hGI0Nvl%)L!` z|2^K>qtvF~>>r}KAAZ^QD(Cfj5>}fQ!1BH>A1UDCiJo? z2@0HdK!W{6I9^v=-D?Ht|0dX@0|6ZIr-I?3F)Ijl1R`Y)XAZH*(;%7N$){ZnG zf|~<0ftu$r?_RaS?i@h|LA67;nehsGGnmqEC;Y>Jan^6oGVqZ`-l? zXH3cIXwb9sYLzO3Ros!l`+M4xtq!;?oPK2swT}We6QIN$JXu(eo3q92!$xRpM`t5i zCoT{RkifLFH;zbnJum|lLOjt5`$Fke_nfd8%|JY#MOD7kUHmm&E5hmn)MD@$C>n1_ ze+JRVKz(+sB{#?C2=05Ha45)YkCvf#ziYviWBa-0IzdGav&>v#L;XagIz zCI!ms-X>*JN==VE{5UV{ja)jyT3ABlp*cMDiv!BWiIj5 z_<$Q@hOwf_NUPBg4p;D-Q!-En3I~lPAOz;J=V8_&cqk- z`r*h#UvXDGGd;rP&1Putbw?KOmL@fo{I~D>@5%7LwvIv>AKGKe-+VCz+qEyVa40%M z$jml`u-{NJI8`$ps+)OG70Nv~I<5Tkr|uh3`oo;-q_2y(%}8h_hiCss>zA0hU}?7+~qXr5V}W01`+wX%>D8fzu?!cC#qF;NAEH0uI7WFM1F9SUlv z!Q9G8MIUmgyn@DDlLO9Pg-}@a$jlYx0hzz}U(K4F_~^JZaxc!#CL@ikz63zBZ5z?T zJojZFC8gK3g8wA21jBZlKHEbEvT8JA&wY(DRs(4Gtdo6j*D3@7Ly8bp=UI*_! z`G7toEOGdl=K%ynbR!;ELE)_r8z*ieFB`YPM!k1uWr05d(ScJFP?fWgB88DTR|?TR ztIn-MklMl1#qBDrU*NZ`ttSt2s5__uf>RhknBD776F9y&UlAJbEWOgpTVS^lC;!|M zAq#wIu&l@na5)4}c*B{)6~9!oN}N~pvc)&X8An${YfUqqoR*(`9K@TJD~jjCjGJ@=`2~_<28p==6qHnNR)CL}Cx{gSsVZou zth~v{$SpKr=V}S@ek>L8av*xHW$s5o3T0X30`$kSK!hlBg2}?oT-jfz?TDzd&xMQB zU???D%k7(LwN(KugdgYU>h?S8g6qp6@_j$zKpSfxEaaTdlrkeGYGr_~Tc5ZJVE^;mzBZ54HG~IHfd27pb{=7t9}VuWT_uUs)zZ z?|9Yf@MuM-%cecK!T1Ci1RH+W52~+U=674!nm8;w6vEbs4%0=0HiM={ZCqkx*0&w*>UGIZp0}I_ zO{s8K&@Pz9#Py9Fu!qG!?aaNxF1~8bylo!oI~9ERCZ1ksS(RDs(7+~w;*Pa?N~?+5 z3N}?dfvx^kU#nr>lHY%>=fzWp&)`+09x4srqOwo1^;xFN3wddnw8f|I0QtY}Qo`_z zpb%Wzs!qKPCqDCUlFsTlLaa!r33{s8*Zi%v37>9>ozZ3UYq@S=FQRbVzgxtUOGaTF6*xg@QY!*8>@U9q zNwzGKWx+WFD`WZc_o5Tl!k2bI6c0Np{`*nAxE^Th8Wtj7WQzN$W?dw5TO*D0iqC6I zrq9sUE+l$P>?xITY(Ko_l8`JjY31!bkWV`jBv}%1( z`uD=tC&Ure#DpVneKqciHcKO~X;#fx@&T^qQS@Xw}`>nrO}(2u@`9_p9$PMgsc zuCRpCLL2g^zo&i<$hf7xrvbN07_Pl>3?+GIJxvf>VecYmz1?s}t8$Y#5lJ9F+1_ihPJChfq;q@)yKY zkC&V@{qL>wNvC8%pF>E9v@lq)dRbts{Zz>BNt*3S0YJ%gsf7vaD3bQxPU$)sh(cw0 z;j@I-9$gIZXVWzfx$-}bDWz7ZOqLe9zrSV|R((YCwrekVKZBaZWjeClyz%YJq9_1r zxksC_NWM9GmMXbg+oSc_2B%P~H78?SGWtX4`z>n&;)KH*Bv z{Pq}czG+B%uijMa89<-GNOAq`s=jj=_s#E?^N~*!3f&$4bpQev#hbI*Zn!YYdO1E& z2moN`agg<+WV#t?f1eJpg@EXj>uRq{elB1d+aZg8e+2Ks&Z{WmBn1{$=a%8NG)P>M zv3vlKC+O?&$9bI;1b%MesC6qMPrJE(f(3b^gux1)UWOPCNE0YIzHx-ljwRc6wy`Yd zijkR+D9`V?E9@=A9al$E&1I&wzhR*-nA1o(CpB)w#|oFi4C)@B6{Q~&>k|Hp>p zs|SRTpKoMF@R?!%i#z+9Sz$V((Vm^B(Bnhnfw>3b+Y=HB&d#3Qh9p+4rT4k@jI%pv z1-to0;+@V~{uI?Qrd26N^{8)Gv6JC#auiduAxrtD_90-QLKAPR%YH(r=LXx6!cZHs zuii6s`c&%gle4bTBpAwk)sEf`nKZP?fL!Nl;Eyzpj8&}hV5lbl_AKFF^*{9|p8M`?AJysEe<;+@t@nyyvcRu$R+8ANvgzXNY{-aMT*y8x9 z=>9$@@?X#StEB&;%sx!9*>~*v7rvR^O%pfLVTl=++z5^?x{RxdSbG-SDfv~q{6DtG z-us5aS71!+m~b=tY;{38*QSZ{>&9V!{abqwTcSdxAAxXU#Z8D3km++9Wvis?6o=ZX z{txWEWmH^Cw>AnvgA;;#2okK3Ai)V1EChnP1P|^Z&=5RWa0~A4E=};@?(Xi^KzDyl z_I}^HzjM#H>@8{^#bhry~^t5&aCwPwwl^Ld_vUJ$d73+rwIKIMF=+xgOpp;sKP z<&Y{lGNPB+uov5q6QHbb=4dIB!Fv^fJ@<bQuV)&?Ad5hJ^>_<9rT)dc*DqcueY#j#Uzw+dy|r%$ zs(~_^7=>Ybs6;S$k>N)%R{h&U{wzd7MLYj!l&_&7UVcKaR`UKj<8Q0<$28GD>7@H~ z|1c&3oV4*f@{hHf5D5?NBbZwTokLr9#|LUphT5r)cu)FoV;g#RqZrwC*@@wIIW7x< z!Kt71tGWnprYA9snseG4RW+=CUhyu3jn8#8&UeKEQp{#7-7E%a1Uodnv!VxIt_WF} zN~=dG(ZiZtu;fV(BG2WH>RM0p8&PRu8Z?0pnP+E0RZ=0@hT&fjWl|XRt$IHCSwfu% zW_G*zJ!9os^tJ|7;3iR+Cy@w71f(?9zCXC+KB1>40`Mb%fuegX(V3ysHF2`&e)*@h4eGvj9F zFbvLY1=sRF-uz-dm6vjJ*--5TCiq0LqDpc5 znXxK%dU0B~cYT|B>i%2(2mO}nnH|BA%4_np9v+&GV)%xOjV=nnTjS4it#Xh_=_vT- zx&rD5XGXDMspMb08pbYMWX!VO?eo8K$QLhVkxEVB>_hnkukqiOSrR}5ym1kjT#p`<(3CUgzr)EZ+i zu5+0ukLj-~(tg6?^w8LkcjWV7Y$6X&&zX&>ku^c6Goq%+X3*Hev_lUevA|VSbM83i z@?#$y)5ecACHE?Bno9z?R?}XpSv6=)dD$-TqIqys{?6U9yIBrVv*<~<<0iMUShvui zzvtsuU}IGZ$y9Xq8^5FOjo^iHJaO;||4I(zd4fc1M9xKUd<2pyIa9}WeXA*t2D{Zh=(aDQgBfm!#N_Og@He z@D~kN1!0UR8t0k6Ek^RkDd+9k=g@uufBeU@dzfXqZtWk>UKXWg3V=J~kDx^OpGy49 zi}aHHUbSGE^)2LEl42Dym~30st9 zI*f;ih&){Fik&Nbna94N_C^U^&S(qb6s1s;Jz@jzq)(maQ?QCG%Am}CNq&Y28*38P z4-DR>8Na%!>hMi-*BLMwk)jlY1~T&;O>@o#!~w4=qxH56=vf?$-jGNh51KQB(}gkN z*vN`ppPv14+zm@|g&JJFHvvY_wcrr7j;D_| zm7Zc;&amMpFwSCV7<0P)dT3#ONnR5bVuZAFRdZ$+<91Wm$oS4ReK6S7OqBXtrf)$@Gq?ed2f(r7S5~E zUlLpnQe93%g`PjFn}*(noBQWkeT*Ab8s+vJh3D`;yqks3QG99m$wi84|4$8j&DDZD zKp=&k^ev9bEeELeXOX&yv1?XP-R@`pESzv*tR(vc%qkHqqYGxcDaY~2Fpshx227(7 zrwI(QUP%$gE&6DIxJZS#C&i#^1w>f2xs55x2>y?(ZYmHqjzlJFz`~!kQ9WAR_1elfKOh^l?R9bA!$7-EZskE|R{O!}qH;R(rYJLZ zn&;n|f{(gmeH-6<3NTc8{r(|3cB@07{ZPwkL0(8EhlAUP?t;kbTRaYL`meBB&Hv$= zSL4uaea9sBuCz)pL!)kh>PUG(LUQpqpcpP=mnj$G!r4fnos9Y7=m*N=?^B^QcI?Ud z0!1-`eC?!HHSlGuTJ*JLXT3hh->)@;Xw%l< z3UEMS%vTs3Ox(q|XedvlVR9LfB!#c$c;NwtaRM3L+{{Zvc%Wf+>dxSCsu{Qe0uxEb zV~ukEHrVs`ZWggVWmwO>#Qu0GnYQ@F2e-=*PVV)E{{>P&mZg83Q zXm{a4E596SykKxxxDAP4>0gf!*ozI`ggatzCoHUe^%VZ!``VH8i;670?YH%_hrZXF z@zpnv9`~cz3X=wO)%pp;Eaw6H6I#<3#mSSVP#Idr>~$tsv2BvrE9u~ zRasW9;v@H{!aS!rrzVp8=hFUXaXH9>JV--1lukr`JpXgj|8&8B?@=%$a1uS>l2y~} zqL9i9m;LzC^J!3w`&Fq3XYu#{UFL%&6?96JbbVcF@+pWoiISbB%mQHDLNA&sJuSL3 zF}eR%N|uSV54p)+E-|IZo~5cZF;6I1 zf`8DdDNp6&{&ARFjcD}`{xsTyis?TN_dffO{evNm2vQ~ezYbLd$TR-I@pf(psQu$G zcKCm8`!7cO|BpKPF9!SAp2;0qR(#;A``~{w^XLBJ?PHoXx@dyq;1uJ%_&NT%?;01~(1k&pVV#hMY-+*3X-SGsQ%am=LPo$M`%pWIJT*qP~ z(k*}&E;#uik}CEc_QXF(t&hI01*Y5iEgjrZ(pgx~#AULp|0XO!wv6yJ_rD+6W4&!PBlylCdm|{FGbKoe* z>~jHGQw4hM<1ri}Vl0Z_*rIVe6{T{~!)X2TAL*vQzM}6=7$Mi@xHN6UMT}}i4+if1 zD4WrmFjvS+VYE!=62_#dB)Q)oX=$a=yZrFwjWzH*?K7mj6}GUGE+k^y@cAVDp=V5^ z_w=3)t}cK-8Qt?d*x~+RsSS8~Z+;I|6Ish_{*w#56PeC*a(@WR-sAYDJ)W2q4uUV3 zw+-fRR&wv5f;Z7Dmyp*RnJJTg@8YGyI4ZQE94eWt^-kEmlxQdlX0({qb+}Dlf=Ven%wo%Rq~BsOG)Ayd3@!mFIh|dM^}AU z)7_`%4<7hpjS?)?n8VJaUQzGv=v`hSmK7xRAAaNJaTj|L?JY|w=kpJ8N{)d_(6iO= z$%TXL{2%?$UcT5%n9M|O$TDMwH!-=281mQz)BiN_KYj84;kb|>8SPRu?^VC|R;yT)Ld3~}CF5wNhU(wG zS_NKD>lkI}$puVkUv_e|k@_3zP>8|BwJijkd zH2onPCBtT49Js4h4(G|u{1s1i$xr%FwM>V%WpDkMtCnsRFRtXRFP5A6D^BRvfnU$7 zeS)9r2#*lKgN8N_rJhf7_w{1p;>!MBv(4(oe}kWq0YBq0{#R^aYCr1u^`Gf$KQIh3vp2ddUUzu(LN`m!vJn82q|7w~Xi04ZZ{uoYm z^B@Jn(c#)RVL>9JJxF%D!;7W&AR9`*-*S4EwrVvf3kB)W^Mb3`xWn-Rso(s&mtXd7 zxz>_wAmD8waoidOE%QXB_Y;u^^hoHF^1jE+uqv76c+uMgulO31C$$1Ie5k7`H7db8;wr&vMO9oD^8@2B(ojlF!x>>s8V@JMAL{= z95c~j;;2`V$io-gSL7pgzO{J|2Zfmv)kTOa=e)k|!bg0=M5NQ(HwddE9_GweRaEW| z#$zv*|9~9NtHM2{;?s#n7mN9PF+z?<4gemPo`2{q(0sk#`Z$|Ig%awK>c!BFnXP9N%AViKF2_?mbH8Tr4!7{p(KtB1RAki28{ z4Qryb$F;dA+5R9M_i$y)z*uBm~}+`;3XnL+#q3Wpr4GJ7b} z zPmKKJo5Ck*Cv0pVLvA86bdw3g>NoDYC;&;vp8`Le7#HySjx z9?4N5Ze6git~zfcLp@J9M>aN}-nB7(U?=JGYi&hXU57_e$3elF3hf_%=IMt%ssb_ji89eWpkN&7T+go*z2g ze91-WY4$m=)Z}%r8bW8m$5}GY+Ft4=5>|sQo%MQFR9A-t^^0VzbPdx`_M*x!3Uj=9rz)VW9`3 zU-|};4FX%69my#k7Ghhf6Jz*%6wYCj zt2RDJoff&fFc2SQ`1vPSMHxq4ao*xO;D}3_7BxcI7>o33?C1o(6-QE;z`guCpB?`Z z9$fDUam&u7^c_feBlphP0&)I=T@${m&>S2ZD6Fm*_rqB*4Ysah_tE2S-#X7>aHe+$ zxS;5s&eo=Xpp22~^3L*(%o;&1HkY}U{bx=y zl+S4b8}#5p*4!&RE=&z6sJW)Ae>b5XO-(SMwxjBp2P~8%{`etY=}fy}oz@AWFgf~% zGr%eHH-iF=(o`(}AKGUzVIx~-DWuV^=2puECaz>qe6W7<% z=f;UL^&pQdH;I|hsq;=W*y^C@6?yngv|6ZW_9xC)@H>W08)k543>QlBO1Fi+D%du7 z@gYmUfnxdXow%xwhT@z>OF~J!%LANm2-fGIE4KjDvg@)Q8A@^cT+ydFmb`K4THL!b zs5sqrNV=4!bTDEeF*+?T5lVOwJk8Kn>(daf6a%m_9#Ca?N<)s{qS=Lt10Vjc_>P~P z$$x6hi-xaA%(W?NT9^cxU(u&C(D!!DlwdlL6sdj-&}i*b=`BDj=iQ}bX@Yhe%nf}+ z4QdI)zA@yc?yCkXfrKyh_Q(|EtXOMWU$9#MC)D+&80YV!_!L7$QzC2NNunAxe-WZD zX)b4mp^%ewQHWOZeITR-QrZgNu0a&4+?TDb4}w6h1_Ak^-nZ|f# z>Xvih{eUD-_r~z^m&HBvyeYmpk~yqM81R1k&0ZC58#TdY=p^WCUNx@xyU30KT%;5# z=y1)kx{gN@y|oKhzOpepN^lCJI zUEQMc35wi+jEVLs!DPol^+nJhanD#tma0~f5&KLhS4#8bl^|}_L>PbAw+0?P2?w&>IN_ zJWqBOUhG7;t)z-8b>syYhTyM6fYa69s6|W>zJ>2!3%GtzyC&b zG?ui5EkYm2@jIo6nm*0i`w}eR5$+=P&4_YJeTtlQ=G1L}Mt2TQ7y*5SZXMtfg?)vD zYbdtEQb*G91oDEj^#~tM^kHijNlxfW8Utv;Fw6E>Cz;K?*rAo{W-2~!bcDQ zqIW&5dUK7dG`3$nD_73?I$&B_BD(O>Di+1P9WQE#{~Y2S$doK zKM@-GaI3fuEkG+%CyV&1u<;oWtzmMvQD_jR0M1?OS}VHux8ayObjjF2 zgd%91p@q{ee%Vd{@hwq}0V~O;M)P2BA+KhM))2h3WN#yTV%uWpqHky!jas-oq_2qw~3+`DY;9D-V=taKI zeEeSi?vp&WC_CXWZJd!q{uKT2h|O zPCmY~r?B-MyHt_mmfV;J)2`|4h0+w8dY$_CH*B5Jx>w66^-y(Y!5MxubywLr{4JI%h1`ngQWX{?Ci%2*x!l z1$>hJi7(Uhs{vlH6`_+S^%N1-2X;5|<@Ppv4eSjo-mDz=WLx>0iRd3o-)ZS%jd~QM zb2n1CbB>z9P6DApMTn>255%RSt^ftdy6MM?el~a08qXa@;@=-K{i>dJVlACF4+WIZnuEc?b!jSey3ZB4#4#91-2CfZ_M9)m}hw4P`tTr;tqZo08To2t%}JE|>*$ZqCC@*7;JhloT-i|o5_(|sC`w=n4dD!e%(6IxLM zhJC%D#8FlaLk(_w!_(j_Q;9pF)U9j23*?k1QIT+R$*(6y7Rc?WAtTjrG2+KcskbGH z9Gh@ljZwV3EqvaJMfv9Y`H<#j#PJvUQsURN;qx=|ZO%?<5a`J(gr3a{);5bjW1$f; zBxE+f2!(MUz$V?y2X0r|h@m)@muyWiQ|pRsy`O6zG#kX^?O8!4l}s%)?X&D zXgH2+&>kOt#}!bVGS^cb(;n1H@a&PjHS0?c6Agr{WT>+30SuwrW0Xg{&t9X+I!9wr z$vL^pb?pAee?h{pH^I-U^szQ}^cm9tW9$=0|68&xr-X%XI|dnG$uj|)h1JoTBi*g0 zE8AbYoVIffXO3c)_1sD>Jmfsraz5m!WxAkWUU!odwo{(e4cO^JZagVGPFDgh&Neu+ zD^phM9<_nG9{daQ9v4e;6r)5U8!|%KsKQ?wd3z~x&voh@!`CMJysc_II=|fP#f&uY z{HXPYe${9r{N&o6Bn3rII<@jsCb<(%EsI-6`_-<6f&mg=I*rY6Fcfp+t?Q z<*oSJ1{*e>#Vu3Ti&@Ghi_yy2_;y)~Jd%QJZsf;S^%hZ<;-TZf@~(bT?!|8j(ndR% zjP?beow40!r+E$*&}=SQcm4Kk-stE=iVS%^`!bk@Bpl!D=>NuImi&6zj#{HMP{61v zHF%4$reF#{0>mn>*k4Mr?T)py-MS>Ty|}w78*^>d%cgX*53k$9ZsZyLJefvZWwD4{ z$@7Y*-#R4RVvxSPZH)-7&>mLrDnqqRmI=F-30IX0K%tXqGPP?tV&3+`*io_J9|mpI z?avSoSJbt+3@PkCn;XNC5$vJH^|IYe&37(i>q>-6kG`Y$rnzLp~hwNX+gJx$@o(+!cME47D!v4)yi6Y7~y zs|d`&P}?AAN7@h2U>?vy9kbZNJxrznp*NZgZ@3q%5V<4h!*82?glIY6D zOErq=;5w~*{B3#R!4d4xga+_PE6qhU`*b$D`2+goXi=X5$h~s6Ub^Q>uF}gZEY$UD zh;nP-(krVdIa!vcvBqNJObx85TvMg#d`dX6y6qKoP+v_D`LwSI4GDFhA=6=#=HKhuvaHQcm{>;#tFRlxW}-6E9*+sVyVbA0$^9QkThS4<8Z2#j<~6}kG;wcX zejoCyL#j_NwSUEH5;qcQu?(SI$Lz=!?%)mW{g%GUKrkCGA zza?aJ4&LapmE;bseqJtG86Isk`vplLIZ_gO0=}~@Q{NodeKaYZ}QY)N`C5|`g;$FOS`rMD%+HF16sE8(Ftb$so!=Ht{#DF zTAW|Mbz4N9G-*#|bWsr5OhIkY=mI5#7_^30Dnd1R|LNuJvJCRfPl;!putnLK9 zbX!beO#ReJP-E3JLFM(GAoVEQjq=ynlh<2UQ;$l5*n3!M5d zEdc*`F)fkI=RfG+E4=fwghX|GUGPKaB{PSyf8R{{R|uF|ADB11 z8sVDIWpQ&5G=w+6J@EZGf%X$qu)m5}1RiW1Ol(}Uup)boM&K`Z=wiWsjBy!c;uE;q zUo0B*ZbIoheM^`@^i|}0J;xYc<;W{9!IHe7Lb+I_!lYB?4fqD+IYts*GTAy?E_qN( z8A0@AvL3x)PPte=+4U*&ebk80baRff(lwaL%jxZ^=ntV=BIDWQ@@1zYgDz2PVB)K{<{_a zy-)lK#QnG2;J1M-#EsWM?!qPB zyfU5!rVoJb(C|G`XyrnUD-UxP=Q4{OFedR>Bm(4MI9~=LxDdS72&! zK&9a6(=a_}!F0p?38@ zaLBxNTl7Y2{4SL)jw*lvr3JJeT1}QG^hsU~xoh!#x#d`$HKfZ zaTvVx%^k{2Om}};m*|k!s&7gH=wyiSL$CAg0*5U14fL4k66|bYh9_F_=+WUf#WiSCrdjUd;NH%TE3(Nz?UlpgM>o4!FSsT-b2KWCGx`E#7w&GB} z1MKPMIC3N6SN0*Mg#n?7-E*uY5|_{iRb1z=zEA6W*LSU1zO$SvUS_B#biSe}$*p1s&ES%*T$hSs8@C175qYf?VQFF6& zs}iFiQ_?&subl*;YwAz&xp4qZyd}ENra>b1H3Jc@)~MkniQqENjV=O0KgXfK@TFB^ zm?edXhGjM?Zg*2xtx7r&{_2L~_^gxH!r|ESeJExEZ;EPPJW}qD55Z3dpCaVxwzW~n zg*_A3qB9%tt^HT&BD4|GdBI0YieZYTTt{(>`7|K0{U?H9f3Lx#0o(y@(sN5>9=`04 zM*`Aj;t?bgASi$z26hZYVCP`-(2m%o>ISCvvE`?4Dk?3jOp8_9H8puEdfI`8kY5qk z*ylGX7J;Itn&<-k)L-|pa3RQ?50v}Z?er3AlihR=;ug-o#bcTh^M`ci9!?+)qLz2-VjQ*H_@Bs zc%tVPzJGGBHwZ1o-S)L6mZjY1JF^!k+s>e34fTCxpvt6nng4K3WV71P!3cd)O#LR;N)UKv~8A+ z5*rO?RTJ1c6Y{VOdWf@bJK(6Y{3hab?A1Qh2A1BVi*l(ueikUZ zO3ZwvBH-FtroG2N=~z(Q{{BlfP`zz$1zND7TYoXEg7`W^>7)0<$NEo$EGlD_e0kG z*hW5Y_a>dQ>4SL&6gt9~m5g5AvXRt!qZ?r3X&6QDC_xI}zE{?d7kBl-hkdIS)UYL_ zrMvF*05Bi20mY=nsMvfJCg>B1u)+>{v&M2sBRR5+pxEn3u;U0M5wJXllQXPzxEi_1 zJ$!i@vf)M9mDSUrFYx7M{~kCUj_xwltta6eYPxkC#59OwY3nXB6_2aEnlIPm}(&6Q2UYT%W2tsX3hx~JiyIi&Tg*IbSI{`r-3 zsq|1qwugh9_x*;Fquz+nP-(Y@WXxd+W?%W(Czg7TD`t(x%C}wSTM3=M3&;@0$OB148M4IHaIB?H6@1oz3y5)CP)Ioc1KxED&KE(Q!NFJy-d=RV%SM~L~ z1r&4qF2I}Kqh`@I=MH(r#w*8|(0;gyi&>Ci^ZSUmCqSmd8!jmq{U1cOR*=9L=bju48 z{p9+}X_VHl^UgQhufhP4@tI6VuLt$nHQiqB1gN#m-vLBvo`qQU%_q2e?9d^WOR zX!jEe@Eu(q)0Yse0z-d86c)K*`8MeG!3m!eq;`~Z;e|66kn7zY5d?}S)BMmBO(13p z`AFGX7X6!A`N8BF{ask%1u(Ta#K`A+43-tg+}C=!Of0ea%`Ng5z-O-ADzuHgd11n& z%Iu`sOYR^!+rSE;q7-SVT=cNndaRl{)<|vH>?{>z>BCp{l&;Um$I3E;A0RTq5oljH z8=S~=ey>@8dU+%@eWXknn=FZc67&$vSxs8+?%y09O?&%uJPqB>^rA@`9iGllI~GWH z%zB=0;8Ln{)?;mtTG|7%&vQ?+;u+8zDoxH-kF%~Aa zTV9eX*sI3c6*0dHwe#Ay)Q|5^pgeNk1RuZ4hQ46hN6qRgM7dlpw{uQErxEDmf;7rk z>-WA#uRM)dKu7zb@Ir<-L7PikLE` zN^#cmuKqdhRe`+lvRALoTTulO0eEm4f-@#@kkFu#re;hV&TUbY*Mh?BnHKiL}dzbCa3XzjCl8cE#zrF&EyE~Qju2m;z2JJ z;QgLEG=VQ@?S|L2CPqdZHEknOZFewx!nt~P zeUE0c{rwm%z%ZYQg~mp=ts`8DpE$;#IJfmBvr~EMxx`?A)GhU}pun(Kkv{QFr4gNF z7DRSM;vFs|%g2a^f%=Q49E{7qxL_r_zF4;z6^+|Fm}vAV*k!<@%J1M}M=(e2I!Q0t zk=B(t(t9l7hwq0#00)WumnB9gcs6%6s&D1kbHzE1WiKoA^c|C&7-z_ggBSb%}E zh<;sf))_diejlUcc!byHm*a3xnV1Zez+2BY^SiSc__Ecc8Ayzn7<6$M^d58I< z3+f6RD5}PtTD0#8ld0x*_^{c6cJ@u2G-stYx!$?juZ&j!FB4qeWiL@^@b#LFNr{b|8#k`kYxP z2}~{JG{8@3vtS~#`k;*N5{bb(34Rc)yWruR88aQXm90r!ZdzeS*b@>cSzB+sIbjY@2 zUbi;NpfJM+=$z&Ba}2rwgWjO;1yu0Rw2YU7cv*z*vidf^>bKzlS`TV$Q;kWRcSLLn zD32^cn=ZlRt~G9ZvFo&Ztp~uPZQ%#EBXSZCL%aHP{e5jLi4u>nW)wi%p&4X*h6E=i zm)*{^mwVWeQi-2^O8xh@1f|xYyq-U%j`8HMV-QLtKbx}o)FOFs?2J82>u%{^`%zqI^Moln(I1x>d{4L~ zS(Xn$+ma7+?cbqpJ}fz@+1CxEJR%5DjCNjrjUeEIh+cq9P)W}w^%(PNW3zx;z=7w;^e^tdzDCXn*`0&E44i(QR;F?Ktc z8e#cV5gDjl48e{5LEN!xI@EBuz6tHL6nZ|quwP4ynVL;!heL7Xy33sUY07%aS-67R zgQaU}yKG$U(69_OXgN7j#5D$2RA^TTQunLuD!v(~-nMB^<6)8Qp_f~LQEZ2O*H_62 zt$Ln)i~l9g9p9p>O#Q@By@jshF2~XMz+zScUQ?i2!ONdKbQLBu^X{;l`X;60R+d>} zE;;Sb%f)zTKIG3#%`~ceMi?U5{?7T$k40$k5jMK zhLuuOd(-LRs^P&=ST}aET?3`}A#$~gVQQ*mq%LRk0 z#BCkq%1-x!7D<`ei3M)}7ES;{(^P#sVOlnXKkExMS>QC-GJ}C_`EDX~K4`=SX4fW> zKRi?y;0vrTcfB{DTDH1AahM}4yF$GGu3))nuxqgrOsr=H6L+qm6AF2`LeaZV!aqL* z-BQ$U5Qm9b;IGX8Y(9~&$WQs8a$jvrs^4_gbVn8*8tDPoHpjWvXSulGuw1^}d6+DR za~()##vUY#x6lu`cK3P%7>M^YvaGXQzj60DPTwEKMcMW!Rp=Lz5SMG1HBVKWHETqU z177C<4Q)MEf0ft~z zk_9@1h<2WR)@@|%JGnp24(?vTF=Z5-uO3Mku$gbxJI(rG{`9kcHL3v-#VdesiA0U+ z()*>1PQ9iJ&kY8?wb9P4pLiHATREL)@dY%W$=q*5hCnG`@NJo*g6_Q;+)_q&#U)N1 zWCCiqcjwH{o;4)3U!>jVr+93QAeSw*5wyK?M_82Ai{W`DIBx^la&k)SwjiDk7KPiC zQc^RD&-F%ARrb7A)Ph)3{sCmeLvVzL`|{FD0Fr`;jnT!(F;L4xkADpwjX7*qQikN> z>~oq|wOPFKWP8i@En53qWH2I@*pE0vM{p%u)il5=RfQ0l8Xt+oXA#O_F9My&W+tT! z$Oa7U?d39~i@ZSPKmgwkz(WBr4%BGUs6b3}!@;Bx(MmD=n3uP~B<%>u&5VhQ&`LIV zsI*oL|KPc}S4z(cJbU$9NLj`c-!wD>T6}3xZ7VGF?7>8fQ4|sUiA;N!T58`uzH_VK zbL?erc6lghJ#M8QN#uil03%-GtgNdIX~LQBId-(D!|aE#bSo<*a6baa-Fr&c)SOHc zN$OZOG|d;?6r7(AEoKgs6dZ7lpB>B5>^V4j=nBy)a$9HJlvHh*K%+pg^CH^1i&EEDvPiCS-4rctvnjeXtP5xw)q z;2GH_x6`0Do)zal^!iS0=NfXfPpx;!DULm)0@IxO@Z5e-1qC|sk4jjLymz1<3v4fi zSz_@F)32n_zJ}XOpooc5P?%ID!*zhDP^6mUB7v{LBhpbOV}B9jeU*N~!|P6st)Amn z&_WGX&|PNnB8tFiVSa~^qZ2;HhD2ZWnMSKRWy>e`r^7VZXW~ch9GeBS603HBNMk8( zH0ztwR{i{qYPO4RxMCFG0Ghp4ThC3-GC>f{kDP`fbS*B|a<7WUT9qCkPai3-S&sdn z4^_HRP>WX87Gh9?zWudw>{=hc>j|V{gRr?RNsQ$7lH1(@fw9(wxtmS5Be52wfq3`1 zgZ+H#t{Q$k4{e7PMtdqy#!6E-}m3Wl+I4ArWZre|Xxm+VC&pzL%*Uk-y zFk&ykV2cQH(O3Z;!{-;H@Rc=~Wjq#Jt}xUWyY}2v7G71=Hqr(DRN^qgx+|_bb^sH) zb5@j}1g!H*kz{)z8P}vh8natbU29U72U$o3Pz_$qJ`_KdxnBjo6im6o#QW;-#LNR~ zXtW2osHV5lk!QZs3p)TOrhj#GfLP*(Td%zN%`eKw-l>7iG`5XougTq69SjkEPZFwM zLKO0pVwz=@30Q2@yxzU)f*<6BrC5bPt8obaSWMVv>rP=!7iP-F3B;zARv-CEm24+q zU$C%N58LtlxFx-oOE>b0qefRP3i&kqC=|gu#bz;MQd z^i*IY#OAYwZFY~NF?OAh9v%CmK@obib<}Cr-s6PSv`sy|ul?BS$5a!0;Z;BXGK0`_ zaQ=b#8Q}{9_}&%0b)2(~I*OPVkBxF002`t2Q{LztHd7kcz#*l;_)3}hE6lgJs+wfJ+IBoFTvbkJlK?H-Jzy0RNID26MAdm33|7yb1qrAcepl?TN7Zv!a;87%RoSliezdXtf2tuzRSUyYvYM6K~z5@r3;qpJ7B?4#?o{U#WvZ^f%VYa=f?9{ zpc4}}eiMcPY;jDuT9*9b7iwCYp+;gsXWGb%=#BDU*XSn>J4dhHu!gOy2nx1By^foy z(H>mz+cfS>b_6;k665{S0<-bfK2+TRC$#+&R*h0>P&%?EH^pOp;5RMNK@)b4*g%+- zh;UZC>qH!4koZP5i{0V?RxxxAHyi}V(*JKVRX;5p2q<@9mXe$9YRPGfSF`)mh4O4b*);QXb8Y9bW-t z(4W2O!zYnH+)l|)TT^fOU+leASX|xnCW-|K1Sd#v57xLt6ErwMf;$8Y?%KG!2ZBQg z!7T)Bf=h5GxLe~6-F^D|&6#<=|6HDnb7r11H+`|$wYsW$??tVu_pN%!`7VoLn#2w| zH8^WzVYQ|ZMHgF^W41*^3u%k*#$vURyZ^4aI*OK4E$p~DJ)~EhstzESoXf|_Brb%^%BX;Hj z;8_dps>)fxVbMwf8KHWRc3g~;6@>Gb#z1I*BCCL+*x3&fOGvpt(Dyk_e{p|#egR1E zn7Md?dj`}Z67Kch@MFRmVLBc>!IPTv`Z*BNl-K25m99USdJ@~UWn&BkB_(n~77txUpO%4i1eE+%^QJP#(z%AAKXdr)>qMz~O(flagBcQJtim;kG-Cf64x zE07o-2+2GEFTbI9BW_qXl1=Dgk!Ups?~_u&QVIk=)S>dX-e5QP(|G&J3eaLu?615% z2xVMPD!^BHXN^GkAoHzi&qHQs*95?Frwn-jMuKKiaEl?T_Qhx}Q^zOtl?cTHL{-m^MLj4AdpE9X+S4jVk$(I4%OG|R?>UH%| zB#KxI4bXo#q$JqjpKV_ExH%dnoY?8csOyM8S{Hc3%K(~V3(@Qi1%}yMpWGf|GN1`} z`gMd=U;mm`5vvdeb5ev92?hr|?`{M1ho6U%IpS0QgQFclqN&S~lj?$f4tZh0w|DIP zPwKQ*l^)2)h~0?RN2b1({mBy?Ky8m2y}wR;V!Lm<(xt#+6~dlEs)2leDa|mh@kWXR zc))}ca_o?nLUs~!yjxxajmvQLxt2{qtt zBALUl>y!H%A1#HJh6+{91c<%Fi!3olm(B=(Cd2Q?xr-#&{buA*VaR(Vr^CP4)CBDx z-*EUPL(_6a^INu&6zup5+b~jcrmQ-(97`F7;pNG zdUStkj0A6Dy+0(5>Q33}ITsp+ZnkBh@#+d#g{9g0$5V9sbKkLq!Dj&~Q!EZY#XMtv z{H|rX&!SN$}tp@D}1e45)zAO72;IybwlK0qlwh~!~ zU0f}&vx301yDQ@#4PKuivl!(D-V#QtZWXSuR{<$Xp!MkiOH+wt+ZOLw=b@S>wm>uI zSyIjjZy3P4&P{3y)&C>)ssJhrSInb@^=cQzfG$xlqdw*4Qux969vZ6NwfIijUq{ z0AO#*BFbHk&`Rm=NygSIG0gO~bkfFCQ%<+ef@lDA=U?MweIDC9XKdVODlo4W*l&U3 zE2_wPvzd{C-OK1A~57sNIz_LrR~#`J5R-|>eMSO7)HgKqiiyf7M( z>8{UHm#g*86jNnm(S6M3PKuJ(olp`^0s^F_qa#{Nk}w1 z5;=%LEk5K!q|BI0Vf%!5i<#>{+QeS6aK@sWzSG-f&Yvhodq>`9d#1ct!&6h^>ol|a zUQO!ViC#Kc-tW%8ffa@%wxJU>K+C(8H$2N(SZ{95u8;~y^0bq|PTdmu9_Ms^$^1JS zaJG&B$5uFU&EdFM``Epo{lktf!7UCzeKPP3Jl=WztX{!o;H62j;^50&e`zI?pM|1w zdLuSKaW-oB$eTHCjZ34TTiE_>3o>CsEskC{@;_jmhpbwl=!eT2Qup6@=*H~DB)w9@ zSNrO)=eN&K?D~p)c+{p%bj07Kb|wn?>>nPlAO@fvZfzW|Q(K$I`2=|Lv7iPE>$e{f zQBlIf7mUcE7s3z>bl)#K7wo! z&kUmGX`hrEP3;n-u@tGqPnT)9@Wknzl2_S^EOU>NG?CUazJP!lcWd*6CR8Oc6KO>8 z&48}+;>F_>0;LtNSXK`Af9=+)YWl}kkA3Wi0JK-){Z{?kjZYtx>r@&_s8| zem%Z;Daf1Wf85l#+92ctH}h&O;6+C+q8w;!CR>FgL|*74Dzv#g4)6Azt_7oS{z7}M zsxv2Ux)P}e@=A}@KY7E&~ zfBt6s28=t&@|twJtou#N^qzQUQ!m0|4<1S&K2Yu3Of;)n^gtgE}I;GeB6|FB;x}=>7U9c= zHg|!}aF! z)D;==C$#cMRHlmFw?LOXbqTps(!m?)cn2O0ThlXeHK+rFfmwbVHvs$m@_?!XX>vH6 zG;C#xtEfgB{bphryk3&jia_dO%6tY5$kGVdCLjC`nj{bt_bcL$E%LHb5Yr=ze4%D= z2q4jwy1`IUc#;i=PV>Z*szEkw_m`>4V#{2b&N^GFK(bj^-D|UC5qrl%J->n3c_}%& zs?UKIJkhVDk^z5yabHi74P=&+lFm{HOJ&hD-rt~2TyG$MrGz*0VE`LpS-vohDA%XQ zEUkmc@ZA{CU?{tg_K>pDh)s)wCI#+RMF#2IlyFOKCDE- z$@y^tU+{=#BJx80>8|xIKlGyI5tWh_+DYUJX6p%b^nSiG5_;$<{1uQrj@OQaB=<() zaq@f6NnZ}RQMWVNaJBKM#8hl13)S%M{_Vs+d9G9)MpMw`jSvXNh)B5ZPOSeq%SaDA z!HC?=x0M^cTBqTThwZVGsXshE0h?intpC~+7f3rW4pF9WcG$GdsvpOWYG;FB87R!%>^QER9ZvbN->xg=f!}o;d{%e66hIAZyEfu|3e2dx4p?&l3 zX}GfSUduSCM@^7}M+roCMa{IJG(qSzJApq`Bp#It&vW^w_t@>qD4t?GemsMywk_yX zn!|aSj6YoCaCNkq3|%2ny`WQkx-*Wdm@=u#=yTM8M|hRqbq}x!ouX>BMgkYQqIK_k zrkA0+23H-;q}P@rN?HHq?Ys~mJoo}PDhyFkutWr>LDhHygWh{2SbU|Q2k4o^Ztdf&$B5zTfD_?w z2lf*7eUA+2qIC$ve=|owEqe<1l9H`c9l=NKr(KIJ;j(T3Y0j-YvxEmdFQz$drm2T2 zpIPIF#(s`^`LR-W0pf9$5W@d70rG5gZWj=MBchRrUV;|y-D(5+PyUuI8%s9z>|ab@ z4Y`HY$t+Fhhx@<=>ZCy{0o`IE&XM9`QDe$dmucANOlQvh@zj>4WkRw?CeXoB$Oq0s zAkAcluD16|xal>n>z3Kq988FNWUwO4zfT;3o=k3jUSq6^B)gB!0zuw zjTb0l^k3BmiIQd-oVQ2CK~}nwh$J7>!BQ87bkJ>eDdfCJYh${21@xyz@@@h}uKv}; z2t4$omS(4ue`2oMw~S2Cc=9Q(0wSg?v%VS02c?f+05>iMjq?PnU4b7$i)*isN$1yj zS9&+UO!Caz9L6^#DSOCRh>OIr$~YUFY-j+;O6d>fMTtW|vO7WIxqaIGOch8u51Zt5IxQa@lXJb7;EZ_$6)+ zqA=UKMXpcY|Ml|I{%ukLd@A*m41ipjhnZTo+a^{qk3O6%;~yf+?zXy(u{dC>LjG59 z<~ys{hiATA5+0TKk^exQP4z%qRFL(73)2BA2!#O>XyYPD^g$~Yn;pJ!#a8kiW0t^~ z-}vqQAXjU)9_dpz(r|&%Jt_gGHcDLa`39boTQsF`=eSoBukaQR^M%K$2cK^xmR^?5{)EX#6nfjv}Hc_!yXum+C&;IJRa z+)m$LkNV(Q&)#6#!OlAk?=^Jxrdhq&FVwhNCBTC&v&-lwOjrzHA$Y=;=# z-R+w>OLZ5AwF1Qtp^#UDDx=0xMM!KZFBFfN57=nja}s6Bns;#@4IzUx0dL^r#@=-KLF(!{=A$MG z9MBmxk|{a28(_=k38;N zWvdscY34ZfSeym=ZRZnem!?`H=I3-UA0_0Ks3%G~zcAsx-_W~}uAo}e=jrBU z$MCF8z6r_wH4J>U1VHL{*RpHS(2#Daw*50`X}^FX>oT<~LXG$xc|ocRXE7LzT=WHP z=)b+btf3>jl^=QpT0p$vj)j54HxmP?AK7^qV+*U)oIp8LABPZ;7wkScP76_IWNwfz z3TePrGD@wdxn-?l7~G@A@|W(aa2 zW21xwEwr^Q5jc<&$-oL3x)nbpU^9DnYw9zqQP#GIY*g3a2MSorD1Q!XHaDuT<==io zcP8{6!LbPYPDl7u9+;(GRRN?FVqjJ!d?_-EwuUd8{Q)hJs~Eub<+nBEg`u)z81aZg z>Yh#{KWch;faR|8J@Tn-)+wKd3Pw1MPu+J|rOkvJf?}-X%~>q}>Ll_M{%5AXIVeiv|TLFUj<>-g{@o#j=YLo@7JQW0-&K&+COQ+GMeIZf)#GTuP zgO~cI+omAWvXIM3)nZPdAYe<7EouUvE_j+;N zA#pD~o#v@PUhZcdz3d-$kM36HZ#w^)u#u5&jV9%7WU5--Q#R}EYpHt)yg3L-ZIii^ z_s|aY2as#-*2kC`U7xFc z;iz{KO1H6fgM-srzMDP8w0=y!Gq?62=Mrw;6m&*6J62@%tY@xdfJP`7g) zHzi#boFu*!c%wfsTk%L&bC4&wR%2uI(76V=?Tc9-=&<+KIY*LDb;w?l(#k)H0p$+J z7Q-%Ewl>FvTsjFq?N~d_)4)T0y$$O?`qeqY-)~!+pzMMOR5xhB(WsH_x@<+&5Be>=fD4HAvGu9~lFPrMj^*i~KCoXj zUdL^(B5hZqc8b?-QN~+1bM{8o{9>>W1%3$KSMS#pUM7G=>QsQJ;BNGpVDci%0ow77 zYM?;wAzdRgB+u07?6u@Y-9k#@Ep}ZA6!S3GSTc~%2598Y6f3M=sK_VbGDkFc(uRRc zVDk3TpFz@}9p0ciY!aK@^fJ*)xXb!^^Yzwo>?T>7J*02%8`xQLcu3j_2piaZ;r@aO z5(GWG5(oh4J2+woRpDZb;AY|Kr?@kWHZXtd!a|JP6nOzzqmv4OhXe|7r9yXU4KjS|j zE6(uJeYr1mCuK<6Cnf_CyhLBaeoEk?7ysz%((Kixc*(Nm?j6X3FUkrfktjNI5nhgC zs!!8VBzf72JtQlOM}(}e`bv9Iia_PZn08TeYw)wc=ze04A_moWsKQ@QUe}<;%fZu5 znjX+SKD!={!#3Vco>S)w+(*Ib2Wzcwt#c(f)jIQvdq^iQE09C&-4C-&}pXbp0R5Kka zyv*c*!?-Dbn7DN1ng1U9m(L4!myNH~UN#iHJnhH%H5jKURWn0(x8G|T&ed^O}> zE5&D%{I~3XeJ334|trDI+oAfHxTTT!8mjr1T!=t2O zgh#P?eLfD68VmvEG8E42TK%!Rdca#k;YBcHzGi_Wt6g5~^Zv&Uv6)Uho3o=YGhxuT z4QHr$t&db<(XcAPY(*CjQ!1QBD+neVe>>5$r zDSqhE;;iy@9Ldc3Jk45^6RGLevbhtler`J4Iv+S|-qRJJA53AJE{fAV8fx~ksgWGO zgGiHir%#*G7TX#-`|B(ipCayJ zeGn&tXnm9>+~;6dHMeXh&B|_v3);W-4K&zTH)AR&H3Vp$h3@BQl$cO0oZ>epG@Faa z3~Fx zPwy@r(Eg#JR}@Sc4+D$AzI6#Eby#-*wD314ra#e(EUhFj zYULi-aWzAx#)k?*4&IJTlZOUnwU|Mim6#rF%3$@FqHkVP=JwGVMgSPq-ihchx8K>Ec8>|d0S)3`4)XArzq zoMMV5m;q}^TJER~Bueu!;K|I9K|YDhe7G@%W8tbx9KAo$u9`&NW=8-Lm?$vUj-?e` zs+nVYd#@L$iWmD2<@$J%?8Ih3RMu3!;U#Io+qKi{8TQSz*a2<+sR?z~*s39U*=$2& z@+ViVLI`rB0iy7xjD2h;`MF7LeiD8t9SwpBC@dyB z);_e>j#0IVucRc(s8-_vr*E2isY0fm%yl>GG0!Z_C4Ne&c>^0bvV&ZfU(` zvknz*1W93T?nZGY^1r<%+c2k1BfqZB7oM^w=3c|B!J^rM-Z`dkqwJl6iLdc=z zCOu>jK={SNl~SMWx-Qj^H=9OO*io6cDT!X;yJiSNf%T^XTJ0eWOp=~bTO;dd;f31+ zOXIt%@z)f+FH|K@SX*E-Nm|=U7Z0Omy=;A{KQ92sqF&E;3PUN&oCZpPKP9go*MIrq z!B?|FVy;OUeA&EHd=7sgUja{#_Ik-Ii+$E9g*pEYL5w~}WUR9xUa%(>dSFn#S8_t0AY z#$8%{yE5qLJ(hvS^a9!$@aYAXiv9z(Nytip5%J0TXELuQ_`2u!ADs4YbWWk`t6P$- zXZe#mq)T9t#}jQD8_T62TccQxN+}eHUt?y zwq~6DN$(Y0V%D0Z*><_t6ArzY9@{GzM$pg-UM)^ZB8x4n20`XATNnV?9mUDbfbF{zdc z;)C`17|w;ap+D8y*i_3qdYJ?w~lsI*Jade+w`8DTpg5` z4Zk$VAPW0y|D23BSF8t06KRho29bd&EH$%q1vmG zr=(h^$U%u9JS>T#mc!XK#mczdxF_w!M8`~j3pP)3G%jdAlbtG^a`ge{Mr5B0!jvGk zAdaxt~Y2a+2 zi^Mf8Lvrdv&C3(=H`j{;2->~6nMUzk*1VqChCXmxk(@g>4r6t zr|WrsB&U>eH;L%-p;h0zWO^dC0W1W>J|h`yb!jDZvvSqGaYoXXe4j;L6ff{k1)<7xQQ%KIM&x*&1e=6*af|9(Qd zo7K{zW*E}~SxUL+pV132*J%AD@L2Bi>BKOXftwl>zgi>dXwp8fDtwRlVd`YLnFeWg zAm>lH#*N00dUMHOT#U^hEhcjMgB6Ro4YHpYK@P6z`NT)$b>z@pQi9y`jQ1ad-i*^+ zla66Q@+xb*u&wspFCNx?y3N9i-kk&h!18>3wxmHB-vHn6YXa7 zF)yZMk`5QhWKk!&lIi^6Fp(FR7DnO(cp`Y18on!MfmtygXI+VQ3*d1k?0 z{*+eGp)f45<;7rt>A+cM(uOe1-aMX}XIU=()OO#O#g=HWiMCJOJ^cRnxYJANVg~P? zkQG8W99N``N5?Jr&lBWRV)+ zfQU{k0N9ZsG6nGXDK1f;7;&`gMq3upK7Hct2UPUdv5ef(rL*S;Kn(%z{HLu2a+-C2 z(n2=f7A>KcQPjJbYKw;+R?2&}BASJ5S&&z*@z^*>E;N`l^)>x_0klM{hI__Z$-qkPL`jJ*{$aOu!;xZ%~Y{ZY5w*M0rxC;f-eS6&}~7-_{T z5;09;^^!_eJaTaFUe4iC;#2B&e8brt9#SeKiUb5}-sqc+Kx(~)Ab_xU1Mlq%eXeNP zL)6H+kd)?ZLf+DV?4tsnhs~0CQYl#1#Q!ZcSg=e-1L7sKiZ4Zv6~b#EJP6;!F4PWu zoqc&x?lm-6fP+rXP!X~<7FLBOYJQKxs#Ead+n@W~%TtbLSYP6;NnSd&vDOX4bJh#3 z8|5L=d}7OKKP-=)^B2jph=S!#NgDba3MQK`UfjrAI6`=6nDz`XVbZLkbF7b@tcuox z;b>VeeC~ZE^GFfA;kjcWIhbspRYs}O52{6xT2C*9cHXQmW`Q|_uBD!rSe677(QB~h z-k(-)A_R8VSm9tqc0U4pH5_`EwWd++N7eQ#2yd08q|9pl_b&wTSm-Lp^jC8u5K}4D z)Z)EP?cssdso%U^jbHU8iYjR$#ql=E3L`$flaMbd(f=iJ4k(gkvLnD*pIu>_#zQdo9_~v)LXOIg$JYB zWcZ1Dxs*1dn!EDn*h%U>!KU7j)D-Vt7HZr~QKJ@By=et+uKb&6?orH`Mx=6ZHK;Bg zLAKi>on&1M!bkF-l{z_9o82x%mA0NK$iQA-!}!^!K@hv~O~7F#H+prfPI$$b15(5; z@P^-Om4M3{(UaImF_WH4fT*5 z81Qs@c#}58_((Mdw{Ny@9|(MGgVe&y*ei##rxgt@j~tvvzSyA2TK4Iz5daiz*Yx0a zS;mL2>Cj@!Ovs|Dz1CHoE)aB50&f%ZX$OX;DWsDe#Ct()AaZ;wR>udE3y7$vJ6ONX zCNjEnPnFcDP8j|83jyBW%DIaUfcmSr2pwJ6c4R$hfwS+EdOBI8UT{-jQ0n8>3=v(`$M|434ho=OB)oafd|)V zK1%nz*8gG9X%fa=Bj@Pwth^IrVE2Hnkl;E4c&=~ieppE7S+-X2PmwQz4?-8lO&SnE$v9rv$lQF0dqT8MBW^rn-7Xtlt`2+c z;BC_~x(?5z0KFklifu0zS@&7DXGnZP66xTxO96z*^K^-5JR|FLk#xa)Zr}1%a(4xu zMhG){Hyvn|m=g)tzf`o?D#$U)whOp=u8>+R#LvWl z%-OF}U#VE@mCTy+d!BFCezkl>m)v2u(hhF>JqFsLV~wVmtRIcg^T!4D{n&o7$tLva zZdDF+iBrH$J@X3Kkh~@irEHC%7D ztTc$z9ecetBeoo!Oc!kD_^jpmfzKM95`szBj%W|LK5}s;GwAZri-&CW{8v9!#mS-( z4`TwGSvphmIK25CuARm)SuHFCo$~%VDsCE#b;*K&`+#2C732P3=Ml%rh~f4(=GWID zjN^S+9#Vq2T-^eux?2oj-!dv!M(}{L0jK@Z0*31dusGF)L+&>fsOJ(GWjuK<`l`C& zs7+qN@7Lw0 z%Wm?QH$YfFEpN$G9wvJ7-dN10=HNr6wfjPyf9W9D_PMr47w?U3wd;+Tr_@mLxBl|i zVsL@s@)F0nDEF1ehpXLPwQWT6FM%Tm;k;Uh=Rm3}@JoP(V6|bA&;D)=g{gGLWC1`| zc-~i!hpOhL-Rt)Q79{p>ec!zyd!#&2*d3|OB4&icjcMn2QRYt2*&}zs zQ7SveO*azu$)5eqPVJLNz9En0x5^0L>0i2d;q8hhb@4`#Y^9)7) z8dYRqU+itJxM?Anw@~oD>j-L^1kjqdfa>Adc#8~JbS6>}C`de6a2(lAsrel{h6Fe) zwV3sLs1=t1lEHg3>Z^Nm4o1ECtJRTvQ}_OeguUzinXLf(^4=FT853V}fb5)IUQP70 zZZcd4;@r^11%>DCxaaAIXh^b`t7p0XwTgmRuX-;%CI4NIRE#Nb4!Wj&a&CjiXo~j7 zsyXuR-T`@ZJ}~UwnKH{u!mb{Y9zF!bnz>*WvFc=IZ>0x7hZokZ9yob^bq7x&vIh^3 zVdfehR56Ikp}ZCnlt?^X3n?ZuRtVQ#61IitI4rjOVCeHioj2#U&ij;AZJdM%W|D^i z;szV1Ldje2P|<_@)JnBucFC8>s4)K{o{5o3OwT4;c=7E+m(}~x1d$yj?uK3R27vr5CjT1$NEVJ= zD^HXWmi$j~ncMzoiVy_3{2`T&Q)n-l{r6C&%}^KF2Zl+X8CFx?(%k_{Hzu;BOPnQA z275FLXNq0r$flKSnHn?(!+g3Y3)uvzZPk*1;pEIW?n4=7R-=4Yrt#kiY&-1I0p!ze zmbk5i@t=JoPvQs!P!fa^E}3Kuoc_@1hNf^%BnR>o%m06?WZZzN%gi`%0qA~nH;8Dg z@vVM5?%Y8FVX&KnR#5W!1Lxafc{2hwjr`yD9RL4w&;J&`;r~KP7HgJwi5bE=Mj{gx z7j6)bIyHr$6yh~o`F?BjHS>Rdf0VmE8NXOvYYWMG(?|A`0u;`y@)H4BFQRKGWGvu& z?^yKyL-u6wiB-!VgGTh!hSO~L-cZ&g&sq!@d3rG$Vnln4*mCn-4DPp#-3Y`eh_@I+ zNTb#D^sNo)pEydbcoapX(Dh7YYl_m#_$}#};uJ@adAr?+J~HZNPRIWbfw&=o^nVLD z^~COsXy()>r}i`MB9WW<60}BY{#!s*FU3e-iSM;$Lv|@8Eh-0qenI2k0#`;m@mrRG{yo z*_@2mU;n@xKp=6z0oird@SO>EQTl+N#Sn^4u*S>lQl05+Rvd1~>APVP2QzK9dFCO> z7eA1StgLn-EyvSGCm>1n$w^>tlF!piDpS4|Ors>Zo#==gi0jD{MG)wf%ZI4?b09xl za1&{rr&r;=DCy#?037eU_VoD12vHNW`n0H$B7M}_FQO$LA&L^N+4os^??3(YXa;)V zlh4?ek~Hv#=ZOVid`JLn|Ck08b)b@&xtV#u?xS$fA-!urFCXBnB^H$RzuzGjy1AnB)`spf3{$7ZkiB5uIA zx!&l^joZUN&FlyDZ2)J_&)pvN>zohIVXD6dm@3nRG)39}xrxv7@&;fEhdjVZ@_ zx>^UrNNb-xSYc0eHym@O3_LIE<{HIS#|sb{QUs)XZ({xV;i-RO{q5O!%KnU(gjgBr z2UE8Cp3ooLmD%vE+$Pvaq8FR_Z~zzi%mG6Lh<`>g(JJ-|*=gK1&@U_$ba^LWJDn&# z*PK7B*pgxfpSfgtMMWQI1BNVMJ~4Ji{jgJLzs==uT}ApM`vbf%N=7K4r4dW{68Zhb zYj(2oPH>(0IfaZ=X$Y|hF-r0$E=^vwGzVWZfym(ZsBhg^(P+nvO0B*!FI;xp;~=M? zYwl=ZO69b^9~M@v*$tT^L!p0FI#h%o%Y8ITidxBoCQI=?MTQQ^ZjYX6o4+*^ zveP3s9U?Op~hW>c39mY3@l3gU)7ppc%wHJl0UJWKX~%p z3$)VjQpu@EiosH>hv}34B+2x}q1twI*Yt9+{2yY2^^z&lP0}=`SwmzECMW5xbMOt; z;9tJvEiL(?Tf6#v!MxE#7A}C@Lv@UzX4;-CPn%-``Zu7QW<`8@KvI z6hHi1AeDZuRx^yPn^+|6iz+uW#=`qpZLrd-A4pm|DxU;@XHyz6yw!xV34H%Qi~Qpg zoG*5K+M+&u+Bqt_{Bc}PIyIn2VKzeb z!pT7f`VJ$WJfX*JtpB-UUmLXNa(PqBOzNQ|bE~r8K~gEAy_-(zE=&UNlH0o&v7l1@ zQqu=+f=|P*)MjcB+Xn5QP3?gKURYCG*e6TJ&$?e~;=$I>oZHUr3{FnzYcisHE^OP* zF^6%HwD7;Zxt?=|G^;X2}fV>kEBDyc94u0^W zF%3JTgP$rkIo9%HTG$Vwvjr^64wY7(yUx>P%fEgPWv#i@W_ZrqA@$4h3n2YbCAz>+ z9iL&8z(~|vgs}UdNav?KC!MY*jmpZE$k=l<7m_0LPu1+s399StwfYLUD1j`(b(=P* z#`P?P6S87KeN;UA+4tT2axKOsGGbrr2h#5uP$VhJpc%KikEY}xAC+^|us0tf92X8I zac!!2;;%HxK_mBC|5$&Xy@7!)RGfYhML+4}V$?*5Sd?tPj2D)9(ejT!c6ol|;W)_> z{QU1rUtkcNPqF^v7%;A zu4=%WJa95T9!(pqlf75?VVfy;s6l8lRy%M~H%FOQ5m{ZVU*o!=lkYsPSp~7w{K1y9 zo6~2q`;eaIX5mOvqL<(x&6g#M>X)(q$}C>*?;x4*ZCdyzt{C)dwuv|0Wc5Fjcw8=$ zH15|%Tr08ib$un}G(`{>KYX?W&Dqu)5sBAc2E>;BXRSp-xP6me&40No1|(p>v4A#F zDPBNd@fEQ?>(4$g1!ty1=)O+AdWyChLMdXyEz^Y8qXNIL*e1%~v$4$I^2Bmp)XK;0 z=4|+8>}xS*5IH=N^=IDemh`)+o_CB~y-gj7X%39HP=2nQvS?-YLD)mAxZAfZDPPY7 z`+ugE*FX}GlS;<3DCV|y``PBXIPY8GPU^5#x(QivX}PubwCHaKw0N6SMp;s_-MT}pz&1dDnPoUvy-N-_C( zZ2@^6nNYD(F11a)=C>qTTq42&w&4~bU;lorFgSc`+WeLi7O2fg0W;b%T`uUNjt^XI zOXTVL9qe4jlD(X+G;KtfXQ1?~{Jh&`v`lk{b<8nvkBi!sk#AVz*>T0FahAa|V7iY5$8-Y}+lT?7AN@irR4W+An5HVq{t;1v zyG!)xSq4NQuPdo@H^0p&ZDkZ~PDhBWFLc5a_5sWF^8PcQzMCdJ2&puw%g`vud;@P* zv{>?fSuovS+S^mK3Y{!E50{ck#;Ud)FG9xu+$W7%R891m7XwdXGe#qkFA+Yqh?9Y* z3#w+w5DJ`96R1Os2sLu}l3R|$Yl(wCJ(~4^Hpzh6=0VcgLp4Uw4_-;O2yWPrDvZ-b z_=6?~CCPI>sUcGHu^^(CEKWOPn85n^?Ka-&_VW9N0py~1@Gea26!8&PRJa22OlHh^ zm9AEG5STi&AMFO`yjw?nOwf3Sp~}ZzKI`OzN3L{zVLck$43Z#K9}7a@lZPR?^58jb zK5%tb9HyQB_0!2djfto{8y!g+pXxtzHch{_gp4qkc@ULXq6uJbqv1#{Tksc)D!FbM zr*6{6>4065Xq%O~P7X&e)RhM(e`mciZJ1ejcti^Qw6m0 zXWg*!{W1HQkfpWVJ--h}r+Gvgx|ACHA^jkAq0g89%9oH&ca9DF#zq-M{zI{{3DN%4 zpMAwYMmm)ovjv=3WO6ZFzN%jp_zGBf+;yrOG(bNY&4`)Wb_86h#{%;E{`{W>|Bny< z|Mu7r+8&bS5I|moZPiVPvL;hz;@KmA7+9a_d%m@+QAAv-qdEuPK=CN}4>=pV^j=1i zJu92$&oI$es|2{ay4ZV!X0qzXOgj*2(D7by392-0D|`86g!8>Sq5YCbJ`B$ef|lYM znWR%?l%#qWr&?}x!u38!DrHReH0E3VC|L-zd2=1fWPDX*+G>+EyUSE1CYF0ImERAF z0nKxL&wFPc*xtHY@vR96k(`~ewDGJbp3lpxz6PR&ZGRX5^TI4;hfh6c1q+8fM2{E^ z{s}yWwv`dF6_f?{^(i$wVmZTBI6WC9ULR*1c0#Qc`?hl{ywu;3O81|g&+rt?Z;-j4 zbou-tA9zo_na>pNX=9USgHw8sw@&1DyTD;sC$nhE?=-skZnHACR{aB`oU(5R6{%?)khrKI_2WO--u7F0M7?uppFWapt5Su#X zOVT8zGoE^^Et1`b5^+%aKQ@L;6^nxwli#ZN!dNG0b|1DYZ=bD|2WM599KdQ}tGZ_o z7(@`7Ev!W9EscBOdKJAc)xG5voN zgye~YUo_Isd`a9g-O|`9SdMX15|ECG{m-AK)P7eDd3-Br0>;SLfhzJ?%e5KOzw33Z z`dAV}i2uZ@*oZ1Ur3t6sX8o@%))fm$%1kVJ*mWB9_<3o_nUM1M;B}+(1>~43nvj_o zlZAl;>cdUZ;TW}UYzv)Iyw6s$S67OBnaWoN=w)J2WGrZOKNX+C{T{?W9%F+9w?sEf z@cMy5qe=RMv_IN{&*eH>PrZLfV`iYVwQA(OJAIHyWDX0`MX0TkonEGc1x}&eyT*?9 zA2muv-ogaLDRepylEE({*^wqpT{FEA@osKDcCGYgt^b3XFk|NG+_5T*~)5vy5 zqFZ_-M>qYb&CnsYQ~OFZMie{^6DFf*^`KLFZp73JZh{17g29^6!jcrF@7)n`Nu)x_ zE&SlYre|CI;^u6vxpAJF7v)lb9Q60wMx0kZjzZae+>M?pR6eg(0v)H4k62uB+=fE& zfG>z#E80QE>{-5C-%lxyF*TO8tk8L2nA`H6=5MXDU&_WPc79E3z*PP+iYs?NkASNP zy+zI+HFM-~EjDR8Cz7{Igu4CpWy2@L{a~XFr44>*CH7CR(>PsqC=C(!eLy^xG|p^Y z5L@gIM~)*bhFi1W(m7Q>m9s)>o50hsrgpM9>f%|PM8%(dB7FZBdv6sURj{-R0|7!D z;vPagfw&MIAnxum#2w09B}ir6HW@F zK-S1&LKEx$RGHLJ@_i&5c@yFIw_n{Fr||zsg7nD3AKs-K!T+~1q`7omVh%` zw*AL5YC4I=cZSZ?hcpa_+y4x^D_IyXQ=Ab#R4xLw z+5zvk$2?gx?mD6+)}F?%=_yb;(~HeUgsOzc;AdqpIw9`eTT@&e@TK&zps!wg?mhq? zx&+}W_t`aAOV1lXO0Z%+SXOyN(O03Fara3TsiME!mS^wewCfd`TPY9qRh_neT&7J5 z_-ZO48w|(8U%f;T;d_cOeoexPm_(Prz`Kw|iL@fe7oB4FKImF06;7g+0Ioj^fbU_# zO)NpI1n=Og!C{*ng;(DuNKmDkmn#2?f<4$Xf>M1nYQ}@}kBk4;&+mAlaR}N(GmX4| zgXgwNu8BrJy8`>IW3;jzJ~_bwOL$}7GxN-k8l3!4?fq>YQ!yK#r*xL|ZE`2u;a>En z-q_>Q1I$lpY1mJ^Lmz#*&xoMTWP0g;*YNcd6CBX=?QT~aC^J75{jiE^k6(vvH3@c4Sh+m)#pJ zwgvUd6_d@Ld?LUMKf2i#S}fl9%|#w#BJeYmXHh=L9XmNvJx_3!l0&RaG5(DEN58L? zBbhPf-f=IrWng>({Hlr_18n55iV2lWq95LliNuS+pit;A-s_XhMb!vG#hLtGqx^N9 zvUhTp(R^SQxC`BD5{rQdp-76@@4jql4-FtV{lB=<-e{kg8wMCT!OFk zac3iv<4no`?7?&}^KRyZf#uUfMeX$?OU*^F&>f+PV$H(CCN5Dz1?QmPVhPBW z(1!1w8~JfC+>A%sut6=`b@Y4TBvr=?9K6aZt-oY)x8~&j@3Wn>#tmwIGwzOlbie zYQBy%qxOSvK{YBXMUY^Ur_(-ELD6?a6=o1IvlDi8zXD zmb{C%*?W|wZ}m?A@-GUhad%I?|1T!c>}>bvo~eJ`lXUae7`{!SelkBr;8@#NOzHes znDu%#zgY`QgpYpB=N|g)BKYUDJ%fd*|Kh9;ZU;E^>??oCkWh?os7BO>4~k)Q=yb~kg#h^R&0$dN6$~4UjMBWzZ~d&ZHzG=lUA{ZBnH~F ze9bF-;X^Z!eN;L9$F7BCfy%DClRCPMaLUZoU%##C&Q7hGemw{W|3Q?z=vKzclE0#D zI4uR&w)2vxRsLb*3xBa);BFJ*IbPArR*9O{)~^98E%=V9A0D)wOZOv4i_r(x-nS?FDPi1=a5l0opN01kuuX?^Z%zFEL$?z4XXPhXl z3v%pfxF)6?@Yi@QV7K^+Eu%1~F(G&p2lL54b8JSfgIO1g?ItB?Xdf1X2;N}z?M?Do z%z1C<>_Y{Obajl1A@p4D&n-4mYji~XnN!3xjF5dfj0LMtpZ31cZOB5aCEal}Az6Of zZP%)luPF-+%_r@F*aLxOGE5vO(7vvj-5$@f9coZ4%|KVjp?(rbTQ}^*;CX}a_-M|5 z{0WO75VS_-KCpY9kd_zKrg~8PPXJ%I#5cFN%{xDuOL+W~E~aga@z<6Z`Ul``l^;Qo zhKLkdthc~YrGl{Ep(cbDwA&ORWc@Pi##)(2ElP9ChLf!+J#z%9b#?ZTBBoM~O7+P$4aw8S?zdZLB5Z9fm6Y1B1x zLsg?<59h)hi!AY5tagH_wP%Xaj(Q@}vH?4l4xi?~+EqKIQ3vUtD90F3R_Kc;r8|+y z%5GSdmGXJ(p2S|7VO*|A;d^t_rA|pg1_kL>~MswG3N1q3x5jkTQOmg~ti! z4werf9*XQ@%*oHYVrrY6hCS@;J2P*k6bXai)xTJGZ69NngSmhX2a9gn5dI?_i(GK6 zwx^)P@J~e-uL3Gxr6ZzpZ(YS(iitU9m;N%-MS?_pYbMBKxPH2kJ;aV=CMN-1Xemzx z5xf)l{=%OMB6>%NaYC4xHDd@>xCAMY#*i8Q)p~oXy%T%y_pHZ~|3qRQ-w{%Mm1xn~ zu!KPuFw5u{r84S1DsKsLno_Alr_ucTI;B=lx0eAYB6A3SliIt2Q%l8(u)g9}uJ_ud zN!f1mJs?WYwaAkUtmB^gJx@-CC7>!SARVN|hFr;kzAmbMZnqk9F^l7^IwYrr+tmJ< z1ScVlbz10~&8vB;ejo+iQXKlcC`ZfdH+kf%Jai6LUz9l>BlBH1RzsoACV`g^OvUTF zKEij51qOnSHyE&Od8D4x6y-tT+Xf0w>^gh~od^MJ!a`yQ0~t*Dh6_~@1q#%GmTUHc z=^uN0C-NnQO^~L#0c)7MpX>2G!8D1v+YNAisp#|{rXV)zL1Gg=QHB5dL?W-0*7=&A zF4J|rfNi)o6~t77*tmD)k0F_h<(w87JOjl(lxQBL9O|-*z#tBPdhuLup+!N^f2(~> z=Mcor9uB=31KH=%1(f?G_vEkb&j81=;=Kn7{iLwv^D#?nUD+!wzo4u?WaIHeF-IwZFTe!qL{^+km`uYU@Mio07Vm`F zyKYjgLKQnXkyOP;Sk_Nj;%^DrYUB@`4hP$~#4lv@_RX@saHrQ*O=2b~QE=dLGq_OD z+*5zKI`6{HE<^s9co9^cV)M$qk=6Ylo=|Rn0@_ykHUY+uv!|CZwyWk7B1t0=OntTk zMH#ZQJ3&!GB3a~VWvbS%+&{9`+-s=?;oS@QR@=7KJM}8Qu2{uRZQSa6PV%K~Zcb(5 z<=m3DkzKWLBF+d-+A#U~B>E{S>Gw%=8jU)h>TCgjuIS77g^y;7*&!c0^%lYIF#Ftr zMIBZ_HamXf@wVnm5%YECEJ(qKMqA7o*jc;M1OJDu@6XPfwNGM#ZhUr~nS}lRe4nDh zJ~eu5sy&q34p!9zECn&-`Won)2+ zcTPMK;K`TCLRfFeJig2l|BQMo7Wz!L>}w z{{8{$vEi5YMbSD>v)S3`#Ga_PlRW8sVR8W_Fe2oWB75acK*zGxt2&zVHJhNwQ|=gK z^J2vSWGWo$phlCYBx)QmVOH$MT0s3u^$wlXV`5WOk@4@t4Cp(=*r3gBBm~De9O5K3 zDF)9FN|-k)02B?+ri4^cW@A%^;L)kvWOrn_yp(t0&RpBo} z36%7o$@lKUNx7BP@6bU}inK~Mu-b zgIF4@A8}>5-N)~1HQ3q5OG7!@`o%@07dTAJtm|dnn?S!UE#@3;xg;J!+`IUIQV!LGR($m{ z%zn0*?fY{rY5V&LmwlG{yBK7O16HvNq=$uzsZ#3={?XrmfA-~Yb|zm;;Q!snFriU~ zf6(5aZurjhqDz%pS)jo)c^|ah!n;A#kBfGrED(Bsi~+{bCF584ecU;9bR-`>_ZaQE zOSutQ70&=Z6n2lDFHB7=pVD$ z1J?k_NLVN!4 z_R5;}qdH>t{dPV}=&ORr<0y@24xvnvrN<7hLr7>#=S|31bUAe^HTjAR?R#itZ9U5@ z+;tOligh~VdU9-_WbUMyWWQk~Y@xXj0NY}j1L?NX()qMzbdZnKrQ3lRnpDMap;4n% zw-{m`QX{5U)xfD#qEoV}knQWMMJeEA;(gg*+jXv9&}GWxRJBlGo(fGSmPz8q(Kq!} z_1>(T>pC6cp+Q{ij?7!J@L?Y1Y-p^ZoGv@B>SGIy1iXtq_zxipAB81zz-^Ui-=L>{ z$#K3>B`NVXl)DG-2#Ky%fENa@KU{acX*$F&qvWhi_(p92yW7Y4TwkcO)}G->L3Xg{ zcAEAt_GwK;sC^>!W9{c1RS_e)np#k;do*N0X^DEnnjU(6oWlCDiit{OPCEDwdPaQm z6NYsETf&+7ziDjO??{!vHrtOo7WC7(Nq46iZlRDnn=w}-i9?D zHHfJAZlxZhr;Cv;m4kzlU5k!{wrJ$>EILCP{v z-nP5tGWYAMIs~*HMf4i9Y+X2RP1Oil4SyBS9&(AYpX!|G%eqCAaEY9G5E*#nw?@$h zZ)ggO$o}e*`aB6wBc#N#hvU!mF!30Gt|jW55lH%#lg=7C<`@dmXx6LHmahJpK_3Ip zPvqA=Mslz9^}h_7B?KAd34FnA@6ht(uoS8!VSApWs$0aWlkq=_Tu)aWbYoI~(wnXk zt7e{@>Gi;USX3TLpZ2ln>twAGK^%unO2l{n*@f-Xv#VL-H;G>rzPBJbD}IDOXScMuUT-|hL-y^s3n>E3Fd9HinZ%6OWMq}0+M(=c0AWUcg3v2V;kNXq+Ia zuD7#^90?acuWe`e_)^x68rheP%P5tm{-@@&FGtOpI(aS^K>kq_0ZXT@4(ZF}!i(N0 zm&FQo9fOkiDST06ipz|UbeF{0FiCF=En(z2ojXOUbQmpJdF$m7Cdz6Xv)evlxsci> z%2M{@P;B)aZNp)BwUz!hMAz>Mn*n^>x1AV5Ve~wz9>zK=@L8SX8%BJptE_66fjR6- zzJ69)I@i@p^DPXXv2m&yJbRB-m&0?1lk1^q8*1yPdEzqamOUODJw#{TEpp^pX+n9L z{g-HMIeVq0Zk&G?Rr6%-z}BY%~Xt1Tenx438;`>ET>jCygG}z_&+lny+Uo0d&~$%KZedwGeU(h0~-$jRA2+ zr);$28NBI)l_q#ft@F7S#PC@I;_W?TGkPJDRm)*HEmaTwwq3asMMU|OF$zZ1(y-t= zG}2iSBfe;zkU@!A0%7I<@xA{nF5N;kas|iNHPC;|K~Ho^*$X4A^k=%Ne?*&VA|w#ui(G> zJM=B}(VxNJt66H66VIwWAM#8UE*$XuIK{*$`RQXHLjv;FC+xy;oN6T2lf}5(=9aj# z0-uDan^MHDVJtrf!ZyV7G2zm-*y*4){QOSs>!NC%AN3wlm85sd`Dj!I>nxOQYxpg- z?pR%aPRqF6xA{;nbE{ZaOUXW+2y^`lR!IyyUG^C8GKdHd(kIgti*HM!KCL9S#*=;@ z(0R+#3Co>BGtu&IC{R+HpG$Tf-&_5W3UE#XCu~{x=}s{fWUj-4Q^V#n zy1t=D5Wvr0_Q%Sb^h&2W?qT<{;&8~yhy74}-niyv-~CVlbx`Wrb@R#g_dEjTt(=XX zWV6n>FIVjm@caMe@m)_Y(b35h!?MA&hJ@P(_K zXwYejNr3@(dS;)^vIYn}09rRmGC{&Zu{;m|>x*qIh-@#I!W;*@SvGMo2iaLUaU8*ok`RceO{^7FzbYaHl_4luI{2ZDcS?k?<=m!aOfPa^MnFkLC-C zO6iLL?rPoD6cbxUGY15scVMwyLOWsSNNJMa6ktR$?{0CSbsmb)R}r~@T6v$$a5FVT zv?0w?vjf#r%D&N6biX>NxVn{Uw_?{t(7EgV(%ExM2JD2|M>;M9bAH53_Fn)Vk1FB2 zvoq*dal~_<)+L9bkuID*x}FC6L(I8KmGMuc+8|t9$qW3$lp`2|Yy-IU15+@>E*Rt7 zb7r@ok}oMNbrIP|8dMc6rBR>Do`GVJ&Fv{Y3AaQa6G>9Ev?0hb$-0%~mbH8UF^j3#hPl*iHjLDnPs%FpsbF@( z_rVz^ol-&d3u`!ol)p?p&=K|K`Iuxqu`3i_@{0k8MpQH#Wgj2@JPQ5xqkv~I_VO?deuDS*kvJyIe$xQdYr=D=n2KTBVEV2L@tcsMF>|7N8lh$xoizjQx2bzWwhoxF{0wx_Q_ za$tBT)!g=>vPP`NH?8dT$O8ZdT-(h%q%%|pF$NKJp3;eb)NfNVzG>UM6z`&Z${+yv z;{{7XTE$lwKnG}`Gm!zocJ!r9LKwaXx;`ql<#VRFzCC1k%Z`g9vhf1MKFQ_P&yGTIJ{al0|yOAz7&vuaH*@N9`^{&Obsz;K>ZTAv$L9h)dAP09%)J zGOU5Tg~>EN;k0J9ZLGbnvYWW&vk?)`S0oR}#O(C}BGm|1K8-)@uLoR^&?h!O4m1O} zF81h_{odk2CITf|?S7oI9|9K0>*{?lvZ)Ply%@TP4Ji3jRWU(T4>}$<1qI$bs;AF2 zf=b=%H3&>qF|#87o4Wn{jvcqaBI+FyrtS{enT5J9f0|-Zz9N#gYtnbPZ)5ZIatsq5 z;JX-4R!J=9fY?oZ6;=HL8!wq)a6#tC;kNp|K91djB!kHY{q$jzXNH^!}ISJY-7Xx`{bwXI>}Sp#&=sld5z0ajnPj>!)JXD;ME-UM>lt`_0yWnBLc1emI%H6cSR|zBh zd9pd<%O&Kp)n42Cr(B88gi9`NPrrDL>~%!Oz%VOie2^ovYzY{8U-vzS8>>M2Yn4@= zMZO8{mr1pK^qvOuZ;Y=mLZ1+c-91Nrc>xwAvkUzrMHeMs*O=fMva2)RVep zC4!3oT)*=_uXi$Wf7WYqZZ0PGD3K%|sj}+&SCv(0N3BXXW*1D+!?@&u8m}j>-^l+{m(|Svk1{N~ zU<$L0VUmM$Qct-989zth#v%{3W&DN+4;Fd(=!fMU3~|?BK)e;V0OOP}n;W&PLrdai z0Sn);F1ptsbfZ>V&4a^DZ>nbY|D@zg|EP(z)eges)H=|+wh_M(d6~B1j{>jpEN)Ve zw25APtz?8uEUV?aQq`TleRwbBi7kH(PVdGlwPKvn+rM9cxMmEE9g_a0ArW%T_p#MZ zq>K+|>7({ngsy|jpZjOqYfc<@*pNf9@q81b=0JiBH{Rc`r}?k1M_3+5S{#_TceXie zFuJSX$DkXprIVJ$LK0=4szwljDNLKmDlfL@mz%1Yylcttl$rBKY?c4Z`Tt+Bob6wg zXwww~XGHp+)QVpJOt`{?ng~m10zB1ftj@zs+ienvc~yKSWkf5;aq$)gLKkc!!>m`c zwDV(*PX^)y`PpKFGsyYH*(6T{-UAZ>H#vbioCu?M!eWRqjh?bB?fs}+9JXgIj~79O z2!Sw?ws&@M3ga9E9sHRl3FO85(;PfoE(q`qgbZAF(L3inZSlQB`s$>Q!FsOEXkBnO z$Qqw_0(~j|Hq^Z9aBE~^E6shhl6ZD=*){B-N-)wa+kudAocLas{1RC&=v2Y`B!r@C z5}pbuad{B!SG2uJ3IF-V0WvdfSeDN>)c}XU*TU9Lxyp%27rVhcO%h1I$tg?~oedr~ zT_sOnDi6Jb_$_7P00u|BGv)Mobm6LFcKX|vOgz|6fGEj;Haz^H$Vquv1#E5$VK8@ z=Y_#G3XRU!}mQHC$(&CWEe-JWdZV*ebFx}Amh?w6;CZX{cCwsdM3Q4?2` zj9(4~iKPDCBd__jFnHpF3laxYe1f@k+1V!T<(}m7$l$tJ+82AjbKp~rW{{TON+z&f z^Hl33{5BBq#D7AHn90Hz-Yc?&dz9CDHWKS7xlYKPZsWq66y12qAX52bh^I+Vt+tOV zVqOA14tKfw)YLUKCOMSO%w4s3T z=oY#*H?Ror@rKpKG0BG=1-^@`{P{*ajKw80E%ttI5JeYn6gJ7RE`Kccyp9``%y(6v zX@6ZfIhJV=Eod{tk0BTxlLAaA`H+Xl-x{{Jtm)9c3oD&$pI`+vZ-b-xu|xOY*5d?h zC-Lq-t;uO~ju?r#v65}MPWstteAFDBtf(XG`;u`^1qJrJ5NfVERpKgtm{ij2@?_Wp z-gpvf+?jH7gf}L6b4M_`vi&1o@MfdeX5Bc2q4!!D0EVDcm(+^Ie_ges){=~?Hb_hk z&mtx7eA_K+(@yu<`hMJXup^r!Q=p3~#=nqP!G^h0CeIn!N}of{->QoH@m}4KlHZB(+80H-5Y+?2umi}$2a2gFmtL( zd%_G1ubmtAGMqwwU5JGJSPsO}eIreEMD*i{+_^-}(Q?~^738eQ2H&k~&kp_R>Aq6z zZ-y%SD>se9sFAlJb(L%8C8k+QN?hC9d=sr(V*AxVP2icM|3nN}bmHC({usl}Z%km* z_$};vKglPTu7>sL67*Qx@hi$uVU;TqBO9k(Xp&r8cYu4#1#gUosOBCu5G!@*U5^?y zH>W+s!}GW87^k>;Y@{C8F1BxeV4wD)`wOLk*wz#>9=q4hnCV`O3N|2UCIuhwB8S}1 zwJW_a3h6UWI$$o&?(r7&zni2QRDa-QY_8Jo9o`tzog%euQUlYs;yU$Sz=3`EE;N$2 z2TZO18NA!dUZWGmsD1@#J4jmyo!=Wp0QjD+n77{B+6F%>f=~lHW;y}rW$%1~uCgWh z+Td5&UG-v7d;Q-^9|Z;=sMdn)8SXX~Iya3Z-RkH>)4;9gm6{VWx7wBa%0xf$9KEgd zAK0r`pG@&N>W}l5OZiB!*c6(1vebj|azZZ)ulHt{7Ulp&|6I`hD;ozjW9J6@6p}Ho zP}e!2-0u)a9fYD?dG~$ZiNxyT-3ef7{xh7gwu$Xg69t?478JY5qIv)OQnmT&`@j$7 z)?C0MV3(KKYi4Q@KD2|>9}@KXjan0x(AH`-!B=`8#5!P`X|4CDx@JS6M1EZTus*=R zdo|b9Jom_-?R>W-^gO<9Lj9Nz_vpgqG#qffX*w-&^jZT5`x_Gly)+XUhm<6}rN$-AzkNL=?E_og4M_N-gL>l7#wd@d^40}~O3F*-CW5xr3-uy^`2v{M-rw;+8H8cO1^K` z@4~Z z*8M`=?dvbw2hOrn&s^5!n2qEnQvJ+-9}8dcJhqqG&^A-X_k9@gSe*=#k)u#LOV|DX%l5l_&>x@Fhi@}{XKvEu8%pxD_2l8|%^lVI0d>8~Eo$RF=cBmckyIKUP zXg*ySyVH3q9c0VnNfR@nA<@}yri_Zw-sdNMT{gx}j+DxE0uk}z%Hd`F7J7f^eD z?F!F{HBGA#6iG!XK8L~lBfM%%>H#!%ZqlVZkH6fqr#Nf(wgo@}2;o4O-;SQF*pxo& zBGWeul3->V#Y3LLVZfKjF`^YjugF4BR?KsRL37!oW;4hU&!#ZYJ2sZ!&COBB;W z5l`a&AY+X9SDeARMY1Vm@In$fj@4P&bVzV@N{vAU`n#~hEMxnuZdthE3cvYzm*%A# zX9gkt$MDOxm3C26bCLsQ;m-GUv#^1O5ulKytLuj(qt52yDtGAux^tUl9u{*<1)SVF z84+3OypALZ2etI?EjwTHV)hyh=xJap%`(R2=+_Sz3)ZvZ&xF3$vH>Bn-l!SCt)5ko z{^@Jj?KzpsUg|Dio*vdt*(StZu6ci)eE!ms{Rb9iI%k76Kf2}T>OUEvO}{HB!m_x^ z*&k;3eVYI^M^gxU>}*23mX0p`NB){?&FFcn`$=AMKkHrrS4BU81zv%SyFReN2y$p!bamDzg)O-4V( zu}XXA(XA(WFJR~%mC6xdw*iJ=Wu8`zqzZF+4%k3En9%Qc3)p)jPQC#(0f+Uq!D7XU zX~d_3EiM#%be=W*c6sf0LI2+Iw16~DbrM}wM613y zWxqT0=}L*~V#-r;19+OxwG2q&UA{`ZEIFAX#?XI5LJ}1;s98bC8b6TuaxL zuSlx>a-e!qo%fN+1>~AcKbR>-v?B|sMO_(LLwO&OBmMGJ*$GEWdY z7Mh2D-@5>v1n2W{uLGg9*G=HOp<4!HN|>LbZuEN15^#+DCK zrn|d>xjDqJe>x2v9J^grjkow+xsU}e#24n7oLY9Ne#ciw?}M8QhqBS$ag=c@YM^Dh z_z6qsr;N7Rwx;#obX`EY3e?N!x*&O?XsDV0wflMd9=xfK9)xp)p?2SKEeO91#DWIU zd9Mo{yb}T zb_L&v)AqN_>)p*YTuJ>dfj(?=-R6G86qJH$z27nhFBx^PR|eeNFhn0vpbsiKg$K#Lb_$dBz;kVarBB;euB9Mgq7))3l+Dn{Z`pB&NxT)b*w zl@i54ZK$4;Eb54I(^LCl3uj%psuq+n4bzWK$L?}qJt*16mgooYfLb~6uC z+V<)A?sxIfkU29S$zefvwghLqb_?nIzr22aJC+@v)MN`Z>ybfKr~}d0&9}kLfl&)s zM%gHQmD(StZC$Z}Q56~ttIgzQb{&T8_PGnte{Wm2zRoW}=!>y?; z)M(~nTKy=uwIvl>Io@r3v2)RV*5X8z&_KYWn}iEc`a%~-m=t>0B%LL^N#9B+oMgXk z_2HXn;6~fM4W>C3l2WzNY6UHO7V^T|!GkQXEYj@SPFPiH^G!WIjEPPx@8CHdtVMDo zP{)$~BT{bX20M3>+&=TD3;=B>EQtH*Zx}7DXlr+rOO9YeJc~82*SjHWS1)dpaBziy z`oc-MMbv7O_yc^D_ARcAd^Rh)iIQ>(sCr{sh`=6}PpF`#x18ZwYd>n}7mi&CgtO@+ zHWUo3RWh9~4I8q~Wyu3fL7sa$tBaMF=tuLvy_9n>{NNJrLb4CT!NxD7PUe|TJca6} zJU(Z!GQ8rAEMvL|u2WdV&a-AEdG_erQ_f z|KWk}#I-g@a@2D3#(#-jRCU<{h zXceyxlPSd%MI%2Kyc+%DMshrP{9Km(T7rZ|4&hm59Szicc#Bta>|JSY;PT-p=P0Vn zleWv9E)!DuoabJrbIKXZTQ`N_ym6WCl9bXatLfFQ7&*Sh# z3=(kvMMvYp`Faik_E*I7W(r|8=Y%5ajzsVuCuRK4%7<+CS1>ZUz3sV zDi58&*!qR$y`_DM$@;*E#_?FD{>SuMVqm$tY0b`-_Z6S!sDpVHHSd41SHF0Q(kqfK+ss88>yu73!T$f>W!bYVYecVqA916Q$5B~5NOhJ;NEr? z$$k8tpE`Fr3Nr@!O^6AOblXq?QI7_P_|kakael(*INV2t*lKlR`EBy&*?d-s`)0 z&1GMTlx0LsRs0XHDf$CQPRnY>=rLYS{xO}3iYACEWPtrt9fne!17oRGC9Bw^Xk&6@4OmQw+~*NrZskfEmX8hKn>UD`jZR_+f3uN9qJW zR`_VkE2%iMxa{s!9v;X0Orvdjyel6a;++eLAK(d)9Yk^up1>cxIQ&%=J#F19#$jqo zr7pEudmI+Yvq><)kpAMzeuOJGwQCoqE=4$W*qidGkZJ!xcOW(#Jw01R=vr% zsRD)GxQ->xJ9tpoR=|g#8N!UO>S@L(nsNi;7#u+9ub&tZIj^krq5|r4^*RFF zT}i3hBswUzEl>7I#5P)eX!i15l^O)X;+G*5hM$B9W&@v?5gS>F0XTCT=23~$N7=r6 zRDS3+0*6Q2jWDxm%j92ItEI9$;Ub-pq6q8xXn5ijm$z^X#l8LYDPm=No**%R15!0> zzB8v&`-sE3jHkJDCtCQYm_&F*{WdV_zh;KyS0$o%pM9CJi#Y!szFooMgF+1Ow9%G# zSCmMlTryHz&9O0zwau2CRrm}{^37vCU~toDn=F0drA9&GxWc?yH{en5|$3kOTjBTt@$(STa4vaA6SJ=b0XkQ`eAoWt48E7?*01 zja0J>6k&Lru&N$oh?cm?p3w3g4?)r+QD4WcK>zelC0oN_0uEF|ychSP&K+N?rem ztl>0+V&(y83IU1#97!=Ig)AyH*dEGOx|k4X6ag#&TotX01|^O}Xkff6mN-l=W(k;) z#uNrNI=<_@+-dNIL6gm@5tc1;a>;MFgp&3q^Q$(6e=?buba7QQFYZ($BQo9`c#1eR zpKPU1#D2!(Ze&i%^@BxlRg6v&KiOo4d!T<`0GltvDr1EZ-%`Jbxb7(y-%{8Uc>Qql z-P_+yzz1&KLmn0Ia$&083;{3oukxE0d z4RKG}Sb+M$N*v4UUaMxK6)oGa2-hWwmM{UxhrfzqF$_EyLMC#amh0Yh zzA^gfUxAH5xu_hpB*7 zZ%m5ks0+Gm0yE~^xXwEx$g(Q~GYN#(;0%69#m_yU)+N&H4T`zVB;&U=5>g#P*EoAQ z2Mjbtvgu!Yf_*IEpPFb43VJ5l-IuQ+tNzI{SzV#A8bVDiHanh9#?%)Zfv4+MH82Y1 z9kxk|@AF$>1#F>}0LhoR@P9z0?Je%)l2^;xdEtrNAjq_v4%MS)quPxJEw9_!2gj=2| zsXF*5;;LfTRrLx&i`fnQ4;!{c>2)9_W1b>QPP`6)UtUXGRxf}}@6W#Y72QV*xl=BV zpqMmsy%)XW@d>imS6a3lJ7s~@-z(1$z`nIulVn)@-fe)56woI^HC;mvbfYy(bw&^! zVRRv<7prcwK2B;Ab`qFKxd~gNu*kB%GH1evXhq?z0+GvQ;MV2b+mV;5!kP+3jUw70 zMg~DMi?d;T$ZbS;ZS*0*)A+4;Vc}mEG_{+D8R+nEv2r2at=6BE&+P&()#u_5BX`I7 zxkjp0cwvi25IFHX^0f~%g>x)DLI2E~wY=M?>&Bx9Z)Qomb$;v^=-?zcDh|Aggm|r3eOeDWY+3nW5*p}O zp3dK2KRcIQj#CF|9NkURu()8P(gZQ$U(~R%PD*}`+1+8&rpB6Ec<=0ix&ql%rc}E- z0=l5I-`{?$R3jJyr>jb0Jj4b$VYrDn@$+SK#8arNsG3pxX2hanC zKG^RK7f_PCJ#-k&C{Igv_9QPWVe5+FH^*w_$E&eyrzl0R&qbo#96Y0D_A$r{=S9}_ zF5>m?b=$y!*wJ?@?mT^&7A~h8g~r9tAsI#GOoxp$OWU!KlKic$;#uS3c{h%}$PvaU zp@>Hp)`h(N-{F98t-aO@3FD|;@^TNQ`1U{Q9~3E5sNpA4s~1Sh9=I=}n- z)Em{wGG3bpNqAD9#>AgXq>hpt3nW3ZUT-U2>RMIPNvJlTZHTijqvAx!oF6`lqhge4 z@R53kMLo*5Y~8!fVQT_ZtbZ_IQ>-+%(+hKutY{5oeRzV+hkh>#e2nCrm$ST*ytEKk z-9sQ4Zc5{M86QK=RnpFNSbkzO2?${)2_sc zs`YmG!2?sEHRWyr$ii-Nj(CHcCTNGq44xAXC6YQPQF228*Zr22OoS;3V%tk+ z7JI$`*SE&|mYBS)BVpb5tl8hp$|Zu^tI5`hr1TF;Ne-kKlr)aApQ>KmB?U)8L8P$~ za<7H9bzWhT9o-?24>JJ9J&n69e;Nx_t>-4qR|b&!Rck6dA__kaF2$wuEPXAv8GwYU z^tW}HMJ~(kM<|1Lx6tf*07*8Iq7Zud<1jQGM=$zwR+`|zA_jWRdhH{0ThV;Cz!Djd z9iZ7zX%>)lNZtH-@{$|Hd<1|{K6`Af=xMZ?=mkDE&jnv5>Fh91A9KNFn`VArweMUu z@@Z1OJj`AN18F_4(>-nL=r!*CIz@wx2)}d<%%fAYY}s1`sfN0w%LZPpfJRT_!!PNh z54`3TBj?)Pa81Y?S^0)~dEjZ|!DeYi&qrBZ8{Ls)W$3ErhrL0%^GCBFWZY)Ob1s)^ zLD#)(eE8y6IX0Gg^Kl-?4K3&@B&p^BzWl+}fSgIz64UfQUS-N-$o31G8u#o--kIQL z`5LYn{p)4mt7poDjDtpyp}Y5e8;X7W5zN)D&EU6=Q+mSyoKt*|UkYOgcnD6oTs@K8 zOsv;KU$-jqY(4}8M$ylRZyCa}-4^{odu+dGP!}Ny)($Fe25XgIf}5Ok46v5h_)teB z=3;5H>rq0OS)LvY6Hz;tcoN^ynr-lbOR6O$nYRwq`MWuCiOuiagupPsVj&K2KbcGq zSVsfHHHoo&Pqi(Zl>;@OTJjy*r?OnB%ca|akVV6gB>Wc;zy~FiX{X*`nOa1-O>d}0 z)nw(LA!x5Q&KYl^2`?t$m1keUZKJ z<@NJEZ^vE=K#Gony3o-02d6l4iQ!31iGYszo zeo+GRZEfEVVv}Ryh?Y==$LCBSqu=j^L(@hEn zZ4Kms40|fhkI()ackdb1WY@KeK2}5p6hx#(ML+}z0)o`2fQVG-JxK2;y(TIG(xnEZ zL^??CJyDU~q<12{CO{x0A#LY*zwaA+jQwMue`lO=er1fitgL&jIpJt+k}WPCdJ!M5j%X}k%PJ=N$xWRY6W3|{9Yr$^~T zRrS13(y@6@r@zakx~c!T|H=nk06h(K1JeoXjD5J>+KD2f`bok3@VrELBHx+P>y-#{ zl}SvX>DvjTwI`TQ$%M@|$v3urJ>BE2vw0}K0U?F=@EAS0xgV_OBiEv2#XMY_79eT? zM>rXR=r9Y_ug z8+Bx|Y^P^>UI`_YU#GsMwp7dfvLf-kFOE6 z4~NW15ucZ5YhMUvb*=Yo?z?Hxt%#pd+zS)O3RYB#qDG(AYe{F|1z^VY0$B=4{5%FH*#hbMHH6_4NYWmdJ4fm=cY z8F6G@T3K=@oa)7y222-Lh+e-^qQDw?QCcpG=d`Lp$tUh08L-dFtn?OI=h3*{*dDmI za5Tt^;gefC&+Il;iDa(AKqI)h<=3opcOok3-3H z4P0b#?9mErYQf!FoyUzF88E6df$AE2WS|zJ*ptb@2Bq$gFrPccsq!(2ntERX@{Tv@ zcp?Puxvbba=?hXSQFx4qob;V};mSTPSbBgJ;`X$;OW#-8DOeLdGXVCi*b0|*L zfKsY$KX=s^{fxVsB1A8{#;jxw3OD(VILB}(adS}|GfvQHiG!}yR8LOLOCl%qKtEVD zMZC@P)EK$2_i6sspJMlF-VY^5@_ZahW&}o_a_o#m-~N7IE8m|t>O7iP;#TlA-E&;N z)8ey|cXVtr3@7gaBG$_*Rk(?bV7YF+YstlTtAGfC*R5u0Y31;dI&Bcsz+GaY?bjp| zj}$g5y;;G8*7oFpgUxGO2w_UWb-x9O{BQkk-Ulp9&!k=~c=hlu$4!^O2csLPHT3$$ zWvBi<;JOHuOMZI|L z34@t@(7;1!*Zxc|#7%dyb^W`byf$n!@{_wN9(QA((i=lpxNynkaAn+ z#XnOzdZZq^w|hdhzsHRK8pX#e*q=mZY%`}GQ=sCAc5k847v zy=QKd88k%sJP=kZDKNQDrQ=I1_yxtw&5oT{fZE*~-vPHHZpGBRmT>2J)sxS%2ym#J zO)-uUppy+dl$Z!IY4m(vg3EI64WwW|`TLyR+?XP>aW3@cd2%ZY9kF{8pR26}7M`?D;B6lF9b3QyqHx55vZf8JsxiCNz1tu znSCgv{96|BOSyrB+5e^>9-ankto)z6#Fd2UlH!*Hr$_L}!T~Ix;!A#kjJw0b-P)!(?GD>rA_!okp5*$1rcYaQ39E`5ovFS;mdf5DZo0w04%Kq&hj7KXI)=)+J5986Cn(?^f>f!6hH{Ya zsIvi&LW7mu9DIw94v0HdRPfi>C~NW=ZP&8Ox|1JoPfU@|*tbr*>Z(Ush_~4uFt$>( zCEgtmc@Br;y7o)skREzYz`I{OKyK|(>zuz@U8~rKWp{mscmL7+J|2?{2_;2b8IjMV ztQOBKUv{&ab2a?Bl?tNf{4RoWd$bCW@;Gjq&$n(GNT*z(NzaDtzAx1Ol@}xSwSuJ1 zwu@9a_(RVUWyvS7LW4MkSAmnp^`K~=Z1eXgmSK$OpY4adQ?K~^%n8FEQOgp$4gZFa z?JV^PaKbHIGI_>blE*xFuF!)6iN%571`Jo+<*MyUmK18D8 zN_>`Hz6wS61saO%vHNZ2%544FD%tm~79@DeIcozJkl{=5l?jKK?2~_?;O8v)dEVWV zPU*NjZMUA<2?rLsemwlP|1`(WWs+7#1wie1dcNha0xLKb*Q#x+l}IuLi@8_ZbdH1t&cbxRdG;2*cX03_nkq&FYX$&7GyROgey3H(}_x%IHpQ`JQPtKw5m^ z$PuL8rABeiZyq03A*t}-PDjEx1j?$WMD{v1`QG#iz`lK{SE%IV>akc;4HiA2?}K0oEiHY)!;PkCX6^0rpR7dhP`28xQ%nj57%GPTA;wymI4=({ca6S$8Gj z^_MvTS(JdF87DT)dblXt=f1DaM!0DcFPzQBV9ZC!Z(8?)E0o^PQy6>R=np-V(csko zdJAgKz?HG2NS3zhG5xSc^Erm2;Ltmhe93{gfY~f>7H4N~^?EH)ec@la5J;zQkJvPJ z&x@kZ!+e&xmOWx;uh|UM@2%O&eMlV*-@yGEtI)A(yc0o?mM^d|~=>KRZo zZwcOeuH65M6n2qeRu}AAmWSK)hLA{aH)N5UYyK=q_UQ}wM?9cK+x@4>q~jH@g>$xN z8#{g`p3;th9k-Z&gnBP1W6bOkCAu@nmB{&U{+d3&var)WEg4(M300@Klgz(&Zl>+t zEB)lV>C~1eRCkEw#(sX&ELi^{*vNR#(5vguTf!r$9GL)AlsybRXOJQ`fd8#gp>y!u zMX~*hT%WxCQec{{8ttMTXMA>!;KAWzd8PhzKItX9bF<}~jPx+Rfr+Q`4!`@G-a8Bt zmVQf#fVfZ^ty2JIJrdy^s2>Q;rKt20l}y<)yA(2LyE6 z68rLe)KGViNmuvjg>BX7`&zG~zuldgitxQ)dEM^yjSC;{MZe0E5}0`^XTo~z(LOE9 zdqdXS0TaqbIDd3~^Et+OWN<;&e`7FobJ(BZi8ROdQ->Q&e3M_SpKt6AymXh<5KIDm zzGr5-KGNy(%DJ8`eVa?`n-|xGwXbU{f@9Gq7Bq{%pS_8@RjIExoB5?OTd8T4a*_8O zqN0P1h;&S;WfOHztKnh$ihzk?=#0Fsfahb?u9iGYveN#-{u|$c&ZNa1sFd`JUouaY z=b|v15~De_fviTB1F!aJk$|dsk0Uw5VA45TZkrD)eA;cs)AStNwC^I96Q27t?d03c z&}!)!YMO(U5t9X*%K|^MJ7{&)U-gar6#<#`9kea}b`L*OLhgIRC%~XSkvnrQ3`aU0 z>`#BiX#cq!GYJvve~~!Sl@RgvPE}Xtqb)%wf?z_V5pCht20=*ul?)$drK3sLuz=)@+4gwrGFMw@bO{HXaoTy^ro|~_)V(3pl>2=1lXfOim}V<*o~Ln zIlx>1ewkc((mt1uS+APAT=o+(rMQ>NvU@WNnzn)41fixB_b&h^QWKK?GP+hqsZ(%| zW)Faiq5GkpamdJJ;FI6eRe_TOZOTi+W%28`X4m)y=LD!b52_?9{PmHfvs&9;Xt zj6_WMRo!+@eJCmT9|c<3C%v}==!M}KCZeH{9Tdf)eHhW3!UW54Ts z7Wfg|^myfiU3cgH;+H%WRl8e7UMXf$(ZI@L5M=CKn;OJ$Q{)4ZIOORszuy>H=>rxvl>qTq+OR|(GzqXI*MPTTZvRKw(Pd{r+;bhdw@!ib> ze?Y_}B7LwdzQT%jQ4>NgX+wq91f2>s2AN5xr7#IL0NSzkTS5s<5?|1|n^w(nanMp?$b`fe9w){&^pTRTwDi7 zv5&Uq@fJdEyCW=8UR&DMqa)bSV?EP9&adFbKbYX5{U>ABSBp-PD<<`AMBvDRBz{f3 zT=-V=tS_KPQ5Jj2Z7nXskDf8@Pow@8GCTZnNCn|IxqYC&9p*DVBN$cOuqBaJM}NbM zk8_xS@17>kqqLySEx{Y!8}~Qfw*P2iN0$l(KMLSHKoBp2+r_)&^?o4`#WZ^mdPzElG7hKC@P_=E z_sxQy)=5to0FQ?8_JLUQDf_^?W*})ye!=IaiK_9Nx_I zSL1=CKa)Z|@HU}Km8o|P=K}(sm$>BN?e-L~D-EJ&tP+Jnw|{%cSyfh+gbZo2+6mUQ zkVUFmFT0b8W>ZVpyU;fGHgk`bhRl{F$=u8>t0?ukPG*Q>BEw1HRu1Xo!`8BzF|#?i z+l0J%x0Ztc;-(V*ne)tf^5Xs^0l#C6JiA&%X3w#DSrr1kBfy4s++ar^CKX;(<+VcS}g;DX5gEc;wBN5HMv(mqBo@fw1z? zXn|VL*oKKeJc{+)Asi(GhQ|reiP8Oir4tnV&w?8+V3tKGGR}ZS=|(8~ND}^+s1$#C%Ey} z{3ZW#s$q7?dVfJh@7*j*yYj{5xbKfNT$D@6JJNFT>#h!8?@bub-Yzy!91BzF;%%c< zgakAY0os?`)n;$wxvcb#Z@(U$gP$C3vEpsxp|j{SC2n67ExZ1`Oh%D`BU?_AJW1`u z1<83-o(6|&deV?CZfo-41I!0BSXyETWuk*}gzZ-i;K#>hreXc~Nkfhr?2xbZvH9MK zB7TL0{wfWHE@Er<8(pnxUq3ifTdMuA!%B>3!-`aqJ-sCjbl2gBnjvt?c7EOMfsGQs zPb}iXuC-ZVgZkoK#BO0!vDD2%oAv%g_msDX0uN54SHL*zY ztUn5_B)wT3TJF?4btoY~)^IXK`;Q|u6Vl>j$MG_c0SynwnOF*Awcxb8FQM8m`GzZ?-}m*&Jlb#Rk<2?gY%&VC75HA93E2bnfhG(OlO z3X(Je)5HB*8ljyszV_n-NUDG*!NvLW#{xHPQa7*P*nYxF-32KZ)}m`Js9V{xbM954 z6M{mAEh$aomBG!-WyO=Id8D(@H1Fr3uHOK21eK{sIimJw=>&KVRjlNlXPXa~?!MTe zhuHu^!sn6ix@E>22LCWE{Qj|fgE}=&-NTc38F&T1`^@-j6>1WTXiPFQ8?i}g+xF)k zHRNl`mI!s-^ErJ%930K`Ur@cS6Flrz(P>mQ-}tf)%{?wNw+siba-#>)(iW&eT(vA$ zr7~g_F+I=x=LA^m9^q1`PO_oVeqJD7Y`d9TTsJ~Q5Lt+;IvtDE1AM`*l*7Oa)94mF zWQT?(RCwGtJn`o%-v-C*I#BFv)k;CDXK)2Mxsnc1ew*2Mp4?BdlunAfRT$s+u51}` zikx}MMuo?FT1Z|nsxQ-)?vClH8}%=spdX_2wHd}mDf*``WcPY@W#*jEh^GS8KXsfz zxxw}WkskBB^;A6sVL2Jz=*Ow|idAuqwE8g-Yj69KFW$GvaXS_KyzX9>Tf~FI*OlA( z0NM>njfv_^TV>;xv^bipBz`u-F{jXZjeFh^LK6MURK}S4*mU@(-ph$(m$?=Cl>76= zLh^an2Lyji+vCrk(t$TXUdd`Z>ZTFLY}-`}Su%6k{t=~VaoU|5fFy+68VA}FG*{h@H!E@5x+Gc3}1YiapyUzni8L1H{4xR`nQXQ?75icB_8@yxfJE3gVvF* zJ62{hc_7Q}XcQ%!L{s`KJdqr9`r9JRv%ZcRp#IIQ=VOKpjo~yd*g1hi%pyHmr1y)L zbo_>BBEP`%tqt>b&CrJJD^>;DNWcElQ;J(l4xD`6-Z1I_Yq%?bz5+~63_G(XN^5>r zKf|KADp+^>f+oxS)yL3$#s3U|<_8#Hj=E0m^FLBGe?F?C-2}OdekI-Z5S<1ufVnR6 zlJr#Cj)qg#%L=5=^~yd+!llV6?a0t6e|D{TH`G01W1?-9NY zDjfH2*3HS5R|MWuqJ*?7cwn{_``^6!a{(y3=b`#fD>L zq-X@1`(4$111{iIAj~g>?7FxCCoXXKu-t38Ig5Nz$pG&wm3*i%di9~PER5(F#Z$_$ z7i*fg80dJ3`Co(LU44TUS1>57U-xg1ukqgK|0=p^EqrfBJww0fzeHW`e#-wylti)S z5G#6EUfDb;>20Kx{-=YV|6lK5Vn2Qs*lzbOajEA2VJHYU;aU)2V${A=t_Rz)L{yH9 z%KG_c%~tQ{i@p-FeA2S1eZiUUH-9Uj2S)_|x`!ET$UN?c_4%N#v9s;aROlVD*f%xno|}c(kBrMq(%ck{SnOWW<^gbHh&FzkTe%%Eu{p+$E4o)D3_JsV=sy$OtFe+Ch zil5QI2uWLq9BEtaeVEBI#2ltMOPGCY<$N&qiWE$eAB(w%{Cj_EV4XtFN%@8U6f1gFp85V}bF#Wb$xt}8RBflO#Q&1#mAph(I9R%_g z2o`!@pD@f5g?t#dY{#0-wvIea)vVuKC9pszDz7_($z#UOyj_kU=FHrcWX7F&*c*D~ z03Y6{tb@daU_Mkd8#-MyrTu_|&8kBYmos?FJu>)Lrxj$7$Gyw%YS`~{>LNgk-?X%6 z55Bad!bXplb!oPGXfBsfBvy)Xk32FQiV9>+W046ctX}u zLbJsTbbFw?%}Zx3$miV9r#lAHvDrj}z;}{t+}Az#*MW!?m=!Gna?EDZzPQHdajyfI$nLBAo20f9aUWfF%Ltgo8GctTDmsn!s1=*e1Z&nR2!pLO=Oix+9ery*w;ue# zDyravTjnzx2{wVQ?V}_za^x6+riwGiKc!54I@U^#ChaA!$EGWH6 ze%w7J^E55ac{AXqrZ6sGBvGx*QhcuQ!utDBr{%nub}{NlGx{r+Yw3r^X(v^bHSKz+ z@E9hlp|q^B)y#nSQZ)edj6@!zWu@%3kjpBm*=azumw&8#*P%=!D6ptHK+d*)+}s~P zId%j|f;v612W0P@5Kl%<&XfH$60iWbWBo1qO|dV^j5i`*{hh zq(LGPfntu#R*(?t-^W*8N_VG8Ti3({7O$l`ZI{p$4U=FCI=EBDKX>W~!mAE_5w<0k z-s5K`%n#s0Xx*fJ;-&oQo*4RrR#2Vk{*lVtY8-lk6}T{o)Tp!qA{_G$?hx)hd@aSP z0+8~r;ttV#SS;sHL5hi;5H$Z?7s|JP?GZ831Il659^kXA8ndmHU#3giwfkskTyLwV zsGX%>)hfjaOvWO(ERA!_&5F!F8g5I!gA2{X96KlFun}9ML!(onMqhO|Ked&+a4ZSU z4HSK2ZPP&(+g000h;x3tEA>6=!RDzh^9sa;`snATr{Hy+gZwbKVg|yAb^3#oP#Fi7!5%MJlv^t*Xg8T*~_b zR;&c6&72>S?UWF%adJ0uWsv8_edsyzHSiS{yu~PA@-^YI1XJ387%ALA*8*4WXL}{P%6DBA1S2`t;6y6bM zX9baj3ju&j(Z#PO?>&NX6gd70&F49;0K__!Fy)+VU_>$HdU zCiq=A%oF(7VQa@VJ6-#!Ivtjl?$kqpv3E7*DQ?~cHBNWO+?qm_l&iG=c{Van?lPm{ zauAT5Td#L(N8Ot!U4jMopc4Yx^}ArsA2Obc4>jv|2g)<(d_iTKK#@5C_YmS?%QcpR z&4VypG13DTa3FI6HPsTC{!0g2$(fc4wF-gOIjseIFH~a^hj$_86MgGWB~8r?+NSNgi$eM*skvT9^9?6{ z_5n`_#e8DaXl7vTGgeYM@>s<93u&e=nJ4j0I zBAc%$l%;ZFXoC+@OVJUWLks+kO+5bjE)tRciB?z{s2Ys;mX8t|VK*_o3i=&(Y0QZq z?w-Mx88<2I(f^q5BS)rJZ}Z*h+)y?jPqM(D=$)$M)>6tO8@gp;P+j))BilM+jlGI9 zn07&^XVT=u$SFxh{&?_^9GLE;vkv~u@#FBeV1E8&K$o5M+4Se&v;u?f*rQE>~Nxg8}i}IGA`zWD0O30r%5O-L{3lt;NPUCW9*g4=wKo+G(z-c#goPsI&)% z75;%me_+?QsRQYp37HUDu!6r$Zsg4Cgn$s{5#lkjtJ3NWGc6|mP)tzpuQECHPxyXye7AK-IXNcDpeh2dd~jb;#q3t{7x#>^ zcP`r*VR=NPUq=7&we4&7=Ov6+C;olx2#T)VfCjvO_{pbNeKxIyt2ix3_CEFJJnC0W zbslfo+-?}(-3s(wx)i!({rgwVnH1E!F>?@mXPxS)<`^v{yiL3I zR9SrTVH$(ba*LOh(C%ZX>0*x1j`z}^ir-jdm`>MQ_BQRt0Tp>cl4uAc2uQK9V9@Oio5d8-Cl)or7MBd^P*Z zGUMr&NQ~Q;RINIhpd6*!11u&XN2WqfCfk_@#j^zMotH+bq1a@hrH43rGzt4Y2gKVs zCL&ivt*zDC5lBXKC6>vyV*A_glD0>39@Am5-d9RAbpg~ReqVbeS)5Bjj|fn}be<}! z_J^!y`c0&|Oj`s~w!XSnaxVwZe2F-aka83Mo5bi=KK2^>{IYakzW+bJsh-J?{5&rNAH3P`%P9CX-+rhCp$)L3 zjpnYa@#atWoen&vJ<+W9wo%9SM1-|^Y4;_hPvMKnYo5VR{bof= z8r<8(wguF~@ke0dSIzo)@T_I&dMA{!--PKeji+wf}*E;#ci+|DMkBq3e z=_C4&(wpZbt~!kW`*J5()QPDgjr(qvvLG;cG7UmwflM#wgQ?i*eAmj3o1s*}dzXHs zWPQCt-?<`-Gym2ZIzl!@3)-}4i_x13Q(&v_LvxoX=kdxb$tTGNc?U(Ak391B-9FcB zv%$qkee&zc%rAx9kHUI#Lv!B>)5`ZDBN$0HJx8LC=DYjx#%3m(C0Y%8>S=M+AF6Ro z_3unam6*TN*R7lM0vY}$PzT?M8i`RczuyCNWuz|#)taZE8U zs!*l}0(6f(KVZcC5lyr>E=+X$R2{-^$fzl#DCiA~S zzoUP-@2TjT3ewj%f40#ZKPlEJ?|Caz=v9u2ZstkJT3uv-E^=+M@UdS9io zD2g$XI<(aV41Qdxwj=9(4{iHnNVv?zTp#zCk&E%^D!HoqUo+T#8iDBknQ^8h70IJB zS!Cv?bHWrF7bba5_lV}DV3_GLt2irj{Fr(8>eC_Gz@dTrcYC}Y>d*9(CzAg>rU85O z8%om_lmFY6N==fX%K{Rkh?&ZoN|lGfTL0bn*1jc;G2>Fx{`P9@qODKWErs#{|Ur44DY?E+}!c1;ojg(ecF23k-o=Q9H7o(A7xleuPBdklQ zdK^679D_11hD#wCOwr|((gJM4y^Zh(ll?`V1{k z>#jV8`)to#di%O*a<_5UqXTVZFflj2LkE0N4ihw5K{3Myi)ToCi|%zpMwpzo@6>eN zJ#Be3t#y(X*nnBshXl7!k#y{9tK-PrE%zZzj2kNA<@*66ZJ_#TLT^II+RkE2ZHtRs zwGC4KxVp2jEl+!0@wiC{miAxhCZN&UwAZc{$#_|-jI)rO;)GzEX~zg{TYb-yXXoxg*K8u* zYYb*=VS-U4XCf4V9@&wM0s($*6nSq9CJE;Dcm(f_hpzh2!Pf0s)rW%gFh|Yw63MqX z%P&aA@g!nVP3K2<=98s&2X_`ZkUn1c!D3K@{GmQv7fR;ItU~;gS>4|;p(T?{17QC$ zyjg7%*j9>b?KqjaklE2Ox;g--d6_p|m;RVceMSS>;M9C%mfq&431o&_1yh*%ksF3p zTg;HnGyMbVGII+ol=HYu1~`ZZ0b_E-eSABm6$Zk->&VgY9sm1=rlB;3GNC#bL)f{w zy_8uCo>4t#s1FzMBZ`2Q_*Ti0C+wNIRFMGohUQFqneXt%_Pvw&4l4MR9JQ!VhepD{ z5LG;x17T7#=0K+y%FUSxdlq_9@|X&yM-(md(fi6hg+scD9d28MI7vh})2v3FE?>!kio5XVk3OehWY?q66MH zzRv{W-DpkdNq7EC^4UB&hi@DMH=o;o`%!l$`#6<`J^}sBUQ`C0e!)Z@A**g5p+C$~ zZ&K`Xc7_R4{;k>mvuxZ$i)C$2qZc%nmdDR6X2rpaDVCW0W9OE&`IO#6m9&Ldo52_qx1KGY1CZZiT3tsy-crW+0OY?6{wM{C>!Qo& z!WvrSz`kF=z%Z{Mq&-CV$JZJhP^4Ne@@g#8ic1ip>r(6XYDP&De|b2p_@HABQ! z_avO~4i6?}#%kOrkn2d?-Da;vuZ=K{ES9%nWsnWjFFQcz26aOmZMX?Bs<<(lFcmbp z4kT}@&b$oN=uoJ7f^CzT>ruT@li}f|V~MyIKxvfsIobgJk-#|=Vexam(-xPvT1ct%j754`|61vmE4V}FT_xyF4-zvzL z#P@zE|K|vZfm`gZmCM(ZLsER|P<~CKL?wRnmd^2?%v7GNw-*>WZ*kxFXN5F8(@thL z+vvb3R*<&CuTg@ATO4Qi#wD;#&cC_WT%YqbJG}nMI z<-9Jftry9_&WPkkR1Ge2mw6;dX$J{N@hs-`-}0LcRFj5lW7aQvOOImXWwCGFtVtm$ z{1;3qn?S;wNZ6hkRUJ&Wkg*L~a5Djx8YARQs`Rx#a`VxUke%%r1wZgZ@Xld#57iZ4 zF^Yonq>FtJ> zX#iQwxy2XULq)Qim*!zeEc?Wf^<>llCMMv4ZQ}8}K3!=J-sCHDfuKHI_P$4MsXfe6wj@)ka$gywnifPOUk|pHtxi<4JR(6~K z4+Q7P*ZW|Z2M%ZMdo1ff=iG&Bu5hnmiM!X!K<%XD*u&3`rwSJrASBGJdyLj-APs~M z2l_H}?7qd*=%)IuTMiY5VF|FRgG~79WXRT$=opU9u~R97>6vfWr2bvbCf|~DUQ8H! zCP({EQkr(1)@5i-C)20k7|`kc+qT!wp6!9(gf5?XVrL%*iVR!qsP#WYYo@BP?DSemTqicfh`?N2T|a z+oJ&ecd{zP*}wPMzPQ5C-SCq#dMsleLU?wS%CH$~45+Qh%@|LRJ!!^#N`P1heHXI| z_^{44Y|>Y{jr5P#^6OKsYfzSYM7Ex>Ta{fLmhUJu-=#Znaldmz91OpIykTOaj-PX+ zVN&#wqZA~R2*d2v4Sx&zVq<8B&th6%Ker#B#c8bpgWgXb$A8eg;6g&QC*|X_v<7@nPW5n6UdAV}JZxs@M>(MZAcxELi!T{z& z44>87`V4qN{e+Q(6BQumDK(iU5%hu$_+P(=%dCi4%(ruR;8^rQ=M~5V`m_2e3Khau z3xn5eWU487HDEdcr`9sOAZ)wEjYg7^=Q!*hkWjVh*Mr!9`S=Z63&yoLYicMXCd#iM z@tnxOqtakK{GOv?9qCv|DNioMxPE?56*w-z44wYTOI>JgTY(|}tLhN%j< z78&;!Llc^OIV^)}EOovwASv@~k7-)8T~)bv4LDb;Mf%2oM0^az-8fDTeRRk`{&+N_ zlm2d+mqcA{U48WKo>FVTb-}d=<`kNvrkQo8sXH_Qy0F^n30b|NI!3$uH+XAt))5|K z5~rRkslCs4bW8KHVb9MY;`e3nDl#{0mhZZejFwqqZdblN(WPW;H$2u7|Jz!vQO z8gT?_)ij_j?>7P+y=m6O79R|4I(*?R1y?-zrAX}N{NXnDF9PkcP)KkqX>MAlOEDun z7<*>&jlDZvpRy+u8SrcR+c_m?grXQow{x<>u!Y(_-%>#CTq{2XxqapLKL=D#u}${t zmxIPjDx|J0EeG!{LP&ra3fpPU0*kEn&$ZDd(%!t{-w!N15Nzj>f&WI+$n&-ZUbez< ztcr905jPF5mF@Pc$rop~&IO#vhpUShxjnv9QMNEkdaRML%BOdrGTVPXzwNIY z$BMu_SfAG!-8#!%iRz%BNqz~d1Bq_^lh277o|e&3-878$2hT&}hrC8|yNXG{zO$;J z7Z0|dJ?Wl6#SVbLQ7}etnLxg$Y>UBvbgK1QI~`%7BR6Qw3f3r(-G^X(_T(#y>_7=r zVDFn#FL7|}>~siuwH4N37vm9$Mpcuq9Lr7e{nD%)2fJH1h0;ej}Y^UbVi6P zTS_FiSbyx<_Y`ouP@sfkBQ%QUNCj9~DV{uXSr<-2UIIR0QCeGE6adiz{pTO16J9uA z^BkPWwn4dsPlo=-k9u6>f8&=r$n;HH#r&H#_dwxSo+`)%hQqZzZ?~)(ELwpn`FEzr zCkS>*#@|)(`l^G=Wxb2k%f<6S^JpI)8(w=GOvk=bfjl-8@Z&sYa*m*Di$0dr!LXXGpF!28A;95QS^Nx<}UJ2Yrw$%-v=4ii=7}EBf zMa<(WStfa`Q2tpBM>2p|EnX*gwMZ5pul(F{;D4RyGt~$_& z|LBgKoFK^!@;j8Cohu8wm318RdMiu8doGlFsa3#09a+T%5i8i}43)V{G0~BqZ`uVk z%QtcX`KiAf#0g#UCgd)@R)c;R)E%uWsgJY-f5ZG= zUQOXxzH*cNjlNQ@6UQ!-xN?B-dgdHp@;HQ64D#{(HLwJD!;`G6EAawTGcUFXPa|Is zJwnPyDZ?z%!D0`t6;p5NTv@q?rQ7?sgV@6j3~D_C#LGe6>REiofGm@t_FhmYCvivx zqY>WU!Ebe~Go}lKkM1&YrhdPDLHdVKj|6b+i$>{XJ?nEJUZV6HEh+!syK&YsVAh8B z*soZ66X z-MW<*gJYPM3wU?XJ83k~Q~_O077TJ}kLIMTV8Pa^q=7r}tqImxf6T(HNg>1%PsjBC zE;!C_YnZaSQZ`d`A>q7C;U1KdiSj`by4FuSJ-Uy5p8--tqpn&cnHd0Lhvin+9kj#% zD1NjRK0?OV%a_6CE|jiLT(d9MERB_vcE>Ft#1&>Ze0%B##oRx;0nGq?a5uRP5t8u< zL5>Fd#aw6Mi!}^zz0IdU1=EX?iGX_)48(CscUW9;p3i8lmy&H|Y{T*T)1;B(yz510 zU`}Tz6XZhTo`weFCXM}}*TOx5a0So_@6nN-2o|1-WV zA$!30eW`G3ReXLcole*;iQl|awd=Po>NCfu8F+3Ru?XbjT7LNQ_esy}TGMKlsRuFl z(~ph%N*>)(t^dp`z64tVxA*|T4q%?qVXHwCTqc&WkdNxmJlioh#7n7I2}{9vK+EaQ zVyli7N5C0V*J7cUU95qL1GYcpzKuzJXL;e6eOOytlnMxaeQH&3X7|0z0|IRtNqxAo z1Z*X(a(W6{?I|6cNheG?z<}vI+v!{`zI!(k)fK<##q5NQnmR6I=CzzT)IROop|uC$ z*JuQmV>a~t(rZasX(GhQ%y|OeQn0!xJW&1y;$*e8=xS;%>Cr zeHdy!G|q7Zs+G6V$rBHgHmeA(9X(qbBgp9^V^hvo=Tdofh2{}6r9&P!K-snAN!5EeG8dydYS+Ey05h5 zk_}qz$mZ1YLs4=1{297J58j^&Jn1oY#9XI%jta!!;6v_W_6KBtq!2R_EB<%ujQ}GjZcz`2Ex!K zw-D{Sh7&vdRabR6NlAVQxMB1&_b*Au{Oi{P z^UR1tv`V5pK0W=w*K@=!hNQ-le#4}uWU(q03#S9To)jdGhAgDJ7b6G-6ua8Rf+|nw<;>I7f_nSa1swO-zACL5zOpfH$OrgThDRc%~)u?>y zxS%s?nL>!p*y4-h{W@9}9UPQBtA46qs-*wS=Jl=8pHj3cE-EZ_3mC9GP%i_vx3q@1&;JAf%HanS31s5m2kYR4_uKS3~&*DNR_4!Ur!|)DFdIh zfU;P>%C;oDLvMjf_tur`&tx$efY5cc^+7_Q(ru?(4?ik3et*AXB1__qA?*I!(%eKk*znS{^|;)yd#KMroTGDb^N zn+}n2v?+ef&L&{-D!b`Gw4ba|3snf^)D&$xNnU;?)HhoG?bgpSH|w1XzUO_;ru}n1 z!*A&7S4PUtzJ#usRHD|Dt+timU)xul@%LbC@zM1Sf+=Ao$U-t7UWkQGhCx`7#e?Izvqqv_-UNz0CVaI^Z$DHls_xE z1zo6>Ce>x(ZgxF?v&W*2!7(7iV3+?I;+PWFaI5yuFQAn}hpIz2)On{NP&|3|UuAtr zz42P$atD<)j?Y-(PkQRz(p4h}`H&s$oY!H}XEYIKSej#e`Krjvudz4OY4JF?N$U+Z zv>b;A+y7$ktD~yizIIiRMkJ&=43KURHcBJiAtBu*U0b>YBvraQq(Nc>(nv{fM3ha# z2I<;yUp(i0zw>?Lj(f+wW8C=eJ^wJ+@4Nb4Ypyw;`OLM3-3i^*1rKq(zY+KrMaI_G z_uY((EN>J@r@w)mCOEwy7UxVav6w3NtZ7*LR5y|%?0`|lbk)*s`96aB`AiXtW+o#~ z>BQAXPWFyn+mej(jjeOv#4@iNvQu3*qPhW^02E?~NPJBU3z5wV*jr$iWwU=aLr9rl{>PivE124g$xilD z2(G~-S4ER2lqPw&NlAv5V_#V_l?jTKmtUg7^l4K=-CdtczdF9mPO&B@&H$@Qxds0Q z>5R!8NlsYuu~sSKqW&XQxp9%UVGR{?=|u*!Bqji-@98sbGKp#FGr@MbWj8O!oYjh|T;o1?UKPiq{=2~j5P zL<5GNPxYJL;R~Luc}6Vj z`AAZVe=gfn_j{H-zJvR%?0e>G8$&@Q&3VFzOqsXSe0gIHUt~W1?(N(=>Xo;6S zWG~>WBveUAff5Y0SRaK^KXU53Qr$+ht+X+GVkzS|5eJ(njy!5QrT zt%5Iy9l)_%MwLh7byVBsB51){%$)ei)5k7G9zwJxk^RmQ$}J-|4O}8V+NCzzi`v=u z3+P!Shkq<-wYwe1lQ^#Edr+vl#-df!wY`}ANFCL_Kr$%5gDo2wNR7$TxgYVS)gN3pika-tf}wFEGn?zz{^CP9@Q#o~F?V?nhglNy{TnHv4% zJQo=f6JYHcA|9m&H{ppII4C;Z7owA=EbYsgpV}-X2j}Zm4owI%<8sT#g1o&EiE0B1 zR8yX^;)tq&au`^-VL1k>-!~lXKAFd|joHpfLcprM49(qmi_jwOp7Ko6r)eg`DncyW zsM5+qT)YxeK7rX-6t34Xl^bug+=J_+;`7ekwI^PUy2HEguF<^kxmAJT*gJ*uYxCi# z(wB)Ue#EP`C}B`xOTHvKZR!_Bi)pHlx2hGmLug0Q>yhhV zCjzKkOhnQ*3_iK6n;bu4j+qC6FrbUPM$rG^H!ouvAmQ&G&xX%W$Bgkb(WHx!+m?SAy~CULy{q?+tRD3u|#edFCn1S0;fd{^2J!B5j| z-@O!_>)vLkULer9^K-2no9O;M7~{httlCSW)g%PyeyA==WG;py1N|!09?pH$(>jY5 zs0PHx3irxq*C;8N`sdunI8YSZ=j`CTI1s&EWY+Zc&bldaEo_O>yUl2wAizFUL1^*O z^LH0`X@ysZfbKPJaQm6@1T<`nmz^S7aX6q>Tps;UwU6S>F>z?p=PrE!zb3-H5ZjcL zr#s%jyUaz>61tSu;gB?K(r40OqhdoXy75>!$)z#Dqd;5V<6eLgVd6Vx(dsvc8$YLb zy$12IDnGw_Zpr3a^=gCrBVH?4H$Jmq+O+$aYve?33?pXRyk;sZyCSZaJyyCR$19Rh z!H>OZ<*XWtN*}fOCzK68BvV!fvo&e6MJs8BWTgjNe;v;3H6wgnTg0xYokX%bO(2l0 zyUvQ`U>41(qnMwRVpd|E`=NpF0k1yBbH_3zlGH*>aY2mH!c@`dZfbq==Q>HHtZegT zRJQl4z9Q)_<;HUEh9Pm}(akJ7_~xYfVT0{G`6{@YZyot1s} zB9FA_q{L#l0hr9w{P!(@Wnp&`ZJ>ks?`F8cR+5o(vYiXs<4wR%S?fstC=TcmwabuN zN#e=)g+L>DUOsCIf#oe@5wptGJe|yl?Su|_8Aj(&Wv8HMDx1Wz4 zUsGE?`RGz6Xy6r3uqD;1P4%yzkML=7v8af4|Exz$olEC$KZkq%srIii|Nm%^-BDZb z8)v7tEYbvJI0>~*i36Wk4b{D}RJdCB)XxYD4#c-^J)wcW*H|C+%n)jx`Ic0#8aASQ z#P`~9y>+MfX%jm5hOSM%6|>3Be2os3(nSM-5FN6x#GpC}o8_nl>a-3*(sJT z5o#;sac%PluU6VCk2gA4BCn#UU$8e?kJvP`!!)tTE}{(afLj+n>+7UCzKu8x6Qy(3 z>1RuST1Lt)&jGn$a01k)eY`5Pfu&jD!y-+GrU0)BJ}xV%SkN!onAYvoYs^d*WOpF! zjlV@AGQ9aTdYb2Cp=!8=%xoGrwcrFYi=H4iL?2a8WP=~`@o1)KmI)e3w&_s4AV%{726a_-9oTc(N&u_|Q0au*?x-PcUPv>}09aVWlBh}6m z$!1a43Z<(Iz|zmiGhYb^b7|caXgTFjZFmJW&M>U>a(~SUrbrPBTh>=RlkIHdOY|sc z;CtcP*~&hg{??^lIqz^|v>({oHGH!Q`HD$6A(MB=u?YxdlytTpl$Fdecq!J%502NF zNn##v@q`$DrClD55P}3*%Y4?y+gTH+C(? zBvO#6d!ZRg@*^hc(HAZetq^QhW&^G=X>P%7qW`=N|W|27I}#vQhQn(@zQ{Ey5H;(8zgKGHd&{8b5uLZPkr?`iey zKTfOLX68ej`jhd}+xIKRteB1UO4XF7L_HVZYFCcrHqUI5nt$G{zxvESA?h{tAgf*H z<2Tuxck&@Bk(J@GCg;}%KcR4!OxuflUJf%DT6--&qHzH*X$;}pqF?1(R}-~*$q}hl z3C@B}h{nz18}D)$R4PJi4Y^Ge0xXLJ2ILa2s=$fdPA>N^s*wC|K$ z{{&E`&&DN`4kU#WRr#<4U@+WX0te|2Kjyd3HX1Bf2WQzbR3^>o%oQ3n@^;NDxzISk z#dk=gc!@a)Z@ij%w!)Nr#HUyjPfG4(dYfBnP^%2#TW_-^I8-$BQn1NzF!sg=+l`aD z(dVh2&e>QhRBAC%F}wj?qC0Pjqcu4gf+ELf9!&B|>~qagPTT}IexvALQpa)tREBIs z&8;N#hfz{KlM(c4?SFko#3oDQMapkD2f9HpfMk^jK;n#WUn$Rba%e!}3P3Uu!Nz z@8U4ds{^Ip8DOKh6LGnrHZVA2Xnc915>HSlSK&DPn(vGca`RQ!tSHvh4Wj}b`iG3= z%**3nD@O)awFM2=f_pXYU1XAq)^jmPKSric4qHtIYuxk27O|LJv!KnqRFva*CyOno zvr6~ljlsJFH&+gZ>ZlGKq|lG{(wKl#*54T&9l(vv+Vrj_+Om@VNtr-8rlt$XY1%Nx zSZw*Ajam}_&LMBF5PI&rrf-)oP~onkyS1@o#QZuMYQ#y{=JG~;a>Pdau>3gM%Jnvi zVQ9nhI5nn77<-6HKP!`*K6xjkud+2yM)&sPB<=^xC2|0-4>rZyLe@&%2K)8ekt`PY zIA74;ZXb<4)X_@eV-EYgO+pr26gRD0ME2uhD7_K|Sq$Af`%II=qPT`sh7R-ZQ5);% zS=6~7&xz;0*jO(XMo^}SSwo`XS4}=T&QbIzT8OLpv?Q=cJeI%q^J|6@3QDKKw1yOA z`R6;=crS{=FRFg5_s+k|cKsaii)}KEiIIvEoV)o2Ps-UVJ|FUE_|spO7b&u%yvy@r zVC%LVO&J>}+tlROYd>0rAKIuCaOK6Fezz{I=tt1phq}lz$V;a!|N6Sf`=N5#bZ%iC z#abt|%J_uk$6ZV2WnR6x8#qEQ^MZMJ357C3BTariV;v~dLOpSeD3>n3 z7_d!~ISXB1XAA9lpBa4I#AkZr37(mP-WD!VgG|Grla$gO_DqbY&L&4-2e2(3^-ep( zJwgD^_m1S>D@%Vwd<`Flx@E={+S1+y{Gr##{o;A7`b57emSUc4E`fPbf+C42GxU71 ze_06Cw2_easQ_jrSKaJXgt!duzetaEtN-aaOi&!-gjRyUA#a z{?t5Ot#~%Acgbn#FYMR(yhzr#JJ!ZoJ{&h0m%I&6RUpS#ks-%ay!*Q^V?|5O)pY%d}AlgZj!lejP1d+N#w7=`Td@f4AWV;x#pK zP1?6*)5PQ?d>Wtb>rb8#Rl9RL+YOG)yWSDv!0>GXT>PZb`q+3t zF{TdgatSwO?To4F0|eP>tyh%8AD&5$$vO$}Z@@UuLdGYJ2Pk_qoA>RCOD6b*$JV_; z%P=5zQ?`vZ?~Qt0Stz`k9laM1ZlYq}X1lG(S$O9y&xbc3rHi&Jy=Dot6iA+s2bL6n zAlYzb!)T$J(iXHXUDMi_QEn7ur0`9xAypNQp-1n)V%BE)Sx7PLHvjKO!2OOcpGh;H^!{9#>aF|6YJkHO8SpAAdGr+bo_Q7T z$guZ^15(Au?mQi;v$3*ucO_Jnx}W2zl-!Q?vQGiI%wo}z?>HdW%2#2cFTQiv1r`{K zl(F3b&J?Pr9lFH@8%$*XDDvU=X;8Q!*N37#mgiVTOdxU=aYZ%#9{&BnAsbP{D}GSJ z>AU}&ulAzhYLav;MG@7EwGB~) zko( zjy46P^aD1-q*?SPy&s%m^TKA5O>YyKb5JN~;6La($W8)&kOr(X)rbPkPv#Oj$qv&e z-&xFjvhpSr-6fv0CR!oLwZbx9Tdc^H$oeV9vZg7O7QPjPnZKuA<9^@xGAQwG4MqF6 zS4NZBiy^K&MeoyFNfLP^Ua7Z)j-<%EP18-T<9sEk$_YGaID}*A#TP^>aMZ{ATZn%; zIs-kGOR{*!2*<7=alGlvq+I!R=)d8W1H7gYY|BaEbdXb*(ubo(+ux?*?ePqBj7zWru z+s;Qsq+oL6#~jc$MBM2rt{l$S?9kl7rY|!hjmKY}x(N?3pyk91$||4EDY{&oep2m* zng4%ZUmh?L<5mBvK7w-YTF1Kt{tDEAF?-U< z*e_Tp{uw{pc)r{Z0ABCLRlh&oR@EM{2!>zSR91YmF}v<)vjn+a|_NwV|##wYX;Q&yuavmXQoLj2VLz_PtpXAmtmSv@K1 zePcB1%eVZ_V3GuzC@GRKOTkZm&(1O32Uta-C8uu|2I&^Dxl_Gae^l~F69sf$4*TVc zjJa5~`=y`ffphP^dPjUEE@X20znpabe(S+*m%5)5U;D^4<3-arWb@rrBW;%JY%Fn>a?TZPn`)Q${Oa`mnLM=?+%JPPU%46; zShn&eE_PBV;Bum}IaAF1tSwg~b1n@dsSXBPD}}aJ4?gAx(zm#7dTtG+jEPyiyW=pM z5-`YFODt+qL>`XSUO(p3YA`jN&}oaRk>L4}^>?naAv!d}Jm8&IatDiMAi;HDfYM)q z0S$)*-1hrKel{;|&0qs3K?wXiek=cTy=t&A-mD5xH8hc&d2=b9al4Qav`K!>~D)5W?H?6In(}8NM z0K;5KtNeGKS0m}&Bt79WmYPJRxjal$>R3+r~Z5yLoH9<+&glgw4*%I5$Vx^0t z>+KyvtIObP#ps-%4TxPvPqzzu!~>}p|DaR?j+O&6k!JuqbHznes6OkhyTH~Iz|T&+Ru=z~PzPPE zVUE{|@JLg)*R$ct1~nGuLz$+7<~RuHk{Wl%GmCMLfC34XzK_8^$}v@uPs&35m1ShI zyC771+6(ZQY~ui}fRCe_Rg^@EO4A=tL#$~T)2QzuY?wknxsuIPHp?oV5o z;_SEEEh}Cvm=EB9QitaN@yu?4bo;5<)`~x-Ca7=^k{ovOj(HlCEoqP8$S?kidoI=P5xDzgC(~vCPX)3tCI_%sOzxbG}tioPDGr*C+B-?Xm{Nuy-eJArH zFen0a5P%^Ae7==m!#9XM*_NfHCi_i&`RV}P%Ws<|@$#0!W!rM8RM%bU-&O$pA`~XK z@Kl*vtocAVp>Z47w*fe3B6>andPEVBnEA4nS>`vv*Um;$M#;Xx-T+nUMD^lljRS!&d-QA;+uG@`BCg9_W~YY zNhbT+B7mT$3yvp>^=@-_JMG;H66@bRmRB_3{%TpIU^oLgz9-dAWwp*u7@k02akH=r zu_|y*mf6-vRa$;UC11Czzv1W8jPp4_F*y-n2D8d?0Dw9r$E1QGn%hr@%n!*%-C^o0 z&(9&NIRM~uM>es)37c9nsSl4Yp9}cCIFOoJN$`2S$LI-o-8xQx^M*K4>e z2JNq$3)gx)x)1dX8n9+uqh8ImUnK=@r*GHn>RVV?d25nj&ly*YEk)j9QEiNrja}cG zZ?IqDaB8jI1ss)7DThHy7H+EIynap3GPK-@b!lk=tqCEie@u3k9TtH`5x3~qJ{gHv zCiriTFyC*EaB9NocffqYr+Fc3kwJCqZ1+Z)bJtxR0D=eNt#jfsYfZJ6YT`hyI62(F z1a=**vMhy{UZ=Q5(|{dd*b+Z#X@xS#OJ(#)BOH-;8DT zzcH5gQ0Jt24K*=HmuI>SBjrw6r~QR>RqXc$hH1g&d@_rS+Q$u#WGIaBl6!Qj__HT%6f^qzKT0Y-G|El`1#^m#e zA=28#%2r67?Ky{O;LA>8JvJLEn(=Ls%ye{tUZ%?*`lz{fYW3tw4Hgbz4Y`Hj8|(3g z19>2^hACSDCBqny7Jq{M{ROaIH|)ksa5A%F{>~6v(jJ%SP%fm z*a!%R0m5S_bqZY?Ho$RrsZBWh?I}mI?Z(l+dCujOvC0KDp0uh?2wc^n$~PcTYP8pJ z>$R_*O1BCHoKHVbpmV>6_k(jz#M9eWD|)vG@254!J>tBiz*nB&Z<{i@dZib&Xn3_FoXwk_uX67h z=;`>bstbJFn8_Ki{g!?DZDWLVfD@)9>cu-6LEhmlRgI7!7*)X|s5a9v>G7An<5|?V zdn-+|sLME;H^sJE|ILC;ec>*XRLZ#C?28=#fgpSWxh4qDqW?}11|l^^rHsNeD;o=iNHgMD2&PxmcI`X> zb8eDj)^d|3G3;HzwFr%|&aHZ;I%}wz5v?*njAeiD;8Z{i2x{28=fHOyrvPxEuay*8 z{s~>C2M(NNqrJs291MVD?@vuPv!Zq!BS>{A$NF>4_F!W#9t7Z%k1Re_+eSi8^gR&? z(WgclG!^=y8eC!?GFh)FWI}?&wvA|xX_J8PNS{xtBo45&9w3&UCfAca1q2?8C<{V3 zzL|a@B-6M<+nnD~?#{GM{fsk&c9Ln`m}^_eUxZ>S6ct}5d#T&mT6F;uWN@JKNHoFx6Td3? zKm0~H@wE9@Qs1Y${+G$K%5$lTZs@wpJFjFfQ$5jE{MxPN#>!k7X~p=70E=~c=$F7x zF2ZSOsfrY7iQxy}fXfAw|3%wlxRcbgN zIe;+Sj}Q>8{O!oTR!H~NQ(kjn$4KV>R$Pv+>f-2D^*0|GdNeTKIn}>> z5ZovM{stdsz~}ClxoU`Z2Hf7K1?TKP(8pVpTS1gjQXV?3+BzH$pkg9yj~ROo9$uCK z!d3dYbQL*s_)QxkRqGtQHEsn`IN#$9F@0lM7J!`1)c)e+M|Yt)EoRX)qb@r5MG|_z za$=Za!_dtN2>em6LRy)M0Gnz*K!pNefB?!n#J05dlnqS>*tM4P{5*h_&jSCLd>v9q z(eXP1$Ra$D@$G)?dF~!viCOKrhq$fFG{@%iw6H(PaExm2F10ps z*guTm|3tiL1bVlFu+rKY2@^&Zm{r@HbpX0s?q>;boriVFQP zbc?()X^c&b(WE3ixRj2RXtt)zL8U_dn76c4xC6YHn7FEsM+oX@%V-=vRjBA;@LOP* zcST&>+%4O!KQq{=3><5%DTjRU+t-;v6>sb{&Y5iN`k#4^wVo|`??~!L*|EIl*(KYn zmbv{bqiioYEd0IDEu7D)KlhZh85=%q(<}UwevrOrd7rlsBAB$r} z-RSukb=Y4?N^%d!srVB%3As5GhjI5blmWHowU|*8Z|CA;=N%b|qt=jM({2O~qFF$T z<}{y@?KMSIg?eFhFbQvtK3XIIWxt0=ULa?9k$WvP;-%-tQnYIR`4Xo=v>5StUU6T( z{EEI|Ho4Frv8vx9XKj5hbK_%1d+sy$$1hm;`2(15=(8@)zoo^W8~j3$gLA_xnL=A3 zKHS05IzkQeMyw?bO_Ie=>JJ}&lHTlcJ`BMds&)Od$V5jA>3=I^Ud2S6NtC=g@dK44 z@r}nxPLBU7q-_YFopqo`kdOcKgIlj<>*5IiRfw?f)9`<_OQEUuUxn=6=PvzMyU2%x zg#J~?((3Jd|7sWWKb`wu{^hV&DlD9rju!_88|x>rIQ9DeoD?GCxos$LJx{}^2B4HJ@O>X8N8v3d%YDFD`v_RYzH?wzQ{Q`Qh7?b;An#4 zoQIS*u81ef2>KRJ?0%wNPT!OW8x3)23S&2^^(qU?0n1RWF>DUFaQ+_dgp2iui^>@wDwZ#Z!LF?>&2g{X~! zksj>A&W-cE_ABJw>GxEcthU7*0v9oqo6d-5K}W_K^&0x8_k4u~G6QKs{6wP%t#$)Lux1~JeTFUWPg0<}m0mSB@G};5Q03q_$oml#zPK_`2A7D-G@?Gg z!IU+A23JSvcarpTF;iGgzp1#|ETZBFY>YlWnM@lILm%_U=ZKwd5J_b0-ZOjI7(UZd z4cXZsLLdx4;5d#a8C;F1=}Xv#g{j!tPDypK|80GJCygDKEbun!ITGOy2BABDeRT*5 z^4nX;@Fm{*-i>E5xe2LRFN1rggHba6;y3}W<5riGB75?Uv1zDH(L3$P8+2*`MnplU zO;N~=Ibrgnpe`20=7I#`mTkm7YK8kS(B&$wf*73J0newi@0_H+8ij2Rz==LL?=vvq z{7@4L-@2>3Jrhpi`?4(TwG7rH#RUr>u$m8!m>df4ai|)Q1WCW_VJm?Pvs(uvyPu2fF54i15V1X|Vpef6j z#XIC#^ail5=M3h5m^1fV4!VgJN#Un<1GCv;F2Y}txFl?rDqOrC3 zA@4K#aM&3Qd{KI(_L6_gZQd&+`auWm1gvBA)v+(7tU}(yiBx3{G(qE+>9UVbMufx11s0WwhOYPl?uSl9mTJ za;9MbUW_{x`jq2;TBc7VGJ#9KeZf!@Uz?GND)gl_fAZ03U<2ZN40BYgYks<~lKr2Wef-74~eiTC!>vjeD|cguVXSMcl*SVo@9#h-L%(k0&u?(4l=il@}L9 z(oTH*nfkuipM{d?q);H8dh)aUQzo#+?9YU8Q#9MXs3v0t3uY?4z*G8<`U)Q8MwwIw zlY7$H%YQCXf7C~ISLWE9urDy1pt0bmW@(B!9uBi#ZN$p3OVPx_w&x<58jvYTinv1` z!zm8ZYPjbTQL)rfrbk2vX%BMe_+eE*VhIgf4Q!z7_H)TQf$UEf^>W3tEnT z!FeX!r=@gI%Bn8IJu78&l2fsUD)v!&M4yTov)M;&TY-Aj_-*;`HO+vl)2=dB9u@g$ zlRV6)aLBE?9G`IqYdt9pB}>GpfC$8fo;0v~ieX!5)B(>^_N z;eua%0*mLT)TsyBmvIS(k9Hw#a8EuIN2)EuZF{4s%h9a}_`2T|)c8nUa2YqYA;|3r z>9-0#6W^WTZQ^ipS)pmhYXFfs07|+y3Vp)h>y5dX*E;<4)hg)#bC^`G8B2;pqR}1g z(*3uE684_G%|XPWRS3h>(g^1YlpyNYPPgQos3(p`7p3G%1_AH9ZFlB%Fprv$xK)@D)kh!%z|iO(jtGmJd#QW|CC_^m#T z!6;enT;BuI22d#wMjNI^c-shoeYVh`9wUALEreB;9s#d*5JqzhZGGLkF`rQ7J2lsT zxQ+0tVJCC3+>q@#$#Dsbn)n0RC#Fk|T;O7klAS;#tR_A>Gzufusm;LIyB8jPL}Lw0 zNNGy;xk`H@1p9QCX0O&HPSqO#fD^1w+2qO8TD*z#Cu?jzr6b@oyl|LlhQ!eK?6Cpv zyVN^s4Q)NLf$FbuG7=zjF^55j^`rc*j5S@0c>=PI5h3B1X2m}vXE-w`U$eI)dNS&W zkEu{*+noby^Bd(q zef}xxpRxMSIvGl?#jyNwD@x{SP;5foJ1oAWOZoHMmmhLdU*1$=5W=Z0 zK*v8#KP@`@4H%pH-&4joUG_O_54;^0N3+~1-qd;(Ry*2cTMwUOwf@{2cNVn}=jET& zfn*8ThKqDxQ%EcltCsv1t+ zJ1RZIf1L$zEywy>y&|t=*|HeAX{N3kw0&7n4MNZ|&5_)+;;3!u|47aNLk>`wc3Nb8 zYt$Q<2V^OWDC?^Uk}IDz@WhTOf>&F-I<1sWRvhbS*Sd~VoG~l5Aok__yTan;$j+;Y z-M9hw8Py-eyUpeBJD&bC7ak>IG2SYNR}~h!EiUse)O+7Qh8|VC)qU;t5lIJ+2vl4@ zXcUozox{4Qxt~R@6f8JWM3baKwwL=$38_^j3392yl0t@}`V1js(Ft{4~?Y=ng__gTaVqvGm8IR_2K59PhccDb*Q6n6qhq~`TKCWG|c!$k)P;xRt4JE9xR&#lUs5sC&s+r9(1hx^ajb*p0A9KX* zzz#wLDL$?!zTQj5KcT8~K-(MK=%Mx?RAmli(RY$7cK}HN(m1`Mf~Dv0fqHdht_%wH zAk)a2PiPy`JjnM|z93Z4-Ur|sD?wf0-dA|2Y{g474zaLqTwG&Sc*kg=G`>DjiHeMX zs`6{BXCed;r$w80=>AB_uO@U;pRu4S2d8esNXGmMoL=VDy2&yyzO5bhl9-clM!|!f ziOcALg$`2FvGhWaz+Rg-Ub`oPSnH+Jdu?W+-SZ1wq84ax>Djs{r^ zPVF-Z-{RP~A-x_IGUgKacFCGWaUv4;k|HE+W4$?&9+AXImqLGwq|2Vbrx)uP!7R&j zeVj+^PyzhgmHn^f9T|JgB2qMdz+AG00Exg1w;?ikbjQIXv3!=H0;Va$bZr6vCc@`NS?l4v;@KP+yRRiK zzQ#3F)QF<3=H%15BMAJXHw3gh$`D-bf%H9)sJYxXzlcAT96liI<_cYoBBrsOz0P*< z8iIB!Fg{a06qmS~t`1Jk^SMFVSi+3JJ?Oq8;0>Iu^XD_VHAvts<1od~+FNh%Ma)^!@y-fXhVgr_L#L7)&4*~Rx>wm zx(#sWjj2YZsD@;K?y0cH&1NmQp<(L3en z2kNUEPmgbNbXY1q31$Wn<#X$Av1zT~l3n=T4eVCp{y?IZJ2)P?iLdMTU#&FNgpV!z zpQ8Wu75=vm$d^vnHi^lgx(Cpl!_K=g@qMH|CYpBPoo2#$33@1mj5z5MKYywl%-}c- zvt3x?z5h~;u9aG2-jkJfOk7+OJ(M0`WWtGvf6&37Oia?1VJCvbmRT3oQ1iAU08r451aGJk-Ev- z@gE`FY7?kMxSu`?0VGc27{qrhZn8GMv+@aj68%AZq42YiKMd#}}Ayy6;TY)m0bGNnQ0t#{VKxGdX zpj}*OxE?$q4@#O3i$4ASjD}14Dakhsd*L>O23C1x^YA{%x|S95tn^s&%Pdwo>Hx!0 zyIilIutFQyzjNYlil4YC+}(XJFQMNgq<$@qTS~WCJ`>6-R)OC8JjU&ou!de|yoMAi zE+T!u+C0yzz!R}aRfI3r&)?C&>x5yyuteeSQCacxzVto%_?dOf zl=?RZD4?In;Dc``@_C-&ALSlG%)tbWY?r&o@u%}^BZCRdFJ=z(P^D5crfSawQHx1B zN8mTn*o~-JV0_goq^ckm)fZ8vfCg^b7S-?RQ3cVBHF=}YVcB=Xq!EdSDOY3k3K#1T^&Q8et++!>}56ucg-47;Rz%Uj44q5 zD1k$vJKTEgEqme8Oanh{J<;{|B#?7o4ip?g*}om=!-#wMLVvp)^<1K6^J-&G|H1(= zhuH9V-_2*5d;_1>k*FuU>SP>`6eRZer1IKQFa&=s&mZG66&Umk$5)a0*`uj9XZl>i z;Wy-%(@ki%+zWF?VcG>F5pXjTdj*iU-ZtB%fJ>mEBU0;?}oY<6Y zu+@M9@;jDoLB{SV>_CJtlmmM4UYVhiHgdiB>X-0kn4Vc)*IMlYHCyn?CVrrb1jjIfHqz3cjSs9occ1Q z1N(@86(GKUW=i=4E({ecS;2k>%25(1SxH3OfPTFyfgtocH;z#dv{uuyuxiecs9MhV zi+#i*GNWE7;}U#^K0uauqv4QOmqn(iHI(O)2r}IiX;lzfBFhB0I5oURa(<>=zm*?t?W`>qh;w0fKKUV!KX-$UTd1VT?1{p!J}_)P%$me zB1TG%gaT zPlK1t_pAv}68o=lISVWRy1F(B4>Mg|B=dlpg_qPlQPKIXfPHu+hVHxu)v89uL02hn zp3|AdFmxVl2t!Yry?8aC!N>LW3=ENR3`}E-p`*&&pLtZ~gEpaD&hU2OAP29R3&61e zpKy`5D4qv{2HgtdzR1(?5@Sz0B?n|Cp!d}4y=R$;h?x{kZLYgv6&ufqoQ+kNgW&2WwB8F_2 zC*Q?7?+h%TTI}k4FCc%Oa~~lx2RWOs(7h=5eh`P5<}|Y$^HSCaXBP5a2i{h3vClFe z>G8&ap}&By5#_^~FJw|-lGs&u(z8(94(xHPk7k7-2gjbKNS*i%Bsv&>L>y`n1mZQ|@>_=Ob>-*4eU` z6ROZcX{@pmW;*eUdab0^zwuIbNu>(Vf8}_3RNgO!~7k|hFG9k~x*iT zV`6{fH@FZK2(6}y{$>*tLHE)>4e41BEX#PEG@M8SZq!7_N7X&g{~EW&0GE)}mvK@#$Dlam_P#vN2p{)Jrw@8m|Tft5uA zBbIS}BP!q0kWRaFHpe8jRisJ^ZV_ON-c**(vq#zKi0C68?vS!TnZOK;ts^;p_#cP!2`>*kA)FAjG(k~>c z3EmtykRyTI9Y0V4(YkZaP$3tG-mbU3N0Q zp^*O2B8YB6+Lb5;DqIq1kCLam+};yZ3g3Rok9~ai8%EJ7(6n;!bl&!UX!n2u^}~)Q z)^|3UTCkPi8B>yisQf#Er~saGN=1yKcLQH;N?@Kzl?A?nmh_uW=k@0hVKK1SgiAL5@o-6;y! zf^l!F!^W{c<8yb|kE5ZaaF@1)9X@4hP-v%13ezqC^;f7vfi*q6cr# zey|kx_Gr6;CpJ(%V-j!gMF2Nw^1@$@peeW4HukCNTL%sRRb%QuQw`k`fH>T>7efCZ|`w3GJ)Id^6XTb|pKMRO}%B|Yp1lNUaZxC^)UhBMC8#!WV$=oXlcl&^I1L&nN zG^h1Kp&F8*H*gF)X4s?tZaVwI!^B>A^#pK}qG1op{Gvzpe0y_>0W#lCI*Cix}IC$n;PdxNAJ>A@25cA3tN^|E+7y zFoCvyZXxfhA1LtTLIKkv(^NDptnAZj_SkS{31m`Ms0-G6B;CgOBr6??ERgx6zI7G^ z#+|Y^HxZb$sLVyeA8mH{>m+8neYBj>$~NK?im_$XV``VorupWL!mk~ARTyU<%y_eEnz@HHW9fR|4valyC%PI0nJN9s#!B)Udy3z`TbD2&L zrY#*WZKlv-@o4Qa__C&w0Sx@d5>oy9o!=7Ah1A)P5Y(JVXb@0`SSrvgll(a&DY>X4 zC`fBx_>%vhy7SjX|32jZJxqV=<$vmYSqN)69c6>h$id}!YPUh=*z*eY<@aVZgVK`R zx2b0}JV2_pvx-J}S`c8eGoLXhe=S`|U=;NatX0DJ$v=tI@ix%7o)A4w2|nCNw53w% zi`RBJ?D0hhmK3J$)&0OkC1pB(&BKFL1HZ-wxirS>>mWK``@@M!KJ@h z;6DKNe+_iz2rG@Q_oxIO5xp{Sth&>mU3c);teo|2zaXP&d~8_|BSS;iLCSO%wH2}- zP5M6Q3rhn@Yfa5&=mo$^0s^e{^M6PMBhOl=*+L79TRqx4Z_YWemaWbUN97M1mK)G> zwibl5Uq8z>+qMZqqmm;q%yGJzw+plZJtiEe2e8uzc?jH`f8|0VbY=YuhtKw*BH{#^ zhUSII<%j|7{ilc)jr>>p=($Io0V|B^d6NnoNft z_lhE~DBfP#?Kbks@dNN-9Nf~0{x?|zg442!H;>gNw(gEN8B71-Krco^e}*J#s`-S( zGR9vf-rj9$S;XKrm{^{p=(dTO1%|86dWBLynnbM4v~=NK zw72+a3T{huHcg75N)YyV7zFhV(iFt(^bU-!9qnGUnfz79aPDZy0|GQ(K)5_UAcVV; z!~5Gb*vDq*g1(g_kt29r=R@+fc(bN##K4H^v~qCNvFY3uAY|YM00a*qZN^ zwklRD;E}`?DW9B>w=$Vz$45H^p-onti&xTZ;{!8Ee1bbhYGrwjs8~ zAcH$`;WjUZocC5*S{zr!f{gAT0er6a6LfOplN?Zm9-aCq2TY=Chv4U37X8QG7NY7k zGilH{Fo6N%HaySjwoRiC&1KonzNM@4)>~KQ>0Yk~{oY<)=m_)q4E}mrY->t>sN}FL zg+Q7K6aCS`m}BF}V*G@G7HA#&OAR?r_)w#Lp7AwW(a#>!qM`e$9J1Jt&NxcvGb?b> z0BjpZ7Ab{KMiLi#0No8?pl>~#H(drB4mpd;<5kLJxL*5$3Y|9AI*Jay^E4tlw$)?f zh5vcqHvd7gjag3CW#KCy^xgl2tpZ+Vcbi0k&f03+X>ta6P*MIr8%wnRupWQ#!YKkH zrdRhs-1o)L_T~H4ch&Fzlso!I2wxxSr}-oJ&day}MxuLyaw_lip+z7$tPkZ#JE{eF zYs8M*uo43*&_tq5RS}oRvOT6;ql)qwbp1UhMHbsH@}M(qV#oO!|5x3H4G|D#RV&on z#^shnMx2NjoT{ALvpd+Eb;W;Wviv)eTjdDBWKzLemJAkGr56zm3M1?kA#yEGPlDXr zOwL<46tF+3u$n+SGziN%j=&BHLv5mgH<1;({k4)Dkho``}-IY9I_p%XgTNJlELiY#9jqvcuXQN0^`AV;?ObsHu^i!v`&-M!FJB(}p z73`fn`QHrn^_hY<%jF(TI908rk9GM$eNh%#l6mHxp?-d7?`&+HcGGtG!1B5_WL2je4#DLCn03%A(mbw$Ujrm@ z&eQInX+S_2|33i26Yvd_6)h_g&i_`T_&{dhKS0AUU`y>>eOtbJm--c}i}LS;bXRuP zTlc4OGGwt`3a4xA*?BivSN1*}Ap9qc*(_G;JW!Pmj9-N;Lco^0ffuq{=*~Xc`8kVhX0Kg?c zXV%GatHYHR1L{3NS7R9xd@zpEx8c!0zClxC&n{^Ob)<&A!ZHWRu>}k?T&~P&0nTu9 zR0NW^W<1;1Kwyhy5jYG^Zi6_6Z%$L>ivx@Tn!u(~cM}LXrmB2673Xt!s zp&v&lBv2ELs_^Y}+JBC&%({U0R+gG^Z}u(0)tQWN4RJ!>&-?Bu^S z@?DPFe9#}%PQjQkrd?QWm0Y8-a#6|ZOtN?d_zm%0Td%K$Y+BUvwQL&!X^Nx(m8O;Y zl>deU2g@|;pC86c&o!=Zi&s$oy1Y<@Y^q=n`~wwdN9`85Oa1A^?>A%v z62601oFoPZKrHizXIzSi!q{HNM!e<~Wrq3haavdnOGC^n{Iir(eAJqsuH z!hC`2DEAv3)sorVvBPx1Ny;k@Hep>VZE=E>d%&)!%WjUz0E8|VjPBfLd1U{oO~xV5o1>aWAmx(APjxgtKL-ysQIs&zaE;npC3 zt$Zc{`i|&pS^nd+%7X7Z_U3B*ezY9K$X#wz`|8d@6Gca-Ec}=F8}1_7W088PElZ{2 z&n2Jyh>ec4NMw{LE%Bn(PsNRJLpFjKgeV2C#aiidFu=6nse!g1~{F(?S*REJw%6Fk)$S z3VzUESF-Q5j)H?bYRJnBFrf(ks0EjQ6k1vO*Sql|TaH?2a}C6)?6H=F|F(fH#`D0H zf6a&@xY{1tH9dftB%UcwWHf15@q++0DWiF$>>tt6={5rSKaK0=U~1#Tfz-8Fs=C_ zt`ksYS}SbZe(@IX+l4;=E5+Lb)Qyz*@SxMu{p>(6_lZJ4_|EJLb?E2WpMl87RvdDC zqWP+P1cS!0z%iRo*1`w>&4Rj-ok2=@BYghsaQT+&fE2C%8QT~=J6Qidx&Dw0hojo2R7Cl$^^bd&~ZqplAybB_NRLe7K_l@!SRrfFPeA@?? zBRON}`Smp7{Vlhf|3r3AOTh*N>?tb>&nEqDCDp>~EPXAbxZ9voHispfft3z-_T9?i z@_(|w7ZI>=v~?=f_zikOiVxfb4j$cnEmJTFg2%S%?t~~|gv|+C7%!7=9_7x#Cgloj zw(IiaP|_*KxvFckdm9SvvnJ=oMEy`gw2A+Ab2=cU=~029MylKQYVb(_}yru*af2d>Y%%b~fJ{NWZtC z_}So?0^+*o*cdrr0$n-;ZFxRpZfXCr7-(i<2|8MsI*M_`_JH9sr_yL|`W};cn}m0n zsUTN-y~^4EByZU)|BbxeT&)3Z3W}sW&`pYI_wF*~97#`juAeD9t$FJf4awh3?*EaH za{m^2El5zUOo)=)>scmM5H6@vF)2&=(Zdh*&q@p5NlNOg+ZTANg14B$KG3|QQ&^EV z`-I)~0-G)62l&CaQ{yqDDLai=u7T_5`hogd$}5&{2L^;qLeE%L-c220b+876YTH@t zK7AHK42qnWeOLyh@U*l>PPyboKOXJXs@-QTyuxlXft z|1HSa^`%f-vMS!k$d<(T#^T?41;TieaK_y^I`!k5|W=92u7hhn;rekfa zUc6~`@he1&1&12`5ULDW2XqH>JgU1D1T=o z_@mJZ{Dm@q4%3ToAm$IhFwE?Y1bfJyUaV7F!#5kn$+`#SvOG8bfwF=H_;kpNxO62= z|D6#2XX-ahm+F|mGaHIM&lX1POCHJksQWZdPEgt5&6&5BeH+$g_>kFC+>fD{nh^^+(R$Si(pw%gXlI0XDO-Qkm^hfjmyiZ$K;DjlALwB1F;Ue; zNMPlH#r+c>s>Utp*IcBoaOA;2cIQum%bypbBX?ExPtitTwZ|dl3}?W-aSkuqFV(7o zd{~36Pl&z^QyOsS;Nz|9+7j;%j*N9YLil($Rg3$d&o$Jmf+%aW6uswdl^Vaai>|;q z_Qya(kM5Sg3tGL|fO4?lFNXHc;Eh*vQ)qCp6Ghl#%mlg|=C0IG1WQTcW;H+M)6_|0UmPVjq@u9tsR2|Fc!#%Hm+&~ z5!$o!C{Jwhy(@8^*Rfl_dU`6*G|Nqr(*uWMSH|9N=Z$Xva@xebu|s}C)$-2HWg^}l zXqE&1u`Bmkl47LHZ&2pX@p#{l2EJ{Yp#93G->hd3gz7|=^NsGJ?h1sYESvgnQaGZh z2jFKoZ2z}icsE>QJ#lL6J7^|V-n8TDBFi@rPIa`yj(wvx$=fW|2lDiGI_9L65OWDH zr(mM)>Mvg3lPSC0lv7iHj`?uY00o?Z^>#L4S}$2(N2nOBXC}XVwKt(A)dzMQ)#0(r zLQc6Oj-Y_Q^Pm9yEDRJ=*jy+FU~C#koa}L^VWpX#wd`sfn3CV3)OF+DG$kXyKIAY$ z!+uI>@uqCsrYEU*0R*2J>K>nF+i#J2rZF^YMfwPru-i0zfKXg$u$8{B1g!Z=@^N1f zAq!&4Q=$suAPj4@S`kMy0*t!-aV?e(C+P!IT`K_(9zFg8pGFK#z<_#w$J)(v6L=Fo zk6&J|9*cn4)#esxeAbuZZiL($%0!9WPnA--?E-J3Aph;cZP9B`;YI%m_PUlO=#`_V zO@K>>@yH_kPC^WHVj+QV#5PLm=_&D@L%XHMm(47!vcE082_Zg_xtdc-HKG5RH(mG) z`r+8~cYWkbj_aFNN-=%{-V22|`&7*?Ech;DpVeX zD><8co=R!Pu}iuA8$k-9@@#KCn$-%PC_4NLA$b%d_Z;i@KY+t@(d=_@)O4M68W z_mEO8CMMI^AD1qg@<;)fS{IGre{uwMK!OPlnxMmd>J+Lm1f+~OGb+XmA8D}xxp*K) z39hjSi+vQr3aq(pauJTdAQeuS=7GW^kgI&83z)o#S+Ie&gP3IHq79VZA2-`1m&-UC zF((2&`rHy2u@iAF{2*iTzk*5rTt-w>cXU|KVb0hgp7KOqs2buYJy2a{^6?V{(PQ75 zj=XO8Fh76ClCV&z4Yp(IB?{5P%F#G?*>Dp^5$9(q@MM!CZ=~h^MYpUg^Ckf~0E8P$ zvORF6s8XuP?ce#EV0z4SDa&?Wb_smrjGSRw2z1TpO~Ir@N=A;>B98C+G%_Aw#I?G< z`*oH;PdAt#4N8EBddlEz?+k(2-7weCqTJ^H_|Y^2iT*oI4&E^j`#d*}Jzbu<4DsVAy- z*p;wzy4{7I5UqDSQEsoW2q3wBCF1vsc_;?BeCZMZh{=a3|FZ^Sg5`oB{7;=(sr#dtK>*}^5tE^Mv-z7zV%PkA7f7d?9jZp>+XqS z;5|k!MC&z;XUyM}+OvMC59H=p_)gy; z%io=`ydLq1Lp0@6^u8G}Uxt53VNBUAG)*PnIunOyEZ&BXC-e7z{Q+!ggG=C{f9JoQ zG2Mu$;$MGYU3W(EuV-wrP6+%DKVUBTy9?kz{H=wH>G=Pph2R#9=Lf!9Pff2$7um1= zxHuL$lB#5!`EPUYp+KnfpJ`8~dHL5?Bvopbt@{nXJQ*eKFddB)J=G23oA^JzlKoVX z6-iV(={bN&c<>OQ33JUBHsY}y117aJML^FKJP{t<3k;m{I|0kbUT*0F%Fr#0jsosO zkIDY&Sn%Wh^Qov{;Ny|WJ}3q1MNKfcd*t+`kXMgyr33R%VmSjpW{L+Z@CecO%t`>8 z&j?*OW2i^W-1krU*`Z9lUBfUR`VTOOyisRmXvjEKZrmmJ0=&8>lvi>`7=|IxP7G?* zOFO4HWy`RqRyG5OKNi0A{-J#5_JiOYD_Q7k3!9=d*Oz^JaX)e89FLr&I{MKNau8GTZ_Ey0Yu4L892# zN9y&Hp^!5U`3D2Yx4c=Ifmx?(+i6iY(A9+F2=v+prz6AB%1Z+n4l$n&uOm{5%L`FH z1^d{w0@2!~hXBxq6Bu;a{FW9KBPc{sbt|WjJjGxb!Ip|6sKO@tNjiCf~HiGJc z4dDB?Tz`(i9<6-_Iu(DbcA=o<7*2l9v8S0W9K!EEzYSRhQz=Q$~(i}KKi(2pO&cW?XZx&-JUmTtX^2n)P5L&!?awMN31d+-90dHX^n z;=LS~^emLfT#o15rc2iGK8oMuh^^#CT^Li?C!^NOqGBqQYXjoh#y(>jiHFU4)o&@{ zWjiHvUxk0lefY(3P&O~k)b4pHkL$tb8`TbIEo7T|x`?>-uy~=r9^oAy(#mbAF9T-8 zyUvt~E)aQ7lt8+|Qz}01;@UGxRT{&)SMK%-{S07|RlhI#rSy#Q#owa8HSvGNoDlJD zvZ-Pj%X!)iJVaY`yGJ^HuCvUl)8Oxpil^|_$6M;Lt+f6~w_h@>O3(6e+20yRmpjzX z{(w`XXWaekITu>J=@ac;*L=Xk=&aAweeTkOv9io6$2s<~QC9!&fh9-xKiE9-H?$*K z@D0^#wu|~<>h@YYtcs*Y;lO1qw`)m?7VdtP`wk{;4zg@H18D87A=QHqR+k%aLq{f* z>8owx?m*#ospAtv=n!FVC3_^Cl#Vy0+!-$XxedLRYE^T~KrLlU+E?q*b*>FCeI{B)6imsf5u8*!-Z5G!^ ze0|2-^E%3c;{>4%)#Ik$$0(jG7b1JU_G@4pss}lVaoo1=fV8u7C26bn&fUR8ufP((_i-7%FIb{D7D8^B3?k)j?IN=g_O)Kyi(8BqDV^%z7L&wXV3}_F$e1q8B2rlLn z+$UB7;6?hDYV)X!TP+_OQ*RRkeRI!67}NcdJ)iuVTdaU5Q+F|l0{s44KA`@s-MoPq zZIa6wbzTnMuIP>A=Qlr`3x9*oYe~^hNNQmrIESVr1&?IC5HH1Q&-Eci z@)fqcjmn{CubPxkXAI9E29r6FH90~vlh+H>U4j0SNc&U-!6#4rbmddN9jM-eRR`HQ z{g%Nn`YvojG<+YS`Negl?&(760Wt6A)6bI-ZW}7O=|IZZK$?)MAzDVBS0PV6hF|s! zSW_m(aAJ5>ehl?wn6Vj#-2Su$iHG|Tuo)27otYr&V{8@@gms1_@=d0;>MS%XowoH+ zZFO3MO@t8yF(Gf|OrXI9FRRJg)76IkI|eFNAwim%GnpI5$N=oI82MEpsa?Ol@=RuC z+LmAMDhEm^yk;FXOIfazB8u&zrJJ-zFFovI-XJa4{DtFio4ueQi0mRGKjJ{g>BP z<8F#H0@Es>SHmhAoJ%m3)p3c^)*&6B`TFUShnFr`Fy3p+~$xje4!fd1mp48h=YZQTvgh<-s&~ zYf<-u7_#3H4;lKo$P>ARat?haOmt<{D8sU8&b&@5Usw-x8WJD8s4czm?mDTB5t{*d z(`lbQvbuct;rYq$L!HRRKHw^lBdeWmagClk%pz?+uX%rW9MUC2N;J;)`%)XJD!dEy zDLE(W82ix?8e7X5`_vb-sJissvc8PBLFwK~ggOy0zow)_LHGvz&#Dc^(M^RxJvhOb zxQ^)MzAR22K>s7w3j#QkxMtCYC?Cj|@{)5$ToW_cu1R=eOp_4vDPTGiFiE zGzeT@L|;o1W=m;OZtV}GoW70|jYw2Wy&8h2KrEM$2+_ap5H;wH32wfYAon<2wZ#)& zWN3*LGz^op%`A8!UhMwL&2i&Q*r;J#pi95*iqzL{FWS5!G-g^feq9RztBi#;Sp2$F z;Lh|A1w|i;%GhG!e|ps8`hLyv8`(V=LeV|(%D}&=1vYC9Ln9c4MWrcQUQBXix)-{y zi&=e-GIERK%-8{YECLU!R_Ta zNBLB9=dmn3k;S<5v*<*%U;Fsr-M1EDJ=nU(1VhM(&#+zUaR|84oKf&@*tUO)6Z;jG zZEv&?`SN#isF)zNnsQ%Toyg^-X@(@G3?gs}1pExnG{<#qn<(HuS&R9KyyNYAcaMjR zjBq<={Ef9u)mXg%I6K4Nt=Mik*!L~O%WEg|gTwb=izjEqw&7fUYEc7Yo79Za$ z?TGHDhQ$dzSHBapW!Y3&@Z@DEs#kRMKfChjbwGT4-mO@w23E7@B=Q88I-DDOs+?xV zw`TM2=lVaGita@2JbY5;m{A9DR3wQ0Scav=koo z(O$!mWTzB}bnoGoH(hiJ{$WLEdxIc@op0c2(}6Oq^z0O;>p?rzZSnd!m?SUt*hIX z#Va7Axtns1OPsizt=kv*DWkLg^ky8_%n~>KRwYX(5?@eI>*;k4_nG#5YEKf%vVwan zGQV|M>PkW?VX!Lv*jnUB1809`f_HqA!Uwbh?u z#0Pd7B_!sHw#9#6MWM9jQuWPk3-g=e@}7_iXR*9qdMADA7~}@HMLe^65lhzkx>D ziELE$j~m7GgYnOHSc9puRb+A;&HfC~mp=mpcHZY9+01yBEBy(y6!04qjB^qsU9)Kd zPdRp2A(-4nVj=L?&F6#VF8iZATCy7~Fr!tkwghsQdu(T(fX_w2fU0wI|3I?h6q(Yw z$D{Na0YR3}xrtQ5(w;)N&MOi0?Rpz}IN=y}ejdg8$J?Vj51*R;@VyvYQ);!~veEq( zO+hki!MM_NA6p4z8eSzObC2Iyy)PtANPG55%YH~|dvB~UiBAg|Rtnmc0|R?bNd)#h zv`WB1Ta~r8KKyt${Z^1oi-c51hjZJT6#1#RoD8;=D4`t2_D@XM96q)1B;|_-nCbmf zPG6%eLta7x4=j!p4kT~YMAZLG)fR7JHna8qfQQcLr&9|Sp<(ws&_j*%z{s8M^x|nV zq?lQ{R8-%Ls}_<2+$)db4dmo(TSpHrv>(b2-h!%2z{ULJbpCYaWB2|88nyDZ4l53G z*%x`BvOaQSi8YGxUnlV+8FeJ6U`6iWi!u9<;-`PpBsMA6f+;6s!JpHfU5hIOjC$Nn zO(pwU&Yk+_Y36%PG7FB9uMn@zFzk-xL;Ne?YN$vaR(aN zB~n@DK4s|HQefh&-g@Jiw9#7%DFsS>JX;^BnFRskicSGN6~XIvQd2U)y7GW8Z4JS0u z?S<4R=Wv`*gE$eL@7yK|t`eG90U(xkA4-KoA%~^$og3(Wky~o7m#;S$*rRHZnRqsd}<{#UC!{x5* zqPwd66gV}t5xL!&B0b&J0C{%C2#!djC%`0T=$PQi03VVm6z7NAF=F^ct1DZ;k#IXG z`T$_xt%VP^1Lo!>X_!EB)my1XYlX(i%wW^BmrIQ}C1c05Ks7LzdNb(lHnbB;0$BUQzCcQEyo5d}!U5htGBrUZS zp+U~L#w2m)bUyxvkZ~KW$+3Xt(f9XsfwOZ%bb!=7%{tIVP)>e$lVQI>mr0W%Gsa(hb}?>|T=)pbG+7@5Ar zRE@^dGT4kAkc=&dsm7)^N&%10PncaI(5^FLXuD=xQ?0TeHF3)X5cG0*mhHxzgX^v9 z)k#$lxRggs5R?zH||2H>Pa8eTViF_ za+e^keFA*e9SsU^uQEtz2OxsrrJfp!9jr8>A;mx>v-sd3*UlF&)2M6mt%ki{uhMNJ zw!1T}x;}i#>Qt(NdTCeOyjK%UZ5J(Bs&f8}HSE(4;aaN0@wA^bOTwBoBXr9A>5cFk zga8nR+nw|ZLo*-E`_-x;v)r_#3twW*sE4FPlN^9WDFfxq4G`{`ugV!lL ziKuaVcz_P#4a>H%>1>sqoxX&;0F#m{*0}-8j_Meg`Q-n4P6`=|Kb~IP)`ON0;aJ~l z4WVu^@$U7GHk&dI8hDr}!Ke4_J@XSA#Tz>_pZ9mT7WCbLsCt;_acVbQNg_Afa18|kk zETvHoW|aE#l0PAoGn>$aBECT-zHfcApTqaWB;Fx>b$Lws1Y4?bc`f&51e->vADH3irZUg&b!=$>$JQ$H)90ZyebF=t=__L@M|8NgpPyA+H^O-rIo_PQWa;~R)H-o0G(#|&0?CGrD+bw?X z`^1^hA`-xyuX+1QHwO-C)<9#Tr|0Ki5^mSenP~Lv5!~w?4PR%Pdr^_UN0B)(cnW=m zwH1nw&b{Y@aA|Js0}9rRrFKmPpOLHvRfv$^^eYViP*2)zVx6jM5KL!3=U5xHzPO+K zoE*D$4t0AA^hAC3!91Ai3=@0d5WO-SFNuo^VcK{)k9+?8k>R*Z7Zxzsh40hlexG)3 zx}1=yrrDGf1IZg06u_AtH18^qcoe@yTkS^V{EdkZ-2TURE7T z9|ox{>XT3vUA@jrXxu*I)2dlE+%n`4*st+Y#UgoUdU9~^N|9DM*%Kn58!<&kZ$r;2>G7?ZUStTT=PWjW{vvL?KkvC^M;rk{nj? z^-(X)!zagA3jf+F~0#axmPSo#giHR@k4}T3yC(S08?PrERt! z^Ju__!_U0s%q~l>(euj;Wert~?Zo`}d)tif!FS)i2ZtZh-5YE>W_4dS-hykRu(aii zp?vGODqCX2=-C(~YyHj-^Eo2d8i3CR%J$AviY8`NDA20Ehr`c`N9+8~4q3i-V~8yJ zRO&|TbASDt6vC=0O;J9ixr2#>#VZ`H=-tV(uX^~5A{;zrtIlrdr)!*F*L=CRZU`tV znO6|Dbx_T4@IvB~sgzhlrPA$hzql=YtyVC`CggPj$?NXUMfGz)#4WnOuy-+Ok4xyI zKfo2qoq9!&yz)j>gttQ>7lpLA>WS#U%fY1D)+navTMC}YTZwCY6q*%p=$TMr$f(s@ z&U7}$@ROxHD`b(ZNb}Q)D#e;FhPqfxe`#_(iZRJ<&e?fLsknIN+O_$i%`U&_V~<~P1MZ28J{+rw z5|$tMUSwT4*fot-*XvtK6ZM#NM~NaY(f)cs%gk{`U9Yl4gf4}PBOWITi1yUl+V(lL zy`8h=GJ?W1AK6;?miqkO&r9z>9VJoAok!9QLOA^NWA)-K<|Mpw?icV&Aaw4anr}E1 zoHS$_eZ(|cSa^1QfDKNH)K8SEtD{zR5J~4aG}CFE2r)-ltt>O+3^G6W<@fy;*Gt0H zEBBX5kr}&g81b{5^qIom5-T|*?=h+H+={5zEX>hIgWqP+LLi6ixa+iZkkJO( zLN!%Vemu&u+fq2=3{#|~)WiAaMYgBPd-qA~8QI!ReKVt+g*yL0%(@J%5o4YXrYyfV zC@5=1=B@G%Fd4_D%FOkYtzY?U;3IXMa;RS!E4~!d?Pt}}y)KkozTEFk9C^;uxclxi ze$>;KX&#E5pLMizhea6r6By~NSCr80zDhV28}6YFziX?5>~-0{!g7g;1#QXWW1#cy zAA+sPR**9ZYMHj=1A%oNxje{xCh3B*;Tyvv537vu71VuxR_V!@cm@>|TlR|(n{7Sr z!WfWUi<21cL081hwUUMfD%fM`Bp48#!QaMy01;O)Hhns+zTq{F-knRYUEk(rJt%Ll zFC?7gjM!5`Q=?`WO*C5@%&QBYS;{x*jP26(!%jSXNl=%-r?AyX>BYC_Vji1I?^P;u zb)~tlj7LNil_#0=B_EMn25ki=)T{A#Vo9U+dQJ+=^~8z*3}M7zinFQ<(E#>jLEKwi zRtkB(o3~_~HGD77^eB14>fCX^rC5i>;wSa3&!_C#eMKp3!@3Ce30f57s_YO$@-C0R zFzVJIW`8I6@T@2EcE)?j)YC}hc_>Owm}t?bv|G$y;O*(Axc_&L4ywvkzYZk}Y<=vx zIY!57er;uN`Ck98yU5AaTCoY&XC6B9^5r@!3*y5Nz5_)F!!GC*@9T9t*v~Ub7QVAa zJe`d^FWoQkeN6dL3{CrF38`7>E4xd6TLfWI0+V*8$?(X1@Ogo@lKK{1ay0=_dv6a% z+K!ld-{cQMJ-Q`JKcJBeHRL87{g|43RS%bxlJ~n2A6LP6P)4^o=s3$v2@ z#{| zoa7uVo6K_Jt}nhB3g+~6uZa%$zHB7smQjaXv zEoYs~ozRTnN?BHHk$g(ah!oSccb-2>={#iXRzj2Vg833I+>3%FM=y#nUMpapznN7>QC#I@~ z(k{U^*4ct&n)m{ERrApJvoU|K7=KkWh%cLx z1evBanL+K?qu@vyLCEuvb}m0Xsvg1=`dcHDv*pDx5?U5Coo_jsfEH>IQ&EcA`YGrw z$L*z6wVurG1c-^vL6|wlm860;ocEH6xnD!I#nn8^tBRvFqf%_}5puEnbnPVYPK)d^ zS1oo&{er7fw9i%mauU}aU~T176#1roY2Eb>D2arYRkl)&#~{O6N`r?TIh5=-pM)?W z-)Y(9g|7~MFsePS7zlr^wJv}?vBj$->LCY&TP_b1b1=U3piO^ZwSS7Cz|I-{lqHrS zY_Bxlo~>yM2z<2!`DOL<=SqM+YW!N}Rd;>?5&^u2_B8mTVfQB>_uWm;&>Tl{8a+R0 zAI!xM(%xx|$FmGSjU^_xL3;(vBvem7%?~G}96T2=01JQLBuMQH8boqwpsb7^;kaB5+lKPY?Hc2U=`;^IEq;v}qY(ZVlW#lBP|fTFYWxUW+W&-Z|YSvI4hC>oIth zSkJizxlm;w(<_lM;;LDueqXBV!9FrjJ$+zrEg72|*zEA4O^b;TQ;kzf53d=x)}xe5 z@!a71`@7F{QV>(Xfc9)MTv;aJiKy_16~9JLnIM`*^aIb+@0TgKmHcgAXERng7WEd~ zv>pXuzPK;mhX9V7@%C3Vsso!U{#eXMVv+Dc4iV${$h$V@SgTDEOb(FbM@t~Wwc~y1 zCYffMzP!p4OX*Mt*>HOe@A-)z`wji~Ouw*0UqMWNZ=Z_jzV|Md*r}IUR5<-kXWHc& zv$bqMry)%-P9c0V!_d!c%189-OlutUDkF!=lyN*t>^XC(h<2P4AXsxNf@;B|jA7`J z%*^dz-8UAC-Kk$!poJ`^@Nn&2%1oKhv*I~d!;EHk<&(TkZs)Tf$=Fl zW6-DjGPv3qD}%A@u?Z1z$q5X$B{T;Iy1!ZteHWRpM?8E4ojwzHu5D4}q(7UXH~m4m z9r0N^kovlg?CWaySKD$&FUDkJtdrQIeGTWQxkb$H&xIW3io4V`xNVG#6XH6M%mL(u z1z(M8=p~x=mL7OXYvlQLP+W?0g*Tr_Sf_tL(>$KNloBZ^V(s1;JOMK=Qab&uJsMwK zPFZ*L8ZcqEpN98$b$glyUZd=JdANA@MF?o_b>c9vHkkNZX&pvz;zzuhea5j zB`%-N1*)ad-6T`no`?a%2kCP1lkfD(-0nT$h!0G#AA5zb_0X)AP4eza8UIuF1DKfO zHM^$)QFHvJ?e^#SxcT||b6jY+kW9{_x@!c;w0#FrDIF|degn3IctFFKgum1UvsDj} z1)}>#$r6h*snBEFfNJ_%6@+wn!R9A*k9ON=kvwf+&Eg8F5?AKivv5oDfdq+QqAOM} zGFXxQ>50O&4Xuw&jvw&$@xGzt@LOgk$$4`*eOs%B8`pmhY>8`0_?Y8&O@5U47#kO1 z_1Q+L;EIIKu*~`!@q-awZoyw#AEc=^9=tr(Q(vYVZn0VHkdIvbEM;bXfGd3B#NX5* z^d8){YhVRUhG8>Bs)4$u7^(&R0WY@36GooZeW$IlV%1z+PH*`=?a(4%;U|#`#f)LKUebRuitwNl-l9ZnQ_INB2uzYU>j`ZGjp|C~Em+S_aVJ(y_SN(4W3N3i zk`(o;;5QI+X0Y9yNM47<7xULP2ReN@SKMR|60{Q&#rbuLZtXt#v^`Jf#ZG{NAH!Rq z8xxB(7Hq?$^r9*_PeJv;y-!wCL=*!F2!CG7S94`T0*#7-wlKP4$QoOVTVnbSaENh3 znaX>79>>O%wYC09S0#RrOqc?3lER|DI$Y%RCA(xF+JrT z+pCO($%B2e$JID76T6;=X#(kl+q>`XMGOwsVmmOH{)cT~73MEQ{;gJ&YlxCbidy-c>BbAXN$j{Z0OKaHid4>r^35^v9XSS#>~5Hq#__X{seJua>L zrO;`RdtiSD^{dhl1%2h+SGs1BIUkR-D?!(G5oX@OX5-xqG~9-j(Os#qpZZ!`WqHrH z@ni?@PGffXbIh*fPpkU-i6h%CAJRTt{S;dTbQi%*I!Obkx|iP*B?e<*?9g8`UpppZ zB|AN^1T61ka0u}O#cna$7!OWm%W^l%LAd=84l#XH>l=Ef{==%~2?X}JaKAYXN6CVR zZgWsb`FcHgt=Vg3zgfWVhGlhj#Zy0dN?qLHIjql-i^IR&moQkUz#@9zYc{;cbj+XQ znS1o+fO>kX^oagY{deXfc-;fH9p1f2v|+LHyht)H}qA!6WmRp7dwLSGWxvLw;Q%>6=q|B81Pu5%lBmH=ZEmSZ`vxR?=wJgd(v04eE!5R{x{b zb~mk$R4t7=J_O!nl>|{q5qD#=xXH*5&#U3D`_Vt@D8tbxZfVy8`rfntzAssVLyRwG zDs+Em;>IObo@Ej!DQrE41mBiVEEG~4F7Ll&=D{r*8HN^5dUre`0S~HuX)mB`FghRJ zzkEp?Ie6l_VM_m+UYXpA!;P$pdu#`Mmx{rlqU>&WN$v4$6sABBK8$1>FUWEI5+Kx5i}mEb!nrmv?0~pH2oM#I1%f=kk;Khh0v66zS)D( zt0)-bObjk-ksx?0Y5yc5mBOsQNx14g)w}rY0avMq1S>GGYzCXCS0}Lx_uf~v@8;!m zRD#qtQ-`|?q?o{u$ugEtN$`=BjFU-G{!c{RD5kBp(7Pk!ftL zx$la99k}{6qxUE%HO%a>T^bv)qd^v_=p~pRY1?Xt){GZB)7F#X4>RnHe1e8e{|^B7 zKnTBB1pi#*F{dRV4=-+t%6fF)V`vbX! z=lGkAWA;ODyGyD_?KYmEs06K?AEDVkW$JVcVekQ6&PBA{DNa~>{_Sv*W!_VX~1PDA;gZL8oI2{i2W5V20mR|~bZ^DJ!tWSgb zD)jXH()ACr#$b?z2`eC+;5{3pOJVBe7oRHvj~TOONgOYCD+7Tg8<=f#FN9`aL1>01 z#B)QTPysffhlv(8ad@Jsd#7upjoNjEwixK{y@wT&{dP~`^JWN2!wf)JhWznvP?F;`u59`bnp-TMxPK#*Fb;DI@+ zPVHJU2IoSc&HCGi2p`hzuaHv}wxqWH^PxTXAU4m~Ms&2VOiP5-s_|}^E7(jq>wn9L ze?Wt4mZWhLrVa#1RBo7x(}W!REX*$GL8{I|w^82x)7j|@)RQ8dZ-I!yDi^!9>J2;u|B zie}tM8B^fvgd0tv+Hy(@#R?a{B6d7*q zyW>)J)PF0~pYKJQAEFt=?=iQp!g`*isa|sj)A5>1gM#|!1jA11&yy&%(MBur4w>}> zpA(yK{nZy)&EzEa$bUW|_cSrnB5c$wUd zYH}Qu#=2_`HV%K0$7Cyvg8@A|A`fZ73G1LdHa7d4L9r3mETt7bQ*gKAjy15UwHT)_ z7Frr;FP5!qdnh?!jbqv3bPDF!p8bbmUWZT(7!{!CQyX*FN@(zZ&-D}D_bgl6<62?O z3(ft6|0JAZy5sH#K?f0d|FfReV3LOO|8%TnxHe$TDq)>qm8bHzKW((nh3S|wQ0N$Z zW4COblNgShEDvyP|Y`|==Xg3^d)?laH7BK1Gwu!GET zZCbecYx@rxJ_1_x_=Z6KKHb~flR3FclGNWPg%L>|5j7GD5Y!5$TL{Gnu2)z#3Ytq} zy(W!=7z$Cv45yH>w1!fn9cy6Lm+eXgky@Ddep$5|?-OpA*!SP{S6__hhx1c1hCpv5 z*0XX-8c{qo!S^P|!%WPVi?DtmJ)RKP`O@VL_)DSl{n#S9)aw#KyH%3APU;xE#xZ|D z!H5bQsLT+o%Sz*<1dxR7#;(7=o-oP0K9=((>y7s_G`8tVV?L<~vzjs_(L_wW@Z8hf zsTa0C+h*j$PbOLI`g?o4!xloTeb(&R$bqqpyj|K~1;IB2^eMM7>u>uG`%2n|-^jIV zp-*rMjPEe6>GPmcji8283P}%FR;y9>@fFFOX z{NP*cb0ui_*#ReydAe#L-q&+*f`lgvTVws*3MY4k0cgoP9^d(N9Dn>qWjpYjXeLfs zaQ)AZqOQ_De8(r9X>%Zi_6wsVoRZh4 z*QSK&4t9Xz2N43=Fn{U(9sU!h&J-aDFGF=)9AN1OPf+yWYzqD%D+fCuKYt$m=Fv}9 zo=38%B@~u(83Yx*AgCaz>iBSLhsF5~_{d(fYOSeP2ik7X0Gfm&n6&lH3A_k6yVG0&rJdS+vd8b1oXsw}bIi^|r>`j95 zDLwk0hL+#PxTFBtrMUj535Zcx_>=h2Et|mv2wtiQO=i>_Pr{zwyU>E*1*)x@AL?ym z2mGIgX4%`=m8Uxj_Op3xpLDyx{0oI96#h}rE=~wr>a@|`Z^*4uzipu9X*C`T%+t@m zWZruBW9ioxc-gl>`O@yGi05HA?$*qeSpnL3oQs`*t_=7Q)TU)q)3Vv&D4XTaUpj3+ zUuzFpOp6!)dK$03290)%XF4n=kQs{(@N;<+{^Vmd&wO5Lxl*venB8~Y$y|K?StKLj z5qFQo$Nh9!1fPBSNib2cyQJA4PoonrLj?^U>Fofajc2Ur7MG#<3l>4E_%=WVvOwzu z0n@e+Oj=iH9)99EGY;lNn4{?-2g(sk-#!-0YHuu*Hf2l;9C<$asOF9>?;Cg#cL1D{ zoG^(BBt`LMXMRuLms272=gwaUZ8B&>%Q$3zA1*mHopc-wfZ8pivFIjk9?S1=?d1@d zZ!bs-7cau)ledd$B5rKl*qw6^9mWar-hgqt5+5(jd&vc7L2G0uN#)Pi5NuGuLENek zhV$}fEq}=0MM_SWk`&U0`AhdbK2B8&jEkP*jylpbOODFZJklVPbpeiPa@<~h$$4T* zCL!eNY&D{JbRMO__~QwPqd~_yYyRNnSKdfAGh_Z*{#S9=z)PdYO3^z&qrJus)g1kV z5VWcLW4x|)o1c7!`wzZVJ_@Lj$!B=w&%elAO)e)Ka}><7pmD}UnY7ooA<+-wKI zvDTmbDd6wjf4Cgc-V&#k2K4DF<*+4H?htZyg;1Ag#F3jDk>{UziX4?C265-$1O!dN zv})0mQRb;ci;K_y87Jc+(0%rjc4T>oPc78%pfygo-Bn(YqkPpTt=QR=Fx|lbq%AQo zux>o{u^&uHyn*rf98ROKq$eKN+8lcD{z8&Cd|qCIDKGYazaAaTRuC4n@6uPsBZ`i1 z7;F>_=q5I6hd=;98r&diDw}%7^ci@wY;bA+Q`kU_+9o(oz9)`NQ-~=}3TaEqUpn%) z&c+i~Nc{vM@N5cyJ9Nb<1I~GH)K)zonoYY0X3l28ywG@T4)WbV!eifk-#q)mt5UZb z*ciP2%8L_|B!xJwP$=`$!o^Eun!e_W3*~)J+8^PV^P@NgMIsdBc4~LE%#AGn=rM2M znID6?AcV5;gShJU5FClKW%Zy9^Z5E|Xx4Lm!Hp$fYY)*(%wW-Cg`gZlvF^B7xjeL` ziLrR;a(On_-~*S7u%0*~Ul|)m+IT}?!BHbv7%{Nq7v-osQ6PLE|bloSj30X_(gaeg>+uH)S|G)W>t-7!`h zknijEI4Myb8xYL72pf3)v608mr3zb@Gkrzl+0x`DYd2`e^W+-G>80nNZ8v$6L1pL5 zN90{my=v0VsrTNWBp)DWXvPbN~AdwhMUPd3<5Nv22YSICV%OYq5`tz((>`)9XZ z_?|vPa%wtFus!zF^Pp8=4n6QMF#FJ&WIzZfHKFOf3hO#FtGVK$b4BZvTsgN7xdrzv z;N3<#au-c<{|&>`Xy-j6Y}f8E=fitOyel;KJn)#jkJy|yL;F?B;sM2WDS7Mv=DQ!6 zXRz+#{B!N)=bJimD$%!tQlkGA%#q#u;G@!~=bV0`m`-B+NGLxX2=jb2e+V+pQ7GFN z?}#PXl;xP~+r6C#Zdocin#AA_-Y??^cSCsuB|2R7R0;KYi(4AtQ}K#@7F zDGY{rFm5=Y!>+pIJX0U@GaWbk2Fo~r84;9*1?%hRB9+550Bi(WLNRY8*I}YnYn)Q>iq8yw@xT!{AFHiFD9c4L^y00yv zA&EwNS)9@v9B8x?Q*nv+I^LTv;CqIS8({4rV3daq;jg}#VD7_Mg)$xsT0S$~>0 zw9mI~4b7oGDGkN@WH!txvF39<9BbYT~j~#Z%L0Gf3lr+)}`3ti9u_jP7H*5Nrp+@@N8^X@8c{Ly?+d)?fVLduVnPxyjqSG>cx zDadhq=>=z+of|fgb|vOFSo7aA@-Z1VJ8X|ld7S>xma&v@qSU>^P|x*Pe{-{od6<6- zjPFj@U5P%ah>&fkhtVhF#@TmR`uUTS4O9|9Su4PF3+>OdUrFmNSywKlTD93DN%m|B2IP3G;?^YoI(R;GdxWJdXE& zPrV>d7By}J1l0uw_biTr_?1*;nSDk7Jh= z)uteWf|Nf){iVZDW@^K9;*n$w*)vXVi#qHf3mzU{W8~2OT~XiCfa8Iegj}@Hecz&7b#VgiOZ z)F!2%y#)G!4L{*Ry#`L&R^9p!! zxYKT;H9LcpVEhl^&i$PEm=G=J))2n&B294#EgQgZ&ag%%e(bqCVg0!f;eXc^$fNwp z!yN}rXi=m6R~n;7ra`E)N0h?=06+jqL_t)))x@&pnL2$sKJG_KpasmIP$OSx3%12! zxFZGaSWr?croCJy?1~luz=spfJP2e+=&#tUa&|V8@=);9rN=-ie}xKL#T#G=4nLM? zI)?SxxnVtX`9`$0IxnAFOICz9Tj!s#nLxgiuM4;mO6j z7;Ag&v70#$0#zofiLc#ps_5eL&lC=FL>l9|c~c7fk5I1O&%yr=2n#36*o5GS+N;S2 zvFjYx%9G&4Y+!ET}mQ_5n|$P#{5#$nLn{n*?f7An?~ql8m$yPvO<$AYX{*>1_Fc zzV$8$_C%9u9X5ra;f{~-=`&}-EYQQMGVx>2HAH&~+GP$aloL+}<8+$l^nl}p4`~Qyp?ytL5d&~) zMoc%k4BX6`fX%GOQNDH1nB7gZu31=`65yrCe9WkUz5@ieVI86U$6&mNv}`^K1#nsmCtUdcYYUS`O`-YdNCME4VT_|K;8SqqnvUUN zG;an$JLmsPAeh~4=Z2CdKR{@oY_d`Vw*v(Mnf@RZMkapjxoFZ8K?^o7`22Ug?lRbq zuO>N1U|#tJb2{&@*#q|E>24hSH?w&0QrP&%-8Uj!!rceh0D2AcCCA@Bdo{uR3Yag0 z=a2K{d3r1&5~W{5uQ?c>eef>x_385qQ#tny49<&~ouP!y0LQH8I6I zbB1AqLfSxnpd~0m!FjT&dn3(I;FJxMz8sJH6CTD`hTExLZFBXd=L>A>hmAof0?_mx z$22trZ|HcHOP32i`3?he_fFT@4RH|FQr&a^qcANsQ6ea47b400qc{%PQuV(M!A8+G zarYZ>0tXqI9e$uWt~CU!=>Mmldj%TTv*iATqg!Gg2meQ(d`@hPllBmpxsvCXWQutI zz4`737$>7-dK9IBJ)ks@w4E~%hloorI77^0*mB!Kw#O+ZZot*Vsm>19Uh1n9)WM!$ zqtFt9c3$QS;gOIJaD3%iR{SOWB|c|ZBNIRN67z+;oYD%~i>f~bi}zzK&F7#bpS%p|J;zJMmXo6E+R<3tQ?MU&n6XPqJ^8(4qdo5AOkLxCq728du= z$jT4bGPlZF1}B#4*Y>A$6WR_FVQxOqhPi08_w5$(2U{2J-Tx-6$CgV3wd5;Ts;EU3 z9G;>R6NI2i6HPR2sR;Lsgn72_u+fe*3LSZ$h&Y6wd2y6zy%YH~e4ibF?~I@s91WX+ z?2##G|FDb>M**OUsS~|ND7p-lwD1?qzhq34qqFDYeS)-0APnBEQ3ENDlH^G@ZrX73 znj59cUp8T(%t4yz`ZKRn?n1gKy>Y$-oaS%ik|bsn90G|8>VF+BLuFI&WK5w%J^%tOI9JhR|rI(-NvLk*Ob_=AjgdrISexA~v%A zU%{T(y$?NxF$vQsQ1Ri5pgKMZ(~g`v(yRtP;Ax_Qc6q4@()QRkVxEJ8dMp<2&p!XE zWTgh=%!N)`m}kzJUN=lG}^kO9azQj*i4O`;CRF&F^CB2|H^A) zQN|OST$X)tzZR33>k_ zHkz@Kl+X&>p9@MAwDaT#@jVX&0w*6O%k4soAO6JT_~Qp2%glVV+qnh{R4$rsO6=lV z5|%18F{mZO9o?STB;#oWbrvH(f8r@l2x)%x1;-g>BFQi7eb)T3$0lH zze4-39zWa?r~K8|_|W%h7Mk?Ewb9PPixvuwwMvRdlyUMaG|4Mh+QyniVF8opkF@(k zShZ041et_5Bt9VsDefjwCdF<}%m+FyQktdJFrc4+L!L|`6)8tu?1=Z4zp+}MPp zu$tzN_JzIYv!LO~@yC-Iyde3Y{q~0N@mRsrAKKS`?}LwVBzqw~keA@2g8F8>OmLB0 zZpms5!dyVJ6>0vW(T@HogQLcS`{Cm|<+MiXGg&@NAn+tzULH#AHJ0%MTuAr$lh4YS zYJT`Z<`^CwPn_friAa19k!t@i-#WarxPeBu4Qv?q5K|r&qdV-u|Mc?;y!%R;o8;aK zmIT^!5W-WCM-FX|Z7F6|#zNz;611Ft#fI#%gk2uW z)OPDFZO-?9{kl8K$rAQI9pnTci^~mhT8(tJgNdka9j=kIZaC4l0wxW3$=x7mQ7V5) z#Lu1g{?mLn3Fa>Vhk_$bS6{2e%eZ+VTeYh8WQwNK7aaTyzvCY`j*VmafO)@xKN)}s zl#`~>y7U|*ZQQWF+Q+r|hlvIv1S2TWErHn+p$#51jmP|zE5g)KFh)ZDaU*I@7SQr1 zF5S{)xFjAYLdc7!eR$#EG-_f0{XU7~5%TMCVuP-IH!HZ5P0|a`k+>JJF)4RiAavom zr(z!3#miX`cL(N6UT%v@+fA^9zs#3kV7>(39bgk*=1b_0GMTspD4<`C@yp?I4dzRG zhYQnfee9;^LJ9W3+(pw*l46sIm^d3DW{03v%lWqf-eI&m&H0&Qh?ll=oj85QESY~8 z8^6PpD@kS;D5ISGLvv)O!Gzuc*jS>5P)upd2|3a6+*`o4j+H=8QLFa=wSbv z!ZptBKjXyGLY$0X0oxvjQ%-W4$MRR((@cx%VUtB+gY(`txc{Li?LE_hj|?aqlFNO0 z`8mg74+`3$u?sM#OUNS4Luo`w$s`96;6D`iMbR9Zy`0j%ixfkBr7PwIF&4;@7i05o zgf#yfVE*Z6oCc#=v;mmk*#2=Pf{0Z8m5*Z3?;)3FuawKZ2jhg8I>q6=Ff{eTHI=hiM9H z8s`&gw6pztCYwVMjv^+JG#SE+v{_a$FGnD7RBYnOBDQM}w5z7}qM0_Fz9Kr;{Cq~4 zM)Gvz{{uGgX}g<9ybD8Er}%G3{Z-ITLVPCaOK~NPJLT%tg;K`p=-aYV2L0KT>+eqZ zE@GW(@T4y`QPlZrSx9-ZjMcE_FIRpmtVu9yq2N{p%C1d+T7fk`;wYf52h%&YLYC@= zuD`A6JgclzA8o;J3_6yG4?W*$G$F&2%JLmX;kBefRv;VrR--*!S1>2@%ZUJdcT+!fAmhbQ2kl6!#oUahu$HB%1u{P|AMer0aH<9XRU<3xe0 zc5OHQ($o{Oi1tuUoJ?{Mu?e2PV*WvUraC}UGRZ;2|9Jb4|8|Oub!VeJX+Lct^;69% zL7(QKG@hhnl7oofx&6JMJuF$kKUI?u3ve1SS4=7kgUH6q6uD^6>C$A=VV5bJkd1N3 z9sp84{u8IpLSmt5SkDUDB~xCa*@SG2XX~IM_~+!8ho~&V{_&7}P4i=#M+fWU<1|mJ zI*l`J|7umX_Zo>{OwF2)#(ggJKjSoLgwswpT^|0q67r&2O7?dX)j!Su-jR=*@%T`p zt-QX8W?2tt715N;?l?|6oz67JmGx=gbEmeJ10tO^YK; zOWJKqxqo4|`_1=0lzybG!(&@RV1-Vl=@<&yOO=A@nErmDpxOEHO*_Qw{|Y$KpqIT0 z&yT?qg=^gkTIewMk{H&ju-D9s5yOJg{0q$*FsnOd0N5VSg|oDl{LZ~#E&C;m?rvCJ|q~Y{OJp004!nuKApur zC8IN!9kM?zaI@teax-k6LZg(MEdwCn zqM$3M13j&OzVwj)2bjAa$GeFi9S8jdZE_OYL|h>*mVN?SuHQ=NBA5!>ZP!LFYdZ+% zd5rx)+^Ikz#`NhkMKDKGOy5nOY<6kTKul$PKK>gBcc4`ZP5Fdu+^r}t?fQ?yhS4XV zj+c+Fh`Sq`-`_&>lbxc%P|_HRi)m-Wdyn|=@8VZ7is-6zrsIV(kOaY7h#^N4$8&e;Oy zc=(Rtrqx~8ydpiee^;1lstWB?ZGXAQ_u_LUon(1Z^T|#cgJcf7i2l#$si*&|GuWE^)-3ox;mHGF#)<1myc5c8EbZ1L( z)J8jL9)1|^b2z${#M>Xszk8n{vN=VwPXjT|;vVtndV+~3CI(@XN1k<`>>!f09sr)wm0dv}L%x$bc&99w* z&MA5Mr}<^VuB37M>t)BRKTl!EWylUU0FwS6jtv1mCp-ye1^)?7LYAlHv4)$G_W8r3?3|WJqF4|Be!fi55SMHGXNYJ7@TE^cj~eZ~m2Ylbp6d!$h1+fC8A#x|DgkMDiX>WbaDa+cfU}{Le_vvL{fQC^-xjV;C*1; zEDsei*5LaOm!<<>H&att6AH1%`FZA?IVfKC`zP1?_f%{`ACzoD$CR?%vN3TE2?1$C z$Di%QG_5SRY)m>2!o~cH+aC{2`2P8F!W0fl(`4tmGCrd5mUmEP6S6Uz$M}l{?eYL5 z6C=y#X2u+am2~_hv%0Nds+t-UpFeCvG;b2G$&z3b+15((Kf-^)w3)(RG}<@g`p=v- z8%Nvkl@D?@-GvY$H-;^_p!NKKP1>KPKW5K?)&#Ne#=C(Z8_u3|a$Jcf9Dpwi6{g9X zksNZkpaU%!L=atr;`3+I_CIZL4!U`S3{zH$yTYuOWt$94gxHPbOpQP8pkINb)D0Wd zb;V<Xs2-479{bd5YT#m8^X6S!tP+$T0S`uQic2nUa~wwPA3-;Lc^j2K61r$jM7IM!SAQgp5p@o^MbH;S3=_s%`h4p059Uh ziCuZ{LHk>tY%k=|R(kj`*sz1{E#(YEEs>MoNz3bS3tmjiAIvO(Y{!Y^r{A{u+jV>&k$Au zh_hf2K|BqL&mTtF`FGxe1!f>@C9{o1qn&1SfRb;x~W7#EiS(G3Gv0{!1 zW102p1oIOVv@3s>o7mJ|Uk7b8y%aGVe+T2^XYQ4*Zp{bIH>pY){&`&5x{2C-_1rXP;;^H_hn|D}VIa;C>0%PY;IMCm8>r;T>#dj25}ZTUAp{1CyvUXI4YoB`sx z!H%=?XLh!OBEn-~8$n|sy z7RhO|Aw1P4iTv^WNyp}~rm8qE^U};cp&@QrprwG2=FfK+H$yqkI|4%2^A|>znJsS- z{BOYt2R?s9ybE~agUiL)kA=spBe)z#Mu2}!J$F#tP>w!|fDKH6g`16~5QNDrwl6lM(t;!6 z>HH_cVR_$|5F76~g_c5B$XXW3uZE~ZI@4##Zqs6og zOslbckNzJv=x{25RjCcl)M|J~GhW)7g@e=e594;jDa|G{ONF$_yf+J)@+2xJYnnF| zeECWEQ<;c&vhbubg}Tlq>9(A(TMyGWbLK9v8ts@DG&#hl#xK{uEMIM`p|8V5plQc< z=}oYwPXc@3#3@bPSX%a1?)P|QjAT0%rmqg#f8XRJFBCCQ!5etNBQ}^Uc0e5wI{qY< zZIh?}Z90BYPCC-!DWcc0xk;Ed+PA|-wWKp5wfXMh*-r#<-X0 zybFY;h01P`C^#T;Q?9>7n2qt_Y_yXp>kVf?`>PvVj6dKndnJiT18%PMf3w35w2C`G z(e~fa^|#ot$9jyHe)Ap10_9r&kUzh_L|Fr4i^Z39#q9YaXdi<4GN}>^3nDO`mCTnF zQych;aL-e}p|=X!&RBb1E~htKZYhHh1DSCA^&51nU6%v(0GwE-3!i^W0V74)qrlkq z!CaDdLf1xGFo<-g0 z?g`q!`G0dBf0&C<8+{<;QLsO8R1gZl0Da>?rKNsAC5{S00T`ff9H_L^2bGCaXW|z} zXknw>b$Hl70q({z4RR?h^>ZZIr~m=rJeXRb9ZH%KpgZf-wlIZ}XrJ2*Ie&RUi)0UQ8_L2nFCQTwp>C zFyBuJ0ph^vOIxx?95C_rvYQf(e6<3aHm6Ur;Q%236_@@?6tu&13|$-8-fVHip#rCW z#(nlB?BM@P%DfAXR$j`NbBgBeca4+KS!uq8^e9L^ z4}xU6ai5Jh4?p%apaQcCZgsv?g;B~E{%!Z%kBgUPNV&+fVZ-_Y3xTkJn#U&md%sFc z{e+sg(XOWh*p^8zr*P8+pmrE-7S@8WuU(Fh1l88rn}YVlCU#go(i77$`7}3D{Ar4Y zCTYq-AUh~Irk*ZS-f%)o?DZ~MD2qh3s~@uoLIIeU?s_E5gAHnai1Ha}1$*_aTQ-ey z#cT>8IKt(UIF`${;zwqDksQnui8devM{rKi4wx5t@sedO8mVnX?LOy}iTW-f{YV4| z0T`f1AWbsd0gZOn?LaK_Pdn+jD4hW@Gx5u6m_31@xJM^9ycALF=0l)LEwRCUX?|e+ z#-HY=Kk9YZXdgXBhF51^9t%NxeVuTz3hT8No$O_pwScX zQE2ad2vc2j*FxKOJdVeYdFwq1^W@O(&@BH=r)1R+GK5joB&1-IarOs((jAOakiy&W zk~h%~#yf)A`imEFvj=v``*np`iB+Z-%z`iq>-{yth?1U6enWGU`qk2`t zyA2d!2sGMxd0i6&pz< z3QCHZijO}1T!aXVArz<9X=#kTA;ATMqFtF>%-4-VA9q2TW#Uc%q5ik<6cgJ4j`Jmj zYy8F-gn7rF3JD4rfHp_=*9s{hXqUMwby_DxPiS?9sh(A0)k3Nz1y6TeiOoRG$7#+D@(5PJo zjapvrEEm}(sV_qC{Tc<|2=_#v&>TuQ{%*VLelumt42io5riqd+0d`R70F0RC2+V;! zZz{Ji%elCG{h8-SK_L2*Ij&7h^W00X%88XjaYqkNFmjAhTav;Yx|>Jb2W|Kt1U~0X zm`2&7vA|lCx8MI*E~aMWajkJdCIt5CtSJO&>SE(WHl#Em@w?$Up=mAmoaCsJTr5dJ zJ6!iJ*Fb2wjm@0{*CuSluhL3<)xM?am?79mE2{muX(8hPY_GmVFEo$K&=Ye!P12RX z`!O5`4lBjq#RJeJ8)rkEa0xF@VU))PAUB25?tzD&fZ+2R$;`V;bYqhDJv_^cno*Y%lL*7TwQ~1je89GrA!Z5M)sE{80XH% zi6EV;l!^KYGHsKugV1t2oYvw+x={gv`}tSjn31R}UGt`gm}A@}@e(DP#k?zvZ|tg7 zw#8|vt6};L>m0npD^)57K`}N#>6EYfHa1GKQ2{~#2IvCHWyi@HwMdQjB;!zgL(jqq zyiz4gV?zoXl7S-|Ct$6Jdns;cZ&Q)L_Fjd%NH{m^d>Le2e^Be9evmVcqDfFFL?E4) zgZE0ELV1iQt#}e0&R^Im!A-jU_8RTUNngt%^Gjtf-jl@j_h5Vz@!Ke;(@LrzAZ_US zTc3f@Tv$LZH<<9Ht^QfC)z7;j^dwDKq;4={##4~8fzPoUJb$|BLK8W>=VpBz?~kHV z96NL%-|;l}6VN1$kbe}46V``aejKHxet;QA1)%^8&^HcLTIvT>;;0}LfC2i(fl5pL zfJz({gaR-?-#AcdsUJ{@qk>QX2Iw0HDlPQ`Dsfa03cvt;<3Oba|4VL~!&lQWnq&zF zp#a=Cra>;HrGAd2O~u~|+5-j|!kU(&Fp?zkL81d4;3f?p6HOh;A@D=YBsxdb@4&A}{*QXv6f^qid=;N!YU<6TfZF2zuC!Lx7$XzcB=`>w9& zOyYuvrZxBy~?zknLZXtHw`zJf^yi{xec-kD2EI(>b zlqK%h3zy^KGQ-Fr121=^;Ep(aMyM&=s6I9U(AHX4PuRyPq(13}FvFpvjdp4S6X$4} zjydA6{27Fhr=~)x+O?{i>#v5{7dTC&Pt6dPe~&$IDImr~E+-c{;-i2X$X3t;EG3f4 zVC~^jdyak5U9^g9xBCnVsZSCiObx_^5bF91Y{S%qVU8$Ck@z6dfevuIe2m?!6O#vM z3_k1e$5M!C`HOv9Y73#SBRlef3j4MrVc!-SnjHVubd06(A5-!N-pV+AN@ERaXe9 zV^?S|6r`YCFBQ&FB*~M5zxF=`?JtiWE1lg5rei2*=h&lDa%wh!Hg-=q)(YBn{PDP` z6|_@Zm={y7#nE7Dw4WdXMILG8Oy7972G~42BPI+EeFoYKr^t*Kld3KCkiXgkSMwMt zA~qOiNMe@2rZX?GCI3bZ>X=!$B>5+3)$v%my&FPn=kC^v(4s78|mmm!@!<%>=%+A*Fyd78ZcXsU?Xp`qhtr$eB*PR+pGa6<3m zU|drWHw#C+MFUaq6A;#xzZ~_)C6p9a_UU##$Y%N57+9xHzS$?RCGmbKY#vx;`*Xv~*%-C=rTyKO56JwnqlkD714 znJ7gJHzuFLeEIhKA4&arLEo;88rWhbbZsE`mG~eLpxC#CS%EV6fak`ormD}}A*}Bo z7KQ@J61dP>+s<(cGq^}46eK#(0gjiCiTQWoCGR+GvgHaAYU<8`X@Zi_xTT<7v#M`t!^BeF4JoW= zaq5!V_{=P3qY~|Gt+w-ps8U9(10CR^d`y7m2*KnHpKq9)kQ19}MUpTx@{E1w1KGG> z{f}t-tMw;rWum zo7XdD%Cs5gHl9uZjeU7B^64i;Wl3`nDj}PABa-)DZJav04r`gv{kj$=z3|iteMR$P-720DSJn(dLb}IJXs;vth1e z-+j0Vl+a4>xc-{>{dB||b3E>9c@CSFtpBmt6gsl$!67-piGKoSnvf$(k|f?HawBat zP7Kq9?XOwYXF6fITpRBbcS4E@;w&aNqu<5$ z4_-UMq$V%A6(>av$_wy`XJ5jdK|I;P%b3r?DZ8Ddbpov4tiN37y#ecQ`yIAOibS)j z*jt0MeWHBTXG#e3&Y?LR2Tsr)rUn}>JoPB+3R1AHOAoxe*8GCJrR82Y&PSH5r=gJg z(kCC_n+Oq9v}60kPBDYn98r=g@j;>k9pLKfW8(S;ToN$E%pXk9pJM1nEd2~rpsYNo=*@~P>2SU9q0f{ ztq|v*q=FG8&e z+n@QWa%UDoA(~lHr=?b(@d~T2xLH5M2w}zCu=;DMl#=>)-H(ggzWW}#&d@&SX0;Ex z_ZKS+PU2Puz;4#S5C+k$Cy4?q62*binTFK*-oj@BhSArxD(3_=w= zYwckU#oIRJW(9cumYxwItO(im z7n2(hP?9b`rjNww0IjR?QcCJ8H4$8jMmw}FM9>~$Kr;lUV@Pbz#=An}{}d@xdj9DF zlM_GD1OYUcXzO1os83!B%cAmqnD4;9LvYFL$*|KKJH@mMVlL)lSBOmzT)c_RE(+Rd z%T?>BcuGNi#w+~)?0pBI9!1smBoLZ(5g|YdB^2p)v3EZU{$K|MMQoo6(wp=i1gu~| zK~X=&UMUtpK~b>~5RyPbZwk_D;Qr4!GtZebv-{p8S5leH&7StmoSn0?v-{4@&X5w@ zr5=%a>1>uxR>?_58^{N=5>CefRPsbv^S5DX1`i>(R zx$)UAouQdM9Sbq;zo(3l@>@RtGRLCKm-*k8KhJ9__mv@xj>CM6$d^&OK!2p8vj(1? ziO)=T#Aw6%{=-qBG8#ulo%piK(KAk@zC`5Dm5z3_3o`w}KD))KV>CbnfbzxAOEI$X z%~)7W@{>=ur2|ieVyC zsb4-5DKV}L{*OXOgUrue`{(Gj^(Kzjg%$hCLmeqH(PKIm^Vr{ZyR0psuXy$T^W0}| ziA7zv6-e6ZRNb>%Uw&QAg~}*Z`H?O6Kkxsy7hJ3( zM>+k)2I!>!-(7c>puXsbgg7l=__b)Z~R8gK2DTmmmHRKD;ZYMOz;)KW!tj+y4CD z_hb(COMx5}UV$k{-iQtnqVKp9pG6<{8MR5nZ%j7}%_{KpPxNu_g7uOkpK z<%ldymgm&<2+vCj*}C!PITq`l`(q>~Ixuj{)w#sq{D#*AxmM*xoqRbZ=U?jotMOv} zb@-BvTbz1BzVLWlrzwdY#@WBLmsd!83I8V@d#JTPSI@*$5vQK6W!BN4dwtZ(pHoXJ zoX-L6rLcPG_NW|KcTkg z`<~zLu6ysFXRUMAz3)HSE3;?MJbU&tGtcvx`8?B2^VQdgJ^WqZbgx{{@nobYx7rok zIcF)5b)Jsij}Mh%>G(y1Hr^IrfC<#&LjiuMQabDPm%dD)plTtW-XCSQOR_ug|(SQEvm}AIlJZ;b&f+BuVtr$q7w!sg-_LI!@jtF)o$2K(Ra1r{{blm<$rL z?;)V%TQCkK9wOxBdhIShJ9P3u=N7Rlj|dI(%CVe_R&;eAr~1*KzbtsHz+L$vLEIel$3tVVTC2 zo@3m~8wzeS72oi5MWW?B=h{I`$ReP7-5 z;IthX7HH8 z2;^g_17{!hwj-kKqXV)F%yM|vZ?(0!w)dFI#yZ@o>P}O3$F|-k7>%l{q|%}0P8AK1 z;2q#4d_p=7C5LGCx7wmkGr#h~IJ!03yqQ`HHALUYbSnXcT|TACzBzpoWl&U;tw!Nc zg_?B7iGnDgsdv>Ikvh@4aH7D+h=c|1s8@_0dmG-8!;Gg`8)(sZR zmu3pVGe*oogow9NGZH1K^kg|8Gp$w@c^hc4knKn|xUlHG<=)Q% zZ=+Gl-J0zamQKef>qeI_l(%Osl-s+uOts}v+_CGI^7O2~2Qg%+a6|Wd!M!HS>EP7$o4u6#6w;5`#FWFCmXMndJtow8KgOgdR8d;r z1Ayk;fR4-Ems%N;+Y6uIrmN8HqMnfR&XO4N6v~}rx+~s`WYSfpblWw*(FDSY19Tco zW5b_&l6CEvIRgueR~djmKYk>X_(F#ScZVl8*WahEavhdlzFzHg%;KlW< ze9=_8bWM_&vkAfTeyt`H>ERlgzZb_N&JGy&xBH%XS|_$>{d(W#n~B)6o8_tcZYkp$ z9qVZ>%}o9)`38lRXSu1`sG@RSjNE2CF&&ymcco9H;Q{sQAW1Om?(r@WojPG%ZOpUe z-B$y)GRJO4ay970VLBIykF)ofehQH&?F^Z~zchE-jz*B$o?QSEJ0n#i@l49OU0;p1 ziIADq2QivH)dfznc_&(4JKvngYz= z>r+nVfdGtSx6L10-QaBS=3qMbHZyx!$%=*dXgpM9x7Cyfaxq5dM#;6#$+no<8zEMq zp6K%8e#uEfsg;1-)pvrSz4ZK;pbvr9-RsMH-#ML!0YB17v-Jsc~1(yV^Qj|;k# zlnejTVvgK)D=cU|gQfA(MroKaNLO5w?jXYZIzUk#j_H=oj0t5 z|9aT@=WO>fD%YO#UgI;PK!!%T5@pR>|GbM9d^{hOu8BJOxEej>SlKKSct8q?b`=l6 zIzp(;k<}Mt8ZsLIpUifeqketRxe61TcxCv}lCpC>sA__hY63FrPH5pr1|0dRkUjpXCGGl_6&RZK$Y%S3k$K? zb!99NuvXS7IvP+vP~D8{$@C2QHZ%*gpC8hSCdc_+K<|!+GDcJtT6=!S1k6U)w-099 z72MmU&R$XvW;_l&1c=o`^VsGpZl=m+%)n*TXdLI2H|-B+*KdvC(r>Hoa##X@02tG4 zD5ikvvsa)~<-yRR6BTIolGLw-%r_cZ?$IW&bfKuBcV#0k&+iX4ut`%KR!lcn7LT(cUnXRl8GIeGW6&9sA=b6$=6m%>#<7tS7=!b(ePv&K?z=ra^5k+F z{R?^P(**3oQpo6;#$|^=hnJ9xgwxuQ%~Yi%jHmqFc925qPd_9Je|N-^>=srIF;zw4 zS33mfhp6;V2uhDa`;^xDkJZBWgTwpp+t-}>=0y8h+3+R!QZRIoUIui|B68xZQ-GZi<2a1#|I)P=(;Z>;}58&j6Gsqr_FrA@5uriuA|cD znLtvUg(qq-Mcs3PmB4XgPU_OgK{G&eu)J2pYP&Bb@0M^_>o ze{MjLD;s!F5vkttX^zqbwx?7aN6(XH958R%r^E;$j;m5FHk!9KfD|L>Aj!)#<|j zOHKU3lws6G^7VQ{i&IqeZMlk+PWRtlLe8DS-?zl(tqZ;j@4P3wn|KA3LZpS4)~+uT zzLng4UvyjdYC7ir>nGCGJ2n*=_*k4q6bjUzQ$$`)^=vH>!ux}Hr*1VeOh-xqeaOS; zc5YL$2T|g&jKORwBgZYsHXj(9dR9b0R33Z^z#j8-G{G*J%s*inPRdzsR!~!q9}NFG zWm*1yW>+_>Q@{o`z~?hV6f%uC=nv_id!k~Ffa zYMLdUrd_f-v3+!*XPHVV%sJ*oc1oJM4iVbjVCuE83r2hzUeR6SWX&z)=f-(H)bEQ| zZ*I;f(oeS|yaS6kA!AIox?!)0^;*Oe5L6jTDjMe=wXK2o<_3L7R)qmHK7{#a=iOnk z?q46JyuR3il%>)(8YuVEdp18!%<{~-2CT!4Xk*-BmIgOAvSZ%FkJh=%`dQ|{Y!sS# zuW|1}W+S|rpDAi~O!!YP-X-L#{8;tNyZdnX!FOC(GC)a2l~8qkgSnop%@XW-7%!Lk zsNg0f+42a!PaF8OWOVsh$Pti_Z;uXc3cs^W6Xvo=elFlAAGcrG>_*Y~G|pe+H_bzs zhY`>yUaG`Lgi~89=$~>=a$v zzP`jYst4`-%(#qh*F0i44!x+rSf=VsPd6XjE+>pA?_te3Tt+iRP~>DL49mw$-RJL! zX7r2X&@~vKaZ42t-f?mE;TrHT1FB61Eu77GmUKQ^V62q-^SiVJ{8}Hj@)c)gw&KkU z%+=?;H7D%>q-ctu$35>(<2M2_xHJoeX2#)728}&asDHA|mu4LAnuK+r=n`y_=N2tV z6UUNX&(N1%A`hm0o1YrqS{DRKab_})mCDtg>z6(i3w&2hapQ@P1L5^<%#kcp^p~gt zRJ6pLTi{8*ESsS00H`2`A7=SYBlqD+XpM(foJH`3ozd0S!UgnbMOonIiM_OodbT3;{dd+iKElawM6K*B&mt^Vc%+`FF&xR#ZezI@^sMeS zqaaFsFJ*{N*e&npTP7N`29;!w2p-UMd<3x8$>Z|rOUiMI3=9GvXl`tz3#x@?AL*>n zF}$_+zfP(jtj+>#>k8a>Afx!PL&fhgUjuS&DlQksS;tHg`->@@QsHTO{5MiC-a%k12fsFv9tBFAk9j=kl*E zmzhY7Rex4!E3ZFqamftZj%a%qHzxyR%38@|!5s}ypb<0R+9L*wW>NPix*Ssrj_9|) zslC%AXDdW6CgUmm3?9Jzo>sXwx?Vw{+Z7eRG0m7^=wK9FSF$jA$x1DWVFOPG?0kV{-9|3!;DtM5 z$JYsQZXK)Stn#pt06NwOl-pW~FUkEh20`PhK{y`B^uyvGQ=c# zw}--xr_7iUd-Ru)_dpW7G++@$yO_VBFBV}P1C8PFU?HjUMT&wy_-bZ1p9-3hp#Z#M zIbBBb2MaiT#DfAi6hyOA3BYuUoNRO5;el~{+1>6=?%2Uo#W8rEO;>+%_fO_-#swX~ zdMCYPi}Y51EMWxRkXv~v=5JhHZKIH^2&VyBk91y76~vbTC6$*G;w3!yc$iE9osm|B z#21(islIw{CHEjIkEAzDp?g)b?ZL-KYey(5bI}{FA(+0d_@71*X)Q5-P@Je#w&*I@ zb<&?Jy?M!MJ3j!DHH)D|kVkM7sNX~s6+QE!q}By0{vq)3G-Rl$*)ID}gty|KXP2uW zQHdUw!cwR8XCk5(K}}s-?C=BGsDv4eIPNux>_IQI#G%z6*B9Y2W)Nv)GDB&zQBd~j?N){<<6P4W_wiM+L6hi4EPw&tpE-pV12leCmIv;{Ch zbO#nCxqj5&xx}(a{cJynp6TpL9X|j@lR)}~NjC(RaXezTd*OevDD$tW}roLgd0}Yaj0CI=O2m z+6nis2eMxK{6Av>D75gV2EO&cDTr1mMbJd(pKog0q>{CF>7Cab zXxe;@1NP`QHE7x~j|S488Y>N%@v}YKzzjw|@l)j^ME6X$l0XWjSo(asHnKViAI2YJ zcC$Lu-;~wRe)EeD_ad9pZDcAy+9YMIr9JBHP! z*4mHn-6AtXdkN~O+i-0c;`;Bp zI7qIm$;>`hHgdX9P~VjU(7RGdmY@N2njgX|w(@HSy;)`$(^6aOrd6a!k`Qi;%NJqh zQwo*1+5KT1b=Q)b)2i^mi#GY8Q6I!${f+W@IyXEIgn}~%IQFTqxiMZetJEIT_1B`!20vfJ z;U3dIzYi+>-L#JdtnieRAze_@U~U$aj*{r~X zKw0_ylDKUiK&%Zb@A+60?r0^9(U`pj@+ibfYmY7mSp4vCfO;xiDGTOHKVW4pleGNq zv+M&Azw}+`JQB)9+5vJc;VVNAvARe}xdRK7Xd=QT<^Py54^I2c(ZCkfEH-_gl75a-TX&zLtt=D>6-N4Nl)>_g)(RD3g!ZM zBum1Fi@Ut;M*CsB1oe{5lxhd-XHr-wp6YPiSN|;UBXP-NbZv5~oyI#X@+lox;!jua zW0PmN5>;i%deyb*j#nG22~p3+B+TiPtKSv&t0Z``^1>ciUGIiI#(}U`$*#rxXOUdj z1$>$?TbDa@%XiYSCj(C*j`WK?jY%@^k!f)j+YeLKwqgw#pNzP<#997$LK5ndQK?uQ z)jpl_DW4K{)ltl#`GP{#2Ah;HP9gJ-kVbnAqf+uY=0mFH9EYXexrxB#q-FwZ)20c5 zq0|#7t_(t9pb4YCQGd$zEO^AZ8hIN$V1}yRl>pql&gO>z2J@@qqZb)$bv1C1!ws#+ zUcHE_5|7}Iao#ab6K6y=b@B5iFsg_N4lL1@g$x9!VYzbXu$>M<|Way|3+dzaGf>DUtEo!HF@#8TS1 z{}Li0wSs&iFZ#tQ#U%UF`gF7K&Qxf&Gh3$wOPV=HtbH26ce&`_i*Eq-59BIIDVF(T z+N`?HrZFRDgvcAc%`r^-nMUj>`?eE0TGi@^2R0W^?q-c#JGJ!*&WO};XLf<S&sT$qi!=xy z7Thg60r^TJ<8wj7(~eaGDh}W68y!n7OuQPte4`A zXDugC{r$Me@U@XBamIaRQz=A-$roW;;{Ch#Gs{um8K*+D3bIqbd?y57hX2msfHVZ2 z5=fFhb@reIbhQy1YK#)OLa1T2dOzl|@#|bCH&Z?e*9q$9giLf`_R`XA*X7Ddug#nY z7z0f6Fu_b+bm=D+Lnw?lnEG&j`65&eV-1MblGkF+9IG8uitwHgakaKul>jKJVI;>6Jl(Kg! zF_c&7ell}~vxwj}qCe-cf#M}rPNM8yQPM}7)kBX7Os4M(2K>T|>2@^0!mD<)G@5Wl zQi+Dac?U6R-I)Wc)pIIeNf+J7?Tm&%ao+KW=m<^A_1RXT8TVaflfUDO+XZ<|&xj-PLHcOQUg+96G!47bU zb5*^-#g9z65A;pP?^Wv}Faa#bHvNb;->}M82^uNPB@0mVxNZ&``ocg)E_QM?@H>sJ zX_oWX-)I3$jfnYcnGhN$gDuPvYt~m%R4QulDtG*N@JBz2_weR=cSM_t#)`!H*Lxj{ z=S%TT)owwI9(NyYVpvxWkAx7tva-sOmRK~zYIyR8#;;w0&uB8~!nY9MTgxwwr$}&u zA}Ech*XkSPeB!d^YG`tK$qy=}-s8b|4ZlAS^XmSzs&N6iK)gZM^ZsU^`c7_Oojzlg z1SN-r(B~K?kq3#7ro=L?E|q1k*yolq!0v`}j|5HKZmF+@Q_e4t#UpA)v;4txm4x?8 zSQT#gy+0OO(6y3I_W*`u^*MZGhTf&QEO!oy1rB%9gh;jV{Wus6rNOFFTs(`B3z~aV z_Aq6TVB?dW3Htce?Y8f@AJ`;#t5An&PU{x1Lx;!NP^KfmATsdrsF2WimAz9SpGJys zRH({Bxvw#i<6f7MZ^CIxRgk3VN3L(SE9~V;O#Y?7p$24tiyl2_Iz|I*gR;-;Zp8!x z7vam%0e`-Yl-LzO(3iH*Kst_0ejUH9U_nN2!=4#*gX!b1#@jD-1*Cvbstz{(KCQJ}3r-uFAV?AeEgoQS1c=FtQdTTZ`s`^ka+>%qqpx0BQntCjZK|SV0vfOU_ z%Z9Cq?B2CoRnC>Tevi=lv_=GT6iC#jEZzryc0^_ zoU#VE^hC)NXZVM27%l_D zs=cPRMrQ(O2I%&7lkH~RW$DGwd%d?ZIxNg{p{3(OnhWYNWG2v#3jxYttY{T>Jna%W zlGt8GUAL>L#5vr8^N+dxlZ*E%*~Sz69+~bfrzF#@OrI(c{APN8BXA(1 zqs;Dg?S21+>8_7efvsOiaWc<0a%Bi0j{}jr{<@2z!==2ke{5bnF#77&d1q=o!Np%) zNXNc|E^Cf6N?)lceb%+c>n&#Ms+C#q;QSZH-pR|TJ@I!FLg0uzBjs{9S zdj$j92|Gm$Akm;=+ynidC%hTVR=i4sBbC?$5bJvPhh#i)AP75ud8{5>J4ggM{1~h% zS^q*i^0T_95O!9t<@cww9)_336wzUo#us#|Xg&{vKhJTw5xbfguj8uwDd`kHdjGr< zk~^m6eJaJoWF`M++HlRmLP|y?t&|e8Ilew5oNpDb>LqPDPWZ zGV^qM90;v9zEcTij}3$0<}5%(m+T2Dpi+VH+1Wtb(MOd*4il@S&mlI6634K-LD>@A;dANqF#m_+4dwAPB5OUBDTj(D zd6?rYpUK*?I_#X~$xEkUdVH{iRS<#jy2Qp(^PxOqSr<+$CR(1j2|iaXfy6#1fZ)Qs zwc60AbPZw%S|w9rBUkrFF2V{|fTkRT{QJbirg!3R+v3 z-Hho$YEz8SqW*hxz7C9%P2CxzNt9Y<@$F@sT~HUC%sm9;ICFY**;od_!tVtJqldY0 zHYDI}Pjlxco19M<=P8h4y_U1v3!Rmn(qshcQxjJlBav6tW)yIy66S{Jl+Eb14blqc zCrLBt6p@MIwT+nyv1Mlcpq&BmH4W;(Lp3$PeKg5V9UY|_e6JtuCzKt7;qcENg)s>X z&U(BypTvwVq8lzQ9|}#`#*mEy(0QDSb4qhuzLni)=8p!$RVRnawICt@8PkPrIfA@o zS~H8#1qH}3>BmPo9~WTPJ(k|0dP`%fz31fu0i)zf z0IJ?z^3yI@*##+tnju_nAo#$j8MROI;|j>X4?IUf296ZEp!lOd&yM8d!)%ZrFVf}D z+M7^sYqHlDyhr4j7djB+Z(ztN6?GDb?!S@=ou!uH%( zR4N>GlpxPWLFOBpMWq8g#t_@llKax!#gQC)^QZY$BB2#70^$69%r2sbk(kAGLj>)IXZjB7&9#)Nik%aUQHPw zf#|w(4>$}2IKjq9n~RWu-HLi5HH-T>F%h!+F~CRWXs?yoy~!$nH{V4bh-mNh^1=np z-UnXj3GDSM=;Zg38-mG~3#?nR&`hKIRYfES>-fEGco1@vf6`sMc$B=B-cIf3JkK@b zSt%BgVrmmdsHv9Fd?hRtac)=M>F#Wag&9w0N)Ws$H(}MSv3UQ7vl>gIskx3$OSr7g z+nq(2Mc_{`+dV?=#>6_x;^&Kw#o3&`i<+hT8nr7<`w&N9*8P6n8gVPm1iKsQ){N6y z33Gw+;~ndTSzrw&KNTD7ne&Rmk{o$w0R}sYwk}pbA@rmCv$DdNU zh;BDa==+Uu1obXpXkurR(3cJ09;TE}0&Qv)1_q|Op}#|YhNw?DH!pMJ9E4?n4dGKv zs|3FH#ao(R9WMQ8IsaBcHGa<&=eG@^{@8pYx?R;Z{I^zLzVoQxCiM!FOLVl_Hv2g7 z(W)-4`mqsrlqnINe5Dn2Xh3>a?tYc$R|tOW?gH+PY&;>8P3C%WDrMQwaXe_{yeUekmQ5l1-f3T}ZkH;-;bDb8bp=7!FYF@sex+nUH(YSKW@C+{Ad_eS^Al%`bwp`a ziM1Xmd1K8!q7`I)2Bxj=rt{NtMn{b}TrKY`AE6FwT>`~SgV8B-jD3uWCU5H;e53ih zQs-5qy@JDeO)%Iba;ugJ3Yl<4620&*(xW=1i_2 zQnwBFnCBM_?6QMLHD&8b>-R7vOXdIU1W5bUQno12W9skl4lC;RVYVm2)1oNA- zw1ZoIUy!m)xoU%~J#pUBW1b-iEd9aw7*aBzrowKd9g5LI(Vx=VL}e5zQ|X&t4T_U3 zL!|SJH5~Ug)}7?;XqGem1aZHpG$)v#6JV%R0ex`d!wHga?@ZA?c>luo)Ab#)^g9NH zG|%g)0orhCXa$+Ea#U1e2Z7MD?CUivQKygk^e17xN3_1v&;ye5MJNmPtO@S!l$?Fm5J1~K5=YwsXGl*fMCUU#dr4*!*p!%UchiWcKlu(FLUgdAZ*C zw%6DSZdSzUeU}lmn-}x%DC&DwqP`b+Dtkw_w@*|Rk8%LGq~64#-s7}56ST+;K3wBg zF5@(`43MU@N5LimZ>%g=4%ELgIGKUMZXeTd0zCG`xu9U2H})@G{*H(ySIcuicN~=905cZ!cT^6**^jbd_rs+8Y7tdum~Ns|QI>sljWjghl2>6gS63k4>{3p2*>%y- zgQf<-k_lE)ORJPMFOXAv)%L6|1r*C~^z^s-n|E?6H+!i}z9lNKbG0iKytf@2$WpMo zRpwFK*->hh^LpS+J*Btjs2Ec9{7l zjU#iIu5kFTzx;yZwy*JL!x(WD#|e%mL~5xS8C6IwZ96)p#klps?tK%5# zNnowW2204@CTLDIPO@3+`viuHFtC1nZ>Cn!U+reC;#i^)_o@9?Wzm%Nthi9&2xM5P z@Ad0x9mi@XM!K=N(j>P3mZ9{-poUV2cBXFPGcSX3SgrTYIuRY&p7EQP|5S^a{7<$2 z|7&D-QLmxGNCFw;AmQC{0h_6$-GA%Dz>vTFKWb=rytrxKKt_Czo54SOmj*3aH_>O8ltJsaNlft=pyW`eFw4=HiW;&gBi`zO@io zK#cxOXcubUH41!XC38^r3E=*eTJAF)pO;#z&b?b6m#C-KUTmGt-Qu`P zxA#xs6x$qOvKG1dAPtvc17FmJPdMaz1*X-GR`3l10@@1nGHG={LE(iEvx=^ZFuwB!T+V^(byk#k%h)ln|IQPOGJFnYCR!~? zV=QF-Qg)zBMvY*^^=~oDmB19P$opXfO~>%?A#AYnr+!u8u;^z)+r&b}RxF%yUy)T^ zpt#|Wx$5JCvc?}O@7P4ht`|Sa=y3WV$lj>@C^1;|&Wm?kFM2Xdh8wj9zqfbQUEA^I zOXe!*Iz3f;V|YVdTPSq)rqv7Ac!kHqFa|1pPAs6Ut^XA9pSJklsTXXvMr5x<&B$Igo7p9)z}=Mp z>T$^bU5{_&345ulcNJ0^Z-JW(y$RB@(%ff|Jn!0WhF0Bt;(0QIhc3jv1O)X_%csbv z=i*2qqbD$BOceOllG>#d7c-1151hd^lGv)c4%L0wmMRl@N?=3#AdqSKU=`T6`&ISCZ5FP4FRa5wz_p!p zj_QukyVqG_r*QRWK5h=sq5`uw=e7(L4D$qKTRpsE)6hw{xmn+nxjZpVg;a|O!JTMYYveIb!bw;b5trU#0H{>^G|IpW#<`<9nnD<(uX8DGxki(NxGBv zDFIXgDF_dZ^?Wa1vLA~zMce-W*Mwmx6JJWe2gIwK(S*k|_;{ufZ;@36MedqMEdwVK ziT`?v59d{@cR-wD;3uP;Xj)4i&syINi%T7lZa?83MW`f3Ppt@c)n81*b(%PR%{S1D zs_uC4!e*!eurc@f&CxQcTsBpHgh6#c(esM%YZ#c`C{;JI1E-jKwnp1;)+jJg3;qoXGhobDcoW$+xK-9V^1 zQ-`6|mNfjizu>qMeNwW{fKopOCHt0R(>{Fp4o77+xh3xMoIO79goS3zOQg%t>f84_ zW27;nI!b=O)rzPAYN%1)>?93dZBSJazw#Q1B1Fg1zb6OU?q51iLz;2MS8K*ZRb z*S{$K);E@3o17n)`gbD7tK|WS;1n&i{T)jo4ei@P!EGCGK9fhS54F6RR1ORd$BDlf z@*(0Ur~X76(H2CK^j?~e)NN1fy~sO00&_Kub3G7Tyg5~t<^+|na1Nj zn)qYH_q3uKImu#$+T&gZcM>g1MxtmHEWXPlG(lIZH-8%E&Qihu_Uq$kpX>A8Yj*rmjGtlT@*(?fo>$2L^L({Bb6E?e2J%j-?pRArplZwx-Rt(;6|Lj|ba z2>beV&|DY+A4pRjGA-j$-Z@XbNv5rx)@nOakOE3dZ_?L|n>genrp?di4;ao;=7Ic2 z!2h)1{}vro#Zzw!m%VD9=1T_*n<{a}(HVr{drv?yKPR6Ez5@t(-^7J`M!V2O@n$cN zTnA_7JWN5-=l>pTe=!Nx@x=r@XH^CMnko?Q6ydoE+`ht=O?e<;^9!DupTRp?6cSz(uKeN8eKc(Xb^MBbsikaFA1x0sM-^yDjE!Hs&fQ?*(ObAyW zRA3$UH68II>&LKyI@wpdvvbR5S9S+bU+(h z&Y922Vvrb1k6%Ver7wN&xqEnjK*{K=TCnwy(VAo|;`GWsBdXL&NuDqI3;h)BYPQ_$ zlR@)(pa(YCgtp@i(t6sV@x>|G2EXb7jp)7#rONtxnH~H$s@|0IiOnWND3;nqY>77i->;(&STY)82T>u6Tx<&5y1ir; zdY85g8nu^JhW}MGbCd68!mc@4Br|0JUd|mP4a!9;!`bylEqJQJ()w5z`y^d?R>~?yc=M{ zeea(e6!P;2Fue8f_sieC?nobF!IofOahOu7Ui)~2_~d5Zr0kvBY-ySb(NN0kq<448 z?E`Q_tYa4fDv_y$W>7MG5X2n3%FG|g`ismIS&)Ge6&!=A)NS(P)SKQE*UM(QND11t z(3(O06qi_kvsm(hiep609i`GDEAJ@%;O0{FHDS5JB_)}8A!UYAW3X+BJs#1}qpSXiGQ?>tzulH2z6*}Q8%BcpOwV&`o%iggtqFwp>3`B6iX%HO4pCwPP~{m#Y#~QKd_rQ_45Ttv6&@bnmFA&R{7llwUP1`Q|hB@bwYc-OlsI(TpHi zq*YO>1wn7|9PhpzlPJWyG+qEnx@>0yGzRQ z`F-pQ{Hr!LCcgcvN;G3Q<%)bSc6>a7H4S-qs~5wBFsTI==CniR_vD%KRhKg>^~d8h zrhWe#rVL_vY0D!Sq|dCg<(}P78PL#cY~_$1eiNY->E&!i^A0GTUiymjQn~g}6!2N}fHWd<0y@UjKo4@-F2|35ko00=y+~XPP<@z_ahv|i8VR2SFOuuJ zdfbxQd<*-_9o{(n`YVXMLe8)EvIzC!^R<$@_Z5q(|Lx~xWM2I<)E3;aTaMc=t1rVl zaOW%rtc7h__z3LYz}xfXzdw+tHybOe{eFkBijsR^ub}1t&UsXJAKklSH{3|VXjGzt zGTJTqW+Qfi>n*hs?Vb>%Ms|M%M7(PakVwI?tqYDXgbadgGr}O9G{sW)L@TC1Yu=Mb ziu~hvbG-Hg!|OP2$ra7~W8qKykF_NFe{{vA3*obB|C6=lH3c}(y%E3>?iJS!Y8;Yf zI!l%Q`ueLyg(+VTpP5|7U~gTsH|~r*%}_{PhJ%Gx#6{dF_ zGDYXcm0E=z#e3A6JooS}{!D|j+LRvg*Bh37l;_spjvh5T59y4PAO=}(@b(z6Gq^OG zU;GL1iTO?Y=YuA{gKluJFJAp(>nw=JtEiEq)69ugGnmslvXE@9K&Nac8*XUD z>o7$&!tXz%vTYAT7n^h@suibE9emmhhkB$@^#4mhw|2p)bYKT#@*OYx8~nuNf}-$x zC*QUH;rnhEt*%Y%N7c_Gn+g3h1v=6H6#5x@^F@w=yTS_@#Tm+Y^&RFEW4*%|eA@)q z6r<07xV~p$+%K10#ftP`Y+s%nTCLoW6`%P?^-of9H;cB}%ppv-vV(D7d}LV6nC2?* zKqqwTRq4wwLgwO`;hXKEPPgzwip7@mQ5~C|ASH9uPD1#hvN-(s0Lea_DvZtrsUQ_jAKv&^+8`}YLAh9I8~4t4n{#1=hG3@L*}mpwa= zqSD#~inenAS%|+;1AKti#2xWxIZ7;G6+2m zAuz8B-AFa#aH{JTw&c~Z7G3o1{NCTQ%O*IOjs@0^p<#pkFrE0IDXW?e`m!qK`Wer) zqdmK~8QFLK9JHJq99_wpQ#n5?K{Elk_&6=-&YQB3wAPDT7GwVR61Xq@w!VaSY6iPG z58Vns66?b6bY>whaFZGhIGZxQEurilTZyZk>`*hmz;vwn!O&)n=WSOVU3fxph3Ina z_sFAy+*}&wUVGfI=&V3Ftj%Sj0FX63Heg(PX_1m*KvLz8j_%C%!E$1*BR>n-yh#rQ zBWp`4sFsfA3{pH+I6?UL^=Molg_2SoUL7>cmY>zW>h!eqKZDVCZ+ z%YCV-tcV#noIKN4~ zvb?$LmBf!1wS4E#Tu4Tt^9Sz=KV8hsFkLa;*TLYvH?dsuQM2a7i1`#Op^gvzdt~4 zhID+jPl8U&x#D}T@)E_XS=?URvc<1Ep%r5DPh0H58&sycy-$gANrB7rY>QHSC?22u zwk+K6Vd>&kng*cBdA->jKPVe9WXv^KZ^CZ)jpI*()v7jq->g&lq)m1VTe|(q!ca6eE`ptQ+H{fud z%Xxq+i2m|O5>LRNx17f1pQsIle0bHswwy?mHwV7x7!gR|U{lng8PNzP?E{`}+xLn( zNEOGeq$HCsCygNe3sMG2=qv84-kDxqjzkcR0HHJh7v>KqOhF*L!(<6_dDMZB<=Ml> zX#-RFDSCP{d;iHns(#_bEn`Re*%Fw2oS`xV* zm_jM`Kg6A>?yd}V?`~WqX%dSqy9a#ZF7TYdj0=3glE-|2ZA_VTT5Xj>`IPElw+lY| z;ZOWvq>;DbJQ|}7f{lQ!I^`*3KWOha*qbE`y2r;K(Dzg%l?YfqNJ_ggz2wTKq)Hf* z0~1^DIK=Ki4;N)3;?6{_SzTwtB3_N-#rx4?LlkK{(x_2m{FfUymtJBf`uv4!P94g2 z<<_WQv853}A+e)y(P;2I(e{y&L%g}AUb^7P<&i*~k;Y^piZcYy7D?Kq^5|@5on`?r z1}m85$U}R7dZjN_?*R%Kj8-EZvI%$}-r<|Ea&~m z1x&N)k+%%%Vu+h#cuFedf3Ww~QB{2Z!!L+Rr!)d0t%N9{)ImC>LpnsdrQ;~6G=hYH zfRso}=Rs0JI^@vZore?i41Rv`UH7@qz3cvQ?^@4Y-+x?qW@gWxJ$ui7*X#Yp?g_HG zBt87W+cfZaX*1*k-*1$S8jQN+B|RCt$@&fW%*XM9#2tg)cCQ}ZwHz=QYSIWdz;4Udzi6( z$Q~w)Jya;ic=h5PmTT?ta zEdNkWtK&Cv$0bR1Oh=5wHm^fnwE5MEpKiTLj~@2}P3`a37{|#BP@N|7H6yn@ z+%EPUv1fLp>RvyL3kgA-6o&1T^+ZwVOs$a2KzLeCwU(X~1_%udr*O(F{R+7t=?5!Z zhZX#uf*s_XT-^svB!mW!4WM&JOEL!w0z3kK_@%&CfKEOfhQ&Jej4Jv~*_WX8i__zm z=iL3_5+edH(qEnYS*aSw5Jmq9;*%fmDdyVbLZ-X4s);$S-D-P>3>YW~NO-ZujNTRB zTbbFVV+gz0zpS+=hj|1AK7WdwJrODo^y)Z$np!3=V)h~XaM?697cI~%XyC9X)M3hu z#>(=vY$Wi(wMsOc`FlRQc=d9>G05gB+li{!2lqH1YS>_7|Y%u$kNNk^Mlwpn1el9PM%k@-*P2 zocx>g4;s;z*87K4`UWg_y@tO$jgwiD9vH!NWMQ;expVuh2TxnCyeH$pR3by7`H?(d z{l;@>1I5!XnY~Vxgxe7-%ziEg-oerJvAEXAFIP}hZ=q$im?-=mrfm?^^&JKAGaLmb zz95-DY`F}Rw@%VOFR1)rRL%ZVX9Kl z^#Z6lbvM5;L(&o;nf(HM4s#;fKhkOiomwEbW-pSl4j(?U9!wd!gn%^Sl-M4v!UvTX z3#dWTM}YWxOHbgj9DjiG9};bZtVqRqYw6xqR&0WMToqU+W}byqYyAH@f!eUolPmhZ126Ed-H*dOi^MFe$un zDg(KkbA2&5+9>@}Mw8&9Aug|3tM5~l{Q*{CJ1yGB39FVnrN$Na+5#NvveEtTy|@SS z@Ev+qpdUX$pZ7rXF#Irg!>4=EE=w7`r=00v2ETLQ6xI8N2gw`|JqbyxU47dkNk3FP zqk=|Cio&5_oE1@ik*O&?c}E5`tzgw{>ram$%V;HYTuW;)M@=!1SV_D6+dxoPR9szj zKmG-J;b7RRqk~i;cuQH21oxncAu+83UE}$Y861L^PKW5Iv)Ebf{)-hf)tyi6nXu8OPoES(%%T z$OE%;Y}DBP4)2#Oxh>QPu@>4tIS32SxsGkGJ6E3x`EEVzui^mIyc;gKKQE@$lqNVC z{`ad;x4{h6rCs;}IXM9}&yxMedx&BQXw3$H^`|2x6?!#Ei%!nCbCjk+r!&v1YNemf zsmO!1(UI6+&aES%N%luqXaXt!ns+W6F5z<*_D_LPt7+3B-@dp8$En=ZDk4VMF9@fKqgVP`1 zisE@7%0%e0AO5V{Iz90U+We+^A%Jillf0!tq6{MyI=)&#WOr~z;O;~3l~j)sEDhs4 zy5X0)mtkg>3MQxQ(tw2e_JaY6uh?hao^bX^5T1P5`Q}15;>_97jB!Rz!P*6~u7cND z*C@@!`%)2PWoh3cZlT=!c^NiX)G?$_m+KD~(WGGlD!GZMLmajQ=gbaos$wEtdBi)&)Mbl)Kg+1yqu6TXT&wiQH=<5H{{%XYPdkDs zhwkWXb29nkRWU1G$oI64-{OWjaqBH}3O%H*yA!)z4!sG_QGBfkDP(AI00($|SRj4u z7$pMC{UIKu6yObYj*M;STHvE33=1ut0G!w8vbnc)Sl--u17cKOXd^B*&}HTMa0p9H zvydPsJ=>}_yY9*cd?TRrTq=(97hZA>j-3vk-_8n?ZU;S1b;m@*l%C(o8u3M66Z#cH zsR{5wQe&>~iInzuk@P0VW-9L{SU%)`YB<~yOd?O4_f(lirlu^ZiwgsSN=;sbYp#m4 z2GTSiK@v&n&KkD-Yl14TJ}N{c=~n&2WUT7DR$9IK!sfX3@3*nLQw_!ji=ZY%RMU0} zO`@4FOlh{?t`^_)x*38-7eF!vIQrboonqJN=LabF>XIUPY4!p)tAp+Wc?B(2ND+(H zQ(h}o6Ev7FmJicmCipW4cb87D{r)!rYV;9oWe^BujYCFH#>WU7iv(;29`MO<_SP@a z2B6bXbkV2XclRDM_8p~?+=|$$&2b%G;@lJ{ul~xj_<(UQWC)lRRY1C6(@~uxp03+6 zr?1<3KkIw$2lz9;k@e9L&7Eq`*r6RUMe0Kpp&*yrL8C6Fjqd+i0h$UWkAM1o@gZlQ zDs^-djQ+7?r*6XAylg!qi;Zj{Y2S2zv#ElMN{HBvp*#)6(F!`Bf?ZGPF(+DL*sG`5 ztnjptFTQ3}-@Bp!|L(EariFaXTuTAB87;?#235wYmgEoxc3-BzcAJrrARF2cIkPxO zFe6gx6^$Oj&wf1L4?ne3c&TdTzwADuN&iG**9F){+d^l&Ton1ex{6tDeyLqmWM8so z*oA!6rq2@Oi1yzEQ}Yg3pjcZG%x^%KLcUk+)ke7{bc=hT3=}-F(agQ*@){V$J1>B4 zyt5Xm-UJFCF8-K9r&rB3^?`q}ls!bQ1hm&9$+@V-`27|0t8H4}?rD&rLarp?n4V?< zk9?4BltV4OmUJt0+%KZEe^d33*{9)K1%1`Mxb>)s_P>xLhDE3-^&q9>mRl~U z3e8>)^?YKa+N$!4ZMffp_k)-VI;oHf@=Y%#dW;i-m@Z+6WTVQqO`4N;ei4f`9iSh% z(`}`_Mnk0>0EDmYIPeo;*E*T8c=x6&c;{@ZZ`>(3A^9;!#-85~TwD9c#WUzqbK>PPup#NSOHXw_LXP;C zs#u%Ar(Up-W2{%EY5wUD(W|8)99N!?9k&hco=g^0x|q#$!-1Q0lDL(hvE0+ki#a9@mX_d!t7Ms`Q6f}MOAXdzsoCzJG;lOS75uURr(g!Kbv zal$QM%3l;)#f0yux8wv;jIPPG2S6nETXGKMe*hA9s1-r{_D0nwnZZQn$Z7F&F*|%l+f_R(}{Wneg>% z-r-v!4VyN{`s){3b49Ze4k`fGZYak@&?x^R0G9VEW_@E%RftTllCOmPhc?IJPf`N2$ zL8+>YPX-X+Dh~3UcR6dHwYeY-t(>^K7l^SQzp#pvEXX|eKS-uF`rY;wtFfL-{(XPI zQN(T?(%1yZdUobu(Oom;fYW%u#7v+Lz1sFNCE&bIbO>F8ldQ!e<;pMSx zmS|%xQnwB$c>p_K0&L+3mkrnkX39wafwi;V?K#HpS4ZXu+n9tgGeT z6x}8aN`&1rV>ZOHXB^Hv{`GGh|3r2Tq@J>ow^K^Z0ZLc?*Ls6evkClZ?8Pn$SIEr` z>~K~k|Qx8wJ5%F;7+SW0MGm{-G_b-&8aEW%K-i&y7-rzJL>U@K@(bga!`Vm9fGz zp~(vy;HJ|PhGh2PDtW7kjIcNja={-v^R6Cv85?UeEs4T-M=0&|=;mx?A^ODERNO1a zRsoR>Gs+;p!E(wUgN9af8C%>!VC{j6d4H&ZTUg3flW@%~fQwIAcD z0)11Mw9EM17qTYx`f+j!ZB6Z&esGcY@vSFVYT7-`C%l>G3ZjGg%__V?9Cy7#qiwzE zhCi&6@h%{b_}dSFLz_|+{(zrV?MAhMEyuS#dp)B2jL|BdSI@-N}x;u4mzd$|% zl<%kk(8+-$I@>*62DXy#5)K_|DSa+UyQZ^V^HaWX{hw*Y3Q+|y zo($3MmpN(_pYoCg(rmNSlJs8Rv9|etf;I-vM{w(rh+6)b=g~6=LbzT&9~EH4CZXnQ z-i%v{fJo33F5;_C z*B({t>-^^&Y8o>#l^S^~6^2{wzm-xiP_;Ah zukm_N8HdL-E_d`y?c_MBRw&oydEkCGWQHt}9jqm4nQ zKSFP(Ey*-3-U|2X?7>MwvnXVc?Kd0*{q|T6b+eetT%b!fdQGPW9s6AuUY?17rWV+Q z9pb-K73R?9@rEF}e3wLMOiOBOD%-Z27FtaV0&5DlXNDwEG_9z!M`(IMIM*C6NWdr*bY9LUD|ys%oNV;o$-mz1#ZRU%Pz1^iv}-PTM#AruA!Jo_GjR8)rvnqg z$iNi1s>wU%k<~!8ZUGIXmGHw?^B%Rft|Cbo&e@IeH-2agz z{lUQ6H@IzJsiF(wrR;xf1&2$el{)aSC$oyZ#r|nUZ=P_)a9+ z1cpFbJ~BzIE_JdrvyjO)u=<4~VZn+1qw#=Qc~0d(m}2>*QB)aB5JMnsB?y z`?}(orUL*kw-&gx>H75o^=s3Ut`u_Wa}Fesns*}ocDkFjmK|Oj)4V|R(TO_6eUCR4 z-DUPCA`)%s0{vwUVd?=lL3*aQ1Xp?pd#p{Io<#iAU~iZ@5&k?6b=1{oN=LLW|7IRc zK7FQQ`e)VPNLUli6L#wbvoGz&ExWo|qNp6pZCZ~MT98&LGJoZ!JqSt@eMr2Tq$TDQ z;7JB(8pnFetZ8LLv2iXi&{P)H6-j}6JZs|wCKhnA_-z-KC>kIvy0T_qC+f2R)|v3y z{LWi2=&SSk_0qVI@HPDFS>z!6FYxc=i_E+K0{>>hKF9nE{9B{Vsqo+LQ){FA^}oQs zc6;N!|20h%!p9NC)Bghh8j5+k{|j^MiLw9pZU2L?{{Li<|DkX<9~Ma@yQ_92<*ViW zC(%9UsCMW2l@t0kIL4koNcXA#s@eiUb3`ny5?kQ{|mt#MTpof|Je+Z zMDnjZ1^Qv%5LwY9({;064@vyF0#wt9p*H4n=#p_&Fs&%FCdpLK0vG(Ty-87oa9ClRc1dyqF>`Vev6BXEAj@(-HGo`HKm5dPBoq` zJM*5wAvtf2r0zbInnY)9tV;CuB3mwQ=+oJ|FZK8KD!p)j3>KiD9y&>imjudVeSVt+ z&cTijH&Pz_sQA{5M?KeMUWs~}wWn>2y<+`68WJXtWX1%yfUdVj5lWs20G#!`aB-(!lU}+sgW=k?ZkPqwYiRZtlimrj9v(fOUV+pXqQ*M(bA< zJJZ8G&r=I$va;};=1C)O#yoF+SJg4m)#j+V%MZ-UvFGdiJk!xRko&1>fXG%yTt$v+ z3{q;}LBx%E(S0vP?&a=kW7%YvN7Cw*;7&;GfaDId!|)a-v)Sy3qz#HahN3Di(M>mP z(c!Z2jq>w!j+3m!;@Rr&itU?@oJ%Ze)YGhSbMxqwQ5O52RPp050 zT(AMXb{^3fKVxP~(11pKdF~%M{>ie%3`N{}`d^dTg zfS1FEK`W(obAKvb8j|a)TD1#F%D~t?)^FWR!IM}Ml##k(w~+yTlp;6MaS|&nD(4#= z8rhFh9TZu9ZG1u%twE?s+hS!TjcRSV^$~BjE515}Ym=OWK$EbJFNt@dPFK9fM(wA% zC2(QcK`0;KGLK>{{W&rrMU0E>|LJys2NLN14YB%AsDZ~#)$^>(S8hbq;nYyvlqF!B|4IHfslGiwsZW1T>ibRXgd3Coq@}!8>~&8!_^sl*PO+yq;wkj&le7@u85KX>yQg*U zh$I#(uak-|U#Ha`SBo9*J*8rE2rCx1TbK&>r*il^oqsp=@3H#-%Vc;vA3*d;o=N7D z_0;rD3VR^;??U=|y^ub5yWYIVUgpZ3f2=DOADq3uP0Oqp;x~Fz|BlN0GVFWZ>|{Z~ z!gg}+L-m)k7S{!U1gnLg$9{o6M4yyWvruwZ=lu)~rs zb=ixCY#2;%Y&j5oyqSW`ngv!dg^fo#mVrAtDc48U_o429(X_#6gY)xa6I$pc?E_@k ze({O@+#j3JAQ`uX;iJ0hVduxRZCHwxMk(trT_=}1eo(zTU+4Cj_PZ+Yeq`I%kyuraoR)Smd4o&g z7k9wjGLM=|6ekBfk?dw068!1CgVw{P2RDq8!mLyYd>6XylJs_T|EH5YFf0U3+Fb6% zWM9Bbm9|?h6dX_m-ZHc&s-nlwpHB$c^X%K=es@SAna4RjNre6!H%NmfLrs1t zGJSWwsT#=gt)?NAy6~!K&rU0aIAzDI4BCL1R{Q>^nciNAcxk$9TzzjAQ=-!>xC_pZ z|CmOpn8$CiD;RGth99zNLuvwt$JgAp6KBkvp$+IXY6`Fiw{hxO#CylpotOnZeKW3B z&r`0C7KGh=gjM?!%NbAo@qcytS_l#;pILY`V%x*GClr?xB-RR43`-I^sa}w&iV+cy z3O7=|U??QW%T^L!;^JE$UEvcb2z_*pL--!}CQvULPQPcOCrc4yY#EG`RDhaE0JzQt zy;;U?D{_M|Xm54!xX4NFF2rAD^)s(={+8sH(%xZB)mpvE+JSJs3R8NZaJ}$lez(EG z0x^k5X!XJ@AcLobThL-?SxD)N>R&Nq0*)`u-jFM8#BV@+F^Sjzq-?-^F>za-v~17x zF5g*RDvE~_R3NwOMc0j<0wnZ%pDi+#dh9$x$NB&Cn$uSZX}@7VsYSZZEcji zyQG`4goEmi%h@SB7+KB;YpETje6pkU>Ue#-y0W=B++#HIc(Vl+5BYK@_MDIm!B`p( z;-ZXMUlrYY5pwh3vEkf&EsO;ZEC0CumymR_;o`qf{r3p`dj$UPM&SL*gn+U4o~doM zLK%7F_^mwh6!AV=Pou%esOQ?MtMoaFGdD43mMA_Miu@&`M5z_dTWrpbGHgB^x8HYv zNu4|m9x&T>c_XcA%p?fwKG<1@`0X|+s&0& zI`K>azqeXj`C;_E8&{+sviCfs#3sAK7Bh8V0>}qO3I z@TXB+1vjawg44I84@srSW85NK*|Wnt@2@jLCu}#YzS-fVK~N!-JYvrcJDdBV>t>2= zkz&`f$&KDKbxHgZMb!>4vi&Cni!czd`H_Hxy$XKSN9M$m0+CcIRaEWjJ%e2ulOE$s zIRp0zSmQKYl%CcEe8uYA4uia(A4}-d`EH6DYsDo%&kpL||Ns0V`hw54$BDCTJE0`|#{U z|D|Eh`%q$Ose^TXwPaX|jP^Dx!LbZ#m{Ou4TYZ})+xsMiV+z6_VGLMGXev5=(x`5U zJ0o?)N`l|JdFqTAUA@{^i{CLT;Up+3rHHJ(sKj8Cywzd|eLMf#?6Wb@eAgWvbtcPF zqbogfE;$Kl!`845AscQ&s3h)WrGV3-@(Wj9tuhyUzUK<}DVDO+Kb?0+pSb@zctXObG zf~M&5H(=LdgaSGZwxE+HRVvY!M&p>T@=d)u19rRqy0Vk%OPe$-XWB*q_RYkWEK3l2 z`aM-$5!>o9TY?GdS6iG{a^GZ^SBj2=--odQpSEs~=2fd&qUZ}Kvglnxej!LhK2udF zD?05Ix}HYGUls963eDe6Sj$>7Q+-f9I6O)Jwf0Q=>6M%!dYt<26<|gKm@!b@aMQ@> zJ^W_})(F3Jw~^G*^$lh*?#TYV@>xf4sef>789k*W?)xV2eHM_46_OTwKMQ~>;{rx} z&RdW#s0fPr;rVQT?{>Yuc-k;Fm&N0@-bboye};gF;6>lEC%zHMsH8HBHT zCW#Ic%-4kDRI0$sL8gEudzR`+DT0t~mR?irbIyNqUr#3_Pg$yo9FyBEoy#bFP#bAx zn_^BZZ@8lwRT)iKPmcM7qK~eg%%x65Oex;$hvqneQl!j{HF;yN2m%xEEc{M#tdVv& zpnShSjjKuKg}sEmz`Lh6?)4$ep7tylW8$S6C{pHfIHvr@EpNEp1WP_c%RsOlW%R)A z|KtFu2YovD17bQjFAYWn{}hdbS4A6B4O~wWn$a`asEUgnOe{1GHmp51_VB1Sx2`$bNn~IPc97yso|v(3~HXi(}S~_~W3Xx;a(S zS)Y)AG%Z!~*1m)-8Jm9LA5jl{8iR(J*-nutHQomjzee}J z4R5x~?#{3Mz%ECZf=%o@CKaRN)cKe|zsL3a7?pQ*#0^pj;btPIvDD8R^eJ#EQzmOX zBHLf-x9yGX(+#we+~|hmMTp1i$Av5NxKHPS= zy3rk#$j5v*^v4D7z_vM(DXoof3$Ci+2=UdZ@o@Lm|NBP&dk&pBDT7?hxsPYGAL4yX z|64UHducmkdwrik6O?w$d7Eu*22Q@2kMJork(5DtZ0dBWzENMW?k(kjn=axwv~L@h zA@uq^<16Y1wxo11Be%wz7Y|s=&Gp{(p;)jJqR3x>whw*qL#U1~JMHVMliR7TNF0cT zLuMJ3s!Z}uH@}?Nk;?-iL+dB|-W}haKuSt3nx*OoQAIvaJQddwdGisGIo4w+USxW$ z=6!Bs#XkngKcw`tI~5MQpS;D!3t;6qsr&IL*u~%v@h!5yC;vdPOc(=W!ZZ#FPJ1fc z3}qjeS;^D>+@O7H41o1e_eeeO)xM|XGfb`Iv3^%3^&xIC#s=)qrM&98i?zkgg^CIW zf_pwIbZuC#5HjC=QED^BC5$yS{P~Xc%8_xhuPi|e3)l{bdqT$F{kgA|x@UWdH#Zz{W-n;o$?B}vXR4eyVn1u`CnqP8zU~y zhoENk&-AXw_v>>rJxm;QIPAyNEoyiJ39iqcKy5)|<(`uyivos2D3 zZ=fuFIoZwczxcCnJlaqtw#FmQjs!J$A0jIHubR0ncosO5I=4E^g|lM{B4IQ#+0u?_ zus2Vhvtg&k9GbwpxN`{rMEg8(?@5F%-dvlIpxa)c! z2``}(6ZH5pv4`17Qm&uuVKs%1p}1XXR(Pg|Sm5LWV&QF;;GYct4>9vzk^!Pk+& z4y77s2G>Yj&c_k^UdBDi-jfg*fyMJR$jJr8uj9H9jWS^OhdVOP)6(<|b}a&vvd1GA z{!He{uVOeaV5zb@;-VL@csUlL1^rYendgNB=#d>>s(Kc5;7#h1rx9u&W*!7)jO#)#8sAR;UWKwBfY#|cI}))+Ir zb7OCDoKJkB$ZH?CM+!JZBBa6I}MN@el&^aec7{%As zXf`S)Y9SaRjvgs|thJ%Xzi*qhfZ|SV_zkS8Lp*p5Yh8Iii_kR4F9~l(vn9WL?yR{G zih43F{9C|7F8n)+O8?HIn1>rc(*)+FmE)&hYgzq3lOSg8Dr*MZrI(F`|9Y6vFz4Gn zUO(O1>1S;4T0^;>u_}c{$gTZj{Axf~c2uB)-`ra->@Ek7vF9y55a)UDkD4>od;l$x zN7hw>X^vtmU%oPXHAl_oS5J@>eq?%Cv(XZ1PJE!3#9Hl4I3xy2VXY4tZkt%=%pF%B zHm_v8u;v}YgCXaAye|St8_9Ef>g~n~l(>&GT$QX7|oLbkb=l_~k9- zv8|TFbVQ+?@`zBqkpcBLPot;(W^5WPA3?1~quu3t=}oh+Uq8+771FCv_uTmKcg#_B zIMHF&rz1H9uHUHq=H)k_X|PWo55zq4Zwwx*?{MVluu#Z_8>aRE^p$G}5qpJwz*6K+ zwtL7AXF?k62O14%-<(j;9tSFb;^P~L4e2R>1XM}6Qaq;&*iXaZDZa9DHu~>I9}yZM zQ^LHO95(Lsl~C1aYu)|G>pSVkP|4j**p2!aU-hH!CzT{w#Xdc+?X~@FvdMFQ@yWfk z=x6MYf0tf7>13*gu_5SBpaBbGGP{kbd_|Aq@OE2w&dYk@gpb~Y0~^`}^$aep{SuH} zYY~Ta)n1~t1gz>Zk%CwB}NQZJY{U z2zCb4mZ0GKX-F|;jPY6`HSe`zN?qJ*?3i>ub1tUV{7Tk}jW*LhHrpqc?$R=6DTbD} zNKS%LcvgyYJl<_X&~0j$5zE+~terAgSK#qhkMo(XzK4-hLs1e!gcmU6vEMj{fQdQP z#m`C@&fv6D1!@j;Q_f;Ve?l_XATDbMoO}%cx-1T&qw0G&(jy=~)qn#%(w_R!WjT5~ zeH2rmmbG8jf_Xhf^vR(rM#QzaY?RK;EqiRbNOliO{o`mTPqnRJH48h?+35?fV|_r> zvHGpT6oqK%b%7ZfO_7eeJ5_c4Br}adjh@&^{R>IWxEt9hGsb6diPJyY_giF0;iSq| zU0aStTF0#JuR|X!y;l=ZTLL^wAklOe;rz_ZO#x=a4$d0V#OT#CFaUveZ@+#6oBwISyWo(Q-g^^sUSPbU zMky?`(~g@JEOO=>hrG<~b^fF)+Q{tmBj-v{_!T-g^r+zp?4ubfKn_7;`OuBk3o`*r z$TjsQ6~ChGu6VuQX12dV-P8CRwW?lJ(2xm34546|$IuUid*5Dyj`%b=BJJ_VMW(H> zM=9&+20*jCKlhU#rVbu#(+((3a_Qx7#QG~OWJk=;&KciWo|PHV@Kif|n0%dcJ8_lU zZ9IPaDNSxxKZH1X z)49AKQ#bDh!V`H86ZRh}{*Xs{^Q}QHXQSq9veex?e`kmt)w9lhbTTTmHcSGV?sPY) z@HJ_1tcnW^Z`8Bq@emwvq(HeeaM;{9NMv;03eC$Z=Fp5K(+9(!_NB5Zf?l9W)qL?~ zh5?{m1+&}TvbNwAKYL6_BxISwSm!?DR3jIIW#1{&De@E;F#lNCshNmQ(!&|*K`po) zgzPf~JgNeA#&)<)6ZX~(FfB-8_a`<3t`AGAgLeW4%4OC+@^HpVQM{#hxxa3Oc>*<~ zRNDh&p3~n;uv>QB4^{zo=Y39`>hNAR>9P$n%-s_Ls8r2^> zS>aJit{Dv}`C;O>N?#}xoUYq*N9K~XP8`Gb%8;{xq~;-1XWxMjJ@sBH&>{U;jwC?A z;PM%Imr%oLdv?;udD&~uSL}nzcSp5bCyw)3k46F!Yl2g?P7HOF>mfOQBJW^v0vHaS zI|_N4-@2QEf$^fT*-%oB$P!VnHh~o7C512H20OEKXuk&GQX{3gVq%jRB?FFF!z=KS zTP*=-*TfX~_4#?5NKF8+!C7!FX12KVnjwxqD7_Ch#2qr1GFCu?mM?)8UhI6Rc{@qr zuZwO%!bls$1UB-SC6O)0*l+g7M;N_VSz4uox=@_H%6H`oVsuw{?LKDxp;Y2e`zdl> z6f$?pZ&Oc|Y&Mzc(+q?QkKm{NeO$?=PU;cPq={?}QjfIm5%@bk+OS#?IF5eS-G+;4^ z@(!xKE}iFuvU#RYRTC&}cU0~lIJb?-awmQquCe1WKK`_3nolI)cXP{jm|eK7J(uC| z^d0+d#&JrI26-k=HQ^YdAM#3PbTD8f4*^?ThBPqNEx=1_uIz=5VTX@-u9kAYeDdrd z4q7~4@V|%$miS}dK)cGGO3;{D;@7PR8#T@xv@WQ1tU?8BFES(!*$yAP;tnWAM1UI} zjfJBIz8MM&Qg{rAg821r)IKxNsI)G&A*BMXluK{wFK?Y}xly{J_v<39@LawAOfoKmP6==x3P|*kG*|nP6ZyElXbT0qt^t37J#1eNt9Gdb}TM6{I}|gl9`; z117(YnF&Ez=fn!*_Vb`}7;|nkJZdyf+$HUw40ExnTgg2#4G?q}-&wdY2oU76e$`Q+ zJ%b5Qyz*U{yH&eu_kP_P0MvGX*5b2+*rxp+X=LtWU~ggL>3AKxX2<7q^wCI9R{c8} zz9jm-u=6>udC5rKolN+*loBZCIrHjk)vPU1bM2xjmjzXvk7{S6{@_<{nm<1_ z0{VdWnqb~Zz`b+;Q4~-!{!zv9Nonb?09-D3NsZrBxf})v+|;}fn73Ntj?^rV@i>Uf zxx&-7!77>XyVNBXWBaXbTY#ErPI(db7!Ot2DjC%5(VX#a-MIU6?dA)z6LwyH8PSFPqMU9mP&_yrC;y#NzU zu_F@S;Tw+A2d!>S&D8+S_@8TM8i|1eBt`2G*6v5>vpL@I2%RB1pC1V-(WV^=1GCSS zd_-;OJaXoYA)}>kc3a#sy(`q3bhfto;Z`Oof}fBh!EF7Y>q*@90=W1$ z29a}Fc|m*45`u7F!8>>Fc&R=Q<|T+M04DIA#!%Ri=;f_8ZqVpCk5K(!pG6>kgPldT(n&lRWb)UpG zH;|W+$BcbYnKLu$SSBA?`Vd=MnkZjWsUs15<`EAf_NA@t-s1~*EA z6(2Eh;j82Rz7Y>Nd829IZ;kW5c@!>oq!WJnET&}jQ9~&orIS+_gvdvp=uWXPdzSUA zr`Oj^ZBpYT-6Mud15d1T0@-b+&Lr0>g8PttzF+7IF~ja0m9pC%||}C9xXXw_3-LYU$wVoB5+C*gC!2sdMqq!QUmMyCy>9*B0nCyC zhH)OllzetH+n`PRko^Xl2o-(z@p4kv;!-$!j&eIx4dv3f=X^2Ds;(^gLac$48a~4& zUYa`q(}z7-ga3JvsqfXp==MmFX8#}#hCY!OK_sdhPfaw|?}hyM{M%y1^%)?I7D|S$ z%zB1$e^XuqFroPSB`5rMzA|QC){mV_*nh3svVjdC*l^dhBY)R^#$pd8<_~#>rum2} ze!~`{ByGh(55D=^_a-pvS1R)IV~QBxV^v{@RFj0Tq}Ob%0^3E-#7ys{+V_CY+yvb@Ib<3O&alzn2LOoGfzwc1GPx8zh(radR z7h=VT>1y?F0F280--}{-^a2eurtbQ{%EH&KVdv?56WF{$#5cSQ(M@p?IykPN!rfz) z*@-zh$wPWaF^^ue`(Hw`X!lTwFtthV7yw)`adG94NIb8f(#To^TbB~_t(S7oZ|PvI z|G-4JVp&!MQm@WMM|r21==U@=^a7ZKj}O#JWqGQ-4Fp<53xqYu zDfRfEefOszrO?*bNkJPGn85UPv&K{fCD)w5G;4Z;fhT(hGf6<+?Eu_qF;)E%x+*$y~kri zrzrUG^exWlx?%&{xUQ>-9@xx25A}2&W;qGF`lXFc>kG`u4;0|hpShpVlLh8Odh$Yv z27ar7tQ?XNSIp|0Nmet>PwQ^4#de~M5t;KMolp0XZiT3KOb8J3g6U%qCJu;19J+a? zitbRu!FVAxwo_+hdXL#lu~eF~EdBJ1TYGkqP+Xqv{ZP3%daG6F!6@}VljZZkKom-!O)&e0`7uOfMV+>TtN0FdC%K!p`>148_W3gtTh7Qj$z8nC^Mk%C zn;OS^AADy45`QYfz2B~$1KTF{iNl@8HnNolVAZPf2GQ^yUkG6NeW%ghrf&XXs(Wto zKvZ)544zt9Z}moVWOnWjsS_UwuZf=FJbzcyPekgk{iglJ`JfGxi}A6cCV_fo3r*wc zk%qCzea@x>0@_@SM{?&Dl}oN8$K0JqN5K#P0d?gn7AU*98fIDCiVw_du- zw%3ej6Pfi*OAL~TcDX?9AvJtWU_4m)fyh!A1Q;KO;u2;&CR>cSqxD&+v24B3b8mM( zU_;{K1{2ge*=x??;S`bgTCGfB(>~lm7`5~W7Zkdh7n<XRejX$Q;7 z8AaNKedN8mO(oG*E=Ju=1GIq_-K|Fj{>#vzrlS?kzHXV5^{D0Vv0i0_`?$02Rcgj_ z_m8AX!xJRe>`u8ieFC$NzxdO;H4E>nP2G)S^W3WbIOB1VX>uZmpwtKxKy7dU%t5G1 ze@g3%+Z?}{)xYe5X^!3dmofXX56f4D7hd5s80j`pQRvuIEXbRPks7`bL|wwY(hYeF z#SU7S*U$|{H6EN79n57jQWQUPYyowagQQ-qZ_MNIg+D);In%}pK#(XE=TQabrXdK> zUgO*nYUGAk%Ql&sK%38bh7QUPe(0h3^VS}=`*^s0X1tE(P|@(|a?8@XSV(uj{0`98 zqm7bg8@>%4j%izoO>}$n+0zOCa1RuO?z7ID@J$%WuqQnH5zkaIJpm&fk!SKnK`-Nd z8G2qrJkNYyMQ$Bb97itJS)AeC&W%V5NAetC4siBsz<~B4vgC`;&W%S``<~*4?1X#S zJ0W4`YYoGukIS1ymAh-|78v;tL`z~E8f&`)(>b%eNSGQwFX=g|=C&;IYYuV%-r0Ns z=hHOKbDoo~aaI|D$i0hM<%c{Q=a)w$Px-`t&$({|Zdysk3t|EmB-nYQQ+NdJC7V4D za7b6KzKR@?O(~3$h)FrPSH(il%G^K zzW7|doXx!aV&qrEJ|}E2eu;O6Q98ZTVal{rup-JlNjM+z`84VlbiU!2Z(n)^1iAa9 z&augQ_5qk3BWJa6{blzb~?-h?~=7Or7 zF>pOOC*M`_R%r2M@D138@?SnPIFU29$#Zi#O^FJ{{J?X%gdp2pFUFq?t&CKv=gsl7 z%Bs}ybpHagmzZ58vO(D~))1wP`$7p}NIpmRt=p%x)ha>bt|S0@-@#&jYSe}ZVH^H< z+CMIn{5vJ~Bjy!&ERt!x9#NL`E;^l2Pqx8vUx+15La65Fl6E?jom99li~hna+vyVH zp13HN{T>?&*)KNB^Cmh|tSmY)c$1$Px_t0%5@T@sY*g5&)|GKs!8x*ax=1FX?+Utr zj(Z>7Xl`ts&XaEB44YC@U_M3HOnn>q!nT*VsW8t2$M4A^t;uW_ypbL{CQ!i38z}Bii;g)D6taBaEn#lnqqxjVVpf_6uk2)B z5lLy=J~P4DRdPq;7PsZfSbeBCzND3F_8L0+Y9}P5v{xT{)gSCpMCDS zKudPL?xxNbM69#ipk7z%Y-iyS^Y2gwZ@6ckABH&V+)sAf*-e{1&G8Dz7lyrp_WrS4 z$FaqaHVo~-rv%Z!knclSbmYA4gAYEGN2hthlp3OZ$Ewy8p<&I<_+#T?4DV8-9j6x= z2bC&xZYE+D&qvw`%BCIWm(or!zf2ZOi}Jto-iI(({7hv1I>vX-qv_x{ z%eSX|1+T|9O*46qO4u@SYCy}V9(v>nH+sxCl<5Stkwwr4VScdT|GCaxI!fG19&7{} zgSq=N&kdI`=O=i?d)kcY7$aVEFXCJ3!;e0~d~`|I<3}5#e)#X67&bsYdB*8MCXfk> z^8XJs+8@T;n^&H4q5Z|-uV7q%1#_PdUHkUSxV6_@-EFbiMjjO9`ArW4DD~$-;K~ebIdODSMp$+_7`vk@Fh;O+;sarh1}{KuM^@Nig)L4 zyuo?}6&S;8yx|Y<{Xl-!)XSr$_doO)+BD`PC||ze)e&>r?Rwzb4}G2#nndB_v7rgy z2#xlK@#Yw1ShLVx%6~a*?|uW(FVv&nb#TWXRlYi=pf>sE{PI4GVQixxO#0X@jxmh$ z-ydNvZSyu2ZwTB1xzKEadBe&WlN+d9pg_Km&hq?|VLwBAe&C_Ui?BZb{N=Z_^qYX0 zMJpMeFuDbs4>TNG7e{~f_><4LSFtw0d+k@k{qFphw5OODiEaNcjTq^ke(HH_puI1B z$Qs>Naob={!Syfpiyb?zDE%gRl=%}E3_aD@L>9Pbo_i6pd{ZL%6yI$xVZ5VR9#`Y= zIv+0^M1ru}^!QP7az&IApwZ6ap+@^BlRuUD>FbzFHOJW38T0+0?7oY%af!5o|EHgS zCZ{3Zc;jt15#I}ZGo&Lnf49eia@*GauK(H9zd6Z2ziaNem+iC8ZTX{(Q0G4pS-yoe zLSC)JIqmk?Sg8DtM+W&l{>bCc$h=}QzTY^P;=G;x<)-K_m#R3$K_#j%hG7kI{KN?& zh96*lx%lFkUlvCCON{ke{{KUnaIJy``#IA6;>)=H6|~Fad%6oYqzLQyw=L%3-@^&7 z3elq9^4~-}?KES?OuQ@5&UIgBZG02?8zemYLVB>2zkHidnc}*w+C{$IIhW%1&gj?2 z$()9H-hG$&9Tw*N*xlP5-)EHR(^z+X9eMWkfOCG#WtulDa%?Tn|GDRfyC*p3$2@2{ zzBL!ec+wu%>ukhzSA6gK3|8e*#8jDo;lk+ER0glj|8QuuQx@y4jyW5R>3=*T{Vifh zk?Lv!e+?S!ubF?iIz|{Efjzm~i3-h+P~KtqzvqT|flJOf?P?}>Y4VOZR!V0GJK7^FAGV;?AZmw*74RPFt+x6ypOSt-7>5Cs zHboUKMXFs8bD%rr%yZGeXCVGM*S9CMHJ4pBWk*^Qt}m{RnL2ekUM+8qJK9e+>GF{p z(il*YYI{=i>pj$4?Ld$qjKhFRo1zMrA`AQ6-~GY8``&nyEx))yL{Y7LbgX2kbF5iy zmu%xsN1aTBq46s7)Hk{cI`TZ{!aoQTPI?EOdLr6Ry*ueNK3X$Fcn|1%92U@*6gWhS z@Xz3=;dQu2e%7p+ND@+H>OUXN;}rwc$hS%2F|)JJ2S4OthwX6ZJKCF#Snj63{w7K1 zLBH5nCgYla+QHaJEr$f}sTIY=+{>=G+D*bli~OaX(vt>}bCSs;pRz$v#ChRme{pZ1 z<5x1tWFdcsZ`*naO!N*xe^T6?RxtC&^2XZl_^WQVe9t@{Pgk zF*)eujyUW9nZzi5;Mo_s4?kpITjvIy*2gV@39}8w2%h-gv+ke&xefR_x9NuKxqbHf zvBXV2tbgZSbOjbwr`MFf@;~eJzF6p8Ou{Q)wHb$)1YsNoBpoOBw_#%`W-gXL%ZUr5 z2mO3s*M05c1Ix#b-+EcpIuCDIOr7$j$VI%0_Ro*-H!(3`{p#E62=tM~gV6>58?Z_C zC>HnWujS83DF07Cn<9^)${p=T|0Wb&U@d@;NVB7MpfQNv7;k4lyU4bG((yxK78WLW zt(WG1$t7E(&*~M64Dq}_aiY8E4}Zmn-W16v%Yg*Gmve4gOw@PYaT|$3yu5cvcdwKE zN7t%YxcMG7a-PA0t2ci9W&WvYObt+F%o9+TT=6&A{193&)$*s^xl;#s)L{o=!D`V2 z@8b>86iy=y11haW4Z>XE1I!g#G;i+q-Dfv<)!%RMWQITcq4S5F0z6C4r|bHgZ+DMj z!d~uwNYMs;&~Fbv#I?r+J_IP3-+0?y_#olEu|P;!H;8(~Z-<5Mz@PXlnod@*cv`n)hj1ZTNH=Un0@efXi^tNOn^ciRD*qMU;jX)P>u zN<_(zC#WLpbuy2wW0?{O^CiSKmX3cusycV!S*Mm*)XT==wHP;NQn+M5BXMC2!nk=b z#!W6-YV4YS+QDeT1YsNoq}Lf|{|<8bSTq#}or?Yv3#7tK>0m#BO_+cF=T?#P#vA<5 z?fa7-gT@oEzr6UeE9G<@5aBI z1M^XDQu&wpUvTyS&8Cp|MxC93g=3DbJ%9Tv;C$<5%uEgIEDKrc?9cXAmW6MfyZ*-8 zWnqkR;UnW0KudTQ;kFzE2UZ_yI>sit~d5_TSsB zi+193NIw`a9uHebg7@Ajs&Ew+l`4333?ol9+C71WrF|bZB5uFuLGbqNuU!6YCkO5S zQ@74K>0E~W>M${#jUoD#vw*OK7TVMff&s}$v zP*xN~+;G$F*u>(v$ujv3%H&UwGdxQ5|A@nIVwam*!9@N{mv;rv62klb=T_X&{^(QE zuDY(;84FBrfGx^V1H%0fIFP&q(NHJeERxF|Lvg=uoJEoqQ4q$UR-;_ z&6ppEFp)>JwIYIM*aXpUKhmd3DqOH`#DX?APiXiJk!;cwp){=8LX00@r?@fP0UGTG z15>1~Ob8!tgmZrR#phE%mexOp;zIDQm|xON!*>B6Y-Ossk$2E9ep-@?kcCWfz2c

e8h-Q`zahp=h+udu?huFr8thVWK6)C?bjyUv-W4WPWleqko( z)sh;|m-B<);%c8&pyVYUg7%rV_0LoL{%>hqXUBK9{9JE2yvuZWC4V1Ae|?-PPPNtd z+zbEc-g$q#Kw_2j5I~CuF zyrsb68Sk@DYL)pD*7$r69r^Pc_ZR!`6%+ zALp0K^xWV5QIu)Q@~`6m^L_Sk|F{0S8dRdDQq-lFx29TNFq1y z=yfvIT`}kDf{oAbVcnGqbmjWL%rZ;iJM38D>#tpWRCw>OtzRRF(R%)^u(7~vr4}vf zfe}YQ&iznq}oaxZ117oVu#023v92GP~a#D zzJAPC&RJnv;RB-$c8|Wmj>}~1?D0eI)V}=iu9F?*d$GgD#LHj-TnFrAwrH^^v?AV; zMSHB~yDc~0R5as!T0FDA#z#82TSM&>YkcS; z!PcXIYkkU?=nhZ;j2eT^0If5*I;OX_)|gI4@{l7PQjsk9XPznrPInc~a`o#(0c&zn|=m7}7|oRdUvOmr2ZQU+tl>$i=LQ zA522$_mPC9=V|!hqo#uzPI`FEjAqB;?lASEO>J`yqBI8|un#oe))KhP-?~G}6i~Ye zNoyu{X8U47G#xgx!o_V~OGM2JYV?o)0Gd+RU>I=HaagS517ki5XX7#0_wZm(bI6^V zJInHF0QBTnQ7H>arYjyVcx^yIXy_*>*&Ko8^}*m zNSzwFItGI_>36~D33(tZNW|0r;m?1=sQ_PJ&%?)&#G(mNyNH&%;wND8Kq6{=auQCG z6AG=AC6LBtprP0f6T+#}rn=Y1yeU^Dk-h^K0ef>XxZuxv$$YZ@_t<}z(;r+PJjwCVDS0S0`%q98k0FLHn(ln)=l_ul6waqo!p=uG@y@Y4oIFf zVB}I@VkQHmfZCwE8Cp9JV4<@a(yL{%IP%N%z4soUqqeZspRe^1MEZ8c#HB zu^`bA9~Bd^_(bh+=3i#2@bizMwo?(g$M9i!0~ThPe=gdtjBtyi-cg%uIyW$xK9~+G zEr*ZK!@Z;QYqC)IlrhoW>*PVG&zu-K(VXQe7i#{IKV`VoQcJlhQ@#-GcG8@RjXSn6 znS{aJ_ms2Tm(#J30#BZ3ptkI1_$Yek-FGDpkYF6x*=@G*1_TSkn0yKKJn2mN;FIxw z+Lsa!HH+J{ZUeqk@R9MkY^`$r1$iDS;XhBY$>KApocJ1tr zI`qIAejX9|2S@?6i;&hDH1zjw;>1b9iwWhXCiyRk4Uiew*pyQ!5Zw9NrV#k5Yj1Eb z;G>KEKj$Z%pmp398(cg^#05R}zg$4&CaGx57W}Eze?1mZ>CgJt0Sic6tmbJ5Zg8>x zp$u25xI&0N7yt3Ea#D=-Y&`lvE<#a8LkFD#-|hN{*wL@bFg~wrstN>KHLLZU6%hfc(dhM zX!9^`Ic7d+dU_+W%>!V)y1<-stza(0+W)X*lPO!=feg&r?eWa?!G62Az8e zG}S(k`o{Xe@^8M_VzQAoUD^riJ@8zZV_GF83aDL*(>gtg|GgPngbzTQm~l|sjN>Nz z=m{T8L?1L>f-(O+u~4@%PdkZ;OgNrjeA!7a_Sv%dMwu!~7yMS~)Nv(u{E>$iA?o~w6xxaQ|Ew=7 zpJ-Ko*NFwkZ1Pl?2cJg|g#96E!hofjDMmOsp`zGnTP>*;j=i^VH@Bkmm zdeDFqP#>fef%8$2*G1Ump`rXaj<1N5Qq8cK!bcQ8`e?GG;ab$)8Jw z;9QiN)Jz}i?P91u%mrg-KgI=1Arzcnyra?xPmS@-qL>;V=J>t?g_5T}5B&L0LRgj6 z_1N5h92$IN!p)A)F@|yRxlQY~ZZUite)!2pGXFgMkYC^$##Ir2y?X)LgI8ViA1Qx^ zTM^%n?a?Ppgfam&3TY^olX@K`ctOaIay8;sl-iNF2J$5J?j6iQhF*BN@V6T6wNcc& zn{K;TwC*XFcAW1+BXV){?eAkez>|;UazR0EAj@|zY@}|n=|;XdH85hj;l|rg z-*K`OR8l5rhvd^1a|3Fj@&x*f>9gE#e)V&=2FgT@iK0N2G10A%UL6BgMYXCE?cBu{ zYvIO>9Vg=_y?9#l(1U&^X(HjJ*hCnG1wDr2y9deC}!DN2mL_>Ye)hQd_BDhF@)&-YH zxsk9P>g%%YmcmJcNpebn31a_uDwK$pGT(kaQvb^&a&9c&nJE9$)2Y+2j>`OZU9}T<9)tizCJodR>#m%Cv_yYL{)~t7q1G7xrsDf=GUh?wC7u%Hrorxb+`Y#Zan3Kq#g9*Y%!BnKTX>d_d_5>fYTQ1IhBO`p zSnE^9M0bD`P`ftTfbk>^6W02me8L^=MKq$}hCzvya}i8*4*VH42D?dtvgYvx>)|6t zK%2HlQQ)}uP!`$|20Ml)KpSBN9JiohMIU_L#rPn`Vh09!eV9^;9H|*FXs9eqa$upR zrr(v-WY)`-GRvc3astH)B{g5Y5x)VAE5$M$)&ySxf-8{l>KInrZe3O^a7-=e<`e&z zE2fQR&iLPT--GTh95ZD2CDA#YE}AM5LGlxFEC4h*vCz(jC3m#T)iFvjcl^_IGtJdT zWA}v@T!vV2P2+#c8RyDX4D#sdLHo-t`-%MrOF#efpYG|_*Q+{&jq)<=eZqj4Gyc@> z>^Jai+<7D;PL1uIx8FLDh!zQsys`bQ-fb0k z_^%G|X+izt1Vk1ZAYMMu!J}SL()BoMI}BR#oS@XXgMax`(P$457eL7IT;%`CzyAxz zMPHQ|cvSG{Bd{}zwytqa!ZFf6Lj&Q+Umt`IWIfJ`!2lZKZEzHAa~uiR4?zuc%|HHw zU0Zhcb+`s*M?cXQ4mh%p#isv4Q;wOdt3#i1Ec%q?(5JwyeF_Jn)~#B}F;ky4jahAv zE&m2z0fNgtk4eZ_93kIjhaUKVX^CL;qp6c4tbe`wdU17KwKMX0pujOSo!+JQb`rBQ z7uun9U=6ACY9W^YF?fuq3r-J3qp{L5I4jz zRbFM`jSt7c`i!$KDzpNj?Sg(lv;{!Ke)xp`17(47i6!_zZ*O2@4dS~7r<{Sh3|`CQ z8jimBK=uChvVeLLCfzixP{wCsVNz2{9FM3!h~v3EHs2U^ei5Q7O$Z}Ea2Z;~;X``Z z%h*_X8yeX?T+8Mt6DGCr9`@3!kjuX$TsJK09(gF+i6`KO({=y4S^Q*jeC%%o=FiQz zTI<1wpOA?R<=+Q+v{%RUKjR!(3~L6z!w>x>t{#^wYg&TD4MPU<;a-9-HH% z80H>m$=z}H1Jbwg!@DOw(m7cs|Ce4F>Hc!{KZFfG=m+Bj15KHKFD$fkQpWbgiJ@o& zuf0Y=iSZtj+TpKayx+QqWQ%2d^X+%T-+y=RWsw?VtM}hUH z%)eGvN~FTQkVo_irS zA^e6euS(*aCrVb+UnC0_wKJ*d!gg`)p#FhB3R&VOB^Ly^Fgu-_CMd+CQ1|?!YIRaR z=itGt@!TYW*?UjFaiXEQG5KGd$l<(&SFW6Z`X1(BlRiYfy;#EWfw|Lh>PYiX{sYd$ zrimo-^ZdQudMS%6NWa(g?6?R8U(Xi zhos^L+U>YrZ=bz(@dTs`CdT7Yh=8d!{8i|rWFI{i3mH3ak3Kq#n+$`irO-$J^_qW4 z-_mV0^wEdK4_grg>L0JWy66vA3Jt@wZLDP;&as7 z^JE<3!to)P>*y&4AwU?)e*(Tge)dzpIM0}ZMmv&MhmQ`KSLnA&XeagfxNR+)%nTER zUdlhOFFI|=g+j4)4_wi>6Z@e;Rw^LzjX!)0bvm?gc|}CeqYeW(CFo@psXT5XHlc<< z>ueS_WLmat?oK@RNZG{ja&zvw>u<(29xq5Reh}}m%XURvK0M_kS2Q8|t+zlwxwG#l zmE)_>@Z~qd@i;M&8c*R*$?%GT;^A1HIxJ;R<6`*U(8!yCMIOmp#pclQeNPuQsw|-8 zulc_oi@J|J`7FwX%f@wXH7ryd{;OYLY-x^goKs^ydCz~{CL65p-*Q0P>3iDQn3sGh z3zNUb;_I5LcNJR3`SPoy+!dIUGR=N*?Fiu?(kwu5iJ$*b9BrB+)1~sK59fNkI)-De zK76nBkN(y?&vt@^u$?d`TpUVlHvhwLO~GHTF6J_;*~J*f5c%8wk|)g4>kDkU8OC9e z>nbetjFYxSWi?&_r&J$*JQ?HI??mf&QCu%J1m7yWb}6R6UQQWknXvt@x(dqVkOQD0 z>F0O6zL2LtH`(ZivKb%JDruG^)ch!an|~6?)iHPsRTj`7(4&8I5Kh%|?ocNSK!eZz zy?o0t>NBy??5{F%BGZfi@E0W8UmtTAzWIDQ7^{;jm#(|v7Ad36v6-+Z7Rf|9l8}%Z zPb|NRqfHa#ub_`0O6uH;p$&_xx)#AA*HC%q%*)@0Pk+z9W8dehEc`713uw$w;;Z!G`n8KXZNwaxMsR^PjT1^zy6R=-0+!9@5O6Cnu(=V`uqa zeccW2`4?Xn5ubZzf7CzLtH|Gntb>;PAh|-13&SU3p zrs1absaR{$IopM2p9(g}MA84AdS1r+O#zpl7mHf_(qDd4G?f0Lf47e#T2VurE& zqbtRF%J>_61*nJezz1Q2U(-~P$dno zffr)gM6*hlV)xw>3`h%mG8tuO>@gS<|UNjQ=xO;+s!A0M8Z z0=#~DXPgF+6VgTg={@Wf%q#Hi$9TK028Eu(4h-QmJd;(vW`~=bK6WJ!E|M3fD3kLp zk#udpO%GothJPWl5Z8l`J>hP?z5c&5PO|TmB8c0tA=iW2oe{?i!uN z_9}Ph*I#1~`DA4m+~A?&06J z0j!e-&c}pGC!A`;D)IKX<6_;;~SUCX5jOeu`tx8{@ch zRsG{f2U}Q+7PzkGG|1evKjyi2zrmOQLlX`oqQ3?~qLkg-vx|pQcH9nE$Kc2i%isIf ziAMW%ygCN_4>|w~?YP^tioYZg!K&&%`In7PFBjq#ac7@?QW!*(Z?w~pjg>!l@_B5K zSzi~&We?`D>B7hWSqviUqYQts-=0jePcQ7j=i+XBd>AjfD9e<6iuElbA@*x*e|@pY z%zFTrEEcOg7v-xq7bfGqojY%bt7EW{!t}AcMc#1n?z;Y%+!4PuK7e*BK9c{9D@)$Q zJ*?eUT?GsNTMLVS;3I+ev$DRPgN-omSVyCL)%HFQKlT(pT<)R(usFZBTOW7GDt{iy z1+QyrmY(&*En$j z<$ZS^Po==HoOzXjO(E}Ay#*gUT>Xg)?b^B}nEYt@Ux<(Earn6A=HyT;v{&W-Mcj3- zT5_wc(iz804~!83;+q)fTzHwZKWYx2d_r8*l|?aGu&$GbzIm5Fjq)FYN%wg4m()U( zc@{FG^6!KEPn$6f<+)g~NFYILer*1ur()HPK7^D%Gh9{vx61|rJ{Hia^gr>qMj!Vh zhn`$uo&}8|XmXxCkaHE~>+KVeml+s0o8beLANjN6FC`{HH6ErqHJ4v`t$PLc^iy6v zp{dKOG1T02+ueAO?nxxS-tD*d9&RI?U{m8y|4f$gcR=4`aq6Pj;2{Cnor`O&I99Mf zJ?6-RgO&?WOjmjQ+d zF!l@Wx_EE%e;md%@{>~-`~M`Azsmo5E;2&FghV{0H~2Iz+(o0D6!Q@7^S<$xJ4F8c zM&-$nvN??>@NkDQ>(x-4-e3(AgUGc0DgUbaW8*9Hr=QLj*#39Mm|T7g)#iV8^6!g{ zbpPfN+et6WT43@QEk^Y7ginEH<1)Bw->17ab)Q3OAw$ z6Xnm!)v(kk{;6E+Bg~2)UgyKNNZ3d5&5pr1t(Y3+t9Hp3a+%ZbkN@DL<-@o-hKc00 zwa1{&TXXXr_qqojeq7SB?bbR6@_hSavy&$vcq)GAppy~I=alm2)t>L;nhp#K?#xrL zK#x;t6yVoU{t^**@v6vo-We}fG@L67?LOsI<=+!m%JC!~Pj8)#YZlA(PajO?hPi(G zF}AXVWv>3n-smH0o4{%c8GI-U?_`z|+=Ko)~2I&cGc5_FApafk zt+*4u>#K}%QjK<&`~Ur59ef+_1#l@K{U5^H5I5a|Z$jjH(~Zzy zLRo`8KBy0W`rr%PN4QObGj-NIAC^RxgLnI1<*T;!a~QwIxJz-xB*&qa=s$+YX%Zh9 z<;gqIFTV7zQvX(6rAy76*Tz=n(02gm6;tGXc|UKL+}I%QR=jV;xjOmx!-?E>=89VK zFXvwa%jO3c+F_{7$TBJO_p~0%Z=xysO?3K+m}mQMbS-}>R$LCn3i1=>2%JJJ^Y1Aq zoAFHwB93Lc?&|r}%HJyuJOX;wgYHE=P-?7^;9F?|)?Il@^<1ob+3|;pr(7%JX24L? zk%roTjIEZx_fx5;Z9`D(bKd_C8!=Ag(|wIDX(WZK0S@q`R2%S}3;sTyO4fpGfWsW~ zM;}RXL^gVL3=8NS7Q$?d6gV~7VGhP%{e4XS8KJaq;4Z-q=WDOM0YtsILr%!uKxl;c zN{Jwa--kLf%MJ)S{zSHZ`!hkQeK0BY{e3 zP)g0W+JQ_70wM(x@8AePN?hSm%BS&A&$Tz)h&h6T^ST9nx~|ASwY>OXQbOQeHNP4@rS;hNxWI!6 z3|)K_tLjcz4X@>{wld;1DZDR~cY^Wp7q%;Y{EQW?e&<$OtxItf8D5Bt3oyJ!f%&h} z%%|4GsMnx1f#%6;B4)=w5NLu*wuUE~SBvmrzzMw80N12oJ}PPD<8r(!a|zsgR{r47 z@XYr+coyR_cD30S&z4QEI-Fp*L^N6XP|0A? z8ZnW8;gis6dlOgje2BaAr|{Yi^s`?;#?<_0_q7M_TGL~}2r3%^#bd2&bX(2+=8&HU z@$?&bu7u^IiGHCW?f*oRvdGJZ>#v7N^QO4&gp1h1D)js1@(%=)rzXNwuJTmpuy>=Dc3D_{;bxv)d1$qWFm6fmBd|Zr2vf0}9 zkbAZ_l5qA%H7Vw_|L0<-kH48)6^}KteX!24&!yHOVIEziJozzmGLE4J0a?ZdPQ()& z0SJ_Xhf-7b194N+e;Hg;L8FwKZ?(D5@-f;l^S>I7ZOYXU5&~%j5htJ2G^fTBKPoQZ zosEdhzf*9l^gn!*mfG&t@C_7h)-aDN77Ou&m9N?w=7QhjN;mM4h4#U<3I$9*H*t6( zjq&^v3sFDB=9q6)8VjyKz*`Mdp-Ince)txG8a^l{n&Hx4;!a{*8D__S-jm5=vD#m1 zINF?peJFQg`#IQ7+iZpYxHEiIs-$Y%D5d6G?GQ={0>T4fF%M2Y>?IGC1=;`zG4D!0 z;~Z@C!NvQ&5BcT3J`(&Y+iefW?pJ!;~R88#8LYLpwZ5>+4?sK3+*2iCqFn3SsIJ{W&Sos4KKLh2!JK6 zgh|PdI^I3ZD{DT%wQ$7I@R6=r(4K6GYa50nn)}|L8tuQs)iE^TsuyM^Zw@uUMii4*tbHa*r@+3h&}uWt?b8pFaeBK_f!rBi(15 zbs@sy>X;rIyWMw!wlE@MyHmT&pI5-Kui-U#yn;@R@)vjE7%&(b>7RTiDE3`450Omz z_}P0=Gj=-fA#R3KGf1!U<-?;~lw|S`z(@UhIQh^>Rzm(Q|FC%nB-~uPG7jX~5L#X^){@#2pPV%bC9`em0j?#|?vHZ*B9|c?r z3@5|i$j4Br(GGaOy?=~NODcJUQjx37P8)K8VAjFgRlho5KlpoN$G?4lvJ2)?>q|L& zj%%p;EWCe*1;E3P2u1#py!U|I_;8ni-s8SH5b8FqQ$3RNCMTc*das z06+jqL_t*bo4ktZxFZh{`3Fe{T3)%sjq4dT+R+-XAH(jJ`p-L^dHoO{t>iTtjBf|j znH|xN$Buo={SK!Ni0jDfyoysadN1|rxLSu-LWwc_wfuSSJ0CP%0UEY_j#Eu*PtIQk z;guqC9V@=Sf6#p$bJEKbJoNZe#X_?yt~y$cLFIw!f8p8~8lL#zRU4AfLMqHZ=h@`3 z5)_P1I67U3XE;r=%3W>xiBSS|8{1w7%e%IB!Wx+6Z%74{ITO~~$V0#JHG1MMz2ZtN zaKDkx^?<+nx_{&Jz)KPbui)XybN_7%-311O;kAr>h?e|+i;b>Tlatm$Qu$-~+y3vh z*T=cv|LH13S10diajm0lmdagizZmV`Wa;1MXg|L!CxGGbpW(&8!9IG(`IpH2Ul-cdyUONwF?n+RZIvz^ zWE|2>iegBTD<{c=*M{}Orl&RJFYB)O_UHRkXUk??k}69su#V4c{|6tiw_Fpf`KEmt zHnv7X{xla18DKJqIX~ttvhE7H)mFiy>R3nWx@u>kjlyW0zb8(ESpIX{|MM|a8hH#= z3S<8Ax8?6E!`I7S7TUeI{I9<&h!uZnnP3s?Sr&{{nnfTja3-#APdqG#JFu*wMi3vj zpy8d6#W%U+g~v|ip(cc7Mm>i*9A#+bw&}5jTsgsTjq#^{)V1NLYi(P{hjDn73>SBKwD?yC?4Q)XGVhSaLJI1i zq{+x%{b`4Z4=UE~J8g%1J2x%7)BFz~KEnOw@Bfr^@Hi*mAh3qi|A1CHufJd?ddv|A zinbf;B(DzO2@%%b9k<6q`!+pnP=t8_*CFuEJAO#&LVL>Jw!b8B;YjidoGd!sz{SUU zx9j%XxNV_Pn|?)A#o}>q;U2%s|8lLrGp!&C{EK8!ocxgFLm@Oo>-}TQ|4DePvOVsR zWB#SpA^>-XsX5Dh#s{F_s5C`5_z8p`TmLl(wbg%*w)8gcDAW7j$e(kDi4SGoeM;@jk)vOCm;Lz~AtL|2J&%$FU_EZ` zuSYo${)h#m81FOXJ&n8rSVcp-oHx5*to%$vD2>9UlRB zOjnJBgU2=3;cmAVhWY$J_>@0SIq)ILy>{OTgLY>PVr(Cp2<2Z+qapS*#V@thFS-0m zxldc=&kqpcT<~Yu7LegtqT%Xe;sc}9{^lK*d^eyh|7&l+l_A)aVg~v^qkVa3{n4-u zKZK7L%AfauuDwP#!E62*;P}3$p$Kq95ceXUAot%3Nh3dv=U*Q?+X4^I?1hgNQlEf@ zc0S~^F&5SL#iBZKeNM%qI_`_)UB0^bu8ZFGXuM5`)G2C|pnNymXnkn0>`E~vbwn20 z@d3^UKDj98Q|o^Hw`*HJ)?5TnWW% zx_Iq{Yzh}?h^H0(_Gd}gC6$n4dKOBDrb85}TqrEYVhT}CPSMsgvfwJDW&Y*xbbHPzf8KLE`Lj>mqRn_B09s-=X~qTQ^Do9C8_c?EA2sTA_lLh+Bi;FC(8%2fr$?2B{TCNPcvoyMXwfHWLY<>_Ff+Lx7TT-s zXt!4^aRJuX?vy`eRAmxg1wn!<#vcvKag!%UIDRmpTDIyhYCLE!yib}7N1^={1iYi2 zkL@u%yoY^1Jl-1WT0v9he=;|Oas3VNTy1PD_Q8EW>LN&sp!O;V2w{&HOh z7B|Is0uf$0Z(9GjIlT$S({lY&9%?7N3S@#a`B$Y1rg>*PYP_Ay^)x26eQ23q{^=@F z4v;i@bWygxg%ZWN3^xh2%`z5G>K{VnnAei}5kwf$=^A z;f-rdaNn}kJf>`^Rmy#Y_Bfq*66Ve{ye9AgXe2ZLJT1u66klig3lscMvzr^T+(_ru zaH;XBC+@|UMqmv4r{up!crPWT=J(tGo_!w3IxKb`jK$85UT(#&%KygOaRLByRT_Wg zTN{CEe?@S}bq;750~PpX!NNt1m!(H`ov$#8P? zxD#Qc9ZB2_7qot8i%k*=?#hC3nEQLq0>mhxv@%s)x|;rs7n+ii{ha&3uPMMHq8%>Uiv z##i6{{*M_U7BH|Fjr)OIzrXet*~Be>Sd2 z(G?y|ZC!rlpGCi)%0gVR{EGlUsETHYj>oBJj{i4*|N3|)8w1jmS^Kkay1;W9bZFpu z-1h!4c`ka=^cBUU(^DpsWmAORe`$QxTPcv=M=W-mk6ioC#4&*roUcBjE0w?lD_)L;km3+{4+v- zQk9-^PBZD#LVsq-4WA9@U>wijZrMMVyRLW>NSHlSao z3Bm8H#$ckI+D8mqCe^hvY{aIAey`xJ$N@>GVf?T;`MYOfaDmYU#@C<0#Mo+BC2w~Y zs>ziLyD*^@chMG#QZ=)XF{YWBf2M~MKXL&I>VS0MNGsDv$0<^Al3K_*)=)M5^ zts}9Ey6Hmh9CSd$BNp@jJ6zsz^`Bw;8B*JRsD6QO4#nfKJSNKofA9m?C9=teAsH(7 z8#zYF-3k~K;NmC_5b4;d^JaB281@4Q%XglH!q3fr$3%OwP0fjRnr=`h5()0l3vvnM zPRonaPRoyN4|5`T`KFS!=IZ*L0Tmqla)N@FuW^?@FYV%G9dE-C$JsDpQO(v@@xnm{ zUVivcnHWhqQQK<#AVxfg$V&9Wo@ml&dy|6+mj9{8AJ(eh0|>xSmg=D&#U$3~HDtxeOJyge_kTWA5V1uEdS; z_-KOMarm&}PU^q^V-$8r&W>FqI1-P6=cZWHpglFd@c#!BOT46wYIsS{_r8A)R`)em z3&CW_(zwfl$MZP}_ivbau@CL7x7@7SWW#k4D(7EpFXBdbI=d)S2530q#{ARV3NNMB zASq)aO`FZ5o;oC54r%#Gr@qI`JV%J z=y;*&LO8z4%j?*_Z^2H7moXp{Qxe>{o>a&V1C$MSJnPAl5HFPaM;%}eQfy-KXShiC zW?l>l@vp*WAWvGW&pfA+a}8Z0!thqwqK$pE?-F6pIx=z1B} z(~$A3D_5CJpCi;5h=Su{bu@?A6=XL?4QT$zYvPqW=*m9@30@ z|8d%^M*I2M1;49q#)lzUU;Dz&_+T8SviK#9`LiS7w2d#e`i>%v)*GVyt8WZhm{)GIt zg-P05<=r4pKmCkE=V&7QQplr-LUcee{<0#xF8ObHE^7O=0vnQk1XN6yddXbU&a2CcOfvLA4wMr z^Br_MOmr}{`+p<$mueH16OVL5(Kh$`3MVsCzJ!XM-dKb_>3=a%4?SzGj+0{2HdU$h z2|8(sb{)b}VlTN2H625?9qk%aV%KBCPso@~PATTXOxk;SArc22kU$aR^FI#n%}232 zm+!yXVajdU!9&D^)!cK=CGvbCh_sjbdTvz0P z1R=&9hOc7B|GeDIhL2W}D8)oJ|0vTwPQ~u{{@CGG`&KzCZ3<$(PQ|7mE%q{E!^}oI zpXx>%;-Xw^t_Y7Qs}@K@RDES!RA1Dtlt>6jBQcbObT=atC>$lHYYoEQ(TF-hO(4>)Pon;>XvE6t#r4)kd z(s=2)*o~2!-RdjuOuHP->zW!v2o6;CV8cjJW5Y0z%H>7&u@!guC|iKB0Xl5{b_n4p zANi7)Qs~vzvHjDyBQQW9xPKYZEdJr`ucQKQK)vd5O{LVbOaQ@o2z_%a7bZc#=PU^g zLQCq=xwB*fx4xDy3oF1pg_`BazWA$`1YF&Gf!v-X^zLt1S+1Y3A+);np&Qx6UFwV{ zhF`q+b6=lSu!oJFolIB@Q1+{mwdFXI^nYyVs(UIbeO5=h7{%rK#Ot$Ba38TcU9dX` z0^X2|szFmlakEK!D?ewaGSG^6PRs43QdQ;KhW=z=uat56?WQa@ZPfbR;;mk?SfEA8Q{88DNyfNBMk6FtY_Lu2Jl0o{TkEe59xV97dyI3d zQJKS%#I-TWvitD?n_;0@6TOAaZu=35o}&qA9$T?bUn;WLAhbIB(;`o0Ru-`hzy0iZMwWTDYsx}*zvER!_Rj>jfV??QkpjOufcgrf;w4-K!TXAcQs28%3wm3k9!J8yQ2O=i zdx~xim+PC|7wIX8ukRG<^ZVb}eCe`~B9GEh&%ZEjm8)Ktd*M|#IW}a-P`eTR<<8rP zFsT2*k8Yqi%L~S*b zIn=b1!ThgxeD_w-F2CKll|T6_xAf1bfj6)Dl5`)BZ6STP%o&z~&x%-Fv;jvXYV>{3 zS*uThpxB@>AHi22j_NOn=GJ6ue!D>=S;}AZnQo=U9%nUbV|&BhmJh>JS3?a;I(j~u zG+zBNpsinOAe{^3xY@Yi?cB=uQb9tcD!pT)u{@iJPg7}3hKsU=8K_V^kmo|^Gdp3Q zqE$(wE=x1~E+x`6FfvB@eKi4A_@ZZ$PcrP;)VTFt-rKzLbg4YZd7(YRw3jm)i$7?+ zmIe}2>51;HAWbB-X@MQBdP?F8AqQCpjPqZR*Kc~iV-xi2{3&rj#gTi~_fG0>M#dJt zb4tZeEc5zc*xu&y^l+Tu2OfZ__`7!lF^~}_TjMlQm{yL49BYFKO79;gp|qBs0W1duA_E@~EIvU!D72?9!S!g(ne> z;4ZHEy)X8;Y&aIKpv!+l;{jrs&m+aLE%TtY)HrdM^bIvqT zW{4<+Dk&ZC3)}ka7llK+oioEJ38tP*=z&EZ($c>8puKe*8$f$P;wFe@5h$65$s$je zZobCWyPy>re(2d)kg0n+hZ}o^{QG+e@5WfUS(50B@eRweh~igW@^L*~TO~a{-y?r# z%!cFW{Tfz?Gh6~!)(PWel=2X`O)=)S|7&X8&w^o7Au_>?@u+>5(LA z4GL33-#@BR`*<~$b*`_vp?hAeGSUrIE*=R-9cD+v-?J}0>O%4hxDw*FH9g!p>;|44 ztR8f;xCEY_xvR+d)D58tc?H(TZpok$&vJ#8!M&Qx@M+Mxf}IX7z;trHfdBU&uZGmX zVK_Bm%kdmodN98!ry9u<5)~Ipd!?qUr)4=qyVfjx2J9X~Zv8F5nYB=EiHHTQ#@%e+ zj7clwLjpzyK)BIcK#JTM5BtB2GhTOfd(QXbF_O=>H-j`Y@;iF>GO^5vh9IlcqQ`5v zU%;iMe@uCMPYc%aGRWoUXRm}ZftrqP({ZbY0p1rkYHx-O?oFQ(Os|$0bE_ulAKoD1 zZyPKzvXW9#z|+oB3o%OO{KfSsL;ni`nZG+8LYoG_11 z@#C&K`|M_gpcZpSMP?D7D%vR)`aUKX7WkX~L483E->}BI`?Eklg`<(%dE?avc@lXn zlt8ELQWt}r2O@pEcs`bo_xo2>&T_V;QEON{`*%CZx4e`N+GeaPnY{v}d}Gq0sZqm{ zAEq{iWK!{-Bo$lQk+uK#?O{1fj&;sSjJmGTQk6-CC1keJ>IlX3xXVDjga@<;Yef$n z;Op_m5yRa(oF#WI1}%lJwnzV+Wcg_JRSOT$h5z6nE4h2A2hq-nZFXl>n!}+BYNGN7 zXQZ|R>z6Rej%XXS>fris)n%_g#+bQglCc<(MupBFn0?FRZ8AwUTq8Ni5!RdL~CIq@nb#f7Qr zabP=IZV_CTH~wapA(S^y=q@!l$+H$v!#lvZK{v?pOFu7(H{*6@pGi?w_#2yHgbEME=71$CYr+!({wykmnF5&2!#`w%d2}$x31YA zt#y-=dYt|^scM7FQ^$n$Ku3XXB1e~OnbxlUl9^Tfq8W5G=&ZvK`~gX&mR(S+?z1P8 zQJ&oD%nqQ}1k%&1Dd>`HTFJ)h{5{r)eIPZIKIDvg!+^m?|IjMX*rf0Z*4iBSH3@D$ zox7}+PN9*#86@<3sDWdm41qbRM`L&%|j(1aAyT z7v}T#b2aYs*Y@YZllXrMafpNMB_lZ47c^|m8hT5YP}Z(h&2|5Hf>}7bCD=lf7dv8y z@_gqMTX5o|JUzQnozoBzF!nQt?kD1$o_F8Hp2+vWj8&auFq_lgu`S>hMtKrAw6n2U zjIW0@D46fWM2j;@;3+pBy<(c;Jq&ug-qE&8&YyMnal=Px4i)ZF|J) zYPzJt+M~OR6q|)wOB*xaU+neupl5esd~7IqNls>m z&h1T<$X>?Jl6f6UxT#&1KCV?rdZ^+4>UPhGvwEFjYwPLm6C;whaSAZwPY#<2Fw1Uh zNNUiQB6l`ByG<%pQRcOoJwX^y!o)v+#7_X#&b&lfH_bEJk2{3E#wb2uPaVt!# zNqnj*o4@SJjW;r31o7gS#4W47!H%(9YHqMu?Sbs*#-|^@RyI97Td3p;ET> zE3Udf?8XIuqU!(|SS_PBs&^L(u`n(HwBg!d;jw%@iLMj6E_;k%|F)H~CmI=i?@tpP zT-Tg|=CJ%gzzicX_NU3R0%Q$cH*SJNs&q0)iez*b1lb*V4^w6~{=EF`^l?BcOlm;$ z%Utgtf*OW?9D~-NZ`)&!I!y@YjmZ@^Fz>9gSE@77moc=$Z54`A_U9bxGI3-)Dsc8C z_@K#tqcrx|Br{ftA`Ox&t2s#bs{Ze6L2rr*hNn-L`$z%IBtfYxQ#L{}Jnx@%Rja9` zCY>1ilfGRQVq8hA=?!6x6!VB=4fR)hT~n{Ro3#LFA8%b(5&W)LhZf*+mLJ$F5Gg|c zBavz2M`Z>ne5(2Z8oZY};4D77%IXa9b0yW(CqQR>glo4h1PX$XB~;_^D(@*ysnxo1s5top&K znz!>gCb!MkIg&#}0v=|Jn!;(#TqGdtnU$*tDcidXDfWIl^ASChsPE?v;6pz9`(#8z zUmvVB13C`=YB0E28n`%OEjNef49oqzv=0b{JF~B!FZyLUj2@Z(w|3#XNS1T zMN>gQBRvG(t4-JYoQ?RqA;;SCaC?Ea{b_eXuR7hBtoF}*edZ>*z^#EbW|0&$hP1|e zDcN!10fe)Fs?^#t-|a@D{4utQdPG%{D`A$_s_0b`np_i12Z6u$A&qD${BeD_a0Ry# zc0fhrVK%vsXL$?twWfM7^VNk9;wjTdE8+BKZOZuK)_i$$ZFGy;ne=iR931OTeT;w& z8{9NV6Oln7O-p5-BQIvx3c^~Oi~uW!H&(SNpd-;5BTg<;=1Bbzp@6Ps^V~hI*-)0_ z5pmVIiAYDiehKMMeXMKuP*@~}JRlYDLs9s}h7~;_jBxZtqnPlFwjA9T|-EQyguO+4+WhwQ6st5`xzv&AoyXi{X_2*f3*?Ns{Y8&GJsy1BY z)>$*U(+Dv}X%%_a8d=0<;_(TSZ$vklbuy>WeyazxQo9?~m znL^8s8dmZo@BDxz;y#jiuoU!86IEI6Txly6H~XcgfL9%Wy*Mu=WG@wYjnGkXAW|aZ zUV6kGIkeNTm9KVaj|nnr)=k&Z8IqlN<;MA6+j_;e8;+zWj^WTaRYgHsYJ6@8I>1e4 zk2{v;&$t#OosTP`P!HZzQ8+ z?SvLnfqj_x(zo}LWd&X+>1xN0XA};f9>Nge$K6C$XN>&U46#Y$4+2Rch>9DG-iHk` zq8M9ceAN@Tbw4cHr<0F8bF{|P5agEBgz3UcZ9M!5q26~O{Wm9Afp;sF39v|ps z!r39Nn~oYUM0er$c>|*W`_jbVbS+^6CnXA4*LP2VWKhCv&(eIw7d!e?Ixfva|8P=F zW1DMS-FqRTm@cpF!CF~rFCs;AML)fd3lN*gf{A-+=p z6KFX2`%||+SKzFHO6L6Ck3}nGsS$orUWH5n1bk*QgP+e4dGd7>$hP1^O(61GV)<1h zy;D`?)$cm^jJHR2)CT?{#hgYT@l%OzGtUj3VGnETI#y8zuQAYUP3lCbOVrTC?l=4X zHP$(RgPXMqS3Ii$e{c?#jc9_p{TqpP`Kp&fL`f6zv;zM2-!@%`&S_pNXwo8^ASu=9 ze#HS(A=2MYN~`N7mtAbvJB3MbgQ>J_H z80wW%J`0)J0crQD%)MVWZ{Gh)Y)iMLAZwk63^)ky=DZk>nKJ3erJ_m@mlLOAgN&TX z&xS&~AtDc>)2>UOdF4a-omHrka41R6YYq^1svKVk*<_>O?Jlgw#-*#-zxgdWL;jUu zQ2-w#a+MprssI_UUK6HeB|%wu@g_2f{C4sMRLuP?++Glfo!wnvZGrqt-UrpYdkr{! z2F1fzY97lZ2K&`px1>X5*E4*|t-77Te>%Q8H!2+p3Z>n&`_VTg$dD^uU6>*(5b#m` z-e9=n>v!=<2OUNa;k}auaP#YR$5OO#TsKS-cg4Lmb(1T5u`n?oCO*po=lT|zowQ}XB1%NA_0E=Y^-eUjR)8LgfxhTI=K6mV@& zp$|J~LbqAndD-?(Xloqw5r7n_us7*jLl=AS^pHeMaCim|;3qp*_LQi(d z&m5f~R;@f>>$<@Mrb5;mPGzBQ#$_v;4=P%e3VAckFgfwg2M`4TARF{fD2HqkacSJnB*9z&I;J>DC=0^YPE zoB2X0{gH(vTL9t2@w&pCs?rUOk#OB>UcK!L65Q{9(4ctV!NBJG!WDEN^3B{quaf|H z)vuYpin@=gmRy(uBbH6+ZAF#Q`VK-16SqhD-LDES)T>3C9-HyC@yt zeWoeu7&=!9BCt47pqFoXOaF6cmHhnNU_swnJP_OUMLzMCAg)cL_u1}Y4S!kFovG1^ zcotc}8w28*w|=@E)-g8%>YeM?bl(&l{O=Vk{L^A083GkGZC`wE!6DiVk|9_L+Zf&1 zNEIq{{2LQdmnoG>u7H(7e^giOpguUw+JEHbnn%wbbb2=CnPp7EI;ou+D~@@hRd-}! z$xrot(09j_`O*2{rma8w{&kl1ar6S9^9rx>kGs&jV*EvsvXfD)%^ElOu$vKy?7pHu ztJ#_(!`!hfUDC&XtD?`BYBg>VU+sRhoRJ+@qHZn$QNkPFOSI$JySHVvUh}V2Bi)J* zu)K>1Pv zFox`)BY_}Y63SD#Ay~e(jEzN9vNwX#uIEg!n#C+X6SSvzf1lg8vdOq@M-d#@ZrEsG zfw98mKDfd;CO^@GJolpd_}3Jzm*B(axf^JeevVX*2;WrXp*m9s-Va(%>eUQSkNi24 z9>uy4RCnM8a{>xpQ8ez>sG!gP8kS|7p8DlhJ68168@Lr^Tk$#p!}}zD)uuWSjtB+b zlBL$r@*&65%JRp$=`1{757Hk=(+{`^zshYXHfTPAw1jrJZ9@wmtP`JZA9JHgnRmey zmX61w6+5PuL?Nu=`$5saA9O<40(a+Z0ntf8S?eSjHvy+%O!uo-E2H<+^~wB*>BzIK zld=voZiNBo;0-@+W;HOL-`@}CLr^E(HnQ>FE2cF8w6sL^iTTo?0L{s7xmkf-VtY>} zS@5)$Zn*z=)P?(n;0&`H>jE8|DuUDYjx|Jw9EDEehy7)t7A@@##oS5O-`0m? z#6hZq;)G;JwU&9ACs?3HLK0WSB)!1*OXbAU;a?HoboQ-3*a8ALGb@|#*Y7*J zWO9R*vkYofvHJKYFqNHxkTHSIVA#$E>*S#y?jfFPqF&{o!f!>E?&oEcax+ggzKB6u zw0x4Si6w?f$#QHMF2#$|eBSediF>2>{#mDlM1{wdt@T6%395VwXd*b7;;NKOv?-(f zY}OtvI{5Ho_Od}BFEE-mOGItD66YhYSDg?&mqng&nIrnHQi-`#C?KTuEm9&@BwYsx z{k@BCcl=Z-QHG1Yb*5-(B)l*Z1+BJBg4L){|M8Wibozo36%uvbdeN)HTyr+S3=w`C zjz06DsR(?C!_atVFY%WqdI~d=5x1CF@0e(NvIM$D>m69xT~tKVa^;3oT?B z`AL3qYz5+N|Lb|}OTu$}he8wAI}z~^uK*8fNbgjHs3n5MOVM292SqSIKD$fEfQ~FJ z$uxil)|nYeTYZxBpew`fhaFP)RjdJgdOETs-L>5O`|P-?sVp33_L9hBFVdF=*f^z`M^SE=nQ*rAiZ zNFpUn+7-z}2>W-cmPHNUA$`t=zEXM}8-1+6(@Qb%?QpFX@<$&$Xh7))2cW<_#Y z1f6b;A8~(KzpzE-x1F4rg(OH#$=2PmRq-|FY(kZH$3q=2KpQ9DUH+gHJKigne*`~D zhrCpII>ru?1G$Q@Lv&9fY-^^TwT7*2{y6OojkY+;fBX@_$;h`Zrr|a1wmLaBMG&%C zr6lS;Vb3^k+qX|$twK42O*mL#>(z=+yUM5MXJs}ds``(mGRPOK*$GknDw|5iRO^>e zYsII_t%S3r2~+Y~mc!URv(S#ENem$YYKIHK509ymq$p2yBA3ZXz?S+!phdAOsb~AT z;D=O#JX)wAdR1ubh3rxM)WcNG9MdJfCI|8f0o1Y|0=xXNyi{UfzHl&d;+F;y&;z4V zG@70qf0)|}V`MLC=;JNCF;5&_3b+A2xscMcxH-W#%Bd%NnhE#usoQICxzhPM?c5^0 z?4M-KtjrvrV1FK}tZv$kiStL;y5<`UeqMlOZI|>wx&%DC0YgIQH$N644L$&oca>!w z%f3?Y0tJs{Qvm@h=x;LW$BB0XK=hW+Pq4p0>s~{n=G*jEz*ZhRH$Psu{(&H&2i@_i zci4?$=dZE8HLc?y{s8gcB65(v=@j4rEg!bwm!Vfi33LftHn@%cm@4n@B*?CNPg=jm zwyry3PF}kGO@nla{)~WcXLA}(;xPsNB}vcqfN0r~ zzHr?RJ|AC#xPWSGl~SJM_z>=8QUvwX?RSaR$@g&GFXr73mj6mz!;PE4VK1 z525DD>0j#BhY`Otzn*Ih^ZOlaC-15v^%97bsN6=$b zxUt!VE5B@!NuPb?1;2r;+zR;aTqRw!^6=nX`CSBd zTxf})fiz3Kyw(8hgnU3e`{3fgJ>N9#3XH3i#gend^|cC4Pm0&Md^ z3Vu_Aq@a~D5I66OhBW7e#(!}5djpAvZdD8e@(BMwX-x6UKOFT)BXY<5i2yz23hvUs zea4zPI<1ZjW0n&wwsjVU7}a%VP6Rplo^KC9QT^x)JM?ySakQ+7KftTba3w4X&;tc- z#qK94OMpa5d{=!>D(qY%uJkiiIs1noSms3s)^tZUJ4!9hfN*+G<3}0KE0~F=$CX%y zksSTTtIZhit>z0HsXOA3y{<@ZElEGNm)CDvKIeMIJ=?T$Hp{r!UFG1ls zq?sCZNr9J4_j$(Sq5P!yHTX>{*b}@rZBC*S%E%jHgI#LktdEEf2)adQ&AODrzBzHH$(B5T|17LpV+=Lq-2yla}& z^z13he!<1d*L2aIt{w{LYl=wP+C2XO3EzQupjO z9c#*c#N+QOw|3(2%~`QmC#O~N!K`-#6^emPpeul&JqaS~0DP`LJ+5lXYs2(4jqJ3c zFZByn2IWkeqHhZ-<6X?c7h_)VR@iERsY6}<_?p{4d0!p_NKzovxzDdnHrO~SS5yHcbK-7w9N{)KG^&s=>disS7N2Oc|_+r>1OECc?D85j2EMwsF1Vh7waVM_=su}wi3)^lKg?31 zJq&)rFQ)|1`Y40CO*&^RfyD$kM6SwgC^uT}2M*?FD1ZYVehKi8Ha*<*z2(c=Hu4?n z`x(%bzno!B*!WxEwX+|3HRK-O8%%RBU2#ikOkdpgt3LbwV%4ntMyuc>U)Td{zb^q_ zjoH(Wt4)oUB5d%zQ1pDyEASa-(*hYwxS4zA#*4P&<8VB@EGwy_5rCTU zy5#ta)QxoXFC+55wmwTkw+sWfwoXfxbzGVbRn zeahq=Y0>pUIAXk_VD~9UhR@r8JC1gmTXkDI61=(9V+f`_N=n5&)cSEJw5Q!>VS=;cQW ze*B%?ypB=|w@xu>Moi#}hPCIC;_~pEjzy}O%YJw2!dZzHK(7S3z6*N+)smAi~T0&|3RWVaZl69Gjm1hz;3bi=(75y~lZ@pEOEPpkk7_zIpBg-zUa(S+} z8%D&cDy38|OUXBwW2(d6XqEHFxAR{)3(NjM-vg8$9q-=HMMQtN_QCk}BY&R?{gX-6 z;t>3_K|e=CfC`N}2X!EpRx&vG9V-v z)AxdbR~8+d0)!?mZV4}TlH=-~T+It-1KInV^5bBDY9}3_mwJ12W^x`tI8c}&V7FbT zvO7tOYIRL1hU!W03=^is()aFVQab9R`e|kN*}#{x9n)jdxS}h^v->0B0vNqfqQ^Nl zk|o(K4fbWHT}M2`m)A9g?%xy-oQ}Jx*Z*H zH3WJ20?TKCa7J#k*Ya0G!TjIv(3F(o;%Amye4!fU{1;G1KhI08%Jz^+L<^8KP``b;&F{o>lxjpgf~fV`TiApJ=qt!h@9lm z>+GoCCbS>Pw(*;*d-g(CKLl@F@qY zqxEEOIQ_Ya^x7u`?Z}jMGHz+YD4Z+CIvxZMxMQA(FU$p3nPxyYSxE76&Mpy!fjqMP z-E;rmkm-`}BMW9^cNLKREm19>3?8eoj;fv_IfvB!A#Psl9peAO0@;GGa)umeV-3l; z8E_FXJ(odyJ4h;NfnF${D&FNpJ1hGjb%GTxP>nbu&Qr5a=@CP^?j`k<>ie`!Q_AdWhJ1S6IZ~N_$ znD~JT*rF>!8u~7Vy@aRJWPG*z$F`-W`12x5hR8i?Iw}g?cd-%pYkOGbd;6hn(=9)1 z(I=SmJj{FH98{)_)8kKRX3z}WE&+621o|k`Fyw%x=7Z+dp_{$-+soaHY)jEg$9 zrX_&|R@vTopvjaSFbl9dpo?*HZ#9+Yqj(jeLb8pU;jTvIwQa1qc_2@4AW7D#Dso)1 zSvY>K&Jl#NrQ&w|)wH0(9Gk!zGNg?QBEgrO-xMHIt?RR-0g5I7HVMZ?i_d4Al}$tz z9#OBv(&x8dreah~A5p&zGE|J^s16FU_sZ*SL%T(9J5=O?*|Mt(dVlJuR_}G}lBPO! zD*n3W3~1!1slNp21#hSCMSA0p1ucjQl)icCJtbOLPGO5yqJ7jhRPmodGqO2q-ioqI ztm)60)oj`~JB&5$l$-PyU_It-UwN%)dj%IhQv^a~v^ER7QkPPU6PPq&YmPS!6yENa zSu<`bb)C|BOIM(ujVu}52|+6b<)c2_1CBSpr1egGh#i1jJ6kGCO?S-Vn%5KFM13QW z46&iiCm&iSYrMVG-IMz5eTOm!%1CI`t&sw`C6B{nZn)Jl9*Xy#ub&-L!O=gwZI_~w z0FPS8hvp0rNxl{%zHr!nET9a0jr#o{#G_`Z?FA5c9vYvEf;Q2zeF!|&jicfoK958+ z^|QURPpC?Hz8KZ!pQOctp1BR3&Y-ir+S?W|(s}D#s7oOo5b@*WeVh#Z zdc*)C0;9Thkpmth4&~$h&U*k{WE=g<@$t$Kr6qxS|FQSmDYRHjQ{5v431sKE9qO89#36Q5a39H}-gl$M?J3jc_m> z@p$Oa;JM%jzw*S3ca)P8ruDNO{=t>~L-7NawcR~rfFzZ=_S{Uf+SoV>k$GVu5J$n4 zs+yf2oA-Evw+`+_gfG;ekj?+_B3R@W1S-ppNt>-^!^+FK(C@tx; zlYKk&DS|kR0>I=A0IpNR5}57Jl^LXq5qt0=gRuTyUUYSYR{=)>lXY5Pj-=P2I@_2G z){y3h!L|aCz_XO$_UuIr?6BM^AvbE*#2uY452l+@==Hz+>EU>EOa+BM)o)K)Hjq`s>rP-H9NZigO- zyOH;iU_ej^iOChL-Hq{ruA1T!pP*8h=33VWy9mlWGj!I#N&x)2u~MpabP6OHLPD=# z*AG6gBiWs`Ev+>pH!S{`(r=vlwU%b%Np2g8rg zuNDK_Wi%-(`&0jsP@@C!bZx-x+8Wsg=yBQ1)eQC8Jv4KB^#!MyV5j_T+Znw$O*$nE zAWN7|`p>{a&5xJX1LyykajC-D zLA-3S9rmLZ8mVjr1Zl<{g&K{_6DFuXDAqg%;K={vsg$N)#=+m)#-b1xP-_XEbEuM% zjgZuDim+Lq@?`K9L5tPf8AAP^tnw!A1`AF2stfGCi}C~6LGeyZDd_@ya~R+L zk8Wl+h3MRc1(wCzA(r&PR%&dg&{?~{CuK=NMCqu9PBH=kZ?`i>B60+e;-#aq6rTdm z1`#L~qH?Z+l0q`2X#x+zTJ-0dP-iqCz44|hwNc65e813%u1sXoh53!IFofy+)%dbE zr(hIY{}%qc941n{!oa5mzjPKXtSXyEKLN@`yLs_TNAg6&D5|tP4Wmlj=FXq0tl+c-fy1)!|!RDDiI>=pxv)FNT##@`Jrswo?H!1)yue;8yOd6uC47pA&Ki# zq((qV%R66E7}eP~v=G02CyUdk{!i#e!{E?YnoiWjZ*&gcM2r11u*8!K17H_#%r(hA zrgLMD!jis9<9pM1I>>w}Qf$0s;w?V1rF!69Ud-XN_-wz5IGO`_@jyATc3uqkQ57Dw zA2ycVF0LZwt}s32)z*SUo{=4=JGPp8Ja^F1?0(~6zob`1JbKsL4dbXml@4|MfXsXM zc$7I-4W-C062o%a!-k?gR;q2TROz;0bcGh1k?^=GXZX$_ zV2#OmiK%7)=A}kf$(c*ah7;EK17ZNe5iw*PzD-gho~( zQmt|dj#8Smsb9vF(nw*^rQh@x{1*#AV%wN9bcQidk>d^#eMn=Gd>(*N<$yv=77IY)v~k!+v1zRYFX zJ+?g0|EK}FnvKfI!FD4hYa?!HcL^3lsL3WZ?ffW~gdhtkq9S=O#_N5s*ve8TZXc*R zkrFLnAHBNKa2YFX-T}>jG5k$jDfB~c`Z95)M!lo9t24d@SsYuTgxMDes1~D)%c%uf z%sOMLFzml6$_Jvx+k$S`C}ZsN_34Hq>^JhzM2j13KC>d;&K98Z)Hfp_5NL1a1gV0! zdgK!_XkTQDDNs}j+4m-riqh&C8;(r6D=*1D+51&Lr#=FizkqqV_IZ#TkO=`?Uvu?o zLR&f|D*jw@jt*Q{5w-R_5z|H&ZH04a%1)#WNf2>;InKO zFA}Yac!;U@*YbK&Pdc!X%d2%NM0O|V@9A+#Dx2%9pqzFzb&&N))L>uE*Lz2c)$h~& zj|IW|t?=1Z6iN$^_5i?+;cbhnHThezAnK;`6thcUV?y*yc3mF2g|@02^+m(sy?k#a zG&J|D+U*o>4or~_9^440eHi?`*OI0X6?u9oUCJ{r?(u}NPs866AMF>|zzRasy1)n(R(Il)T2iOfs~wlAGK+}y7SAXioSpV`OH z947u|aa+ptPwL4;;y|atm%2uRqn?TD^7?7$d+aO>_;K~Xsnf<=qO|+ieO8)x6DZR0 z%`CiBZe=iD*7xXRv(fR@^+s~!ptZR1Fis`n9%?i9$32+GR4(MgZi@@i}FYieG1ux z7k5~5BhQL6@cS9vsPFFfv=M4c$ihFW*zBk0==lv|kVNG|$r~bOrhG?GwZS*ViGC>Z z#npmxeLNX^W7_pF5a;+o+4iK$7j21X?DQP-5$1bTwdiy%2MaIOojpCUKv@_QByP$x za6=Q4EtBf1QP4Kp$0jS-3krwkwfmn3&Zw_fq@q>&Cix!2!?{Rp)7_mtT+Ktb}|BhB2p+%AuFMIHO>k7{f8uH|6 z9=Nk5mOx=?kW=@e6jfcB+z0)PI-v{jx*~Jf_X&=%8>EGQ+{b<5#7!sZ;PP8YbC0{K z(?3d1>5&*%V1N01u91oA=VyJgH~8mRatkgUlN7tt39R-9&OL3okM%cT_rqU~5%3w= zIyvv{JNbW1X}TcWnE=skc0A#)Xt#}kHl7jb?=e4On`Xul>?fqMyWQWnD!(Y`V_;=< zH}9pUM0rv~nI}GOOoR#5J8;EvUU;##dLqs9j9Fgit3laGUoizU=Bz&y!mYEn2n9`F zUEQE?8Is`upRS1z@plr~%5*;S8E{FnTuiw)eRpa%pRc}h#90cf59BymM0)AWI~MJ;D9pej_8wnh7U z50TkJa98K@#=wTnEj#Go{=)TcZ^9ZD5x3T$I=7bqPLpf&TWUL3|1_Yy#_Vb&xTP~y zgtzHz3_OCah}dvX-DC3-8x@*IaNq>PHmc6kzh#nmnN^*O`Zu1|a0Zf>=^6y%jF_v| zo>H>gQ+E4Ly?easl=mPg{24aJSt!`SQaZ7T-&1%ptjB+9Ojwk_yuB|uU`w&RhbYyZ zO&T}7M+d-=`K(r(U=8!A4}`ENWleqb->SuMyDRgmIj*`S$$t*`6xcLFv2G7o_|!pl zJ>}C1E-j=ii{Mpod*)vuK}1kVZhb}+edjWgBCYxE#G^9-vx9(*UiNJAm*PS4rJ8<1 zuU5}@M0R+4OaGFt%>8Aps}~kkmAmjrP*x50cGc!*M1Dp%f41u+i13;*YfTp&_;Woc zfM$+mYs-{WkLCUUb->fS)v1>jV@Q!1=NU`oB zY4(|0>-8A3L{SY!@Z#0Y5XdJ@)tuJAzHiGcqKoa9PEHEq2H?*Mp^>TZeR{Ge^4Ca& zM_gByeDK5GIFr1JZifGV??*rW4M|m{FI|j*FnxF5;_Rf}6t>)Bc9Ud^`M&b%BIKW+ zM1PQKh|gKBxWjyxj#up;LJeZ%b>C3q-eV}S6rMMfUXi6Fe>(S}%9tcX#vG1zp$hNJn{k~0S z?_|4n>8~#O({&D`Uz6%TJIy8tRbnP3QS_!bw=|zL1MpZ@V5pXR!QGRI62oooq=$RU zZU(4x9mFY}W|31%vQ1EZI|ND%gn4vgVuu7pU%*yU|guSmV8!6n79$n%5wWIQir@~rtcc;JVZe{qUR+H`cH+t;}?#F|FtbGuRJhcmgU>ZHtv^YA$DBv_9 z67&u!ySer;_>Y`7}|7+uwz~Ut4^^R6WIy^^@mm%Z{@a z%PbF9LGX957)k;3`NekP$CCdY>(~C}-{=Z-0DT)+yvu`sq^9b#+s620WY=YpMCn0k zw;{{^en)G5`G<1-^1J7GU^qwh$^?;SU1s9|jhQ-=3qElTHDqo zYI5OGX8G_9)C7Mr5Q^9%=oT@ za~KUe)Xx+LG4ocnQEpS20jX`rBP<#wO!x&X_(aNtE`LR&0(_p@nnXNy+5Bf~-&7A} z|K8doqJ5U+|F_3;b<)`bt^8!-qj(jpu~O{$@M8WKn)+j=S68@&Wuhnq8a~9FmNwyB zNs`T}iF$J>RMKY`$n#lFh)=;oV(oG46N%t{bJFd<8*zdL&77~+XcMrzxqqTTbk*6n zx4ruoMrnRP-rp9%gmU0JkJJYNm|MbQ69!+#Qz;Ug$p=IH(S`>_;DsRhU0C?E8Lm9+ z(UIAG2ykV?C$Op=sEN|HgqQ7qE^bBua}eYAN?ErzNft#RR7ya#q_5P|f!-H!WjD^4 z7feGQThR6Avl=n4NLDugd#tigUHZG=eoKJ`aczC!;W_TD=v%BNcw zRZtK~k|k%5IDjG&2Sk!&R5A=fauNh2k4lo9lY}AXEIEw=O3q;b36gVWNW;u~$KSX2 zzUS0Fb^p0_>fWmJ{lOId&fDEgeMMVV>%w*ehX;Kx`BIdJK6+ z?8&0Gc``z=pUieG2anxt8hA>p9!_X;>$y*w;@HmpfH4+d#ksdnc*G4uugAdFQsBbt zca-7`Z+2toTz@f_8%SdrTVs^Hqa&I0B=jjMhPa3(M?6n`=IWn1#QceyrUi&8@DOu+mBU zadfaB&XGH@lmzaOaPpDT8@yBSae|oj(z(Fc;3CN&(w8z zI60LV&E}i-c^_(ftdL&(v|hyPaGM>FxX$|N=G{N|e{ihoD;6iG^WWB!wBw=43vKfM z)@Jy4bo+2_>Gc`Z)Z9n66f63%zR2hlyb`0Hcl}{t$)yZ)cthCkT!Rs4IeI?z3AINe zd9_z>WUL3YT+&=Hjdt8y{Uvw}+jKlsB}9^_{v5Nrnkr!HK!Z#~uld$rxWMeA}5V{u;?u zz)2-=O<3Z?;V~bajy38H9tiVPKDO*^jb{3GZEJfulII4_Cm>_Dx|-OZCf=!ae> z1LYXZF4kub(*rwe-w~dv&m=#+Um;a-jpIP=#tAH;B|A!=GEW9znG-cdbUbSE8X*56` zk3eUIggCcfFG7zUT+^6yc~x!`nmu5CXp2o)@ch3@{D3=Q{m*PBgnx~H!KMEGiHA6c zU+~mOf8r$+Yf(a_uKi8bo|$ru(fxaCi5gE!B}0n5wg{P#awnOOnZ(w2hjB1iF4c)wSE4B)a5|VR$|tH1T7i>LUhxMlW?FL{&0WyxZiFQhG32ps1i`D>xK$A+%pNq3b?lP%dD2DF(&$Ah#eXUpq`NxYO^=k`pBaXE z+O4m7Q=`;v)BQ+P9=&`qlP^>uO}Nc0y(}lbE`cLCH)K#c#Jym4s@|}z6m~Cttvm@h zr#uhPuJ1D%o{S+Uds-q0eA7X@K%Xz19*Sx?@PW!^P0%(3-Q?lbNjeBj>-ka?xaC;y zTjQYgiwn&5B6!~=zCkQ}D&0EDKH*>yynrh51>6r|)-LAgFG#wL1n252uHR>QFM`x- zccCqqqQ4(XsK9fkl_)T#-T%yM`;}g3)cF%CC&sr95Qp`*9fV>ZACX~|!op~mnXxQ# zR#P>t{Ku|wHes1QOY*pn_HG-rvHj68fF&@b`V`2G%j4QkfUOw><%7uz+VZ4>zucyO z!}=%{=V6}RMAgqfI$tU#KnsyHVYsgzZF@F^;*BQ3J^vW$l)UXe)!EsBATV0^M?0sy z%d)<>={QsJxLb4BXD8XbQ$)vY$?oVFQ7I5Pe&Oi&+$#hv~RzK;MgmFd_ZXJv&|eapjBcU+^N{g<*m5Y_&n9%>hR2gz0lLVyu9xPg^A+9Enh3z+fz#?%C7@uC-#OaBcJ>f29Js#5j4r}=fju%q zZ}-(I=bPCmcq<0(3)scXv;(ad0KMG}){Q^c{=Jgq0{sCRgyk0aWk0c8!>Kww0Bcxw zNUpXJ0lN~3f+=m-JJRx@MBH=BibTQN56k*^uErel#YChbS=#G#_8kK?79Q&m{+_}7 z&BK_QiKQu^67BoG7&i)2`k;uFtR=XtwM%IO+WPLMN;S23vG5YYkK0m?Xi3hdr&@f1$YS1w7YDx$)1eN4 zO5RGjt*ZsH9=m|1&CGmfFPDCP?4yxiiFOdba=E|=l)csi#$ISi zwwxbIE8^|=t97$yJg| zAq5pt>F9t((Z}DASj2skv6wMahrbosOzakE>?iEJ{|ge{rf~xPHUOUhCEZ1GPKlJ5 z8ur*{JQ>N8s&FRL4ZnFQd(%cThdnv3n|qAF%YYmeht|re$V#*--&id{aDmxP(&sMh zVEC!y>ZMBu^*}=_l2nn&%yx%@U;?-lom)?%HnG-Dc_R?Z z0`ro9j+$%e!k8dB!BdAsq;)#4p!{M}m?85H&x3-VCA{BB{Y=X3?$hiMtiD|e8F$Bt zu;(yzUJv*l+JEZHa;hzqVq+=7f-4DH#5`50Etl@mq`~uyLtw@=9NoHKT^o# zjkW%W_nWZ23~EZr-%yDW<*SW;~_ zH!y$Jw7I38guRG1zR$B5Xjk)jA#{8o#l(=GnBs;h53hiMQD;UzINn!Cv^pr$5bZ|G zn~Sxt*OstE`YLkn57I0|4nT{*Q=B{(l{WQDmCOEkW~)Y5jlZ`|FcX{c0JgqJ}z^KI2-;_MUtYG<9u^^eTk{(E{(yC zPzP~$Gz0rIWfuSh(ZZoGxyleFnb^7FZNHsHmUag5t~PDT4^E!z8IU)(3EYEAglb4(Q z-yZ8>bZGOVDXBQANZXj!_=WBk-_s1LEQ1=7n4lB-Sv>NKAC-9hLH?JRCg=&btsU5F zyb^W=1(lz;RrunBYPWeiDROpqV9D}&K)#4FBMTKzbqi0}@_vr{x;EgoyQ_;05QF zqo*6RfcupT&!>Z{4}W{Gou>mZG=w66e^MU*JR;ZtS}@p**0KQfcP7?ZpO|8wJ)L6T zCFrmUYZF|OUGR&7eJf^0Nh|1g4b!MDrw}N&HniMtr z7(wSZJp|`8;uEWxCUUiIW{RF%n7%)c zgcd*A=fqV+0N#)7LHU)y?lrhB3%gJ(LW}V#(6$$t!$r7`u%UyJ7-s7i^FA6+iD}`o zj2>!0Q0K|KaQTfMnrkume04;7W^A}QR#Z{2Nc4jEDaLg|IKFifQyw)AQfdD55(E*E z7qWWz+mGhaz1sxYeaZPjv}1l0o)Fq!PvO5bZ2#a;((nH%jye~EV0K*&wIm)T{e1zX zkDF-jcpBv}_K2zJ_LJH8L?QOCE}aK_T{9bq83N+@TVEYjUZ#=_iJ4y{VPACE3&L~0 zrQX27IrwEGy&Bao)Nm#0`5ag5BbO1DqwU41`iwtTiW@q~oKN(!2?8nvk8`iM_Buo& zodTjVN52#QFC@boeXFX|8EM-=&{{=gnGUh!e)102ww9B}T=B_L(1Kn_%}`Yh1>L{J z`*-X8e}ui#dF>BTDce7>7p)?Wf03%>_z{cf4p*E0n>qp9zQ6e&1R=fN$^I`v-hRCDD7dW`xA<9IBQyS= z%D2k?UHQM8{l5T5>^33H9&+()C50l}od0bh{p5e*OrVw;@((PV?oB(@`37+*!brXi z8{-Jkox%6fQf}1tY}>j#;A`|Ux``c2b{E-1TL#vg7|FQ#aBbs^ z-tC9;K@U%{2WrkyBz&B^O=S_g>B1hN7B^ZkRlC^rn%U!)|8oSe>HJ9^M}Vq?k<%Jo zq_YbjrutsPV*TXWec>{%3|dTRf;ufUiyAfzZ=mQJ)U!t;nsJ^{cSkD1DzTeCl)TB- z984@&%mTG)RXq5Ij*oc2i7D3R+5>Zgk2F`6Ed2c{gu|u+yicwu3McCK)x|$1Cnlm4 z_s;yKqyYaRyjGqMQS14WGmRy->Sd(>UAk z{0NY}=6XQud5pwpo+q{t4>3Ty;W`rO)%mv^C{_!D0U>dl;Vfr{9e{JI!{@sEDLpz< z#rSH3FTjo^j#PWLBJ1#reT?JS^k+oy-SUos)Q=P|v&|$|WO?R4r{!;pE-9#gC*XWA zYxzr>#arL?QsjZXhCm`K)wiQUgkOs2ZSF+bAD-QxbeiryR+(_EmSwC*>WaoPC{ebASrx%9Me<02F-ywYuYx`u&LRgx6w}LD}34z<|N)W^>d3TgL zdo=0J{WK3V6TA4tjhB4o zT26J#Ez&7ki^^Asojh?i{s#f3swjHt^Q@hI2bb8BIgg^4H}6M8^_-~G>(4Ml*ASnp z^_?5Y4fQpu6uImKY#0o@k^;}-szu0i5b9^U32(c@6SE)!dUi1RaG`! zkC3B^KHS(Mlf5^OpHQ|GCSYyx;g)9$k6>kPNQ*1WpFUA{=?^_C;n*#%|=I*BTJK!HnjZCWjCK!@eVeIL>?H=WD3V;KL))&z|`Y-Wr* zSI7vwsE~epF9@rd@z}3IP9bm8r%bCh}WTXVtUi)Zt`qGH($F*bUaNB%Vst%+ryge94HajoB^>C zQCGC5H@#w1NlhV#CMkOHj&TLRW6jG4(02KU@IAvdk6; zt@g8VT~be=YhyiSDW(B6hVMSzEe$>bx5gswn7a3^Pg&`ifYg`&pwEk`O}$uMHmd3| z0DZ#rlGOR@K`PSHr?XqqQ`5{hvbrW96U}g34+7YG>M))14{f3vVIj)54t%$Srv~)1 z4cz)TORcj`w@^o7ssRS zgKS*fX-Kl+8xz0Tsi^`z7U_2=D0*NjJ_5w`j&;+X@j==bbtg=OS3=>IiO-ej6z3!M zvQcu-oe&a6o&BqIliSP79AeUEM)L|1CULlI)HQZV0BsKNlZN|EjI<0Hr?`>m+oN#< ztJ}fz;#=Q$C4d?dDg(jTSUr5kt&`xW?5BTMqv+?xR41Fkr=|3{`A^`VxKjj&oiLJ{`pE3SGJnsTFN^U!=vQy zag@swRJ8)Sl7rB(`HD*cm9fwVKfbYg$;+Tq7JT{q=h_ zJf21(I!5s<~naW;F$8}$GxioJKILt-xVy}1zYn5Et(Sh2meUSZ-c{xI` z8K)Im)x%&0@#qa`)r;W2Y2X0nkYMEGt5jQ{VQa>#3t8$U(`1krShCwF=O3pmXWEKs zdZqJR$x5M;a`xhZMjhN(pnj5ks>3&+COK$358`f-a;2lnZ@M2Cc8)cOy3oJZOisv3 zDP_B~P^N&sO6;pBnm!r%8N(he`Ns3BOJo95hOJnpz)uRcik^r1qDMKQOeM}YyWo7Z z@Bx-3&0r%j6eO8Hx60Q_HLh(FM93;vXbS$BSEp8I>6UIc3q1tssb0Ql?F;*yEAWUD z^XnmdJ7c9PVP*Huk5Hyc=jT_Wu2lfcrLClN)I&hhQMn$G(tpxdgRmUTcv>vTh*Y{t zG{zkRe9tZQOhU&QUo%DqIGWcbG?dxp4&MVBuSNeM zU`K9YX?_L&d~`#lxGv{n5_p#l|Hq!J_e}cBZBD4D6J+xJ_WC(!wbKNnO<9FRBcQXM z>yTvIN(U#c_PRSRJb#qK-#ymAzLFq6RdCmZfI)?9SeP~+%O|YX-~b@U$=eE!*mydd zIf!+f0THg>Nzi|?wPCXfs{D&)7+WAn;D^zD5EePA<1E;+ENe}!5UQ$2$(<4T_cr67 zC}Yu)>ZphLZ^cROrhwIZgg_a#u<27${$L+Ff<+xKEQF2Y|Aon)%48I_iRuJ>kwmi! zg{&{}8GBc7khuwVQm3M}VLU_6EZn|#1wUdFz}r?SinSAg;L<&{mU65Mtiuu%_kX;J zoP;IfRZRef1HifDL21Bc0?bmxMGKkbFs zo$HnU7~p@kj~30eJxl_?W^5NHWzMp3>Xjt3HZk^b3PNL8(#FZ~ip=4=vEKr29`E7M zzIJNEv`q2xMIF7{XYI}MUWXoxK-mi|b@c<9?IYCfRyf*mq-sdKWGJ^3xDj3(DXhh( zc4`5yHaF6pSx(SXK!jj>Zp%$SeSYG}b7k5_`)bH)$%xHK7c&f0GUpYDEPbPAICdui zygvXVl&KisW_n%p40}yZy$vK;R3=a~#^z5j2 zhl-z^L{)MQ<%==pj`+Nrna(o>XQPuV^uN;N0j%f>qcGs!&&#lar;IICS%YC#h}LfG zvkY!5x3SwxepStwYw+WK@Mf=@eLxB{S=NBAxvph%>F?#t=83H>D~ZGddNp_jPh*{k zW7yBFf897^JoZ6n53pZJMpgo0{vH)?TQG>7$SXrxPHMvap<_(5x@TRNqVFnJ=dOqm z9+RORnVEiI!90c4J*pE^pI$-Px8QsI4rO3dpQP8#RRIB;_QC5R9nL#Tk&gg> z;W3N|*IX#kC)&&^w_NGT_f@a&_uiR$V?Xj$QtmYReDrmJq9;-ltgLf-=EgztRssq2 zS-CZW&$uh+B@-doR?TIGw>=_ivjYQUq_jVUott;rN`z4Cizm}+19pYM8-~TY+;cPt zk=3e{blfz(z?WeqBS7LJ)R)=)Epq2=qNe_r;u30ipKU~s_AiVN0tk)3auCw-E3+Df z{#ol`i{MYJeLYZ=M^b0ijtE}iWF??+~nfI%<7bKPaZ@~;h455e|Y zcnWUp_7jYUzZd=AwFHg`t;7V6lwx-sXi`Hw%uwlRRi0u@0%`b^l3>b?)7Z!T3Z2V> z?(ziy6@9)4Q?DoLE>9Ns(D;Xh0TFmhh^N4+;xFq|id=@tKSUQumRpI#jQf7$e`&5D zMvryj1&QILg8<{d++mWn*M=(kuMi**LaI7y~*oiX2 z*fPm}(R=gf;*^Y`WpOfdgClad9#KBkP)aAZyohzoh>lmt#xj6wiEbyQl%@kdM#z}o z&Q-QOJ~?-3%AfiywU%N@It6G9d28X{_qrHAL{~EXEGXOSO*Xc#v9FlYt(Z1dwW@f# z4Io{B;$KU?(0cwsYpL@Y%PFV4gVGI%S-_rY07TSpW_0KC(oGJX7)BA)qO=I+U)Zv}0oS{Tgu}l&M2nj#`Mj$~KV>f6NDUM&i@5I5Y^tL3 z=y?bNW@l#Q_x2qsO^Ho?R0wgvA#5S=zCbfoRH^-$G)1Wm1|8WuCTnH5^=e`wo((f#@@g&gy@W5Hm`QzltouH>hbE-mA{ zYC$fdNha&POR-!@$@XWdu2cCbTyIoC^uo=#`{;#05Y!)4$Q(u6{T8gGa_(9U};P~E*Q&{;$9I}wXMd&atwoIb_2^%t*aD53% zjy;49r+NPk-zc`8@Y@E5pr=8IZ&mtUx=V|;*F>dcDC?YNI8tuA<-N7Um>?;ed#=Cc+OrD`AhmPy zl|JATN`e!M&&XHr4d6@S#D*^ znHMoOxU>zX>}P}KKLEH7vE0+*RF>z1LgWZm5JSMJU==B@)yMB~hdz)?_Fq6bl1{a>ZiW!Fq5Zp2t zOU|=in++e}*l_+@qO?7deCK1i?SS^<6UU!cc=>(+~Dy&G0U!kW{q zceJm+ao%R(n{%6tlrnNn>z-GCjC_QijlUI3v8l>3!hvdp4ut+ zMt{||=I)N9k1kAWiBU7sFf_#Wrbr|6vDNOwG={`Co(jo=&Orxzem;S(5kxmjrA>6t z#uN6Y6(qXiDS_cW(ks6&%7 zJPfIN@nW-T-n(+nTR`5g_Rr$B}71GL%}_h>fd zr1-^=kyTrw9d4~DA@F%Oht#M(C3E|MA9qQ=2Q}W*T2M%>*)cV;Z(Py6s)Uk^%dG(Q zHA=o$IMWYb4~H^*s(@|`Qqvunw2+qC=}c;ugTkQaeLaeKgf~u(nx~uT&S5+p<DO!n-B^hnt_Qa{Y(m*dxxx z_J4$S>Iq)zdXbZwenmsVPa9CL8vm0E;F|Hny~D+Q0UxJG=%(~V2nYrU481b7kXUEF z_<6$eDL?MAOOKA4)OuCCYMuas0O4l6+WZ?_S4 z4Hji-o5&ZSK!}drT?~8MsZ%TUaWoj2A>@C(Dz{OmDYa2uy>g$Aa-HVH1qy5)p|O!N z2Y?;D4mQ87_Cul+EFoPJ32E*O@I==hdeZsFj#P$W_t{UNH*}H0^b@|ly_()ppla23 zrZec|b?n)SCCZ5QaQqS{U|Gm5ifqTGWn%csF!ia^SDC#Ti-@64r$+S`nT4LPm6%1x zgz6C}wEPR_z9Y#_9I^_LZc!^Ogqba3qBx`pY?1I3Wj+i(-3~4lyc@P2_u%-W+-KE4 z%?v}Rs@Exce+Q(f46pod-Zaz+x+SgvNodeUK@7O}KNUxVZJ$c`wY^&cTL>V|^-vH- z=+5N?)BE;9Xe+?8fFX1ZE@`AY``bW5@_?cvT=vcPR=BwPD>)RdO0l<5{Im?_q zV@k#H#n{3-ZGD_|ReT#_v9+!(1r8snf6`N%`c>Mdq~s(sKZxM!nEFgwr0AmWwGJ^{ zg`9y?%#bT;#sLtowXtn|p2(!g;##C|O~<^O{5!tYAVhMyQ+QH=)OOnAF4^)KQ>%icPL^I;AcM?$aj~gF;vztLBFo#J0l2qrK6OQA)9yRAPJF(Te+@yGnjOe%nA))B$ z3LznWY(4n>!{n!BMwdnLHoFvrUB{rjg)MVJgg``2n>CO?u(s>c-9YfiqRgYb7*6By z_!d&+A@W;gQ2k|<*Hwdgk6!!p=eCQkF`nhNJ>AJ~S@<+8GX-h5EUk`CCB!59l*(-v zRvBHKe*yx!;{&)veU8+oCs#tc5Y>$nk;#Q;C4{P{&pdBvmtC7-#ogwqy^s$JqFw!b z#H2CmFtP)f1eLGfMR0;u{JX9DQTZj#-S$XJmf4I09dJ<6z!GMW)Lc%1_2Bh9_pE_K zX1&$8k!eVO|1c8xlNYn~qSY$Uon6?q_1eBmd*lM&`ysn`#W!lMUD6j!bP_!&VdD|- zi@a3P!B;ge^$wO=9HNLqu_ks`y>@~vm#Ad|HJkwf@3+^ME%tg|yA`b(`b}BInWGlEt#$kHzD7Nwosd)cxb^hto-=f3xKADUsld*@HFC!M*kLFIlaVV=i!Xm%HG{aOj#8_lefn4>3L zodrNeh=k>bs7`(wl4I6pdaY6NB6P9ipbC)M#0+Th#TgTOF_j3g7H_^ze-s#6B%C``tf2sRb8oG*B;Zl ze>m#Oy)w7aBt5q-Vli}iP3HGA34y&+hL5@teMd502alKqUnqOwnWcwsFLzJCgCw>l z-n8^YN$QL2%wqCQqb08#Gx-x}T-+2|x!jInUDVhZ9`D1y>UGM8Qp8Af+mwRF+m2J< zUHA78*_ES46JmnRrsAf>=U6&sZgcYYPr3ShHGRNe_8)18pAI~tFr*j!6R3ZMqVv}J zwCauZb?m|ow8{F#!FTpeLxzqfMdnV@vS#PQ2PD!jErvVKr@f04 zh{Z2XTCs<5wHHt3u0JP2@fx0qW7fXKiZKP4p`t#t@2e*-=HBWJEK@xyi&;44yW`I) zXt0ug_4e6${mGpw0u4$A-63dHB9Xp3~Llx@7{UTh;GY#>QPN zv)lr%ONzSUxHAg(z4t|xLTd2$@`A7XMk)!!%wX?b8IGthmk+Xw~kCmdvv>vqd`CB#TFh=&{<<;4UiXycD7>FS${*X{csJ+Poc_HDN=0j`(Q z4MB0M#FEP?R5Q*zrrP(4VCbo%k5Xr!HJMHrTzfZ>km4yH%;`Fa16q}4@4ZzKVqd;L;F;=lmdCGVS;{t1~aSIqqA@ zz|P_UgJ?SNbYN?sC&*+dF7a)p{4~s!SSajYIn1u+K}4Ff4*}3kFS11%0uTcZj!9IZ;7pFr59ahZp{v73+=ci=QY6f zN$b(;p3h(O(e;b?v@KQNuFaG)pIqlxa)Q<{*`o&bgTBOzzTh$H=>;7(&iW;o;g|;)7N!u8+Q+Yh?c7P+k6>@QiM$3u#rZ2ZYj5A)eE{fJl42Gb=svqiKp7{(qm$Z?(*bw zgU5jH8i`9`y!2^(nPKlg@tG&6`C1U(yz zZX>?c&21SY)1g{h-do)3EAkb*TNjCSp5_7LsqOV?Jn zub1?M`uKkrDa(r!{(e{O$m26^X>2ei0$z=T`>Wj-JQY{zb;t#}u@G6gV+0JZin7hqJ07Wzt;h-$#aj_&Xdb9B_QZy(cf&!!2{u zQ5O?%@54fHg=I%{m}ep+z{+)e>>=0~l>mYI9Xl+^mfpU0+wcdY3HV&T-QW+rkYqCK zeR++pd1(~QrR3OSwvMI%u2Uppn0#-|Exi-&!6o4G+rAO<;MM)SdfB8d<%lcdUFmGYg#^GC5W`@7*{%k9u5DwL92GqSz zFk*zxuW{90ts<^tGJC&6lx*>SRRehPmXQYD^a-2L^V$zPPq+;3(*${c z)cOt6#dD~f2AAeVLrVgmnGM$!FAEktN^l3rcw^Y!=* z-x01A|L)loGXKOKyXH)Df-oqzZr#9}sJ}-Xui!*`$BbG~9v&8%gNjDmorq6>ozYKa-qrYVijH&;{Nxl>kA2%<^S z6fhtY0O^=`Ougw8)<+BWY(u2LQXf@n$sEd=elebSr+jOPc!kx)$bHPsTHAQBinm)8 zsIsT2WFK=4C-U(2|7yFmYsvgQ0>6>J7Sn%sse5Ot?@}ft?5RP`!W9q0Dp&?Lp{2+| zK~mpU0Y(29P6mAJis_=KUH&sLcOpg;aRWsFBJ`uaa}thurtUWx_@d*u3O z*1P9s61_~(H=mbhc49n^S-E48aK~h#QDnO-A^->uW!4{yCfu7F4pn(%)k-q!so0S2 z%|NP=)pe)jlIchIdQn!V=hN>+Swe#Rp;Swl(K8;3135vX(3xprMkHvPHf4NMCBvVL z(Re{bF*)WJA4%<1Uqo?gFrxg}r2Imq9( z=6~sl;>Y}p`YAwJJUq2qUD+I|Dm}pq5`HntQ_@G zC|R?~GJG}(P|lLuQ!jq|v}-28(`dXoS>l?DE`Rc)Dy?v0#!`c1L<(iB&j?bKmWYBa zf-Xg*Vq2I<^Eoiu+bPTn6&)YDpiK%AksBQnD%$H&mwrWjpy z4xakkHFOeakHB{&B1i93KaV+{|*abs5o27R6^SaYc_xYJv-d^Zf=B#ync}DOIB$NFH{usJ*$TmOS7(H#?K( zKi6eGRIeD+MS7Dlr-7wdbzgCaB6HO-sXW}P3Sd`DbA#wpB`Ecn)t5$}_n&h!3(Wnd z9*Mbpka?8O_|({?{T+*LL?cNG!G&!~md`_7pfU>GbNVT%2HV+9=yMhO_@qHWyF$(< zxJEq;(EGZYfpw?DGxXO^F3zr#w}3|AB6OLnoFVyUjpGAuwVtrBlwTPICq`2|Yi;Aj3_QW`FlK1@PRw=VSPm)IWVB4*ko;t~#=4lVo6 zP|HWcE_?AiRU3Z=hBtSE_lgs+cdr?hxnQCMl+PJ|B6gW3O{(S$VW{Q&W&d+p*xngt z?AOd)n;ByaYtL?=1#K_=*jWc-Xh988cfT9hz*e8nQYsX4FC$pwYY?7Q@_LSzzvH#( zor^&z$77#vm*X{w@VRL|>;PJQfwV8nJ#<%V3%Ed~Sft0pS=MD88BYzQzK1zU$Yjf# zSlpzL`r9dy%V~rs$iZU*tHlF08ZJzksqh-2!+h%qA?MOdtC{-^PNcW0!IynK1G<9o z=BQ`)5P+2R`FbX4i;{0^>esE0H9afictIZ1-SV`v0CQ;3qU+|uav21!pSSlV6z8x< z{&svmdf?&t9WFS&Ma&6-M2-y0d}yez%?c|l5i+-vW&3ULj2qlaN4gLYk+g$btz*J9 z`X05q*3=C@2!U9rrtezOd#d#^=doVB15GpPuystrr|X4u-q>blW4JT?5<7?tjaxhh z>q4tdMzV#LyPFo0XS~f%%*?pXry*9C{mZHBq;GZO;)lmI&w@w4JU)m81x+cH-#7h$ z{??ZKsp|FP`?ivE$!v13Wxv9XdvwnKh3^z1`x`@G4zNd!WOn9QbKCDII{nA!*at)~ zi1QTsVEG}%$;qfW&pH9c;amCtj97G4G}v3~U9tF=Cmwm&Q48MG(HT+7ljd(c61TmGk&sSm{ggFoLP{ zJ@+zpiGs@ajG&N9ieom_=AM>Zf8lP({5phs<-Lx=*TjRKh^f^K;=L(MlSgDCq`^H- zg+A@h3a@700J9R)2VUJHnLLo8G%|=?=M~7PPAzrlN6>8l%>Cs{*BLInP)7$=?3C_y zSRHsi*6>u0Yp%xP{Tf|aaF;MEX#X(dw1e!R{eoG4y@QvF@B&d+kw8d;6)z1d-cJlS zpM%XvfJ}Mg?S_IM4P>4l$J>B;3B?mSZaz7sY(ekuo%tQPhl+#w_{^- zOS^aM+K!Hz5{9)C%CiD!&QYF@>sOaz=ylyaxL^GNX{EPvgEGr(g{a$$XKREo;y~dm zE+wL$AMJC6RgMWVfa6V}@`nK=$jQY#=}q8)DV}$&BV*vM&n`VA1}e#2ghvSd-Z8Nh z7v}jQ8FI(*G`?a(0`t><*=CzipVY&sXHAXqd0bt^z*ChkAh=&_sHkVP#B0wK$oUZ1 z6w8tFY0n!FbY!%==&lEtjeQg@kuI2G*P!YHLkBy4@7q|;rS8_lF=>=lC$c+_bd2V@ zFnzofnszS*Juf!@Y+r7eP*Dbh8L0s5$OZJ&7|f+kZzJxtsmkd^ml`?n@;mf}}(U;Hzbg zq?>tQKpMH(McUmUvCSH^cA3Ce`D;K6T1Iht{f=x|u*a9LGESh@J*idd9m9i4)KwMs z7|Q}NPOp^3Kg4c>lK79);5=f2-89P4;cvra_XXDIUNX8X;Ig$gu{9e(p=_2EK3p=MPW9s*;> zn?Jzv+~xt>ngCe_h5 zB``4Zv?u^$#_~N>&9d%w*UB}vQ!N{QO$!gKY(g?@U8cNFxt@IvlyCzixi=KHPk7Ze z-j9x<@Y85G-O_?8Ec2Mxzg=#-*t*_hN6np3E72JeBK&f z1)O`+V1Z;`n~T1eW~-^!~<3LGfAFn zcIk7UC-mkMXyZkTG&sEC!&?PO(hUWI)?eM8q7F1=TZ}*C`hGR2;3PM6Na)s$TzqOf zTkh%G{3CN_u7Gkl`fNB)!C;koc`|5V`#7*VvzH7XO5$r=Wf&xWxVuD>aM1b6j^X6Q zF!Lkmp@H~4qr5?^o>2B;8+nUcoXdzGMcmv$3E z9@5q`Jvv)WG0chB@;J;iFUPaXmuB%}()RH?ImR>Zop4V_74{wyFY^=pC6wTyF29kA zG;02v`PL{^*JU2*P||$wxAyvI_Gez-mwPM)8#I}{dgYThj`b3c(;t;_cux#V27ma2 zpvI&|IT@0O`}o~V4Sl_w8j^z%;xm7$xeb4+e;4E;bN&UFTpDjZ{9I1|HVEXDyz180 zwQQ(1GZ1vE=g005+YSt~XSi@4#y8i)yZ18^aJM`GN6g#B>dcRy`6?p=_ZLHpyH!vB`Hw>Oh~XmbyHo3`6+G?vnvr@ zWYQ(5`v*&+;K+XmEJhBCd^eu|LVm$O!4vVJ{|AKspPJ#W_W*~%SXN_n4xjbj6MPiS zWPycgB4Z^DZ$NYI0?yFmS}aRMS+vWj?B>$9+4OJy#a+M6bvouUC$c}?4To|!M8{=X zHY>H7yc!->BV-R4Y-86CE%~KHY}?+{e|vKOiI6zIW|jEWOvZ=@PaPfTimWj@F6=x| zSo<0O;{7aof)2kQ3d_T-g)E)7+HRemdXbrb{iD`~&y*TMkb5eMoHmLk0MN(4q^k6O zd6N?At3wp_9>DcP_rek%qRZYBcHVLH^Au|opmwFCPfTIj(;KA6E(0nnyK!aXAen_TDQhimq+{G=idlf=H%CB#B6l0*xXdS%T!8BqKS~DoL`EMafZe z4iZ{PEubJd(?XL|6C3DMQ}}%E_q}Uo4(4EH&3|USN4l!2cWs7`~Mz3T4O zV^FqCUi8_kBE?Ks5biaRLCv?qYJ>=+1=lnd3C_$Ro=y<$Rbe)kQX72;9QZ`xRk;G*_a>(hQmV?Xu zZVgZKF*0R#aIwJ4)Z1FbSkVq;LJ%etnrg=K;0KwfeWPQnFZSN+1gBFJStBbz2j@}aG?&sMRwCcIX+itaB zT91x16Z#QC!VPaN_D#(&`@~0aHTbRcbS2R3T6Gs<^ecb6W|C;FYho5oHtz*RJjEsN ze|y4#jQ_B^VBIQwYSAiez@n;72UXYWJ}`8@ao5yjblIku(mXe4_YbT7Q1B%s&9{;} zT_fP8PBO7rLkXq;agJ#b)aQt7o?Tg4-T8i2!c*OiK@EIq1S~gDN_i^R*JPsIn0dK$S)OeXr`1uT^M5$-mn2mkhTj#Tskc6b_hGvTggRr?1NYC_R={Ca)x&W>zkiK-~<7aG~&k39j0_q z<-Hr)w%*i!;fSS$K`c8Lu`8fx1LdKM zYIHtXiI5&Q%$s{)ZFodFR<9#Pl#|Kpw=piO>{6S;1{LkAd%CKX zA9PiPCJw4|322|$NUcMQ%`~eO1{jHHrk@lzRdt*w&0SsxG!|@<+zC`LuU08cadowe z65#W9o!Qdt^v|m1I8xIAu1O|Q0HED?7Bh{;mcCL(XhwvrN z^|id|KZ&qhMn7ns6zGWws1v$fU@ePpffCvAXuza!57<0Q?zSx!l;f??M_&YOdQkCJ z@!n3WdB^!yk08&pdXAXh(5fq|PO+J>xbU|>n-Z1h_$YyVQDMiaZK)9WfTIIA9prpv z;JeO_SxiwfjO2@Wsi@N62N7Uzz6&Z^CPq(cGGd+Pgh+XgNiE0rxe;;Qx}0)b>46Un=Af6**R$0&{{)uVO}Lx4 zBvQwBbyYbz-l7*HZZxKKwUceU-re7B`0l&M(o$%PgSy~9`T`d*>WZc>`<{yATlecH zJm00Cbl)I;pO}p|jB3i)y zd)e1z6Ee(+3pMU06g_Ri&dfq~*<0(uNh|qAD!n1%vw;<+sWjWE7V<4l=RH=q-C?Am zV7wy{ED%~A@jPu}=cI49eGXaSr?T^FzrWJia!$U_ep1qwp-0hVD9%4QWa8d_F*Qdh z=gWcXr4@fuKc*}nPFtY!p~3sqv49z5lC5WhPlE!p`ieLTtzDeY#=OMw{=~^?#pyI#p|$hh=fbuem?mx_&Gt{( z6n!W^XuKa*WGUd-kpds6dlN)ZakCAp2fFvN144^Y8qBcG)p#^xR}x;>S!HlH?dQp9 zz)V*!b_!08u`|035Z!pDwb_ezX%@G&B<2x)=`i~*=f&UL(8h`P^zHq$HYbKi78a1K zMM2jyztFuPL}8LTIGsc;)0(sVemOz|)vc_4ZxmYz@z7-_@gJ{i{ie+k5IQw0*`syw z1dDFVl`h!5>IT?!uUn+uN>*a^TSxAoeI0!X>XqY;UsteZp*$7sk5PQ_kzcjd#hJJl zcikKehjxzbpci?N=zu@xotTC0GWqd0yq3i!Mq+w>={Fqo3;bfrhMl_51}A>v_dbnO zYv3N3klGz$2-2Ixe^&$uPtF#g*Wd41K(tXw&6z|zJa>Bc31Dj48W;#SBh=Nl1$-IUVqx}yw+h#Jr zC&OUY$~UxkATegq58|bJIZ>(HX2j`6&!6utd%Z<@7HEaqrjcQ^0N>(l&WkFN`N%tH zL48HDCsOB5D+-Su3UDGH$-_?X`cXWQfP(7F$+(x&a{v*4jgNvFonF@H9zwo1j0ysb z67sbazMbs<*-+YYdq{h)UdF#RwnHWhd+9xsmUh*XA5j>_Dnk>?-lr{0sr@PnN3?wU zZ53#{Z&BV`VGk)EvD0%RvtaFfOl}Vv;{9AwWMqBEcp9#uJ7u_%G0p+ zbEnIE0ZJ#oao&0@mr^iQd|dfC6Cq^I42qPb)o zE!~n~2Je88EHL2XTS^S@9<|6qw2ze{B*<>ZL0Af{;xP~tmf(XHsQn-WHkxD6ZNZab zFS!GZP3r!6IWb@CMzZ$jhTh7+2YQLqOA)@uE%Q{SjUyB(db4>1R@KiI$#oTWlol5_ zrqNlFYsbY(+E_W75-Xk1hK``6;Y>Fx z^InQs@GIY)sj2kdNK}>LBaSci`>$#P10#hF){8m>I5ThBT3v2-?|LV<2-~NIkQuo) z`>B?Udp?P|Y!A=|UgKMD3!>VO*(0^^YL;S(j!0r{fLBkp+dCh3XzcZ0i!NGtoMarY z%T9Kmx}$c<-(sjDZa=G_w4QBsCt&BhHMX(-Mmv#|lHs-cUE1>58x05tOcOZ2Jp0ze z%4Z<6(KX@)2>{m^rq?P^i4eeiQei`}CREcj{Q*H90ZCHAP)?BEO+QDytA88zJ2-%J zipT{qyssSuNtMM}CIpSBi7m1#vLqNsZJWECNPv>kizy@3UNK#%kr>AcfQAD=Z3M8I zMMNI=o2RP0@Aa7nKJC4d#~=`uYh}dc?y7y23m7q_!;S66Ymh*s%WX5gI@FutJ5qI@ zUoGDBmwo`}0;Q8hnd#uTw>0znX!mkYX9Xh`+>zSB7O$=t6$m7QqDofQ+9oQV>B=r~ z4jT(#f@ZtaT)u^_I}SEHuxKJE=e~5Zo8ReX@9^XH#c=Sh?!EnBuLz)M#Gc%Ch;{W5 z8do`cq5no|r#9~CF(_{FR3L7Ylo7H}Fcx$D$5X>kc}cE&;Y+u{TGymD{y1w=&p4h{ z$KXutwgd;XHs6?QIK;I|)7hzb;eXZZ;vgG$MRLSvU;TcJW7Uy>q2k-G(%?o7!~ z*&qEn-|_2$76<2xKK3fSZcMih!1ojnCP9N+Cl+jq^@9S0gID1G=}Zk9JH>#CwPOep zujG0fiC|&~FMlmvxQZeI^a0_p)dZDJrdEE9fQ0KZ=j2HEB3>k-ug_9Jt*Z>*X34+)3x#xs!LmGQ z8+@81RXbTwX}t1dUCLmP-^M>Q0KdmK@wKb}x#q*>xUpen^&S9*#F{o8xl%_*ih`jF zWVroDx-=PU2)m0)nV~wkkq~Iq`ZnKNy*0A8Kf)KZ+_5`Yw?CPlYkW8ErtckAqoW`F z!Y%Row@oA53~d>n_?`?Yb}ALYrd<3!pLBLF0=9uux=%45Q!4o=p>I8@EhPwdp74XQ{Kr3BLo;bLUik3rj4EU zE1Z;(72j24va;9`zkO*dlu9wPINhac^U#BMWP8p%%A(!i>) z;=kJ5VKG$w9U*hE3U*4q(6|g7@~DAMxpqV$ zlmvEPWGm{1M)3MU<{Xlt$4RhnaWl$WwT@5B`jz+#)9@05W$fa(Kxeg=sxcVj)|+yR zDET_9j4V8Yz9U$Rnu)z@G?9XlB(>X(`}?4R-1_eLF@%Sg+^hEzZ?)G%WC@=JC)vnON^K9d7o$|V9}Ixu2%!{+;9rou z>8hU6UbB4rljZX9hJ3{Cu?`~??Ge%W$@J&828V>rg@X@@g%Kaq>XHcGZ5*!$yy}Ru zHj!*wdukFq9cWW@IDcqa0s9hXdz#e|t!V>wH=u8wDrAh%^xZ4ke`QF801cAU>u759 zFe&$0h32?Dd~}fTYdj%|01P2)%}aB+7a}=EIUAiJz1oF;(u=}rA}U^Qe;j{0S5XvD z8?e(6#TPavE~8&U=UTF7W{d>NOsaTWf3ySR`>80{Hc$`1(}=`!0vrQi37i10HUf|& zPV7O6W9x{p!=uTk{S*AcI%-7?OS?SN(mn?3u-I~|z?(*pW`1GfPuF3OqXNH&H}L+j zBh;@~QdKs28mLA1nLeG+BjI&v(s=6zS?@oD_`etR1v zr~wRK6vw9{OfPM_Rw3$v38EPe#ti%>!B1SC;5Kza!Ed*vKt#-aSkx~1a-ZNG=UZIb zf{FE#0gB0^II|ge9d&8gG+;DmtCR`c=NtEV6+d!i%A$mTGz=!-jb0A|MqrLCjdtEU zT5TWU${?SclUMDPmNJSdqTVKcdEEM(+Yn1q9@ZO+@Y^?6cF`252BiYM-4hbc6!AtP zbxo-LC~xk8wAhh`TYNS9d^_06z53d0c&j+htPMCKZocf%8YhBZVb=WT?sj89>j7_? z9g_97+Fl}a-;S08K_I322B+=fg+vE!pT379mI}I`M%K3T8Z1K@jrR3ehqS&Qp`m`t;t@-7eut zq&Li^nb!_GJ$d(Jbgt={7MF8yKX3RU;;^e%`#i2AO%ufM-b_K3JSizpfzSE+>qm*c z;M%^#+xP;z=n8mqyH6bv8(mE)RopbL6=Y;DHz-#gpIz?3}y^ji6PmybUEw1^4^isC#~xa;qrC=(>xb zi3Klg5M!ics}&{5nn`veq9xqJrfeSO6J#^*y$(a|yvnY!4 zjr4}Q(tLmx#(=!6fO&c4pko(TM6`z47w)4_ zrz|!2lpY*EFVd{b zf5>afHYPqoC#UAP=bC)vE7@Q5kF-hk(1cA%A&Z|uV&Aawf|Z)-4yGyP4Afb-q5W z5EY(KLYf;PLA~-O>M-|*=0D=?IsrRIZU*HNmUk>Gs%fP6hokTQ6=-X1&$}a}^-scR zwvFPHF%P1!{VS&m^4RVdfc|e5Ia<9Du8`-4oGW&oc6Y`V80sF1yqq~Y{88}Z=}XmD zH+!<`7+Va zdOUa(4bGYyCq+UO{a7T7xeXo%fU9|w+1bH}%I{uy#Pi>$tV7N}N77Xg_?IuaZ+}05 z^&`R6+YRdNPmP?@sbO%qWJ8?Ni}GZirWS)`l2JFuuHHN$KV|ZvTGYeB6Q4eCsk<`7 zSotYx-r#jJblEVfe{kkDW20R?UYC<1|Mu1cig8>PPhRb5{&a}`FcxldV#xq=!0TMB zCxYq0IOdFt&j@&VvGodi@r~7Z^1QiZ9Vo2sXmk*XC0q=7wkoa#1@nlNqA>&GnrHuW zJ#J#nYCXa!5{Ta!)|g~Ajw`W*Yvi3lKr0PcYH-BH4sbsmLE{%bv?7}mJvdK>B`+PEzwp{=It#tmvQo&&%chU z(Q&s$I%|w1c*$K#`jxF7pETdqP-NfxmGy!$ZRJ(Ae`}V0bp5}ZeJZ=YC}NR+$k8CJ zrgGMjXo#e=mOu4OW+D4#_!TabR*sneX{pcld6A;BtL4l{o%P&}^99ipq5sy>)b)+S zXX|QC0qH4ajCZp=_tN?Qt))+oGg$tuiw{ky75=9s8=>Nnf9v9Kw`0e@wd6$N<^OM8 z{ObFkKlcB1~Ykcg7?(&nbN#c z6wl3~-t5?UUCUn2PO97PY$a3mcsl*Gui6gP58@&?<^}Sqykc0QMT0X7&7_tq_h?;l zrAKC)$ez}-<=VzcsZ~ex(m`V!%nM&DV}^iB636x+&gZP2Farlwcg(I@mfLM|iNs|M zO-p^!dt)D`@adVv#&JBDdAscZ)K+{`N6f~Smi>zbkV%ERD$-}?ocXKto3LUY*vG#s zw}$7qEUz$|YM{6OdBN)$muk1216kd*0z8p&tuw(}wXx`eeXpd(+;v0l{`~#SvGe;> zFRxkB>m7ZDe)L25>w0{K51p3|8t%O| z+fqI^ih&=-!n_X{vN2%JfBRr&n#AaGfyAv*Fb)HTF@#E|?*^Mg9gmB%fTIJr;-)?s zKXwW4^`s?= zSXJ2}~5Yuk}Con)YIeOk&os7JOKs`HWxgDp?~piL!fy0tZTq zfhKf(TtMJvqJo2k)}ER9D$wb#_=h(*TIxMwv0tuPS!Uv#H99kL{VYTX{jc^%J?m%Fm?qUr-u8tLt?=^K1{# z&Vp4zFZ}k_gJqw&r+xx~M9@HNV?1elpy^j(Pk$d~l`BmdwI1i;Tc^7~*WhmAJa6Ij zwpmi?t*2B7Nz$rF@T%q~pC%@@&!r>PxQ=_EC5>O))(RAA3}vfs)`#6hhMQlrmaQCd z6p?YbcKmF!OE0D+@8-bRI#`bVEn5y7eO(#*-_n0cj*~avV~hWF`t^RR?mzx~u#^9s zsz<0{)E>9z0Rj4Dp!E+lYAq>0qnh2yM5wt^B zs@AD&&f7+-E&7_1&wbOH0~o2dW8-3SkNo$a+8U5o$9*06kUAArgr?GrSl&qKS>Qp+>}SpN-Q;? zQwleqZK<)Wetwthv%}=>h_`kAGOy`3zvNb-l)IMkC}P$S_%*H7mbc&9i!x4p3N}O0 zTu=N|U*NB}?3ajW=7{{~g9I^0m7}=61CDqPHLAajk7HfOQ#P2BSHb4f??r(f{84^{ zEaM$}bbk=+f{4%REJJ` z3^|u_;Q#K9RqR`D(rMb{W_Sz?Wbh0>2fxN@=`<5KI`#YPao4cwM09BWk#_r!QGx3W z=7;wJrn=Q2HmX_<+>A8QqQv~($vkE^#dt%gNmp(xT7|_e7GjpaY54B(#aM?;8(M~- zq_SmG%486Ck4>eOXu(*XY0Tuw4@+oShZO0lQ_=^^&U{@CKq)Gok@Y&m?!|CMD+b#a zAHxORm46kLp2=Fya1Ri%Cv?JpNU#4f_09o5n3!T%H>CZK{-v44^7m^r|F^cSCwcLL z9K7{*c}4%U=^@>feI9A?I$$bH0qnGYbcG#)WxG5z=OH5!4o2Oi>?=Z-^eA;%tM7gt zuz6AagsS${6D3BEz14>j@V9B`PD@Y=!}8bsr&u1X;(3(7H~HLexnJSbqdv8u_Q|8? zf)1xBQumVVT=(n;?A!2p*erA#(@pMKF4LKyd6pyC4-;mVM->y`aWFgj6POY})JDJ# z!NHwJ6?Hx)&yZC`fq*Z~f*l=H1`~@|bLp5iji)ye`#1U^6*wb)^qJ!* zw;R+H>e~uUbL$)u);|7V->;;i0$Qh6Fl@nDEPLE?9}1#pzRIqSFy>3L$lda8rlVWI zMA@72*|}-M8acX_K{&%BYrn#*E+`qex>FV?j$p$dW%R`vlPU=N!>+5T;w0|N%iLP zTONcTCV%_%pc(hoJoq9vW0BEU5Vd=tXic6#HkX)19UnsL)TB&=Y*D>kdYf-*_5|W3 zR=*$ii2MsYV(t%>_;D-g!}{Qm&`l%6^-u%Ta0layOaBERfpNC?`?aH>drR<+D4wz# zB$V_uvU^!znR*w$C1EjHMf2fd>YEAI2}{{pu?mNce*5m8!=KttKi_IOEr0k+95N^S zhd%QC5ad=qw7EC)Umd9V7smudSEdRkZ2uRZXzE{lB9LCGLf`8>;K$$QM*e>5I$7Ss zmlA0*AYZc}#`@8!RN8zK$usYNm_@2tAYxNXp(ewFMb*{#;=O-*Pf-YtW_ND3sR0Sf zLa~bT3I701NJmzS>6?>2IIVsr9bud}*ZU6wC1l-WG{(5^S%b$w$a<{fYwQ1X`#*R4 z|7U|l{pFNoA!X_C8Na6hd?Gm9{&{`~k%K&*5;LD|NCaT+FFp;PNDjGtWPC=yFGl|S zm(A} z1OX;F?n(zQE4@h2s^TDVVfZg`fr<)H2Mv;?3?Vez?z?2%W0T@GW(wrWKhGEsm$?9< zRs6`ckwIDOp_lN51W36oqWw8Kc;Zv%rjLKDN%&JqOqWmxG%HZhEuRwgQsz%j;Op}Z z47CO)ho+E+!}gg~@3th}x&Os?xR3-FauxZCXUJ!O99O=O9;mvp0f1tX>w3mPA;J1< za?EuiQ#D&Qd{a`bZmAOs6uh%1?N{yY(LTg}wqQ+y_Y8_W--Hbv!;NuYikeqUXW*l+ zOW#ieUY{|}JrnOszi@PqS-PhD#ZZ80NGSOFCF!~SWc}YTFga%>Q3srrk3cWW6MG8M z8a}pF-QvuY8G10XIYU?2Hddo`D~b-6ZXsVXmQ4e{+YFP}K<$n}8EUW`2Ko_L(L=)8Y>~y!I1)SUIkQA_K00eR-uf>${RRze z*t*P4u^|5cgkB*cC@sqg@{+K>`Tc9vIut;+^okVp5gtPcyGkj&Z}<5IB4XTvG)S~e z+C4u^nt^&7=y-~A4~Yo<1%hT2KzN|O+Zx%zI9%l@P0(XHVBI3!i;X(jVZJLO*H@? zB=E#BT#8G4l<8^uSIwEYhVCEquXX-Av+@5R@BrOrhT4q6bl-pl_rZEn2Pj=(2aFvl zRtiQo-Cwt^y@V}yyh1~FM!q5~aH(OGZLnic2(}}P76x^yTOhGW1tv8|PONRI05Wy+Q!af;lG8@sJ`_$ammqQ<-L) z{U<$*=ll)a4TZP)ZYzXz?>tB4v4GhE5GRXFAQFn=;BKHBB9NOv)P};e$k$dMz9Qhu zv*2JsnrV19qAvk|?DN;OE{f2F!iMO|M7ONw&OwnUH($bbIYnV0Nipjn1}seVO<=)vWeU65HFnB*#F1O`;U!%DbGb1W7o*IL&}fXHhZ2L<)`W0 zl-qlg$R=U3Ab z8>Ydh%N@3PqQh9KMy6r!G{V}@r_c%bIN^ybeVpvw?ExCKxIfu>$CQG6%Bd>$?&%?M zGG@Df*wn8N4*HowFkA3J)8@C5`wu{i@~if@1F>DLT+EIC@hJZv&;$Q#8ngee*ruIw zQH;Xo)NxY@tCQ{uEPl2%K53(Q-mAiP=5IjzM!8j$QSuX^a)Qr^daG?uTCQIi=a){= zt+NVxHtCyp)Dev9qS=(NSC@S{#rC%4)}ZRjzbvJb>^3SduhN2B)5S@#NRf5)5BD689OXQ?FZ!>CwW=!#YBsd^1z>>6oJ(9mZFYziy?fNk%&}Z@<~yy@pVC6% zz7~U7)i-g|>-=Mw2!`MOZpl`^Ww&9)9Kav5X|)RGp>)NF#?JgN|Cm|JoWAS@nFu?= zYrXy1pPw0JpKn5FjAvj|CGMMcjqM2^@oiMaXRV*%8%ZxZ)-F1Hp^f7@-C;YH>b z31@!U*JA+U(u?BlI_x?WXt6jgyyF<4QOAd0!mED_tq(wco9G2yc$PV43DB zc-@s`xHgaoI$mo6Sd02oO+Tp0PxY^iSkETk4`BB(BSs#pk7bRYvE*2OzWE=2tSvqK z(-1D&G7$iYBoq?>zA^puVdad#7A8*Yf`@W#?`^{v;7sa>5jte=?^`GyG;37Ifd;Tl>Oe33jBxzA>$g?8(aha0S-7e!I;PH0Zpb6SAf5UQB!qnr&Pc24QWystA#vpHGu2X3c!I zMLKnjVy@0Om9MR+!+x*_ZW=y1Q|;@SB(jQ+u_I1QwPV zJeC(aJ6nF6iq6@|slX=Yv^%m~+eNN3(RBoP2PmE#p^2f=1Xs#Bo zRL)rhpc)@P1imY>#7AOej7c|Cbn7++jI>%^_1YJ0 zbUB^oWH3U$P3{uY=iMXxWc6)Mlo!-m@DY}Sn`pwzFI@dnZ7ZN}Q|NgATJ#sLfT=Vq z?iMXSg;+EKW@c2zKF!swuBzl>-Q5nZaRW=qxv>H5S&CEwq_Q7My8r{~346 z&hXfo;Py;Ce9XeSal&a;29b{Bw%S~m3;>y!69aXEkhA75sYD`tqZ z{_F|Ozs?lFT<5Cq7%LLRQ}g+JAU<(WTukb4*UGTQr;QK`V!Gj?1)qQu`D_;D$`c!j z*f8T2X5i4HouN=>_q{@r^srTWQi6e!#RuB4g-$&R1dCsGOQH;gK|(>}%OLFat)XBt zj2(iNdJ^X$-(u*WwNy~H8hE;CK~ZDk)=kq9Ims9N`_50xBJn{f-s4?Q)%#Eg$@Q*l z&Xlu^e03&?JFnI>QJrP0wyPgBp5)jGF7P2Z7+vWwr=y4tb0?q^RaZNBZKP28f=H^F zO4!$gt7|Zsy~?%6%;a4$*gX`*bsloY!e00>40;ug0}=BJBWu4D!XE8Cm%F&)K=H}> z>rKnx4wi8N7j2fnuB#T912_2=skGhgL9$}naoWrv7u}P-2{=t5p3Px>+4JBvYAeKLN!JtW9|m^1<>@-ZuIXNEXK)1i+sZId=zu=YW7NL4z2khNxpU>S zSf?{^o<{pnS7)OTD3mZsn@>%6___+T2NK3GdNYtm@#vT1D(*0$#Pb}+cR=UwKY~-0)Z#@E#9xKH=RWe$$EhC%mJM$xFsqQlEz;Ftan><+3aG11!_CX?J8=kB`%z~$k&Q^-3 zp$1TtVUaYY@Z~7@aY#S^P;la+jHmDV0i$bEd%HPir&rr^(5n}f%!iZ=JPAS9JH}qk zzAH16<-(jtz3t1tH&r*Lt~w+M5hDKF4V5`}#iDsRB2-Ommj61PAlGcrVB13T%ghle zMc0N8>J2Jh{Xyf=sh`h5eAjYbG4%0zNAevL>Zs#x@KGRQ!^fMuUt4I#KwIB4Aa`ub z5nvI6y1$2a;7!Ii; zv?hrBIf`CSx@&gq*pyyx75|}b301P=kK!5)txZ5$?nBc#rri#|x6fej(MP!|6|{~Q z9}P$Om%e*KbNn3z{6PatEciJ&DJoBN!v$UT5k=WC%{*YWTCKOy_3K5C4&Dkjj@&`W zu3DpD!wn@{!N85B+4&8=usj+l{v)5;&E%T6y4u@k@Qh6(_!Rr*W>q=wnsa ziOz;lDn{&PKpkb<&q_O5E=}U*x$EQMY*>%qp_1kou;yFWkWlR9of1YDgvy81H|wuy z@8VjR_bivh;D8Vj_O7(1H@s~&QiSiqPV1&jV)*k%T#x5u;(d(UC(%xL(M4vckQUSw6WuTOTS2C$-Vm`WP!V6-DxPuvtc+Ob-RHIaIgz0?1D=H)2CT=InUr! zC9#EbG5{Ek^AEM>4?wZcRA$5OZq>;@(vbPcL-UL7TrU%eRH@i2Tb>5h50L_DvENH> z*8@XV)pwcBuQP(^g;63m|A7$@0STI&!zGfQ2tEuUAV@QUYK;8kRZ~VF$qQ9}Q9DOh zU7K!BrUp@PK(G4aHO*cbxeWQV6SRYq@j~((?l<-Itg1>*BZ0DyLURTo{9oewnB3ML z@8r!mhY@-K)DCfIusJl9Qd(@vVJYM!E0i!~FaHP{uf4OYByjH|-RaS_NX1~{jYeLX zZ_3^hc8*C0ds^n$L;A^zf{;fmyK>BGx!OKkQDYl&9Vvnb+5jBCee*am3;Kf?-?OnF z?^Mg)f}+`;41w7=QG0+>OqC0NLz~~hcH?Z+{TfrguISB~_oq6P{W=8SN?Q0y@0_-U)aeFbtgD z9+0!72l`HqEwH%K7{CV4hl0@q%dTJC0iI*HJ8;nUJuVvm%1)iesPM;Az$vo!r}oFP z+x7C~&Ggx?EL?VKw{&F6~#- z0&=DXt+!rMP9wK}Lh6%@W?N4+Y~!2tH|Ps(fomu%6f+2XZP~$bHtjEqZyPV34ED zgx1L_PjMHxfPugK&3CYuK?ja5+w}oe3j4~_7lxtuL0C(wS@18l4%5BE z1r5nUbw8w9n)rv!o|%EII%zYYzoL04HX!Ii!$*U$jN|geW@2Z>*Yk-R)N}WFynJY{ zOT~_u1@k%^9egzksvnzeMq)`kdBIuY{7FZY_leYgbe7kQ%UpbQ;FA~jmYMsx4(QjE zNx=(M7cCNEjkATf(J>x;Jq=>Db0m}gD|Lw*4RL$bkAl9L18-eFQcQZZb0WgHM z^#DZ~Mxx1ua;=X|+G~t~+u+r*lpI{SFeFx|@9Pv^WWs`;9~$={1&JxEfM=O~#4+;2 zp@2?ODNx9mUNe1uU|(ha1VO!xDSrbg{&F|R%bnmkxyYd05<9I!-ErgU`SqMy%nI4H z3lCh&Z#TlgH`xnxNIdWU_v9E6b`wJ*S0VGkX`#orpAZn{@C`=SwnR=3?uNQ)UsSBW z(O~8vULyl5qd_%NVo~zbG+=8HgA6!+ANT!_9B;FK;372V%B=?v`jbjDw%jtsUJg(d zg#{8^;Ri0qOCwgZQD42{JXXn@JKB!t16=xl;hOlE59GCre>4;jhN3Va=}P^ms9Xnh zw5-C3a3TTlfS=A~y^oJy`cAqP8#Lu3y8uGrDe?XbFDa$gY=4t#(qGQ`&KMKnpe;{RfrD*PQIP zPw?y+V%d(zAGl%MNH9TWJ{k1|)?2kU7$=_|30fieRhcONVZHce&)!Hf(n}h3s0nHr z(>kvhs1qKck@n|d+kW^B%BNwjWI1uSs49x{Jzc^o`kQlBvv?)mC~wBlsmm3G%@Xg2 zCEg9i(gGqABmy-PNW}XKdPrg{yYS_iI}bE|yh=J@yK&`-JurNi%5d5Y=SRFx$Rg#b z8x$nEaW1oFXb?qN*tC0KabfY~i2F~w4px4ukrfFNKV?5{IGbWz`3@+TiHHyy$(PN* z-j(joM_GLYzUx!_de$+@C6R0af0~pQbar6Lzu)Id&jOkGk=}==#7`J98{@B7s74)b zRcOSi*&?@nI9P7Xh)pTsX>nmmn$k^dO5k)2#V4JG1M=)p}xO>wbF6 ze)x=Wzmxwn_noFZ%1-P3!uB7@=MawkK|R-f1avJmdX|LLc6RDeigP)nJ4lyBXys86 zLo8xrdm$D1BiS)$3?1HWCoZ%kmMMBL+2;*9}Lx zjL0zNwAP{8tW~IdlMr4`ZeSYyEAHNgy;V9{VfGufs(c}0GJBA2u$Bn3QfB0HHBEui zk=>5`3&krR924$EzGq{PEA$6v6j;=|@V6bh6|nj}VY>v5)GK3`XlhB?y3FJrTkvdG zPWv(lD}7Q9b$A-=Om93~3iy45gDEQu|8oLKkeX)#A}n#fuK!JdoDDY}XP zrh+Mdt^Yh>g{LMcyQO>dyKnH75iv*YA&?t_UhkbwT zeGi9-1eKjBicbQ&l*GzxPv{1vfu=re70vYCfA}K@n02zZs5jn+VIx!_N^?{Yl>$#^ zXIP!r^|q?)E&JRIy}HCZVHZnD4>z)sSx$!gE1OCy;LE(L zR}{zx-_bqZ;6dS^22A=dr!&GgK^wOG)^dA7%O9p`_3*!Y-A(5)4=bIBZ}u=ADVLlO z>()=+Z4_`>k~U6pFt$_%tzWtS%0CpF1#S;wJM#2VFt7W@)jBU#5u)~d)&_}*_*;T= z49!0B4`oN6{L#&7R?LUPm+IEBT2X&sN_4Pc2CX*GRGaF^SW!oLZNQXbdX|f8Z4(PA zaB&303{V@lfQDFQr=*mVR7_*26wv!_apvKXqh#O7jBwZKhsqdOL+pvD)qoA2=WLD4 zAJy0CN5|K9pyx*vF7Jp>8y0)4wXsPITqX`88RXcZKpk448s@vOnKm zMVn1ahCj50nhv?3sXbX!@x*wE7K!4_kG-jq>7XLIyLcs9Z8%Xj0=uUx!zoLd=Mf@# zVWoq8T`4>7JCH`ZW>qXWH1I=y1Dev0E3D-OgjJm~p@(En%z}wIjIOi&M>Cc}yQ6eN zZnF4L57I`hV;W;v-~+8;v+&;2iK?(GUd=RLz1?s-^`yR6-{ptME$u}zHyoFC2mv~o zr_x=}B5EJ=hS!V)c!M7GqZa2>ebzA-Ql{fd+8#f zKuF%MB_CcaWHy33N2oVP@I6r3LU>^*IQ)qnYL1K?()l|*cU!)Sp$|sU$sK2X?Mo-F zDmwQmFg7mQ#UCTRj%KL*<1iH#D$6%B3)rvr#~9!(O6m}zDW{**_jiKsO1@EImSGg% zd>n9didbfXoGu_eGbC`fwZi5s^Ze)G1?C*vgWEx{GMWU-`0L z9Tn}AQ-k1T9^iRjtKyzS9Q7^)Pq+fAFeR){V)owtSQV?~ z6_JoY8+ae@db=83Tnl16G(daGdcC|DrF%X#oFPJLG&v@V|9o|=BH&iX(?uT_# z0F^R-L7)!$eS_{!EB;zVEn-0jG98=91{V{Bl|o8u`N%+)r7V$LV1DCCusOynNz2$}WP5PjSJ`E{cAXn;g5N{ke6J{}cXE7e5wX=c&mHtX+KYB;nC6 zd+A2H@&s??Sp?zkqUWoO@>|zB-`uY!$@w-sR1wKH*V4$&W_gXy(v&6_7@rk=7bl73 zo08jy_^3pFhE%Au|JlxL(mXP1aZz2l>92w;bhj3AIOuprY6rvklgLdgwYs7 zP)kqGuX}!Y1E+B67QarEbJYy64i*&6VG`)`gw|xz2kg-r@3}|Bbo88P&%lm{=MNQN zw}yo(KOay(+qiImwJ3;9I0jc}sDT-eG=}uppGCWH-7ko+A6p)O8fPk<_SN^+gRmV{ z3s5|oV+XxLP|6-~VY7ab_X!{aog;q$XX})1Db_+EGvdx@3rTSq>bQ2+LCWh{YdvWq zGQ!xjl#^z2Zd8h*d0f@XBr)wl0D57JUlhawRZbWT$Kygw+>gB%W@~sa$P3;@o-v!t zVIWN1OuO$H9qHW{gPr^QAJxq)xfSO-6KY^E6EzWLp9-Kidb+295amj@{jbl`^>(4Y z-!HHsQVA5BPnxlFd$Ey8sJk93sqt=so2>)_tD}$W)+|$B%hy&92?tz1<;T|(B<49} zi}I|#g9bRg@`|>$wgKw%X)p5PDrcA>#thRb6V!yQ)4s&6isp;QpW;KYfQ= zqk>_nPWE-Ccma`ZR+E7Wz8~BvH8)iKDyT|LjNa<*50cj6tJHnE$@=>rt}Uv!bG(x! z80VfYRHjj>Bmcm?JW^00R=sdDltj+~3qTw%oT^Rq@V0oZU}>Oo;ezrXFGqlCL8z_RY0w7a7QRCSKW@!dt3o zhVz}odplkWk&-dn1)Hj(G4IXgZ5FTaObrh#N1C5QuoG)hP;mJFu`M%~c z&My1#$uP^TQSVxh$%-|^Eyw3hM0o|=)M+3 zI06Y33(Ih^+cOoRm{l2=Cpi{P9zdqIiA;fxaD1T6`Vhgegu}jak)$~?0Ano=# z0?$1prt^5*7|sl#WW2Y;XPrsHQWeL%jjas4udh^3-kRf!Q{!#JmSWbNfnR;%m=Fv) z6&r-HdqhOYc#iZzRA~6*Pc>_?3k7@=xhgLpwRfMi6c-*Nk^5)u=_w7h*b}@mRvE*M zBVU!l-G1BG`Oc7=?DgrE%?Hj^bp|{8ZkjyeSAD=cue!7x#Az2bPza(N7vYMMkAaUyX#3; zof!&o65N74!Y|x+$~z-C-foW6|A+{AludDy+w!H36lI~tRqj(FKGNYKspq=YUlqh2 z2gRR}LvhEN{j$WGB#9j1cBbKnU<2y1H>;Kw0_CP!Iv-?dOW@kfeLtD}QMpb#_{>(A zINJGK#=&3Oy|J5@>9^?5l+nbT?0cQn?#GbBipClRi~ti6^OSBMfuwA^ zPnXioWOZ^Jm24`efX*+SHFUZ%|jia=u+VHpC$NU$=o%yF;l>YDoH- z`|a2t)gh|?>Fhsq_Rlx;f61fa%y==RpHuR^F-~!k2z)37EX=-wk6SNYQ86X(SUWgq z@BMlXmf}hX6_-`v;(etW19- z+UJ#LJ(cD*$?uYRcyI{Bc+^2e91HnZ%pE>|QBgS0-e1^}$2)7!Dy@4wid*P4As?3e z`)HPLbIyoeBJyroF{=PuQs$N(?9N^O3A1^g2*pLSP@LWNTbi5Qb{N~NI6aH=pWkFS z84IuCM!yx$GkPzKnm0Nv`0(d^DOd#ymQUfB&vM|;tnWU0bR9p__XwR!yt`4^x~0~~ z=+R-~)ToY%&y8zZXERxDJ2SLzan6p4^b$T~mI)-|M(Tkw-$}Fko{jU%IWW9j;{ewz zePHmC3=Sl79dn%7uq(MjR|oz(r2kMV+~ zu0P=LY2(AQ@-Dr&Un8Cql>PI5Wn9$d z{o7YN#{c~LKPKmY`)sgFf7erioR6e&E{W4C=lXG9@m7#PL;FA|^GeGxw`(5X9fv%M{|Lt*#LKflIvUuB_ zdl}fBNqVFHgBlxL{}tXGFsvEfh#OYMTAL-}nm0^5c-urrD(crWoN85tyard+Le8l7 zp51N|z-Z9+^EKS(JrM`0W4Z=aL(9UHg_fQ2NMNQxhQj#eh;+rwx3U!4l!y1fM@$t0 z?hZ8Ls7#aof8_2i4Kxp0mFHZo<051*^12bcI zsStZ~u6}{BR?GyHj9iija8+1b?Nb2nyOK_WQp{T_YO~0HHlMhN_mT5|MM9m-_oKp^ zFcQJ-fw`FjrD?h%J7Qz5E0uopH8o-LeQbOXp1QJ|t!*Ye-)^$hFCJ#aa~(KLm$TE^ z;QK-H1qD5tgZj7PMaSdVgdD!T081uh2}-^!#9buhoggNFH<%LEQ+#o@2!9Gbhg%68 zBs?d10HxQ5;K%m{eOfKJ`Jwb>dQW)>KWCFX<(o_2Ed{TKhQ|QarXB@ZnrYi|q`{GwC*u%cHY zP59}5S10d=z^siZ%A!PkS2R^N=8XOCF;e{ZG2RItnC6pAcyu}@tM^^5*51_IWN5jd z?5F*!N9`dJ<2-MG{J!?6t<$@>dtB6JnrQU^o_F9Y`P_CT|8^IU+m5ee$8@8rALF(y zQE~*YX)cL^2~DG zg=>|3VRbwHO*zR2S-n2^-+poX@swTQ{sSs^;gm}!*%Di^`*^F?D>xZLewz9;E*W$@ zfsYtx+%L^CG8~a0*va|QnKw`f`g@*RGmYL1J0J57A(=Muv9J10$HePN=w*#Nui5Xk zj?QXl=#W{s3~+V(aDSJG@SN88-mH@^)z~ziW>ai6TTG){H}ln?Mug`kfFzts;EyiA z_riRxO;>Xt=f(hmkiZVy?s9)K_sv!m!wl%aE%DrroxqP9jTtwE7Yv8ZDT&wH#Z(J# zW|#@7+80s+|5zth`8sdiw30n^D3cEr6t+w;%SstQY5n73Bl@q2Jx!x1jDg&Fs~c*O zXL&g|VeXWFq~>_Q$^#@`rcYU-tc?Wd>N+{gRA^zhuhPfzCt(A zRSX>6(C9NV>gQ;hV$L1Yq4*`@B+yyQHQ4|1#@`K%Dq&1KAMHb|!DAEdjDRh#H}pW_ z?+*UYtybU)(Q6sM3{uuC9)%x+x)mWjhokwuZmI|614n#`UB31^_c}kKHpb1H*?e>@ zFYYNWf35e7F;&JM+te6SiI;r|h$(Pc1i>2Bta#r#{YsJ?@FL}334<5OGD``F8$O=7 zHd^|anT0c}u_2DaA@YCSutp^CVC;TPj%t^GW8QBOESR1=g|7QL%aRQNM8_AiJ_mf8 zx}U7WhPJL$RF|(IIaSp9zSFY;DX_aez-2)d>^woG;vgOPDnUNJmuXkSal&81`AU!` znp};H6LkHzWV$A#$Db$b^wrUrXP!)dG=KHoO7Aj?RESH#TgzX!OsOG|r-comq6P2A z4;oC4%@#Par#NJ|0i5UX%Ma#f(i~+mj88j+wn*3nb0uxLe6#hH0B&5>31m_R?AYtx zfvR6fq-u$JhLQ>U$IC1+H*WOgHrO*GQ9x3TsX5hlQc>beq^0Hwg55_>?98Sr;HKx6 z4<0No#LzQ~)hwXU>ywvQ)(X4!=mjN9ST$cFcK)GN@)ZlQF(Qftk<=pNr+5WOe1*mB zILWq|w_;SOpk_t*GQ=ul-DFi#`e&2rHuEzc{NO3?E~0WN^2zQ4Ffc~%_Fj#W;kxoS z6toXw4B0#TPMFLFAG@Q8gxLZo#Ad>YeVS+x@G!=I0QHCAc~>E5XIg+F?9G)VO`crN zymI~cYP*PC#iSNMu z2ec}A0(#MZK1=jJ_q7_g|NS___q*`3-*yQV*5kbeCNkW}EhXm=P|9@9xDH<^4z}ni zsxu@JT(e7%sJ9*_iTU*PiC=7%+%q_vrhDbxpIZLYk4&$vdH&ti#q-Dv_xf)+$Xd3m zEF4wQCM?$DL&b_yS!Hr(Q#k@8_oRGZpU{a!TS=YLkCrKKBa|POeSiOp*9Fc1h`KY%K5X!7M2s`Ui3$x%KK;CEu&|y!ieY#)vO< zO{#ui9zCe`q3W1k#%NB;1aZfNCM=NMdE3TruQk7h$8iQR1+hJu?;AWV&h3!Rt%EVr zD+3A^zs@xJfHAq>>*Pu`QpQ~$%x{u#ml+QpM;K7q^xYfHsI38QdQ%ti%f*tsTZw;K zV~%50oi6Fkre$sn!bVU$0EE7^i~)nQF$@BChw})*8n?_cWZlX>O>4RD)F+}!;@{3xNk`{!{6s1M&$y9}R|9D$ zuXas8!Ghay#yqyU+{;p0Bc^p?roLRjI>775w-t$*#>cOk!^MrN5oool31_v_Hp!Dbb{6;QAs* z+9`kb)`t@>H?>#SPha|2n|4~On)b?TJ!0S zrRb#Q%Kqxu$1~@LMo4%aEB&2Y761Gl36Gbth1FzVXV-ps=X0Ze>(Rh<}NuB>n_W$w$iUSx`%{Fr=adFqymf-Ow)Rw1s}>tU8gPp%^g$5?Xm8T<0MAfenAjDd_SmY=fVg?nJdL&*>65sW4%n4HmX{`aHB z=7LdPuK=W*jIC0JOiTrB?`3l(+-Z>&!D9+aJI5{squ)Jj$vo7xn#rhCR7AuL+h?+c z;n(Z`y?Z4Lh;XTcY&}sbjJU27Y6d2I`i34GaarYafF=~^IUYG_?ZMt(AJ)rA$m5f* z$Q?k13hRd0+_A*+tUA-e==<+ZYSHmoVr}Cn|32#SJ-WM!dUj+BRu5ZY+RaT>CZ#sq z!fMDG{dQxxY@+{d7ot`-mq-hgk68BVlIg^Tun=gF=7@HwHp_ z$ATTO{#OUK0O;nQIj08n?`iHq-iMQ^u70}gimkHiBltidc0KUXnKp~>-3^egmY+%_ zTezn9FOPuN1MKn=>g1MbHv6v~WtF8c%IwHyf;4}X?#GBTTB<9fbcAnZ-zc%aT0Ugk z>>VOAT~GY$l6pnES&D=2t>I+ zmOHb4c-R5w@XMIP%v~rNwgn>CR$W`q-n{c4r3+{NgEQ^26HPfpv;jDsJ=hvvZx1G} zZC2ftrqc)9j-fNZY)05A_eKdsz@;7{0!JZ1`ungioSQh@5(l@wo(`BdUa*_&3?KCa34V*%arlvt&;S)fOcx90I#%u2 z_|9oQ9u&KOoxPleSE=DWeBipkh@EyXbx{eET=9iZ6J*8J(({>+SDw3< zkW5Y?*z+*7MZWj$G=2V;fs&;XPQ2q|m0y{m3(3K!eI@1mtoZkKwty`>x*{Kme)YyZ z=?$s%8#gW8bdcz9nay^*fA&6^Tw>^U^v!KLY9oE;7;q>-`9-M4nx}7_Z+U6`^>@!8 zT(xu!#E&-5ik4RJ$_WZ7Hn_;M30bCaf@?Ck_Kp#m$G`O5R$zgHRKiaUbf|cgX$Y&lWVU0eJW)a;0 zHS$Bc>%7E{E>{@e#Zq$Jy1@s9ca{8>!*4Vw@qqt2Ku@c9&5mPRZt)5nPd$9hTk;Ax zo5Jr@X*AR z|K*;;w{0G*zK@}kR^ye9xZG*>P+K0Tf+-o_3&Cj&OcwZRLR(W#=ktW49?4g=x{#U zS0j6+75e!Yg7&?{J;<&`oqgzHD}PS7YWk#nxM&1H9-8;T=y0?<=ACSMvuw*^`RC4L z6z1x@0+;N&NcqqIm}-}uNw!>-K;q13U9C{g%gqm^L2XDx<;ZG@O^7RgplS6)qT=sE z!N4dO*qcz79yQHtEBHIQP0uk3nYcL=`pF~fA`e;H@weHVjEVPvk3CDX;e9*4O=9nu z=(YH{h)C=5;N3z%;w`wL3!u+;$?__mH+WxON9^K#0f98RpLo!yn1?q6mdk%PreWiYBE1*_FFh37@42Xt+5`5nhP)LejZqxhuFQ|| z`)Wa>JdMUQV0f`ugdq$fb~$Dn`5uvvd!C`SZZzL}>n1i{_GVKSS4`Qd+5bF{ak#=^HCosE&+p0JF~qVw#pghCV1vibzIdKdgzNR*`vy6{a|RJDT3)K)dDAeW z{P)sx<2VJqx`@cL!rgtutvb2ZCrRHci6ftrFFknf(GvK85S7`*AC8tX?U<7_P>xxft7w57q*nm>3`&M9-xv_~NI8Qdfrzb({1bp551Ilo z0RP&nf7$~4w9Ng4c!GhfKWX2$L1q-iEAZfdgvY?x8Qs%AO&tX9MRXj}A5w|1?%3Vb zJvF0+{fRm&tigkV;tf$#cgr0v#=7jZ6Z%N&PlW=;HjJ;qHoet7ti_9_uylewT0a+E=_c@Ft6DR%wz?wqa!zJGkjr}jLvsO zV?1KCR_%1=7Oy*54n~y!V^B|at9lT1h}rWdqg?1z<=yXM$tgTgG_%4dwnvuOL#c6h zTG$}U=#l|~yq>%Pl8Qj&P=mrXN!X|AFKhI_%BRJgFEB~?pvRX>UA{Q1z(Q5*D-c%@ zpPOe4uEt}@KjM5pf*B%6j!mPpDwa7)J7G+;IjB9+qeuqnI8{U!&u^{vUTb%lnu)^H z*S@I^mxwzrNYN4u_K0Q5mbGG(O>$lwHi9nzGS|0VYYc7mpdETk*XJ#H|3^bwOHHjdmAdo=<1z z2NviP>}21eR@4z2Vf_^h4Jmy&s`zvkwHVC|2ThaYF8yj$d3ieI*66 z?r%k#bX$jfaJ+hoC=|h)RZD;UICLgtH+0+tm+W2JN3bFlmtvchK&s0v;6^O60|}xd zTmPK!+1&}KE8c*!O5l-BkD6qafnzB!rRYdKkcyuP!sEg83c0RLrt&&YeXyd96wDq3 z-X1{N8-*YJ?Wy>ugS0VtuRGwI2y#hBcM!H!PoF$~eGWn7Wt-cxX{8r#4?s_Hw<{8U zA3c&5(CM9z!^YELxTMEd&?kMe{$dqC%FIHDqsiF;tS90?Nu{cJ+3UP3x=MO(MX~`m zy%!C~#h3)!P8PSWwRjwkN{rc^en5TJ%%87VYNHvr<#ei}=NdX9`t!>3XnA?8`z0UY z6Wtu4cwPAl~Z_|8ffbfG@kM zW-&I6Mw~C+5jr_?UTx95#n>Fgc+l5w(I1y~V$xX=rPvuL*<8ERY~rI>Kn;ebSyRiZ z5W{V#3E>&npK*IpxuN>mQ=Al!bPA}Sao+uP3e`W17kEG4=-f^~RZI2jm7UxI(Tqj- z+5%UZmv`%4Q|Mg4q$J-}VX5skgP2p;&aU^uFA$1`+HW6J+Y82>AEkyUl@qE&LAf7! zDur=iv|A*`x&wddt;t-zIYQ0T9heFqfn1z0g|qTi3)^uEO|L zv8={>e(Gc6ZOGwp<9s{}%`LQ7KXZXTpZgk*nSVfR6V&rE#~XKh_cxTqpjHQ=y5Oo1 zl;f%{DS=!F+K|9nNcu?yjemMJaJum=>=#e&Dx%`A!};PuJ{w}1z{<0R~J%sGcM=zBBtgW8$XBRTxY(5YJ@U_w33yU4rdl4Z5 zNevgU--kepKkVcg%46@#gN>$*U~jI zzH?F-|Kkepg%4(W?ib!mYpZ)5xN})r)-G)|(Utm?ME^EtnDXQ)v-lq_@Jxd|=rk6| zordMevs-(_=lE+>yJ;`vAag|ADe)pl?hJo1$KOs77iN1I?S`dlRMM<0>;=+8-?jXF zX5D-`ZPcIbdZgF&t=44)K<=zAki(9G{SW2PPRhbAIR6SnoY-jrZ*7-<93FPS0!Y6@ z2g1I75Q#JS77U~0{o;%u;Qi9+z26?vx@p`(%wqs%t!}=2F8oAU3)mn%dB6lH;bfrG zi>gBr8+g4+STmk^eFHIpSH|$}0^OK%=oS!N41hq+lYUu{($RiW4;lJ-`0fFooQ>WB zr^V&yCoeJTkjO*g@$&I5+>T_ddvpFDWB_zCiupJM$VY9`TRK7%kSjcif`y7oT*<0{lIzE-|@aj=;gm@nm3-c>tUw&F8 zI6*+fPxQ`DHmzR^eXSD~H2S&oOnsCT3CqCD7lv;EA-Q@@-nYGtiBtxhzPn}%I%fD= ztYkW^JaSmQwsF!`JVUgDab|uTj2dn0@SLkIdpG8EDK(<{>iv>u;i_BNqu+P1QU?csr*pLq#e!$$l|4;p;W5^M+ctp3b}m_3)wD#r$=> zKo#u#17>$02y0iqnmbdo{KAUfp*lxww}3a2Ef>-eb=D7@Uh7Wn{iGj45cDoQKqCEbliN=bnd7SkujiS2a| z=86eGy6mtbbW~9$GPYET@v8gsW&6u8@-KyUe!M1lh|+cPm;dDaC}WPtxp2I7bW5VB ztmnzIC3I61PidYgs{h5vikG|v29^3c93RJZCp7{;&ABr9_(*w z$D-4SqF+8-Pf&5`7o3me>H6Z|kDsJ7@_uyOv>VHHTqlWil0030v+&E>3Zphlej9eY zg2m1~QS?E-hRnssPiTZ*qkC&Q%weH7Im%@=^##QSm^{%jA=X)2C{#z+}7sb1v z%1aFf>8cPm5c*i^v{)K0hT>N#MeL&;7iSn@Cp7aXThHc$k9n5`1AcFiyUsaI@=mKZ zc}?I8gh|K_;m;#=>!5>-8thJF2c4IoeCz^TUuNO7RGIhbLdyl(J%sfWe%BS-e1#ji zE<*?I3H}&+MkMHT#>2-c) zvl4?HB98YkHSB;^z`n8j>5us!%%9~wRA*q8?$Atf2U*s5z ztn5Ub3I`K^Wqp&JFX;Pn0U2)e-?$f7pS|Uz7VzNv0YlbpIgNdwa5^jhiS_;-Jc(GI zHg*@#dOA8$utYtxxV;VIghsv1q~cR>AiB;$httk>mtS;i=5rrt0qg zW2FZX%ov)W^n=H`G3x8jx$}p1%vg8Mn12pbAn+|@EL3i90b(X>Xl7I@j|Z-?@6DF- zY(B6bkDZjjU`d^5jRCR`_)oZV*VnC{p7G*m&a=>Ei4AgzG2q6hCwLfka;aJg$Ad4t z7Wgzx{+;l691VTl;oB#KI#kbFh*Iu|{!4>O|JOnbWntjy16Dhh|*WIw$I%sivnq=G_ zc((Y%b9?GLNY?&C%G<&Y2pQrq+{l%NpH|9^i%5Ha2UQG9w?hmq0)WB1M%xZT{Evql z4|h`6G^Xq496=UOW4D)4tEEby44E)uATq{nRyrzlg&J$#(&Z`*z zf{+;$Fawj%a|Y(xVrl3mt%p2b^Tn0dAh}RQ-vpha+n4=`meB~*k?FMFCVZhN+;@O=o2f+Gvh zZhSr%8KZ@bLAG13(-G6#Rjgf*t||wDJe}3}n07KLu2o**z8C~cOV z71){PGj4UkS#W;`K1Gv-`5TZ)%91?7GSC?le&mQT)#sEcy#dm0Zs>m&dT(H3bt|tX zWK9BTmQZ04Lyf#2`KrX~aSZrRi9RbmFMXLAVPknUJ*$Z4l;uN z=9v(Qu4H5${25nEx=(*%yp-+Lb(r!NyG`F7s#u$F5+$6T&u3iPXdO;59*(z1WZ96FXBZH$&i;Ts-z`A%st=%fuiaG6aJ`jXveG<>br zcm;O;+S`M8uTifMzo;24hRcc`AK7S%^*i_Au9{zP#+X$?QedFB>J{4V`K5KE9aM;6 z2FNkMikYO9Br^}C^QimYZI!xQ{7KC(_k_3sf60b8UmB_oAKIPD9^UIc5bBsHd}u4| z4->GTRK9phCDs&5KFe-(W7mGQzm?wUqTQdIDknL3V2wNj@8l}Bf5PVtR@^0GT)Ted zo9x&7tt-gP1H8m@#Zll>g*}S_2)V#OjnOe_ag8)Yg6QqfztQH7Wv{0kK0DEFA zMQ~}A;Rn8n+ovQ{^PWPBku>+T0!6;RB<3$h@7L_GA0)0PX`r+d&u$t=|I`ov`otu0 zEKJPNwP$w-RqWxvcSbT2eSEX{QM^d)uYpDg+OwmS+w2QcSB0tw&l*3Jo<=-t9Y8O{G?r-ssy;;#hi1e@V&L;XNngDO%$Q0UQ2CWy$X@uTF*L50yV|* z+x^9LMJDkJ_=EKMaAzef)zZgrRiMC)s^IpT8hT*-Wyr*PXzqjJmzOk>A53=u^k~xF z9wunTYFHYPrzFjb-?E$EIZ}j0oCNEeK@fOA+s_dM(%zyKV*@{@Pz)Wo+)k=vOUDWW6^W{~T2|nnR z4erg+hZIj4%uUCyzZ=dyA^q%5OdbJ`!#-T8bN9H^Ai9t=_7Cr_KF`v-N*BHO)vt^4UiqXW+lnpfd0aR^{)g z9sb99o&GuKrogyelp))2(T#-iJk}Xm0}->Zz8>lknT)qO%9W8{+}_fHC6=&y{$D&* zbpIm%k(^$?x4+Lof60_G{4T&H{)kW#g^6IOKo@+E+0#!E_W6Lb^^59l$L@V8bM~r} z0H)51%?MBYZ|w%N8`%i_F(?jNsEA2PR#nJ`MXRfNP$O=Y$+I;E98@H9=I|GOH9FN|WExLI!K zrkb2WC12us&&P1f@9@B0fBT2K#Gi}Tug4{?ohf#V4^gQSof^mM()O$HcFJPtlh}?* zgKpeeha8$)8YpmETMuW1>lE#~1*{a*cn5*vDyC~(xTC8{j;rhs7gT!O4ZJVLq?k-c ze#f4@D*CP?I^9!6ycn?YTBUmQhMcWyS$Q3Q6*5~en@!ya)C*AaEGu8pyJ$xvcbs|z zgtVxuOB-5^++%f`1DsjnH*#PUy+sYkl{573Cr&`ynJM#`EPk}(oM?S0y}K-=*uqo% zHBhNf*lOOmw}-RU;`=GqThVfZ4M`k8Rpz$jNn_$h-3YI*>B1WoXPeeq;ENHcSPW=m zKBP@&K1#>UKM@PMgT4jIBCs~Zr4L!AQ19{~M_vc*^5_pk;&3n~Zlw29(2?q1L~pPJ zk}d{lW~5XXUaPnPV_qwaJi40W$aW=T)VQifISe^z=tg`SxSJC0o2dlpf59~kw+=~@jGzID=&>ew0P!o-z z(e_`jge=f11>L;R1Jbb587Q$uKW2}*yr=I&*P+e_r6c%2xqutGm@}qClYP5BY9V)9fB(?)HWoLtEV)m*R$rEH85N%@9;F} z#PR}n@s_s&#loWKAn&$!dYZv45JZ@q{u{N?9ve0AuLYv(I<>XH)W3bLIOOK~7l9Hy zW!4XkfBRb3S5@*i8|!xl2RD0+hO4fO#3ecFA797l5P3)ccBWo~|D5<=Q|$r*8sUqo zu<0nw!Awqpc0K<;mguhQKjuqgE;*2Qu_>`6cP27rO!JB$1f3XGn|0pqu+w`vJ|9ll zl)Fno2ASRMH~ALh=;8_so1hP6hBu> zw(m(loH$8;Ht&r%XE`6*-0=C!5>$ulKjUNP;X6GiJoOYIH`@4mZi3p}s)2euvl{VO zqVph8H)nL6?R1)pKiRmu=3geyGL`av^ZmqlP$k6in8m1njA^$x%jatqX=*JY=1RP4 zqZxlh(a2^KrT;tcUxj&(k0SNz)H8aLbe_wdeqXSqKFYcA>Bj&9I}G~u+UMjgcDSk* z3Pe_iE)}EL6A*jHKkl?TeKn~pC@;IAGMC4}<_K6BtTaQES!BMKvd&&9GJkkDPs-;@ zNCUq(k#rI&M-`zEV!lzWKr#8j_V$lMZqjx(Gi%qiJ5gTa?bT0xTg$Ro>!5RlFHX7^w9@Hal*>P^` zmcYzM{|V7;We&Ud65Yu6)1U8b6(0Tr$QJeVNHuvn#xqA^RCu3J_4h)oqR~Jjv2GbW z5KZzmFN+_&zzqBe3g2Pxzfx|)9>ef54{zIb%=1;BR{W3Mh&?$vr2{{8w4wf%RWsgZ+^L8s*UUMgo~H~@&c_uaLdhjYItB7lX;Y1bgI(S7sCV5rt)B~TV#uKq zcb8zlLh71!oSUiUE>Pbm^V<&$8g~V^yzZ|6L+%Hpkq0a9qCBpe43&pfgq3*UKV*D#6>hsCyB?ej-?z2j3pUj_TKM!i<;zkh6=8~ zm}9JHo8HD!_RYk-N?0)_R8v$51khTA;J6T0N}{P~GjqvALi7lCBX$@%*Z zj57U1KHq)mOx$iHrby)pijpl|%gq@tBt??+k%|ZjMoZ>T1rQ;OSj(JAhox0+%y@$H82#dY2I+Z7s_e@T|uiI2a8Ee@Qp zJPj7Q*r>2D9lGRwzOc$=;m7^LPcr09{f0d{GsN$m?@7Hr%=aq4A#wbhx3#{;Fgfm` z0w9#B5%oTLb87@NsFtY_uR_=WFhxEM+$>L%^dHk`Z--*BQnS2G5H?o0%eg5ltLhDt zpu^^`fT#TobUSnMOaq48NM}QSeq3fMaAx8k@Ru>M5G}U}yxVSq@44+@in~*Otba>V zdw@zI4(fJsnx>KS{tcrs^s9vUa#McC%*;q%$HU4Nyr6FE99)VU z=_=9i(@xp@rX-glZa?NNjjPzgUl>;y39nSi2I|L1?Ly8hFJ24v%XHEV2Zilqw^!=R z2c8~~CiEBv-YN!T(JFqL0OaHou4Vw8UlSI*fdiId6SA9tt2>g=NRL6<=xbQ0BxS%_ zqqBuAsmdK#I9t?3hf=^v`uACx9LmaYiA~$C!1W=6y#>zw<}H-fU-6K85t88~e9G2m%pih=NZh2OBL!kUqk>zh|xYt8A zcH4*9d0X*UH=x_Fz$*xX5n*s07K(*Ao5@}LTGq>*Vq9R-R}8q%rm+)8`lNF<*zc9^ zXnzAwT|X?wpHz2mX&aFgoTYYwc8xpxn0gpddH5LQy1ut}-MZvt{-NbPWRCXo-yL4E z1nPKE_*qQ*-mf#+nWRd_E1<+FnWa7j!;j48HTc`8+rS&=QiQr8+~nwiA^0o-DgD)D zU~JuF@ejD%PXjDIB5wQfW9=GhhHEND{VtISy+4E&*G+tE8M5k{q^#jF6_G19+&Dvh zD1T~=-xw|@J4Zlpr<&)J#7x(kdIMK1=FFmNaGk}6t=AC;pP(Pc)Fkvw+$4wA@t>V~ zsx&s7n#cm(he!hgZ84nw0Hezyt4|~!>FPV+G-L`E)CaE}VGMCr9CF>U5Wvtj&0M%C z0EW+>3gVeh(C#oY|2pvQ0({zs+*5wgYCOI8<1Zjv)t5Zio=20yuo4m55%LE{M)6LJ zPL8geY?Zll4ZoT+U97%MDQ@uk#0cI##hm|SkN!?ExhP&xR@gX&$i5kbPhRrw{${7H zh)4llox32>to!)!lIYGp{LG-3>49OcAfdT9^Z62cj_=zlb%d&aar(8-odo5|eaFmI zHtJltA^i2!jY?7vD^JdahiRVb#9Yx%;EyyQw0z|f`{?B%w|4Gd8gc{r$D13_iTSmEvX%3HDLVI7Sj-YXJ|T{Qmppun5^)M& zYc+p(q&;JBh7>ZmsIXvj&DqGtsRpH+53${g)E#_rGmtb`GNzTQZ+g$t3%YO}#R+dRVJI zhLfY8?(}ZJ31gh8Pq?q5>#sywXCDa!Y)&A)<*C^0q2kC%bwF)%g!nNpZX)_0|+M-@P5t@()=O<&X zPuQ>}_(8MYKh>QCwCeZ*ywKtqfe;<@^`fECq6&-Y4q0)U_et#R$aw6-fGf$jkVcpn ze=2rsD5=RIRQ`LT84`n@pjdlDp%RAT0e}@!S;R9WHQK<4VSZ2r?vu4oKQ@!S*7mqt zNNst8+{YATM3w+OoIwi#hxItSM+x9ihv|>X8+7vSOzI zPQMLL^8aG%RXFTyMq-nIF$$>owe1Gwe>YG>fl`E;vuYx-=+`y+pg33}91 zUflr#)xcVJ6g3g&yHD9|ikPL)rRz%+v(}>vjJpz}mdW!v8uE`-M(KX{lOp$lp(MnB zsMLTbJ9=V}x7DcKzj0J-3O*n!q0FRqZ(qRSr_&sM?}Pe&|C$BEOo%Gh{_eJSazD}R z;@0y;(Z0EDFsXXJm}SjsSeTeY&Bc-5#3uit0mOhse!TYW|6%XFqv3krzu!cn1(6_n zNg{|kh)#?UMDM*5LGC z{`&nh%i8wdcinfn?(2HJ^EpzJv{bt!ZM|M3Ag@Z8oQF;2-v6(@*Z-*4FAqUWU+^7? z2duH+bIjP2uL8*sk`LH!Xk{y2(+bE88S&LoceL{VmmmFqy@dC5E*QJt3bNav!kL*Zrr4u~er;x>&ws)2IAltFv||QtS^G{^}|IP0LkLiW`DGFL?%iyHkj? zsF#L@)aRpF+=zJOT{AEc3(wc+9 z(+3B6^U6tcSy_Wnn)OY-eGGfEBnAY8REtu6dhWOT`k_73Gb$f5$2u>D^PH^mu=@B* zm@06(r0aAFJ66*7Q;f~5UB*D&1oZWYmGyyTC z?<+|1(syY+5I5^1Bj5Q*V%gEs`_{h%_`T|#=-NIcYo>2KKMAbx3McOEqX&VB#f`b> z#ZA0vzG~QXThI((GevC~bUG=WLS9tgUCo5Nw;?}&a9=9rsX&EpB^{36Tx>~qz3q9+ zYID2%Zx5uw%^lL&J0G-0kJR6*ABQ@ZQ>QU^4~bmZ#v|cj#JgW= zimx1(K=kFXKA_KhC*%{%IO_Y3h1_NR<%VZ;lnq~+%D`diF_ivlj<|u=r!wpDRq%sd zaYy(hBS^~xRt`6GcSf4Ern1tw_m^*#Qy6*2FLu*A)nWQPcDJfG5meP=Ged6r3EmvM z#HYYQ6Vw^N487V8WKW9Tt^6+0s{r}oj`|}z_i@|7eZ|<%s3Oab6{D#x@(E@GgJ-$U zI^N1UAMzt*K%LM%dqPO13rIm;F0Sss{ybu4g3LoTAKa574XwU)#<3qlytKFD-sM4@ zPv~9DdjD>rC@K4ljVRMh^Phf4)xzv0X&~wym0xc29ZmYF%d`2P ze!I1dw&<}0{YpQwNZjY;_K9iMD$h66oo@5HEJH)Fr?V`m)mcPbp40sJInD!Fclt5; z^j2PTU^!CI{znHx>j7HWQS|hk4b0z_6=bqNt?@xm&~x}fqne;G^ZCp>U=8mH59|5j zU$UHo0S$ok5mzT5JRjrpcwkDNpdIE! z?TsBj=zT(BkLFq4O7&#oesJids5&aZ>JkpDvTDqMs?`$7+IKIXZedeIxAba2%e};l z-HqKWe}BgabG#1t)Fmd9UB&@uN8;H2gU^VBbC1B@-?RLUs~h)W$Mp|!uuv;4842}e zJwp^oGJZPgv9i#g#}eD{qnCSJKD-`NIdpMv$3;1QXP&?Zj0OgK59n@bP*$n_IrC6` zM_QboA!BFGQV%gI+A3qHXzuzbudv*$Ujc&n?o;{faqyBwc9LfIDqFFgIPyl(m#zmf zzw$*LqCZVZp|JVr&50|8@;Z&7(Q76Oeoq9=~Kf|)! z5uLXW4dyT*=4-;6o0qd^Fz>0XCXh*fI5M@O&X`?qL1HXn7(sF0)ktvuHRJgygkh7u z^Y-Ta)X^<7_p6;q&KKf!h4qi-f|I}%gHPoKgo|0(cg)CrKq-HgBhEJJYRh>Fw_%@o z>n!~Wwocy);m-e3IUpa+uPp_#**7!WT8PQM2?=z&i=Nz6`l8IhO}Rl{LtRZtby6Iw zXSEGmRDty%ZhyO`vMNUN>)ev%&!?}T98s?S6uZ!2ybE29o*u=OW<6O*1XOokz-PKg6xa`eMHV15krj};f;K~1 zRM_J(=;KJcpsTfjc*C)*HZE}kIeXutdB@#Z`vEXoc4pC`VdrBaf93NSmvc0&{k9`; zqC|Q$^W3}kSNW-$VB>0*GWQ)n7n17Q%s}-;!<&8@ZzVTvuu#o#%pHTcCWXhT`5!cw z)_7Q9ZHdus)!en`^3se_PyO`-2_V}7Euo&9mbzm|S@e)&H0idAILhxacif{3d|ba( z_bYo=dLdpwqx=_Xu{DdEO5^*iVvC*A8g%p+3(Ek@P+v?FIVX{tpN zYxeudHzH*{OZn@_ZxBp#9d!i;g@`dv1++%wr`!Ls9>&Ql;*F?KzYcu)OQ1POGR4Jt zmKk>#`gr)QlVT+y_&B9i4z@66^rdKg#bPeaFFBpGe_1ltslBkLOk%r_?=V z8~)A#xiNEo;j6eef~#o5>y<_1bNMUg1eb;B8@?r`aIr4Fj3~fP?ErJK>G1H(!PxJY z)|@iKBE3QXiTk$sm)C6KAJ1mUXkYFObr}hH7+;6B$dB*{}lbP(ELHcDxp82*3 z;ep;%ARQj%2P_izTcf@}@^sqtw96niDxKtqtgr@RURc!1V+eh=m$q`5U&%0VaU)T5iD{9;e(51iX&{8-rz5- zyM86jRLz}yv?rO(%}J11Y{<7_l|I}LDs({wRNpmAuyj_U-0^EVUr{IA-JM;Qyn+gs z#F-?M8?qAh-b}&?uD6+VXfh+`s&pK=Loq`8&0!n#ASW)I{Nq; zC8{%I6va9rjo3jL(WFklvnlNAMRyvm*N~p0YV*V(Kk{lHX$P19#$)~*FQQ|dZ~PB| z2t1Hrw@RTJu$uE*yk!z1e{PPeNGCP2XhE z{b4Te){<=8%+3)P6%T@4!$FF5y4|10QD^NovJIly4v;q=E4V00!(NYYP>@x#^@XN< zaM5n{4c(0JUYW{VVG#9b8Rrqj`@Gp#x`Ot<^s=K_w>~eh2qU-JSbBUl1!;c&$gvSO z>p%zVnAM0x+4_WO=~q%%@MVsuIS^BU)tc#8PiG==)pJi1C=^&k zb@J8^N%ke08yaQEtOw?If~+Kv#-v9Pq2|G-;xRb#c}%kWD1O%%)QcS?#?x{i5O%yfmiR_)dSNYXzAWH zXz63N6WFCAOf^syAdczbHIC_?+|pOKR?5~~q!kEldT|YHdi3R=6qF8!WWv`1uhC9Y zPl8=0uq|#koOHw0yHyRWGmJ3lhEB5y#b?`+KASQlTnhU1+#t^g-y^P0-J3T|DIfIF zQf5i$+=TUe_K!qGrSg^RL(DhdLf7n?!;I@g!y#))+U-qtF?)AqK5>2ZhrJM`RLj>c z7CGq*CKGuxm_kJ1zP;i!C&?BNE>J77zsI$3lSBSA&7%uH=~+E}V%8NC9?oZN#{^z_ z_UyO?@+hA2C#OQbtU#QA)lTi<+`1WqAK|_)cf>_(R67|@?Zea6Zxl{3CkBR}i|}P> zx75{DZ6_S(?rHF-Vl2YqMcI}YZ%cmHv$oGr+~G;Eb9;n=Vm^w_lB64D0mbdbm8yhRGu+)E(Knk- zxR%`hZ7*vNCosA?!np&}WOt$2S(}loFQa@>Hn^8VCzG4S;Vt*d#gF{)7Ex#RcZ@@}P-Am1gpUigy1$-3FIzkqj;X(aBaX&u z6j@bj%;xn)w2PNXZ!6{86ek9J7lM8FHoG&@?}Yx?aNX^}2+q1%_&V?1)F0#-1fJK< z`fTxqJ!?Lp@}rH0j1@;sE<>K^_VPE zlReYH!TT3Tf)KO0K?_kjLQX-4sI%Z9XyR!-&K1SFe7A}8FhqBv-2{5OCa0u6E}g4@ zmfq(`kMi=Y;ip!ci9Rh34gc&zO)8_R_CA!tK6WkT>?@Odl`Y%Qv!6lt?#)R2p>J|* z8J9zRt0yd}J@NHlyt&!_Xp%WjeM7O^*_G4ymht_;*-2>^d0LnpRNCfa{a3fg+B8=l z{*v>prB3Fg^<^Z3(443`N{#N%4I!t_8EIF}hM}I^f=~0~VtFMg27sfZ3x)P>liQ@Js#KOD4I5kXE09P8AEw_E3?rXQV&zX6MaCxKyJgU{iq7!J z`s`We!=i^4YloHff(IB1XZ$UB)1H3hk;Gcwjk%9)`2L|_xCz)d3V4Te@vY1ovKe4#fsASA?T!nO(a6h=g0oFpd8z+(rfm9YsZOBSnjw85Fc*j2_Wi^pB z6Q1f1jL={02NKM?99rhn%~W;L?gGEX-4}A2Oz-CUS%-S9^1Jn0HkqCk)zxx?WBA!h z=Ny5PTB3;4uD)%X^hO$&LvmEt{Etf81Q}){GsrwY&DDNHfyMfgq!_1Sy4TUj4*U-1 z4rYa^-7C>t@3l2Yk8>}6+P6)d?N2}BP#)cMy9l!_%FBoEcH`&U(FaR3f=dd>NyNSk z`+BCa7gPV?LUQ+v*ql8~ygF@kTeC!y%G!!&KVhYJ5Yy(7yc2O;s=x1abMmVDT=z>%}whW1gyX@X;Z&y z4lhdNM8afnLfNfW^JR9&56xTRZPL-OY5?*FBO5t{=ltOdz;tmDbZL8}LO_D~D8h1wfC^CO zApD+>#c#kYla0*7Bwm_O!)!21crRluQeb1pxK=nQpcHk*@*FmLoR>KSkI6dJ85UBi zYVjDUBaRul{RVo*%D|YgHw3HCN;9AmXHJFE@DdHbc}!ZP$*EWMGis)Syhn??5eH<( zC5Al>DNKQE_114*?e)}`B%X#$$7RjuMP_!7;#>0qn&t-_M6*ZZ<~(w&zS(`r5mBrmboT=jrzan1)6 z0pZ>!!Bn-ninj8hbW`_XO=Ya-zh*Bre7lZ!Gb@d|O}CQBX&kdBJ$Dff-H_BbO9~M+ zK?8@0bSH(6!?wHOQ2{=CunsF-$O^VK20PYJq6@}a)k5pGv3=0@LymM)FVyRtX9I~Z z%YYTP@bT{D>DX}1LhxirW6;ot?@sq~-^H9A`;Z^>@qS-xiE3EcLl0!Uv!qVVa<&uS z>S7MWhZI-Ah+Gk%tNto3=hHmuwM~%v=l$NxLPi;SX~sjIp}TZ$~6HVTi1oD z3;UrtuNECr1VDxz{?DLCvpUR+b@K?$b(Pu+D_1VZY5LH zniYaTu$>=c)hJ5=zqrWW0Lt5y)FnM0rxm`F|J?Te>)W8(AM6n2$e4hioU;5XWa-LyJ=i?j_* zPs*Z;4z5D5ub;u6`;cQf2Vl+rDP^wZ@Ozk}@a-9w6Wr@Dz#C}%UO3S>q<&zcY=5CP zi;h^|7akP8KWkSdO#1;G7=|T9InC`y>X~wBGfr47x$!6}js16(bQtXix{OLr=ndqt zr7(p$1vnM!qoQ}Lc}fYm-hq>;V8EZGU0*d7<03k-YDU9-Pn zvz&sVQfGPFrv!YtfQfr2|JSTE)Ujj(L6C>+c`l($6g82@87yhrz=o-}a6uZ92gwb{ zgf!2c4t2Y0x6N16p6I zw`o=5i^sK2z)pDSDADn*RKjc!6YGNqHlL)8{7_gWeaS5M$+Xsn_ZQJ-bBUyv zBXu%0Isc6Yg>Obn$0)2*p4u!w4d3!&+7tHJeP=~^RH0_^GQwK&_5v(ycLF&&3I;rM z^Ot`BpraTQo>P)0O0S8XX>Y(LESo(~+CK`v-Xv?{EwXLCLUsGA_$Sst<96TUM%#J8 zZzR=;@A}4Guok=-Nbd6#6wnz*9+xVXIq;1Fs>N@$lAc>dUFMxJgd@b>*2%ftWe>Wy zA=YqgjcQw-5Z%)Ns)3q0ys>FoH*TX4Xjwnt1bEr0z(X)-bVq$QXbbECc&4lbJFNy8 zJ|PSrjX(2ar$}v$LuS}k_%%bC@R0H z>mndPVZjlz48JrPhvZXaJdQ;4fBl)oE|PO0n;Xps9Bja#uA|38M5M>7&e2Hg^bBDf z=go`Qbf_BQAn56H82RSKvv((+gu24HQLS{l;;yi~i|!q3kKHjBwY-=F3khUQTzf6v z=8F7oFS6D8wOf+eyL*MmZB$>ByEoN$fkcS?A#(Dmu1614rUmCoGr&LyQ0~G0@c2&{ zxnMVcCH0tF@Y`?a#`4fB`EjTD!;!fn6Qf`(Xu-DWuwce551WEj|2Fvrz%JJWYv=aG z9X^Um4&~0RjI?1HeL@Iyd;8S7>l(VJiju|mJ|ihQP~V{R>!p|aHD zt`pE6eQRE4&`w(4(5WNG&^m}9N~=&iB*U?JNC}ZCx*kxXr_m>OWg{z^V>NAxmT|iL zB&&{nw|$p4@);ASkMlXZ87SDDSAEuksbD)}ES55l_~p7SB|MY&&Ty_zRmx5>vD0u* z#}F5x9!ACCBDP1r;Mx9WYtPFN>Aw{JsFpI4;A?j0!^EXb3t_JM$(F+my)i>v}ue#6zdvYyMbJGu5$M_sdx?`1_Xn{?RfXUQ8T0Tjmm13e@p9NT;B zI$0Ro$pRt@^DQcm;rRI0EEO>#$L3@DiCyt8edxSOp}6+u3F^Y79Axx%2_EK4E9aME z0^bWA%7x#yxxwy72&z3o@uML8e#*AJjt%2?e4CJClOdq^ze!AHv?wK z@x0te8?WyJg})&f|%O-Q~4% zIEe+DKqHE3Xl8fPF9}b*-X$ahl7oJdTy>c4$z&8@b8aF^jw^5iYwFfs3xw~%wqOOo zQp=LCUUw)jpR3b?;E$+O!q_0)PWUmZ&oe@LJBm{~26g;wBIIROVmb^qu@QZO8c`08 z*tN4k3xOqxhb|vHZ)Y7y@B|wEOJyfgmerX!UznQYCs03+clXK z>btx8l<9*=_VZAY>_+qW`;8!I^tH&?qc!$r7+-EwM$^yA^a^qSF#C|IDG!_115ul_?30e81%Op)I4=tt z`n^{A>*&&W3#97F2TA^&-ne#RD1a5qtQ5e&Q>CHBA+^~^U917us7U%|j;}%Rx9Bh- z%+yGpFPbQV4tgIkm4XZU;gQR;RABiBbh=S_3`z;-ZBmE(onGzxx0O$SUJNeF$FQhi z?&SV174q*)%vA?$%G~L`C8mzX8|d`1uQURiyBlxQNVny^EWf}gZj#=6lLiu6F;2jW zdd6MWeLic=kbv?)`wWgp*^Qh}weaFou!!7Vd4Vih>wj8Ds+R?Lq}+z@7W2c(s@#3; z-whhGyubYU(&W!y0xb3x$G-@$*Y8&cT%5t>*~wo5ESB5939#3#TL9DvWn(BV{}NyW zME*^HWdRAWGQ}>&OcUB(aG;2Qk_{g7IP!Y?Dlh2VOI16{6Qa+_xYcV1DmDtS&G&&Aj}q6Eo1tyfEfVCITDYo!Bx z%St;}pvb;1mJ1JtTgx;MHT<;xZq5N{-x?|_i}|ljXk!TJoEe)FMbiEHH269vJ@7MB zBxK5jb2*BoNpifo`ynBx4XV3cE+|LsouanM)9}%;q(Al}DH#%~i|DSz5Rf zH&g1xHTXULhpKwDU#2_`$q+6&v-v$`Im%sR^$rMpb-7dBV)?Kn{pwo08wnlO2p~9?AqMp-AF2wI0!YN##hH6DZkES$g3w=rK7MnTks`V7U*``GyZq$-$ zFh|lrKf#9@_Qr3zw^OK$9$H z06yT7__TWe74dx#MGKbi8bu4HlzqMX--7WP#`WUe|Blms+u(OZvfg#cW4f-b0w~MS zNQ}L$jJ#ZbAVyw!1>%QMf&v8EbYl(y+KF6Q7l2yH&EkM#CxQY&1 zaD84gJZLGeog%o(zs1i@aA5MM^mUGxlriZXTOtZlg@(+-A|$Fwtt@9_vOYaF(acC- z{R1S9Dk$YCb?>_;>xIvgPldSgSS+qe!F5D*X0!|wOMK&_()+|A zTmcs>#?~7I+$JLNx@(gP0>$r&)b71{nd|!a!Cgox#WR|(G3IpUjki(J>D z)H<$#UYPtqLpotS9dKjq%h~aQ#+K$SdG_}7hF!2(m7Om(69&~1cu12hBHMgmA7Dy*UAV;)l->-0QG^2ngy|Semno81 z2o(Tv;f?m`rk3``jJ!@v2gdz`?z+k!!%~36!BZVMx(fWM6r9=F#3FdHeR0mJDxEfKEhw{f88N^Z1zm zCyyu`Tpaf;St)uwbDQDQ%`-O24`Y2ze(@Q6WnlSV$ZlA7xo8}ht#+&xnn36re$Z5-^yMXF+t83Oh2xb@rzvGrz^lic|`gsEWAsO zN((zOU|N^WF~(T$n>oRDq?#VM$RLb!;Lv*|lqTFU*sie19YWpsqZc&Tf+pKgzlRYY zlO}m`Bc#18|CJ{-#EV$etgiJ`JZl+wzB-BriYhEAUA5+d~oT@6ZY$k~Ua) zro1g-V6xpMpaSa`d=tJss&V}n!;y)xID^L3@(})y?bR(lzS&C>*zq$6zEfaXG;R-8 z038ooW_m7q3JZH5`FV{=-UgL-2p5NC51Cv{^Y-8SyO-@$`I5;Jc9QBF%_f<*q2i6n zzW!OYB1o2fJ#p_ZQum*v6#qT)3Nnxl-Gc!`2!?3-A(yuV{UdvcnU;YZUu~I`B_DjX z0P(z7hGNI1(<6J3z)wvN3-iJ&1nQ=w^Yp2cpE9J4_uY`jhJ9CmGm=J~ogkC@6G(DK z@@mdKqIR#mBB?elVW-3;Ftg{E#u!nO1y?ZvVguH%;`Cl+hYx@+AcF}8G`za_$vyJ) zpUS`Kdt#HQn(O(V^JQU9jNJ9n*Fi?_IU)0m!YGRImWotnzod+Qxt;=J>_1a-kI*4w z(5I*`d_eXE?v=zPigCWh_g-AUacF)N$LrDKzjk}skZ1-fMc24*e_6Nc?jr@@DbMwx zT0+91AeKkv*u3?05f903P6nb-K3RJI1g9V;M(-;c+=-+X;tvq?_6JXko$f7H;hS-p zKJd4Af0Ix!?mOSq??=n;@HD4dP+FMoyVD{40#ND>U0`9Rdi5jq>A z_`W};UDh2xR@ISAEg#>iq?u_IM#x#YGE(^{H!3E52eSBO?o>akT7hP(=JFGHE)lnR3U((h_ZtG#}Vt22S(%fZPkg0mMkr z+kfBStbIS2jcWi}=gGBxA?s0j73|*6f~lbfEaNhbYI=}^-_iFh^+O@Yw-&at{FQ`I zEQYvk`f&04vER22z4?^r!^r;Lzl8 zp6X9?0|(hsg9oqM83_dCt=cNkO%$^Qv|9v-;y!I_%f73yJDTs*20v^-|A3h(t?g9u z%$OG`Lz!$qJ5qgh;Rz}jVJz%NF-gLt>A-Ka%3};_So%!H^oL7C zJmPI3Z!1jWeg|&~C(j=}p2U_O3P+;o43RFJnaF3#CDZQwnf?a*yKnHfa(3LNEP)rwj6q4I!CcJq=W23PD# z8uS)ykp0+)m4p!pSK#7J&K3L;K{e`NXyq+K4T#Ab+9{UN+78hQiRD}j$w*)1Y#!^R z0MD|%HVDE!8^@Fs;83GUBDGJ9nREt}cUjX%k%=E)@SL?}0NKa6n00Wm-&cB;Fn+vYp>N$SjIcbGX@+5%)?qbS zX&Wqpa;ypi@l*qXelI@sj0?QaDyii}?(ReMSRhb*sDp z)`ly2xGEu`yOXLM8AujjYWE!--(qM*O8%=SuVd;8##vFR>EMnF+;bgUFb@D1Jy{=^ zQ{Fv(Wb)8zLe8oO3Y@C{`7wqbT5Kdq`I9aq*(@*qx;dFxE^2ly9Q z!WB5rPoYHE!JMZE-woD`PnVicRtZ-7sZYiMJ~FcEao{K|?*sFe2AI3g&uoV^fH76o zDRrRFBb_8AUq$*qUW~qmgBnC#F8<_MacXy?LJ*$r*J4ydSZ8cp5W+}ppJ_t;(rRri z;kplMZ>3#?Wl9x&qQ<`{w3hPMXMV`KRa*9eAdkz;HMnjk^Kt_ma@-n+2bC#GVfIf= zM61H1Ktky1;yF{4PZ%`x(J7RUyxK$6?(0sKUKRm;5V;#BhT2H&`{yV=48Aok(xjg-x6ZNcJT!d^%V)JW)O57>h9xSd@`+F+ZSiHngdnNJd2eGy>!+VmzBWHa=~}I!SNxyH&#LxAFyB< z?o+kQNQ(*o1*_%SNF5wG#XWuOqIMBn3B4E!$zT+?3`S9EWKSJs)FtU|5G-XL zJsJLM>R2913%GhUuIB6cIZhR~MY1+u4Bs^yvjG}G7(8(H7}aDCmtOp*XD;F4Qd_V& zs@mw6be*BNa{oR5TQIJ>1%R{FZ*dYgG6wo5Oyf7p?s2h!ti)^E2nQ3|u_NC(spqCg zrQ_6;iO$0jG{KhidghVB7G@>HeM6)^MUe(i@}l@N*;@6`H%1;!gG!%yiCe=@pEppV zqrr1uSH88x3@(3Q!9tPT;>x1C08JY}2CTh7h`DVd_@| zk3a8$JDO2cjUfuH!+m)@1cPH;&IM!u*4KIoj?4s)%P7}@`|u@6A0|U<#{?5=Koo`6 z`Yh6gn-ZkZ=zmH&AAnsPew_Fukc(qa0b>1|>k(kFX_-H@&Kx;$rUbET2}D?Ct@o(u z`fl1I46C>2o;(nEScQ1~die7m)Q#4I%pE=sco~{e%KJOleE_FadmGfsz*4ipRKOT2 zlrBez*ZS2l{BG9r!@t=Q@*cgOXQznnY>b?sREA9UD1)0A{V=cK(69}n%hechSk90M zNkH2scu^4!Ew|v1hC^jRgNQzX&9vR~Nf+P^9JFT=)(l2Nsj^;LXi>+6=$=%?!7 z(7YMbh6h4uijMw)hCKtJVO=}Y7SahWm06u@)+U%4xSx0GA5+an5EDkNYxeb8!JF-u z(Db#iyzUy)UtxJGP*^@}eNykvx9S$kPw3Zm6Q21~G4=2o#-bt8C-Tb1bm7ad+t(ndH)+( zCloRN1mQ8`$i5$U)v1$eUh}`W7QENXlX3q~3Grio6#Y9PQW@)sf*87NK5oaJw}C}p zxg{eJ9NQ0b0=yKoNneBTs1&!iuW?z4`VD@h{7rfV@?S~+SB3v&acuH5hrD$^VRn#pW(cjXbYbAB2TcmVqB7g0?I|Q4@iFbn$E6A+G z4E0+E0*+)|V((`DSfVhA@hb`Lh7RXM%LxzC!|rE3pr*(glo<@xC+gSifaXQDhWCLW-KCr8*XiQxB%mueS+wpp0168PY?x4EWpzab zPgiW*==YfD)nb#{<+pv2Cv_I&eY$0uvL+o4*n2GEk}~^63g*zJ@aqwSk&P`s1@R|f z++o_*WlqV`C!j-tGs=!H9L&&Lh2dSp$}9M?2`!Xnz#PBoivEx-vaLD%)B7*fRO9+zXaT`Q;`&&!`Q))>v@i5$IQj1 z(E>mO0hL@B$mhBP>Z$)P9|`0o#JKLfraW4pT z97NycOxV1Dbwx}&8N+c88WaShdr#^e&{f~IdwiTlD_B0obr|I@{~u>FkoRD8IEMSI zZ{Krd_5J*eMDZ`3TI9 z%71Ra|D&q;-!;I0Xxsmv)$f13q>@q?L)b zG8vAg7}PQHVwy5VcMX@dif}t(d_Awyh=0#A_=E23Gjg7ox;%;bs)-K$IX2PBNS05) zS7DdmZF@Scb6ze~FV4K(wj?H9lt+18@kjX4orlrBF)m_{jqm~7b8(X93;!@jn)w%( z0;MG5`Z?r$`4wC{)9!*(UKMmmQG6Rj;d61>=0?`h_yd(;Tw|}>mkTha?sul}fZ_bJ z`h2&Xo&b@2;-mvJcyc!FQJo*f+?5q28P1YN|7QBAG)cM&T1#sQ1rXR?GgdQ zXEz_uV=coABOY9rzcT-DaqGn1tSiE%_WdL^edBMaE={!s&t>8nN5Po^fZp>b_g+Lk z5kSz2z<(rii4X%j3R9=U#*`_%*7KP>Vm|xW>iuJ3-6m}MUw47SM4PgavyDvK6sdeY zp;*(<0v!)GO3Yk*-!A%mMECLT;?)P+rQLIx6*|_S7wDm&>SBT4CC)4JLr(A~8GQvl z?OrTT7v_y^s%E)xupPb(?0S6>OPZ&QFOx8Wwc=nd<1w# zu2c}V zej0VnM3#ohdFia#Icx`SAl0tLg^N*a=h9#=5OmBo|E+CchZ9O$>rp~9cTa5Ic}VJ@ zC(pt(IECM|t3O#cmsVqNJotF1i*9#IJ2@v8?Q4*)8Tp>#69mcg9br zw#SG*gz-GiK}#??W1`oV`w5KKUQ3&*xcVm)o&P&v(kTNiZWz&Sq3UR8-Hq+<(c$K4 zd6P#7EKOs)-PMIG(L1xc6#Ig&BTuj6STUc0z4OzMZWAxQFa(W?>*9grVW5tl7k}+` zqv*Fy5r?IISCMw@euNF#4`;ga0ePIzA_Hsqom4)1B4R@)id#gFw_pkeDEmUT8GljW zv|(HC&nW~k?0=MAJKQW-1MA3#m?cX2j0skk=@p*-uJic;x|}izygiKX{L;!=NGJtX z=m{X~veAA^h45Ej{cZroQaJu%+l<@9`{;B8@7o@eC79YejB33v9PqQwNOLdIX$wB{ z84RuFoZPr_xpmefj!tj!QO7Y-o+cfH79c5b`@qBQ^Tl%qx<9=f35W1y_%ee>GT!fQ>eW-!$cGq%+bah7exJr)hE9tJsD%M8iURyauV}R#`9_JfmZS+!<)&6>@ zV`)}HI~#jZQRffq1pB3YZ5FbmD)Bl|g09=O?bv)SFEqbt=^5Yb6|!YjJiqd3Cxt+J z|A0>M3iI+Q}(ONe(7MBxK}f|n8#x9BUqvdJ=Zklr`)Of75vm1H&g$)p92Pd z_b>MSlg#fRo@_=C>~5?;Q^dsE=yrjYVE4=AY_0Iq-xqV>Sq@K0i7KPZi*a@^kdBuGJ@6{i}v zDm#gEs8pBUUIFPl#SkDpRzXiPFB_OA6(cJ2au* z1A_%O-P%bT3v2u2Dueu*v} z#ms!ER#}0+w_1qLTcP+-Qb{mYut4_?|9yX(S|EJ;!q$K*X8P*GHW;)MyjO5lFF8wI zI~+B3Mdb1PmLF1wyfVuVGB?6iU?DI2tkcAtQ8UvHo^-~Qjj3sjMvP-R&(A~Yym)!9 zr?bS>W5H9zwd2k+cw(Fu^D}!eHc`<|(lS8>j%W*uB(l0h)rs{Z7(Hc0*R6+|z>@=K zz&XQDJj!#d(+$OL;p5lQjfej+^rZ}$kkM_D*P9!6mp;BXqaVd*eOO^=crg}`DQVc7A0_+_|xpFydf@L=keXBxx;(;#>L(TODn*# zY-wxvig-XIjU(O)0!@n0dzi-RIq!0gcF>lAW*{dLGURcq#Q zDoeQblm2qk;9$om$ZXjo_II8MERbKP5PN{e4sX}M4x3KEVdG$A;6>{dY!97iI^Hp& znm3{E^v4~y%>&_24ESvb+ifc(d0UCtl__fo*_V=LIM2H+jeW9E1s+d&{B*~anCIWB ztw-w_Ha@?6?zuhYp=yA`vg^-Lq}s&nw3VdeEGrtgCj__~S}%SHjg0`Vc;INQq@na1 zz?8R2?In`kuvne-LC0l?|B*nWz_J_VC!SPcD;&OVlP5brrq9a8a%X)$u*;m*;(m#R zd#efX7iK_v+4!oO7)GGOb{@aftwE`52#HjnXww-+CT8QgEXzkM|y+z<*D-9}heG4$V8Hgc-baz(}DEdVz zFm$@GiQ3=O`i8xLZD3vJq=_{OhVr7WK4nCD_P<2#9G8|C|H|0(c3b-Vye4FwW|*M9 z-R$x0{YVs6h&lanw0JrmsN(Won}$D-u6jCYwpT}g7%)_-CLhnwj}W1SZi;%E{p>EA z`Oe-Vg6wQhi*Cd@-WUiCI-j9-pKWF$^xQM@Jenr{_V$;&Q%CczS)O|;@`rBXA=J4y zn%ncI6Xn_F?IhH%=rXm~%QEa-x*5kwfh4*R9EJx3m~-JJYC~&=zWV>h-kbkJ`M&?d zZ75kPiHNBrNl3OBOp+8?qA1%WWzD{?6GF(+!iX6AB-v{0%h)o?ZU|#1%V3Ok_L=LR zUa$B2{(K(yc1jBO-;lj=TT&3o0h zF+VGz^M{R1Cp(Bll~4ks5E*8^9j^y~)1s&E-ytlAKOCgW|A2rZJ|}ElD&UZY-Rc}> z7ZdvI1dG6S$4xnp3_9fqE9BScYJen$7#pPd&kq6RpJvfiB0OhSao zX0TyJ;aZ)>HIW#o#t->L1jJ9TA*jtKv&|mtS=X8NTGw2b4L^I~dh!F7qdelf)6&9u zm%e{-TZgY18MBLDjZ|Bs{mG8)^Lz3ZCmT79Ug#Iv*($g$U8(&OUt-rc8T6s=l-zZ) z(&t2Z9YNtiP&j2j%{oM}2Lovg81t90emx`TuwZb%VVeyb!9&IR2F2MAVRB0dCagRE zJNQxVUwAfB^Rd!S(c!|Rk812gL3zcAMr!#v_ph`Ahv?{0&Ku<+p4!KROaf-AC3ZW9 ze;#YB77fPv^*OZ?E zT?|*AmhCaM`JAtus2#>R*KH!|N$~!73%sYvc{_=E*zOTXb8qEFsAQ;@t7Z>gi<)`l zYhFB?7=^QZdh`6(#bv9SAS6e$@z zAQ;=4zJ+Lwmnr2AGhX3ELIW~Nx*!opbnpRMjSHHTm4xKE72B*@W(bOSI4lW&dnCHu zqEQD9Ycqzxjz0YIAUXhGo_f%>t;sgy0`dT8G;D$z&|+SjKh-)#EgdAb{|qyptygjR zCavK+H`QezvtMY$u??^4*UHh6d!KPS@}Y@(M&{?Nhb1v<+V0bgAkXzZlN9?h|Tv@HA))o9GRAC2F*KG<7SxtMAw~F~52Q@YHFoU&~IIr)-S;ct}GqB-g#TZcfFq>^4K94_NaVGl=L+g{*U08bbPST{T zi(;>ouR8tJ)NCGBy~)c_Em z*H)0*n~h>SZd$twG)nQa)_gyIU;5JNs#XinP5M#NKCCc?#!=1?ROgdO(@aipCTbwO z8FuBz{}shG91(g|J`j>L~BbreD#o4uV{p?!bVE<3-=k4r{3mr8>t~fcPxXdc-|GDjx?KCV ziILDh`10h0&uah7_4oO%!~azxUdNRkN6v#?`YjKg)>gCm`wk9Ta(PRCVdjL#31=lP zA^!oj_F!~}Km9Lw?EiwO{sq6v9$@1pvibfZTGy=1i? zsMSeR`MF)Qem}Ld+`e~wjKW#@23Bx8xL)|dz-4U;T{)oi%}wF*=jUxt9e!a`X6fVq zwfrbY8v9IWkAeM2C^8iJJ-VinomGM!0DvLZnn%6BMWc+Kqwfj0>X?J%DG4ELm(!2MB(b^FzujaN|UUOd6>V$u1>$9MA3e%Q4l zk6Kp1UcPD@v!Ap~514O8w%}`Bt@u^}Cg&7)0AFJ&eMZFfD+h$NEB2toQfy)HCBCD) zv-L`--3!2ABf3|_9(Q^M=@Gc?Kv~(DvnGBZUTh~rLVLGB!^?MT2D0%$?842BuFCf7 z&8}aY*@o5jpwRN>VwJ|erG>T`k%~?i*Opgz5j$1Zp2NDHhc`6f{7$9D?nieV`Xffn z%Q*~1l%iv*Mx%?-#?h*``67zVU<=(YRbHaC$Q`#ajTetPf&Fk$pW0f9d8zuEgI+a=2a5_ik!=!`(aC@Q@^hfWmz~N7@Wy#G+tNz)M zp4cyxgh+qcny9*+<+jXrPck7?U+fi^E&VYUBH<_@i}LOnE0e-}R=b|vJuZchfsyvl zFSmA5t_^cFO#kF4ZghjFLFQ=KxvaOfQ6kAAwV7zc1pk$%;*HANyy=RrD&$z3YMPXF z0`$e$LRX2=%Q;H)L2BMw`D1$yr|*O2SKXE#P-fo;RPZ&L_>xu@leMu`qY}rU=sn2n zmeg!sLc{wb@`XHnV<7ac`UB6kD&~8b323%2MKmw@c&risv>}su^Rc-00 z*ST9=_ZdVGh0}K$t7u6d#k{oA$WpbUjNZPsk z@VaMtX^uPLVO^NVynEQx@$k7cm+WNC0*e$8)O)G%_}(e z8_nt5vFCYgp)JBrZ|*Q75AP)^vF07~jwCx`84_5`J1C3-WwFR+1$C{(0K4w`Z?f~F zbnZ(VktN`5K4u{`b)g*XoE7z$c?AO^GX8Wnnq5BwS$J#n3j%x;Be3eDZzY~9d`L;| zFqd3BhD?^Jl36HG_?FgvRqgddh9B#>9=M4|Sv)5JgTCEbZ(sQE&jc`OP~N&D-x$9o z8=Gojdpg*5XngXT1xfIpwBib0sG{2Y`qo&xUAu!}t;6)7QL+88PB4xgS>`#P&v}73 zW4F@yYy-XS1g%`s-|RFD*K0uknF$AY{ng1J#x*0$3k}rC%pB%LLYt(-sK)?$u20Hi z*?cI6P%-ZBIrY=0A3K z=;tbb)iklemsvLRPAL6Pn#nM^je~gCtoaF0P7dKPxALm`1RQkE4P!_>LWJx?_zjGE zu0xXYx@YZiJ<--!p2;fYOpCMCuDJd8KJ=PtAgdSf9^Vh= ze|fR??7d2S92f`M0pmO%ME|ibY=C#}!R~t${{v^nn8z5BKdzWF8@k;pdSl$ukywF8 zP%>a0iFkWiTV~QQ+;Q28-TD4GYIa+B^z}y?c z=BUUbCAwRG^8qoUV(GGLPU)H3=U7j!#Fh}QApGt)-UAKCbqi*1s@LQ}`59WgD$ez% zH3D0+4!=h~)d3K@3n#|}c6zau+rLWMu}#@8ADUaIzMZkRL^R1wbFHPvqaS_dk)OUU z{M)+n6z1Kk`nC(Zd{x|cZ}scJs9-J5kxJ;m*4RMAz`}-jAU+TZUgv5`YCcpI1RTun zh$a~v)8qQ>^Kxo1>6=U*k9}TJJI7I@qQj4+HxwO*j9eMla&HT=Mk23VH%82D*grfY zGji4KPB9gIzd_NiQ>o)=YpVH|BkaJgx4zeT%(F>e7O6sh_T^NCd=5}%p?N3(vdf*( zJ)7Yk+y0jBzd7Jdp^nbjl{CqWmAlW#&`k(8uTZlH5Di} z>Dznqp0xW7d2LkC8@#W2mXE-%=L23fvU6$O$v>d215dBA+QY*KikY)}H4uA-)j|2# zJ?UP)nr_v;hc=;o+M7ptt(}PMQ1Kt;6f#67ziRXqwtk8?S!+)Py6SrHQrce5S}MN| z5DSgIz4kjMfOAgB;x(`lTU>#MG_*0)c5>(HUE98sZT3}}TRje&2_^0f?9^i@+hutF z3uneFo2p@?PeE6?V1Bysf-dGeh~kRG^lAsraQq#;M3ILPOU7}$$tT^S*kq*iy~yha zC{mThY4VZA%^t_f{n_vszUVl;!`3~EXU*BM6l)G?R^bvf$v7UuXFma-cSoA?Jryhl z1plJ&@(=%0s2^TujpTVgw1d#Go6i++kNK(n^?WayT|ACJCqO!{WcGs$#mp)OHXLG} zhcGgu{YO)3)mX*`C4bCC|AkY3JM)Y+G>ld=yvyEOpLKr8n4jMNpPx*d&$D}Iv+1yW zvTS3%*nXH>-FkMi=P%NlA?WeQVR7hz&eN3wc{o>B*r3Ysm|F8!uRNm&J$Xv7==n5m?pQ5yfC%MEFmz5dqXyY`#?3+M*7ho_Zj7@k03ee+3KgPFw%VAc4mk?#ER`e5Ny{5f&fN&V6 zYr|QiYg5+Ij&Cc`dcRhz`ezN< zX@P95d+Vd8k z%!!T_*{jM0>}rEs9tw%a`9nn9uky6JEnD?cPdNlvh)b<)s9V-yq z6y+5Wy03=1W>>Ryz1Fd%#FHh+KPPlnrp-|viZPO_UA3#Fw_1z=nYH#|2OH%{=~2?2 zA~g_E^ow-fOdsyNqit2I(RYsg2YO!yoxi0neeQ$r*74PpZ8ip8|33@~rdn(gGHHBE zFyFse{U`s$>T{JxC`yVw>Sts7%h|LEFa8zgJ5;vYS5$CtO>OwxqF~9Jmx+;&*>HP4 zX%O2R{owoLzf=ts|D|e(8g2Rbj_>QTN$dxUuh$N!aR0*^P!P)YNzH~L_Rjn}o0k84 z;t%|6t|fi-ifkP*Q`^d4hsXXy1+mTcOz-_4l+OP@`TuvVJYA8^{)dKHDY<_AyL(P5 z{JR}4&qK=whQGoTIXg$>AElidgvg^@7k^Q>ol7K3_2+UgKG(Q?=RfoY!cxscY`AyN zA-H)Co0Va)_7Ee}_S+pc{j2ZE$snS{>mQ?m^W98!gqOxw8-5{$3&UC;`1u35r-KmQ zD`~AunN=-fXc_f;lJ`K72}FG%xbbQHrG)kUpM~SSN#E$C5%8!NSiB7BT26)O_KLDwofDVrx&TgLf zlJg!`mYVNAFcW=|m+e5-4<6Mx{cH4I!n8b32!~dtlE}rmqxWI$pV;6(r9C}iu(;6R zAh1Yz-mYau>}9e&@Iu2hI(*pFjaccA>j{IIjL_w;1;@3oTxMX#jf0(zqw8Na;n^F+HY~PC_r# z9Z>VhuEo5==AK(kng>-;XQ-4uhceZX0yz< z>6v1s?W~>s8@mo4ek%*0UpXZ}Z>NOORlrZbWV)sVh=c8tNXPRPGH z_oIW2TouHUlwMS5@vP6CQf&XB-gCt|oiT?2RqF310Oj?+e$`q{CcD9;-#mj4nHt-l zhc8|(`hFOI`#yttUb4Wfpl#Gim-NYk}Rrhp?;dr*sea6U8d3chwS0-EBe$4 zAUG4zBQH@J=R?w_+%zpahT%i3${Q&argeOfm zU{0|>WZns*+1x$9QZm<++Oi;RTg?bvwX;o?|XaU^B8SkyO zj(&O9X|DW2Cmc7JP1S0Tmzx;1<^ z>lRJ_cKQDA{_J1h4+9r8PK^JHHbrZQ_&QyZi0bH*zYYIUc}3sY{@oJjNb)O%UWhY` z4L?oh6chQ?b#_asME-*=-uWIILp=9(K(3SO_~-N186Ztm9`lJf~Fr9~8*>FOZ{Do`dQ)Ev5`qd*nb^snx8|>|n|M>5XYhPYl)~Ve~y$x3Y46(u(pk5^Bl07`rh&iRYSqWIM~24&76Fmp%>kFDG@j$HOtzeh$DH)&Bem}{84$n48+{15>z%Xs&5}!gJy)HQ_8{I~FeP~F zeGA0PqvOO@TH;m6-gADhw*vGm4r1u8`Y;r!pb-l};p!W^?8#FhRlUwV3GKYR{;fR!SD)n)ke5#lr>M(aUGGd8H9l?(}s zqPC7kI|lQ9kP-ZDT1RKel}umr1{U;h{>&qp1!*6y^5X`*h+q>ne^Z(k2|z6v?UCFv z?Zo{Vk+)r?P8}a^Wo!+Yd9;ngNqUERjjyZD1t>k=mE`O-Yd+3rc&$ZRk8nVyX(Da7TbU7_49WG-VIo)={>31vKqi~zkW)^=K;FB$b>G{mZJvz2E zDsm`D@=*du>;pP(0?~GQiq@_=!-}`iw)}buxDP4h2<#I|77FXv9(2lwqiM6|oywTu>k#02FZ~$$=1;qIpoG6tW7@;H#-!}Z|Dq2XKoel5w#RPj zdN@~b^x@(h4fiD|r8`_O$q>nKz3fqKxdQBQU+bx$o9eLtVS zwRaaql~vy-1=}wbJ3?Qb^Jrc>Z^ZJFvOnD*E&1*3khl^2Y53 z*w&>@=r5BKtK3eNrdy6Ts^5M6>c^ooVK!mMhd-UZ5GWaF1&#UAlHU6CF`#OiM2e{K zL4;CiLb<1wNu(c9jD>i7d%aWQXAMV_RbkEuV^{g*@tR z81>3+IwIGhwG`lp2;F(S`TMH16I3*yjvN{ZSq#7Cb@I&bg{xQEd0+aim2-(I;|{x& z*R!=})?Z{N#Vz>wr4~tyf7HQ=fL+^zYMb0WgIXJApX<(d9tl7SiI0==8kLu15L)&k z;m(z(8sm>nU>#X}6SFs!WK-Shwtjmq*VTAFH2n~OLenlmSH;*_fNIurcH*utQi7iS z5=_yX^)rt&Y7pbK;k#}oZ!f&D4xzz{lUV`=}Iy7+6~>`G061WD<;3NNkTzOxyvnH4X?x~$A7CnmANOj1Fo*qecyZ4 zugB(i$C1Sfn`N6hI0E)EL)qe0jfeObxMOQ3V)ztH`I_kJi2J^NJNMY;<<8#+jdRB4^2R&?ZH*Wa0DK@ z8gwC9xvt>#{N9u=@T8Vu`D;88ePA4B#dwz|j(MZLU$#*|Qq<4ivcW`RHu9zFJ;iIt*^sC(8JA|tRcnA$J9`z;ntU-~>0zv~^0mPhXJ@N3?S)J|v=n6w|-ml5XUh%yO)M(kn#cB1W zUQ}LK)821=G^=%Mp3WFuE{NiTOqu8UxC;&N3($uG1UG7MAAA=C)d!om%t%Pbp1fU8 z+9(el{X(w}ZVJ1cFmq_r;u5^8KZi-0jQCnBe$C-dmzcFBVa4){Sjrs&g&*Ff^4?t4 zdvvf$xNhHhUF!QCru+s(H^;4`)Lpi2ZN>79^}e@xOg(zdRuhUx*Gzf~@UTRbp{C}VI1^q0S2MQ#O@nVa;Bq0^}y3I!OeBIOrH zuKo~t{LbjjqBSdW4JNhN9ZwQ8VZ9p$iXbd$G4k8@&cG5(zrumo>`JRa4qy}}&?(2B zybWDVMu+n3d1l`dG3KB7%i0)k8&_~0^N?GT9ko*dH z&u-)i?+2OLBx`-CN9`>q=ZcfZ?HA=j6EEIY4O_|IqggW?LG)j{J0-9T@fzwI-`}}N z1FH$E>bSbdi#TMV{9wFeI5UWF#3Ln+q^J4x`>vnmU>_zNq;|FUBXF=4l&?AFs1+_+ z0ul0Ro%ASd*V^Kf1~$Wz?#V9+50^?oK3pMTBn-CUnT2-i`~@*#cVN zNyZ5J5`G?-e+#`cgWitC+do_2F;aVVaR|v2)t0{V4O?p8d|?XCv@*md-}eU4JAGiR zijo(M3?ZiR3)|istz_ZW?owe5?@6zaZZEITd{p`w-nORo0zSIG@VYd0AI)MPgfT7| z3ERGli;sdNt*pX+roxLxVU!!!5(}ejX+lp5~0B=e)lI$`_nfQeeK3Qhyp#R?oc`I#Lz1CTyA#deC=;&hg z-Uyceu9c>1VP5FRo~cqVivMU_$g;lEeoDs*1~8bD7U3z=zPpYq>Z9y_ z?Zag0D0yqo$Ld#&QGii(TrRBFXD%5lGjmUXfD-IWgcPyYSaXjWTR3Cds2aB0J~X+L z^tSej8@0|{x0dImdX)L^`I%|p{wkEauS-y9(dVyzc;-|d zA>$ZWmQ#Sxo8?Dt-WgG|Nmt$q6?A`AQR~M!}hzw>L+1*aZ^=(8FSC-}EBK`BXK z%Un6Z?Z|bn;^Jc)Ii*6=)M@@fj3)8a=u)OzhJ(gjWu)`rV(&)?l56-=lA2zG+C;+! zO)q#2JR<=UcE1PG30upwU30z1Fl~;N%s+noTeR=^@I|EB%F3?71KYvotEGkl)o{DK zDFNEm?ejqlDk_huVat~26afe#eV!7}-+Ynz2Ob0=HCA=G8Vv{%l5y$PNkQbg2g8qWtdy)F*_z2u;&<~6DLF9;G)emyjeLDt)ZsRSp(uO({P?$ikcmgG@z z#K4<@!TRU9Jz6Tv1bpo+J*Kz{43g2GjqYWXIgM)KjDuthQOkmav)Q4o$RSLBVX}^C z3c>(#_>945!h-bfaTC@JVt(-k6t1~8HFEv1)*pKF=G-n7&@wCA5_oXYm_=V`Uk<;L zwUubxEgLG~CidN9I^Tw8(ZS$^T#OV>Xd7cv6Kbly=7w}OH>7%8r>6LBB{$176Nk8b zK{r7|dzd}c!@eE2$fACsxt=n9^U(bDSD{|;bgLNs8Ll;*-N8iscJT|X7CHoIwtRYNUPT+BA~=t#tck`^mD zsm#6kd}o;q(V;gOk9W;Gbviai+>mX&M-e&8Q{0B#4i6|lIMg?R<=(aKY9+F))px8{ z6AFNJFs3k3e0yK5w^pr)so3N$p378&sBZ=FOV}MTZZ0%iddk~%bV%~E;TLwda%8Mwh;SxV9pxn-Lo2gm(U;t~r}dfj-|M(*!T>NKZgLE81!|E}TSS@wF? z{k#41wf}J7y^9TvdbLk+k^G^57Esqrd9T$Ofj)LL|9M(;FEAu}#JPW+ z3@VlR6eK>lyjuCy2{PaG4Yz$l#VhZ z+d&pf(GRq|X9j|}P_RuXBicF2PyB4?_;d_pRUh{;HtS<{ z?YKa_>YLC2tiK)^@l8aqG@A9HIx9%c4cv}-gVB%rpa_y+yw{mCy8H+kyv!Qfhk>2ty2PD{2U^{k9;EuYeCUkDuV~U2sD- zD~9cGEqAv)VOelewxXKKDf>#DpeZ#;bDB890P34x55hN@o>hP54V}i@$*>-w`K3ufzBVgW)b8ousCzGg#Utrp}{4 z6Q@>VhNd*_CXvH!xr1iFwi%?bpCmV4!T~lGc*GN8N2t5t6*r~ED^gK^s@rLg*!1M* z@ZyVs8y}2S5x?D-KC?s8Xxk=h3bS$RxdAYa8K_*PE?wbRp2r%KkKrRJ*qxeO#bKw_&LOGwIn2*OX0>YqSPon;CAJEY+ z3^C50Q|MAE)r|WE^ki2uq zV6j|W_?y0oG<&o=1{Of|#jY*q@(^`5F(0s@@8GSFD)Mz<>uii4Rf>J)(irR$n={2N z*ix_=D`9E|Ygt05h^xHj zTrMq8$Pk4fH~DncUdr08HeM7Yuq;h!19egbigFYsug)P@-=t)dqeu2tBfKh%B3pU@ z7BL*OH!@nl-yojlAHMp1eZwZKy?h8GJ*5kw8L20d>R>|-$u(_=fQ~YJjjFXgjn8=E z?Nb!2eg_nQ49M07q5tp~4n1l=4cdLDS{N4a=Pq@QRI|4hm`s`&T5uj>UBTr~K{Yq0 zl%#8w4ZCLiM#Vl5KKSmIBpJz%1v^T!o2T^M#e^?SJ@_Nc+;=Oaw!7w_6F4(;{f7X- zf_bU*F8NppN&;H65>Lt;y1lC~?9l|b&0O7?W)SuQj0Hp4cldKkS-bAqOcqwGsC(cEL$bkH@B4>_KfzY zl71f)lwQC__%SHIT(NN|B305S+!?g|Osd>zSrfMhrMy8B9F2?}2QZE zo(*3qpy-Ir-a<1<5A8jdpHvasNrM;o{kF6bMmKGx?Jn7Cy;lhyJBU3(4AwPD9pZ)6 zDr-{5iO0eY;#^rD$W7{Qz%C}P54i>qlkr$+EG4�JbSn9MwZ$Keq)dUgZ|6 zz5nO6YI6$74&bL%rkuYWwhb`%s(n=!{e~RT@A<}d9ywvIWacIC-V+C|>m%1F*k|Jza z|5yAKI}yULr;NBQsZLPR4dC$U1$m%!(f%M$aVe7c_hDeQY>0(itBjh+<0+JMl`H<|u&SLKD91 zA?CA!e}|oByI2@>dS><5A1|810~c6%Dzg)f5U)~TufDL&VECd(nSO}4A!z5%18bhe zrcM#pLNKx3<`*=!x_2%)z?)hh94yqfS82sIn{sYcQ{rH@{DWJa?}jJLf^jS>Ec#5X z&aWB9AaSW@)P(Pz$=Ae5Q>7*`CbEtPYG%Upa53!4Ou?TTN2y^M6et3a z+%KulDv?4O!xF|bO>YQ@x#hS;XDw5|H@Jie6T zPKpuLxHLtBL+-9jw^(7;ACR2TTm7&*U@^v-Ew7K?Zhq?STJ+IWT1j~JG_;H!h{Oq1k)JyIQ}?dk>izQ20Nf%Tygb=;mrC%PEE&?6R*xY&A^D5-SsQtK z_McUU#0i-N9?haMxcleiA}mm_Xmb=u`h9BXRzp)tH8P0&c70Xzit>K8*c&(9u)i;U zI`iiZ50=2`%8?^%0god|O2ZI3TG?`x4dWBcd@(*b!xuBj7lTLjYgkl|VCQE`57*GW z?;EXI57EsL<|wwd??7^WDp+vYJhU~#>Vv#CF&*O9T;V`vFzY_OO0t$ee%g^-_Co*kEj zeRLx4p=tFqNJrux%Xea?*29Z#;2g#K`)&=^+%90~x2-h*AKQF$@qn_z_jV1yH z6NhDk2U+<5*1kaFu6Oq_yV8PPRmIbfa79v~28L%lXI{fl5a0Ys#aoZ$<5;oFP0=0u z4%9ptG8K5umUgz-4}^L5AG2$ER+k9banc3Xbe^^{lB{HO*PvxK3TX{-{)em!%fCG8 zn&rCK1FbNwljF#_lZCp>TVIe8%4O8mHu>z4_##w?ZI>fekb;B}WqIWG{TacBKx!2O zx$LI(n;j(t6_(mlmhK*de`RKER=vj}`@p(G%#@3oqeTxp6B+;w?Y@u_AGOALLEaB^ zPUEtz7blEscBsno8fTj}g38l=jv#FObTcY{ymxkeZzeez0^6**HrTv4j46~C+fu6( z+pJVY8o(Humbwi=>VOk2QqmFF>qe(0Y3<#~2yHNsNncZoA{~c;-K@SXD|~-`V$G&p z{c@Aj+A`K}cyA`_Vy=*N$n)TqVE%hE$dMJD*axj(AF7AeA_3o4H1!2Ie`C;5@7OVEZ#5E5<3k?@gkN{5``(3$MK z2xx=A*O{rLSh$P#y}D=K(+Kl=fG$vNM4YC-Mzz+9nlA#ZG*RrD^CHs^ZF9paWuW>z z85+gnXx-iYErgbCdSkxpBd*stZ{tk<*nm@JW|MBR53q4%4`&}%hmKxYZ`)d&fmMxQ z1*Q5^t$K`_eT3lL(Ynzl6sq8^ z&3;=#--K9d)am}^({(Q9yLvh(^Gs1}j2Tdk9P$Bd$dt*xRbtUx)> zgcbbOi7zIi({dJNHXs4Q&uWni@+7Ajdg1pWuIXk+SnK#|H-tO^N7jfl>vmOfGgTGxGfV+?{s@SXB-zX)2^=Ne1` z`}Xg~PdOG(`;ZoA3_)4pv1&GaY)@}SdmI+XS8 z>LA2DWt%EaXk0)S)(`=N(s4je8t+T1UGqUi2oef6(KG&f!B_>yqVlk{_)k)0ff{c5 zCHQ2`7yYRA-^uR})dF98pqnuKhzB^jx{NB}tfo@O;8l49ZhC@57Pa$-p4$t00bX#G z8uv32<2>EB#2lLm3dX%O-02hFnq1i%6Aqu0b2R8A-~`|#@&GevSE4qC zTlML__%~bqXyDIpodcRbZ;x@GedTaL=M7rYWf1tA`^e9aN)mMM*mttd`weT@x}Fq3n7 zD=={5bE%9g4Qi#;IHvQrAU?y*?Kid|Is3ZSW4Y^IEdtCWG%^S^)$6Bf3m0#mYac?t zK%E|8Z_Cx~UXvt#(~o-^{J;*g<|HY*>&%m}Xyz8dzLavv3Tq$cY*2$ua}c?6Fx zx=UndP}-Hkx((TOc~Z~h%%2-n;0*LbSs`;;$l4&JxxC4N1~&wyi8l>K>4V?N5Ls0J zi8k96SG^v<(8rn^e1Xa0<O>rFH|jg^V?if=A4ArFwp$9i5^@ z?7W+&kW76SeU=_O^(RD)rM~`HCns$Hg}em8L3bhSmS8Kp@c5VE93Qhx&RNV-M41R; z+|+Af;3)$sH^<6;y$sa==BXB%BaJ8e(Mw_DT$pT`Me2F?&ncY=XuwT3B-;r(vV_0{ zCinxPbDVaBmkJF#FBb?yo|DB3t~`mCrGNZh*eqJKVU3J3jcnDbdqPn1#BH^!GT&JD z!#iM~nKt_LE+Wv%e5OlHnpppolut16q$oXQ|JU-8CZC688k5K?CH6_KZvN)u)841U zLVewE-=Zxr7)orz=b_kVk2`0Wr+vz&VN~JOGQFQ)w)+RzH9roTl_F;Mt%{N5FZ=_s zza9Z6tcOwJ*e8iJvr)1tcmsyS-=d>EngH*En>Od!ElC0T&DM%qwj~c}o~uKW zA@f8!CD8H?y>dq1s)l{g50}ciXSLSFS|4seZ$%s(k`TWIve@+vFx&k-5F|~9X62$= z#rbQ1x}#-xViEq&aQ3nAf~o2dZA)119u|U!AsD|;;|qMWE>47NP`7|=qx@3YdOfR{ zQB83<2oBNtv#*=V@?n(I_7bV~pLgYjl3-c)P!{Ci6A;*jGd-E)D4QH}u}vn2xuuCJ zdA+@Mu~$ri2KrI3GyA7y0BD+86ZbiWUr}iNET^tVFVVT|m0x>{QFvqoS*;y3weaZ+ z<|M&5>gn#1&6tbM$E?{`=0Bz-8bAND5oVlw63rOfgEahawtvZ_3MyXsge{6UnQ zT^@_v6f|S(p}{&E2AA0QAWeQBhNHGQf5>f`vM`Y>B&YP7Y1eqZ%GM&pMgn z1k2Z8Yh5$!PhefA{&-1UNM#b@!*D^`y4=kZL(-iyCj?^WnfBWZrVtT2^tjlslaBPg ze|qT8h2#U(KPXaf2lec=LK2<^q+QfS3IjGK+;9GF=bzVry1Z0vdD zo(SZ+@-VaPgL`DsL}WJbf^e)p2$gpEZXv3t&*Tdy8G|AMu?R0;8cq_LtEG@8UON|s zO~|ga3TDDKMt`C%e=}7d?mJr2T;i1%VhccL0^QVCI%*1LrUEse8w3r(7~ugBoEa<5 zN=r?QtUaMs0p*{K&TiKp90Ot28v4RVS&fy*h|h ztjS6mNO(hWz5X@mHr=X-VBD$5SIO~cA<+i~NqiM8g@dBd&#$xefNqIIzpHOFF59ym z+E|Gvy%L=>!Z3SAs<@p^?&{gE_d*}oyA=9j{U*&ooIzjhv5OxIl z)`$bP>#)3np^b9rF(nTihpp}ouMrP2Avl=vp}*B9$t=(U^bJtLpnLSM7!$JH zL;o-K-ZHF?uKUwOf(Do1?hqijyG!sukO0BmA@~UvT!Op1y96h=TOddvxCeJQr;Fry zrQiQG(_f~iyJwy+hl@H@d+*w3)t0sH->M79E@TRl2dP>I0rSv2wjVxZ;}&lM;tpO7 zpMZFD=7(M}01??l^;XzP##i7A8j7A% zExbsxOK1A7>lX?#)eSv}UNSR?BW@nKMI&qncqy!?mF>7Z8KaZnGTd44QBU5(E@axx zi^w4YG^=_?B@u-WvBBR%SBn5mdm24N?*K9J_6=D<(8etjYF?9T?>SFq=i>&vh{whw z)rts)-^v=*O6U4xIH7bKsQ;dhD*#O4PZ-SW**@~{Xe?Y|vC~pbpler1HP3hjw$>ex zJvzGyXG=A;9VU#35%x25?LxJzAO4Ah&|UFbI{*{QByRsBQLUr-HxHy?(xc5Op~Yjb zOM9=3a5O0z>sR7BhS0OnJk)K2(ylwM7|Vt{tkvfX1D`GA z^Z)#0v#jl^|6j``dDg^jiYhG|^STt)Zm>V&&EEz6m%jhIkN#KM(dBsOK7We7O;c3K zj2U35Blw~u4iY`B;@f0L#>LHqvaO{oD#Nd84lJ3ac%DHmFweb|C!lo`swmj~#NK?T z0}MvK+9i!qHLDRMc;??)@a0UW_+OROGSBY)TMOQK zFl+p)l7$!hF8|ho%C;Ab|Ek31x$BpIwLn%&|L@!UfBV<;vpGl}P$YS4WWXXiLvC6F z>-yUsp~ydLNB{mA35p(fYGhhX5eXH9Z?e!Z`bqH|%Dypw`~(|2m1Mn2sQguy0b4CgT}Ms+(EZGVVb=Hai>Y|m#>hD0xSF`{wGcGN zTak6e!n3Md)T1dSv7f0YpRH+Q8}ua3pc3BRN@5L^g5$*_;-9lO+||7vA>JXEx)qLp zvG?Sjz4)>V3XzNu*}A2Y;6}&3BMv{E7XqeY>j$-@X`(R<=^+%>okaJqdwX#QU z|9z97pld$4>_$+plnh$%`^f8PcgSExFBjphI?vNQJ+cj2f8wzEU2 zDXJSC#eHnkbKCrr-plo`u9N%eJw)y(3xYgkL$1+%ZTjz%+5~&=i|T{iA>$%;+MPdZVpsAu-!QIp z-n!}{jNbrjeq;n{^qkY{;3!h8sGIxn#UK;q1W~#Ld`zC_gbXVZ0?Hd*XXzS zrOW&+&Ms@=B3+v$mWrwe56()@dqg!8mT+KUOTq|7Lx;&)BWV};LL=608MpB6Y8cpy zgrzIuLAJ7%n2v)IEs-_RhcD1aM6+OxCb)m3^uOdsi$M;@5e^;Bs{7HXA<|LGpa;ue z4>mT|0EKum5-7k;F|2?#9(h(k_pOST}~sTEzCGA3VvtuF`2u2Hb72abz;($sK4++Im7 zmM_4QtB0=P1fe9ireXTDb)iEZ+AvD#U&~bx@0Ms&-Jbsi4}gul8X!^HEY};;KTq(iW>{b`|zux4bVj= zKFGqMD_|^zQx(O;>N0h#k(b3K&Nrnsyx;+ZU9#f=Td2up#(S} z6xu$t5sMw;Nw@uxX{;nHG54KNF>s?WBhYI#dikN<)_f5~S37&U6ZgEakCNa)u%8j}OW2U2G2+KCi z6E?p*Wkn|bnhl*LI(=b~v|ZG}Z(DJD2$-r$cnRFdNA$P7oh~u7EajADG4dr`SuX+a zgot3$1(NaWVyIO^JtFJT+}r{&#-cgzFHfq3+{ZmH?Tbz;M8IXy^LZ(dj2&U4hdQD@ zCbfFb+l&p|e?#=N+qVmRWzmI>Zx>-XnoEhA?_@Pr6#gfS2RztRfnu<}UF3o$=7ioc zsr7TS@Dn~ckg+)2BZjeEZxq*W_#n&NN3<^koG~Z&?5nn^iiwZ&rj0H4SYtTCqO2&$ zh^9UF$qE)Bvag(n#D~A*ob3?{E~HHOJEse7O{BDB=+%ukTEnTxbgb0oW?27(jK=6B zi3l*7qrn%_#Y5RH_3t4Y#V68VE}sM)Od&rP2`>=6-LxeYX>f^lpBHZAoHXRI;?PTeCiVtC&MiU5PzK-~>zzXW^~02dtTdYR^f=>fhi zj}DvAxe4D`$V}KdTdbhpIJ#A%JccZy@=%LkO|A^LIkR$G9Iabs*G_tjfthKQQ+__K zy0AUT*I*YSouTov^HW$DT~n#nSAp?Fa43uicX?(pEnvxpByl;-BE}z$*r}0d3v)u% z!|xP^O_GwtKe!1q2b@KmQGwsI{&bW6)D~N?v>!&ZNcJWA$|E!)yZ|_(V;6*j5-Jk` zVgsvBlw`Uta}TO43^&8#JgqA3?yxqhDv+Ee@PmFGdY?Yz7|IH+11ou84K+KV^NZ;8 zp~Bd|DT?y9Uv2#{fGqD6jC*Ww8_jhcRWg~8VXxf|8aHqtK^@$vcU8P+(_rxXbmG8;IT1HQgLWs9*@lKHN)kmD|K0Sx9(tH>NNz^iVy8S%92wy@dM zd>^d{d-{-|((KOJJ}`^cN3{OrH~jr!Q4g%jiP&*_?`59G?}6bfu&M6Ag<^f4K~lHf zmKP)^^s03iHOgRpcm2GVeU%zak&dqaIcmu4hd7*`?P%LshWW!=V{|fE*0{^VwU^(O z=spMX1?9*2f9K~L&f;)hk_^8r0DHe_^FT|yuB-H_=UCU7rciMeKL0Efh>VV?7V=F_ zXvO|J6c%rQ=(pQZnfNNlkeehom}jAgxFw{=JT_1^<`~8NS+{?@$6AX>7}S&+`JQd7 z)zH-$V%huN+f+bgjbhQjl1?-xMCJ4Tsqa_#E;o3;(({yP3lL$j1*jkcN{mums&wEU zl?ZBy;92Ro`CtC)g#Y;!Y4%?Y0N(zGvkT^;#Ybhh&H)Tr|B{r&>H5ujpagyqzEF!q>XVf_)^}m+L4eh%}saj{=azW#qwg zK?i+o>)&le%e`&pjES4!5a?jc=x;Y#fa-)S=4V7~g69G05r#=;Xy68eA z5J5Hkl(m1=9V}~KUHKj=gL-6crR=FLqX#i}jKzQAiD4g6QQ=?7nk+1Ox#HKA2QfYK zz@k{pdItNMiHCCCK&lHSuu*~?3}&Q=y&;#?o};`Y>j^0S5xfH0HgL^Yh7d$&ge}G? zL2FC(uhuMCNVO_{QZF#+^Q@$uD;{Ytg8sU%2%kco#1T#17GW@eBW;X>56PKf6e=p9 zP7R|e`pLC%m`uE7Ane?FCgIuD&=MQJYq0mVAkJCdfR1r+z`4_-5*-p>kU(f zzfPt*znyu=*(E%WpF|)zQB!fBmdXgW^1u-aCL{#pTYS?P@B(Jfr>jp3!#ieuuQ>y- zvL~VHE(`6H1o_yS=qc{zGECo$qrhL!-lCoH@mysQiqk`yyFwUP=0_Q}r1@Vg*W!Ds zezGvxl&ZZz85C0-hGNsOq7AoCe>$(|i2FL_)Evy}A?3yBRlg%^82It_@#apZHnT@+XjRk#LEiKw5=PiXylS!LP1Z4R_ zGW7y+dJ?TB2Q8ahXY;Xqg>~d}sV%B9J&0#+M%6MljbJ2P3a{MI4OJPIwK?~9v!(rj zUV6|gjTam+e*}I;4+MlIOJe!oY+vs2e|bTLCz}6PaOCdC5WnnFsE$tz{;^0vPHi&a z5~2f)1QL3k3L_-C@bt{EAy<`oS-FBZ8n~? zyk}BVlJ^=OA{C^s0}}T6za*;JN-$-E0Z3FSMPxvcmuc?7v`3rn>k;LU<@scbrl5(H zi_1wo%1|&a&ZxN*?ZFTO_IW;$GW&dlmdkC@)Ery0-6Oe8rO3Qr)Dde@g|WltU0vxU zK^U6=7i_2spaWiWJ+S`(Tkv9!U1b+VRoG6x*B})xix+1Zg6Qx;z1vJ^5aXzd1PBS| zc(~+Siy~+E4XH?-F#rSyu&p(EDDWfC6yX*e?kWy276g^N`;M&zo_sadV*)jS$4>9^ ziCB3^anw8PX%v2%WXK2+fB&(Ce|S3?K#F;KZ7&EqiUdaDVz#%OlL}!jRk}bG+CUYS zH;>PC2L$~9|1p+U&drEqYXr*~+~o8S=SwUi_UQwHNKrw=Q%bkcXB&#OT_*g2ZL^qi z>o28WoA5&q#VN<-KePaXOToas#d3XjjvRiJUsF-?tdWxB$R)+npZTnAco4xM9 zE>5!&%fS_Et@D?7D(rD5Hk*w-=QQIaq#H>xzHf4_wdO1MV}nfUtPS#C_lC&N=lNJ~ z-WY{-sjw@)z-5Yg8aggQ&g>+m6{C`x5oU=AV(w6x z;wbyyLbfOA4d9IsRd(@IoC4FsVBz5r2f*h-RFfZW#*YdmgBz}PPp^`x6aENn%65%EH@2tZ|`DajojyV)$r@5q7}Rzwcin(Ct(k84(*L_hMsi%Zn4xk&uU(#uiT zGQg<;j`lsPyEuY?vo6lzI;VT%HQlh^N3uQVfB*QZHW6-9yktj&jK?q;WUB zztZ7RE$o_p_y!-Y8S(gkv`GTF#z^)&OOG>FfP-+e)m@U5Ip zz3;RZ6~*@ukj?R)xy9V zTyDu7GRPxlm43v(q`2q0u9w?g>HV{CZ|qGl^j;d{$-B zLG$BQ(iUO%wgR0hhy})0-+7P}v!61liDTxTb89-CnahvfU@5nMVqhUxW8Ib(Rsq{> zL&pl3CqqCU#hZx~JvwsrA`u?|#l&1uBK%t`m?wr)3LCZ>u;bUrzc!hgkieL_5-*}QPu_9UBTX{n!m_HaNshr{!1738_OC74ZgGxr5D^=cRR0r6 z1MJnZ8h6Q$)SGqz#CILAK!f_c-^Ta!fgbfym}wasR%O%Y;L-X@7~%Wyg|g3KfMtg3 zT>cHx*+*x|X<(5HmE+fE?N(xRln zR*{OT&n~AF&BcCW`(DM-vO}@ZM3_F7K)Zh$ho807p3T`5CbQ1eOpZ@`cs|svgVQ$i zZh{3rJXEvZ_#oNtT*^kiUH-8b0k^gU^o_(@frWr*pGbJr@>WM|-yhjhuw%VYSk>1f zj=_&>HZ;itpS&w(0SR~79TTD?_(bh|{aU=QTk5i?&?klv5CNvc6y+s1e#ogli4*Ey zRRV>b@;q@=rZ&3*u6GJjJy6e|z*6Ifg09}1k&3*TOdtsJbc&#Zn^aM!1`bN~Q}OKm z2FQvLoy+|EN0u}spzG{Vw~W^G*m3?xV>eJs)ZB7X?W1$%qC6n>ua9%m9P`e3>nIK# zvw(&>%@QK~DGc|>Bln#z^V^{Q&YGa-mbve82kGqWJi9pUuzz_&;`7XX(B!@1;}=b7 zgfQLx1jZT^+J1f(j7-z2(4FL($9)G*Pgzn!u^1LGcnKMN735OMKMxANGA<@$nK!vZ z)f_uCqi7@z<{646zBOw5VMVE|oU$Gj*t%<9+ZIMIpJL0|0Mu&O z72Xl+U6yc!cc(?``+<3U!UmTqpopi33GXTRf{yR27jjw@B}&KrM3&Y(k)=3KquSGh zI0E~L3~zs`Xkb2uh^wEhw~p@BpD&qaZdwOcfc!3BX{wBc4_q>EcE*1#)w}pUUEX^H zn()!5JJ0gwzjt{z6(vaSLs-N0Nt!wS@Puhm=);>mka1gXhL-I}JrCR)tvBZZk#s+t z6Sn$u?oN=TX!94o25-lje`lz$A*u^07hD^E_C-|_t-_{B?oLhvyqp4PlH28ND+Ir? zyqUW*mJ-lHSi`iT+gc#l8=Kf0Orx`JZ%ND9&Lxg^E+xf2Q^Cu~^KJ(TPySiHdq?Br zt2{t$oI<@D^}Vqe_!EEWkU>GA_Z>ZT|H!h954s5&$i+AYoq`8Ioi|iZ zPgv+q^f4wu(*%B%m!K$KU1ZxSctknpFO==_tuw1I==!@C$fr?tK2Gk`bP{4BC1Ai2 zY2kb3t33`H2lCyh5j@RxMg^v&-5ZK~Y_I2Tl>x*aNKo4uZuTG;TiG*gBB zNMRtZ2`U=;`MkWqBIrHh^a}kt@On{boLYKZwsdRy+*TwJf=oo~tx5 zBAOs*Ha>b3=Oy+Qw71!>tEjoC8ybt(?ub01xaCO#HesV7Xoo^;fm1akV(^V&>-zeJjMsWp_y z@6qlyGw)7;U*ZrqT7Z7^a~PH^Y81F&yDY!BumHV4MgsyEb{hoM*{@FrRM;R^*hlf( z>E|r62H<@-_HT@iTYUN{?nUGyn>Lvcnx*he$a4J>i-7KftCYa0MHG}*eN&R(*;e8k z`H{mcNE)DpbRjT4W1D^B2(~`t2Er8nU&SV%cZdpV){#C4%bLS7^=^b(6#uN@nD~Z6 zcG@SM@0dC`kS|EYXFeuVctNu|qykRYUYhQ6l4>w}wmV7x$`jrPrNLr&_$w7o;Wvc& zto?LrdEs&0krU0=&&aHs;n&UTuKh8$(4Wb`GS-CO+$Vn0jK8N?r^XVlXGwhO);D7x ziGqk1b#fuM!v5cr^G|x89$i7m>2{#Gq9Dk->V(RwJK|~jTP-E9IL~$#1hsqspae3i za!07&UcJ5t*huVCaE^p{8)(Q~ZX)u{5ilcmAneY>*wxsci@T%iB(NMA*gdZA7;rJi zsi(H{98FcC%A85E8pW9;O<<(xJp26O`kEDR3hxz-gt^6cwVcDv}k$ zbTht7^GMSEO!;g{t#`=`5D+8@VY7AL$V)f!Udw7f=wM?yl%(7*A|0BqFbCIs1? zaO%wjz{sZB7XYb+GD>|vR89-r$M!HjirxY}MRWc8&gDD-7~tH!LswXbF|}U|aow0s zik65|njd=XZ5+mW%Gv0U^mwY#u-=_)Y56Bs9LMb$69&+@+tMDcB~5|Q4H@hr?okJt z5B}Ouoev-(X9nac0*?5flW>mie53FBvkOd!wqzc*c*ekuYJ~FhWB}}4xeNH)fr#Lf zC*6$OAke^*qZuWN;>YIzh{@17+$lhZ06PeT zd!;@4ANuuJLLd({;(>+wEYFg;-A4oA>Qos_{XJoP37o^t*hG=zB+e<}Alk*I^nEq+ zW~{!>cK2Bkz%X<2h{VJ-6F77k2j&``%~(|N*F-<%)=?s`&vI7p2MR8P6tSZ1X93dW zOuEGu?L>ZycMCm$EHZ%2!1dTK|L~AzYnB?`Al>N!fj#6bSbT&n`o$NVVaz)Z@Yw*8B{m;zfcRqox8thS{z+-l4_M-W^;y zv(6)@R7e()SF#mtJLja4p|SDy{f+PbO(y?;o8C^zR|-34Ut?R?Hq{;#Nj$RX2f&LB zQ}MbY?{=Ig7CuRvKqCe8%{A7()m2fdFM=^5CXwwUK(hzpEfoK1L-W^7tA(ec9;E#S z-88sl*BM^aZhL^gvKC|>{2U2bWNjx%6n@^ys*|&F3}K`m{zx~ur{cHVD_N9#5OzDH z-T|lwbc+y6m zk2~Q4+e50AnA0Ql+m7I>=eWn}??ti4enb9`%UgjWAW>I~;?Rqvgi&A?lv8m_II{2z z;gfo@LNpT~_Fz^zDx$k4^u!S-P5#A^ADUUec(P5>)U8CJ#l1qqtuIPx2Ud3D+O$0$ zg&vrncSW?Fgo9ijqfvSjQY<F|7`SXQxM+0zE2$N{7Z_3?IiAGpPj6ISv`>0l&o`Sw*6 z)XYy>q$gDPAw;Ah$O1Hnn+w?+{P;O{&Z_KgcmcSODG(n-|H5N5q4)_=V!ez5Tu4nn zS;S<7JVgUEl)SisGKf*R6TP1lTr##4cUi6gi#qigno6qTo91Ogod;a9CL(ufO?32c zmt7;qMzkwHKe?C`%b;7t3|mfY;~J*sb@#^t-vhj1@U{Bnuh%0g9$eAy!@P}nZ;Z5(=X>v%Nw;|Yn$D1CYyvOYco21dzcBF;ce*I#DZsUH+<9})3I=aX#d!kzjGw2X(cy0{A7Pi;93IE{ zFD38qHxz(eAx!n98LRv^Euv_l{lIQ4y`Bh2wpRhG%FdUjIppl?9slO6e68jAP@~h! zv2*j4H}fO7idozZCO;=dk$QhVCpuBe?G!NuoD8&R`fX$LD=x1qkXMO24)t`;VND(#4jEaB21>on=U3#&Vhe|iMd*2V6nHv32~os%w{{K z8D-O6TNvi*$>#YRej?PcQ%9NIBt=z>e{QLPF{%O>KV>`!2&((;;3 zCC-cUl`2cVs@N+DRK_L-cq^x9c-rA0PDVttVzDjmKGD~|rn)3sVx-~zZp7a`@ozS< z>12LfRyJW-T3fDxkVD6u_GCS=iuD|y*(>N47v4_it;FoR0*3ifVLdwMi~<g*o zPy-Muakj*DVE)r0S6C^bIs|TphF8zMIH1d54=g-@AB)V4SK)$%0Vyy zo;n4<jzN&{}dQ9yDIO&0l^F9zI@|6|x)K0<`p4=G?Hcgr0f6>-A) zpWHD!?Tue|B>g`r`VDlcE}7rD>ZQ{py2UBg@y7OfpEA`CkcCr}s3KT&Vagv)BNcny z=)Nla;DCW;rt>Ty<6ni>UH#a_wBD^t(vj2HsEyj<9Z?O8@S80QoB<9C(Pn+!)HBxu z{L7rr$-mIW|oy5#eL~ZAie6zH>-DFE~VPTZ5DFNYGM!pM*aT+s}J|YZOqOkoJteq z_J;-WzYOEKGrjH&Qd0AQX<<`xHeRhQcCza#A}K>r6)^#2v>Z+%$rL^vv9 zId9Ua2OLJ$7FC)Tnc>&8KSjWMb1tXoEDCjvKNy7qX_r24n2!td_?$1{72+M$Ixj|o zMW%8*Csa! zP_9l#8XVfp&Nr5PING2FF!~<628tcZQD-~jxfQ_cp>M1%qSVK3Bx(Rqf1=GEbgSp; z^evF)Bkl)s&v6p~&3Bzm{fuN`@(s%n zPs`bAYzOZ$`etLNWqH252LA+=_9<(M6|Bz&I}dg}fovmgnHBgSq3QczB32Z_6WIR1 zJUIf({rZOOy8p!PLrw=)PE)Hx!jk_${ZAPOp5kE!JmUDAKM_!RB-{$S5lZB&U)!F% zd<{t(TWZ_9)e@P~caoHgp*P)S-3Ff?$E!~$;`u;=`I8ht)+34Rnz9*9DR5l~B`Y2P zaSvqP^G0dt^d23%0#LT=*m#k2qlI{7?4u7V1OU?C_AE&{Zm1UWWt95^9aC}-!fucl zo@C02@V1ksBz1C&35BT*@~sP6=HaM$H=k1G*$$AKcFW;XhUC^0aJg3cb&jb4ue(YY z+Zyf8zPMwB%@6c04Pkj_d@bjxE`7^SehEjn&YHpe)KB}!>~l-*(-9nngs;q=TS-5S zpp(wTk@;4{`6pk0rxPq@=)DP0>Z#qQSF$}6mh0#GD-8pn)LQ*1N+ks>=m13YNmKsG z-yL$ss(z`f;Xz^zoVtpkfJFE8ejt-`3b09+Tl3or3OV(>Yh9@BBhOjCY^@g_yovKNd<=!VDzm;%5}T&?>qM&q_Psg#(;2W0nU zH<|4+J}$&!Kq=T3%=!!JI%M=N1AMbQsFC_vmzpj^1Np=YJvz1z)}Jb;vzU>ft7reH z2Il2Pf28J=U6?C~L%nQBP_ol-ONz0njm*-}A*3|vK4KJs%IS*cEBrVBB;{t9NfrTb3;>>mF0KW$Sdu@_Li&F% zW_fuh4v5<6+Fj?88vWmkLJ|^oype3ah1$zW7M(Jfm=5VDK5!7o;qsqW3a4rmCLBJf zQ)Z+XAsl!Ey4#)c^b*&Yg97WK;nM`=|9jZK{YwE0>l2@^1HVN81RBcRx{o4I=9*fM z&=LXkR(N^F+1#~8V|RQU?=jk+;xq(6lR<>4rRF3}sO%ct5&Tk5f~Dw=j^FVJ!MDxk zh>sghFDq?C#iQwZQWyisvcGxCsstZS(}wsw9H(DKc&{~d>|;n%_zGj_8oXXFT?~{ zA%$ER7vJ*V`roFuhy!APgrRdAG1mryZHmw*F#yk4dNYdF1C*9|W@#bfspih>{FlJe z+8gkK5HUVZzY>;Ch-<=#LekF@I$)t?z-ZB2p8EbYmmzvv|Tvf}Begy;QnwH31 zpWAKhBjrW-;NEp(@}=}&5<8B;>!^Roqwv#UcoeVO?w`N8ElzF+=W3ZxegMTyuO~QZ z`&%;bPj+iM8*}1GGw@f`=6?Tv{;>UezC{kXOS>quzV|%(p=L&1*wxJQDyj{2^w+N+ zTm?%nRx*{q7X*7@kPN!>1wpzmM~%8gu=;XL3rSNqK&BBuM{oeuh8p`{R?m+Y|q5VPNR|iu?%i_LmfvmxoyH)RVvKa}|JB-k9g_7IF zmR^igj!Nj5KWYTny+>C{xP117o$B0ZZ_XBR?QkVvO#T8^P~YV%_g_BxL`zQaig;`%vqrlDeH=z1SXE_pa+5|&6x z;>DG(cap@KPHK1!rYVil#nL6z8ewN32k`M?12$-Bn;Q`4_MUcvj;eE~tmKVFY_h7k z-nT2?2f`r0#nyWW6M#EU4B*p9MfBb89*gD;JRx$&pjxWJYtRV1;8Dk5c_HT&x$t}I z9?z^RBser=YRhwP_WaJyM0CvgJdG|sI48$miLI>QOC(z?9NFpZTa(Ev%y0C#_4Qp~ zg0;yj(m6UDUiz5)vGbwqBdStWMhi>7M~qb{s!E(O<1r>M?t)cbxb;XAkL*G`{G4 zA&`Z#2#HAzLR5HJE^NvF>1^waF5&E`A(F1V>%AY8wyZG0RdC1E=*%-x;3mY#=6K1U zchN~O-Vx|FO}RvrN&AaC!ZXCSF;^Gc1R<{>?R>6PVSk|(qsFmp1S38duAv_jl1-9b z%E=N5fxp<%Lm@h1caIv6Bz#8~J($K=wFTOGO>A=yMEn!~wYmDdP$XVxb`U3q{w$bN_y2xiFob03-%DniI zSR?OzuYdj6enj6%#$B!8ww|xx=!@d*(crzLR&P8Er9JjT2>Nj%Iaj%4nA-U3rADi( zm90FPfm7$6_4P}bqkNzRMPv=oqFo?|m+;P@JWaEa#ER|0gDUQ(6^FUl@uc%0&yC7Pj+!C3fiYGngr3u8v+@Ox?TV3R z6fqS37DZ%FpY0d3b`y4`p+fSE*vUxvV ztfqquSagh}#nlbJDvRVDw7yQ+P)MoFaF-49+kOSMP=p9SBI3z0#;pf7Xxw8r$jv}L z0Pg^EI$A_6)Lv5ZMk=%(NPMeaaJBac`QlpUQEe$u=e)z>{Ix+VRlu%Azc6b3vIZ1d zNo}hC{2g($H;6JF>V{_r6!^RZ)b+4b=M_!B?v$R=Y54i}sL8e`GxK|%JgF`vSU>*T zFx1eKEvcqLhDlFsj=o%;@sM{CEwe@stbY8?7UzMpQDvsqg=9yAVcwQlcr9}BI{EPC zhVJ3g2qO2lXrW%v^FINFY%rmvD|E@{X2DA|jm!vx}qPojQ;fc>D(i4umupHhg)+ zpoIY8Y~J|v+Nx-7OwkYK)?`nR{nGM$k;r~&KC&=@Rd9Z`Z9{XW{n+sQ=tEf>{rdJn z6E=P;&X!wK$$4V*mc^%A;A~Y8CnQEM^8t|;KWSKWKwPG%=E`Q|nz=e+ArXdH z^Fe5LqQX1pLiIbw6`tkUvQ@o81t?p-UsB&LsJI)phyDQgInx$w6VCR38w%@Y(iKHtOm$^s|$D(X3E6>w-S}}{7^;zK zp(<)|8YDP}12@(`R&iirNSf`OLtF00b;a1bk|zCpayk)wisy^DD)(&~k|%e&0?;_I zWl&e1Z^u}rgRe*gMum2%c9?^CTpt{WZ5Eo6zvXpme>t>vzEG7(^%Zg`t|8l)r;ygj zi=VT6$tCwqtQ*4nh-cvOLlAuNoE9(nk-o~NWingatM1esQJZb{ikUFwY)g5Lu@{te z3b~k(o?$6VT4>wTTIk6)cXw!i@iJ!hV${k$>;>P;U9b2E>G$fdbxc!T59X1e282A_ zMSjv_JdU5e&P(KnxH*i^S?}*a;*q`v6+!3QSA-U`$XjOg|Gwb|xO4lh(r<;Yi!yg% zI&8`N5RiRT4PJpcA46cvPG4Jpt1K%o8f_d?)b^ga zGJTu?@2YcLtktlCqF(w25_}gJq51*0cF)7q5%YkwbP3{=|;H?V!&L79EW!n$^Rm{5b^aj?K5f7~*l>x!Se1J#%XSLy@4ic{6#jKes~cH9D1zUtZK1 z;tQiQ1oWQ<YwoZl%vax`8tZ$0-hk~><}UO+^<90ulggEF>cK3SXauZktK#T zYvF9kp0q>%N2}D*yPp9F?~jr=#sj4m8-gjV>WMaN>jj=6=QvX8Z|8lXPe7!5 zG6p|(#+)2+i*yy{1>mQl>G2>sN=!4smwujW#Nc`JzVJEc0~+6^p%gNz z4dSAJ=wwu^5{7(w1erF!FFG|+!HWdiBuQ6cxNH&QhYzds-w&4?M)clYs;Qrk>pJaz zE+V9H%2v*i8({I7Y_V~sMWfiCZTp(~e9%#42sf0*m{!nAIQ{Z-iPLGPp;ve?G$PdS z{tOtZ+x~WhG;iud9b}hiFK7<)L;bes-czzc+el+6~WsEJ-rS48z9a zSxh;e;Ep5n!9pPHW1Dbv7UiDqoWB8mOi6Uh@Jh8^Y6?grC{*c&DdY|GoR!}RPCVc0 zf<=4fazP#gR&5)3u1%1I~GOdh{3#UJGBE zVt=BR}ihUzAf2&KZ$E;y2{vY z3p4ksmQqMet!zgaSvAO5;=*0?nVkJfLj%se7TKyXA7z?ZsSS?gB_CmXkh+jNt|A3R z@}rKCeph(u>5e&*zt--g{*rjd;I&A8f>k{P=g!*qp}T&w8wY;$(#c7iRFUS><`iub zb)y)msMkH1`gJbxXId@lr2IWPNAfYq#lzCXYUgQ7eA{BI!a6f`QYL8c7WlZoxGt*1 zyTy#FkB`;Tb&^xdy8sZ(6_BuB_2Zidk`9YK_O*tG_`a_rv0{+#8&N&0ZEGp}ST?E}21G z%Ij_>*&is6IZAcB_N)c&!G0zSZia2q{s3bxGRs)1m>rK!m=LCN(L_ZQe@uQ9A)MEj znpcmg<~uwNbu`&WBtM<~gN#J}Q=E2`)FYwVn21+lqTttv9gW8GL1+U{PPUk+Ib95h^EwjzD2kboHx6d#`s)Z|4N4&)}eg7Nh={Q|p~?Nr~!X zB0hwK&0`{wuTvS)U}+zIi#Z-041dWPe0t)?`l^V0qc(w?0H^wG9o9K!WT(Oe*otjKsGOyoD3(X(KwXEQ^iy9%8LHkQP8aBa#j<#2g#%;)#nb) zO4CS~Hv&TZ_{-;0GAkY{H0xQ4Bh?*bV9yKukkp@57_Bva2@S5g^;@lHd8 zti-gjK!qKE-gPu`ZLo&N3LbVj;*fPvoAj;qru*UVaueV2n72`t0crESyGyel;R$al zdVqpZoZFKqE^=A^ko)9nKepuP;HGK=xd&cK8mDz=(43ajI5`GucI5*;)ihQhR-9@y z*=fAO7@VNn(>?J$BBG~|SKLl(lQ(7c-{_2G--bou(-NG}#3fg$Ul(ltP z3+xb0x~vux=f*Wu^F7eL_Mm=7M+U;ab2j9c1|v$ZK0Hqn!LnhIAv)@AzUC{5nB=v< zXGL~mVOZS9$hStcZB!rZAa$L?QE6nzO+7>|ugU%Pb_8=E++QySrOU@@XFOwj<&N3V zfOy;JgsNaKz?IxYWMn=#w6Y!ki+U3ZkXEj6KJm?wNRQi#88)1H2~o&F6|HjRGH=ib zUhWXvnCq9dqO9HvDSbq6tbdf0F+#Q11Zi@|%@DDZ14Wr1p%c}|_IqE%MYff)_xy#0 z$x(8-)z>h6TkAzxAcDoNs-6}d77mYPiK&MXKd>?p=!KtIhc`oio-{#P^#ooq5> z@0KqP&?4PL7HlPsbktb%YqS`3*JO>)tJ2;(Z8~6z(!tpKr^E_*xdluJs)Wq<4?Sxk zC$N9-ECP859}2#8#7I{H+o|ZWnCYhO4@EPn>zFz|ov{w`^LI;*%IW`tS04;jG99L1 z+%<``yB17h=Cm_JQcVqo7%M3kIqy2@MicEk0|+yb(6llTbdpyaA!g%z_b4;<-9G*l z)asquMCT(DXZL!+TNmm&xgvjLbrKBQkK zidP?J)1SJV4}6Ia!ITO|Jch;T%+k;!Y<;1p^^#vO=zQow$F#*er?TecgByrm&H%8Q!=q{q>4uX)FgpKqg%Wvx}D2!#H%iikI%15C?DFR-kDE z%B`+Vrg4gKNq7)$sC`{Y^_JS$bUgwuZUu#yA0f5r3xSOW&8-w*`R>(U;St zTN~B&2(9_n-Bn|phu*!tb~*Fm-S#eR_Z8TFU`;-kp&q~e_=yfHdw$>j^H{~(mg)L~ zSq0HArj6XD@(CIz@uzl&xI{Ht4(|$4=zL_y1S_Df&;3QqqS`y=2eGE4;hsfLiU$ zpOz9tucZf*6c-xT4^yH!i8(<+;45&F`WZ^WFYi`dP#_Uno^uc3-_R*2Zm|s*wWUv6 zf)e_r?tRX`k&EjVzz&T$n1qjx?K^&aO`Cs{5Jry zKuy1+^cg*=GIzG^ls=`?+Vfx#el+2@?AX~fXrY*bI7MxWB6V__LH^@C6s>wC4nnfc zy0@mGr}j%lr0>{CS0-deMsWztuQXW;l|KVISe9T0lfANLqoBQk3^t2)< zOMflwxi)LlS?d3F?%Ae6y*ff&w3(pMPIw9sK7i?y*>gTITj6|+0x1fk&OhgDQyZpL zEb;&|l0QJ`G#Xc67Jc=#9TUpX-5~a&gBBJB&v|fgHgWRf=KHm4{rjiT zwd@I{P2&gZn1d1o+IK^vopy4szM_h$p@McGCT`kto%iJ;!F^xtyKo|Sp6#lm7Sf*# z0mYlsXP901;c4etw#kz_x4=^LNWu^c;;AMf*2ILE!|x+_h|tA@EU}EDY0%O5>~^{UD(J)|^)1RMWCaeOrtM z?O{XyJJ>xxuhLoOg7Yhx36r1jBVVl$ORssA-yiBF`Vd*eST2 zHTx4BI&72m_XrNVG*DZA<F=kcdub{BF zdEOa_vTgVjA)*Hf^r zKfyk>3vJ+i1@nbMz*{jNFF3D~A2ZwP_-!9w!|ex{6GI_Q6qP>ySoE=q>?LtJJ{Kh% zeK+U`v7m^V3SPr6C{d(1)HixJpG5wt_2otaD=9=|vHBQr<7X&5)^ zW8X9>A=hoFQ?HpE=+?aJHdFP|i_CJE80*xv4?p#8yx2$K>xRBgazki8k!k)ns0+itqnoPTab zDI>mTUxc}+7hV&SDtw2WFnQ1y{uNgW`+3*Stz`}kd}s`A&U_*E+q<|ji^M+Pn>ELb z9`gu0XdW3G?K6)&_OyB9P3)D2;+-_U-wcDz`tN^S%SmZ&x)$%`mTN6hJYRnGP4nE# zuVX&Z&q)UC)?+@EI@Vl?`BVwtCgrN@W=K9r$7|{Mv@gErKoI&_dpp}lZN-1 zif5c|7A#t1diRI_7a$+puN#~{PccirT8i6#yQTT@$CWUxnm%X>;~?sVm#4}1a0hMz z^80%b4z|z3H|PF3H9RQ}YR&g+;ispIjF0Q3Y)<9_rC-5le9|Y#A{n>FBow9t!Y-Mj zHbs#DOLg`w>UtX_-f{ zM+oUEQWQyzln0eQ=@XuARFbA2@*>9ih^g`7oEk`ZQ0bFCk>)=*nV$dgH5bi}_%yS* z6tyXe1Xjv}N}u$JeVTvs7k?vgR?r@`^}S0`^k>rdbRwj`TNHr?o%2bbu;btI+cx}N zjh_pciL7EmOr|g?n5@8=#`Wb#l$6QBi zbNmdpr#vzsTln+Cm`mo&VU=ZG5KCdo2V3cw!?XgEua<`_Ney8!gms#p-vQd|Fe4)^ zwa_6t;&KYvvyl7i=!Yapw%34RBCzH_9vaXC8fVmm%$ff3Z@)8Jp)FUqa3NCyCS-_D zg%bQBRuWFtmakap`A-_kBnq!798~PA`gO||)3{|PYqmmaAh_h@M&K+wqDWCVl*=@^ zAjr1C@_#XeY~A`er=xiPoTj92TR{*~FrVq#skJ$>n6**Os(YZ(zGDXk?bK+$#iGNr z_kiILgf0ZV40H31S3%H3K>!0=g}t?9qaeVW`Ti`szI6RL`sB-qp?#zkwFN0?Q#8b+ zbBD8&+G~Bgb&NDNQQx{l7qfEBkLIK@$D6DUEj;}$5N0m^YB>b$u+iQWCSR;^PfVZ{&+XV5;S3zYZ{}0r@L^`Qq!aF5afZ) z0Wcx}=@%}X9|slPjMe(L0H1y~&-902oAl{K@Ee(5(j_!PEBF4dxCA_ai2#Sz$02>K zdjZZ+pLps;aW)%jv{Oj*D!h49;4@hSU>q~-mXCkL%y@T}I54Dej@pYL8>7$hv~>U z{l=~3;DjbII>R)^EF8uRdw2pM_Lxx*^>;Sf_lF zaI+paRZ@+gw?VjG=zP@%ZOvSmwzYTOLqUFqDRx8=j1huJ_x@=DXv%miXy1(SHEq?= z9^wROWc=VA+Yac}8A49Gr!;C|`>FFk+bvKQo z_kZU-56bvU9ecD{4#9M||LOOyIQG9m=#z4iF+=BWeazQie@j+M9UtNN?X4f~ksOH) z&%E%edHT7RkO3sy3DRi&HGPmK$Igt=($*n;EmOQ2^ROnXdtb9l5R(d8;eAOLP{xCR zcC8wkQ_7YV`fN990`}sWAL6jh@^{9^LH{Mpw)E&bnCB9n|Ka{q z0Jmy-bZ%>k6)OVx3f>-a4ApBlM0SsWWL@0Q?r|{nRI(H7~=wR5*TC@ckckWKq+;TiYesS~3yjKZ9s`JR0zytT6p2ckgD|M5<)!aK1C!kkafJpZ!v zN$H34zi9)^`LoZGzC@3RKFc^p#|jVf$!GK7V2a-h7aS1bxOYw%J;>z6O%n2$2OwYL z-KL^XPV(m4Rq*K&g=`#jc9NTSyxFx8K5X>+Lw@qx$-jZdOt9YzYVXt8EN_e`eVIGJ z%>&34->$TW5NI2&KhkSh?;dl(xs@W)l8VMp4S70v--Ec^sVAHEtr|H9%M%WJ_^1h@ z_>h6akV$aT&UNxB_|qT!VSkUs-tq0q)k)(&6bFN6onFqoHRA(^OlB-F5^IL3e8D-U z{(ZGv4yKmGbPR5Qpstg<)o3A6grI4SZE31!2oa_gHX1)mQbR=J*SVo^8Y{NsID`n( z3Yn(=dw+i@*EA;QG_A36GdT_+!n8uB`Jd*${riJ6BJ~VOuYdX0fIsQ|&+Z#KPc*ir zsh%N3m{!>I{*&H+()-VXCCg>+Ee{**y2nH--b4R_~To<8i_m=&bq{041cJ^gKv$*pG7~U z(4vYV z#~ch{Gy{JqvK`GRFi-=r^7-e8lgHPg5%=zU5N4yi{3-TFq>i7?S6g@LhW5}T#}D~x zw_XP=tBTM7T!$a{v&?(Y(&xG;1NvP%w*&_J{>4T+v?Q+*LHn&FY5GDC{rS8FlD@Or zjpn+ms!CcPsm8xa=7t3T06+jqL_t&=nqM^C@%&5E%&V{C>OIhpf&)pC$paH2c@NBM zcJJJ6>O9y2nvL6WRsJCJ!2LC$v0YX);a;Eq4m8+46B0K<6Z>`uWHhKbkCV!jhS0Kw zpFPxcr@*GfG0rCLym-3>zVJ(7Ve#S#%X}L95)RP!EJ?4&7)5}OC@L#$POLQ zEilUwr?34a-IdT9Zr{0=*^P$O*1i1}``&n6f5y8Xn73wrAn&bsv7)9Qggw;wB(~2W zXzw>tI`SkPoX2h6@(0+whF5t%w?*~&d`2(`9KhipS&~(h> zPrV@5-s5N}h0SAh2fQo0H4vpQ_=CP-rGv9u@O7K~M&Lv34gYP{O zI{z(%tC7e1GALQe4QF(Z)^{nj0EIJ6pvLnq>JsJ%NJ0z41U*2DA#>GRe>-CB2wmNf-$<0n0C zKEt{rKQFwXlBr*}R@A{Dl}P`t+6_?4?_IVjkiUSr<@&2}BjW_Td)^Q@+U(x5%QSD> z)vTis9&~TK{t9!^1?OT<*=AmoJq0(Mz>ab!V^3*q1ykF1><|s)ZV<$-{B|{Ne-wua zEbbfGV%mjT+g$U_VS{)bOpdUe@4qtfLg@bbTQg*x5O4WY%0l4Pm>@!j2Q=^CfQEGp z=R&yluk$L(0b*g8Vc<=OIUju@dnB72S+uCBe&@~Rgwmz)jut|*`APE|%u;ZX_Q+}@ z8pnbN1n#`2fkO*zeH>=gx#teKX|ig~_h!(L(GUjy4A4EI?OO4y(`_?6hm9C(KExVk zC<~J)H(p!S99QBPGYkEA0UGt2HvfwLXPBN{+L+^@;moejp8F~KI9A?QaU4|KdHYS~ zMC?)25}!2XaR?H($@-H%9($}Ge~=J*dwX=~(%URw{+;ludbOLut242;?KJOyI7c*V zDHttP@)*-Ii)MW+gSjr>dG7<{&`bP(-Z{8E0sa<)^UJ~zgcgRcfi*a|Y}2Vb=EfeA z8(Ph`<9l&#CH-E^Ht$0-o1ygaB~3RR&N8r#*l0(Z<1Yo_X$=Uf`Au1ZL*79TkHO6Y zj2U$!hH?!RMv5WZREGmjsweY?!wuKqdxEZRfyVaYCChLVW|Sao-sl1FzBJZg9vmuK z?dr9dTP@pmaeKu<*eh-}XJM~ci9?jB@Fzi`EZ5835dL0S^JR4a;%xf_la!T z6HChhL&>A<`+WZ8*I1g4wNDgO9-c5Uk~d-Lb7pM)b*l)FyTc|v;o7!rXpS#+9F*^K zc~f=+hK@3y;M+pv<*;tA#rLh`u_f?LnTOj>FN!00;%e6Lep3nSN9i}l0phw1*auL+ z+XmO;9iN69Xn7C9w-d?-e5Ye@>tzPMom_tzpjoTNt+-WC3E%(k&46Je&9CSm1K(#E z+z8=qzoJ-IGqG1Zih~g1J{Gqadf^}*Y+x5XeP*QqHJneMeD=8`@pURgjYudGJEG>C(9ez(Q#^KG)*hhJTWYn0+?qHo%v*q?$qX%l^;J-9(94<41 zhK<2(7~C{L_0;hXyKYdU9nOR4rw461w`*=rKH&s`(S8cy{dkc7dmBIblKB3mMcB|{ z*bnMK?{naPntq!9>G|gu8zzHG`y!u6ufP4^fae|(`u(wJT#ZB?D$W1&{KFi;7t>D( zpV*Jt7e|wxf9`J);iTiML?MsEasq~RfBY5r)=2!F_&*OC?c_#zj{GYWJ#eCSd954~$DR$rlfW|Vduazw^Cj};2*D!4;>V%Y zgk!rP0GZf)mm-H#t0nv2qd(`O3(*s3v11Uv*GO>ud+;OXk~!9N49CbHZVZ+K_8Ano z3d>24D+VB$l#c+Ltw(`pIZ8tM)N0=_{k7N)5@Ld-YIL1;g$D~ zKmH8-&oILW^?;MoLo5y2Xs0t&XsF!{VOD?qNac^}oakF@d|F;bd7F9$W=5!q$}9Sl z$3eIm08m?e3IwSvyZ)-nVe$Y1D+fSq_dd`RntnSBwIzFIw!^qlhzb!}QltF@3N0z@ zW5_mLdJJ&RP+_CJM`v4%r~HtHFzRw>bJwm}&6g7w`A?1Z&!N#yLEJD1#2HAxNy`qf zQ@l~=cI^oJwWUki3itlEZ`)>S*Kba6Q=#0+rX4i3!|(x2DGVPuLE1lX@7?A?*adUL zvtW+CmXXI4)Xn)A0wHv)Q`<(OnJU2S5CBI*6Y?Dh-1*)}k8~M6`TPqJC=jenDG0-0 z#vlwcAfO*T;ZdRAwxw&Af_}*VmtK9{JpQE9Xdeehfb1yRJo0#`(LThH$u?ugKWg5F zpq+ic^`>j$W@-RM!37Tl*vH4H-RbBL8#&(0#yp1<(g{jS2n^>x&380!n<@SU3Ljk1 zj2he*aDROLv6G}r6GBaKaJCHxFL@!Kf0*IH{$KOX+prcO z+(+YCAAcfdH`uR{&}gUWm?#jtzR9RmQ>{C6gP{F;m~65d?NW{=japIAzCqS$_sq5s zbU^@%V6kPJx(!-ESh*D%=FqzCljSP*K7I<9iIBGnhG4(qt&j+(!G7_Pc?f$7K+N6T zQ!cyM)+5jHv+jdgAItd1VowqO5w=6nZl#U(=x?0S#SaOai+SYH<7G|3^3(tr2>mnvh zl-obRR87lvS)+P(dY;)#mb#xEWvjrH*PKr^Ho-JcsAyDw(!=PVM294e<%(XX3gQjX0~b50^f`Br=njGeF_if ze)>78v*mk1lP7fWZ3TzcjMjH`EnoJjj^L_DvuZKhdIdT^Wi4>Djnh673asy|CXj4bv2R1^4X2g$tNb zFl)uI4f{0TC&z!ZILgNRB%|H(GhsE}^@vh_7!zJ$HGUso&hU|#F{|3$4n4dRd&KE9d z2KT{yqM0{G{|C$`+WY3g2nF0SpFH-k2T@v@Mp?nNV$~|su5(Y>3%Yh{gKyk%0zueq z+qU8xjPENt%|oVMU2%Bh=yR=Zz)hTHnA7xK!-J(k=%WTXq{a;$?lH9eUb<9C$5VyC zx`&|s?f3b&C-ylUFkXVcQ+56?$AL+Qte&XK5S!-@4eTX;UX*^Hfg{Z4Fl9qc_(#SJ z6&%vh2)$1&S@t#lHn65)n!|LGKTt#8mVCY3(5x5x*`|3TnD%ntQ_=Y6H!1@r>P|JS zn{rRJWT?V(_kB&}u!ls34}_C<+Ew4;C0!<8PK$bRLYf`00V^ zm_NGyb^L$y?@!VvU7df-vmi}B;z{EA3->?IJYizA{)Laq%s6+WDwj(0KjO8rEIt1s zo}}j=c;PlEyHo2|k|L5dCx>xD~AUm2SW7O7iXx*Qlp(g zw=l`Lg8%97-`3x@b4(bR9h%>~MMw_zpnyNR;*7HJ{s$P^YrP-?F6idq3GEwSBSfsQ z9x{0f;6rx)UFcguJG*AL2mZKYKjn!oSD8Bpc{l!WY*MNZ%gb?WT(@|BGB+)s*WI{h)KNIOx{DPe16AB*j4}G&)ZzQ^sU9G?Z6)k37eP!!(Ae2Wpg^So(O=rBf>l9PpnSstdndBKT;3JTDyH zk^lEV`CDO{vO%8x#Va0SDqt<*~{`j^1}k?}tRE#_xM(4NcMsMW=2dlY->``5z3 z!y$D3=u=auPysV~7=yPj|G3T3O4Q>#}pxLHnW3HD90V;3+ zYouPI)}l>G^C^QNFts5&reW%xp(;6zbD%GWL#tpq1{$d}9ixHkR2=+4m^M<(DUq2` z7%+6C`51>2Ijw(BE}(xWgqZvkT>vfk2KU_)A#>}WLLdr*@?p)79|=LI3;O=)K({`G z#$2kjnSM5IYUsQcGZM?cg;p!Hrs)h-=^`FSyffc}jpDp!0`Mw6#lI1JZ_o^FfVesA zQd_*vy8q6^>6^?$N{tufk7SR0Dp=M}*u2uW~ zDbOWHE1nHunf2P3>O!EaW_*4QhQoQq|zc!Z`}jF~icD74S>h(!XtXcHfkN@3I0);Tg~F(w<9Tbwd$M;C zdg}P$e*7Y6mpO0byUuq^c+Nit&iR^kxzFP;tokkXuutkD{Cx-DfEdE&!)fvi-yhpF z8#hyS2o8_Wq7)?&nvV*d3xE3^oT1_d72jbu{GGtt2pV)95bwZVnMr;k2sZ_G)?az^ zZIc^obIOE=P-6S1e}5c?1DWB2ATVce`;W~)&`y(4axe@394PzL z4kht3&3~EuDW?|-llT<_)Cs1stJJK<>G=o7q~{-JN78&sufO#A3!;VY5jEN%h($MMYRd`f{M5@QNSt!j2HKzX2gT0{d4C=3>}(-E@>8!7&tp zo%V9wyCnCIZSXJRKQb=tD}9A$tZnKxXestX55<-4hllj`AX@JWv`vbN)wniHZ6*f( za62820U1Kj+OQ=~6DOBkbb+aRk998C4%hj=UAac4+X|sH zcGaujDnF=eK!icNZ&g7_Yqqr_hj8o8t4d{POvg1zfi zG{bR1DcER_gqB@kI%e@QI75XNYQLVHeYa?Lp5_&5NwEY(pVs9&859*^QfGOvgM4CwPPqXQ&QXgiq6Eh%NTXV^pKvYTHwALh~=yd0~W% zO&3s8e84c_KQ%OqK?{`SJYW*uA$>yWlCr-F8}VRFa}mElo0%}ywyhPux$XcW3R0G$ zf|{Qc5>uc?KHqa!H3#c<9J+(q{Cq{^AUl zaAC-aKIbe2Exd)%xgE8oZA;oRUjGvWhY-4Sf|KMh5Z9zBPl!`iI@p^y5(jMo!4$)^ z{Dc-a(btAQg3IA(k|Bg`(-GSBFwelbTBcMf;I!W?fk7Gf7uvFBJ@*vuABv-!dkW*ctPOm%P%!G@3Q;S7-u?$8oT31 zK%3bG?X$PvjRM|kC<>D&mJxRUWBM!L6$EGRba1zwt2 z$gj~y4Jvf~2DYzh4o2rc-y8W)zUuz#?UOr#JP4h)V6pl1i+Rv0-Ut&STg{ej*e~I1 zQFskFxiJ8n>I~{TAwT##4*U(rPn0BB1EySfYl(>Tg&ul)`>oJu$AO`S#Y=IstLGpYf4J7A9(b$Q;rm1Y zbLa$@-#>Coc!lIz94`Oz3-$^yuu~hD=YW5O$y1+#R{9KR+e51y!tTWJlh>&NF;9X2 zkXNU{^cfEu^;VAqW<8x~E`qt6VxgUX+a-Y#8|{-GLpsCW;z5e^$Kt?|w}0}%x$O86 z0|YjFEX91vbT;b?;fBN!MT^KBA!E=SAp_r*{Df-$D}{{!erQ$&9ca zk}|X;4|M-o0kd3mbjuG?TIv z6=9L`pAEutrK@pLT|z-ZR+>p!ii)r(O&@F4Eyj>9%6E;E>JkbPvT6Q<1HzLOj0ua< z^DjOB((BKDAj5T``;Nv*bqNIt+4TOC-ha~jFXn*${TXVshim1Z^8Lx6Mmx2(`6EmQ zC4Vlt@evDt7q2j7HoCko|KKT@;V}?=C4tvOhAQ*tAtql=9 z5jtZ2-Bk@j$EzrGjOrY4tjIb;eF^-aFymq0i$|tD16$s2i_^Ht)M#e_|3^=R-~^hp zG|w>>ra^3oXneV7iJ^^e@^28#e-wxCXg&Db7{X=}CL}}R`{ykpo$$5qu4bxMx!AuW zX~4(t>_5F=lYRb|i)8&>UG*~O=r`&cQP6}7`A=N`f;RYr_ua!{1Pdq5P+^jZ>u(Hf zv`5ZK2?ChC>_2h~1Eyn6JQ0UO?NwtqTgFZv&{Rj87P!$8?~<831wz8WuK+aE;i;ELjIqw{X!}0GvOfgD>w*^?0`!X z8GjwznD`Ca*%n)T{yVI~f4+aaSMdf9c@&?2>n5q#34lN`41DFiI0PKK#f6+eG z{-^6Nod0*$u8(n&7k8M;U>+vUVBBheM)n#AsA&sa1nr>F9gc_>;?S=^{`~M~(BHS= z_;cd_Yt!BqlS&qbRQ5jp5ks&>4=#)Yjc;)PghNEMU|WWe|HLwNBEC76GBm!wGQIl` z7xOU|9uRns{7=Wv_G2H0$sY*TiFY(iI#HuNKlnTLVUC9o47RuHachUScbKCIk4t6F z2!MN7IR6Aci9&5olfG!^mOU|SBx!!rXruqqi~nWr#jPl%SsmKSI8k&q+O0-A8!Unu z7TP^0iOx893cr)QVMTLZIeq`a@ss~F6GoFj-TMqP+3C-l?Sq|puJQ{ z&z|mmhJbHNVS^m=1~()U-#;4R!25eRC%4+$4eQm0?SE^|s1a^vZNPp?lXWyj6orVv zYCgyEfb$X|smmK=@5~e@v+V3+Fv;_K`!B!ajap#t;9J(LVLdUovlI@v zvtVwHIQql!^HDe?Q2IQ$?hjLE)-P=&3{bg#7Rl+Bu=O>AEwjuPdJc*CCWovg=g^naa=ihri(U(#ngz5Xye()&-e?I1Ou&QP&0S15aYP#$hDVfue>|A8}9 z2-=<2y8Xccx2X6VfPXYgf*++^_?JynFdQrb|3+}*Rsn>zl}a{6y#)g%X4o2&OXioL zaYzXJH=;iW8qzkff41-Z!6D;ETxHH285dzV3@cJ0EQ2kv>EJ2j#Uth7LM!lxKYVQv zU?g2$P|8EF6J}vYD`aOW-%1hh_|(D?hJyI@5XAGnuwO+lS3x{$gcaTNG5?w$UcAE3>|Yxd}SW}Bv_EHv$u(`-rlBB+8r*~{?0?uAA> zL-RHe^1~i0ZIRZ$?{2`^-mx>n1w3}bM(Tku<8fs1Vz6_53}`@@DmHMTk$MF*M`3H- z1~*D!spTu546eq|OwKOY0A@+0v(GehKmJ70MPcq>AOs222$LWU@%WwbKMjrcXJ2?( zZ1+x~Mj(Tb&W1MJ7jT$2TJm%RNoQiG;fnTQ5I_|!R0z)P;0W`(m9Q}l+uYP>ccB%2 z*ssP9d}_33cEFEZ7pPIXWa-y%)L6{)=>~zd>s#%5O`x>~(=pKQtqnWON}pq7S12%F z03mD<2-@ikRo_3gjW_(X9zxLau-|IU`Y0_n96$Ln^CnCKkPK}QGjQGsGZ~?LI~^8k!%lGw+!HP(LohZrjaTCicR{8##4E?x@3)KJ+w2ldM`#b9n>7sgx@ z+O%Xqnd3`BqxMqYEA~};NGEg$z~Sa8uxooT4-wc=K7MEZ5o#E;&_A5>v0(exdFMcY zUJLD_krIadXaB{SEASoz^Fs%~oP*8dS`}LHboiPW68E20 z9ih>VTNo$8bW9dB+LgYT?0}&2bR3ekfmU$TEB1)m)lZt&r@tfSL#*j2M~Q%hPBDHF zv|}FJE5hZAESxm6IBAdihjnXBp4U&=KLUG72`T5JGitb1V~-Y%_K<#a*e(CzN8rW0s9zU*70~HBbg0da9asXz=jdoy}I)S#%Enkp`0&x(L4Y0#c83fuJsaX7Hlyz&}u*r1Nw=+HKc~=@@ib z!Xg|bbnC@i4K%L-jdUD(P+oP zAf0?tSe`h3HdOj{w9%NS;DF~<9Q1H3(pIS8K@dDd&`#4a@S!lUPZkR$==!I_^2t-5 z5O6QxM%&R7Va{jfY%#B8=e%o&i1VLwzUKhk%)lYztv6mL`;G0DT^*cfG%rKu)46!1 zv(AujEP1q=^9jI~Ep`vp^_L5CntPkh{}uSY(sT?NKqt3!cB|`;4p-lJYX&DfSDJ$M1b-;j^j2H6%`h#*bWAyE z#J>SswCe`eL)oG|{sx5q0oyar88>qKrlY>=?6f8Fl!kclC8r3f#_y>JdP_slpuJ*= zO5-I-B%~o8Y5Ga5VL_VzSebrqB+N3IWb#PQe>Z#LtIhJpR)uK?%!tK&cpft!h4lPO z&%gBg3s)7_hRe&6vg=BgQB;%u{t7QFZ^$wIi^!&fr!WqW^!^htB}#JtT|hxQ=3Irc zC0)foYyLr_eFtQXm;?}}Q~OC481nqXmp?FMj!2SqHqR8{D1fF09D{?DwEUuDOUN1B zZ*(DHF<1~j70=&^{_Kk?%OCgBOWQ%4lwYaY=3)riQw8A@Dx^s)lMJ0y%>u_LpJcOu zzG8_9(9x!-2-&;X_oPi6fd!o)kbh&E$5S*gBNIdKiMpSSu6-){+KNuunbXP(`ac`?SH_O%Z#Tqqizkhb)Fl1PL0%qE5g&D)!eKm8(hklVLu zEY;G4NEnczuxU4h@mF7QnW=GyJw&k@cq8P;jR*!HXxH&8eenT+_SLK1B!Ya4Fz4s< zuUI>{{DV!*COG;u9YZbSJP>@VMmuRxpf?kChx6xin!pL`pW2b#`wf<RtauP zqUxoUeRiD`5GGSB}>9adscf7 zOjzQb1^(sq{skEH6GKYPRsbpe9XKSr2e(pKQnxlVuEn``9E-ww^en)OvW{V~2jC_P zogpW#KRT48S+7$d(Cx$n5QNYS6Zer4wCSBdfI{!BFmFXiu@n^YAg?wKDY;hetyNw2 zaGfZwD}p_!G|N@qIq*aH;13g*Am?ojX#{ zp2&aMd$&QOz4G~D4ov~9M!PY0+;+XWJ}@04g7%))L=v^+Jx<3An&kKyra4ZB(^8sX z)8MKVz3sePsPu6#K(v!#bH7I?*xbkaOb9epwq@%!lfPhId~5SbEpf`BBFv}IJd60L z@B_36diEbGLUB4Q9SP^FzM73ee=lzw3$xO=!=9?6wfJv$z{fpp?b|hK4yGe`W>`A0yeJeY=~Y zum!LESD43f5c|T*Z-{9ftMPAZ^zV<;%9Y2yW=(@hO+a65w99R;P^;e|=iv_z4sN*t z4w4~k58J;v!GJYP6q#gNd#G_{t|5zyL{l{+w+&0qtZ}R4uLrH8;jb)M>BvpH+r{|w%1=;rhX#UM# z`VIc<&k$#*vK9Zs#-FhTreoxN;zzGY!8l5k*u_AByB#qFWRd|KwM;ataIAFSs;CZ) zr3^s)(Wydt7K$ie@Q6qsfPWAAv+2ZAIATX8!w+Ws#c+mdd17lUAMDc)+*Ui^Xrc z&6I^UqTu|4^j$X?`CutW^x3of;52XRuUmzUx886Ke*9gNa{Rse4K?!?!kh@O_3YYC zY#DQ)a?KtZ?M!F3qxK)J*+(P8Q8-|O!?-uzdRNjz zV3+&|Cv2|;(=pU$Ra?EhnIYP^5UPM2>?*@C8|*8yL;LdnX`}raXtd|fpy?QzK(O>V zHq|E02VvFt;D2v=6+)6506jbi~oKmUp!)Q$0j8tL=T zuV@A2=n>p^Fh%IomJFn7NCQsf2%mo$C z7Slo=nQP54Mj>0wE3Aa`yvVPBr7wp$KW#K;lsm->+HJS&bCL+^W{3mBiQ){|VMTRL z;}?so;lhTF|*q#r8ZP?!}5F%3uwg=MHD=)d&oN~%Z zwke*SV3y+RuUBASJI3_D{ub{4Z{gjK!yMrL)5zgfn&cma)4VkxcrOLsvcL<%qhPCf z=1kbD#y-G#6OLcIUKh>`x&PAf zou)jTE4FXh2vs-)XvlBG7VIO3iy0AW8rxt;^fvnV`TT{VeNG=7IyPIY*tOV|29?}P zXtIg>@IwP(D&(+(F$z1KfQQGw#3 zN8;vy4VF>MU{dP^X!UddxEC7q2gAPk)@@rws7i>E#~p2Yb>aJr#{cu?Url3}`rys5 z@~56G&N6lXv1YQ~l3vTWakEPTka7Jzj{Wf^-28#kH_Xxuz@bZCKYr4y-?+8ew0Sdu zjX3Relh+ItGGcrN0^LtsdqyLAh2thK{NM^vjmbrYUZHZHM#KqD2ogL+Fsz z(QiU0&)C6rSK9?1%J#u;YxxJRJTj)Pg;ycj1Ynpkcj$bUNh-m@Em_8YIpKPPCn zAZ9xLb{RM2F<=2-d4S=1&3Gpq6aRp@S>l+Z9kd-04=?WF;RVKe?bVlyFAf5Xh2Me# zVrI#L6Pn*s-Vozj;|;OM6q|*iM*DK`?gVJGQ_vpLr~i}&@T0>0qa{qooar3Y%MB15 z?C~wpOjTLj&SJ*)&f?|M=3QxGrGlY6r~N-%e-=DM!ZbrfIILxj&AZaXN&+yTJWW63 zv@+_Ct-s(kSiV};qBza}aE^NBXd*rT((4bKv;O^~yB6cH)J_*&o6IrIklz1t+F~rX z9M3}5S;pBX%G3LQIMb9->G>CO#ZMNlHwoku!#{uh(R2*gSoyLg?RYutf6)E|LHjlg z&%Rjxp&Y$amSG`KiX{*Z3=zQ?q!p`Ol`Tzv5?)|gCGD~0lbE!PYX1)O=fFlcd&JJk zfdaJ=0cK>T zPm^l$SjG^(kbR_|6aK_VZyr2SlKPtqY<4LJ3?0K)cy5FmX0 z^>Q;5Hluk(o15F9KAEOCgp_ZXhsT8#D#MS$&s=~1#w~60+*^LFKkiMA?&?%TwG1JCJMm=0fM`P1a}P%!6iU| zBxrE=U_l#qcL}aZ@H8$B!QE+SAPpf{u;AL=(`4T7``$To=FZ&TwKKna{^^F=t7@-Z zUA1bhr=D8-9fGmM^u1~B94Wgla*!cYo}^FVa~onpdORXjEwPP#FGSSV@XmLTkit|x zTmMhQVzkbf;Zb1Jp;eYcO~>2{YW$&*9@x$MQw{)ZSiH$tzdB^P6qC4L;vVEb& zz?t``!RNYiSffaRK@C4Veo#7C;LE5orGXV(D>Hg3GnFq-eNY$w7y6*hlQqUcrGYgm;|yuw_lV~lN)MY?f5+-cq)Nk za0TP?9vLnV_!1G+a0gODKX~qe!c$dftn~q|!{j%fL*Ji9ekt@Qz%_I?76aGH(FibK z2c{1gd$l#nlbMB+N`IM<)4!tlDP>08pUTu^6Rv4f@BKBAB`u=$$O z^qWyxlMCNL+-#tPIN(Va{iDNL46cpdO%&UqAskoNc2&Y;DW}!bwUApV1vUg)E+eqU zW0Gyctz3I`(O!Dg??XDt4>E^lU-xjH&I$0Spq+HFpwBxZI{jyn+KzQZx#kTi#C9 z2*;tmIF+dNDRh46?%VpFnH>L})W_S$7dM~GLHQbrt#5xb_t~cVVFxjCiT!Gs!zgf1 zxagIl3BG`E|G2+D*tX4z%OC9OdO2TX_SwjzOU{Mh)AfObvHGCA2*HaR3pccwkc*Fk z5C`p&0FjSHFQx(=LJDE=%{DpFT4bhKV)-Fn=y3>ewV^tU*{MH`gy1ElxtlR-8#j%9 z=ZnSTuHln`s#bmuR&qSJnM-3_T74N2uz7SJ=c`xU^t%yc4o^8Hn~h27UNav*yXDWv zXeTghWJ;gd0=h-pOv8Aq(j~aW8BE2{n&R#`@>Sp#L1b~0G%-v;P?dg&KyOmH%k^3d zheQnD$ZMvNqUR5;@^q^t1@P?PhEk>1JgKr<%8td)FBtxIX&3q8hNOG|Kc!_tA9IWa zLGj;O%Lil->|V3{d)07GUB3Tt`F)E^b-Muk%vd1v7a29sAuF8~+e zO2pLsTcKx63Gn<)xs!;y_hfaWADMTdr|jjwut z|KY}E*!9iha6xn7QFy!DtygHqTSgDS(NRH&8N{x_=~8QILZdpQuEVK+HR%- zTu>Sh;wM1QU^*X$(`D~| z`s`{ydr6*kG+cIZpkmB{n))2EH3pl*qvKn6on#>Ko7bH83gEi_ARqCBBFG0FlZPTo zjD2%KrJPU5^fnI*Kl)TNCmFes4T6mMK;F#@g_?_QbY5{9HBl5q$*e#Y=o zJ5>wJG4g{kFCtJfL*9tM_3Mh@Q&Bi;7}jYVU*qaGZ0L7(nqRc0q5*%t|8;G1kk-y< zKq6*T#B&QOb=@dZkXs~@Qi#m7xPw=<5&|{Te8sl8ba_n@&M=}pXx&rBXj?BeBir{F z{oha@%y55Df9MGOqUaYUe126;CK5I(#9$O*5~3U2G-v3!LwCToQ?bv6ig4+;P~B$( z59a8U1T2Ygn3i;+qt`g44j_6H_vHNm;6vkS5}U}!Eo508I3K?B7=@C>6%PoZJA-US ztos&KwpIzY^o*Plq%_**eS)e08fUuVW>J|cU)rq07wR^ZnXv-8So>GdVlE+wT}dZi zm`QSB9-Ihb>SCba2WETV^ZL_|-Ex)C+cQ$!xv2X4+^3Tnmxq}jcmp4jVtt#$3SdQo zQeeQt_u74;w=${1i^PD&qleG}ynQw=ZfbW{*BM6)G$F7`Y~EMMEO7d8;Tfv`_KI+5 z@gzvk_6CnG|2?c8=Q7~>9gPi$+@TK8++D;X_p?Q};Ud@#x?CuVAKgqTCRZjZ_^3_l zsD+g3;L5Aj>dE}2kS$K|?i(;))$cG^B%I8$w)?90lKv26G)n?xH}9Hk%4-`%<+2Ok zGl?qJQdbkI{9>GTrR49I+cX@PK5e%Zl+QUzMo(M~@gkKCP%hv|<>Zc&^qno|nt|6x zYcRxp1aA$97mF6S-Z9oc-r(JaHoHr4f{&ydd$3$5Sh9?X^`<5t*ZUzPl3X&E)YjU( zV{#K16IT7aVna|aV|iHvP7o0eHGR^MmZbE>)Il% zv$Os0i?!u{JzRV20K zcE8J69oAj`NnJrKqesn{*vt`1KG)#7E@jr@2C4#uE#`r&EikpeItQ7P6^#n>XclEx zL3+)+%IIR>6IR0Z_b4VzaoVAH%J~(Lkv9qYKtar zH8?^fCTC@u)2TrTWaH3z(7F)y{;qdCUK$G>L43A7ZeqzS_3%+kD+*OeQoE%{>*lUwiR*(YsjBBZ)bSSFXzoeEFKDxduzOE7p*czgAHMrPVgz60 zEx%GwU%Fy68Ja82xb-1*(tm)E{&-uTjaR++GB?o5<={&%!BmQ?wesz8q_+4ZMpuv6 zc}~tjorrox+Fbr6YWi$H_b+0Gyhqhd=H(!4YLbxZ=?e6lIcva{K8G#9a)tNuR|yW# z{+wzScS2bNeuA5;im2=~{4(IQrS?4A4-wj0PAF)u^l0}>nEIZE@i_bQjM5Sbdu>S2 zm!nRs?EctH*;6FP$F@Wgn}qd@R?x^Xc=Seze8=>nX4!@Rbc;v0U_95w33z$5Whmr~ zBP*`Xr-cnMZ~}f6{?*lel7Z4#L(T;saU_#MLkGxD>F>O5xz;);->XW35sV=StS5zd zK=2Ix^HuxDTS=Buwyya>KJMP?P|e`I>^<~EdTjbv=VI3E&3^i6;qV{10Q~0P*BjSBO(6AKE3xYsnAsvN)yb*WUkKgK zDx|JIX5S9mOqH$%nYSZmQ0@D_YLXjX3v!U0n0yFsB016i0^xsd&hT>3pCJB1M^kDT z7-<(*IgsTvMMHNtMIk_tpkY;#nP55O2SSa+0QcO4{d8wH5G zMigcs*w4uH*=;S_P{YdgL!2-pVow6wrjih7@&*GcNaOW9Y^z4>(UkY%6zD+lcm3xI z&AF8?cAq04Yhzzcig?q*JJN+7b&+@VzLV9FCwmAB8wgm1cxP{T*2=_Veovy3@UIFe z2$^pxE|(?%)b!jw?d;<{h3Ri4D;1ESzy_ZO&7C zM&vy9@a7v8&jixY=)&GeLRC2ScWu_{g4eNVc7$AV!)NePF)$)iiQt%cyK14odsH9o z>uN{sMDFomW^^O;X!-4KoPC)2Bd!GzOf{w3CVjXCsPuXt2(?gzWc7h_z_M|QLgtHRXu_;#uTm%T~Hk2L= zQe(iEa&cX2qWw&&5?}h-*{EH`X)S)Vy+V2P^6T%&A>{V2Bah=cD%x4yk^(LIje*sK zkvM}1nH!6$Tc6{&4f^3;PfnbACgDyiUuC;TNoD2Q?cl_J8DrsB^7@6^Swc3 z{e#=ZH?~5JV?L|-)`qNA<&O^K@L!|GyeM)@($zhFk~#Y#o^)}rDP*#-@a3cZk{EIU zA4dOlLI-k7qxVd}D%*)tEo6FB%%&$^C=hvz>Wlj7Df@Wh&&I-)k5V2|^E8M;d^Qu| zFEDUl%(hmBVAhAvHc|Nn>B%PHq=c>F+@5l{Znm5DJTPyQUqH11ezV(u?C|Z4ZR3E! zmxE7EHyaRoMtP}k4`otNn6#U!(X^f;9rTAKtc6@CgAtK(8}GgdX_V6U4yzNHnkV01 zl{A03_^^6G&tbzO1j6vC?#~nSEk>Kon3CdudEbMl>6R5Z9A8exfRY-Z>;}(1+lWg4 zCY=jUoRY6_Iw^4-WvC^d`ZeU#0oZ8%u;G{9)k|0l0344L;=0|OG0Dz8>Nx*~MlC9~ z9jWpn=&5pfrNW>4l2Y(p#?dd-gd>5NEsCtfB9)4#b$Y?$b*s%#^V%L%x%y%S`72c* zpVm0?r$7zJ1(F)PWJ%_zH#u=oCuVJRH;ccE-l%xP?P5R@G=9qzOTX?{eI|6V8b^wr z{g3B}M^%SUk4?*B(PF2XV--KWJ|cj(Dx9*k{-!6;tDX{+A$poFwT(~Ebv@1&ER0MX zAfmf2_{NmpCYCaF+^{L<#c$bU4$Z@;)i9)W8*Y8SX@3{cNR8i`*d#o!vldI<`jO0j zf7kv&bA{JoiVHbGYK-ZGp^jdS)B^Vq`Y^T*?`w~>hZTQ@jN?ENKLMuN+FE!Zk$+Sp zF2Ag{*@gmlMK~2lU7}O?8;6ft2gn0DK$pzWXSDg>oFXYJ{OD~NC;B*gM18+vUKanF zyoDQz$sUE2UNHV`BsLD<%yU!EVXB13|52x^TdIlFpxW(4<0xk1zjqH=r~j1!{-4bv zXZioE6A+1=M<{cptWAgQ-3{nySu$GsX{As5@%D+%*g}FCUXk?QQOkrZv6wzcHJ#81nT1}(%elso(`?Ys=6mmGj=eblht-MQ0 zoE7S<>bnPR?V)C9ZDey0)K1x-q4D_A;j%?@H*P`vE9*;-Hpvy>+%U%lIGU!hbT;`s z+vn@dFRj-qb))EF!o*anp39`h&@7{%AA2)=&;9MH9tw`+W9a$)L>|?=nTeR<4G+)+ zYkMf6r>&}nI;XAobyYa9wJ|*yA*{uX=l{5P>A|JoEibe5h{~e`kL5zrSZ$j2u~x(f zW81&UI!_f+TRpEo+BJwdj0)oK+k5dhS+7vcRo33bm#V?q`M0jgaFw+DTQ|O&Gw1!=BjEi1q-x$!W`e$F@ym|;?y%Bp*q#7smUNDC-H$@O zj?h0pqiKdA*mf|kq2u6bu11@M%aPo0qP^*LnIyr}T%Q3DD8d1T+L1DrUfp~E6g0Gn9lKNXuUZYyALWYZwPown^I zJvHU8=~SvRx3+tgxu$H1*$k-xkgL$H->iw!Cw#iQ4i2?l+Pm&DxM~RMY(6x4x&FTE zot@``#M-qS8bEi5al3(|mqt)0+&T4xwbDUtNTvSt$zILSO|Ch`xJ!iEkFyN}^Gt-L zQw9brJZ)I70-R#%G^gSvprY2ID9#{E(=Pa}Y;lD7;OrulMSb;spe~qQj{qk?G)tDl z%DATA<=O={S)=KLy;uX1kTPvq3z&_l>Df@Cd5I}tTNd|>up}Pfbhixy86&^ee+R7> z$4g&~y2(-l5I#qpy8-k!&u>1*?{ZYN7(p&){dS4;0}(%c&Y+!6cat`=0!)Rg2*}aV z#cewbKA;?gXaq^$!KV)q2bTn5p%+-NUEZrpxsGgn>nT-AHQ?bC4IT@wg&hng+|iZVhEUf=buC2>8LOwx?%p2Nb>F6SJ z3~k#J*|`(lk)15+6b1RxZe>7rsTX3-AFJ3z{VjY3%Fc-Xy=sN;+kX@?6HEwr{X9}*Qhrh$AsW6wF}jE(LafiAadhKQB$4<5Az&nex-j6q z?%l>Wh%|r5#YVSCju-~k7cQ*rBF8dVOkM23(Sqr|w&GoSwKrM2kjJ@p=97H`|2>yg z_2_q-V#Mr*qkuic!418~E?)i8Jd=jP;-AsldssNHm+Pl%<*?yG4OqSsx2&SIZ2F=k z5mWb%k{yF#uriz@D9#I!y!R}T=>Wcb2s(g|7OgW5`L70j!fy9MI9)=$5Y;@i$gVIV zcc>PwUvc2?uPOAWm6Sb_7Mp&j;cKhyoQX%kUsgkdS64g?;9r10qB+1DPSmPuU=K;OPgSiE}O32Yvn# zzPwhNZgbLBOGTojJ z^STKMME8|M>iM^aH1FfC`e+f3yA*f9PXLuFsg|j+Z%G19$`ATH1WE(WblF^&&zjpB39pJx_Yj?_ zEIV?Po15R_Qe&lSj;-RoBm-&i64e%#W}6sQtad5HuU62VF7?{E4bM@-OW1w{u5Quh z>Zp1yeI{U~dHFaqCu&SwIMV1qW5~gbgZ(pc37a{~bKavx8kX&$@aoD+jkxltytVEQ z3-^yJKbS}l?lQj@S5|(1Rs2u6W_YA75dPLTwz$|=Df(a1H}u-mHzvDWF)_brpXEI9 z3PC$f7%R->g1M_EE-wQ>SlQo+am`H=_^J8RdN>i^K6* zH(!A06@Njc`;Y3?Kh#*D>(ZR$4imS}?2G*Cuqi zptDywUltzF@?{nI%P{WOY4`4H^8}=E1&+m7F&!Gh4G~}KzZe62s!oe~WjjoRBA3Dy z>B~r~g}zSD-k9tGkh|08(w)qA=5B;M6l-Q)Mbk=l3J&9rXTZH$W55BDNgpMLbsU09 zXH8BOkoE?+Fs7*44u_nBYe25y&prOnR3d}#9jOMC&^iDwr6Sr~$3SMq0c1DNHA?Ru zadgtA4!6PECWJ3plEa@+?}i756%y$W8tI@tG2Qz1z{--wUl@y^{kMX0Jg&wa+ZDxU z=OUP635|A-jzR=EyP#kMKcr48@4&ekqo|fPp`Cl6%PKpEAj* z;1lQ#eOpL^XCUos+A?E6K0a3dC+yF6+sYTb7{aE)CWP^#e#og}X44lVo=}tR z8>eo_W?+aMvk$$ceoSVG`sp%vIxUc^^A ztSDZ0W9nVActZ_+U#nqPIcmCyRnRY!#}zmVnCB@i=vf1MfuPefH}pL8tuv?nRPXJ0 z_d}6(Svg|sPxvwzrMe8*X^!yje(m;VQd~q@p=?dIx(s6#1TtGHw(vEmSnM3fi zdL%Zk_6O2WYDc8`9Wc!OWy$yrnxOOtmrA#=qRXh?hTrZLfDOn*1Ki0>Gv0?et*(?c zKQWyrBwoi;+Ux)75YTZNHk7%Cd~7eV^9AD)3f*ovp#j{uagZOhd1s9K0BDV)+n=tb1_D1NQQT7%heIn7LKhHKD2mnIqDYzg<1oZrmkbnLuJ(j

HT^R!h@b1NG}zbx8q z$mH@1dYBlc9X&rGF@3a%ii;llV%CbsFxJJ#_L>J47L`KDKJ(|wQcvNO$I|G+O~Gc- zIcP>RiZ#3F$v81Afi{U2@8QeLPRDA5KAi!A<3DO8%|1Ab+ThULiNTkbXB(Gq#Of~k z1JC8N0kqkCY8eT`6<9JR=8>P7=MR8BhN#bR3e@!X`YUxU?8{E9Tjnjp_dUI;jaeYF zn`#>dA5f#DJ(;SexnE9=L!KO@(5N^I=kp6Sr+&=&wO|BXup4V2BYW#UBqlq=685ax z!lxSJd9W4Zmo|A8wowD%l{&%KkyQLuV|?Y21_%1e*(@ur7laEqFT@c!c-A!^qcRZe zX!#5mv_oF7OcJ}mtWr*g=^E+sNPUM56Qt7&Q>w)T3DW$2GW?I)kgMJ^-o|@(0r_@5 zB-(*@HMJHLDxYC|E0Z_C>F_wDPJ_?@F>A@|z9|p9drSEnz5Yn12?SD&5tLTf&S}+~1HR78&{tshMAY78yikpl zy?2U4KJm~25?Ll?^}8v%*Y8G(qtc1kp8d>obK|5yB1(`t3FW9kT+Z#4@3uSvvV=xH z>Rgr9mKu|^c=>B>Pbt$H!N4CJm7_YE$P%uuyfuv=8;P~k6VtliWx*;g`hLb0Yi_((nl-2@ zVdhTZ>WLPs6wf_;vR91q94F&>JinRF+e>PXNtMSiu(FJEtqh95=Y~^Vm1j&vD?6-S zLrgS*qsdCe0ZTOhYU0G z0i3(yH)Jg2DB9GBWmxShVh^ej80^7QTqBjX7>K}onZAvOjIx~WoIn7`QNhJ6OF|5W zH`a8`;aFFRi`#othDIph;L_w41`b4|%Q6<;H<}0WKI78hMk&Q`x@$ejao8;6otAn9 zD0qW>16%wr@tcepN2Nr$+hfIB$2{q6^%mCeFwbvG%)Ky%^)sKH6?RH~E^*-x_Tj&e zA3a=;Elxdm{naPov2C~c=6Hh^@r0AMccY2m+t!5|b)A#MBeg--(F5{%Q(h7aF9VF6 zBK5txbg&Dk;E^I1zpg1Sg@J#5S_a^NtRYo*=p2h7GZ%+%8B=Z#uzHMKX!hwODaDd{ zObPj4r#CpjkR|tnp9eF<3vs;u3QLiiW*J5f`*zfF6B*%<&y3Xp>P9yCUaFB_XtZV( z0D)E9e_)}>-dpHIPqbF9#RxI6@$Ev>!Qw!CV!;-v^vcwM$1fq?&* z;d3zGrATZc+%#c)G$41D2 z5sV7dSmHwBtH`RII2(%{#&=dB!g$6ddGUeIQ=$v;tQ>Tv9^jo_hgQY%&uQm|keL=v z(pws*6=gt3fGB7IaE85NyvDimLJW$XQ!IUQtI9HA46bgO0_mYPRynRlHd|E8n>*PB z1xou*FJ*Cgr?v?ixJR_qoE{nk1xo>vJYPi^*#GA({)2Z^(p$Jb(nzWePFay+adltg zQmNK+kD%5lv3K#%TIj3^w>pl3c1CuolvqBVoAxo!Zc7c;5dX%Z7j0DWToiCY7dROJ z%2kgj`%rkm#lQ+66^-f4hDtmPI@nd4VmnRizz7yg5oy9&`~{ng+3dzl9wn_2ANtcz5DbDbi6xgACI>Y9*JlB?!|i=G2|jKLo(>SEAmXd z*s~e+J1R3**~Oa2PPYZ=pBm%v?tMIt!uz7aO?n(>80heInfIBW$@m!D3}cS&BR(w< z4!%JGMpIZLq^~yMq!if)H?w$n$}06(6>?blm*#fYiLJJ<+T38&B}!9!7y;!}N7&Ej z9#b{arJrE%s=<{R@iuV&4q6AAx`FmV&+b$(_zfo-Qy5zGm?NF3LDmmV5S0V4L>7th z^IxD*iFcoc*&_l3Y<8)*+p1z|M1#1qpJ*AH6CW~Vk%Cn`8kZ)x-~C2aTo>#rQ=#~6 z>QdY7kZ);iY+}}YVy+|Xh^u3mtQBtweXNA)!a`>9W4`QrFL@8Z4<8b~dT0kW@vgGSXXWw>y+B@T{pS*GvC*^k zxHulezR!}@k$YxkDX(sQZ;v$p`cTHiOicO{*n2`vrHg*90(qF2%=wpLNGqi@ z^BQbaVKHf-S0bs|Ul)3nMdC-mSC;C>!2g8#xPBMFBw#(>({^>DuOp5fFlxk-K5gXW z*0k&>kTAhK5s)EDU;Fawa_)|oiaF2gIw!H71jS&U`Cmp&S8kCeN%u~%#K>YGO$*R@ z!;XBD>}Q0ude4O#_IP6EBpvBQhzKN{Cg9x_BO1@6sUO?iHA}HR7o6$-?ZZ8C6FyIU z?Se88830;y1H_(@O<=mmeoEyIF>KxGUE95(PKMHd4|qSRwcd&T-Io0Qna_G8UWcFz zHR2u?+9)Hg6#%J@oNqB>abDGxW@6gjV~mjV!BG|yO7=T;J23sxWj+y>`buxgJE}j6 z91j6GUrv{GlOm_mfi;~ z+TV_dGSVJ%(wBJSn?jE$GH^6Q+NsDljNo!$v`9s z2rz`R?bQaAsrQ;uI0;5rblC{VfAccFwF(Iv(PNXu#LIurYj~G|SU~)kC#j)$k&g64 z?me<)7|Zu}qB8P^@qTy|5ZK#5%B6)ru0PV>?;>M30o}%9;!*st1xZ7W5-)B;FXL|> z@HtI&tpY|n-<;0gi<-1VeV|1`IztK?5%HvEeGIxwhakMxGBKD=< zVengrfw83-X2G$Xt-QA^!$6Cz@iLMH@o#;Sib`EQAH4fa zYR%SK*w-BGB`Ua=Uy?)U0K#*o*4&uk+p>|eANG1>&GULh<95#|xG(k9+ZssWddU<; zP(%NuikwEU1Q)*PuaA=-SU93R=Qi4vQ1;5kG(M+Iq!Muj?jhW&%TAGD(x?qJ0{JyiV6PjkdgL3eLI2jj&~78qGHAEZLyj8Y2m5qCH=H(H zggz_&sh!9nHI?Z8WKf5fR9#yx%#qTe@L+gMi5!H;N#B@lVnw=C*&U}q_v4p0NleIa zO#sho63pkJ%T?ZlnqceubYn6{RA9UtVKbSNw>6QMdsq;O#n*~9{Pc^5*OElnPa2pD z4P^2TchvXcEmYaSa-{{hV;)deG)oGDY4L2?Ky6p%mD8c)fTG?arl^7$PX3 z(x?5Fd9?`ijV+q*PLss-zZ3nsT`GRq!7-jAq(j}%7gjclVFMR3cJHU%9oRcmxm*z? zcIrk%d<0yRBVT7cumgx?pwxV49S!_8GFmFMU@Yv^(ywZ__3>8FMU7L6k?R&%QPDrh zV;y}*Fe**ul#O~XO5HA?dN90~KXY+CG{RX!S z2)RvdLQlkGdkOMF7*cH0cO*970@@MHw}=M;2#_i>gzsxBvd=b0FQTOpl!Npg(+P=1 zTf-iPRG5#_qD`_V`uiFZUOg;ZFUJibCf;5fwv=cZ)2$LX*Cujl7^P{{ea2XYSu&J= z&Z&%?xC7J&@9Q>E9{rk)oCZE-hG03hhBbcDzS++=#1nmmUzYW((xeAP?X^wW*|20Y zRyx2Xi9jI+MtywLdDP{xOxwH{or!aC%rsi6FQ7QzXoPUMR>G9%$#6MD z?t-X)@HIe;h6c97J2;fdkMX~8*tAsDd{W)b+-;S#9R*dqm{~Z19!bb?zApHj78snr zocjHy;J)<61ayj5uN&}L`v$|;S<`n9kpED{a1Q{R5a`oBN47w|(<-@JjqqWA>Qs$5 z7oQ|lo3CImGb!A@C~byse@X&2!omMd!|6@p%J&Y#v^=Yctv2%2(F4VR>Lab>&Z$H~!kjwm*6`oV1@YYm2h+DCUiTeLYl7 z_KXRCXl8c=(|&NK%n2TEV6bKK$7{4*fUih?!mj>a3bS>0X7hjMH*FujL;SMNF)C|( znuBgO@_9G|^-7|Zf3_tE*0g+fC++!Zb7l;{y>;vjJ=8lOAvnJqU03@aaUt#0)@X7A zk(FN2S5wYqk??VD+x~9YNFWu^YE#O>6&`#M_%;7-{Jr}t@h z@#B;r2!wB<2%YA^D~JyvK`ZD7a+D=bV$(I6AHoE4GW=&cJiwhI4o(~rw@Z48)*b1A zX^;YfYNA9d_?K>dyJPWHQz`QsxQJ3~vJ7Yu^?z*hj>vtqe25>F{(e|7Y_E$@f z`1*{n2|_-f6b~(&++&5{iNb)=U#y~%gmPoyzZojod1C$o1ZV$WyW+Yz5B?Rq=upka zw_O(X89{O?r}+AM@C#yiP-`>Fv%yHpAcsJ{292(e^Pp(2-8$5mNf`BI{yR~Aox^Zd zI>!+bdX@R+b=)#u&YD2M*CQ4do$U0zS31Hgbu=i6a;fIkhh5XoKiB=r(W{@$hU%+^CWa>}1f>AehJa%nz0rW{O|_{g)#BoL*C4-FP!*fO1z@af3ck?PYGa-4ICot;8 zj^XBvZf9#$DBVpC5q5f}s|r9q0raA}B-6=6CgLXa3XUTMM!8 zwwdnr7xo;>PWFts0E%orT;#0BwUP_Leiq-*5esZ~TdGdNBx>MII zr)pj*#{R6NgkOB55LN2kafRtF#j@iIZ@L5(I%|VTs($%fV4U6PnW}QE)rsCk_#uhd z9AO&DaP|Ly1DoyN8!uAc>b_lG!QE<}<3kTgoDjet&c$N$Ns>Qgb^wlE<8Pa=toA3~ zERsHTCul|tuMbfl2s@b!nmmBM=(O2-X*bcgpu$zEX9drWocnC^9`8<{p<7u^P;qUwf3a0!b61VpH+5!*62~ zKdi!Z3HrHEj-=zNG^n{xy`U$Jrh zily=zN+C0RGnqd-V!x%d)>7sg3enRss8n)PAk| zaA30@tYIDgjj1il+d%oZf0up`j0ct3eki{Ai{>4v2rj|_PyCA%9xE+~mQlPO{p&9Z zISo~39zbpSxBU5ET=k~A|E>ua7*tzO;?+MW>0Ago0aG@r{K|iD-;1UV5zQozG_@!qE&s7hu?%CqLq zU)t}#-6Q)$5YIZ86M~!?RnA$?ZV6v=wP{3+lx|8Sd03OQyGl)m^c=qMS1!iojFU)yYUT9gqCQ62=>&5DKks8d>M+NG@NCUsh1#H=#ZwH3 zxo688!|}HlNS3n!qwaZ>en@b|pjnda-pm|pnIpix_5t`ovT$;PB=E}nyQfXtc0S+- zTIFa(_7%!!8)ouL3&nSvT;3*BioL<5v?$svL;9=(4TfprygPt{i2kY`UqBP0Gb#&1L}4;&xhIt9lVdMNdDqqZ-UOH&%(W6 z*JVg7m74Oo_MCx}kjYZ}+hB+AwT(<9h5H_-nj(i>ZDhWn1~^()DiPSH4eTDSe(7$M zDS27yc<)FM+#s(ZY1SKw@pv?B_SH=}wfpx1PmyasdTr;8D*JiPtU2!Bl>om5rc^{s z^y#ar&EnL32=_g+x)Z$r5zh~1tOvo}O!w+JDUhjZ=TC9+7clw&cYE!s_)ki;m?A;G z6Z=6jvs=8EjAQo3Ox22-cqh!ZISu^sb6Qhu@#{J|cLE3jlEbW@>Cd?V^`EV_TUc4z z9o~4W?rv>xOJS0M-LNf~fm)!G**j08LbWz)t!#qVn)0O1unS!VY~LU^YQ?1fYvj)P z4u@EAM%o6NMMe+$;Cu0KRNVV_SOJaEl7u54>a?o9Xk&r&yKRJ5RXSjF9H6Pj)oAJa z-TjSnET`~y2uEbrX|IvwV~F%6{5JLO3o?TySEGl4JRBpg$-ZY4L_>L7@YIN&BIZ@o zAS2@I*4RsT>q$jd{X2)JT<4`_RnoS5C$X(kZZ+HsTZge#a!3UCF zzNY6DYlcH_q!I9efNy@-&g8hu(1L@T%ddNv-Cl^^+O7q}X6Doe{L$hg;xO?_i+<7 zKuGTi*T%k@EIJzF8>9#q0L-ur5$t0(?8Z@wMVF+j0vd{B$BG*F4MjPA(mTUbr*EPY zMeEON2v-PCh|rg2!U|m6pC;thNLr|j?$$U7LJR}iHm_ni`E#t}zDMCe6lPBIFO6!| zV_&)Vqe`ZKl=Rc^U4ys!8d1@owct$@$8x7It7n;74b-UOg9#d0(;H(}Uk`QM9{SBV z`|YQ5ckags+DyzMW%ljpt@soASRzhJc*{9_E3=&oZZYWFkvq6nwLe z>Br&TJKl-vSbz;fU*}B}e5v0-XAxjTCfz8KmxAiCqAy^R4$qv7`Kf5mDIDle1zI$x z5;&y$bY;N8!9mLyK^3KMS#@`Gb>Us6#?z`BDJWV?ZsHN>`w(sw>Bwoqk^b7a*UK`2 z6y)(ckc$(!C&791XGK#j_ut z;OP)Umu8)t(*i^YjRcblw_f1H$J^QRT0gnA^94{vI&WA0?NxYds=<9 zzgg}4=E773SLxdm0+vA5cS`0~jY2b|1%Mux*+}UdzBio?C43sQ*V!1^jQytpA^$j|gtrw5V*@ z9n?B^iNsMYs z%97Fs%1J%o&9S}pSxiai_B_?_ZAfaMAk}#) z5PlcUu^H7k)Y!YzC{Vog9^U*taL|L4xmbSwk=wOQw?XcVP9|~*_8S+PReRUr>^n>5 zqKrIe6Vh}$J%q^fUQPerv1vH#)C~QkR1;Y?tYL@Xu_%U(XJIFknUZhNM-J!1y3W#9 zFt64SKe`HDE<1m1T&e@V_bI@_xRiWeH}g#=%s39pWzs*QQ6I2f*E`DyeXcu5-wMYU zb438J_e{WCQZmg{{YBXAX2%5Zg`(Z%NV-EwO%Azl`@u<)i^(E>1qnC<=U{+>?=t>! zg^bl%t$8_i$PkAE0`1mJXAl5bCRyZ}SzM{uhrrhP7L1;=G`t4fn zRY$5S&i({DW;nN=X8`9?)XGPBx|Ho2#1VJ6Gk#LPAJYRgB-VG%wBrJ3)aX_HH{;yk zEG{QveQ})mwUhJ9&N0Go$3aEJv^nl0F><&L$uM)8sO4g+ z#zb$;=JYDeSR8S1*9;fA^8HkEuKvjpclVqJ>HoMP4^S~Lobn9ye47f)v*pQ?5*#iR z)+rZE52e==o5m@)TWIiHc=lL$nALrDhTwZOQqa$D#Y#m^EiCelY6Ca&<{WB}IGD@!a|cbZ}CZ@fVw6<4Z*11J&oqO0U4ietA;46w*hc z8T6uB&Jy6MXQ>b+TOB%nc0>;&x#4%Vb}7nh$HF+xnG)|S$Uf^{fR*x{D3b`g&1N)5 z5&V!j{3lACsE1be=J*KI9Ami)knDGktxQLMp-*IPLS(2H>KUac0DW?#tb=Ap&)$noqayE=6}yFNBmR#i|Kzx@~^EcVwTsS;Z2xCfe!p_6H5p| zBkM5hc%syUYgPe6!Gbr&B9wQzdq*xWKeo0}R#BaBtiGvHK31BjS zhjUhY@&a@{>>rY}%l*j@W#46kJ;M?8(i~q4-`VlQtixOgnS5n+QMfx%w0Tl!(n$o< zi9n1STIYqoEVT7$x9T7?8kdSr8pw966z>#s2-OKFHH?+ij5keksT({e5RrE<=}R~S zd{0FXy8iKA?X5}AR)^XBgE2J6w<$;Z!0Z1KFtl0G(@pbkyu|fCI%Pn&@DX@r!jl<- z(?)+S>@3~up(MOF+UF1)o*>aQFD11vy$*qlk)hX@aiXG!8*mL+_$-T*_v_Won_jQK zu8+QY2$-nDpj+&IPk=(Sd)_$>tCW-Y8@h^}t?T#fNUYA=KDu?(0Q45)2h!Cf{AO}x zHQ7>qJiE6yB>I1-oL57j=Tr?Oer4z1fZb|bEV=84TkPMvNDL9ne=$V=Yp=1;Ql6Q< z`|IIb1Y3qpntJt*i@}^Ho_*SWPhvog9?_at48jxM5B9Ocw>}P!a#A_C{gU$?l$lO0 z5jP2RiTa`uImJ|3p~`@Dcl+Y%hDC^WR*qF8*k%Qj>}JK7T@0mu8980H{s@NsFM=oM zeX|n%VI$kyDX~Y zssclO26>6;tsYU{KP+ESd<9u&tHVk~TvuN2Lv=#3aP$He7d%aiP6&~J3pQ>2Xu*8# zOzaQNqoKkQMd5RgiRJJT{f_Mv-@B@owI;6748p6lwq|ap#I@3K+tNHV7DR~XKuRwX z#Y(3fB*}Ode2@6OrB6;KKL{@YneNQv`@?{u@5OlDUdurwvxmJ0;^nASh10J{HjVpi zzVxZF=NsZD*{XvS_zQjHMpnn-p}}7vgSuALn8?WQp%lo7Q}!cV&kH7Hw{Dj}j!th5 z*C%PD$zRUXoMxn|(a1NJnN$a!ytW8ETCvrP$15)fYK<-P?(@&V9n(B!tkO0u*;I4| z@%Q9zM@O6@xC75@-icev{LX&&;+_kcQ`4^{#w%?Of61`y&-`C%O>>>j zvv=&|I4fO0N__F?qtRJ$&9B#&0m@kAi~ev>nbmc*jJf@0cESzHW`WM#=h9?Ca@VHj zY(a98veY__b=xIg4zcg4x1TvEDtfN0X@KLze>p3j6r#U?0TZ?>%`bvuezu&a8rL!p z>!1(Sgl1T7HIdXP9?Qu*wmtVI5enD*U8J08zh7sjg$qr~Pkzv`ApHg&7%Xl_stNeU zGpE!G6VpxsBdLq@)e}QRf|9>+T*_~ zWTda(>e{^4ZDVci9D0rW(p^D5hz*IBKBZ?4YYk)aM`DkB#%Npzo+gl*^~lt3!BcfA0uqsbo{;16QTLiibye=rrzShe(o`t7;Z$c&Qb7Qj0M3DdJ>pSh z$WH;SYRV{(-(o*tYMXZbW>b*ZM9P6nL& zYv9$0S`(45kNyI*2n7K2?F`jf)6|@KsVa1Yk(wa+09lRn`J0HQ(-f)2`o9o#oIW^4 z{(-fK#`%IXvi>mD)7dg(?6^uHP8s#nji-L>nX=uqd)&gfA7nvMmU0~*Oy8(uEc8j4 ztvJJ;KehgJ2q{d)cIbFlQ9{Zjvh~g7rku z84LG}-)vnvjAyH>^-U$bz(KgjhStchxn0Vi6qNl)P~K(s=7;WGF53h}T5{paJ>QY$ z$M$`jo0l zECJCaC(+|tDit;Lc6*SX*xB7|8}I|?FGEEx3p%U#b3q_$@qF*ha-dWihH|Xy+Zhic zTPx0n{j{7Tz5_SMvLf7u1oMW0bxDaYf%q7)x&d!Z$Y$6LVLn0meA0*d*Qo3}HJJ78 z;ulKiA*EbF_?p)vIs6VVbO~jl#yl5@D`KYvAekZI|4@o{vSuW)^j^D3Li#e#<)Vr$ zHGd(6>q!}G-m2sIAby5qK!;E((X;y?MozWvVTG+L3Iyo%wSWMtivuUNaqNCW9_f@{ zdL;&e+HPH_{4A$>G-<>qEYZnfZ%}RyDNmCdqy>HItG|E755%1jO8YiZ#Xgm1YE!Rv zYyYobLfdoa^L-*=Y7gY*dAH3jY{oJpQ`a7{K10f5{U>!48h~%nLD?V}F&%OF0?bn& z&RJ{oXa%KIl+g28bEGng_Ecp^Vv9kMuP6=Vo{~&qc+}G*eKc`;V^=S! z&16BBjMF_3)?1LjHvL9&@$gOC`WHFJxV14=k_okt<`?wvQ+s2Ij7DqP?R7puO{Ob$ zH>E#vzSrcAbHm%$^icDNICNh-kAcM0Sev1kY2GnbW2O{BLjSxMh?8bgAjCwJ*_(i#<7#zccu*Zr`{tnq)rk&*5BzDXF0X-XwZWmS2cIvwnY}5 zcs>yi(U-8Ctn?V@OS35(33Nhv+~GX)kx^m|vwH9L4BWXGRTpwiuATc_LE;o7(DNu| zz<1&B>R*O4^YS|fxtHw^#|4Mw8kmqLWVKF%&SPTakNLePU*sjcH+K9XVtqRAf#skp zwH+5wS*H%BC;!b1-J5SgPr)TY1UA;;{<-oY!6xR^4~D!|5mrvQ?Z-*U zbebW*D$`;aRLGzK0Bq({jT&$<1xF_Hj3bk6=}N6@YME1;y%l|z@93*VElEG{bunU8 zqF-qsY_CLoDNsZBZz}VK6VC=ZPSyA4t*i?}384E&8qPB}H@Du0e7LD|F}+7pc|k|2 z7wqzl@ohwG-0={YC`EY4M$t(&;0!*sJ=Y=VP3#r%DO9noQ>1<8WJ7yA1|w*C7ZM^-mpEyR zye7<;nYU=-c*GA#3B*=_OPPoe%hqeoW<%GqHf5~)U<1FHimlQxTEj!vO4|U}ruV{M z!b|I&I^@<8Cbm9d(jbHpXDsdWi(zh7lR>2jaRWBBdV}B`DeJxL;|di1rem8Xn}Mw3 zj1?BUvRSMlzQ8SeuCm4E6QvYL*QqVULiy@xXY}=ojt?oY`NNTJR{}d>uZgY%gvZ+X zvoFusa#dDD9oo({7w=!NXJd^O07_Wz>`* zo&5qxaYwt97KS5baeL{#pi&3lg2z=rGVkVmMyF1d*!+L26jMR9TLO=d3)IU$FY_`m z917AA&syOtVDg2`RO7u2+k4TWQ8An0N&KC9h$Dc(u#hl8I^yD4Ak~^i+rg~!{S${86pP-AS7?>^^C25TXe?8vY%Rq})}QE9~E~m}Q#|e9uKG1mM#E zHSq<1_e8%#)e%#k7~|KPFCAEBepE6LcC-#1nbLEJN?L-k`rF^$N|$|t;TDciha(gu zn!AlCL?4RHlP!z^op2k45n?-@{?`6u^RF!dQzMLd^e^4KM>?LjU9ABK%fU7bE`Qdh zVuIx{-!ifLG4S!4miNw~BzQUP-HDf?ab&Tr+a`f5Vuqhq&D@U;QPnDema3!yc~beQCW_B^h4b%F2EgHJM5xjCCyE ztZ{jx!tb6FJ*~p$Krnw;PGY+XioX5m=33r z4p4?BXvg~W3VE^S<(LY(^2Laz(#k!1KU$8eMh#96xa)!b_)TwxCIkM(SRDN}N1Ev} zw$#k~mC;6ddi=2?O;Wu3_~zNAj?{?~=+)E4*^4~6pIIaR>qBq+H`ipfysr1FLeX38s2BVt$kFD3#{q%E9;3 zkbLTm7w6$wSkOVISK%I|@q%P0w>AE_5;lbZ#k8(Nc`$^!1te+rF(dYZi2Xi(h!><0J>S2v3}>HBR4LM$0_TnR-6r z+HanJ!sQ%k4``Md)UWGr7F(Owzb63`+myDv(V|GA7kmeU<}lF0HyA+HhNbtBM*xk? z^$f_evq8+@3n)bM;(4l43rm2WSOf;HNPRd& zS!#Ql8Y!b*Z#42&Y4%eE|2UUir_#kzI7CesdqsN|dh*V@_Aw<{$QQ@LsYha*4eOaL z#|3~2+k)jjX|Tq`{%`xe*knNrSv+!)dO)KK3T?kf)x(&lb>@ zZHB1tvo%TTh9{L$^-D$uEg{pm+QAgD7Bm@&o{hAN8ACJR$82cEx90*JLoh!b{85W zj>WB5mNi2_;l-Augtbo3g4aUMV*SbK#W(fiCa05)<37RNVBbn2)4|K-!nXZ{>WiK{ zx8UCbST4tA^NVfbrMZ7%xUbvO#6MS=qC8CgV>MvAllcGp5dJ@Il6X3R6h8DCGdhns zC5=1X!(ShIF`K?Pq0ea4fi)(V-FUd?-~f$~$Li#CgON*_^Vw*; zh!3M&*t3|Wt_o8R9vaNg?cjwLiydeGp`j;MZvV>&5a*7!7f#^&W9qL*3dxBLzKXns z3AYu`u@R>me?EEMWW?$VNRv{IaSYJYW+o8{F7p$r`@Kl(O%w75%~B6Pjmkod_iJ@C zVtdsg{GZ968dE821o|^N*EN4)!_qD|*{ykZZhXaa) zpU(uuGd};;PdEknWSwsn#;HdQcCElcrU4qhNAKs1zH>PJ_Us2JHF0usxTflmLr1tE zriR)<$KVip7=b96asO28)qd3R^$ybt{7iOV)h{rbdeigL8NL$>BZk$y3aDL$Z_4dU zqW7B?W2HWA(syg2ck_r(W!apOgOFLRz)U$}`N%(prgp!vmPCF3;f8U_SV_jDm=T@G zTFRd5xL4`7rV^($x*urKnH(5bMEwmt1)){ciW@Y6`;+Nr)$W>ncJoIUNusk>@_86w z4S|V)RLJeRx07bkTDC)uje>t(;TuMz_+_D1_BHFDo?@a**r44Jl0~`P9}?;fiNyp2 zi~C348^f+*yjGOzu)LrMPX=g_mnJDxob}=~F~MKPjYwzck>D|GSZbN*tXP#5VBx0@ z1BXRGqNF1SW{yt4!peNM0AIT~exs^MV+t&&#yfMqe+r5a%>Q@~n`c4(&^XgZB*$}7 z()O%FE+}&J7QP9oI-<5|e)yJ>FFT1nRz@n|MKoa!S^ofgZ2?a^_B-0-*05kuSS0ju{ZpbM;-U99A%`TK^Mbjx zzsb332y++QTaw)Qbxk$46nuh!{cV)C!=GR`PC{{0Ohg_l5c zZ^ox6a5}!@8(D3bcT7&vWHg6@f|UY?^nmRCA_pdvOr-TjWLNEoTt@ohcGX-dd@05u zW-h|{9{8h`8&cS-|Q zEXMuP|8b57lE?BFh&a8!4DRlS`))bsUE%}LWL!Z15r~@@#^ey+8PKnfJs6h@?CNS9K+nGUaj0rBx$`hI;Mjlgen0%scmEPp zNvTvMbHp|Wzb*&6T-DW7=e6X!mm$tPTeGR-Ns?e`PcM}XtGL{dm^=}L(W3m!hCmm= z#{iO4Ixb@I0^IpF{;pFZ(^_#WCz`jO#DL3*5$!+8v%R1{?JCXDI{8-#pfFNiE$R^s zA$Yp!{9-Bi7i9{ELi_i@3*Geg|2j%y;3P-MDyj`ohi^y~1<U>D0#|bKH|K$(i=|1&Ko!FqD-5w$tLTKA@c>3)SAKsOO zyTgqpUNRs5nTDWF4P*hl3J=W;t0s^%sV28h$x2Wn`)*D~SW1GBmJGWd*DPX6BB+mU z#8_MtzjNPYOej)(7WK&)R!FKGOCWd+I{UN+0_%_bZ|NQU5no7zpqQw$ zr%NmuBFKcUa_I^u0-lq;_fzu>^ep#);s9iC%6pw$X6o2yRcC|uu%~Msc1cYN>xE&5 zS`?FJ`zfcN*oSAvbBQ9ATyYV63)`nC2qMQ;frP{XMMA^}-hSSbl{4u11}&xC%@Qzi z8-E-`Y572nD}MLxpc~KOm8BYJn=pYO#^)DI?c#z}_bA#d!j@oU2@m`YIFGY_aKL&2uwawig|jc|gCCGdA>0UB*O$ zlA5UY!6KThzGrSRL!g718Y2nl3i457bb|cV&yL4OUfa%4(PO}F<;Ar{Bbf$+TXASJ zKJbIpA+mrt$-_3)lwz|})`1(DBD)Q+cMW(@N)YR}br~C9k)MWsx^MF&v4uT0|ottvn``S+iV1^X&M_IP8 z_}p^s6FGKA+dw`r`Yj3QQpn)4(9+>htsQ=Z@h}vg>6SZbN~wnUogGAO>))K@9BAJ` zz|~~JTw8Zy+h7EE+mb$-!8^-fd*k1it>2v>ZDNJ|SkYHukBTk=eE*cpUSDZZ+oAug?GXZSSlLakvCm z>CCL34CnOO!agq}n2+Q(vmdt?o1v%1Y4x1(1y)e5d@N_N6W8^3M2F?GG}Dls4__wFOYN&w&Imi5 z9=+O1mgw(yKJ*Z70f*hGi(NhP{?^MG2LGsuOMmQ zvcZpBQ(-FF0elstHnWcoYGec&PYd~#{LkjL$3H#+4r?B0$|(|0;vJ(_nL93X_LXb8 zd#>4DFj!}2Xr5!WmS9AWm4#)M? zkVX!yeT<+Q>r9Wh%=IaV;c918AmJn!p1;06>%Gb(rdAVxu}2b`B$+*OrHDJEO>~FST)*0oiLA!O#|x2A>?6#yE5Z@`p1`%N zV4ZreamuMNG|ta?e&rsHj<#((Q7_HJEhCrdyuXZo{; z0xo`;gm?cdO>$eFC{v0E`)@ES7>IT_%R6rYa7f{6oU@J}d@bTY={9-6w94$GuMT_b z=Zn@}l{s8!ovsUVZav2eP#^sIk(JTz!$D0~5TPWNIyK;nRW_`%EPY_0Y9o2?>EsP| zA`L#D5BhV+d_WrwnrWOG(rXf(ow+URU~f=LI2bj|f2)JBvd-P|+Woxy;jK;Uu2m9# z?!EWxabObRZ^V%nZ2$}My~T8E0JfCS};pDni>^r#g;O_mN*%! zo6W`EvXYI{G*Yd^BtG|Wjmuu6ZU3B{PuiuCbzH`T`+2_SN}bZqT4G4YYNND}F!qh< z&UwcaCD6Zl)nR`M)Zr^Du;%Lf4oW?oU)!%!w@Y^f=vUlD z!2i5=)&yU4Z~oZb^9z(A+#Pyk0I;cmQ3 z>;=Cqk~0g9-4Y`A_&ugnq;Hcl4zC~eO=C-{p+8#s+U%sQ%L%t;L~ z?>+vBaUhsL1eZ`W7pY1Vy^O;2&zWPR+>_e4!;nW@3|qNyBI6NW;|r7QPxT zR#ip@KSPLhnpcPZ5nLknh%|5YiIV6hT$^-GYbx;}dj0At90~N@f1t?Qi;IjvrFE*Z z<}Q?0ZRJAq3ETQ`m3>4#pPT<-{LZt=8#SospNGY&zQpAZo`Y9ID@w;TWoKrQl3Oui zU5ESz?2DtiLLM3=he==MmS;S|@03`7rev zA40XV96PNtLyN5?hO!@-vA$DG-3d+BFIGcjM;2SYHRJ4t;(Mr(jP{kw zf#q9jWd8gtM*(~RA@(c5-t2)*ad=P_cm-Gosx^$;U3p^!F}VAzMpYSXM#98EFkV$^ zFCPj(p?YJRqa;O${q351GfZFoIe2OrrBJ%+?KScTLL?q zYY;U6dw1dDA6U~^U8qa81FDDBXNBQ!0Vuc@@`V7zz-h8GVR(E^%H*%k2^;4Ph(QCLR z*+;VfQp@c?Q^O|#RnX&tk71D_TF26mmk=Rt5!2K9A4Kc_C;!AvQutpl4f1=< zdG(F(SZ95cI9txn110fX4{p;~l9hyoP2tDAq`$aL!XZ}ixpNyv%>Ua_;<0#ur6ijO z1(Dy`*HUVU_cBO4aWBsgwD<@rDaXnk$9@oRfnTwGCa1&WoW7H~3jS(ky;xVF?rWqp zf0H^L+|AVC>NoU$&XOmiLbO5W?0BdIeLdbCc6Bnc1B68%C%qU(DzJ3v78k<3ynRI% zi;~|EFG#7(OF7(qnk36#*D;W}qJX+LwJ9PE%wd&dopPixHfdEg{k0sk^T*k&i{j7x z@VX=EMN2NqP%FcxZebUk!_y+Xfzx zGJX=bt{+C39d~=o@__nHZlwdB`yI9&`jwP@u}X^%a;oj!vht|Es8R&YGzL?gH)?Jf z7n6M7Nw4>PH|O4Qa5btiU+$jud2~~1jy)>|Fwx>55W90=!B4MPoSD=u=hqcqi05OJ za1a5c&g!)acO7!Xep?=K$~~L|&nYR5P0H5oHMdteViVem(^TQO^AY58@A&&o0jHO4 zQdlysVC&!fV$cAow0Vlxd0a)`oj-d5w#Ap0LCLq=>u?6bY>#_9qv$SJ})A zOOOsw{8w~Y!PUiJ%Yrj>`skF#xJ3*0rD1Ujw(4c~iKKXkOHSG=7LA>i^uVv{DXq+I zeh|GuE4{Uz9DNfL&Z3S7E+r;1`~e3&Y&~%LpKyU7Vq;F@xM&R~9h38FM2G0>N>lecd6+4^Xg;fdmo z-BllZB3G$JL|Qyl(p^3mpE-qAinhvb{fCmuWBkIZfbh=tCaVBnocPKJ@V8~7hZxCQ zQtIf{J00Epye?pEIsBK%bbdi>l;9uAs~l9swhPL%O9iC}=OlcSUB^YLM5+#wA3^6o zi?%L_gRZ=I@C?&|a6&J%?Il_=ph-y*l1hWC4CAL1$mATk>C6}+Rg~)lSY8${0=_+2 z$P*l{%mJCIQr5$m&sk;M`RAaM(qCf1WjqEav1@_mD$Pk|fEt4)lc&NdxT@tLax}f^2J$MCpz%AcDQ}V18bm$<*WTNJ;%1fLw~kHCU9m0*1q=l z2!GSk;`7HEaEse~+|d`Ogq5pk+$!`N7KJ^{884NKwfb-q22e%cvCi|$ZKaS|8bT|2 z(?5FG&xm2`LcF!QoVS)sS!_OMO7wqZBG<_qLfJ_Q&iKD2w2rqbjTaj{up#5K*w3iTkDenk96EY;u^W!g^pOBI^3+CX^b&LFt`h;Anul-S}{TWqJ;QD18p^jjCC zVmMg<_KJ#QHhPfJk_u?T2Nx>R=(G%WpqW?ykR>Hr@ss>Y$KH8gNcP0y%UjzU{q8qL znfB2iC25E2X$h@!IMlz#xW`XcQpT&{!xBA@e^DpjyXMK*P}#RCMO24hNX5WU8L4NU zY)SkixoG0%!^LMkpEJiG#U}|eGg)=M0xs9EVm;rI)>_k~@03FBqFXzkqs#R}rup=Z z{#zSqwSG_Gf3%V6Yrj@+q`Esf!_qn*-4bxreJ#rFcU!nExQp5(?P+lRY36(X8=gM@ z3Llq&1}~P+kcWzXV4M7qC-@Iruj1c+QNC}>qlfM&^q_k6NCe%{biMei2i0|&_$M8= zx*KoSB@4w$08CKWjh@w%~)LsX#> z<-GJ_plUFdnRa%dt>MAWV*+YBG*$sD6F?Sq39CJ*lC1q1VUPQI-@H(xt|DHbAH8|0 z-|N9F^2=hv<`r-)AHEc1-or^!uos_>d^QbEp8VpqU62cFp0;mE;WNFr|LpZesMz(ql@dC(uvw;Z zON&eNqhV`qf_e$ZY}yCc#-}Y)hLybRR@e@f}pX2R0RBh<^)nmGzu(+zYzG414 zdqdiJKu{2NM0&VsT1tWWG|{A#(^|W{AGo(F5vI2U?*=?mk6P%jOrmKq`3u6N11F($ zM>sAvC1&3b(>~T0p|49AhHgt-Ot1EMDqnpi<$(zc^;zg^*f-(Zid!Xm*_WGkQfC)^;R6IG#IDF4K{xY= zUj^G}!;1J#0{i~@dzW5-@3%qE7B;OPts5Shd^rW-Hvp4)g31^;n!Zn36 zH0UF&#u%`l7aSXBzg)ua2Av*=QOJ?Z5ODX|r(!n%S--$Ex}&xyf1}Ot9KB)&HcFT1 zp`@$UIn_^s*G{5e)Ez`#<3~#!9w_j(^;rU;D}S06X(^=f+_B38T+A`o6q=Tv&l3C6 zaI9wl$0~CnzmD=?HWy3zE1TcCgXK?q=pIauY2Lvk7RvI&z=0gOSX=9(Bhd0R`@s#? zKYry!7hKJ~&xhvlM=S1Hmadsv%K3ZuDJ=q`zTeMfKE4HM@N$3OyZB;+;?A6dQaF8h z?Vm~G5b8MTHy#Dj#x`VWbOYEO#-owcaSi*j_@{X*caX)MP5(@l-nlqGO1ErvL1B#s zZkqGCT0rTyeKvDrjzRVl7i=lU4g*##fTxlaH_+GjCd=vJn`j)ouB)V%Y&wZS1crs-!j0KZlWE-{G$myG`7y9lUgS5(H|S^X8B z&-!^n7`K0=2-QL!PCt}3sO%LAX2ASF2z(!WJEvt^;>+LmL^VNB66dks0qLpH6cSvK z)E7LdsC~vIHSpm5UrQB@UHW^gs5waHyYW8IlP9vJp2-F})Y5MvfR8aC6uB-9^~QQg zLlGw=`T_6&7)S>K0M!m|b2GCGFavb{h227r@E~4yBkwt&SE_O8fPSN@#sa7`f1j8^ zpla!Cm81jLzmtBn*I)~`D=<&~&zph|@s^Uat0>tkHvHLcd!DdtVtfHqs5^29;vzNs#%72&-%wzR_Y z6QR3n_N&)XCz~Viu$NQc0^jXGk?YfDx_~s9^;?T8U(0ZZb!j8{`t-HVUre$CJ6220*0kI%wmfMNZtc^24un35u5jEhB<+) zs^`?b?J?hs{rLfUGqE&}##>wnD*doFibi_&Tu2WK!ePl0jI1ac8?F}5dY@aRC%r)m z-bgJ774NV(LA|z%TMW4G{+)N0v>iE1sffK^RMT={q$)0dNF~s=)?GXMtm5Da>iLlN z9^ksv7=FH)1)7KMV@9c=9#oqT^$C-BtxBK*h!HcPl*DRTftxJy2~@kpDWX;s6f|c~ znflj>`5#{`Q8~RkJLhzG&TKzcLgbSWl&J#QZ7AGAb!90dw_!JOdLgFg?Vm@y^+&Tu z`!nu!E(^{z$>0VF_GGVssH(=*P54eV?!o5LwVbx1Y2cee4~ueE5vDYIVO}P%M8$c& zxsKU76WTO;7alE%mawLjo~^4@!;<#YbEn4wJNk88OD?M;CWQOPhNVwDmHc3bvV1VL zZF;`Ds65))GtyC0^Uj`MzM`#WV7LgE8Y~(p$y!xYC`v47c8`T@_h7Y8Ud?8T$G;Eh ze8hYT+Z&A?p7Ff}(4WWE?%m9C$*96AcB>%Rl4w5X_|6(G*H_fMiEI|*gXOVt$Gn5Q zn^ik`3lyDQFx6OgK?6Qu%3i z*W9<$E6I;IxYqL|xm)jD>W4a84F&C^V;fN z1Wo#=0z(_%s5=@TMXt6~47lBh)5d zb2UcFJy-Qu>tSaqDtKmniy^HKp$2)z8j4xJUv#ngs*bM(Us14_v+*rFzc*P!?LVEP53hS<`)0ZNt& znP=Ui_;NQch@}vD-ztIWQ=nC6`8Xqi4dh4D{7Hy2pnEu_*eXeu# za4K)KGkY)9?9obXY5X;Yw(pW#dLn(`!J^xDUvH-$CEPJv9l3)M_Ebl@(cc~2n;WTX z{?oV=N7u0OIH}^yl%cHnM6E0AnD*p6D7_9kk zWaKL|eGz1{xTNeJCgxetRlEld*yFllr;Y!>f5G1Y`hZ9L#`)&Gk3iF?yfg&Zp?i?r z1|3;|Bt+J;w`%`220`n0E>V!_KSUbHkMWa#4jXp%{6CFqFnuVq{M^Jx@s;JpP59^s zF{e7h1>QQ_r=*r@k|(G3~a)+>f3-<;mWrkEQyWToCfO+!eR?t$KkdWIM zi^qrK?n>~9mbLL{&FhWg9;zt{-mdOxq}F0&IHN(^W9e>v?qWhy~~ zuL#2CStbPf^1+7aOWx=aDgxY@6WS7_Ha7dms@?XXmn@AG2-XO2nh^Dk*Zmwn2p$_f z=X9nI7Q53pJ|kuEX?4G5!GA%J44#{izkG8Y?P$W z5>H*2C=^U(Si@BBq!K2LD5cp@$&i&r$~({LmVZh@?=gxz#a|D9RR7`_uyt|S(pF-= z?HEa6>PE(}2;C1Bx@@W)qBN$pRtVg?CvGs3bvp|wFRg>fhIBS+(UxvG{=jg z=GGr8V;V(sb>sL%m*JY>JC4(1T3C9QVYK-*BbyqNWF2$dS2)9&qSVjlC4#~wPqv@R z8})O6Jnrwf@Y(G}_WjWtV-8>pzv0wC(EL?YB6IxHw7vh9h+Gn#dDQBnq4WQ^09IJK zgUEL2KB2{^YjGjVA+(c-Xoew_HBz3}6xIU?x2Xw_5@uu#7i_JqHrdk6Z)#kLo zB~?wtPp6d|8PBN6{oRzkv! zRg`I1=5pQzYn7G(uvIqu8^n2G#&v%x#$}^G7dc{ z$7FkKr!Va?$jyq>Dc|Jl67OPnLysRNTiBKtr`-}q9Y`mLZM9l3d?yPYmKgsnT&2UQ z8OY@DED8d1j-3#mATE#=jIZjWnk{&a5p)o*c^`3ctIfRK&w`ezF@)g`XG=>&Gz-(G z-sMz}^u6apd^y`!3)>4>T*&!gC<}BsOpNLZCb%8t{K3h7c1)n$a{Eq?J}Gx6fu49V z^K(pzl{K)vr*WW0Jg&uk!0J6|o_}ujOHG-D{SM~%+ftSnY~0CL<6YnG?i(`qnzpO7 zv#yQ}e?Q^sH>cGDZ&N6A91d2T6Wj;-?w$Y5$9zxLB?aF#2Xi`?zT64B+-v1;0P$Qe z&TeIuoJ9w(EkIjEkGJYRyjLga%Alj7&O2GWU`jz48^jA1?^AR(Lhi+tFB>`7ynsRX z-!SE_AIC_w)v2cohK?zJFGIah0dWM7>{^}B5ub=)u^QnHLi>Klj@g<`Y3S*6so28D zRhJ?DCfE70-wdU>^kNIIky;TkVbTuw{D`3kKZ7a5;dgyyWO~4M1MZySyj9I6I7~`9 z9e&*9oo%gz58sdC(Uf7sShq6WefsZ>G*Y~hL)sLc+bjxyQ{}BWtR)BYH9IWJW_7kI z*Z7nqC(6C7?nJd(L!H8&<4IE}wG+td zaYwc!EZq3%+A;4;{LKwDBhTHZ@6I`PMK@6B&vd<^qG^gb@aGJT} zf?KrxW!L~lxpbXhv&XWD+Ua?-hJ#{DLnfM2&FspB?oa?lJMwFqrOewNW0oMYC^e?h zVb@b@&7L<|4h&%cX20%XVqp&LY)eIN{YUncN2&rwHh?JY><@s@O*{LzhK58YiFf-l zISrS;Y6iNl5mZ;I=ZM@7UkAy$mhCFwPCn1JJpjM1jLrc(-u)I9Tu4lIhph_f8QM@7 zd_>7;g?4?%nD?U0D43kS-0&`$qiW;m)=<8xKv&m@a@{<5s)KmTyv2yeDM-Bag#0Sc zr34+jRO%W_Z1;mdJob=Iow@gBul;hd76=OOHE6UfHV-9|A3#p?9R zH%Eb6NqXFo8_q^M>t)5y|2;mPRbQ99F?=)EPuL+=K^bkn7jZF4;d94KCps)!R6)1% zkij}rSSE^wms8#+&d>b|7f)&IE7_0v0i`Zmj|uLc?;R;ib6qLi7A*I!1xzG_hvw~m z4c#>`|4|Zu*L$AHgt^>uYhWxtO?*z?&+OZNrrS?WL5OvD`=9`EY`SmX9hM|`q2m_i z2w7vS`YfV5WfI_HDZ%D*ET~+ncz#|?HX!duS0S_>zPWJxm4w*E+24CRJ4R$D%?BnC`?tlr|T?n zvXQOkRag3Ff$PC)5SUE?JSlf*DQMvy`Q*;t_CfHv{)yoj(t=R4lQaP z+rY^`;HlYa-Pj)LjvQJ|dj|3O(_dM;E2IYlE>Yl{;dJ1K)x9;>HA@6_afG>8qPr~c zTt4dA(GHIMmGY>Wj5X2D`5hHL@o+iUiDFOjZZ= zJ=l=W&kv&kZY8rpX_{zQVlCDuA31(-ef*#H^qO8CVgTQ>F0vU?V+zi`%*5rcXm3G= zM9h6iT$lYD$hC@IcrREgZHGCGQHNBIQ^f~ZbJyHvaSa@J84L^RQ%v6v`S&kiG?bbJ z+GFM$dKtk7EA6ygs1N!-*n8`sIKI9AGl7s0G`NRg!8JgzFgOHvOJLC8!7a#yV8LAz z+#M1K3GVI?Ah^5xz%ac{zRz=?yIWiPtF7AF+O4|(OhI=~_vtfz&iUB;)qK+D&1$Ay zD~HzlY;k@)FnVLW7d2tXrL5+(7P<}t9?#BiPwd*}BqB$F-a4(hDU{9Q? z3tVtC$CEGPXK<|}TK#`r&pkE5NcrP&O8!*GJhY@ET40d83`(eUZLOC%b@bEPhZ_k7 z1Py|XWraPn6f&AGuy!O-EoFt=`OCsO5^&;jkghFm@%l0zV;Uz&#^5xGA=m(&A(P~W zfYWEX^^Y0Rz<4>--^)De>8rvg9Md~u2yOt^P4Es#4LVbE? zv2FqA(>{|G?!J#N|LB?EOid7tZ6GR2MyI%+eundq1V+;Nl$|XQAuxCFnJ#Mm!^pSG zKFC{|x1N6(_TrN5>0Ae_y-AC8ZFt&izm(%D zoV}&=2!#RuxT`Kg4ev2~?T;|;$q$OLU-7BeeRbw=t9Hg7iHa5qBA(IM%?z-iTeGAV zT{$%4Qyt6N3>Ni^rydWf%vai5%W$fOih({GQ+YdX0_FaWBn{OAg`y7&KAQ#>Rj(*v zduqn@c0Xda}vKdJ>Pe^Px$FLGk1-55}*;{4cnszB*@T48}*ml&Sn_zY0C)s4hVZ zj28-Ws@^p&JhMHE4P55V^1AdiiF9K=-!8}q%1bm5XNlbWemLy#4vm`Q%Z!Tf=u~@> z^eW`$>tKul=s~ab3@5XV(gGCr4R~8RD8r)LxF)~J1H{}WTP1`efU@sY`|3#=RXJ%m z7I`?H8{3S55ijSsnk3cV#?^F;U&PsdFZPsI!^qSJ8gP8PI@_*t2^ZXG zhS3cwPdSWZHwRMdMQ>8=Hx~rD^^N+n;yg6`-0wl%ktuq{t=>KG@=#=1Ja=VOcf1_I zS}t`>u|@e|bJ zd91!ORu#+h_=uL^eS<(Bd!)C%-D)j2-S!~GCZ?WZUVT$67dI-Amntoawrg<~n!0*k z+G<)aq#$xsUp;|Nc|UXVoZ{rC=2t1IpVhZ!iL0jk*#Ul5;ydu%J#%f3SUgtjwXicz z;hEX05u|FVX>|q8>M7)r@Qh$-X<+Bb)#E6yhb~O#n4Bz5o0;!I?jtNe2`P{|Q0<52 zM$-B8wzXdHons|fUBFn}s!d^LTU8EGK+)}+_Y}_6?Zh>klMoX>M12^F!j$Qi`nyeo z3w*S4nAgv<6=?8p9fOoF(psXYd-s>e6e^@%S>RXkeq3}DHjfw#2s?~;dG6=){|J`+d`H1SU1ld@oC=%g%crJ0JABF1jYAwfRD3!$_dLfY0TtCl}q~ zF&RF}(Cj6Whq~xqCL`_By(*44J)^z?o0bJvyQdjMn7WTH7D*mWTx|GLS4inc1_KC^ zsbn`%dKbFdE5;(z^dDEaNK9~?`2})ZU4f#nwiDJ)i$U=$O)=IWx~MB@T}tRqcn2rv zkj#f9uLG~>+04~LKd-|!6!3+%1kOLQ9rNaC6!fbq9PmLb^=`V^gewQ)CXYx{XK_<^JsH z)vO&!_>E-M_w)??gIM*skr%n%3xsoxmos!{V2Wa4Tw1v5vV#me$_Ov63t(oX4nrJ$ zkw&wca!=AF-Y|^>gO}tsZorpLHY_iH3_``P5nt!I-d7Fa6d z@2`Ut)Vpmzxm5?+{TR^bj!uE5xf=@{BEm*~J0u^==$eV%YC7bgKE$(_O;^Fng27fJ zmV0tkjIibVB~F3t#qHMW1?4Db;aBCqwGC5nA8Gf?QaMZfMB=_YLAYIJynl?z+3+k> zJcdXUv-ycG-lLtBlp$eUr)r4UG2x#hJi4R2Z119A_2scegiz@Z@&(p|4?sI^+XuO< zQ|dj!0{CX@&EcA))@#^W4{W9XbA-8XV6TRT|I5R@sOes}Mhq1X8e-@onn$#3}VsrC0P@^h1-UNmj;p4@QA=_aOn zr;vx|i%tk+g|wHH>>)8jk4T1QBO7rVmQkKx{8iFbLCoGw%6aU>Vz_ya*;!q#HMkk6 zb7xKp@vrn48RdZI@mbW9!y0W-BCZ}2`dawtU#ue1VL~xg{WX z+E#fKDkAfY9l=c=%w5w+RUfUJzlMjVh2UIBg=#5IZ6pH z;OB7aISbc`2ldmV=vLTqh`sJr+)KWPU}nsku8eM!0WZ4VRLW0k%+?%3k$2%MUyQ#o z&7*?vaG)C^4b%qfp_q0(^zchq~Oi_7Uk2!P;quF zxv+=r(KyneqWW~0;-GocZKT>r{E=cLE@Z*;@@P#1X0CspFFBL+=iNT>LTkBI-Bmx+ zM8=5+#N{xpL3RITapTQewypV}PZsgK+ zYjZeEYfasI{NnHjt51qpSf~@2Gu$J4g>)BzedYoh zxWb*PRT$T^*~=vZCA0l>dkQ3Vw%h77^RtdOuhjs_a0cWw83G0b&ll?i+YgVY^^egl zwSDw=@HmM&HV^xuFbnMeYNpy!h<98Sjo~?N>V7XAD2cOU|D4_x%dNV7(?bM!4xD+{ z0CBfkI(iImeR~6|Qce(7S+^Be*8_A_Z$#$Vw0|+%-WvQA4T~^+uysq=>!9w1EAQ!WpLY)ab_l(1$FqYF z$@krKDgtTsV$Iqi@5%_Dc1vx-gs@!Cl1G2s2*Fc6!vea1PS~y>FC%9eC zrN~R-bEvR1KM$;c?)elp;7cVuvyJ&+R*QpggK9sgGRH@hGANYOr1%(u8aABt)(vgi z5n1~=cIsn1Us$l7MH-(7|JCEfBhX{!eSUqY0AGd{Nc-+tc9R6UgjoC{cy&UwX1Qpo zaR8gOZS)klFE~@Q@L}G!n`$}JKT1rH`TK>wO+b^!A&eS&z!nOX8%ZebR5!A`(Zfk? zdQg9RA)GlI^!0K)*mX*evGh*`Zub?9cgpdV=~d~yZu;is8P-2dx;D7r`dHM2F zM>ZdIP@SqvF8NztUq`>d3wu*pVKB%-b%v-AD<+orm%J!wN4e6sDG%{C(7{3H3Ej&W62dB2`C_{WFcvywb8F*u31FtpREHpXVlU!^+TgamsXG-lw6JqPQJ z{s<#%GkBxsT`zBqn~{&i$DT$CVjKqU*FNN^$q|)lW+Dwv+wGWf`%>2axclkrcUOq; z2>#izbb$CO+XA~IyeT(d^uq#LbL(>N@W~Z0MEk1EpmuR!eJP(91|V}5a*^2P+K;** zY=SnO5b4a0<}*mRIRuD5w$MObS$T&gO_m4`UQn5__wIOL-(-WXgduZ&`{p_$DnBea z8|%*A{F`Q;R>Y8EL?7-yPJKuU-9YpQXJunl=cJWa%s_-)YdPnDE$-Ex=j6}x_t!ha z*0$1(MwTNzWr=(i8beH))NQdS_2qJXPX0V$G%&o!@I5z0-i;XeHlnN*x1FLMulfoe zxpUFpMrNQ?!AUGt~T`n&k@t-EZkHxl*z)$8J?H%U8V&+?PcK?gzAY7}?~W*X05BV=ug5N6foA0HhV z7Z2XrUkF-Y1>b&H=falf=nzI{e`3pdSQ4!SvXXOd1=*@kNtBuPaV3?oZDr-7vjn(a z9IOPt-T^GqKgds;nacA$LvA~?mHn9K4j1bq*id7u9P8P9VA(Bco1c=e@bkW4l^2bj z+&O&QxbSNZmGt(9gKfr`oV2kA4n{GUzNUM=$byJw4du4?lkAnGMC)2!69BXO#p8mn zK`gIdd2uw6p4e!RKar<8Rn~1B)}KUfxDcsFVlKI%suxkZB0{V{fIFx9=vr40JO3j6 z*8oY#Elqy)J!Qd(^|r{1?=dfY8>yv*?$0YJ4ad%$wT%>1I?!+9PpAF-Jg9t5H}6-S zLk0H}q{lu^+LUfG0sPArO3I!NQ8@(V3C5%r8u)=4Vt-WJmTW?~G=P4OUWH*&&qgWN zLV$vnG}7nVXpO4CUo=mBUyfiD^40M|EIAwMADwEiDttmV?B7nrypNHWKKfzAxKKE- zSv2sB*AYo|awRD@&-JESAyt=4_`oc;zV(zLj=&PA+btbD&Tva5)hWCQ8`CPSc7pyW zI)5HlkmjvEZTo^U+VVF~fGarXOhuc*FbyfcMgs@)^}%4Vpy+@o>u)GWC|;+0g(S`% zXwwP%(GMT1yJKibPd7&b%dnd_)0U=e4^0q<4X2TEG%l6;Tyn?iKBnZfIJ^;|ROH3J zL_dy(->sY$aBlyY4t2w<4V-s}KX$6N*-3r}T)sL|z53I1<2+v&DT%&kVIb-D#FIOma8XM?n~G^NCkE>k+!Nj?JBrZFM9dKaP^gRE z)p=*q(U5!1B3gZ$`=9OZ2;It+O z&U9FVcHPE>V5E1Qn=^do5en8i6Zm=yT108J0ty7a#lAOSZ|R+Sh}HBG+~B&M^HvNUf_?e!K=c;#6>T zpw8?+%WgS;Y|+Z;UA#e}eJY9(vPHzYT|z(3-`dj5JX`7l>TD{=h6Gn9xaQBsHE5a+ z>K<+Kok5Z}GfX3eurT*0WY4W}{U1Wee82S{7=0cbS81ItXjc<|3R@|XW0dw`?JU`W zUFcchCK-6s6!fT$zabA_nh~K)RxCz8!oNi>+~$}Kl({tXAiwE#64V^81oBr* zOVOz_5TzQz5vIa3s}l9)Ff(JuuwiEa3>jP)foSHOh6Yg=%0CJI00FhWu`{ zgMJea-+a+xiteAl7}JQ>jU|Tl;<2v6O=#wAzG37@IEioYp^Mn4-)g+yQ0a=m)=7h_ zdmOyZb#I~Gsm3?-L86uej~}e~J;FpwMEXh3p?b)A*+M!+IDRTj*=ZdDWXUEjSag`V{S* zY6K<~ssChF_s)!&Rl6`*sX@empi!3KAFDe>Nl7fE8^Z6#pSQqhvc1BUg9$LdP8z7InM z8qQ+b2(y4u2`{0e-xFlZLROtEf`^-E$pvJrk&d zsD8`}u{DfH^d`PM+{6DuEcOTsVSY8c2))lBVFz;12S_4C_M$5{$bD!um~)mhB`a+% zRNTAZj7J=++&SGr?NOq{!eW5cF=N6F2q&VvP<<%IzsTv5Uyq20H+2(pyU4E3+J_2-Gk)VUnl zh&?4_(pC-SFl2Ez@RYv1IjG-8i2l5)Ylb3V3VCZkK>a;{kvqx*h;Q1+iGtvq4hus) zmJF{y$#JmT@RHg$ofEqiG?Q(ldvWAGOMO{Ank4q~$AT~8!f(Z4pfd}$eyrgAt!hJP zHyB1&0I(h15}Fhz)dCe$hS)Y`jd**@nE7_K7~NDpX2jGirh!_~&l5q(NT+%hKzAF}a5U)^0%;J_t;`f6Pr-Chnt*yD$V zX4#f4AoB!aOS8r?4c8^<(@zEJuTvKTF*)l3(D&a1 zf{9lz7XYJacL?I-;W~)o@2NbWe6#L~3XHKHv$9Z*DdhF+NM6qO4yRzL;#{mMiv(sc z5aqh5)z=&Q8u--wzG|@$0s}M0jBi}j{;=^A$pk8zlRrq;Laf>epm`(DhS^@d?Mm(G zC?OiSQTIfy!;_GlFKpUXtL|&ZX^|3r3x`O3G#z_FI?Qsak^;N)V5w8NZW~$%3hRHH zfoEHb9k6-gF{#4`Tv6>qgJC3nY(r4Zn^{ZQdP=qsNZ^r992<9U#;db#JOGXo>s!YG z>np^f*F7WqO7EhkH`B@CNn!aZAn=P@qky-?>Mhm&hNmcyDN6IbgJn<+2MHy(K z1^m4(gM`bm1=oe*VC8I2=0}wWmt|tu>T`$OrihFx+OaE$0%U9}wm;0Qs%81*@k<5V z=&WTB8$u9A?Oa#swe1l}a`Hr;`S4Q+iQr^WaL?jKmB#E8F`BSn_}#zN1`{LHs6+2RJS@dTMZ5EoGAj* z{qlK50|M8Vr+Q1_RR1=+iJ;Ai)x?pkez4wM_B!R}@cq6m55l79?F|Ijd+{~zh#T=^ zb?@V!C&VAzx7MjVMEa<9o!P!MhqwsY-)`E8DtgeI=^z&}QEycmZP)_chBRBN3Xz8m z=kGmE(_W4SSygdCsC|z|2UjYjN$W0HGZt#%^Y@e}1w`7ycUo<_CfpCl^7B zHcK;RjcUgXxtr~|k13`kxJT|#+4MWfIaPim9Z7bvy~!ai;8 zDKVWJe;PGOu4|5r%bacm={UeST|7=353&!TvjL;R#tI%aE+i%CKYQD8e2dw&s+Q;X zTW=8}fJKD4UuQ!~9UYw}g0%bi$IlR-m)WHi*pJ5u(hmxI9yu*%a4)G--B7|@aG0U= z;TI`YD;JIfsO@ud8j`dgU`ezjyWBk{YLn?y&(r$}g|TrGugU&N4@b zR-BcbMg34M7K+A7&*Rp2vAG&>YJcxi`zE-MTi7suS5%(C6rr$P#3ZHQbZxy5&$02> znF!Yi?cofP-l9WA8Gyp!R{2N?xr3}9xLV}eAV6SI3&+-9r`2ePBSwwhj=gW4Pn)Ly z5_*$S?Y3hBv<8DU4ph@*;lGkM79lGi`|_e8!lG(tPK)oN6r>c7SwA3o6FD1KSP(*{ z_ael~sTw5@>M82oC`fchtCjhYAJ}X0oi?M|lb&G)dpW2wsF=+VKd2r6#%gnG;i8+z z4S-K%yKfS(ywjrx32KLzI1fMGU8*#$L!3fZ2b|j&bl&zNsA?BQDJ6r=$HH8|8fFuW?sS+5>=u!eQ z??_@O5~c}ew-u3(&RZkhLLV87sfrgVSt>%=s$UvZ1rYXru5(jT3@2rhEJ{9w*2X&X zd?Ab3#nU4AGXB$6N274I(5Vo8U+i{oT&3OCfCSxCHm5?aX9UL%-Kp?2(v_M0?Nu%^ zsPl|78#p#DsRBF!1B*7CVeX2PWf)i>4bc&^>AatUv7!>O!mqRj|J~8Sw74zYcQ5D~5|{XnA0Va_UOJ~s z%V*L>iHbHLPWqQmhqo|w!Z!r~`$}Y#gNNPR;1GV*C|UO+t3daX?5=|KS1R}EhmT%8 zU6@WP3lEZeuWKnoE8DY#{1Y`OMA)Gbjm|Q)HWa(C=d!9w7|iKOn3xM-;&=+HNI7P zy8^va_>eN0BmQWLjmxCKcH%5BmH7+6y<$qX;+(g`65_^Sgk!-|-{G5R0^T_aUlm&8 z83Yq8u|z)`NTx=3x81E#oFUx#H? zwK*6^eK|El(s@4!-|5@_%Rl=2?9#S`FjA=lGCnQkQAfEBL9InRHo1;uT33jRSomJ90@&XyyxudxYC^YDEmK zfRT7njKikO_sKDCHBl*&Gi;6hGb+Jp%0s6~lPZ~jqZmEQ#MHw%F}N9nAu=rU2iamf z$8R;`A;Ha+xwcaO%EgyaN!C4X-^ANZDHOyY!@@YA>gaa3NdHFTwi?veC zq3!Bns!auEcZLg#7SCIUg_g=mav#5h;|d?v3*HW?^4@Kjsch6^ufti02*2eM36?{c zP{gN2C;}O*barf2r%1qYJBVgX^!4VMP6$AP2j&1zgS(jAQXh=G?!Orxt`-UvUPP4G z^Llz{s?_yeO*NIND6eFXhRzj_Fef0P*RT{|TZ7p^NVN}?0!lxnh#+X?0j!fo)9I?l z(ls}ri?Y1@5Ao7ZkjHdNUTP^YUKTLr-KER9FnX|QwIi*8MED0@R9U9;h7+@BeEA$4 z`2@I^2nkB*bjIOgmgeTd>?nhdmZFO}IP{VwDUA&+!5kKUo8Fkwe4J5f_ru>*4Sch2 zSy3zGsE*l6_le`N;FFk>R~lyQO*KZ0fgwhEp0r!nv54kKNww}3)rmhAa5vJ^(Q4h7 z;ykn>y0_6&u-%do6IB9Fq^5YJcOGy|B07fBlSefPjPM&;Zc4w#ZzDJ&dw0w0eRTZA z3Elegfc|Q1hO_JRMu!ZT`wqSiXx&jmw<#A1NOuE;tIFt8iwkHpSt zJoZvc1h{dW-d(uaqh1Z=e%X#?yox=A*-hJfZ`;J-)y3w`)wA(Z5ryZ6i3u5>0nLgvI@XNoxN!4zVL#vt(!=X&FfS

=3A_-4+e4QMAzWTb?9Uv9{*=meZ#C}XwtX5j!(|I`?55<$d7&cwK1)( zb~<`pC@iF1^8(Jw&w{!R*QpbhE;s|GWpmw+UhOg!Vg65NvK%J~#KVJyQ7>akb2^Uh z{ZD&YZdF!Puc_T19?)Uudi{ZL7$9C!QJ(OwXMZ(QuB1eGM*7$J ztD2haSymkmW}$ad1_(RsU**4hUcYN52Ufd$@R7G&y9hCh4D$u9>l_Y|k6T3=^Xruw z`;tX{lO4Lo`#QwH&!ut#skcEEv7w(kFIs~0co^o&=etZ}s2-uT0S%{vBz4M=SIkot zgoO{u0!CpLQLvhmB0cEfDJSw2-CJV?T(qeJNub``10ttv#z?e{byON={Kfc-O_f(_ zdAC9!Vi97$dT&S#EaDkm)P-v8!M*qB>RP;{Qy??7`T`>A~jtRE33nB4&DyRooF+*oXd z=~^C+5r1G`FfH~5Iw!c#wvNQnKe`jCYrxl)-|CN@=}e&YpMD>HEOnIkFfZK6yoO5T zi-6Pu83H#1tYNO=su7=&rxe0U;AktFj7TD8FwRkD!ya*32|u|16yZd`C3 zoL;tXIa0SPy-CIl+ncwIp_12Yq*_+BlmEZC93j{&?T#3i|3$0*bJ+jkXZlZv{C~Vd zVsN~y=qviQG`iQ!>GBi<-|6Ckqb*CmIq|MwRW!@oUSS?TdO46ds>aDm)@x=}iD<*z z3@J#Ew878y8m;#pdnQ4bSQ$5FtyI|U&}xQ8_ee2kanHSo*h7?`Gz~ch))_OIW$L;~ znt~zxigKsGfu!#?1nCnX0w+gHJXNxxKc2?Y+&q48k<^^C6tw z6Ox?b+N|A>YTDYKZk~i3!cM-HDOj(^Ibna9xG4CfmGie9MGn{m36r6&uM^@d+X>Zl zPg6;=$MmZ>ik$H6l4&vG>dBw8lo9R5vM`PYF=tn9@NrA!)tDHluhY+PNfSPI=Tp?w zXPsowQqIQKkTM>$G5P#&ccpk>om^P0U8+$0Rf;12b6e_E$CH1%Sn}L&F7T%R)hB!v zAvFJXF|J=F#{b?H8$$xgf4`WMPW!*NWwPOU(7#`7tvo2?-`Y~@sf6|K7wa|n&yD{- z{EM3;3T@QCTKV+$M5i-1Jh4>%b|<~BxbE+BreFQf^ZuY@4otSP_El?SaOm+Tol#1i zN(hwkMg_-~ikQCSv4nRsTp1~lKAYG51TXENj4-HHMhch<3li0*bpp|%C9j3g3NWiX z^|fczrjmt%QbSlL4bgKzkRmx3Go4I|h#mu(!5Wspl%(pr^}?J~TM0_eI3APu(EACp z(dEEA07fVgpk)=H0=dPSbgX1k96L?2Hx`p3Sz$k?%hsD70g^k_S)%Hk9^p%lE4}nd z_L=-6S*vGZjET%Ii+e}Dt{D%WNcR`B0CEiHm(8yH&Gx81@7vGuI_b?1^3GuC1pQaF zMGo>_z|U6p@u%D#$-BDtV_>)9>mhLqD zP#g}_$Ux<&go#}{pkI}+|K)>l&r_UR2LF{ z^w>lRx4$07(Fv^J?;9KoLE!HAgKD>;Ql$w}V>}(_YSd0NKV>Pb6swok1vS)8EW=6P z8J|x?vP>9%4{{>fSQq*NRGD@KjGA@@Rb2t&!=jSl3)9_p=#JseB7$ceNXksY?Foso zEaVh}qJP58c7B@Z0GH_$*Qug`3n>7V|))ZEKy|sT4?o%Tk#Abvr}a_0&g?;1peI{*=4kJ z+)@#_aTyHz!fV5%lf~($rZWlYyN)Uc63#2m;MnbX-pJw2j4aMu|JCslizsjW*A=CN zkns^u*{sK;+lr^Shn5A_J9!y!R%)fSLmG142IpkaI=RdvHDYuo6Nf{*uiYeOwzBXY z`ZhDV$4&3S(0N5e&&z74ZL*DYK6u!DluNEF{Het#)}t<{V&GRC3)tbOYm)v z5&|B!+&ILn*wNfh^aK>fa^-VkMfulSmc_+J;gr1{GNiGrFI9_+e2G$vSxD(*d8+V& z*7~sHt&5?7`NbGrJu!;50W`myQ1ierc~(*Jr~jPhKYjE6;&X$C4;IO|fOYk{7I{Rv zhTaS=v`Kf*rnVwccnn?2G`ghI`a^lX-xU%XffBQY+|#3xVKXxILski~?uB%hHH0m( zFW3c4FS!n#83lVQY2P1np(Y$v3YI-&ZpH2S={v|P%qWUH#6mtQYa*YKt;r5pc6og> zJ2T>|*>JcdUdUGawu7Lt;NnHl7kgOEPs;)x`eBcn0^J(byg2qQ2UcWWvlgAS3-NAY z^s)Ru&Ysm)^-}K^4UOr~1bD#!q--Jc&sz#F%`Vn|yxdunayyg$Et%VjOT&P$>6N9pIbE^QD@~LEIgl9 z1X3jyAq^wxPwQ;dZAp}Ht8<5hl8r(@#?X{}x+^VB!963p)Q`=%xw*;4bZ;pGJ-I1T z&H6D^m#^eW;)$B%0srf>4I!(9+|DtKYub-s{aVxYz^`I$DEs#EgFxlcZ8B^0UC-jH zsM{wo%Llo*UDBGW)HSIi++WkPf-2Jsz(>trqu~C1Cu;#FNQ$ z&Aj~N;iu*ose09ZXaSBKX9lQeY+G`AA-dS zJ%nYBP+L#X*I6Fnw=Om~3RlfxF$Jf8!|3>i7&PH{;6v;18(0XzJS)fA?QGj&BnI?v zK^R;)geB)ZTO@dn{{eGeWK3W8bBB6HmlEq2^QzO|MGR}%#~$zIs%zQhQ($-{cE>Sv zN(mWL{a!x^`1#zf3*Ra<9gL}QN#znua<6X*TD?e=(>P;``tpf}Hmx#}nFK(W_Cyxd zawW>`GX2|;W5AQpF+knkm@Q^fO{9M{-{`X(W2tFh9za8w2jnfZ>C%?vcqDc!wLXba z*6og003?~@0folEDk**0?BONcy`q!&`s~zK)E+Fuq}}t&POF$GW3O1z`1mk~cJ%1-uG+`!fMu0)$d%uf zbmbA&k+!$GMv4S;sz#f}>up#b(7PEs26!k=8*z8wk}j29<>vDQs`C~E6vTqrH;{)j z9PvaF`xy112dijNkzy9%AoFrjF389McRJH`s7fL}-d_k+v1ZX=l6IE&U}63X&_T|j zb5A^h7=5f=iA(Jxlppe{QpJQLQO= z%4x-^wX+XiisqL3d9L5b7W8%Q%@Hv?%L%kcQg29l%&?z&k1>i73r7Ls0$2&0Q@(a| zzhCZK77$O5QEw-&#e_7Mh`itT3H8%c!w}du zYzsqV>W@I5kUSZT7)O##U5kE-=`OQ>^mIx&))nUo7+pKeH~~MPifHS%C2{nvw%IOb zfrnvIB2!F{>>{2C3#(Nk8~rc!;6uOL!Y1}E=}tI?R2=52E{9Cf&P}41}ncg=hxF;saq(h zy1Vln-~ZAH3xQ2?7H0Svo7OKJ#%o+>;82rqJ66`|V(c6!Yj;t9YCUE;g{A=9IcA4K zI}}D{B5AJpY>X7mt-&YBkr+=aXS$zwMySyf z`bUZ0@cmC3{T6OgqSONyA^<-aADB=f)F{N0SN*%Ic%L*JL&?2P9*7eFEt%^O6AV6y z$Dtkl*e|7OsQlHkwv~0ZVfewIwFFU9%#vXekMa1m98~zjl#7LTe*2$19(0E>lz9T3 zfeD}U<=m6sZdfvb`N9Tyz-vm-Xu6f+4kXWdAic64M3Frc*;+W_Qc!XR36b1}6=g8x ztJ1}1$~DY6NNUdh)5ruQqvM_JM9@iS9e__5l0@>WA>T5P#>^m?Om>*jjT*F@~U*AY}AY z@HScm)xM~Let>^gi~??U2PEtxn%oVJ5&VWV@bhYpcqrE+bA*)#uk~W)Fr?j(ymuIu z!tlXzSDfydMlWKPA47P?lbbSPg=)7drA{_22bcqDXt zU`jbb8jo2zT7D$m5#I#|ko-`Q-XwQ)j;1{P)(wO`h>=P;Dl6%hGj&aCaeAZN*7o-Vvf)Xj_~>6Mwgct3D6sAv8>{@mk>*J|24tD z;>t9BaKwJjJx|s5NRD|I6QISXcZZ$*r|>dkrxM;Z0QN;L)jrL-WmL=vnS?RBm=So5 z;ty;^Aylgh=`c3g`l0;lM`r24}U#U?XjCK^usY%qFG!)>q|b zD_Qcc#6_WVrP;iY?VZ@22MbaoL8tZI&JMkLo*hRK$d=VmMvw19Ko?-^w;3?EZ}-)y zq_pbtOyG!d9!=sG&&-j`r}l7!hA0p}4Dr=g^l-&58_U-tnGnqX`h+QA7`A>2g(GxC zfxOqP#=l?Z%73voP~A*+lE|F+vyqY24$YD`&T4!F6CE^EVyDmozgP4p$On7BJMzM@ z!MB`sSxWbE6U{;ot5#mZa(ARki`QJ<#q7k)KYAMnV~p_=$u7-Wpyx<_cUR}p)IISnrk`ZoK%*D5WS7 z?!GnMh2|}ii>`GDZ}>MZvg|_=t_QB+q$>Pfwsi@YDxN_6-G>n^)146>^Ioh1?blH# z6AVbatngW3%7BcJv5^bOajHQ`Y`0!1h)d6Yq;mv&=rvGC{lm)IMXWn zwXOia(aI{>yJx8ZmM?{5KOGgC`GxFYTuD;J3k(g!OUR%ae{tERM?Ru+#cB>vdufy8 z%Og&qzhOBgqk=Ob#^hrDe}c99|2>-OUx2><+{yo4CK;N5%Y%JOl_FD3`XH+Hkw`(; zyotoNhodCxi|XAy_&?b=6s}2zz7F|%w5G61is*~h^0^s)#1&Z6B>vqR^}$XzhD52z zT05xEzjb$NG_enD2j7PU)0F9G{pK&<>w<_?ww%naJ@P`lWv=sl z@5E{qe^NW~wOy}4;Fm8!!PR9I({Y7NCXEnwDHs{K9~p)jnH3a&9LxoWr(G+B;;8*D z5ua&UQ6F%Zki_POhG-yebTxApNz=5^{-OS?MBPh5W?U9e2=6p!B5Dm;%q@V{E>TQU>LmM>=>FWPh+ri+X{|r05(fZ2kOA+Mh3Ze}J5! z8rVc~)z|jG@jBH(KZia-iC+xgmKK7v91W!`(&x;MB&g+t1F|`dX|d%TlGu+Z8TIux z+4t1bJxZ|+Esi1RplFOvP|Y36yoHJ9q;Lql?%6~TAFb< zXvz&Y5oNN)`ubx8?eh3zIsNttibx8>pys#lS4n|x#i=gCZaAN-GoIJ_O7gmf_wYRx zoN!|f2laW{Ga20&^4DBWtBQO|)UTDOnAnh}BTqDph>0azibYg_=L&v&|2x^QTF6TC z84RM69T$I`5y7G|(G^BA^YfeE^S^38GFXjABK)sZ+3b5LqxEVhrk!C`Nd5qX@IH31 zgell%lNod-1;xkja&2;cesrCRX(B`2X>6#xGhTY80G?mZzagyynO(bV~t3 za@63g9S{XLlD4CJNctwu6-_S(I8m;-LF8=p> z%!AJaK6xMedJQ&c%5k0Zu#$pN>>RrFg}W6PY{y+z%Ux}%b#Lo#ad#TYYgIQ%uVb?? z^%a#0E-KVsVG-?T^{3L9MX1Huq&)PqI8LIh;z_S~PdNEk!((!%;n6;hLK?1QT!*>+ z#5nWGfBoxuF#hSCROp`>vG>b(R9N2;>ml_6DF`$kF3UJIp^$ow^Y@T{@pgIRt~_Z5 z**^WF4U+hK-v6>*d4Q3C1#Gylw} za{Uj_KNMko-%8?96l@Sxz0cM^s;-oTYk7<_SdB7huV4uGIn5;BNrr@(jk0DCMi%w# zWA1k%ArL!Q#K4!ji-oUhk|jJ-BuM_WYybHNw*sOMEQg%$JrZ7HsIwH^iG*_giiEuG zhQhve9+0J?=?@OuAu4m^DEigo$yIaYIymo3-GGW0&O2kQNV#VHR$~DI21Pl^9+eOj z7rZjO`_CVp*X6N!DEj3;p;4r(Gg|~jc-RTD*R)O3RpPk1+jR7yb_$H1$&K^$kbbba zeTz#oyx;r-$I5lyq0!TflWS@m$xaEcxf+iCJpp1Of*0)kFC^mBNf3+5MMi~HKP^`x z_b1Uj*!v||Fn$%b;^S$i5>M2WlGDtCyg7#qt)jr6h1u%vUx~xyvu{7%KE!?Z*h&t4 zO}X0XfxEjp&3;!e6@G_oGams(t_sqz>Q2bf5*oXbVMEFChr@IXpitZEJ1lrpsuU_1y%6M=$Gkenvky0FUmw=|*G7`mg=~JB5c%bAd;s z@g%}RXY4p8JK~L2wH1pNeb{AQ}%WAqaF}%U7@_<&7rxwaRX7 zDO#2wkRiZh7a7mWcac`=^7KoWH(?YmQ;TDEq9K+FJg_c!0jHh-u~9|eiavch zsr}#Bd&{7>x@b)pLI@BXf;+*2yF-%@AV6?Ukj5d9G!8)F()w?wz{#&P?4u-#1lLHTU<~wQHZX&R%<;wVw4ngwR|*^2PK@!#9hG#O~0vR7wHO zP;CJm%@sKe_PU?M?mKDo83S<@A|b6Yoa|ij#CmFnTrM9j!?hMQUa!wPad5mPXJlsc zwH6o+_ijmRMzJ6K(*>eAbXQjrP#A;S_Uz;28K2crPXp8DznMN{hkWbNe*kt|)~{Rn zalSmnw705G* zCk0`fn^T>HFgTUw5&w`q^q)=qFgJ$`jrkffmwmuLUE&Nc`|?72&DUlolfNN~qEA#+PuC4ohsN)|GySpS2o$I#nlU?4jXq^9|Wn(UwZ$)8sA+vlyyjuCzX zo^(@01%k-CABBOOmvM2CZd5V&TESC#{{&yFl>i^imHehY*{!zNPvP1>!H@5zN`QRIvVZ9=CGG8JoA;u4ib>)|(=*_#T z48phqvSe}()RLSdndupU$^aV8PqwI{)#+i4Uz%v>M|G@UDl-3|^@Sx~>fm;>edA>y zil_t~lDD+k?$Cj?C(9qj`oJ(0^BtinHT@#so_l1%FN=SweTCI{?fVU^^IXjr0aS$v zr1)KQV+jrjbQWcPDx9!>IM^B?b`ZvapEjg}@R6;X7yP{$t|1D9GU6kxeVdiZj=PZ;!rAU&N4`yz`;eB_Sa1_;o?p!oT6# z>w%j@wg$0U9viOSju{xpW zZFRXcvD?4o&f@+D;QkTdvxZ)*;M^cX(VVjCqvK6RrXUyjqOE2ibS1U8CZ)LMcGV(c zfIPu&dd<{wy7F3k!a0s@T8_<;PWGPxW+H8yj1jQy-5T zyjqvv5nX^l?VSjIvVrWIpwpEI9or$rV^F4%k9T~*10R#4Kq4p7@)|%WZyjSTBtgh? zO|~Ik{X9}=S!!8A&MmqaV{toJMZ=3D@d~4NB2j`ip0jO(^vByb(4pKCKrOrm4s&Rz z|M7SB&RWhx$!9s#x7r=cC=+(W&G`dc@h#!d=<5*1mq46tl|)tLX~bGJ0N$;%yu6p? zT;QOunq3ViQ!Q;pXTamR0w~ro%(iT?QgL{FHG8-RQi2;1J04S;&RZ*esGhZGNg409 zOoryU+xz5E$jsW9`{ke`!hY(>%YyX!0W*U7kkYe#rte$$q*kPaex-<21YHvgzzrNm`0o{AV%o zWRQ^{(nS@ARjbV!4Bpn$sRrJ`j@Tb=4Jc3lyv4~!dochuf20@ycO!#Eeyt-XvZc(w zJhIExmV*$daS=M}c2%0&t?r*Q%g))W5f2jrh%h3-1--FCl`Zk6S^z;i_gm}_Dv~c= zFvq{oO%^Dn+z7|VFt`^CuQ-mg0=IkCyBe~5nLsgv_GtW?Cqy>hyJ4oCSYHT%AZ<5?L0h0Em_q~EeG z_GZQ87V9)(ATw}h9O;9Jpgr}KkG+&-U+lUIKl*b(}IhfzNaqvzxE!f(fJ@LhO7_^dKup_u*XLS^@*nZxR3ne`>57&FDizdNpUOO>}=>* zXKq>%P&(Y|FO+jbLcm81phXdbp=I7mowaM9qf>J@UCSu~)LYByf|N4$>2PR7%9g+Y zLkq!1HpIz&@EINDSkp?Hs zFb5*yWWemGlOIXGQe#O24azozMd?>5>{B*=|HJnfxo%71e_hw1{AK zmj2YY!vou`j!Cbp~n6h9bkhmsOArW$CJ?!B?= zi;+uEOOUpCJKS+r-H8ngn!vrOz#If!lP|S#epzhJJZYcNwRw=xCJAKAVDlOYPfmCG zon-!bSm<+{;xe}Ig763Ps3UHD7qNo-59|IVR#LyQkUw?^dPJ{>a&MCo^r}5t7)VF1CD}b|Q2K9_^fY zsnfx*f^aG~NEfZ__3P{H0%(-hFR$utdAo;I8XUCxpk6jClqv`HVxZ-#faw3+d}`v` zL;Q_9RE*l`#C2_F7B-6%F&1~HZeR=YCARKa=51uTOk;f_UOu!t2mKa zt|Ua7S`Dj+wV3-o7z)fCq4WeB3aJlAh6tbwxc!f7z`HBQ_4&!y^eTeNsvkZKr}$p{ zO#eFjp|ZSQcQAdLblL9lgVCbtl~L2m4}b>b zZg^#poGQ=uh?cr~g;SgJOdP5Vm~41kGPqg0F{}c1s4@jgnRjq^U1}4b5`ITd9(*QL z9hu0NI{ZhQL|X2dVO9-Q9%nqcvCOTH*h#hgPUjDu-2C}#@U4kKjS89Brv*wvS`6+u zd>b>eS3v%hgaVeY0eIEYmO_ep`M%x8>dEoz=z?7r^JdTVe_UX?N_h5SV+`T zS7C@^WXI|i4n5<)PVk2;aYA4(BQFm>3QK;_O=&;%YkNs){^tNZxz1hK>B=#CmPZne zn9~xSPjs1K3yWTm#yB#@NOTutqFI!z<;K7Sn#SNJ_gz3Q5GC7$9M@bcuvD~n*KCO` zcB~8XXZu=QhMvrxG#;q?@0UhfhV%MgmtqYXUG@TT&z1=;17wkroaPl_lJoJi6GMWnSH(W~RZG8KI&) zr=LqFiBrZ)Q()HGVcGO;St+Q2i)tjNt_#Ls^w7ao?))TgL@B4PQ_#L0pKZ=|9mMzI z#qA%y4ZM_0jEJ`dhYdB-Nv$zu`lXVVOs6+(K1Av^o((i6dVRReG%ct8^Dz+NM2c93 z-b}~Vevt(S&BDq~?&5#U{o9mW_urelPVuGje=zs4_3QuOF9+eC|KP9xn&AJV5ub%j z2+(~@xvgWHmK!$wBS#>|%dVyK3;eQ!#jn_vC0nPTflOWT6pEGBy=!f=f~ZtJy?+cqT$si)Ai>> z)o&T`_%BisQYXm9350?rz$IZ!M)e`OLq9#%8CVYA4kCqM>EzbIr0;-k7adH6$Z2H0O$?!#q1g%rQ~i>iaV{PSyRiI#jzcrC+-7P zd&%$_!l(JK`w{IM;#NB3S#?>{usXBUWeuQZAx@g5R?n#3tpn(d?(~2lgf1){^#BdX zh}G>!Qh87n?7PWVMXh8B>_d-v@JJE+Hq&ugs0y_(Q3qGyxD!LRo1kpT2doYvIiJ#| z(`|3r>!)|csuEzZulp&+Nm~(9Z^Wn?&R6q3!^;WA>!WXU(3qOM6%r$bEPYwC0nyNL z<(ssj8opMJ!smI$;SwokS^)tHE{c|8y48GsM*B$q7j9_mFVzQ?r9tspCGFex+94=p z4w?7MgPdt;wibTm^Gm|5{AxsSiKZdgt>s-6edq^zo>#<_%}<_k$369WA97t(jWFYW zF`La#h9Es6B$O`*q?2k;*`>`fyMnYMQJ2^O^J1rr6sF`T@fK^7+%jW|+&(|vie%YY z*6?qw@D(fTFsb2tXJw7={YdUhson+W4JW-~j!lBHFTWA<=-70<>Gt5Whyeq<7se+1e`{&SpE7hSgd7M2E=!}Tx;z>wu$tq`sjJg9FM|`IrSb7~htu}F zrFxGFBYxj}BWah!GR=Zg2k=dmiF3ur{hoY;+gsn;#kJ*9K8TCM-l!|<^-+s`#m5$# zF#2uIxsn7Bwp!a_ z1hI=qht0Nub`r-;W^8zjm+I6Bp|&CW?S@TGxiG}F*h(o?-Et@ypm|6wz4>FNWcMn< zDJ$R7DgB@Um%Npg!H;D2eo@LTup`+;eD#}o@ABrx{_s$LrT!jo<>YFRb84ofx?yKK z4DuLN0z#+tbJ+9W8=9?jZSYv^o`Eh*&74dVk3P?vE@f^V19 zseXG>sXnK^xvorx_68QE80Sip!q@B5!)#FEVjV*fEn+)4nB9zd+POF6#91XH1o0ktXAJ~lp+pBgd*s)essnuiAj-Z zlm42`)tj0{I5_{yGb}eN$r#@0x4qu2GE*AySsF3yw7zlc2*GNttk9ztbGi0d`DwCC z?$1vW_Nvmwl^*tT;E^`zbsP0bLv|TfX1k|*o4dQ7k#Nd`H4Kbys>stjZxV%J5H&$D z)983WecF*yw$O>ceYxhjrdh+cMd9jto#D6~TA;cS?yz@wy*xV8zg&stw@`2P^svo7 z3AQ^qxXd|iz+>lkbaV9bYbIT5t36M8gx?s~7~jc7p-}aKKP=e(gGNw^18z1=DmaNo z)aBa8E#;zqT$1-*a}Re3Sd>0C?jA+ac8Ww)8lCr3q-KwrEY)d@Q-LKbCp)R?CdY>b zD$~u3E&VSX(3hK*>1#iJ7^7x+wS?q`xb?6!J+!re?u$s5ALmSaWVVH#sH0@Mn|B9k zd7u@4nHTfA{ji1}XQm24ykl^Du@s_b75@hT1J^i(7YR=tmN2*0sx`_lx|ByB+eGhsX7K z4$fzR#SC-Y9c}dxv`e=c-Fo!#m5Ny;e4x-)Q%|1!3CsDFlXYEN zZw9GF6uT$$u^ofB2VSx02{*;0Qw>a`CD-pk!l0E{x?ycE)ALNaUr0UD-fQ4{b|mG+ z&8@t#9Ri2GKoTrq7l)ge!%9+tzT>4{G}$NGa3%mmb_hZ46tfDh5bstP^Fx4NtkWtN8%oVH|~p$TsQ6wz9PtGfk@x3Eej(b#QThg25G`J zcl%8La8|w9J?lt^ahYMA_xJFcigIvmUgk`_mF)OP_Opi~7NlJlL)`mWVP3OM4(8V< z^k|O>5WX%_8O4B5scj%CpLNlcJ1oLZq-<7w( z-B0iit#(tQS@~l2Gwu!5019z{9TkAEC|zt%a&X=}2R)36h5ECU!LkvX_MQhU!ka=2 z;GR*hZNmLywVYf5f01g0V?BykJGeQGQ=ZzVPXKf+CSF7N0;g9qxR%2pu(=6Xpe58K zm2u{rc3s52d>qE`4J9eOc6Zzx3Zp|anxlNR4FufRr(gRVYuf;W7O%qdR$5u3RyK2e zYXZWkj(bT%G++nV=Q#P}MEYh6`-FYuxV7ckDo%yEE>J#1g~Rz}kU|x|UxnT25lm!E z>|oTaD&ODl_FA5>l)#v3HvGY^Y1C`4d!d&CZ&g%iI_b&LIwNv_TW3ArD92h^>Eg5V zx?3}exy*XAYB4hjueoQfBY+1BMiyz(rpoKgLm(qw1Xb<)Yu)Ap2 zWkOO}?Io{cF^MzHx%;7EZFrTyZ)ck)hph0b83Je#+(wDOnU1$puGM2YFs%6+cejKf zaUXdCtJEH)j!=^;Xijq-6=eit3*$JHfbIa zj=-o%@QxV@n!LQue_GuhzA-QG5C(mVQCwODQ4C2x|P&vM4 zI-IEKc6Z{pvDNZ8}yt zMHS#5lk!6mTh?#lY_ptanjC(X4!$_H%MPQ1+CWC{=O_I~h;xzb#!fXxg5G^Lg8;Gt zC_Aqu_H=8d=7 z*xkN5=_>NJ>x7U;a2t7u*cb4cxJ-zUVQO2MA)Ag|A{Mqd%XA)gxiv_v`Ddog}+;%w$G;x=~U%3li{FZoTqQ7 z-_>A{1k^jxkFbnZ?!2CU`h*ETe;yr2?xQ%NO}x$A1*83w!0*qrj{}}E@?>BMDc3o8 z5s3uKy~B9rA@}4v`B>1;{DlVT@H9Eb{Jk6XO5XCmc^B^(#=keJqVJZDaRbAt2(%v`c{DSwa**{QPD5Y2Ou( z#Mj;BgujIWfC*g+LGp<>Yv*EP3SPo{tts6C-sK&p+y*h1bKm51HUfx zeUj!MMGlAqoz5X^m*hGJ`FJ7P^%-rc25N8LyWs>6gBN8j-^YdInUEYBmDtdUD;tpD-qGfX0H1TaQ65NEF0UsFH9-UHZ%LB!uuui%^qD=|hTm!Q`gihNCYb6n- z^`9}7Rz6qHw7ga(ZMr#q{B2o_o5XDiGOT%WyX~}4VwB~#xb6GJ>)5#xe!pjbo|8MG z*1qr3^!2HS(dFvr0slFpQ>U0`(2ZgCFT~g>D3ssmJ$St3z;lgmQ3FfU>t-p-6Wt<> z@Z3X$W)&Q;6inCl-r8`AbFTDgmIuha)%5`B$6@cC^bh@gh8r=iuGDUo_9HP1X_LJ{ z)4J?Z<{<18fYZuqIoO7?m-*5&wx3H3bT~VjjrA_+oH`D?c2!D?urP^gZ|3tQKHHi2pp#XbPER@?`_$7410P zhMg_7`$X=3)hSb@=!5yKn{&*e#pI!Gs|`LaG^po}t8#AQ8V;k;&Z6)V2%#{a?$T{> z7TWK7d@Bg6WVSHg!o^S}B^x=hqM9S|ADV<%u1Qa(ZePp~#znlH@49HazI40U)|m`%X?Q^Sv98La8FUxvRv7! z_DIob{9Eu4k6Zm#2sTYrDXP*Y_Vtff;&fn&7C`EE1yCIDJIatAwg7XyG0Jj_bnx8$ z^vmC{Dk~Ss8r#-qM_4F|F_Giya9$8rkMD%puE|vrvvT~i9uJ7?cTolmy>W#mNlJMZbnCGK>X=mPfb)u-_U|PUz%w1&7evmnMC7>-kkMb{6$U>FoTnUu3|a$*+&6t01JH*Kty!-~HV#Y)-lqquc4?R+qVi0Tc)x{T z)hAVwAs29-HH&}j+A`cTn2b*t$0UM`{_Iy)ee)gsd4lL}njO;2@y=v~wWj*i1~U+O zy2v1fM(}3wM%k#mB8N03)}ySd;$C}36Uarimu{{2?T0ZM2BV8WW5ps6UkTPMkD?tq z5jlZ;6?^O$7&{WA?P@$q&}jWgC)pg5H_$rHC#^B?z4Lf-B_5S!aCg}Cjmey!--(<} z7@V9qtQRs)2WD|wLZgmAZzx0KOkTaI`E1<4e8p)sZp>9T+WFI?)@ME#SJ#Sf9+n!jo2cXY(*Wt?r6{>_Ko>L0+YIzb%7om zL>0P4om?g@%SnQ4m3Yte^a>U{K({H`gzmg1P2_F5ac)OF>K@cwu4H9%a>XI7BySW= z^IwNugX7qdhxQ(y3F#y^JKHbmZ&xmngp@XXP&$xwLiJzFW0ffyPBgG7RQNLXFfK#r|VbBiN`x?QTTQT3{}JN`u~FGCldV^ zM%(<|OOZSMxgt-*YIgoWUWCo6h!+4P5l_X*+>7|gocqYc?6}2z;C~fLZrUPQLF>iD ztDUYTN$H^XWVa*qnU#D{yY;T(|NE;>1HR^$9hTRjt#)cg_9^)LfZ-jQ<+rW4%PK)ysNbr$`~VAd5SU>{Of-os&Y!OexQ`$= zE2=y(%?@>zxoxqn2l+pytos`*nGU)iL|T8pJp$}5s}sI#6y0Nwe=kv-l*>uckm{qB zYFw4<7kzC{Hp>-l{wn&30`^O7sw1)`%{m9Mre3u<+{ZtkY+HA-{odDJxh^Bi1Q5fb zl^WOJ8R%m3>Uf@vR;|Qa)?e(@;5V=3-3T(Cvx^XX!gmmB5!{+w!^VG7^w7Ga%Ca1B z4Vh8RMt(0bA#|XAz>^vkncQcad&s~wF55b1{bQ4GGqoQ?fXk<32NCHMokvi*n;B{N z2U6%>B6cBGa@J{d7p`-EAOSqL_d#FZvKFs-(=UH&yDa%0F|!RHlt~ul21Y_0&s?S! z34iGCWt}!E(ahTv@_~BHi>o>*A0SZ2bvuBhbA23TebG`dg*W@7{7P5*g zI{>A{sxUtD=+CkRFHtv)%VO`vrtocBsGY=V3O_R2941ksKl>kC0MI+;jegspSYEM} z$TM9G9m#;igyWNMbX{ogep13bn*f5;fi?Z%Bb?v*y%fRe&+^~3evXEVRY0gw+!8H+Px}=4ozEFb{NsXhVpM`3$4~PCcR{^e z)qr4ypT<{voJoJJiI0iQBpx9Z^S03*C4lt9BL()Ldi(>u9{wlNLF!IgzA z;prMfTWrlG*~Rf?;rzl7|BFJORlusJPGz(4Gn_#jx)%7xV_CTPDcj4iT*OV2MV#aj z3Me1zxm+q<$!V~wc-0%|R;@sL8e(j@*m_vYcq`+fq258#$jErhF!T(MAvX0QNr5fc zWis-2bFrcJf_v+^ci+nsp0Q_=KPj^;$Sgj@0XD-Y{9_+0n^sS#@#%}N17rTonVyoj zUyC&mw&!c<%-!Ok_qYH{w*UER%`($Yud zgRX&P8?>Hi_}9w;AEktxY9%b~>=fWYVBoa^jc16z@U}QoFQBn_3SX?P5O)0PQDJ^k zHX_zT3ytLMKF2AJ5-6lp?=`Qh5QEq9sQ)qX0nR5(E39a$3RiT6Sw5wGO7R+wE>XSy zul!1Fl-&xwx6x=%W4<4`u@X?oP&)Ss9pnMCPW0bDa7P2O=q6~|)Febd_zc)Hgv~Eo z7a;ndgqxhUE{VJ`wlCb#DQwkHmwa^vzyi7+%h?uFROHAv7eSgO2$4)zU;$H(E1x~J zSB@z-;&|=?J#45%%I)>&DpCs&l!qekJVN@Px+?idy5VK|;?ec;mChqJTk%Z*;)^_f z@TYI2WSpvgy?9+34x8V2pfT=Ul@S1xsWcPcbf+!2=EFHdxVEL%ylDom<(O*jC=7t7 z- ze}eEXM zW5)7`#|~~{jxTzxMfp`C8+@*vS5DhhhrV;{ZZk7)y!kta{p#kLfgbN>2Xi9(5torq z!X+Diru}@($q_8phglUH^!De43|J-2;uru+%wX+u#h4F`QLP?clBC%wZBnGkQd#7G zW*#;>+UxZUaS!yoU0E5!9?vToQERy;xP^1^slZB#@PXKP5`QnJ7OFe(U~dQAek{R9 z#jMrL*T(#gzKB5=%M_aJqh>4TqL73nX`3fMdNsA=LS?ejF$OObcuzU1kkTc_%siUk zT7Sk_n0Q~ALtPL1ggkB`kOR)GsL;=8zWpNMmPk*PgNGnn!#a!`vYL{n?nwm6tR36_ zDGGif-@m|Q&ndv6`K`2_90&TRm%zpUDSTT%)XyMCOKm*%G(2t8i1&?VfF+}Edk5{P=%uVd{V$_(k#!xcU$e%dlm#-b z@?Q_Fv`7CTfA~K$P$_e8Lg4LzUDKKnvDCqDv{#;&g0JtCknj!9`b(^I{SV;Qg)TF7 zNwA8g5_wwyQuLGQfRo@I@et7V@T+ZafR4U@21@ooK2lDxARHH+)>$O56FSczhF0@_ z(yH-eT2JzMjv<80W#Z0x$ZG1X3L3N4-_B@kVms;Kq@)36=fzu@ZLSwTd8%~1+zv&u zc98xshutxEOF}8U!g;akpmHIP#($s#vGD#afCuTg;<0ff$<{ByUbgm!T78wuMZ`EC z&t*D(ynd z&mG$pscd_84!H|&Iu=dcN|wf!;_2#^&11b2&Ba9MR69)l$;MU`e<|@THt7)CZ^BZl z>z3zQ{xF4gD|_I)4PJK*rkp=z?DJAucH<1`kgbAjaEkSu=(C*IW#bI~i~&e~zWqul z70q?9oXdMcPQMB!Jnjnaoo<5gS?mZNV@%lv^RF}gI4lUPyDHuy8iW};*=dl z!8igv=Rn<-Qkt`Fe*O*3R&I<^&Np6UplJlw5L1jO(i04K6wj{- ztnmYFjk&NE325|=UAU{J1m7EIH_@B&t_O56Mmvd8m~N8CJ)j8_X*GFZPfcB5pM0Nf zL}37qDTK?JXrmw8^IBrbWwtIT5C4iKrQCR-&8T;r$-dbZg@nSa8xS5 zZwrBfIXKZSJ#v-AQ9?^51jg5KiNxg<&~EYhGASGLpA$4rza6bN+AXv&9)5f}b|cnZ zxzD@Vck?SgspSWZE?Sf8QY)D5;B0dXKiXkTV~T8;ls7KxY!?D}aYSZ%=DhsolT171 z^1+x92hrcebfUCvk>k{x@$8`(swcQdNmXGB_h-R6XL^6E*0}c%r^cafZo-?NKA6qzfJ1*6k*u}8H>u|ca+r)?z$8_VcpWLH9`;{n7k z*ZX+2taG?gRAt{_yzaq2NqqaKZXK&Qc_T-Ekw?_TVC!9WXQf7I%Q!`HGEEb9$^~4e ze1bk=g18CFMPW&YqCLaOb9%&;_gMh=st>S-=tK4>Y_JV9lw|NkZ@3+ap%j~#f>UTm zy!(*9mcj4Dm@ELGj-!DPC6p<$b!as~^@Wh)ny8%Gzsl_9KI>jSa zz8lqOQkS0~0#>c2L6QaWBkxh+$74+*1xsZ=wLUZ7(92DQa@-|Y+h;@Xb_Oao+`*FF zn?LhmuUVg+j_=|#!>OPnHeow_Kh?7Lv23z2XbJigqFuw{T<;olhGL8w#ipy9GqZdt z)|Sl06{E2EJr0V?j*Z30i`FbH*&l7&Lat`1BBb8!?}9AQcw>vnc*5VcGx^F!dbq)k zS|`mJg<9SR8-cCf2X~VMeCSIQ z;su%`6ogm;(8JmB)-U#72xaYj6pnc{DvqSNbo_DLnoot+z_>MKej7fHVJG&@w}{H4n7JYG zd~7;{1im)i0fym40Iz7(`zic{X8td%1xG6192aX_`NF+m`J3mOYt*Wb>M2!f zjNMV8g93MOA=&_Fqq4;p<7)9n_1SeM@j_?1BNq8>7c z%7Th4HIc3IAJ^}Vc~aZV?%_*5A4Siydu38bU6Ud93-6=0@uXg9Wn0AH#zdQl9hTk{ z$C6glUgc^h`!`l-fMv$bpJ@-g#5cgz%Ybw&ta4p>4x;KI3>M>>=BMf%;IFOh-^keM z*PHzhw8dppn46bjQ`Dr9ffMOz?JXr#M3!;S$ zy^gJBy2YgG(g6F3_Rz(oJX9MGI)JdH-iUF_@2C3R+(@Em;Vq(V2`?HjK2?NCnuUqe zLC^1uM9t%2SM@+G8E;HK40h|3C6HPA7AETvG#h8Fy(-4YM)rs(c&EV@3vRzit^ zy?md@a=q$U9C=CdwkL+)Y|;PUg_!#3$iqR8YZT*^}ch-sV+>A$9F_II>M zf#|QDml1@<)gn&MQ`ntELq`M6G_NlBbtQnkO^{}Nx@o#2P-366?|NW&r*D53g<$>Z z&e!78ceID9OtAp^kHdU~0%A30J?9Go2CJ^wx>c=_=`9{hB?bAK62B(otR#Qk*jp|b3lZlpQ4Lcpy z=!Ux^9LdE!7)1kjvD9MC4L_#Ld;?-29kh5or;IdM>8v<{(`I?f#`KzZmD!HR`^=o% zw+Bd~UA~bN&_?@!PlthKB{d?(le@L{0BGb3xrheqZ}_x3rF!?1MX3FrfsV=>-v45= z%PYmt-)%VRd zK+FIuQGc5MOyI(^r!WraIimqa;DS8uOpJVfq_srDo`ztmHXRv{5|y_$qui$mR30E2 zvVB@*MYrel>Yt225M<}9sv40)qYa)dG?=tnwc0nIQ46SlYYvBJmqQW?M-#0}jRr*# zwo0v@38or3sDQMBB#~4stDKqT0#jSEvv?RY?_KPVgSqA=pPe>LoV} zYpyYSmPW#QL3L22cfqg2WkwRC9|Xl5=bhT4y}B#X9wcZ(9rCFYiG7}8d%-Hk+la7! zF)xQsWF}NoapVcL{KltOg0~|-u11vz9fuy_p#V?jx1v4PeIhvTF$7hTyC!8fGEe}k zN&n0f8I#+v6T(K__7SyB3ewY#D9)fK-LZHb)qsq6x#m1SmN$d*cPYJ^#Ca==@>AK} z&K)me9sU;A^(LY2jnxvBNus9}p3Bo^Rq^+?RnY)?V+pf9ry790Zsq9^2Vkz+kY)Rrp%dvcS?@JCaTN_;XzI4)h6G;$GtiR zRoo0-lKBs{8)<`cnok3iUsaf`op}Exb#}zbIH~O#i^rdn?hIu{d#~~-V&-XN0j4?y z&N26b)9981$CIx7#AHLY9K(<6Za@BO=>I(yh|RUU+bT?7o6JIa=k20=p?L4VM(tN= zg)I7{96wf`!^-B$du2Bn6!c-o5Ml*~p55o#nU&xLf#Xc?!pBV$RaWrl4;*Q*zRnCs9Z`lSdu|gkX7p zXXO#QUu*uZpUzBtpv~W^DBTc9vh*E3Bd+O~0r*Z#w_n=$IpjO(_^v2zqQu@Whkdnr+9?{>K9;j`&%Cuh69_L$pCT7>>$I?Pp>7Ha;vcb00e)jB(R z%DbBI=hr1P$1(qF6wES91ECds%|8v(lp_=FJvoV`0H!t}mGEf8#W$Vs>Rz`uar7L% zTa1Q7!S1CFuACk(Q zP6)dU{)-bEN5~?TEcr1z211O1wV?^o)6_y&mxqEKAa3*xztt}73p&!5J&H087qdJ{ zr>|Yb7b&_YI~Q*9?#yUKxg-2S<~I^}+y3%U3kZ)u!2f`OC@hp%}7 zSTD`Fre%?}MXz+7b~#c98j$e}e1@T&%|inw<7BSyPu2Q$gt2@ZdcjN_98r(Ph=+0;)Mfw2an0c+)qoE11b2NSf>1sxZ z?6Sv){_Kf$bOeU~UGp_%uIUyxn=)m5^#i#6mA$B*EY<_ZJ>-l|)No??GxF9Ohp9A8 zZ1ezGi;qn@UB&RZ#AE54`{_J`tQjNiTKFV^EFo-Uw*Mh}JiEcQ#)BbrLV&TBSMMVz zta-z&-T`^pYJRRQc8Dfk@{`e^K-o1~OT0wy?e7A&`pYAJ0AgEKLEWDCB4xg_0Zh7h zg-&~&J|y~v$0Ng_?Bs#aZ|#R{I|DG(0ja;CYK$}9AN!PQAz2zcyJ3wkZ>^PeQzooH z<5XR;fWjVdQ^r!9){mb9jhh4rR{PP*SH}|59X&5iy^QofgX~jL{^0!v>h%u3T%f?psZ@kbGNA0kz=uoK1ca9QN#LRE*ao2E zg*+2j#9}(sz(np4CKc#(!Wfzq%1BJ|S|gmhkqtM4A{_H`ObVhN%-zkdm!>o_)n@tgXe`uFYy|{LHU~7!O&mkY4VBY2`#=_3&&iFW)I=Q^a zyED}BwpEGAX|3uN<2cI%DMown`VMBuJK^ z)XI=h^~-o$SA(=ixCd@zcmna5?k9lh9exkUzascl9Qb|9_Bp|n0&&UvBtKGZietr+Zh3M{ll#~b5vwd!*#N@b_?4DA?upg2F-ZZt;V*^SzMta*bkJ<6qj7_ADfIMwJzRw;kn@ zsbjzW41eV{7iAp)1#;hckMl}i$>-tBX2==_8HRec3|#c7?1Tz*kwe;W&@I znC(r9!u;ntDtp#51oEpmEdPETWc8^0f#B^;G6VAFQLDr3M~tYqC|a54NOzHxG96iL@>U$`B z`zM0ER0c5c1+InDv3NPRo8186@D4Ok@3$0@xS0yRx*I3o?l_kpxYcNdW5Tq+`BHq{ zE^jT~*I!XZxJeJp`Kqt&Ta{3 zgQ{hpc1=V2?jAh2LvVL@?e1yvzVCm{nptb^hx=jf%>8}owfby1eX94VUAyY3 zdJJfghH=!C(Bhiy{*b@kE#t-VOD7cUufMHHBFb6Tqnw!y5slHHOFUzYcZ zt#6PM4x+f|wWu~ehvfU`q{|h;T#Amq#$pAMCt&DVBQCa>N!o9xG}pFm?m4S75o2mB zHO3AwUliXlrbn*CC3TED>6%r8yEW|)jq9)+%+sEyQ$glfJNJ1}Z!6?>|4^<<;D@Wy z_A(@5`Gj-b;JpWmrkzriYQcxuDj&0zUNKtA=nKVwg8EalBZ&gHuXs*op&cPukX z2TD}OR%-mFfh@N#Rg?BAFE(TNI?Gb;@lkVb$5+cnMH$jIW20;Njy(I7?r&FK60a_a zAb8X^M7Y;t_ERQAO}rmU#B4Hopx(6atz})7cBDDS9=tzYb0lK(POPU@-$&>Mh=Ans zRA=-X+&}0!guaxtpU@!*@m}G}0=xNKIST-OEzj)V0KX7o+~7+K;F*)Sx8Cr>QXR2L z53%jdxG=>fX|3y-%xkCM2sHIb=6FfsX;xr_QU=>;sqBswj#$UFD`PO;&#+~$* zUWA4WW<@e;;@!#;7irT*cWdL=^5*+O8}5253|fpcQ9scjIL`36EXk3?|85@lObCGg zCVw3Ci{Lmi=V5YUMX-M&hK&e`(slUjY4=0P`ISKa@H_Ap=PjZ6zBu5WM)6SNyyM!- z9Iy72hXsK;S!?fC?zNkdxW;wg#5IhSC@~t7B=%w!?LDHA(DB-~^iy9^fEXPG3wbLP zN|W;?Mk$77V9}-C#);aoZWWK#%UPY8p?zqAlGE|1AZf8;uD zr>*mnVH-C4!gY+s*?NL6zIZ-AA^#^qm~)ejaYnz^xy{Iv+dh$ZL7Mbu7SMByna4Ur zT+jH8S8)#Mi52vPz=GYAY#4bfR=ADQ1Op@e&ZWrA0I%ntKI2PV;JOy@11W2&)UU7= zX#45;w<(+P9FI8E2ADd+h`E_q0-Zi~RD0C+-|%FkQ%`t&T3z@lq`s9;A@$g*O~8Rv zCgG>|IL=Ig3hp%70Y@+FCto2;VT=E{G;kiS&ktH_Y$7OzqZt*OC8QAb@lJV{4ISDkwb;up9v$S;{jnG--f>AAWnL$dM(5}_c>YPd=qY*CS3FN^An=M%VG zv1210f2r>`bbl1-S8({dpn*Yp*pZH@sB1k9_GXB3zn~+*ex>n4n~pgXcKj>MMGdvh z?jA&%f05!Sfu-VPlv?U*_8}lUo{6M99D|wsBfLr1KR5V4MnsUoarP@#kHbIwiO*|; z>R*4|0@0&Zw~Wi(cOf{9jsevA;2T)}uf-mLvCs=ETZS=mzbCj}Jf;`^fUb84-y}pe z)Dj0{*;UJfT?JaKHZj?l>J&HCJc%m-_7v`w_e{(`kIl%dm=U8%cNeXN)?AX}ZX7Up zC^HLcOx{~@=TPVjyh2t(eFdjH7D+s@yU)U5#!vBW7gDfbJ;OHhYwnjW=bKTYV=NNK z2$(r@`Ri9D0wsIv#bK)b(?poGl7JO!I$BG|c}R&yPV?F)AnlL0t3pTxh>^`|bDmH? z!}M~)aG5kHnHd@9P1$LUHyEioeXS7{Wm{`BZC_Y$hv1vPNvl?=-pIArCAxN%_qFGq z-0-FYwwwgc)rSDw+BcuiZ@z$G3J>t@NXhP#z=CeYFgWvkZ_|F%9J7Rs&DK3ce3La6 z{^OI`t*oeOiTb?fwMtsGyUG>i>qY-iJIW zHbDG4#~S;It0XKr>dSlPo<{Zsqa9` zGI#Hfac@mD#X%^h#USl2w}~Y^9>M&h{gM009~Ql@wH4Ee=|i?YZ{}yGWa7x&P?@xF zG|&fr_;(VSSci;m3Q-6au?6z|&!XRMP-?SMk3~_?T@34D?S$X;FY0fL6c0AXNa9c*ghxGp0kcy5eBJ;k2m^%!i{*Q>E|cP zH!D!YdR*HNE>wWW_`AY1YRq%Zm$+fHu*w>t zS>A9VdTG~>kDcmbHPmOl1GKKQV!}0$Vb43K+mTJok}+&h#RT@|LpUJ9rs=M!)^VC3 z$`;*0QpirJ|EVc~o^hzo?${wbqunPs4k z*t7!+wZ}%ugcL(CsggNEhtRwh)1%hMhebC63*dTIg1tmf60&exHs`PY`>jMh^61=$ z%Qu6OZ^_a~57&eem+y#Y2adN+9?lyhLyIo!}}bGCA)~u_f@8F%%h@hzrFRGA1mVQgO=ei zx^LSy^JC{)o8f*jdC!;KLkCyI+uk|NI6wA5RI0Ysn&fGatL&%}lVlEQlc%)n;_eme*I zRJpAWSagBzM@#&wPq=A7$&$((!<(;Js@3K~SHvDsPSWwCb>p9~dSu^gmv0&Mi9dC| zA$Lt<8mnf=&P%Cbxs6Jwf|>VYhMuJq>ITNYez-K}7|y#R$S=?!2!0eClBC1F+6u$s z|08E*kCRl;WSwf)E8LAKvqzwXiC?kc?9+4K3unz2t{-O|gT!Mm@cw3HhDn-S~_xY8{;T^3t# zNX^mmZ@d97F!pViy4*rHYi(-sodc5_ zMq`pg!5_8oB&+-%dm?7x=C0+FJ5lP%DWdEu8Kz9e{0w%7SOaRJVwyQ_M_yMn?|ZBu zI$-{QK~*4!kE4s_1eAg)G<3dORt_;KXSHwX^|nv$HDQ4xoDII?n=5skm9KY8JS(p1 z6&*^4VRAA;Hw$BRLWi!r&flAR9WRtyPWT(X+~cfvjMfFYw3FUVx0%j!@Hnr6RWR%j z1Hh{cIt=hAd(pV!;iZOQDa#ql zca}&k@Aq1=H_WE3n;x&OIG2kn3c7{0Y2uvi90`hf7uu+trYWUbiY@;{{Sl?DQy-rjz^Q(eIHmP49 zOPkwrO0@tPaT}m6J?V4f?9+jy$8(f06zk%61NQO53-$%t0MgSp^((2q%Zm1$t5_jO z7oU9)T7CB%dqL&vWPS#DgPN+^uEIE*8>|urzFIMwUFPW|WU^ZyHec*l=QSqYP*?8G4R-b#l zdmK8m=;15`eF#cyczr04c})wK98qZgI8*`4SGy98+O=^cu|X(+1{gO8l09UG3fFgB zFkOwT*dJ%p+V`D8*WOSLka0 zjik*7c4t5k_RHZ%dhn{R&)oV#iJ>8h+z=a+@kZqUdA{HK>#vC^i^uc3hS6G!uZJT^ zkXzrdFNB+XreR;m)5=ABPW+9P{KJ~p2^U=_z$c?Ia0rX6wv(q%^FuyH$^8LIWcKj% zd(o@W61?9@MnXHM2B`>b#`3L{rJaMu_ri`tD+HM+eKmg2nW3?MIXxc#q7RhW^Y@y5 zstg={6;T9!=LM08a_`7VcN>HyGVz~Tbe_Ta$bjad8&;OYzVQUdVTbmI%EYZN7GV`q z`jUJ(MvZm+&j&8tJh~$rkgj@(F^kAX$1Nd{O9VMt@Iz6xM5*-1g#EFD-{`#_Yn<#X zK+`|vW~L;|q0;`oc57;EDaiOTj}l&Aw1Pp3+$do8t8Z7R*4mc^66|O!8(u3+Uv?Gv zs&k&-Zw0*jujvjzWy+I3`pG<)^L^un0lop64j!#E3`IvoN3+y!(1h80R40GS_`1~# zH2v|QWD#Ay^{qTj-zRfAeGbvdpnf6NCI7SZhokc!?5yXqHK)+Cr|(?B0t<#XIm^lv z-zk$Uck$2v>waB8Pe?Gq@lA;$i544E)!c;hJz?;JBU&Z(A0{xL1Q`jQiHs-Vs==TS zJ3g0J(yez-MF6>nB-cx?Z`8W@PgO^;-I%sz49wdJ4)BYa?zJ^LpY7tE8Bth8ur?@5 zCg%bO;B;wq1;chYoEb%V;V7;$Ydexg)5OF?gS z-)sUv5Lr!%0-%iiO0WKA=@BM7-Av_vlVpZe$1B5ms9bW%8Yb3HA>{)NXwFGTRna0j z-u`3xbgJr!P2KWKGQ;AV*`t3MN7VZ2X<0`&GOIjR(t3@{7>1#)Wkb&dSn z*F+w$5)#KAF23oaQY{gcB~69SRm|OfHRr6ZyaGNQ5%4_3R6)TG&{}~LXP3-=c@8`f zBz7Tl>nKbA40Ajzjl-X-x@3en=XrU+JOadJ|Ri7A`OR*xiSe_HIQ{ zKCtp*?=?1$fb*9F(_TmBzPDz_Xd~Ish&5M|6y8GN0d+>yV)Z@XOhgaeybB|0Q!{5!x*n= z=w3Tiqw%{@d1c}xSZfrr;OBbvZT!o@D&${jhCdhrj+}ckp$Hnz^ig3t&J8$ucCInFWO! z$$u>#I}6SKD_9H)4T3^;@K!%FMZr>_SfhY~ zs6(lY^Pw_tFcX-Q3&CwTrb&yvU1SSNCiUBrpajs25w|`|&AUu&ZEArPGKvu{_tFlyNAMREf!kvLN)G9-5W$c&-pX z5~af@wkUMe{W&r{M$$v9F2F*?L{;P>eiri|MA;NxW9T)EueVQ#N?Z?FQ=Eo_=Y%&X z=H5om3K&~Jkkc0ZCzr&773jMm8`GkCjj8bcFx;;`vuePj_0gmJ%V|a_%iv@4uO%L< z{;QVCM>1Kx7xgdqBu5>7*PP4<=6$BYg`9QU!Ff1H<$!$md`~q zCzr706^>b!l6k09h>}}G%ft5 zA3M&TL%<(m7>bz0B`Wi}rz0jI==Hn@5IvO|{QU}eNgaF6{-pZyLCy*5C`CMG+;jZM z#no};5p&n4;qlbt+WV%GPAvuBBlC%f(ok4Z=54+L^fgBM5mc)HvQT$F!>SRZ{q8;M zpwz}tjG8ZPeBBr)5`nlO&K98K1hD~Y{YN2>F?8;DaqL~MXk{s4i6!guG@eJTZ6WQ{ z90}_Tzric8D%A26$}`pxW_alFvw8nMv(6ZIvpF;<={$XHQCj~Kz*R-;NuXA@wQYxc&<#*AsD1yOS4_|Xqjox3 zu_TYh*a7X+9SuWRaYeJJPV_kYCc({X-}(;Jc9T7DcKI?>&^Y_uq$ygv>sdFvF#=^P zHtA@bRG$@jK(|VhuL>+e3E!G%7UgaSUAVto-V?`|t8(S#=5C=%!q6x$*MtTnQh?l){|Q@v=HA-5@kNmC3=^>y zr`^qi6^?!atKL19oZY^C^L2O?`iB1#Qcw&E@EjVH(XnBb+)=)LxxOVG^FFeg`)k;? z=of{T{d7$GC^sQ*QAsy@-z7*Qh*giGs=h`bc>&b1lfUVwbd5rLIsLA7=o4bGo_&He{o+Op4noJJXM{xE+P{7*imR!6=ZD!nAES@^UOAL%NS{W%cMr`g__ zz(#MhayvoTL%nJ-rvBs8Iav*vjH||nPNg1{q;V%ceJeMmi=x(s8d#C(H zKLx__9Ql$@jl4*!+MsK*tokfC97k;nax=C~v%49adL-VC40dlU0g65z0p&N}Nzr}2 z^gClAo~?&>xRzjviKY3=kL_l-%;cP5C%#*(gq0t-c5hfqZ!nnmKKX>G%JlV7qbNJ* zZvOnF#b9PfQ8HF9G2RG^(#%(Y`_BEFZBe7tI})8V`_S`?olfD#aCYnuvmv08r2@;0 z=wxKa{6}~hMwKEh(z)}9q2-GK^`!=7i0q(>lRd=Z(`Jj^?zzyvmQJQp4`st@Z>iW{@Lm zz$53hQlT!Y##2cA;wvm>$mEf%u=vQiXlU~d?{B9q6aJHF8QH+TFk+})CBx-*MoaL> zb-_JMLw2k!{ZfXTmDyTt54pcz3$%ydh^?tya%UZ8Q!X3h)7~ur$ud67#RcnB2zT63 z0jVPlzyUCdaP|d1x$mN3MQ@FJ`A}k;&?Da#OH3Ps*iQ9GfM0FFk+@}^Oyn_qDj~^= zzGU5*5tb>d`=6y)q#4VX%`y5G(1{c^7Tco_ub-y;TSdqDGNdSTqw|( zd1M=nAw3?ye<-u{+8Tpzhja15+vQ;Jjbn4Xvg%Qs?8;1c%g}$wYCp5`JzFmy!cPuz zepMS4H@Gxzv@)-Vm{1W&E3Plj{K+T|4ACZ>AwuX;6Hl==0zJYd6jVzfjFK83vM}r#lLT;65@ zNe{n3T+G_{Wx(RWHG>4Re3nswJlxE4|3#xzp?-)*RY@8DkIm4vPTu0*DXzn~t5(?%muB6@6qB zmvvG5$X#CQ8o1c_iB#+$(TV~6y;jx?iblju>D6&ocg3d`_j0|+9cX6T>5D%(3=gY3 z6f;stlENYsSv1&KSTfooX1{3aC>3x<8)RGgV0TLodymtVHou#TCmkEdH=3@?s~Kl#S_DIGcU{gy z<`=W;(I5KcvWfK8A3Iyry~aGf;xylVr6@4@UH}w=NTm401$QS~ll!i$6n(WQ+(G+Z z)tAC#O;Q?9dOg-K0a)$k7IR^(m$@@5Gt|a$%ztlb9(^wZp}kFwy{` zttzcb-#twZt@RRI8@BJ2n=xW;C#q#+@R0X$=@4t6S+;Q!*+$*VrELKRUB+^hmHQf7 zzIrKZsZInv5#KI_`)*|g+}xcC_!0o|G&nr?h;4^m!2$&_iq?wrKh1~_(~u zGBQg+dI~J)MtV-}pD z&m!WR>po8pn@9xo=&-V@c39ZZPC|Hmj8nNn82#Z>{=#Y_Jsn%QcC5uZTVCDdhr&O7 ze`gtbXH6uOQX*BNeDp28>G{b;=sGy@UF=e3rQ~UFmE+B+-gkcNN)Xn4LE+berl?j1^cj|rQgqUg4 zVHdX!_m4cwE`@nk0;{Zu>R)YRGA?3-WfVy`xZZuQ?XcQd6fdk-v)P&+nHi;_z3-lfy|=Xl^%s zt~L)kl!JI3rs!BUZ7{yqXbCVsk+dj$pDs`f+4{O^J}>baSG@D!`qd4$yx>$+9wLmD zlzD&iv#Q)VH;A2+)CIG4+5|?b{4^zlqmPJdOPdGY_q3#B@AD{0-Ff#RWfI!_37S*( z?PS^c@C>3~(SIDcM;LJ8`^O)FT>cyJ!bK84!zaHBf3Nqn6Q zI5uzGRdH6sb|<=!6iXJc=uJJ(IHg*HCG1s0C%{$o%-QVdpr6@ia3Kc(bXEk!=p?XR zQOv!*N;v!`$b#v*p_Rk`>&VClYweG6Euh%xOjLU)6&^%~C z`>44&A&jJ1d6SI?F$&WPbNgQXE2VibF?*tgUIt+3($Whu>(qUl!kfs2b1e2LC|eMi ze6GEy+5{aox;2InF!2kNSrwSqA41hvypj)sB4lTd*2C!sCQ7rcvNUbs=~+mh?nF$8 zUQm{#a|VV8LnIHkYV^@ey|Kn>sIkOp%$i>xAb-K_v!HF14%x0twsMi}~4&TjT&PsByb|dG^Mz5Zb zHIh2fH51c2FlGQFI95-(ObGn;7I5+|53)xz$-_$qQZH-!=uT>qD3uc-H*^>H3&yhh z+zUoY_W+~3-uR_UUk8a7b@kUIiiS!}++u`zjh*2?A{tvJtgO0m*4xdxbk=|DVGQ@kfF`_mj3 zI%35JjNy{asKP#R_A|buu(M?F?s6as@I~_RhyaSAH=$J0=eh8mjOiXbfuCEkxt~cq5i=;>$PR5? zk~}C|+&P@{NM>lUPa!agZV6T=)aEh}bj&Tg8vGP{5*nK&$5=FJ@G0yk&TGR7rJ0E{ zHV697`P5H)jBS9%4NY1&8qKfX^Ox8YKPLryf?S@-FYRpdz*&kg^2>+J7*bfK8}c38 z?4`xiU-HYvZz+!NZ!?{tMHqG45cLzlHl&1yP`U)ZI9bT}`5TPQq9a#O8J5$oj8YgBw2s1ZMT=*FL->W@J2iDXv7LVw0va zSDS`n+VTyiK<4s@HhzAUn?JA9!Na*mBIWhw(nqGG{Kh#@jJ=YMBDUApN&2QodUZjL zEQlV;%j+!mx_c}nFn(SG7Ek9nOm5K}kc$_c-6c^~ zf>HUu6CW{Qy}PR-uwhd^_kN6hEoU|aE?5E%K7V|aC|t7e^xVdcEf0c`Uk2-IMsID7 z{-9N|cybe!{Y(fPy3_A71{ABTGK@h5#m>%{%vmsV7&*58Lw?m#>8KdgR>Ga`H=m2X9ee@!JX;4nPYbIulC4iU@c~tHQNiFBEEdNZEs@8F3Hx z(o*r*Rr=I8P*j8h5fzgx>83kB)bK^a$S*~NVvFhI<54te>hSqWy>l6^3n&~v^TLSJ zUSpw50jg6zi3u5w7;O9%*&ah4bY4ZITZ#~P5NJuP$ej;s6&?93%6dE|CThxjT(RQ0 zU{%cxLb-nRp$4I?7VsJ&xU9Crd(%2+U_pa!8h3j5&DA7?1rM)&5^@k-5KU*Ro~oj( z!l^$l|5&4<@<;BmgeQYLtyIzCe>E|9$`-hpk@o9y?23JQ-U(7-&QTw;exm>*zvL!S z4V8M2sMt6Km&%G*M+8GW;G@nWU6$Z?1ti z+}lyd6-gvHW=m_pp2UKsEd6Z%=yI-UiPBrYs~Wk>H%Ep8L3Vx85R0z>LuCx0yqwC}l2=bMBgWUJwQNA16ESzx_+3 z>8p`DVD(vsDkFvil6X#Ui@3zJM^i>yPq^xeM){Kia+d*P$lQc6WOBh6GG%+FRQobx zeV($)%zsNO8%@M`Ua~*-kmDY!s}dLK2&*dbyGmsE(@O*eG#-8s$ik#{4iNq9Nk_uDc7#dE$bN3jX6aWub z>ppB4cWG^qe~+!j5Vl08tt;m~c$ET|oJSuJg98i~C(-7W(*2oDm>bOx_vx3#zUgQSdC{Bn;8yoopc|C?J}<8F9v!ckhWT6QCbdYozF z4Lfo(tl!H+tqp+>1Wcfmw+U0y^5&w2q&9F~9D+)X>hK_LCfxA|^LHbO`q_9$3nBUV zXK@-v=$RBKlwa<1ieMIzs^6nrRc^e2Hk9LMbN2FFR`{HwO4*^qm_fuV*TLTxy`lmB z>&7V4*mfTn7h$$grnlL5>JN$hKWhPGEimit+3LN97?abbaarpyK5Op3A9h5vKjq;i zNmVicgO}1zk2OocA#lSnfgU;EQl;A8i(U|`MUO#n1Naxr@DaY*jjh^bpI9lQzB+1G z@WabQ-ym;@$vO!o#zwASDkyf|meD8uLG=b}=kQh!)gl~dqml>C(;?7) zAdh8!-XvN3LU$-%MhBut&pJapbtXv&2?oLaQVTm2p!0^Pjy<8jTaguF^rqGQBTWA` znR3;~Ts)~}0Mh!=y)PKXjJNOQsmFPJ6L-hTZ=U!tm=~a1Qe2p!lv{7Z~ zSMG)~d?uwvYBTx8@5_{}_0j^i-$ZHrcE!%XE@scmclk;zfnMtP)g1qONp`MW9x68z z;s@rkl$^cN7|qY+5%EkQray%Q)1|d$G1)czT2)OW|OCOKv*HIos15u*n>y*tGW zMQTM~qa#E|>ru^-?=n&`i0oz=;ccE`?sufV6RJ36$k7^P^(+$VPXC; zQx!3ysj8NzhCqxTn3k&aWmhQeroPPFD)em{sS<_ZM8>SA`WM0IVZiR@^wC#IIT^z7 zSNu*2Ts&Iqi63>@SKXd2XW557S@j;ebi7+os7am{6 z$7ES;hGw4EB9Z$}6C|<#f0$HEH_*qJqmlkWC7>2*_MN6;e6+fhb)c~(O0H0)eUVN4 z=N}w$Gye?!M_~Ui7RliJEITtx_f-EuNw^%5qOSDxe-@gM{uJ`_LhEGVIh}|hv@mRX zKebbx_T70W+%e5M1M%CiVCXn{^%Lf+N%~x60031Lk^HZe~t8T9G8oq5(oj0}NAL zP>qt!AnuN53WzXa8m*W=+Z7KAOW1v#2iDbQ04qx&k}^6o&PBXS9~q32MS+!T?xBil zA^~wglFr|PbE7(n^i`67#l?~_G2$y+f7be>;LJ9IotJafF$o=iBL}T1SIGc={5T#* zmF!&hXL7!DI3@7~cX3?wUwakFE-MN!i$8crO)W0$U6`xEHdCXU%0AGkA)WZ|4(sM* zK-lqdde-||hrf=`u}1#!FogqwT)el(>$OkQ85i#@bGp@>wTHb;`vUum>Zf!S60Bu& zTBElM9(mLUdQKL+>qnc#XEUNcHLjGTzE@m4XrE8K#jbe3&ruz_P|WZ`~J!#tpC9RUgQ|im~EM?d7TtT5*ci z$<@#ZjwZu=3FOQ4@=)em=*1ImzcgC%HU#&S*Z0t>9eCFw``phDwWks0Na_GwosM1H zYI}Eyd%!%QguuHm!{U~gcl**)pMq>a4|o<&?`~l%_G%DFdQ%6mU-%qtHPib>hmKq# zd-_vQfaXPPj#pAW^EJR|LJ2f3zH7h)BpUL?6RPdW+tqV=fY;OVrABJ^>HZ46zenUA zmA*cpnM{=C@LhmN-yRNG6gVGFA+uT)P-Pe2OSB{|9$+7iM6T~Y9A>=$F>`T#H&H+^ ze2ZW71w^Cyi%2Rz^Cz0^AEIgn4+w4nZ#X1c#1t(M8ZARVDc>kVJbA`{30bS1nl`w zKl#mwZ&Lf2Bi*f$ZyvAMXv=U1Z-oA1GLv8(-_A3XbCy79GjD_3NqU%%PMEE3Piby% z9K*7dofZ=2A1n1YmIKl5BPYXs`n4vdVOn78YV|y*&#UNPo>Q25^i(*54~#-S(-(BnR)`Pc0;3M_R4G0P<`_`=gZSh+@UP`2Akvchj*{yWZcs{%%brjHzid2d4)_N|FQ zwM=d1L}CF@{n~W24z;)|914E;p@gX(bLaHRln-z521@;dFJ=aA%h!Rfz|W+C*(%ms z5!5fQvUEO^igQ9?EYEMKHKSFBzpY^uMXK{^*~#@L%41-V6J_a8?A99=yL%66+sQ=& z$??NO0LgdBHw6_)=Ee=>=1~r8Ym56R`P_N&T*(pzNjOj(U=wTdO}}3kePwkv=2*1y8 zhiSGS(*rLN2N+$sjWl7P70N%xJx3phA{N?(`w~u+t~Qo06j7uS`!#w{jD6(*iQrWb zy%?W6DKzJdT|?LaToEbOgJ% zW9gfjfAyNk&q!^UvzI*WWvtt5Y;_1MRuJ4x5UBwg!2TQ6IN4l~sqTZzit2cF&A>h) zvwkiC-M-PJp(iSp?)k<4-VOVAgy7v6xndx^RK&%TW=6;0rM4HOOJy8Cv!hRlFCf#; z+r595T`+7{nFl=<0HQA_2S0Vgj8@uQGw1vP=ixB(UN59V-`qs|4Oh@lMAIMsoznVI zQX0~XO0Du71|O>qP;ZgdO16eFgh`>bZfK;w^Of=GTDym@Urk;_xJ$7yaHDD>j~tSl zTb$_tf8VJ58o1CXnx|26_Sh8+CoHxB1wYi#!sReb&{l+BTJ2oYd@3*2d~-0C^eQS_ zBDs}rG$(Z|A*HEUOScf9kHZ#$V|bCq8~aIE*=(m+&ms%*S@su$oa=z?hG5#gV0dcD zKNJ2V!~dTx8=CQ1b}s4#nD$mS!c88Jn~Gu%fxR22x^9ft<+89#mFZ`I?Q{=)uKjm4 z?SD{12%a*vGNx!L$`pKEoE&Z30+SeY!zXQVR46&l-*YR}n$rrj$#tbtxPMcS*1iBV z8v}~qliylMZx?PY7jC6^o&peIR-K&Hx~?+E%*0`54Z3%CeEF9>rrV?V=GGuLOG{kx z-!*rv=VJ>9b({>P4s(m?HgbKIizs=8^%-?W6n-%O~IhW)yEB3AI5$>p; zB=b2*VaIwBxkvf`Zx74ty^+@MAAfR&nd>_DWl4Q9VBeO9(%}wwg;Y8H{+=QDkhfLh zAMuBr=S#~?Tycc+;};U*v%YRASX(r1(S(2G6WATaJ@!Ayc2Zh`9a6~rg%*lXePs*_ zjqs==Mt-U0m{K&RkA&ZC6WCp7pGkW5RM zgmMWI)p0;zQJf`UBahA;o0NcTuBKm3>7a}Yj2!_zHl+T)jD0LPVxp)CQL4$}c2zBl zTs|iyF69@ng==E9H5trsK1O8%H(3v_2Z6{@ZroXYqZ*Oj2NID*F90Vl$6#2vi|f<6 z4Guk@-^jl|b3oh``Xbyj(4_M`d%a8Z%T;%6W8u0F&=8d4FH@y(^!ixMQJqMUqoCu~ zNg0z=;ki_Dj8-GOgv}vPcJM>~Ta@Md3r(*y@}D!3ey{MaX$g znzfK9(ZzpR52wT4;f^f!um>!*j6R5y$_$Q_v4kF8#-9@q`i>u*fw zC%*eoqn`MTJFx~X7)IG(s@fp-)97#fNY(v2h z*@(JE{5=Uq0cK2LQR6U~w2GqOP<(4VSp)om=b!Kl)5_$4Xtay~NA5W71Y1b)6)FLi_l)Hgd_?j(RD zBSMPP32$JJx`f2GfV)1;PSgH13uG~5&MD9Vol5xNtp8dtPO(D#NEt`r%mbJ9&MzF;?KYTGj0sH zeP1C61?_flG4Pi2hiO;@&Z4_T2jIf1XcGhbg!uwcgTrqu?(Vr-KGc_!Jr<`-aZ^3i2|zQVDx=Ahjw@>ECD^7$k=P`R}5=}1K-UF26DJiRvDA{IO6YXVa6O=cNW(m)?I<~) zwOIW)L`fG;Cdxq&1`YVE>AVq5CFjyWkC>U(#AX9$Py)%}TDtiM*1Y%02HQ0K{GPiy zBl1Nh^nCR$N`_1$^45XYTK5fQ z<{wcF=#niS->&ebgU^CE--fty`PsW13Br+|#i^%igbHu)vr)6kFxn)AOp142&at!B zy`EuwNPLq@+1Y=Zd23Y=UsIvO>pb!qNvk&YwrR-|1Itg^UhW2sSzi*i8 z*`}XS=TCHs=cnc{Jsd3}?nZsTeNDC(mj`uvMI;t~HELDL{^mB9 z@%*-m;kbe*AY_lLQ0`Iu74Q4^yf7^H19_K52H=vNr!K~3mAa{O;pawTsfUz#bk$OP z{zM>in6#8zppE+l-~{DpA_n#Ppo(P_9b~8Cmwy1bPcLc>eeG~4MvK&~pN}>4Ar9ph zV>sfHhW~JjCjG4^+dBdTR#U21EWATFo-w#1rI$GFval>V@j1<>*e4lFwrRrsj(Lv5t&FPi#D57G~~Zg9NToO2AmU3Q6O zn_F_xRq)*hX&2WOsmGqRQd#9E`L(_3d^sX^i=PyzeoX5I zO~!2FQ1HI48+X~p7he@VWHL#bfris(BJZXHOWLhH(NxLjP1H78s0?9Vg32CGG%^J>?XUs}ipG?V< zt$X#l9zUov)=kST?$=83*~x8VXBvQ^=SP5U^tsjHQIAEp0=CoE%dgO_rvjNT{MS&2 zE9l+b`TBuvML)QO`l#bH!!(9ZcsCH5+6Ylr_N7|_!WhEHp}uc!alMJGgWov<_N%%s zW_g%FW^sMxu!5_>AZ=Z~tIfyo)5x@J{BrTk#>?^+K31Z&J9hLP@{@X(y%j%%%XM{J zfZM^e2Cc!Bs_Z1_F^r5#;}5!tbDN#Av!I>NR>dl4?qn zsBaGuT5?FP*xH+5yp4T$x`sTShPsS`IRW(L4G?eBCX3|RVWPs@eXn5m<@4Q4D~GvN zN6vmIQp+*HPO9aKt~bp4Wj_6jM{&F!DyJcKHpqMCo2X|t6xkjdStopfDy$v$$pxp4K+FHl- z9{=u?Rc>PzLSW ztal1%2qkm4e->HJ6*!ZKhWpo{n3hmR1GkYnH8MXRGexllPzXr)_c(eAAAfT&bEpxC z@NH957rwR;F$VvZiW1=9zcKdRK}|;AwkitJL`8ZDh|(b-(o1Ye2T_XDh)9#(J5lLf zL8MAV1Vl>c9U{GV>AiPCfIvw5UVit^n>+L7&Aj)2GUv<5+50ncZqNj27iKwADwm_RW_e(;Kn;@jLQ6kcpfji zNat8G2Vc{GiAqqM8h?8&8dqmwX|JzBvOfl&*;~C8Ol!*iyvQ$vA0$wQpUflGhEgU3Vt{JzDTS`;#K4ZU4A7=Y(#29 zk}CKPFtz06Ic3w_={DQTdVp_c#jE{|P76s2taK-br{4$7_# zej`EA^${;afQr*gy>54R&z-2RZfY9As((-H+a0ll0&{ETOTp`{`brwU8-{82z=jn; z!S2+e9o;>31)h$Bpx2k$&TFPK!2dYmnS90dxLvElyp}%9l2xO#1l!Eh-P>l`cj8WS zqkXh@U9bz7_QHa!?YERYqID#26ZS2uzkm_Yfd%=Wx;H&J#-|C&9d7d#b9Ve)(8fcS zm)qMW((XXrTEpM{v|yAvFvmlVQX{R8RdlLO`sLz;<`YJ+4sY$OwD;je{8EIWkqLEx z_bv?p!cNU&H>h-~))H%8Nsg8t)D@jU8hn^zOkTi-7z!dm0r#Am$4gBJHiYE8IeLoq zrjsF%E)j#adIONg{A_aolTi|atozsFT)CUjaj$cAJpI?m9s&brB8h<;A8EYWu=NE_ z-yZ&jj?qrs;Fe-Gy`JoJm}ZDUo*whAjPNC{_~4h*8r!!dN3#{8JYQScrN9E*dQhX&86l-_@J?$dJ(Z>q2iA#@E%~jDDMx@WoHE zJ}ppk#tR7CNHKm2zw9R&8sTw_po-Ly#T|OB!Bm4La|vn}cFH}b*DBCxp?}B)Ou_NP z38V#K30Q8IIE@j>f?MKQYulFB5;|#xGVF&L2HUD$7~o;mKy?w!t{a&ijf}Toh4D8Z2gt1r zEO|cGgK&YVr=FS-SaFcf^;~lxv65uYoMqdMwzDmT6+&j;)|0s_c*Xo1i`si@$QssN z#e*AzZTm00I??bx0UPi8M&BF?0lO7aJDE;X{fp^fC*y&LfO-G07e4cNsPP}?=<7W1 z*>P(-#eECF=S@Q00 z%s6kZnuIeQG`Kt~P(`5O&1dau{03^|r%Cf(LD(;OBH-5EYn&ee>`$hH z*R8VbBC{+b(Px@$4^c4+F{Y364*vC8_9Gb45Za;(J(UAGAD?z<+8Foumgy=W|w$+Et*?=(8b9 zfTHXt@lR3t&)}SE5)Lv=g+HBRQu>VJfsbiTNE(qvdpF`vqA$bAuq+IF2{HrQ1OeA& zmlQ;`gMEdO{rIs|=IeYejl2W0OF`vH&mKbaMt}W$*{(sz+=UInhZx8y6Zu#U{E z8^wvf7=kTLpGs2^1sRsrfLFnAp+0k5WS_a>n%O@&Fr>N{c(s)VQqv^1WaWhdBYNtW;cPk%I4DF$A}vGY6UD0HdxB10Wqu)evG|Q+g96!XgQpT6KT0~gh4s0Vp z|2}KXV5BJZfS|5S0mYs}^a5}a$Dy69x#zV*0q7LXWWOWx+h3pT0QCIPZKEofCuZW^ z{#bxWyqpFv2F6YFUk*s)=_H=h72DTFpNYbbUqrL)2Ogfpx{VLk9{1Uq6gno{tB%p+ zAY^9hc0i4)7}iB~|6W~X&UB><*+e0A){rUPlBgEEC2PEK$!r>aky zxt6MVm35?D3k2-v_YT7towB`n9Zgyl0z0TG0DQnb$_U3qj^SuejA z(g_3$_!7dyY&hZ$=AUIDpQ-?_Rh;9Pfh%oQ8hM9=I$^`j=M1t79*$@IiKa?(|A0ay zQQ165=+H_KPr|QeEZ6@IvA>q`{Mj97Ad|=}egjEJGXZvsB8(|sVTvA}!`rg=s|mCJ zpbP(wB#x#rTyYk1LvomRaTZIIWQA*<&l7VSrM)ni&wv0qQ0(>f9cZ4BMOum9cISlI zd%FqePzPZ07MWc3pLVgHJE8nP;=1pf%(ew+@-_I5cGU@1S0G^i^HW2yOt;7s+vd8b zUA*jfyF;sw)!TP+3a%Yi{Yl?{zoJC1g<4+8*mwFdUVwt#;s1>NBEtO5@`2aW%Z0lJ zz~hO;oS*-^UQ0hK7JBcaGydjCIHdQMYu*2$r<*7~(!(bpLa732b|%f7qn$Mq?DydO zvpb34wuFX2zt_wC(C4t^*p>cHwz^k?M*0RFHKg9M_RuJ+)E$GyEKo!C6C6apv+2`y;hKfGyB)$FX7W zzD@}k{@#8M9@8Gv!#XL=s_rdeR0VaH4!Mn{R(SZoy#V6e*FTQ>Mu0=mu|}o6u6j4j zoNHgD$+_Q61XCR#^{|)EB7ol*cs6X%(RNoarO+^!tlN_+h8dseF&@nAKaz9_C!Q@z z5l#gl>k1<~?GEF98*5@|?{WiNswXyAu(=8Q#|LnPMteB=j|b6RmcZJzB;u!v=dA;* zRTXREk3?qeYzW|1+Qs(rpWm}Zx!FDS%tv)gWX?=b+W+Pw8lM384J);<{z&sq^N2tT4!gWG6V*K?rK>39^uaJkDv)@-Xa~6Q=~Rt>W37F= z$4Y;<$#A|3qeq!Y6eK3rcKj%@UOo@APPk#_^ra>N?O)-EA^(kk5?7ZDWf5Vxm)&0~ zK&XMel1|@Zfrko z;oQ*^8sb&6V{FKi%lNuIgqi4QnqONvb|Z3603HT&zGJQjov|k`MGg<0EWsX-E|?A~*D$CbOb1o(GYgt`a;6!*MVumZH7#wv;J5@bKC%Ha70y)AA$23Aq?kHo9IElIuIY z-MB=*u+73$DM&);27^Z?ua2o)K|I7MhA2RW=TE|j=X3oT^wj`~h>OT;Ig=K0JOyO< z<6P@8G6objt2O*Y6uAuJ2sl5aE=K&=x}O;d;^ugsSPza1J{^^?=~K*^>ML3nXkDUl zEI|*Z-FC?LBpO4D^!)HkzzwrtSic*mMe+dX;z-5pV+gx0-h2u88@dw80HNCpaul-^ z@+ZRv5k*Iz-mQeQv^~QgsH-(AWf!c$mDbgc)tr}U78UaO=4AukVaHfnF4@1AI)`B2 zOj~s?$h%}ZRqz^(&?lH^a3>dNQyVYmQH2K(F;rwU$KuX`RZt!A%xdK_VfAf!C(DMI zu1uFO=7v*0kD5pm@$8N{TsUaKQfL6I^3of&MW*2xM~?tNWikr_cVCr%&Pt9?kZbV zeI8borW&ST@0br;%Yb?JBEno5IR7?y#i%?IZ@}KpeuQdiqp>QHMn)gp=kAI*v(Ud1 zROfAI zIp8dxT6V85mv@60YUgF>(3~tS$0_&QYFn!L&k`-c^Zw@xEA;#6O-e@iv)y`{F)eoG zM7EPheuv>(^6Ot~7hy6BUbzx1E!1B?y`UZVb11h=Rv*qUEe;w&cIcjJ|I>{8*xUWs zgXrPs$2=8`?fIfU^RYy^1(Y2~nvn=%?JAYDcGKCSEkc~dmr2E2cquPn^lW~=OS3rn zBX$)hv3NZ$9*R3oZMz*S#!L!8+pM%tMp{YjFAxtNQylTObF_I+EyS_F;A;nB>!E2! z5ohO%R48j#Gu%xpk<*`p;{N z6H9MWNC=$oQn0MKkGyl|6E#}vUYqHd4Ym+>ts>){AJ~ymB+y`0ct5pIyqEk|mt6>; zEq-9BZiZTh8etA6V#m>i@v!3yaz+n-oL2mE6y@c_Rmn@N(7e4O+LHUE=>4i?nmu{g zlUdnIUo!3+GOj%Vtf+PUgv}?GUyMGomRV@W6*v04wvM0pf@HKxW#X>RS1zT|5Q&<^pDh}(!izyC z@e*%4ELIlvS;1SGk=^~@eWq1HB0CL@v_^lde&Rvq;}Vn9M6$X_LW);HJe;K9uA-v|Gr$|E{Aj7C_M&Z=PRft5Pgg7SNV z9}L5#)46J_AGVSX>mZ16*v*R8TJ90Onle|mhxpWE17~wOj@#mmLH0kkRyK@Yf3vpD zbHl(+N?_rRh~@+^Y^h~0%;uY=X+_t?!ujGF!vk_Z5S0DVvO}3TShioG<(W?1_%BK8 ziZl_u6}|zAKVCo|{K)qEHgj|Ms{zgW)-J+907>+z^XeIqAVnj? zS+Zf=&cPu~UM62*y$be!FP%S-ODX7uIla$t{>6MzL#hT0Z$CLD_3YXVcYmc9*5TvN z;@E`}_{1xhFTjmT=%lY$vwo2SIJ^1|ta^?t2X9!!N+pn~EqD(EcmJ$=i17x7#}v9HeS{5!OFfZv-rU!A)On%D1uB=9gH1 z=KtdTyg8QCHq)VfeU9vP&;=^!xE zHBIj`w}6iV0LSW@cY(F)4UoBVA>Y(B%?xejRpah(UhD@8*?&5xyCr;1m4nPHQBN7D zJ%{A&`a)l%oYmqorWI_D=T`7$ZxYX}6Ye+-44Sevx`ao9{2%UD%`u>&@s}cm<7HxdsUpgr zh(e>++;wV_f98COQ^n8Ohtm5k1wFu$&L7m^c4VVMO0!lGQ*i#H!w%3nDCFqldSn>> zO%e_WIp+J~u0k+Y3y%e}_027hunN1!*kYkJc`0r3b^s-$2r5_v;T0@qvG8)2+kG9- zJJM>l?G&T@9Uz_|tz`;{7QUFzWorDUZjv(Ko^XHw^V4@( z-zFGp)3{djKKGmP;7r<`_+svJ(VEyUSf!)V^X!~wUH&a=u)2$+k@22hA1x_BLk^e5 zxR1l53w%+AZ6-)%KG7(s8x}V{?R_&O`tcO7&PW*v<#a1EuaqOb7!CM=Fn8ZkRq`qK z%*r5`DGT}-EN@4T+0*Y#Ns()+XHG2s_+09-OqV1mt6SEW!`0ZK?)8a3U$3=XlN375 zBYwRFB5#~t^BuQwa*uo0txz@t^qb2v$~YNY1A>LF|g zxPZI$)1x_P>Fif1k|?m9LQoZt)lwt~`29&w`RqFHhgPHv#xD61D|_n~7LQ(=r|m0h zoSkjDe!bqjrH&K8W~NI_b4;QKxazvNe#r92$TqzY63~W3_k)^&ZS464I7B7OcQV~i z=nr`L*R$1`@7BbkHN@Rh9FlM>k^?>z@cFoaU7G`4Kt4iBn}vS#Zuzk{*34$lfeJA( zBj@*ZbCqXB)?gEm-m0I$%K;U)FXCR65!-O~d{S&cv)>+T@xRWPvs+a!jT0kq$n!<~ zN>6UWN+2r+*u^aQ?1{NEC_Ws}0RJQN`B}1SI2+DpIfU-b5M2wnYN%O=m9P!26&RNTW+gD1r?SE$OR}4`e~H=z(Ydrn0G&xArTtM@OeC~ zhCVxRh(Mu|#N7=NdMUEsbaI1y5E(uw;MVpuOx8&nrC&uY{n7OoMsrp#VL{vBEW)W! zkB=!I+1$HYCd$y~H8ikxnR||<)d6IOOh`Il5pu*=uXlT-8e;0N14_(qPxV4VIeWbC zmDH#<1BK7K;j!X!sRE4hj9J+B^SUlCqMovY+ceAC{c|hN4|d8;+guOU+m7nxw=!Ia z_w}N~H(ei20>57AF;p>eN*Ao8Et52h6Okl6;(@DG@*r|p<9yB$yjY_<2L)VRKlDze z-V%BDVcKAB$!E@qDM4vJwc>h5R%kS7XLkHC_}6wS2--@FJbbzcyGoH#3W!5Gq}jY7 z6*+M?C$?c%TS6cCv&zio{0(L$t}nM=Y5p*Z_53E-uIm@=zXC-!g`s_q(A`JfFYFBQ z_~TTT>$xbl$ExaT#ehGoUV;<0+RHh_n`#jkNQ#NeaYuk4YOlUu_L+hg#cUzg5^;vp zw`0AwC8SPnGmeeFJAXuAkDOiFDR`6ULu7q_ia-m9o)7N1(#49_xYapgoh2^JDIgRo zBy6(Z$7A|=+2N-#O@PH6V8}jzWXXn6*z-LVWdw%YNGLXG1;TbWWG!4c$YS**F#*>9 z#&IyywJw9GFTatb$t9opF51}4Db9Ney6)#gl4{Nvz3~TAE9iN)8d~|79VB#cl9aOi zUPX>qmwAm-GWQHYL|{|v$i6d^n{!!P79494p|2cZ;)2m)WUC+;{0s{SlCk}vv7+v= za;q-=gvP2<$HT6&5aw=3v3+;jfU(H{rgPBsu<)fLyO`!fsTVG>LU8v;s>sfzcJ9vun7rTu#JfsAI*N1W{~y zj8E5LCdJIim01yNYeg@TDg1%VC2EXypW>@FYJoA((iq8=L*{Oig2T(S+_|i#7`bX# zvD?BXUWr%iweBY-eMDHYu1b6(lxh~h$j-MhEI*X=z>$5VT-RXT-(fco+ppgAE=9aC zyi=mS7h(8AcF9B0sGh_a-U@o9=)!UXa?0awApeSMhg_#uop2wJJ2Gc!?K#njgEUd3 zCG3=$)q*$GN}_DKff=9}+BTJX5y0w?T3C@RzAeC7^3KveC%jE?Rv|wrJLn?UmS2@q z@M|7*zes6*bOW5kaG~e4b(b$Wnh{RD=i0z# z*GM?-w|cqaU@6pi+$XZemlk{cKHrXCiSfofY^elWLZg69MJ-7IfK`X=wgtgDvhTtKZ2_gCNR^+ohG z2#~h(sYk<^O?Zkg2Bk+-Qdh7Gkm!BmvHAFg={ai>r z_nno^$#OibM|TsutjbkKWJeR~U4Ih6jdYknk;1v2%fR`(A`O^|l)9$wObE<$iA%jf zyPV2Y8^&^!6gsOAZnLJ-!lB!RV3&JlK&`+-*l0sWsC6m#d1rkvEKF3E$=-A8F5{?2 zNtC_>IKGfGKlk4q2XBmRrgNW2gM;+$D;O*zxcI|sXyC*~R+jG9@Sq+xYnCNOGpkbn zts5L`Prp{N5K{ac9@_N1`=QV#sm2w7wh|F4;xDa&y%e~lRXzS$1VM*XS~sT4ZSI~j z2|RG4JtG+cCvR0RcnC?GxXiLXwrlH9#+8g$COf(PL^RrFRZkx6*Yx{ys_MO0`p>OX z&_iinxnWPm8?Q4SoH|~X-!`KzDxIM!x>-;G-i1}ULWq4)vrA=GeEumYXIW^0MjGkx z+%7V;toiDO2AHkTISHvFyC@h$qCM%v!J6WXqf0jJD7}0MgHF*yp5_nVP zOzXe{p-cb=T9&J{`LOGe$a(KsGJKyoqC2s-*pQTm*n9JOt0z;=?U8G9RCVwHd9`U< zkvQ*55AMwS%(;Z(duf)}d6acte-DGQ?2u^q?f0g$ip9ZfYE3m6p?eUZCu?g~$hx5#& zi$uGb!683Mk7-`22Z(|-J%YC!K%o6xO0l;31iQTXd<6>NWS2x#2%lT1!#GC)Kh;1R zExN(bpfRgXzH89aO+3iTAqDdS7k-D7i5pVHR(D_5^(2fU+nzNxjoi;dlJJ~vZ|X?6 z%pYOQD$G!)(Ic*T#hvWH3F)b~S&XpSl}u(WvHK!EC4%4BB&Ad+;a(otaetN{C@0Ka|7TkqU>2g=*S302sVnX}Cpu}%1$ttq! zkvqoTcUb;RVPtMetbsrjy7K4*z(=zRx;K$R z^%U-B1s+0Q!=|`uS5w_$uT$C)^9O0L7=z(#<@T3aFnTjo^Wf5b?3U-SK0h|4KZ5L0 z&R87{a1);F8j+Z85syP@AAUbmJ1;9|71{A)KPM9&0y#Al+PKL6Tb;~y!PTUHdPBti zYvv`YFCulyaKt67(HNP6B#_+H^Ko_w-Mte2&o=WlQS8oF$IRo(_P*$l%f9QQUVw9W zKPiAWgcu2ZXEf#-!@_zxUvqSqHoOt_11i<~80o}Or_#k)l{tY{j^-8-jSLX`Xcv>( zZiB7nDe);d%JOO}4+0Q%wqN>m0;?E)D$jmlK-l}5bz>ifEwF&2T!%gi5^xq|^{~L3Rj#L5@u0wbk05yRk==1I<{>r3OX2p;g0-A3;Cz8m^N*$nY1Ko%=&+v(mIyN z{%QEDb4zsv{6|Z$Q%M7E8Wk%5geSU^t<7={tn;;l!DEHm8juUF)!ew|c@q}*3|)6o zil_eR^hF!;u9}L5$G4!bc$4X?VlO~7o9rc4j>XZiXBbfLu`9bJaPf5gcL_Vwb>c%p z>WvN0lIe-(x6%4T(T@gayM7C%dFtJQj?$Pr-@66c$h!Wo*g5W2c;dV2Z)SzYj^Rv! zwITl7U%ve@75)Tu-)CH@d(7n9FkEFJj{Y6gA{5pE70;jDtEC6EVhUIf8iB`Rgi)t71{G`> zCKN=xW3xTz{apgh)=TB!sh2df>sUH&ntm8wLvbP|6(X>U)wRG;LIY>EQ zCo`hra5zACxOS53cYan48Y-4@?>2z_`)4B-{%gzX!_oqb05c!n2snLD+#FcK{~FNC zlK5h+v0-}Irr_+!K{o{ow)}B2_#AS_Tk{xq&Q->pN&%9v{!p8A1vYOY53YYUJ5fEg zz~f9mbxeRj|Jrm@JuM;Xq$}K4$ee6DlPkI98~3k>F8KH;vJ$ZOX8?sz6=)dsu7X(z z6B1tWWtvstknOjm9{TbI@>I;?!`C~Lrp_haH!~MY25aZL{FCn`7c?#GmiPV1+8REa z=FmiAmqQsUUF3h^+f88F7onL-7YCE2jllG5PdZGld%xoafLio4ECqb)TwAyg#)JXC zLx1z^CfD2VOlgtgZ;=0LL4iR{DZYJQg-YmU7MoP3;H794Jm|M-yuacn;m-wou65L} z9lFzgZ4rvlS(CW33D`{>@9{6WH{rSOuJUvq+65kl21Mx*OnJYldF05wQaDD(PfWQq zlbi0}&Qgp8s*TLUy9yRdN>-=u=Xq?rn@o+u3T}mcc^YBqfPs;@q^tov=NvnL9+8NO zQ{3HdRU(xlSI%GaFOy-G0n87Q-hnjNs{Oxh$#U^#)5JKgR3-{AXK{9@o)VkJNt;z$ ziFbF8Vx?%&+VG32z!<&@7-nMXw$aI3`i;yjuKVq=S=IyBH{KGMXsU8gg`=Lox|=T@@|kU`?e64`E8V)MCmCbQvH-{(Ky z6Qw_HrjBSlbW7KC>$`EOVV>LIhUR4s^pGO zO`5tFml^Sdla02>s%IrNe^&ZM_Gs816sRDiT~;S1Yp-2ffbFQf!hltz<+sG2T($IF8}tEM zC;8(s1tDXhhtjMkl%=)$v~$_%utR}5mSos2?5X>39|QDf1I#tg>#m;Ts8oguA9p~< zXtij0Fb83@`fx!3b1L=I;^z~z!hx(^m)#wdl_~AqeDyZ!QeU95xuPqE6y5#pOVB}2 zcf9Pv?cfhQUlJi2fxzmcQebw%4zq0~rNp7HIOEf8aSy(YwNZLn$_h{1HrcG6+D66M zUtO_d!xl8WHIvrTBJKEp?0bH3gM<;v63>5^H7~2C$*z(ty`dwVsOOQu8|?GfyaYMz zS+e`mv`=65?p+hmTF>6+)E(5i^($D;UqtGQW> zA2X`s_4OrK0LkZ^j2kDv)$9KKKazONr+RFnN$0OUD$~;@)I&GuPVKO0B~n=E<2b=iJhjGR=s+UPiv5j68vy{F{bL zq`i}Nh!JJOKlz~0c-b`^qTB~LiU0iyGeXT1vyzTfj3qZV^gkx%c=$7@oL(1tNvSQ5 zXxMBpFZIS-w-tCa#c3Ec)SO0k)=my0qMuYc{pXkT?J&q;C5DnoJWc4$IaA*yPuIN! zMU)fq;!~{OC&Srf?a#zDIACD>TtNHpvp`W}UxL+X7YDktUmG_Shodux3s8*pGgM#C zgZNA^=&3(ZCPfS6Btw38#nr=$v~2Ei=`=K*R_J11aldp>X~ZRyrM8PJkSK=-t6l`& zS+6(OeqJouCyQn9RJ*~kd*gESDO>Pim41hRkmj(YigOn$rh*ynpzW1O8f^RbT}@ci z_`6nM&T(l{MsfdBNOgp{$SLx`cQziM0lr>SBMD=KXa6=#`0Nk|W%C~ajn6qDEAIy% z`V&^-_Vh4I42&KVYm;*k<=^|Bfxpjku^VOB7hsb?2vqQ{YN`>FES{S1--P)mg$hN^FnfuLF$3l^bS^zZ=B7XEJ~s znW6L5=(9gCxXHIg4%<)2^)X(1$e0TQ`ft zghs-LH9f{pY0i!vpC42j5Q8stp z7yr2eIiy!HEBLKyEVSzovV=6GVw zXwkn|;z)Sr;^nja80R5F-icE>zMTB1KiVLvk~ZG)=4XAQMcx-9B8+8i2bD{gIbrY3 zPLn<}Y$0VWyYy8a`jqdbpF-W+@16zMY{7YzF2KKI!S%)A&eNvTlbUyq+z;jIHh-DBrj+YoC8}$aFgL6dfE8%^ zmlt?xm2}!cZN%F4=02n}wF(g{>9V~tUR0{77WadN>t!ll1Prb?y?Gi=W)Yn}(JT%c z`p_F{YzK~=Gf(ap9}o0HFgG6^?P$m?|7hRGF~rjfuqI#5BnmixpYxV&a#ADMzcoiG zhy8RyJMvGjUu>nrdZZ%Pd2|c5Ky!m=@0_i~9j*iZ*~<4{KEVFT7AoP2EiuTMZ*v|? z3qA!FmDt|OxGH!wBmZPfF3j%5B2Kj3pTeK(FcU}kf{T1zL<;W8Slm;gf&VAQ$$JV{ zs?rzuOIIhVOf9X79_H;`P5LzZ{QD)T<%-jL|L)u;aVCk13;q6|+@rtx|M8)Zb_ldy zZI_Blj${GdVpLkoga1xjP#D=VzGSQb?sKfBwT2SjHl`p*U8(tUE93WP=$(;a(QT@@ zpPNf;BN;HQt521-w>-t1Tz)`WjiP3w$t?L?+*!(7jr(~a26b4)n9Eq!_YbLED7U`8 z{5c`xd}Y#eeVOOJ1lDlXZU|x|`gSkvan)e(bbwZnA0s|vGT}9Bw)W)F{-~~)?e((< zn+%){IFR@JvK#MNUcR$JS7L67^!l{b)&hE5CrPm_L2;~Q%ib0JL;2BYbDLPZ3j+d) zqjVLKI?R!L&#XYZibP$WPR2B3wzW;~u5sh!g%iFW#33L?S17eV^l~3m6_j$9l9U5V znDecG!Hc8Id15l%dLe}_<@zg$9KW`&vp{|1L#W5ws7`PZl`vp#+H#k)WBvQo6ID_k z92NA#h>KsdrA&cl=5FbnE8~rB?q3r!gaw_NziN2?G^`=5ljWF9M%ylkPG-lsaucV<%^d+oipf z)3QK^DUh3(dX{J=W)3?TDI-iFxk>2xN~>m!yR)0QQaO&a0x!J>kVkD=S1{BH zy7K;R(^o-RCu)C;8c1pHZcx+>aIL5{qS$X>J5_vgWR^S{k61$0co2c3MyWQQAlAt#kcd?|m>^p(c>H*NO=xOgy|aB% zd-{nDJlH`b#;7jz+&&e);Q8r#2dLc&PGop~VY-4~$sPusKD}H=d}Y%^7792GfeOt7 z9A+c4&R(Ug(Kvi(hXIo|1XEiNsqf6lY9`vFn&1r?W>L8M-2Kwr*cSZq)2WJJ0p{=Z)#CTX# z=f`|*Dx%K#ek=G5Z&@~%F+C~X&%F z%B~o{S(o>%*H{J!$%_dx7+Jg*>!QM@IvKWQA`!Mc+h!e0({pwx5*$n7eXik$L(Y=R zWNXHLP$2oK3$o5QN&(90f~=Z|l|Y(LiSlI6o8VJPr|%fKRDAv(qHR)5>($u4y)i)d z?8%jk=tF_2apKh$6nAtt#N*`8M&8mMxXbU?Kk^ z$vM)W9MaTU`xgGtm*+fQF=8!~c{;x%5jinN21s&-F9lUnUQ-H3;vaz~Cf-l14F^`8 zR9gOJ4MkTN&t}IQ=es7Fhn0+OuZ^yOI{l&t^0$zt+(|_wXy8G0*^O+~9W0u`cPnwS z^3w7O*7j0JN|y?mMCpqY%!`FAq&PSQ;ZTfNzB!<4QgWRF`Hj|hUh=lNnjF4(X*D-D z_~D$N$tz+WoQyAG?Iq4k5SLWX?6v@0rpt}Adl5`#-8=`kr+o?ovOXN-l1>XwOo&Gm zxottyK40$U9O&VCfzY8~I_YaM<2C|YumJQ{#R^F?jdn;m6LP0`=7yNEed)P?Bek1xKb4A4WyD^a#_v)`;&ztpJw|aqVyR^D&3X;XF;| z#|*ZDdJ@JNjP8^v-t)Flb^nCUea4tr!KmzQV`F1d94~ zY~sl=VjUV1RxG`@5jE38>Fxc4Ym`F}S>oA*Ak|e$KY*KG+hSxTV8>EPW>ddN6Nahv z&hgb#TD6NFX7&2lo901mtatK`1ExfKn?%HQ`j`9109%6Oo{UvZfy<|RjxTm4UuzsM z?0toi+a;Q^RzHXnuct1e^f_8 z{SCX=gO-!PGQST(2t627Evw%bkVevh3u^BEL6ohvp--ErCI^s1Hx?5SkfV@-i1U zzgm)Zikc0GbB`K>-B^uDuO!{7if+8T$6*g*l}o}HC;r71-3BU$l;|C4ziGkaAA{{6&LdV85kCiZJ}kM|K5$p#f+;j^G~?p}78q`ycvLD{KtQQkh* zg(!rK45WvCJgeNEVoV~YY0WT`~-d6&T|N%CR+Trvx1g~&&OL>?OFB{kM!TE260MWdMHm4ft+9a zGxsjp7?0~qv&mY|rQJjR+A>Q#S|FXL0i?T=J%HY8x2r(?McU%<6+zN{BgAvHktMZANN;;~Uolw)a3ekQ^)^#~O$HIocq~@yjwgasPWUhoGYT0PwHr0kvqhX91n>6Faowj2mf{vXfvH%l(Ybw$ z*|yr?gpCAhue;7LU4sz2;PE?ozj>I{P`@u_^qQB5RfGHup`OZ%w*fJl7ly55RSv1^ zwJM+;2P%B?4vx@1;F+lEp{{$_?y<+)V94)ddDefy?^*wG9V3RDF>bC_Ux^P+DX?yv zJ)Td_OQtD^dFBiLc2j#fS_BBXaQFvONs~xceq<-EupXmqC68H;kQbS?y4XFbeGEFx zOJ&jc>Rn85b!wBSm}#A0N%dy`m_8I2RH}HNVg~$FRzh9T%b&|JdXpXGVBUcZ?SzO9^`cYn&+2}AteEZ_emaUFD@Lb& zP4#^Mmm14F#ps0c(V@#|Ihq<;agj6g)Ri;k7x-p!9VET8Rv|B+G~C@dUF2mQ;G}}w zI&^4su8k02UH*hx0>~Ghov7g;72-iDvULmwd@1@&N(D`O{9a=cu-FTJs?`04@KEJ; z%WaB-)qGgo7~ZE_jVx09k^B~0%Kc$X#yS3MVyw0$B+d*gK7If&{f)i-Cr{mBF(q|f zr$#KccC}t!4W9Y=WAZVC9)IRkHA=bjU2&zp-YLX4;|XCfbYqW@cI>-`@_R4{D^(1= z{MAg>y!u{90N}|(mAv)ug2eFjjY0d5>I+x2D+VlE&h2o32zytCe~rVz>y3w}>{jAZ z;5Jhvo$2`Gfy<50UyY|fAG%MQ{LZLg zz~!q+twIIZmBZuFJrQ}8n1)kb;eIpu2 zsly!h_d&O5%6(xCYM=L%85)Y4qLhwrqDu@-ekOf=Q(*h!!j{W^>Cz;%Q%jwR!s!nR z(U2Gcnk&oe#IR?DA|tfFFJJlgo01sNsA*WK^qg2QVvwUK26?Zdic4p6R_9 zOW&RS>G4E~zUl$xjKv+0N16*e<#g?gZBbU$*)V|)>Qddy)_?C88-b+!?#=o`x-zjy zP=Z|og5R*=?trOp?rCJE&5vNdIXb2bW)VsrL_NPVPGMj&(gQOAO_P~_qkO0EYx0z+ zvt}PsNrpSHGlIjwUy$GKkJK!HgY3jl(_vl=4D3;$pI#1S$$WeC#FVrcc=&Cx=D>_r ze9KyD-KlJV^3K5LL86mG6boO_2&(=(Wak}SRe#(TbfC-jcVe*9<(q1ME;`1qQyj?t zikHZ>kRd3nCd)MT-ZE_9x%%yOI+HMmS_=&bq7rVBV;UJnL2TFIw1=xhh?11E<>^e5 zsXC5BNizmm5t;$7;LRA3{BW2>RD9XwGn~G{PUDj9aNwdaD-TK0cEL3%1i(Yyw+vr# znJiA-*>8_jIbAxP>?>BOZ?Cvmd5lLboB-8p@1zXa$P2IxsuaY$s?#2%;8A=d$3*eA z@$JczLJ_s#9a@DtH>?08x#egBaY^yZP-o(B!JF|1n>id$-~O<0LcvghW4ek5KhCxK zqBerYazMno&F0Ar$6vWEagS-1)0p?5dr&K-YZP;HuC>zU6#xtCiz`yw*=Au}U56NibOTzjQ+ke2CjOSqzM9Gz+UryjI^`tZu)Kdd-7Qu`GW=4m@cAPf)}wi9NCbqJ(=y98 zW628i2~d)8W0_(FtUssRPw7j8>Di&xmnv>MRuwd#mr%{>JqPLqC}#os z%qoinlfzZO%X}|z5l=ccex#nb(RBM8^C%XS@VGo4dh*93N1YG!qNejvV-=DSo2n{G zJ!U=Fc-o8tB!UUa@G<1%2)@8LZcrQaK&*Ld0i}tWc8~l+m?;j?C4?-Vn!fec<+exA z79IUp^e9_Du>E}E+v52IH*%S3$6Fmvct@zd6>GJvUt!n1S|u)%Kpgu5*T?u^(>z-D zk}C@%3U>-}Xm}-&oc4CQVX* zyK1X*It&%wlu}>1&*6f+oq1(J-hqv{xSEQuI_v9 zbl>VvS5;S4?|iv)(Qsu?dOiIj1g{oqmV+WlQm1%MK$nCWqq9m3N(t;&LklVb- zJ8$XDjK7!xWZI&BsNY(7AF!3Y;7CZQ?*JWT*}u&cT_xU0xH5T(Gd>Keq-)!(b8dIV zlP%RKuj)~$TDdB2ezaL@OMIpBMcRyi)?9FCOWMcN`x<%m_^qPsMz23coRQwdDLUbW z5!-ONo6*F-mBfebw`yL_Ts>)(n8mmpgb~`X5Z*L=eqi-}$}1~!DU@)x!nf}EL1i@6 z*C7eez+TB!IA$*i1Ie8a{?w%ht0iIbeeG}$PeqnVyI(!s832h=6h2B1tul1WRM??h zx^)+OLRqA2QXpwT9*L^SJm0I`tB(GL3-)s#_S#819agZzs|C!2&~Y12g90}q+=~DO zDkrRc*<;A-Hg&WC2GXj3p1_U`M=-9{vzrpPmP>XeL$&qEcTY$^Pd{dreBfy6b8SMG zPQo{_^=0E;dK-9+kaw)!6B29vEo(gnDu!CTR9B;wUJX4fNOjgM#U_6^L*fQ8a_F)YqqdoGVnZsWhEe>(Tlqvlb2VUv!e|ltDT4ybdE-RlFmyXk{ z=M6!fyxHt)&HdcVNB!a9pp+>`j2z2*70@}{@BY?LMfaV>)}I*nlZfnBJylY^-t0g|vtvGTFm3=q&JXY6uYwpV&7G-=iYKi?C_33>y6@D}?yL*Pl{><9`)H zAG#}{uJBp#1yn;wRxa%_5#R0+{gAD5%Nnd%CvP6A?mr8EB&>MXDax&`8=Yxic0+hg zTDkT5#k&tV3qmTlrn6Jaad-a;E95Gq zEa%+0#IfE3WML8MeoSxKzKk>BmNAE#5_h?_io!(HX}x%dJkf2HA9wmX#JvB~Hl0xx zcbVM!wrc=(zRKM8YOmBjV>QL%og58)cqw0GnX^4&+a=Py*J^XxJi5k(fosa>(%wp6 zv*eKf^IEITGMdN*R(Y$=qrcf)R0&V0hC57wSxV`ne;cH9=d7tqXioWdtEvk3Z#J(2 z*ClP!ZUvdg=A1vunagLp84t?nE2(zHVGTGgAqpyGzDRAi-Hr zUVLU`8tL9mq*Lz0v)_lOOZx6TZsy@0szVn1s4{iYYCj8aVTJ`Co9TkLS>-MTnl*}oZJmdS(W z0(-B+UftuN=(yyplNUOymwL6ktRPtDWD$M7Z8`3!Z{6baN1P}VOlst-1RH=2OLA|C zx_<6aAKqoEKz$JJFvdoN3~4-~-(QzG#_?7^;a3$t%g@trWGPG?!3Dke4qHBHM@2psXB5r< z$J1nKY?5R~lrLAZLe4bixcygN32U{hg<^OMX4wB{(Z@LaH{Dv`zrpCahve{o6fatz zfBO$?;ymz9`;X$j7bk8|1kMGgkyvqj$%(%tng1k3 z$_pc`3NM0`g*GnNqyL=?U~xj$)Ne0rIxS4vrZU57_S`qu4)MG`CVe;1^EK`* zHX%lFSxhTemx$!!dO+v)8jDu%OA((}6~RRxp@>uE8^hcTd2$GeSx_^7rPl%uU3jGX z$l$Oqy^uy{G}+*bU<=`L-0*bFjZPwZOpM*0Zv&fM~eF>B%2#6~;S zlij7)tyVSXf!Mfb`W$Er)wis1dyqisl}se510QdiXHlQOLT4WT$n-}4ec$}>nLKIq zdWK@eVv9XZDX!92j5|~ndGW2xy-i`Uk>OXWr;b?rIkEV)19Z6#5grLv;OSnepF2#F zXbMIU7BvTrk<=w_n}44V6jc?QLnUCX<6k%my?t1A=gT2g2G!sz9B>zEpuMWG7!aB+rW0-x# z*BOR6UrAI}*xw41euVk$w0(zb7oKkSql*&Ijo8l&*k~_R>OQ{$WT-7|hICi)g&>f5 zduA=UF!c+qMv;DUvL+v@r!c?Y9Y`03jnC2XK3O$vqPCj682&UKxG6~6oFS{xlm1$T z^4%z`Xjb3DTHR>ewR5oOb5NqT^~b&|@L;zu;gjth`k+_UP3|;>%<&|w_b79-6NWUH z{pJnlFub^qc5d28q^cmly1Lvb#fj1wTOO4OSD^iq8ry$*j~^@v`xAQcpk$3ac&qP2 z!yJ7IAMEpMEW(RZ1v6PW@}%xl!kVcCyGNvmo?NZW4e3M;ia#yuHet!&uUaeuM}e3( zZJ=b4E`w3SVOVtb{lVd0JlyLq^;M)dROv9NI5ZnP_3mFvcTI!voZ; zr+*(kWrgw$@G?Vm3@ED`4jzGvz8rB2=N;inrJ1W4LJo*2rF$PMO7nDH`b9$95PbnW z*t2a=i}G-V3)8XNkb&xfQf_8N)x*l~Kixta4ojz4kDG5YTF%=v``IoB30@JkdDiyj zJHNk02rrGD=4g|Q>5#F{ktSvHzrB!k*E%ltQ;v>D~+pxvcIbUS_< zvtx&y_~?z0YgaVD>v78*kA&PX!Ag-Yue&5c-|L_}<=j%2zEu~Ee7mM$WxJA$+dCm^^!$ZE5yRI+FT=Uj-EDe7%J@;~&y@5FX z;uM;Fg*7*z@(k+BiA z#H+QEu989A^swK23#(6shE7N)ovAK4@w*yNmRv6-GpZ5LD3jRjBAc%{@R#uO$w1{{ z8LBN%9IxeBbY#~VvlKzZ2<`FVv=?b)PSkoM{%$a!*yjO-_t z7~ba}LyMuW9*`G)z<0bFHqn=8-Xpfoj zq-*#o0V#cz1L&?niDr9l9|)iM9#*ck2!Q%%5vrGatAHM!)fn(wZbP9k073#>Pk|26 zoN%(NZq;ocZ0tTRIQc$2*ipX4`_Gic@f^8ysb!Wi_T5dx&#^Z^&!?rciwZ~LkI{{M zT()gP$!1n73t}=%8$PU7Z3}*v3j(aD5%h`qjDN1m9D-)yWG=#enOEeOg^K1T|$c&*QQFeZ9vQZX!Jsfuvc5}T?9DOEVH~6M`p5uj#}h zvJxkLurUS|#Ti@G>OOqP#l9AoZ;tA3}=kRegLAi*Z@{Kt0{+79U z#5Y1y#>|{JsxhCkaD&sBJAH=#!3G6Bh0n#mF>f>_oQR8(KlGg9nnmk$@Ec`F2B&mznw%W2yy)^`&!C}s_q)3%P1cEGM(Hz$%UY#Ec?@LKQ&AswGi zZ!Vz#K2lInN6Vj}Ho63yd2yo%Vd6nz7-U48!U2o|X zoI)$Fl~09F&syBePI|oa2eI@4v*VU~e(1Vg;t4o6vqB%QJ5;GgE~*sWq>a8MJmF$I zmvI2$IOCMHa^-CJS@xlzQiRN)uKjS3RP*q|u}T~}C4|M=Zl=X1Yy798VLHXmhjvP` z_bP{^*Q(cVKnmsDyaltb{|`uR6R9IXJjC$mxAoktRd zYs3S76-A6a3-*Ou^dSb!t@PRX?`?#v9?6JX)ta}%r5J{&P@D2MD>n*VBiJvkW@W@r z;>q{5fDMI|!IL=I#Oo(%UEqRr5Aubx-qiD%PlVX@K8+~ z84hcgc5%jQY%!JSjHkZLUi1_8`Ch<_j2?a2Dg15sH0C#eW%k5b4|p zAKhN`d5&-)(()(YOSsU*W|z;I8xg9a5tp*da-{KdNGQRBD_=9eO?7S>vRRy*il}Tl z*>+7@P;QF{VKeJHX+Z-F<3$vYLwG1F*;v1Nv~Br`UI_7j{*>{Jn}1t0i{Th)PE%^_ zea-LN1kpklANB{RQ=wU*1^$jENyctmBE&zRfo~tN*cs}Klkfk*QTn_?hB>qhwiYoC zdp}=Hb`=_e?(;4O*K8RU=C>SwT8oLM+T4INf};HCX_iFMU9p3k(i`#b6sE1)D*z;= z(|gPx8#D6lvrKfzdPxNC_ybHiAhFN1q1A+}QEo4qY1YHm{aBtI2}4mvM#c)ail|Pj z2J}7uP4)c>()Els?;lh8i-UN1v-X*&Gh}W?UkDUqPPy$4rS>pg4d8G*^Tsmtl{>}0@o zW2AGP{KBk^v|EHi>6ebPRm5mrn#aQvCW=BM zT(l&PS?P*B>1Tc|Ga#nYz719}QAeaVUhNv%p=wg7`}d%-+{=1isvn`CJ;(}e60`HQ z2)%wEsP5>R5lKdyKecBRL%uIPhWO#qlV{!x>0nv~p9@+Qfp@@_m<_eD0d8M zW!zz{(9aIZqg-ef@uaVxSk49RH{Nr@hUuZU1N0QrW06sj5}hEkiLlQ_u}8OS0f(Fo z^P4JXmFV>2wM=Yv6GZ6K;nJ|Xqf-MwMH!Sw~mAgo#>D1v7e19)G{=c=u%adrHwDm&m&y943Yx$i&b4jsN;m z%Xh;Rk<4x{@0J%P_wRk-7xa{2i1SyXRt{jd%jauZR>h}@3B|Bk2+{v@AJOGI(+Wa> z!AYclQGPJvfA8<#89N$1Lg7R9ZqCX^PIjds1;|TY>45x!^Cf zzY_*}l&lLjGAbRk{qbrGxc#qRCRIIMNw8#m&AL0^q?^mxFhjq>tTX=5s)%H-8OZ=b`LHgvgde>(3R;Ev);)+HEn+FOfrY4vskMN)d{M#g8aqBU+2sh`= zv;tP=J`dUHtQr#K>lHorh}-*#tHdLa&OfRkE8zaQ=YQOg_t9rl{qFiEG=s!$`3SRLbD zg?80d^8iqXwhQ>6$RVaG)0pqe2VbHe+)?9qQiDXVa88g!m4sRo6C1N zKR6X^EbaRps)_G6`VB*0d~j~@Yu?UQ5%{unH482vg>HXKAx-S4s`nzDees2^N%~XM z1`#&*s1RV4EYmba(_-GaP$m%h^6*W|f(v4w7+yCO=|~QKw7v#0dJc|tE6886Aa)4$ zCKHye+q;-K3}B*M(%1h;yQ00S4qQm^pDGYY(Y4)8rBK%A9f1ffes*o)VoDO)r{9T< z_VqNll75UrA0E{^j%Cn#N{?)e3}Nzd>JGSfcv-I)o4GxNo9kAugl`R;A`! zt`^UxptsT8WPeCoO{|a?pFrBc=Pc&-uyf~Lk6$e5eiuyw{66Q-sk97DTO-_1eHLjj zLcEt{uyVrC6DTmPfrl_kd1N0by2hDN`z`xFzubq-lU@u_^p(Tce&><}5s4+Ax zYFpv1bfEW*be!t=9Co|HYYMSytfctPunpSidV%Jq3qtk%b6^$fqqtPJX;6JP$FY?~ zRL@cuyFd%b48^}wG9>ySj!;S1<6!=*hjY=6Vjg?}CX_=p?Vf;auEP$sob+bT0klz7 zV6{WkVW)`~M@K)ykKkp^55D#oq7`MvCotVmxhvn1|f zq&Ze}EVwlL(eY?rH4(@O@fT@xs!NJDP%0ZmC6+hszThoK6iJU9DT%TnxGMulW3w; zR~6I^#`V)cO64WgvxIO!^K<`7*F{4wj`UajDX<9y=LY@(D!SitiPKijORFRdM&F+8 zMuMX41DTE$3==!WN#P{ANe&V~$P#c@>c!ZW^l9JO2_}Vp-(<;2{|Xa&DLB%v>M(Q) z{6L1AG7>7AS@z`PAO1b@-b}nKm1aFl*^xxaRi8Ezl)$vKAc2bpD$c2Ef>u@nu2f$P+K`R{(+*sZekqs zMwF!@G7U9Fk0AQCnSO*?dGT8-(_PxT98zO4!oN3<)YZUU`KMX{SKIa$X4bu?mDr5A zj2LQ|7Hg5SngRF*R8@3`+PY9GqU*wsq~fo-kFGDDn9!cYgxEn(vPp+jd;RuHjyT9y zienE>*vpkaINk`|r2o7wsGTQg%`uS%WQv7y*vt?;Bx`v|&%5&${^ts4Oyb zZ+x^vxAiCRSPo}vo4wdoo?2bn1=)k!-1&_)XX9K%>d@9Z2r$OMr-^%9*SJc;{#4D6 z=L{@1Vr=aFIyPd`DMQ+L{Vuz-<$7lA`RJ7xu@qm|C-V+Kho*{3(!h+l|qoD!b&?OmT@ieeRH z)bla^j@%!5h{-4XXE^X;ROIQ=F4{WxFR)o9FRG%INLR4hhlH0(Y1wlD@te}|u@iM8 zsf8~{G+)u7$Xn_2_}W!|UB$+%dfZ~DpY73wqEu={v=DFZWiI&k2kvqyCyU0q{9K-j0zaR4G7R zv0Rz@+Iv5g;wVFBPmZB){9ig&ZNPW9$?kv$Hk}o5sP!({TYmn^I0<^U^TxTP3$zM9 z2V>lRa)qHgkvz+bYwaM?-1Nmdm6VX1Y+W{%iEG=&VOfIT0X+zz{RCkB-CHG}EMFJH ztJ9ieUOW8_{UpZPLnQ8r-ix7BpHKC2*>6=>O8JYUfd1+SOz1uT0XJ%!Qt4?x1KQXRp)Lv4cY&!ty{j zUgJ8eoB}xyE@eFxQol{YaWxx-q))b0!Bh4Xx0b)2xy`-|Q<*1H>qJA>o#s8Fd+7+U zpKM(9OhqXl&R@6faDzKSx($KcHmdUt#_`9xsgK_Lk*wj{z6n$J6QXvTsJcq3BzqW6 zd;^{2eNxkT;jF?9a$fLlTP^bW>f4g9OdwL(vft!^>>%_{$|!~X;3pw}qK#^KK#PDI zdSH>fI>@H_5+CF-saJ%NUtUq}Q8QmQxmGCSQ28n%pJ6*4#u1wGaGq+A+w}4a7f^l& zBroTGRIcO9E)bsLygB9e>zNz1?lPyzFug)xqJGYyfz1=rO`DdqmyKt;x=@DwdPK`H z{Z3VeYWY!ixPR;ssSNUN`uSni)twVByv;VZxd!$N^APGdp@nrpQ6pA}wZNbIX*D@# zZSUTy(aNO8^~2kMGuY)4zVI}i-@$l@{lOkM0~ya!;5uA=L%Q&bfVQHdD{Enw+xsc@ zsj_rY(lRDuP!~&p1WX?4cMvg2jAr00YucpPv6*lzc}#43+Tf7R1>M6%i5w4v!=fSC zw+BAUD7hPz`I@w*ge3j=6ENA~N9W%yh7G7N;0KQPfS_#(Qx2Z7T;Fap?WBuoYpte>x8`fY#-n@E@l1yzh1y?ItZKTWppj z(NTbcR~yFJO8$rw5~#06_^;16!u&pexjP4)2Xxy`p4pPNzWcRXmr75KJuB_=2IEDB zQ0BUR>7~JlRZ0u27Z9P@9`3K}6qcb6hu!0TTuEv+bx9*3@mheC?~{y>ROh#(7)S=k zy1xGA|wzFtMsnKohRQ_po~ zxX?G~L)EG5Lo*cd(kagfO*AH}F_&Xxn5f76v2`IQdQ8|K&7Y|pf?86~WiL+&3A5%lW7F5o)u>QH^)9s~o{@di;ZUT>ULN0GZh~JgY-vh*zOvY***-aLn7) zA~B1~{kZ92e#-j1T!}=CNHN0_Y_{}=xpFa=!A4-0=CkWKV$qtnQS|k+oNB^<>p?CI z*6>ec9BQ$f<~pah*N?|?c(FE%2BZZgPj}dtzg^I$1m;sJQfbE)OuZfw6Sa~s7{_Od zD*gjW`;)AVZMp?``!_$8wzGV`i<_j$SyR#+@>3VTP zP@{qO6(f!5{^2+UxBnD=Z^cUEMXZzIs2c#z zomqER14CyCGyi9VcL%Ju+iUO|rSaV^cGyd^_O+M5W-qW> zH?&>emxpFB6f+#&u^to??dkZj2z+SceruN8!8OJDgH*@ZHt$T;_lkC@0eyG{*@9R2 zqY$65ka1gO&34|ixazK%=>zQFG>1!1OqabS)cxB`0;Mk3E8Z~mEJWiT+vTMp=UZ8& zg)^hJUSu$z%tuHuE`1{4-JEW47c{Ev$0EpPJ6X6*0f!H-^Rj6ovbAacGB3AiEI;O} zncaA({7?3EbHS?`0t*|k5#Hy<%mfCdVa!wsbv!r=Rb)<(l>cJK;2tU%TF(K$d1;|?&S<^Cnk-CsL{E> zmziCMJEPka&Q1&r5KHPXG4Zz3g+n<&BKDW>y7jnN4ZMG9n9u!tHiKhsa8X`T`8iYt zf#P-(UF2TrT^ceg;jJS%wZDWe02jBmhnYV^KEjiyO>5Bw=g>l|Yooe%{IjPaj=>Z6 z-mCE1>|f7iK>xY?t6czX0V$bdZeness)C9=7`VOgXd1Rrx9wqL?^zB4e>?-oY@mL6l1p zZ4EP^oMME$?}zdApC@8=Fz$s1t>#H+5fF>@q>)Bw8Ab|zN;mwjw{>vTJ`uVJ?S@W5 z;b<2eO*eukxu^Xo*nY!8tP^rvZD-n<3i4Lu6&$R#6X`t7L5*C&l7(tp#_*RZMP6;4 zOIOT$)|?^LK&e80`#pMzJAK|yt9|?Cmad&RJZgFR#_+5&y(luc2WrufhQemibCffT z7F)^YSs|VK8L!f&eV23vny^tv`*dj$dg~S9J--N^y@{R*DRvEbk^z(f(UNx03gLi{ zNLpA&@fF1=G7}EeqZ`hlP2q)NI1l%)*Pzh3Q(-Cj((J)Dt6x$+1r-r_=Cx0?pS^tX z@s~Wu0*uy3tfzdQYi^iNAnNI-L6KhNK^w-Gq7>h41Rv6U=l|&6LD~^jIvht(!=H@5 ztnzj+I*g;&*MIqTV2syg+p$yCJ-H7?_%M5teE++K#%-R0BUey3*9XJZCKH!8Mw-QH zEAxu^1Ojyj(YU{}t#?Ch(TLFaLelasHdi+yVUNl9$etROyRz{+-=}`d)t>xcM2i|z zhWXuX-9S^l7jnDl=v$i13rSKsHV~Oj<1^PK8`pl958e?dVpp7tMj9+)w8{Nhb52|{xXs3tBIS^^3~m$=k#!i z-PWz1m@s`hGO-YdB7s#(2-$*$qxaOtI6Jr?EkV!=H4vvQN(_qDus zoAbM%5^x#1Tj$9Kk`G}!$|dZEZ`eUBpD=dJ85;>7BAz$N<({1Xr_th=RC*N;1teiM z+{TY}N0QBZsAYB4M7{INnaTt){lay}MY}~_+}0^!C!D9|MwHwPx;8z?t_$>Nqe_#X zR#n9j>td@W=wW;xr*rHQXeK)qoV>@EFc+-czwwmuHaY z;1bF*blrvSr7*jsu8@CP`-`CHx4?DWxQwh@Blw+Gs^~sWtL4z!8R-Q@Z~NyYa9 zfI+XBqC_Ys+5y8x%lOi*R?+W}!-rX6;J8!+806e@d6UE&eF{LI zo)NT(C)y+nbr|~P{yl078ofki2HNcP5$PFN&`|wX+$wmI#b(P{BSV-RLH<;Sca;pi z&`wgq7YIqpTk0_Pog-;V%3agyUx}b{<>#=KGyhn}NcWZ8c#(KP{b3i2$BkbY6^h$; zEfQ@!7Rg^c#I;mQtf3l$cK_^#P7u4~Mri!B3Ul8|rx$zq&keOm>rXc4760$7x@Ct; z>x;?vKnf~avq4bE7&$wrR2N`ds~`?PK+Y*zXQ&*vZx6c1D>$e0yU(?jnut6EExgxc zn~1^e5#lwZam1=wPt9Wj`ZeBCOm(RQVuTd4NO#sRG&+e?6p=&THCtUNs#$qe8rn+K zS^68drS6^-c12vaCVj#d9Kj|y7TsB@midCm2-8HNR45qOmlE$Mvr;?9Q1_E&b^PyF z6w8LHwg3h>J@8m11SQ53=&oyD?Ta!rzXV>Y1epP9+{V);%`}E@e;3D+4YS^sfbj@r z=l)tH%K%#xA;Yp!5dR+2e^-C}EpgZ8Ts^4cPXguWDoCy!tE(Byplu*rRU==}_B?vU z)MV}ydM;fCOv0DdI?09NR9ld*lKWNd$B?waAwL~aFccgZZ1WC;L&;0Z|7^?l;Csc? z0%6~hM$3a%Ud9jWUAo%`ts7h({a&^VevQ+2&f!dSQt&!dVe`e4q{dO(1mm%LHhMqf zbT%WxO?QsKE2VV4y~?Mr{=s6$u6e zkyE?0sp0SHpJ)l+&!5I69qcdudj}kCaAUt;G3Rg_DOMX_m2`oYlv1|CyfXW5=WS82 z>0iu$>2M$-I?lj*Gs_00jsP0~{PoU{I4wCgK}|riIL61WpjzICi+Mn8mR*9RTc?rh zEvKZb#_f+AT1;F+&Jtg1dC+3@MKeLin%R;1Y{323UYy_XqUWNDnp;)5%JI^z$%r1b z=EANO`Q}ugy$yh@J}+6_g{1jqlteTs7U5czlVvKzyD1rIG>$g zlW$ham%b};oQr&ul)i_R$c5!}lrxbm2L<9-FA z%HBYL+s*736XB^fx%3E{yM2te)oJdD5Cqg8&?zJ={LZCLSMt`T&HRcnY+ph;*W#;hG0AOtIkS7jH};F+gnl z7meiY>@h~M@OEeM;Y>x55 zddGMPdoBvF_K}}Qsby4H>`h0fWx}RhB?8y!nQBG_iGEwh;JoNmI?JP>i>zVej2$o$ zP#5K7MsHyh9=}JObzV(ZR^Ry|jB?Vyp%q?Yy`mU{7t=iuYA@*F;~tAqDZ|w=!Sc1^ zIAy?Zn)v@K{=YRO_u6g^l1Ggbqki`B5onndYzpL>8Ruf<1DwFG&k^{6bIa9uk>-mb z1To=^)F0vDPt&J;BaCpCiG@V#NJgyZ@5`^_+d>TTV$U?TuiS>i-E#=jz(zSn{OWB6er`i7gt)&ZX6!_f$-f(e59CPkc5EH<^DNR!WhD-2Nf`-E;;wV^4|oUp6V zLHOMSgZH!%!(wax;rZ9mRW=wig9)7&Rx#!ocOz9EM%4`0UWD+}T~;*1IO}reF5b{o z5)=yL?FNnNTT3)#lb=1|Vq&QAmYKX|yhj0fLS>z9d#sRTa8og7SVZ0Ar)|+LmNmvy zOel}3IIoz5GS@?!bj>5(yD*wG?03@yb(y&fg+`IuKOM@bwdt|8Ml*~FWGFpPe<`q> z?$#5>)q2Wh)G0S*0+}%R+(%+6C`|b=qrI?^AiHGvE!^uaq1FAIm9i&aVmiFv2I@BO zRhPe;=4{(0!Cx3#1q;D#Aeh4!He%JWiJo6~#f%|cH$(f@xWp1a;J3Yd^Cm+ktRw*> z(E0H6spGm*@`p_MH|t>z=nuCaP(RQLQ7g~KW;4IC^aM*3VLKm@JdI^({I6vSvnG{F zlO50-0CRsaD$FrRf;BVWj{?)8S`s{W+VHOn^Sw?<3m?Gdkk)O%M3R1EyjGo&;p9#I zR)qu@leIjszHLV@N0P9cM`rPb`PrWzVvW6T-mE`r1+Pk1ZI?sMLAW#U39i@H$%rhz z?>S;<>PajT)-cF2q^Ii$;Vl^Yhn zk!DfZ{b2@r9}aMH2}or~e25ppg%^^3to2&G8T7Q{83MQd;2oyPBXZUib9VM3`jn%r`N$Cp@8X{}6nr2vQ0rvRcWvUESwX>f1v+IM>-*q`iEI?;f`!~5x z8aUM3jt8T#pqvrl8DEzHjn%UIJ%ywWwY>X&1(?VFy|eD3x1M+|xgle@o20yoUh`k9*w@3)Y7-Jx=6n9mv)T+;6MO6fLO#M%ZAi($gn zm_bxl+bVRqgW<=TCMePR&k^xeXk4dHBW5w$b{i0_#Grue9T&;_Bs4AosTi?F2PmD? z`|yY}xO5DT&c$>~ea}??Rd)HN&%>7n0K2-p_&=)D>?upbgP2>7OwB+7S-k!0@eJwx z>wzu#1sPQev4$;YFSwoW?2UpC@S4#~-0lz*Dn}4}{_JNjT}kb~SY*bTqYMVZWNRX2 z!DwG5#5(ls=sYl(yZO{v>jlZ+_sw(&LEPGf%u~oW(~i0uBA&SJEE}s4)m&Q*tYf053` zlXJS&cMJq70e~f9)K8Lm;F-!M9wxC_@oDqBO(QVXs z4*{z@#ob0YaJD-0*HDC!ZFaS@|GTmbh<(UIm0R9!RhTxKfiqi@+@jZs8)8JyI=Ed@T&9?k=Z*GX z8%W)SwfgWhm)KB+B>2gbU!YoaNVIU*{B zu@fA1>hA0GT)D>5&tm_~E>NQv+cD5^(c|*^N^R>llhi%ZAJB4#M`Pcgr)B|X2f_fj zTAA{{Z&7BgHRgY#5&posR^<~J%?8RsM0((1TW)m7^VSlQfIPO5mkLsh*zX5BRYim` zn?(!7@Lk&7H^MJ5(;jp38zJKp@##MeXkA90Cq!_1{+0Q^{64;KH}}`BFnbCiOqOY( zwu@(6`b!Ubi1+>x+t626A9Veevky90N@o^-R?Y`K!K+y`_w$YDiRexMW(b~>NH?G_ zrOu(Qmi+H)2gpk#*e3?`Iv9WoU7(Vj4SV*q)Q!@rx4v*Y$+A+Pd?!AC1yD@<68n2K zCQ2NViglz~BCmwo(h>9HVVnW>L~>&CLwD8_Y3p>sysskbulHxGK5%dmZQvL=4^!1W z{QcU*I<|;cD(wNocE>RF^R5uk5C>sLIG8G>?Rvx^t3PoQWNum&tFd81P6?wBNi(=L zf1l=j{uiczE@SN!c?7sFXyjlLskbk$VljKFfN4Fdw-HK4JB(?KL4^BxmH$El3>?52 zKWFgGw(TnU=yr4|_H~t&_nbVk9wI7$1HoA&_2?!#K{?FeD; z;!vX3rdXHm{iqN|ROoRLALkSqw&oBROvPgNGWjk4NyA191lF6YAea;ReQ`0VB z`rhRr_Q0!m{F_x2lpJ3r zqt)0kX&rnC`c;_RUeYGBJ}}*GlzwJ63yA#{OGc zY5lqwaY+;--oz}(!4~hmJ(!nG$C8XP_A4akFG>^@2f}eh^&R`%Ug%IOkQJUwSLN|) zlmTIyRcxKpp-in*|GZSo#@rj?C<6zXET zth(24bw0SHhiUgd#m3bCeI){H_P(^AM~LAOw*m%sW>C=_)QnR3hzR$t579X4x4a|% zq{`+GN^tt+LV^pij=uciiP7*a3CfU-QV)5U@$*NQK~pz*{E0PIEf+p|3v+la7cC?* zHf|ue&^>+4s@CJXVOZW*jc_^zyihsFkLDqoVQpj-PP8vd7UgwTaLBP zKBDsVz&@qhPc3hob~bzGeI@p&`Z-F@6+)?bPr7Z-Nq+yrh&b> zsrrHH*LM1Ay#WUi7ka_;87nbbm(YxFBoD~qlP6Py9^aD(l(VA$2Yc@U)MU3V`UBDw zq}b?1iYN$3??j4#g3>`idY2NECN&@mC?!Z0ktV(OUINmK^dcRk386>{kU*0E8~pa( z-`@Xo?!9y8o^$7(^9?hZ$zr{2WvypD<@Y=Q9yc+T2F$YWcaxZeFPTe;x+#yP7AQh5wL!U$Av zSFZ1#L{>FH&PEqNe5oOUNA_3kaTPp$_DJN;4n_n<&VI2H3>&O!>F|EGYe?4aBw%BN z<|n^TBN3_;9?J)+cYbaXPxQ0@1u^yoIQ=e~W8C~5y%H-V`%J>L$8LFAs)xs1o>8agr zs_M+?`m=t!gt8$z9#G%TY|s`G(82kD6~GzG4mmWJWU1wz;T{tc~5}{>2Z177$MA78^%E|qc)QBw0ttd+Jk0JaC-SUfulS!`W*Sp>6 zOsMaaWyZS(O1&Z0CA|6HtF+I5?ZQQWJ>CCyWvXwI$D2fw8q>y-+2@tKaOL6B5@YpP zKI%RwC6538kBWUa9&^h8IExa`MLCzK_-rjKX(Y zioGYMyQE{4Bmg@+nar}>|51*r&aqgdrt1$gijr-HrtP1?+e=6HTa;9bdr>`510rXbVrGKjcgAdc8`^Q%;$-gf9 zw<I6`Z>`Q+lT-4FIqK?y+ zi8SHES_j@#x9g)())^3M!1xC{x={T9J00+aO^+K9X4i?#GgYhCRj(L)f31<(eO!Yj zn>6U_Z3P)e-8m8+;Y+Yo?Rsh+P!W~enq}xv{n7&{<8b|c95lCs&c&OlGe6%ZNH~_O zAL#zJ;GT2%Sm39+!B?*`4Cvf-cDd& zY1^Tp2y*vbxp!mt<|>ThUfgNPy~+(}p@562{+Id=j_%KM5YqFq$#Y#~zKZ}`46``~ zzYjd1o_INI?&74+Xt!S4pjY*DixDpg!*}~K>EzR%;|CMQiQV;@DRg||3(u}M-?DOw z&*}zjo>I4P9d7=ZYn?h@R_V9RUbM7Cs^oE_IaUw%+xRvRq)3As{UHIeOiCK6hB*%B z?!b!bLYA%X(nHTqX6?2qC7p8o9Kt?E8tFJ(n}$4%PAzX3ih->)7@btvml~=-K%I_%S<7O3Xq!=iO-KcCZYC{oa|e zlEtYmW81n)Qu*yfi2`*POoTl|6N`Qe@s{kVT+t-QpJvsJku14nE)P zX6@0MNH5Jw{ScN(!TCQ)W&i6G|48fqYb^c)#=-(H?t!F14fid#i|?*Eap5wFZ~p%> ziSe$I?Y4(|0712R+}Ha%JD&Gc_&v_$@@`8@9lE9)!=oS9=k$Re6>dcO!ksv!Y*p3coV z+u9AC!B6CQZj>YIP{22Y{(2avAFF8-+c*|QqJVTy^D9*`(MyhT?&!SGY2!Tu2nB-# zifb2!weatW@^UZ>it`5@(u{6+u zf`>BbrSb&Qa4A&RXtMqu<{p;4=|P^ZY>$R2nvE>Ju_FRXw%_J^^v8o6VGI1^w`k>| z7F&NiHNaU=WdP!G0xSCzWlCq4FfHR3XKMgiygru**#I&mh{jf-DOd##@zS5?>HpRY4~xNbEOV5sfo^m zX2s~w23%cKGd~t0;(IT&h5@9zO7uB9Y;@KztmVb}3ZUq(JUnOA9mD>Y>0#-Ax?Ts2 zfj5riH4OkJf8em4=n-hIKJf$~^!vX6dYLnN1z@~`zu&f-6h5-yx0Nu0o@Z|TWM9Ti~#c=5u|N<5bsg&qxG%L*r5DlI2`U}n!QqRmSr z?t4!j`TF(Di@eSaPSa_XBrNUqFePamhtV|{R9ECP`gia+Vk~+hdc)3s54=~i{;~iv zeXFrd{3-+a$qVnmVWsB}9eUg2Jm1YL537yEcfF81guaI7f#^en-aM-uO`{ zRMz@0@GwpfqA?7u7-%QH@MruP*M4jUh9m$Ew!-208FECc046x_s9~s6^TVoGW2FcA zEjS7;IX%mwcq5eY4Gkf|Yc(q-*UOg!%!F>xlU^M)s}OkglZapO2N)53sAyv96z&;yaH^>L&XqJySP$EH`Mk+u=1yfs?5N zNuwiZOa`En-Yhiph;Mxv9%|W%B+PZv;--92r>YTjd!S{pf>)WnpdyxJo|n$K+(4pD zCdjVJcYO51vT1ze2L&*LO?lszum63jq5(VoH?Lo2rG2$C#xU}PtnVuvB@jH;%i$i+ zc8T{9pL{qwq^m7TKbS&Du9?kaLPj&(3$)Gt)%MpI{522$2WtTfI+`amjDd4g7R^+1 zS{g+^cAWZ7Twq3bTfi?m*wK$j2~|=`JVco>Wnwd!5U5}rmgFa zYK}1j67C+`6$Q?7oApD+`?8Z+TfrdT6=W%_u>Qdu{F20yicF-4PKFWD;{bLMm{u2Tcu*bN2q$7=^Y#E8Z z)4^qMU5@r6KZ#5kq%ZkKMQ6!LPUDdDRfWQBulZIjWXNg;PZO`+`z(d&n39Q9!nPlp zh>}g1POMwe=q!~&dHSZC0U~D;y3nkHE`qD`+;EFIeHBFD|0%iM!mB}y{o&iW<~7sjFF&31KBX%PpcWRX(FSCk;pt2qg0r>+P0#w zisYw=mrCXe5vF^SjB%OoIzkBZ&njkzToio?gc&wSXKveG6CFbpAoSrSo6u_!`7njm zLb$pyBvbUcUOT7IePamkwQEpw#2d+s()2$bZ4;xA|6mTH*yE;g%;JvKJZ2%;#_-58 zRs2e0g4feD1bJfFDW_SYrNo=w#RP#V;}IMiVN~@SVv~ENQ=oK$Vy=p2WU>00jyBZU z4onFj&oIt4_P9mlK;~e3AcJ=3A!^JALcar2L-AjxP zNH?WfRoJtWeZI4Z z9>7YS&NtVFX~73_1J19#n%b4VU$TCYih~V!=PK^{->vTbtlx1jI6Dy6!62mZUn{<; zccVPLK!TSm^3VptRIT`yAzfrgpykM7875 z8?M&_LVgv+4VpwKxo5lQgM)q4=etd9Yv#A*8Z`DsYDMNrmKRXcNTr4+t)i)61FDvp zWnLKGnrg4tF?r@rk1HrFV+>AeZzvqzdE+5JG;)>4dz+Qijz+Tewra=J$LP>fXtk{{3nL7%G<%38m<&A)ar9PgT54sX~`!c=;$0x?^Fv;-8HgZ8} z>Nj;T2KT7y{MooMcL=CiS0cMn$byjWA3>}li4TfEZ%8zK2eIBQjqpJK<6u%3=ZnNvNA(ka zOcBxt{j*lNduT$+K!rD~BsF<+lf&IYgFvtMkPeu!j<{#k&8V#lJI#@cLBhD^UKsEP zx|yRJQhnX}l8)w1aYYzNO^ac1ak9Ay|=MVP0iPXC#22?#7zsIJ`Q3w4Y z^l)9I;@8J?{ST2!*|_6$(0M3rgzYm?=tq?6{$-TX=@@Kyo-Obaz64nmZGB0`2iugy zByyTMOuN{$=3@kto6pap1(O=(UoY?NrxxR1eq)~WR+c$ow==X&mVY$cfpTVM#V6I` zmva$|(;7rgm-vH+^5olHZdUu7G0LqObD|9CRf!cDJrcw>^R!={Dc3}n@-?- za>-I_@vNS#nP@$TGswM$Iab;Z^!zwyW290tug=nWW0azjU(5^9d(RWb0u=qAhp3Xx+23|U zUmRLplmFKIE`1+d2&uwEF$+DsxDrMFDEPUSXB^OwkI_NL$!koe-iGSYHi=Il^!M3{ zYmb7I?5MNxYMVn_Z_*h`7YPZ$i;F?-=)80JOErebDF&qwdmH?E%twtl09Mj+B(Se= z(6P}!p_ z`BBjj&B|-Id<08s9ZaL-HHvWDbW%-IKRNG{(|=S(!$ z{=lKaW2ed{+AX9zoXkJrmEyw8BioV1A5idu-6VTW*>vm15OK{)#E}ulo&Dj zVhG>7bI(U_hp0sOtpnP)6Z{M9wR2j_u6MaHmV`IHRG8(T#gIOIc3T|(!Wb&%-V49U z#*JZ3r`a2gWValwJzf%%Q(3yJMhuqGX258ZtB7s5Y+LZILoT|kLI(0vm=3o3`qxYy z%y1nwkorh{xcbYqlF;yVo~Xns%v}Pqn;Ylnc(EJ*9@O<^9~|By?{-5i4sr!QjEsoO zEWi+QCA%KmFH&RMRePjk`it*lVb)X+-M#yV6TD&ULxJ}y5^2;z?9XC6d&Q=$<++?| z^^VA5jPEh!B4OAIl;6dkZB_7juMlj-+_~g*3)AAKn(}@|!L0&0KvVLI$T4gb$$ZN? zRQU*Vsj=f>YT*pe*1U;R=ZzVEI_wQ#ryejBONC;3@3(z{S$xcV`l$S9ztwFvi;&nMopzHv877^AbM~+ zMi;#G<=b485kkx~=>u0(?WcZD;8X^asr8t1LF0}dCcUfQU5}YSh^-Uv6JF6Dt+OJw zyaz`aO)eB|L~7d>9x*0>D{GVmRHAYpewJy8l1st2xktP=va&FNrj+Jb=$HgKY?7FR z6K52x6N|sqPND597?VNb(47A5S7?C-*t;E7t)pq8H5>aDowp6DQLC3=sW?@3 z@wOM{<)UQ6`htgRl3db>*QI{bkkS*y(=`F=yL;uvJzHU&>*Qam0_b5`wGW`njGCK! z6xsoO$#&MI5=uj1NuNeq>`R zENe?uM5Kc*0d^}Ou}U&bcVyD&BSG4dSC1WU+JtEl%neUSA)bi z% zcY5S$J%$inNIvl6h47c$rgH3i)k&pb3_%QZ*VJQkPoec#I|n(%Q%{&<)a&%fKbl(H z+4-p^T{4Wbi!S>!i;)s^wUbSS4C;>@$JfsVI)f^2MD?DrR3(}VumN_ zcfPr#K``~eB;WjOWg%OoV&bDx%wyzy(^}Uu(DFxo^P_kh#%pl3yGEnbQ>oV<^2Rw( zE>;;?AH|h*Y z=a}Pl)5C}!TX5h0dgZ=a8*+umfYLFI4kUePh~LUp{w;Y*b?zPywodO+^cYIL;CqFs@l*rp->W7j{}N9H;_E;zkEUHd#*UDRqWfMqi$Vv(_O_gl zcZ_()jdaG81WpR#0LLe}QNoxlUz0^tjXM^-pEj4WdvaAphIr0wI+A4P3Ku%=HRI>q zCW@)OkK;2>eQy3F+u1Li`#}Un(9IrAc&knO%)$4-b$g>u!MOq`)nIl(%jEh2EYUJx z8zO(+7GlA%Bd_xTWv|(od~{1o-ZOa^E&9UNb`zM2W*|}igVOwA=Q;c zQxzK{m(slbl6}CgHI?u(ChsdL23?_=HPu1Oz1TJ=kCi&_un8Vtz>Pvxw2Sf2xQ^j| zFb3EH%pUJldE4;;5WbL#zqVjMEJ;ET&jIvz^CUeyx_^%9kfZS zJnsk%IXtxk?D<$w@TPKJOts|=-OMfma3$Q0in*=K)np5Cv8j6f+bvo8xWyvLIQPzo zGBbIWooGKm+_7jE?W@1EAb(T@8jH*ah2qgX?bLDaF;27MARxPgpV44tItiHW6NrT8g~bd8H16mg0RgAGw+n@wAJeGmLZok( zm7si{AdZ2WeL4mSfPjzRkG>kd*V+d{TITMjH8lZM3Z_;EzdSOZ2>C`_d7J4277WiZ zb1N^mUvfU^yzr`0BuDf*Y&4Tgx3WrBL)pmf%dDR;rbx{1(}0Gkj0VU9=}`7EN)Ym4 z5Qfk@xZS3(=reBqLd_@Zwoh4YnDURHg->2Ay_0*^6+3?9a3!^G+RH|FrA6uUZ`=)O ztZC^f{xPU|@fonSm26V#>l)MRLW=G`^+M1)SXU}%7lUq)K_fcyAG8Z>^SYE5z$uBc z+Ws!;_uk)oW?k4gJ&<4UQd|r5W5RCF-wtftTfE5+bo;$7Ug{24X&z(sZWcCrM^p(; zvuht?&(Fzi95!p=L-u)V6Qv-xp-}?z{2An7;0laTwgkl_Dn@L26`H;o=jcaEWzr_&_ir`GW=s^jk?ywMsaFQ!{5#Ik zV$%q-Q+&zF1zAV+!5ETlRU?Nb*GIjdWn2r=iMZ255AeQ8JuS_YjS=J;oE5NZa7w0L z^9zq3GHGD1Wb>0r)I|m*@o*gjUg18%N2+_P$37A)j zG=tYw^Yb1iihZnO{}~6NzI54WbwS!o@9v$PXhHBjSLGodEZa5u>Ry=Fe&JKCC!E&v zW^0jY`j`i|g&pG{2P+0;nV%o^Hn#RN$(5XiY1n<|#;)~LSUi-7i}eahlzMG~q)8tt z)x~^^vF(U{$$jU5SjdymZ+CxpWusvmS%DE4Ydbk}04&!H+CE#fQ<%)}#b!J?N&mCiyM|7v zT3D|A;rGp@=VihV%ABubdttG}@z?7Q9PK6A@~)C|jiZ+1g6{*LxvzRzMf2}W6yfal zf9|7;UIO|6pa19k40aTQ0FNTma&6Nv-(L0huXa=BN)T(s-n&(j)#ov9?I;)HhV9tw zP$@yf3Son+vCtuVOI2qkwQ$rR@!}jM;Q44Av^!|CwRBrUk!YgDC+F>0vOkZ>DhL#O zVIXPG2urA+Q$HO`*;>D(eM-O3rnd*)Se`OJjlC_?px2*VO7>`5cev=s?h8Bj4vScV z@maQiYRx?{5_}q&sc64MU1qWK##rNd$@||9ACM|>--p=SywZO<;N0J1+hZmXeI@Iy za{K$bs~&QBP2Bam7%xU{>|MIM%35D4e}z63@chbmyGsATZ`V~SXV9w3qu3kF)I4iX zz7u5~<^TNcxvH=#WqkN<pW4y-fmz}biT^u!ffy}Zem40D#X zjh)^dM^1u*^OYU>W8f^jP9$HvLN8Q?ENuri+{#_g1qBcT@AS!(rbmeXw6&||LbB%_ ziTdWa1w$Pm!tT&6*s73h8)YAtz3ZweaX7g0fHD5w*Yt`M>`}O(8yg)%WehtB2ji(e zfoo@emZ#CO{+T;xv7?OU+M8Zbf$?t}xB~$(xfOr6sqhb#GY`J26-Q;nf6Y}Mr+p}& zA}fkv?r7tp^n+eG>#RTAje3($j3JX`4s(!aho{h)1y;&wsN>_V5|Cucj}TVO_NYMp z*@`^J*Lm*Ayy=xO$s0MH*Wa@_+9&5*Fi0MXmQJ%ue*AUT*@HecKbx5j@@TqyEOGK| z{0pGeh;?|6g)w}}cl|JC81@Uve>n03HX;`RyJ2|Qx&y|gvuX-`kY)(c(?7T1QKiq= zI3)VZeip%@W6`VKp&7*>P5Xo(9YoD$Nnr|3yef~Fl|@br0#4>< zvIf|Z^JBy2e9&q|m223J4^8n#&2-H+W!C$y`Pbm02Oa5lP#*ydFCae_4r$2unVXr} zZr$uc0lVtK#kWPnF++3?4s)K~8jJTX+#ziJmYv;7dhw--XUk=Y+N4J&uNQ5!N6p?4 zN@Pkc1~bk+=H!=ismQaxC;yspgvmvLVkbK~fwgvOOqdqfRyQbWZ<2Uw_o!0MIzFcl zk75mRBbki~YRFsRBy|=QxvZoTrBHvtxw~~vXa5SJSkfnAc8>0wbNFH_i_Y9$7hfkm zejG%7WhH7SfZ?T!SX|>@xAWKN{Kw55_uU?;!S6vMd!qt%PQV-wkHnwF7vpH$Gn*j) z=Ls9Li)~RreV3AD$}oL3oYR*4Mr`_2YJNIZMyVPyU|Zxws$G@tkw!UmJ@G!+Cfaxs z9f3p(VNz%PN|>5i(g)}cjx#z3JL3E@ne+eybB9VZ18HI38lYisM4w4m5dpZQJKiHp4xT{S^h zgBS}NBTAf2%p?P4Ax?K1tL@c?!a3>ccuRU6ET*&TiCUJOEjRJX$4|OJ7lS(s0DBdu zud0s&s`qyhtrALa<6Jm+4)T<((ua5UnL%FRDZc?*{Wv;j-g6S|i9SpBT6BRCO)wBpwB}U{J?Y}0z)%lj3o7B9UwNBw;R1X>b zM_L-e+`mrn*BJb#%>#`Zz&M}Vf~HSfP8!qG&3K;A*?@nUv)qI}L(IhZ^Q4dGVjL?> zY7tj<{OF>M8^1N*SGN>_lpC+?sVCRz`&X3nf-6Bnkvm$Esh!h7$jK9wDi@UC3Twv- z+qx-z!2s+5Ye(jfUD!9pmpj}(d<@ZZ{>8A3XZjd@j4GkllQC2Y0u0{RHayWnXk=}s z&i~R!m%vl!m-)bX6QYmGbS1w2j?`RrOzmO+#o#*~~qK{8iyE|4C>EhoEk zEN}Q%d=-)iKY*&5sR;)pb4@(QT;c7Z4!cMaEI7Rs`NZNXzgfV0m|{SN=D9;02=|W@ z@{#LkGVT225ZxmnzQ^qFTioQKEJXszF6hSQgXja9f)s|?Oj__dEsOr~~^6=aVIx z#=AxR(gl)ek5d9>8-z$^kyGU!WD!&Cwa0`j!2cH~PAn_cOi7u69x4QNp0*UV*RcYI z+5Cji$KgI4f#=7($I|kS(!B1v)hQEwe`hZ7f^!EXJbr_$)$-~x^F!9-oqqh9A0VZ^ z!?%lN?_NMTqI^8p0*v-pGOSVZzrMHEDqrbtl5%Y+I)M%g`rUlxXfexv@%-X?XI*xQ z%~aB&0y`fFU+xYty6|BB&)tsOr4)ZjC0)OvNZWyxoj`KjCFNw-*I~0P%kx)i1e z#J@mpZdAc@Syn~SYdhi5b?kfCnKh!D;nB@%FZwFKfufc7qKPpg&gT;a*s!78iY<80 z?h%$u#Syb)ihcVuvzUhiMkZK_q5|+=wUU~gpA7s-q^4CHXf`bZ83Gsi^_sfTMxWj{ zYF^mEIVk71Z@p5UfOwIJ{nfW(;S<&-`-xd%^&(gs4C7n__>CC0D?q{C;wg~spreZD zSY5~UN}CQ^>Q5RG-mte#Dkt8+z_H@EfYo|T+UGJL7dTFFJ2 zBGd&HFf+TyAYH6AS`VGTnn@6xA8%zdhA1h9xT6c;5FYA0@iDae9QOQU91U1&ecSHO zI1q+QH1A__R-oyZr2U(GCD*9tAzcjHAMfpCo;tZI|9Y!NGg>;}JS^whb2@JW3oikD zn~BX&m@7}6mf0OJ;_QACOszCmxJ1b*l!V-54@wc)QzHO2<;u|e_^ZsP^oA8bVQRei z8B{Klz>JIYm7QVoInLdTcX*|<6Uy76Q^Bq=E>N4Fd|oV%2?JKEWuGhei+)ae<0Gu# z*>h^ghIh9Hp($liy)?@)n?YBvIj|(I!#@1dHvQB^S5(iixjWV$!{$3qm#JU z#bdkRo#^9XMZBlZ@C=W3$F{nMwaP+n360QO1T8O(SgP1<7zX~jwSC!7e~sFI;9QFV zq+V(RGZtU%gn5@HP$j6z z_=n@ze5^Zq^fbL5Q^R20U~}?hGPs@dIZ++y58gp@>8mY>QwFRiU9Fz5iolI{a&JJ{Ay&5icGot^xcbpt(#kGqs~gH6~feh&tFeJMnA) zauCO;;9@N$W8sJ4dJf&Kjo482uDjB9$Gxvg;Vd$C$M04)Di6Aql0<%!b*Q>sfZem* zpFhXle1GF^ez%uXqt&|@Kgb?J(>rgwJ;C4nTP*ZAV~*T5i^ZN$%AQ2|9_#W+?JISBU{}u0kzVZ?)%V|^QCG)?=3J~0({VeVJ5~cB zcQG+c3)SfChtqjFDLTAOuZ)jAcBz$|#e=CBs&?i+CQDzIlsm3B-U3uVH+gcsGZ8p9 z7H6dA0VX<2$pzo!_Ujj}g!7$>5blvV|BWIHJ`(YVUZu)Zet&!p_bvVb_W?fR{{*;@ zL;!m@DloH8esF?NUOusm$M^OBtd9wG#SShoS9VDgR9;+KaC=8zjQ3HvmhF@-n|Mok z`BueKJ9a`emsfeZHA#_aD64SW7aRrnoi%6o11Ok#rYvJ$=~OluI|=&{C;L#spA0&n z5LA+0ZkdwJe|ARmcjp}EJ7lnv_hbfInmQ9~QrhE5rb8g#rs~f^9@Tv(& z5jG!EO#!(&=BGuHh)15u4qn}J4NG8o78WSPI(iUvjJ=` zE5vJD2DgR-21x*lP;*cD6uRrr~L*+uf zJKc_!LUNM8r%fBpp6J9g-+XWl_%Zg(+Ehpev6=Hd{ih1#Bm^Ri?&m+FF~X`hpf)$! zKxdE2s-F*a!p_S3a!Sq`_#@i7sO5u$?jO4=ItQ&K*7dkBADC`6Kn3d?LV{hd&^gD1vBUQF{p#kVi4Ct8n{v&&9Lnh zcT<7YHcXxT?|@|3X9!wOiiIu$yrxOHGb>O-Sa;#3Q=cx(ucvq>u=9x$lk_D4wE`U~ zot=A_4IyA$3DMuHFllq2iaaDe`+22Z+N8o^;`2ir1&|f4>_MMlvg~yetYdl&$!ZaN zvhir)3D|$s=&oSu{zDcqzYSHa&4Jn|wiyl0PCcc>cC2AnO^>2CuF4+0I=MpIX+-Lp z0ab*1i+>rb;9>c3<^vVMyuz$gZwz13*;}YVbPWu@x}uz{zEV1^mp80*KN%~DJv~Gj zA$Q?Iyzub{GQcf0{sJr=Q#fn_cDKxTmyyT%nPNusqr%gLag7K4gulTX9Or6U{GJK= zz-=r@0ys!+=f27*0-40LBK}Sjn%Msb@c0b^k%2U!$L74XR^(1K8$c>q=7>xj4hh;0 zJX$%A{rMI8^6wI;2f&rZwfUzK0RZ&>UNqNE(mg6#(QOj*EW!I(| zip8^ypQo>7?j!a0a)h2DxmrV?(^?DSUDpV)vV%|Ea9xG9YX+5KOF&f^2Xxo_5|loU znIGToU^3oejBX8UqPYrSjGI`0;QhkCwdd40?mK!~75SJNv%93+#}qwjZn?MI^>KbL zj6dc?r3v!~z9`s|Tz;q#l% zxEAc7SDCLHJ!_wH)Oh~3nU&_5GaG^27ZTsmqy8WAIg{vf9F-I@bIIbAR3r zYXD&P4JW<)em#eKkjFsu-L8^1jUp>16Y=-YkO68Du9%?|41bW2Qw_do zu-=<;-W4+3auh6aeZEUQ-`CrUny_+k_pcoi{1W&sEE3k^F?mbpYR z$o~0c*x7==AL`pevw=T#GcTZsX>UWnd@V?gL{6n1gDWB5mzjAM+(8b;&t9xv9~DZ) zRBos?|2oL-0%2ZQD1_1a4Oa^LgQrjNUXOW%+s6{q0AM3~Qu1d2gnarx03jn_z$QoM zs*WJqecfaD3D;i{JXbDGz(gvP|Si+nzu(KBCh?lXRFoY z{wD)KI~J$XJft|h{^5n8x1Xl9keChhoNNrA;T4hXdfm41sK!<0aGashXi z{tAAfBuG)>S(ii)hLQm!7 z{oC-%h1#1EW_TL!~7UDW37 zx`H!;b)@cb)VlVNcbb{hB0;}ef<|kaHc7H!XMG{tzRf=vV9xcZJ1js#xU~nMJI)HA z3w8AdOGZu-LR^B}{{yT^Esb}vxyC{?|=Xsc^xU5Ihg|{}k94JE#_CJQV z=IuM=Af7(O^Ou&!c!wuEQwovsu+yUx*~C0-$6?F~}QTw>(A{w($ZO zur+#cD19a>;AUc~05AgX_CM4Cx-#fqD@nVDjQG)#*`TqK1OA4O;?GIa*3IR&cUtNw zf!D3@n%U#r9sm|r(|XFVT|^}IIg8+ODcOoMkiB`2P}N)Nc+ZqQHQejKXyqj9TaN!e zml^~fX8JjDjnWxriAqexW^L?2PfIuMsQd39zTxuyen_+HwR>0%^6NVMH5J0k>fP#x z6!ZOdI95>N47}0pO!)izD?(RY($`^vR)Ui!{-bI3x_jWVQgZu5bGC9tX-9pw)50aM zZ2->1DH;npE-4S<4}HnB0}gtnq5wMcJO=`1ZvCC$-8od*@b5yE+6d*B_w^oTD&lbr zoCBG^eU5(snQTw0c@q5We0Bs4$#M~slMCB`lJK0X7{tx?Wo(%#8*iQ2%>o#-1VPMU zT5@EzdI>|wg=N_25($g;&pNwX$cR9~QhvMb=vu!wZ*0f~T+H|;fVIw|Fdmo^(>%Nr z;(Mo4nQFij1H*t!#L$~1uzA7b_gvEEsDuSn1aH3#W*2~aM;kC(gW0xznaxEDgWW(b zn;B|yKMIq4+|<{PqQYEXIIL>_jy+iT@mcEPlFoJr_I09CTef8Y)`wj$ffQt&`uEGWwn+%y6Z(7AvNW3a@VG-Z{VZ8+E|mu&7kA-4(!^D zKN!`4J=NcW#)41+(3ECG63p5Ahpv9lM}eW@W!Ns}GzSbBFUZ-huyvXS9hNksTlzt7 z=dblMlnbQEYx&x&yF&N**R+=PF-%dYs}c-&WaQ-&sSog$0t!*==6gn6`7n2E95c!I zZx>q_&nBr2LXg@eFc3#lx}!g|0PgS#%XoDhp$Q|$OfEeuAFJ>SI~h}A70%?j<24*(o1avS6x*0vvUvXIENZPeZoPFsxp9L z369HL_*4wA>9Db72eScN3>Wrf>~Iux%)*7P$c9D(DICj_=(ddwb;$D_tDo9kLr&q? z5f?o=T&O0kPR|!G>w43g7 za6+)}pv6(^z1-yTMKf(2U0j8Ej<#=ItT!Wi;~}(QMyumsUrj`k^g9>;EC4d%Ng{5U zrufnqtd!5e6~IxrJSpfKR2#UGrSptMmZ?p9%&uX#jS4VnldDUJJP{ z_s$PD0w+b*JPf)JEBCw2MZ!0(P0-!ymoNZ|H(>@p9`O%gNQWyQ$I#MB}YS&|y*wR<}6a9jd9nOl&QL1{vdMu#!tf$j?I zC;fiA83MA{Js+0$)6#`~vRAyO{Y0TX-+d~YKJmMp89`shO5d_%nDPXSU)a8S{Gq(l zNdI?b!~$6g-wY6JA>s#{OcsVCx+{CTM4)9=N68|w#>tRNk3!98ER8CJV;f(-ROan+R3Y;5!9G;<~`I}J4-aWyluXpCv<#iHYJiNj%54P4YS+0+q`jVdT@1= zWYAwD(%k{&16dEtRzEqpDmt9}1KUa|D=mW>hJG@>H~x#n6WFi&VOY+@g9$gJC9{y< z0?fCgIT?EvPEiw5arLuN|EwG4!t)qEZ_I(?Gu7YlXIJL2Ke{9Rr@8*wIv2Pjdca<5 z?Xt}dsdqA#^lfm_J~&01Cq7pDKO5(4+UJ)~H*a`@^xQw3+y6Qjj~3AJx#sh(tLtDP z40wenQn8_VRz2zRxLZg4#f-$M0_I8m&yR*4&(2(F!gLi6k;!`h5MF4Tr2n)x5&;H+ ze-y2NK-)URSp zB)PT1YyB zD}~f)Mp{c?`}@^0#)#KtTDSH3pFQ$u$B~ma1pL26d&WWH$>Z7YXd1p!Ec_^CP7^y_@WtpnOL;K5^(6=ABQj{{byu#f*IKxH zJx@|L5S;a2pF47oTppB}{xR~PH}y9ks*C9%+m>~c{A5n?Dw>DU$KKmzH}l9j!QbZz zuhfU|%O+oefOC$eo0JV;?~Fhfl=@$l)9&PXUt;(J9 zm<~UmJ~~WZIA|MfSU@xLyxbcUqW6P$f7l=zJRRHUNJS?$U0|ihmZn0~BziuGgr z85MVk2ol*FZ1kbb3b7pqW5|*NQzYPH*<476VGB?&sz99H^G9UP)EK)G0z)CeOZ0UX z`Kgc({D=b(Y!sxLkaAl{zwx0@D13Jt97VFNyfP{<$s!YbV0z-FmXtI1jK_qpKx*|Z zI+}RN&~e^yH&)z77-Nj;(y$(wG(I>KMRZ);Ix~_@X0Gm7^AW>_FnimfVuX&>j+@|v zIj0Mr*u!=%V-cpNwT!J8L2;`XpKDn0V0x^^T59S-Qy-SzlwD)5ri0V`DZ0ZPw|{$V zn=}Sk5_w6`9oILO@`?g_A6)%P2F^M3FlhD4%^vf}2jFp*ypp~T)XL+g&;0aW>j0j1 zHC%#*mf{V#${e<)<*w4XyWPM<%zJfe5#@t}NK-r1pFxUD8z`nwK%Dpc)-+<$c6yEH z3xAb=py)C|s!{7@I`pl73;ql|ityMw5u28=Wqx>&6XUd({xftQAU%yZ8e9Odb4i_8 zi}WvO^Dm_JzXI@^4-`f4>SX4ROpWYuN+M>rawA^^aOR~BOSQ>=e!g4F(DYjll}`!l zk|cpv7(nYr94Zr-=xolSsoh>FI z2*?CpAkZuM;t%ptg5puV_QX5a-)B*w2fuk@z%?L~kp&OLW9^cA==qPX50@i`?!epY zY%ASlsPIK2Bo5#VkH=kuk%V*ZA6+>j#N=}dudb&Ik09>jMJ=agO8uj2 z=AP2eSoa^ZLWcFsq`EL(}e?KxPdgmWqqdOVW|8eKtFEmE})OF<5 zUk~}8`b%Eu$gzxMS`}-sAERixZ0I31^v5rHC7D+R_lq(k?KFHdWF!e6XE~!}Ys}6V zd}`+&@!xO5&vRNgdUg4YlHzxrO%MC7NkFNpi3OB)V6Ona?m{qudR|cudD(PY-ml`50Yv0%O!CfK^Q(YU2Er`_#kgGGer7Sr(va+36j* z-3v~ky`Y}AhLEyrr9Vrxe3S17xxs5GO9F>NiIX19Jx7nDVxHw9XjGT(6@!4vW0I|a zyKr=}G410aJ_u_xv;U|;+8KPcJdt-No~~4WEgR*jS91vc*&Xpkw$b@mInVj0%!)t# zf-Dm|m%DFG%ysMyAt1Iq( z`{2Tsp!mOq!G8Bc?bJ*&7E7VXZ+>IpU5PKoF}LJ=e<8GgVZ{IMpwweUxV))T%iN>y z?g>hrM@%^E`}V)i_e{K6^57K4i`6;LvCQ3rX@wT zDV`1hZ<{gMuEt1HBtNx^geDMyg^a`W=msC0Y-(oToYF;4`V_A6j(<{mSp7SZ`7VFT zgMt!fcYyoFY2&&O8XDE+NvBxluLxx$?cxht>_6jjsw5@Q+=j zy&b^B2spa3NZ>3QE9#jb)zA1If^b6Q1K5La0JcaKQTaSV$uV|W_W@!N% zZwaJ3ai7x+h?HCltg5|zQC0=~QDmp^H!`aW$(1K0Zy^eL-ft#)-HA0BKyz_HgY)`X zIyV8H_Vvww=4o+GX1lk*F=R@=J{jBplJg!dth=1@+xI+t=^||aP57cn!^mRLVRp?7 z!!}U4Vv0pUhVgh|KMh^jPYY8>6IZ-1O{IFu$W53j5ThM?WX^ZynlNw5c63mxyqwx> z1SCrV?r6VyMz)SD7MC>Nl@Lpe%$ApjfIUH?=D{)9OEQg1k+(@Wu<)}!WQBF=6IN@# zkVH*j#g>R=I;r*mYj!i$D)_8sVHa>(_MwVU{BkNppM7{dvlh8XmdKZF zo;>#@Xf67<>6<^DDNu+;$S)b7(q=l9C(d3dp$es5^K(3Lq-6}Z`RTj%_u_=2v47FC ze=*1ZZE@&ZXt!`#Pnr37yIp{?ow}U9+$!)X{h<5rT)G%7WCnOsmBMCpXEGBja*HsL z4;K9YvGLF z%P_LTb>08_d7iDOYHO=@-)wF1W~$FQefpd}bpN{h^ZmB0s~9!!;U#;4L)*uTXy~K} z^HdVbQuE|vG;lVhaiH2-c~(q8oMF=U;v>sF1^347nG#;4D&(Lz`-O`2>&rWoEoWXM zrF?89EGbmhBXmIpMIBYS(?>xc$SMG(Sbzq$6S;psnDfdMH3F^5jf9W<%S%(N(Mqr;@+!H^bw=1Tp5esu;wvXm0M)q8pVd&Zd zc`~i&!!N9x+#!%iSJW8B!(TV`jODRtI?cTO87g*Z#ItYWM3A8q$!=xAWjmR3evkuR z2LU=eDuM4JOMrVgKSy)Qeh4GaSvW$1$O_Lv@FvEyM=A%aA3vOhw$XH=h}(Znd{AC- zsj(H~+7j9}_H!@|5rVjiwtO3uiRZtOO9?`Dy$JeN16%^Sx&YrHVdPm+U){%!AGual zf-bX{+2ab|f|OG}Ezn*z?4Q&Z-r!*E!B0DG{I9zR(Zv6yaK|#4h<;<|z4bWBR6pNK zW-*=t1k)~|{TI6W4{2L*Myfy*CYAiJhb1L2y8HQ^a%?$F;LGb*4 z+`yAr7VbRU(3a>6gXYEpQ19TsJU*{Y5c7f8f`@3nov@_VKa|-HPo?kw!C>w6Ju7bo zD1W2iSn8&Mr-ylg3An+U_u@X$sAzQ_HFg$QxH0q|j6>;pxi!0oaCR&PV}Bjjx{wmm zb~&S{)PN^63wSxbjVQ>pR!|Ej_OFShZ;w?oHi|LTKroBOsv8$wnU9B#VZD#}kM*VM zUC8OvIv05PKSV&ZV_kW&SPG*wbBgyhPyt$#L@-;1&8x91oT26jZ{Uq#o5% zKA_4vgw^jb3}gQbdS!JuAAS27s3dx0adJyi4njzad@2Fg&FTk*`gAVOl6uEHaHLhr zy&whDd~&YvbJPlHFiX%oNYz0{6i(R9Tc>!VtYP3;Q;)2Suv&lP=$i*)%T%E5lwfBl z3G2OIYbDF=(-G8ZIU5FNb^?_BG>QErve)Qt1~R7~Qq8xYqwH5ve@wp=WXnkU?MZe! zqWW#dL{X&d!^A-8mB8z?7KEJSr3ag4*fh#^yadYPkd7To@bBWkUO88t+Gin6;7qRR z1A6$mWJ8|`Vo^REr% zcb#M5g(UA528%<}sjgg-?mBtw4_ibJA}N$6dMsM+fOw&N-m=iCZ|M)FKwI~1IOJdM zln><>M~U=lMGZ#SFd)wuuVi;oc9V}BaX&6pUd<9YrvEMKQ~ZzDz416s)(Kehk9mpW?m3Zni6Ww3Q>Qa4$ybnxOq6nm{$LQugT>Zd*!)VsO}E4|f% zK^Q^%(X0}ZEU(GYcQH0%2#!2aZX&}ii^$n5ZDc)y1@iCwhq;TFgUr?nGfmr^7cXz^ zaS7t&CJXcsrGZ)yUyI|6+4xHLf%v@v*^VbD=gSb3^Q9)T6mfF06CFKufPxk-cu@^a z_ZK9J0e&2p_-xhezp>6Kh5x2KIoi`vjq+~!s0%726k)pZx!Ucaqe)`kUu21M2Abd$Q@8Z^k71rw zv$V+%Jf;SWtt1iYF>-a7Y;N$aqA<^+jAfteVQe>uVqfAgeWXm6K2!f+=ive$v8pid z6TN@qB*r#k!k}u0${V4H^4N{1-{pK}q9?wf;lizyPgpXqhf zJk9Ho%Rm=Jt9JAssIeKe4e|~;pxS2>|F-==PL|xA6v7O|C0r1*wi-zrKZYw{vv~GF z)GYGA%A-8LUafuMS+P=)_{kfea*{}z%gJu4rUl*KqC z+cR@RSv#KHU>wI<#`2P?mcUA{*oB@Zb;$li8^X7yvO*nwP_%-IEgxXVynW&)`a!In zuQ_ez8OpIATpP3wh!6703COGE9|*2k`l5TLJoIHemUz;H&16_qv#oKM^ zi6W3nAxz$iIkOmV2kZz~{op~CNq>)6Sl^k1`eQm(qrQHW0Y1@X`emdmU{irtJfKSJ zqVh}(gA&+*r-`r{D7jj7+Au~fCZndl-eG70@3m_qicmg&TDHF(nDnl+jK>4k>jPfm zWDf*hU4&?%BshXULQ$1D4L4r~{v%`8`rCq-y+ZOVBj-@?>D0_WsNpQ|&NgCH?m53G z(N1C+%3As?p2;ZSf#IVV{R%{_sDJkvd%aj~j^e3f298d@4o4+r@Kz=ldF6b>IgtoQ zdac}d>{Um%d$%0&Mt_&_M}Imyd^~%d1h}r*JMYt-F|U?6i^eQEBUVK82;uv+1zHmo z#ZbLKn#`e5qt)~_KA1V8TwlXiTfqAs58*NHCX~sH8|{gpsnh!(We*_Ueim0$3G(W~ zz>}e@0>$-K9srkABMd)tlcNhzKTwee(} zF-%s%qi2;15u1^dfyCmbAjJ6UH2|uL5~;xw*_92>+(7Q0Q1z@CkywOafpD)KZ01B! z09m=3wgNxCQ8Wi<@&)wX?H7uAKyeMu8Vd^b;1v0C9pFBJzACzVCfxM9db>LyRO?x} z^7hOvB~qao!H3O>^xP}@SD%ey5D$Lqm3*`x;ei-ZPbqyxxkCOssZ@`sGem9HgYmKT zpU0_x_wYFX(f{XS2OeM~X6h@<3C7^oH$GhT@4sjW2ysex6yg9U&Wc*+u;en$a40Rp ze_rR1ba=PwRsZb(R8B2ont`GYk(Vir^Ag7ghaW_u2W~eavw#UZydu8y0APLwjo4$o z09s?dT{@b@c+q!BxZ4Jo8xNwgOXZY41IBdZtuhkkyt60JJ1+&k){)vfJZZbcFHpYA zi@s5^!Se6=yu|-5$aW&K8eq7C)ZJj3Z1=kWg6~%Z^zMTC6lV1`d9zEp7!WN5!qG%BOx4ulc7W9EGy?h-~hRm#jA;)oWq8%pH6UW1%EC$gH7!Z1!h%THRrw&Aa6NMC2qF z^5CWrW%ZR((X??ksesttsd#0fZy2GqyAuNh-QNQRmtAhs3PA2)FBlun_lrc}iJfwE zJTO+!03!MvGSYV=koBej%2$+dxMJ$RTQj^^gp?mXF4b<<;fP3;|x) zfCMsTXnjy3wj}Q^^C2Tbs+w?7@$HSXFVxmuLHsBu&aKtMx}yffjRIm_cjj&u?-lEP zz@xT7;HP_SB{X&=>A98CPAt2i10Y%P7P;Yz-?LJhlI5#>2dMWgk4Q`T?9S(Xoi zhx8i1h1Xix5t=o+J8`qf`<>~OwlhA=+dX1z-A)ll|6f?mu;(M#smLLHg#3XXQyin$ zHQ%I+&*t005GHX>fGFbla`Yb27TL!4fNy>CEa^y5f*==xH(3SoZcFn~W?s-;x{9<4 zuj~3Zg|(A(;5IWTM7^+(`)&iACB8+D^02Vx7hCiYFkU#gJK;x2pf(oU10XiI7ack_ z!^MG~un;j<&kLOu;r3%U+YClv52PT;7u~n2fhN-p;R7xOI(woRQM<_U8fi&b7TQK~ zf$l+t1_(Q(9yDq0>(l)5rK)|gQsVu-+(7T~opyWZCTPX6o-{sadn{RZ&fs~%-q~u=e(~UA zmqizach++2ez&y|U(w>&BInBi8yB#Es}h%Vr9;|gmNbJ@hlwQ%aAGY_?vCQKg z;4xDaFGFXDAi}5&K#_6LfzS`V1#S2FT6$if^lM`K<1z(I?$eF(miCpN&Yv39_jjh1 zOm6Ci-Lk+T)jHPP+r+-7fs<}NNKnekg+6FT=XFC`P!g~kaDD$S=9B*1nT=i#{oWjw ze$oAjTN?`FfZ-2unnjA94RYQ;eIhuIa=dAGT@$@tZ_m?BKI8jr*Ld5?}d&D^3cZhqPPn#sShS`NL4eFLl* ze;}y&S7?U!PXdWWdD7WdHs?AsH8~b1f6w^_XMYH;-bqfDkJiuGdd3Q4XEjT&@RJHZpF{67tO!vU)LLmi9zVCy+#@gX3_6xZ5}gVW|vg-fr%BEM0d`v zbP>6g(DS{pzJs*08lmy(Lzm&%#pK`p)X*Y)$ezD1YV%+N1Tdbdwt;q`^t;WZ(0{); zOACLsTPq~oB_6R>kn!E(kVi)`%~Co8)FT)5^{7QJ^y~^I4(kdjG#`|hu!FH195I~K zfMOszFO1)`5-ct4h;)ck+;wOnv&gE-_mJi%oM;U%e}QiDB~|5BROK)!tE{eo481D#$?-L42_+By;{_neTgCg~`y*8fl^9>ps@*qKcyu8O#{YsWU2Sa> zH8*knc7K?Xks)-L4X@6mM^pSUyGqL4@oc|9w$LktQ}=3rS`AxA2Ri)9M~e8Z3>@io z0N80|TJk%vCB+!w;TM!PPI}2n{&>u8^@z67Td4QL(I>suA$dkz-q9WX_c~`P7?g*u zd_-*WmZfC7?1U6a;vhglRwhC7DaTxW-fD}9T}nb?Rj=-3yWV?SK?5L!>t@O+m&D+Z zNXUX|cH>k6tH5j3Y8foL#PU=`91K-A=_b_Ep_l&rPKU+UPgH2bOyJwFNWjHzuDiMw zcNYzk+Gil{@n4mFu-vaV1IlkG@b>o_55let?_QSS)<3Sma`+MG+Awb(Coo z@(l`9RgI)I)(TO~xd03IXqNm99Q|`(XUjFgTl}&RH5eyoMQ|6EuH_z9c8Qr2XB z>@8x|0O`Ina8n#m<<0BRHA*|}8Wyz+= z$TQl~M`ZzFHG^nL{!*F_2~GA50iJ%to_amB4!sF7WVn19m$J#zwqMEb&j!VYh) zd!>vCuCi_sTmfOOMn-J$AEeufrPcq)^c7=G*!xRLgqa#W4o+OGirL~k6b~ez<_oZQ zc4wn{nlp|~##g(krw%nHpxg}_e=UjBhUWZMbDasd9XSAeAJlN0%;?@~ua_&2)D0

_m^D5hGPYg~<&^HCgPSwi_aqjh|I&m_UbjLx*+b=>fFO6Q%u!KdWS6(k-Lr1UcIz6Kxcs>5GI2L+jc z(QO~G_70+5L`BjyXFYj^HFEciO-5Tc`<8UInSnp$g@k=5@^YwhsXcq(BV}S2GXd*% zqooSi=O^}YATdDtUEi1L*2CYm%TKNj?#lkkH*Q0svxSH(W}Fe#e%xxpmYWCf)n8rB znL;9Wr;W4Q2eZ>Z*I?ePicCubvEbKw(3UMzYOLM`107&-(YxQ%=h1}#+&BPc$Wnmo zt3T_HsgFV!cUwmUoP&M;h`x4QJ|i`WaQ$)Zu~EjDmh&|Yfo#7L_=aa-{l@~(w5J^j z$X%^a$lC1OssZlZO8oHSZ}PrMA{L+PeClIVrw(O`f9o;%RRZ2{W$tn*u|ACH2&90| zWIzR}uj~&rwZT_C{$>q`+*PbxhDOzbQsbiw&-1;3#9~EZbyY*urRtW zfM$;idwl$hRFrgKiM4g#*kqWb6%&Fm6Mz!FS#Su<-&(KO6Ic1U&A=?`rDk6!%#HyS zyHcJB{G>-m-v&2m0L{$4{HA$bJuitV0Xr!MMciVrzH52Ef#iW}=>zdk7AqZ2^#?MX zdVhXa6ZO$!4fYj|8kv$XzRN{@e1wk&#Bg+iHU&h}Qkmm$_YvR2!uLJ;-5YdYuy&Z8| z>=p8>{UXWxg-ax7ZlAFMG*XA@BX7B>EkdjpsEf3?9C%jEf0cxIf(5L+L(0r%DPC0a z5WO^tv~>}l*)^pO+BUugxl??dw4K-@j*T7l*z@^^?T^g%IiY~I@@W*n9(HNXU5l9|HH$H<7 zxqfNje#dun&S`>mLK?!bOY|e5s@WPIvgDkUCgk+1lMy&fYP%}tvF88OSDywR?DfP_ zc#coUMis2**fpPn6pkH79H?pG%q~~$%-YmB0FW zZh)J*8u#3Sp4dhB{un!vXd_HYEv4kc9NU!nr_}2BnjTWCJ>@NPzltCP&>1w5{YwC*GuxB_dfci8g4Hw9rx=zgJ`Evg zJN`_7yJYHTnfT4H&I!i0B|r8SdPgPmLEft@BC8_C0xbWXeXO~ILR%S-lUsbAhM{;$ z5vqjtrsJgJeua=)zF6YTLRw4r)9Fl0+vj=D&Oyk2LG36`@ie>7L-jh{X@rsttfgx^ zxCVT(b%p(;FDPTP#JhH98W5?Rcb`z@KNgrMloaVxWaIhJZvk!@kFfwkn_~lzYXvbD zcCMibpdG$h;f0*1^9Rry*>NP<^~d9;9cC^vv=*193C$4sS5C?S3WEnp3hTS=q>B zEU^NxKy>a3yKh7KzG7~VMA7abm_FGw=b%6gLq!DxElV3A16H@Czw7OM>% z1u~#wm?|vQQ~eHqj4GMJFrfXPT(UL_0vKE3sz@bSN6~_D9^2H>VtlW=Q?h%8g=D#8 z|L8)nJY!5SopfTSfi%x#+S6ya_(cKhgkL*yMT-vKXjQkicmW%&_Z+qG*^$PUpAc)Oc}%^RfOD&RG4AcVjPQF&#$r@Zr^FgZ2|2c6{CB>$oY~Yj|_@cKt{+ z^-lNs8Lm2PH}dz31?ttKeP1ZV7LDf!XO!W;L+?IlvCdudMuL#*g|>s2d%mKS9}4eB zRm3zn{kASl4-D*&WYMI4!`XNiX{IsYF8%)Z@^G5!ma84?q6}sUyCJB{R`%AXrM0!A zU?w1Je0r`ZScJrq-6H9!Yg++qv?&@RveD>8v{>V7=lhe0G|U=F=vAd^Zn+-II2(hB z3i8s*69ovLXxEqq~wM~{d; zgcv>k9na)A65Ni(a1=99aDXE%LVUR5bHXCvG3cz-;4P%Zbmw8AQDObnzd9=!@kc6r znOgR_a*xZJhaklQ8uaAA&%;CT5YxI!JmUNbExlDU;*`Y5PxnNtxO>@cejw7vJbh{9 zOK@`)#|+3sn?7?Y`iInqc_2NmaBtZ1Vi6Nnf{Rg+eIY{w6?NjUJ+;naUN33iGI$CU zA+MM!tmj-ueiRki_#-m(3QL){Kx6)m+43V9rmnoTOfTOAoru6Ln}&Hc4fzP)3x>J_ z4Iz?c3}IVhVM9CJz>4F&9sbFe>4~7r!2{ckyaC%TZ|bjD+ww7jtMs_#_s8{gnd!Md z`m!ik_li_1)_yL4T-eR(Dv3F2zqmwnO&tGKSGoGw$Lq{WeRMc;JWJ5krpt=R!Ss~% zguT7oZq0|wh4nVwkeMt!KAWoL?&=6mvf$1Ze%?!YA8%Ri0WTa`6Gf;jR1?U|Q$b{0OZ}d2?RRYkNNRJ!Z}TjgOgf>6>8Hym_>q-ts~$;tQv> zno77_rs}=*3CBcMI31oLPAl^e4+bJ3M@5(o1J^D1N`sDL{0vGyK&_H~(rj{_6fT&|bC|eRFoz8eZ#MYg7u@1BD9J zc<(*t2)|<5d9?WHWrjK2Bld*6%tgmqm8o&P!PTy#`({A0P5DVvDqm@9!JNs~0rIYvO_PdKaf!k{aRqU3$=cx8A}6PLqU$3@g)I4yQmkKJ=+ zm#x7BH<$e>$38<)uW<4`=}DBp>1Z0iP4H5SPQ4}DOhRfEB(S>i=D6bJVfCg<$15i9 zOBxM7Z@gAs{G|!Ap=#Iia9&M9OT4ruX~IVNc3@r<#GZ~w(`fRneZb93O{Ua1)(Y#M zx2`M3#yBc)=giiq!$(zoMgN{c0I_o48I3s=*+@d%ZDdaqfj&X|!)FHU4xFyk5}C6K zJ-B>#-N~6l4syt~8FRf78@aq?fe97~=lnfPKiO_E0P11r&?ll|-2Kq@)UbEgN6TJJ z-WvtkV)F(7Zf({rh|K!)ddn7Qy;TU5d~L1ZzF>uu$s5K2wJ9jYSQNo!=F&k5tavJK z4@mO~INuwVkGAw!FflGU!cOqLsOao!s_$Xp+^W}Sw%dpE6F1&e48a~4K)>1hwmpZT}O9H z>8-uFOi7R+vrp!9BDYdtgtl$fS& z8~S6eEERoPfK#iYGn3|kaeL?ZldGc2c1{-SufvPU$M3a)w4NFMKGO9inv&EZ7l{rK zBLS-(`Qt18gzoPht$`Ppg^+g1d#Se_8C$-09@V9)wW&+u`TKx7X*`;#w@<958^0)c zG&O?tKP}11hAJoX(Co7V2_c47OL>$@6z>d;kddB8gmcHK``cao8a*yAHy9co&0IWp z4>1CL2}tu7oqY(Wf%z@tsn#vxjR9?;=hf`ceRtm|dZgYxj^ zZU;YrVzxWcfG?AmP4B1P))-tPXI+zKA`a~(rU3CNNVNEyL@l(lw@d-@m2KiPpR$A& z;SoAAnqvYk_GyV2;&f#Ok0kxs!1sMCMz1D)lUwT&dv40g_1dob;QmL*dAG?za9mBg zUrkql_cujhX;E)6)g5E#fPjsX0wP+HA@X>j1T&A3PH{gS(>LHe&x2CoUWq*OM%)^Em;sl6&6oJu{@JSTu$ z@Ktpr+t})IJ=jpyt$=BaitbAy(9#-PVk3H&k(eMz2UV~fjWLQZ+&NnJ4%0K~5F$Cp43=of;f55L6% z7sOyEg-e3o6mNWQo{xcn&n_=mIzNeiuR#!=I(YW2`swmZp< z)l9rEv)ryZ9@FuN+}uvGpa$`(Ol9j{|8Ye7A0X&N_lm<*plFK5Eu9Sm`>_RS?;xtag@OwG2_cfo5_1`CU z6GpyO7E+pG{@SowiwKt#$tP01)=PWm%H(sN;*DCxink=CUP&^rZz$CQMO8AhjvE9> zPL-PEE?ru+OhWiJsqE}Zcn2h%Ivn-9h#f)iU1*6_aP=m?5_#h_n%=!}8)E3*YKULE^ss@&b}6hmeXphHYPXvem-ADte3@n>XuqM&F$ushEsL_Z)pB-cF4x9t{^#RP;7EPLJrs%dfj zvpp_sj%tV-9VQnT}g9WYZsE)PqzU|_g*F4Y`=aK?|K>u9sL9*&tbhf3Gk?K zKQlg*5$F{C9#1hD4H{54&-OWvcc)GAy*RqrB4LeSQwDmuG`J?`*B8=aN{Ij1krPGO_&^qQ10p`oR6LEt0(%krOvj zjmR4}emzuO&;Kwt@(I6wBQC&HS_(wFG8y^<=jk)8)G}h20}Brldfon{hqla0w6j${ zbKlt8*+S!5z0D0%Jmwatf#+8u`2uYnFMOe@Sf1|oe{U*hrjr<>yA5$m?wCK7yRQ#) zvq!Z`xrdl7;_|O7`{N!$qW&;@irB;K1u!+aLpQ4FAQOw z6^x+!H0iukutB1?V)WFBVtf0`@Cef#5x${3khn~*FuU@*K*Xx~U*G+oeS(kuOb@_; z^{?A;@qHLm-FhPXy+>!C8pQDj8F+xF6zOJ~V6uIlJ7nJ(r<53jT5MZqbCYr1>g2EHGgC~NBGgza zy9#o>`=1@{`S-|+uoi#WZ@-xv$*?cWTqBQ|U}AVmI2;8k0=8FI!*+8_*|^>UE#r8 zE&ysFl*}3qwVrCxbedLUIQn-^$F3h4kSWm9;^1yY$!lzsu7=c zGqj#ME`2qKvoPUH<{KN~&afq6%0Z8xKIjy4%crF6RQ#h8z8!57u8?t8zw9Z!_Lj8p zAbz%(ZLdcr@_jc4;~xOp-r{QPaNoc#ix4b@uRI@lD9t97AN5&k3Us#Vt#5PdzOZ3@ zYheNncz%_O6%iq35MY`6$lxOE35~Ua1HNh0*s39%@R9`WtPH^EraScQ8L5rOfFLb) zz4ULLr8M!@|&dz*RRbE>|l3&3uqrW>8tyQ%#MIsf6i1W_-b@0_Z5}e`aEzRbm zscbf%a7@|h31)&!4GsxHdhcSS7T%7cA>CHNF7WTWlzWFl0kN@~l*1*(F^Zezj8UuF zbhFM3+6F-yM+Ph2)YuGJPck1rC*l5ey8UPxkCc3t=$UnZL}%Q+BWC!SpR)?ruUuwri>J+7D%eLZ6<$&ezn z&Evy|rcZ@dd6l!>t+{quMN#7gZ|!&0fOHYpNoZd;U+fJ>JN!OkE-`sAu74Q(O{0%w zfQ0_ZaF8U;0r1>`>*@FkYeLjScqJw`?&}nZKZh*KqFd7e76ELF>XS8hzco(au+mC1 zu}+O&_0lt#G`L&3M3=euYRcz zx-zbKWp0k?oCIIizDaYZ%YRM$#ozt$#%Bix>^Pf-l|OpUD>NL?KwGQ}(ko_62fUey zI!;$TD1k$`{n%GZg1?M<3)Di`n4<$tG%k}iH;+bLI4kfu6nLCTw3$qRdJ&KxF>1O2 zI*hG3KFZzqFHDEkfmzgIb=%Oice9a=#1f!a@mJ9;4O$z|nTQ#KlWF;fNQ^en7vy;s z>dV8KL#zB{@4-C_S1fsadlq#L_DpTcmp=lMjc=OU)a`kG0!I~c22y9-6$kH9GpJ>)b}#?Vw+`lfu@{$TAS^TGq_};nx^>88V!<}Y@_)L7lKJ}lx^Y4BkTu``b#G)af ze`MG(IW4d{^KOETCUy$|7LArjxd}2ZeXHb$<-~&8pl9Q7$trsZk2J9FjP}PSBRs?y zVQBE6FJwPY%0>r=MY&umAAWCOIsD0 z>GZ)_3FX^o@A8+8aG9$0wW%9WleGg=K!e0ihSjf5N2n4YAj}}oUnb?7Q1GJEQXec} zk-kl6*p0dm{Ie+~sr|F?|9#2J)AV%wesxFR*`&849F6TX zZ75Rmvt~v}{j2M`&C@9?g$DEI^SHTF{Z>_bFPLg%y=d*-Em2L?+xWvkRm=ZvB*Ax1 zYb`t&@@gUzhdwjaaNv5F_1-Xn)`O6rVe6sW#w1dHsH|^sK0NY~Z8&LB=gi@Ch3FxL z&%e}&y&Vvz&X?8?{3P?xOHBIx?}8B27gqcbMJUz~OBeqqinxBa_J2{_ROp_Tx+#39 zBuZ}Q3Uy2K_tuOL1<|%_+x#|b@T!#~Y4iY9K(Gc8&bzL-Et-g&0%Iq~f@c#JYI0;e z8glad&mZAtc^sygj-GL#>R~CtT9J%M{3Jz?hK}T&tGtV10oG$$$8T!oDUjV))~G`l zb8km8&p2giV}|AQTOqxn5w!A~tQB7>7S5p^QU1m}GnP$CHr!HrE)su7%%Xi~2XQG6 zRC$_d^M z2eMb*f&?AwrVIoQLnSpI{RYTq#r{kPQzP%iW79=j#S4+8O7}?xYi!y!J5g(}eUi|w z7J(#?XFoBzS3$0!la{P~?Vu-fGK{H5SATZ!g=jg*#EBTk7j$6zr!R#3ibSjX)}D_C z@LqqZJLZ=Mv6i$Dn8=UyHJfAnXDtJuxA#boOn?sy1A(Scg8tjSz~7|Y?Ew-gENm|e z?0C-9Cl$gtdMS0NC4P8PHdIneo^yY-ADsiCYYxE2wNC1IHm z4()}=vw7@U;kWO&6DuHRE7fr$emW&2N4L$ zCf}$$a_a6NE5yp}Yl{pl5v%_8muvvX$OWAvyr!@)%O^C-HNgcgfAG;ok@2T1&))%R za~EQvF$G&p58^po=8J@K`wY2DuNp|UF@#i>$B| zdWro9C-s_ts@DWuv{B&Y`IhIps1)^aqCErmYpr(b`e^Pe<9ID97>On(O8@+hm4;J1 z;J%q7Ye3(I{c5|~ToQ1g8H05SK=2dprF&x#eRJS5kcCFLt=weaJN{vPq#7xaA#57( z#6PD8vv@I|i*v0rB5s`SJsZi}$tr;q5>cKPfoD?RBs5nX16j715w42OHCtT-2d~bq zyPXp)wB(lco3@_G5~5L){dBz+>?Kbo*V6Z_C{-=@M1!9~lw;Lc51jiSD>on}-ZH!_8(bT^TJRNo!9(H&EweGA_M+6(&i+*NEchTPfTC6BnD)5i4u`m6$e(XKs z*-Qz+lz;P>yLru8h;?Y=mmB^{+7hx~d@lyG_9-df$}@=nly#97=Sgr-8k3wy%O&H+ zlR*EkG)K$$xN612oz_R)HM~jn%AblZs;>(@X`#(oIjwg}5eh|Azr%?;XbOZAt#Fq8 zs+%5{m<~4iiizYR+y%bG9?Gp@D1CU0`G##~+&8fetm3~G*VbjuC>pZj8C@hd$UdM* zfyEZzW)8~1qiBZmWcy&-`lgydUlmQ$cz0)zO;Zc_jE380ow-h_gEttk8#$=^b;+f+ z7{dBp_oCrT#MHR2&bB&-bh4`_Q9=ZIJH%1~YXQ@>=PGJkzf~ZD=OrdDp>u!ngv73I zLErAR#vvhf0G!RRS=tFW(9P$C6gxjDTyACZeRY?1Ow5d1^q9}m2WJ^C_)K~3c*7?! zu-i- zf1-(9p%%IsuU=xaRh{hPiF|B2%6*Mrx}MVsAiSOb)y6k;!q3?UQQmlpTjDk+zGxk( zqqmc>=RkwEVnov4d^WRQgLrFTw)AREaC1a*RreV4Yik&<0G$E?(KOCO)u=W9ehE-* zfHgxkei-f$%@u;*;(=GUr>c_0ocP=Szq&hApGK@7t`_shubE>$nU&sqySk8c=tARv zPB3R|d6NJ12l{_E5y~vTc8dS!1hA+xmprP@w+l>7;_OdT`ZA?ofz|()1dmWETD}2^VAaFR(cXlGEZM<^F8rmzY$|1ouqhealSkbNog|`aiC8 z8V{!a=fr?UJZk2M=ydF`xn=VF}RgVwT*YjwzxRYu8w+gwJSx` z;c~Io2#uS4gGB@=AE7NHOZNe~Zs|RCKB=c^aERyQk@eoJM_p~FYs^h)4{s(^B9&ma z2@!!Pzibxrr71BAZRSD#rG80sbjy=Rq2F?u5akdfc*J&9n0My4l7Yn~&^zTNPgMal-vrl|D4z+US>P-e@0Y#1z8p`Hk)>3|lTz7(mexI5gN6J=lgEAb zczl-laQ))t>v2A1xz_~eh<1^WFWWzMe%c--ye-bPJ#3;=0Rjkqb zJ;3$%oU0Rl>Kr(&E76za&D>!s5}~c^LLFdN7iLwa-okbSK%c#Uf-u8&pV{GM`w;cU zOGQ9V-qozP+$-L{quE8mmQSg_|IO+UwkuF%EBE3f5Uu$q0|O#ykId-Z6p2_c6EJshwI zk;iVCdqLIB9PR#Y3a7-R$ULJ$d6wT6b3C`qXmsyd&!`qXZtqQD4vsV(i6V1R%HG>G zobLj()`TY0Xjmpt8IEU4qRbTNU+J@)J0=itJ5&~cM&-t9QnnGQh@5BU-iDIXyry+d zqqdLr3cM@)BzcLYILwB5^c0GsvtOHVJvGS|#vwbejP?jYrUalY@9By=RzP<9S{`9pIz_tVoKOR>1SD-K?>QNzZvN(E4Yln?+x0iLZ=?B8)2 z#xU1qx@H2a>XnHzK5-9r!f_*e<<)k5^4rS_#ORxJzaSy@eW+qs1ZGmMPvkOt|+?nJubvsnhsmy@zUq zVO>76@m}Of0sbixB8Z^1$|mr5TcjWcU-IHePJE8jASjECT99!yu>kI0QtqiLjOLg= zx{h!t0g)5!1A7qu&_7f$v8D^r{G!n&Bl>ef4XG@^Cc*b+|Gd`+hU$_yZ2)mXj z3dvc3h*ck`9BOAc7;Bs91p9VeH=Z%=KkMhp1G^&laqRkae*}^{;h0@%!F~-EG6amo zw6`3y#SDRfAJ5R{OOaQYVp(@g>%?1Q8YliIhu5X`TbgA>0~JyA`BV6Hc(p z^7F>2S0~E8c;WTt!kmEf!@B0(3i@wh+=>*6yIYI9yF>BfRw!EBHMljnLveR4?(Pz_ zxD_o{JV0{u{Ga>2>)ucIOV&!(oH@VDoRPC<@BL#J;disi^$K8?p#eiz?-Nc_Dj}SA zyRNEO;i)FR0kS(U{g#Q_PZ)ZRA46i0bx}POp~Yi6w;TzCcJj341IsehG)azt)<=`X z?LTP_L3|VdRrfY3omZ>lop-!77<^P7T{6N+dZE7|uNr0XUe65$XT&jT2@=nVNG`s_ zRHV@}bjLeeLzJO~9nK|v31gmffdkjmD^TRr{3}y0wIR4c}jxcyA9Z9eKaqW?N1iIqEB}HVDu6|!`4l6rED4xmJ4big zw|a{mApiEFp3gPJhI*TC|4mlnmwE=?&<=Dx$K~4_lU2dtNm_f;XL*@*f};9+_C&)$ zu*x!es{S7k;HmJX%i5Rzb{{V@m4DADHzvV7Ns+sAPeBt$w z1bL*nQDMS9fGObCyLwT3gfuAl{{A1L>*Y zilZSE*2EOW4(gP#%*{zxIoqN-mgR+c{E)x9G4~RLsI{nnf1$3^PB>>a&%M4UH2MU} zu?7@!WHRy&k9q|WT@8<2e?EK_@d4b8;hx}F9X!!#TcKpp762Uk^4cqt%Q}(THY@6Y zBM0k*b=!!lB+<eG#`Jg9MYl@YmoK}w?0n9+=Hkk7rj!-GDuV?jUUyvd z)`&DfN0;}l;Is0z(hyprnHG@ve+5^~j_vT`$@~92>$i=PL_f2rviuI23Bk&iTHT?!{i?vZ zH%Iefd$mskYD5AI-9`v8#8@>IJ#Hcc5 z)vF5~!r6XR6iKmV>TXpRRflz6E}H8m4|(!ruo(_(lxg*C4KH)YJn zA+>s+*O-3XNfljnUjA7!7TWoc%_2CQv_I`7bj6vN2LZ6ToJdiwqv;$Vv39WcYW3n7 zwd8rvx^~_e!gIkid_yNNP#_+2(f2K^lX~Kz{Ps#y)W#gpfsp(pr{7;+ToCFF!+i_f zNqr-Ck4z2b@llb6$BdHeH4w<}I7A;maYD!x-MZM{8lWcZtQtNdN$l)<=NgXx=rL1o zNz1veYhRbV#V-T-5{;2V85Ag7GdD<3_NI0vr?iQzN;oW}$SsN7{?P%wC?h9HDXQOd z6Hk?^E4TFhBRvZ<*K1{aSor;r@lz2B??B<~)o|*))>|lode+qx@4p`NzKBLuf_$=; zj6{*KrqXl&sam_-Yj$1N_HFTPn00eKtTW%Ko#5mJ%1(Z%;YcA;{+32GzWIy05KZaD z!0IFoq0)CW-wOFDy9Gdvs1A>zXu(0K$X06R@|xBPJv)XeI8+P^`Y~U|ru%Np)Y8&Q zZusw0lofjW{NHZkch9K}hh?aJiq4K6N$GKKOq}N69N}naFO(RfB(F|B!{`-e9DSc_e-*wIE^~z~(qdxU5{IUt=4}PEYP?8L*1k|s2lB1;U8u$#~eWVlm zn0!0y)lFy|9i*VRqUG1{sU&@{jOqyp;{EPaKgO6rm*;1|5sur!=bF9)yT>8l|51^z zG>Y$PgF>U`GsddJYE*cn)B8&0NO`XRe0;hUn&Pmdc`y3hRI-m&Iqj<0LR1@?`ax$* za-F3eZP`*?^k6%r3aQijNl}E{MYG9cRNEXOp7MqN!A$Own!9?OJmegWfIMWu$?qGk z^E1&WVQ@?L5{uWENl@j&tM?8_FmJP2Z8`z+}Zivb+g^Rj& zjR8zJ8m`nx`y0b&1GidHI|+D{nu_=v%rNO>U-^7c(Z_-*{aXYsaQ+1cTNIVuyYScJ z%9EAyv-~y9$rvz0hZiHbx>$Ow-}e>8?gG|L_HZ-^e$x}cBLbgc3O_~qEF$wT1-C5N zS&X->J376M1IqXCZX@i(>!e^X&c%-QnKWF|ZZ3LH-qTq3ez(Gg{KihQ?93G9>G^2- zmlHdNUw+js;=~sP?wlpXM*Rg&(wpeFH=5j3NjIB3h4B_Ijwx0$k^fq4c0vs_x`Hui zJ|=wQ0?+kwPWC9D0_Kk|XgdbUS)DtQ%PTGSq-3L3h+djVzc67Ya=4%=2Q1yzulDgl z5femD#hnoV;_Yn{GnVmFE3d`k$wWR#7?RUcT#wRoJ6NX5?M2 zR1>7WuM+6>ML@BI&XnY$5AC&#Q)ha#e6N9F-eL09qbo<;$?oIO+2*1?j+s9q-bJ(o zA>M_~0KQ0A%R`$@FxUV8TybI-NJk$Ov~nvgb}ZgIFLp3J;rLZ76=H#t*`)}6FSs;h zz_YkkgvBP)t?AV4vs|kvuIrOL>>k(_>pDqrURCa-Iqhl?H{>Cfk%}Lo-VI{qM;n-{ z{yf|zBtbB^&vX^G6hzm0jpouhIcIxk8KOfm#NO<6+)PGt!C0w+^6RehkCz4o;?`yx zR*LPS#m7n#uu}Y>_!QovK%N$Y%RZ zj(7dbHdA??h6~gI@51e)w38BpB7%~91RVXk1&##)y>2CIQO@d6-l1|p`X9X$&AvZ% z78-M$M(1J5N;%Z{^?d}?0~0bn?$gj4pI^l^7ySWG3jWO95hK3cJKJ4kKC_D_=UpyB z-@PTbh6xha1#I95Ds);M4NJ6|SrS4%!!TxBV!Zad%j zqYz!4d)=-tq{2$q z4^>0HZ71KhJl$Z_Wb~Q2#2;h57;&kW2dDJY_dP#YNW0^Z#)wf0NQ=D*xgW#MsIirI zOY)ym6Cr5CK~}v5kgsyDk6a-h*uZxgA%ql2FrHuC(K zUcbamyS3WGM_u$|yPe+HUyhRjiSMW1 zTeu$lAQXhG#jOQSUB^-^Q``QR*=qQ0H@1Q?2`?}<8T*Ag8G5<7)B4jfPdjGdS=#YSw&Nn{Inl)p zC$+$wi*`A;GxW0|Q&cWeUup0jGa4A~H4Gl>>#8|0CDjhVY!R!dgy)8Z9 z@D8QtV#%MOiop!oRT?;YM|`;B3t1p$%_WveYqb0|sdwPaV;*^AUoyo+cD^%j744Pwj_{kB`zr?!^lk0nHTfJle-Qf24i`*I1nDWdYBiIYm`$KbQM^F{>rXM}Ep4>Jk+PXMM z{sj`v-5bc$FVVT5$XukDYq6%=*8~1FvJEHNZbEb@WaLHStg-*9mFa3(f7Fhinz!+r zU>{%*e{FcPvz;VH;k9+}g2NY{klDnH^KnhBkl90JUKZ6*7V+}N0t^R+Z14>Sij|a4 z-&4BukQT}zN%#ptnWaX-w}PRdg}q{=B(=v4l_fLIW%AQ{wYNBu!Pgoi9z`1vI_0ZI z`DyXIqcUFYtROn*c|+MR_~xSCFHP^s)kQox$pULVAMc`AUZx47?tD3;xVGxY&WX)f zpJFMZGX-%?7Y6vNj0race169OI|c!s>x{&! zID8H}vNNa!*)rVo$Eq2LK%O{^!E&E>YYtQR43T<##fVA&0$`&d&>MU@pRcVq!q7!n za#kPm`EgTs5;|ls+bXPayg&--6Na|P>J&DhvEtkQ_12(LE`8w#r6+TGvS}M8k3RZ& z5A6LampB>S*!s@7KEX>u?xC(i_{>FdVYT!SY9*1ogf7>t`TuzVAWD3PR+_ggCXz2K z_&gP|l$EdOa~p_%)JDG-c)H{HPgf_3lU(pJDiYAzU&*?&cqA);#l@{A=G(}uLMn3@ z;}iF3i%qaE`oo>v<$5=`I_@_5Pi(k!Aki%)ryaBN2@{%7jyPYp*Bj0Z%%AqURZl}{ zUz6O-dObS2tDo{FI@SAr?ovXp(54q76!%$&2}nPRS2eI>x`LwF<7gS*d66P!Rd;u! z@oQzbls;X5n3GWcJ~e|^$(mByNEnbj{UMN9pmy8S|b?OaFlmqxSC9^3$FA&?Vds zz-n9^T?WYA9l%0Q#jXDnh=LAFt{Q#s@Mz*iTS;ysynYV$CWS9?dWw0G$VuX~Z~_G( zU^8hs;w{*iYTBT6Ny#OCE|>aBX}jr|JfN5n<}~NRkQdXS>q_?hO9Ms4O4Z&MBgP?; z<)+T2%kZ5FYfrSUzvnV21@{X7NCnx%;7>pJi)v6b$M=;c%N5KkQC@OPG?#_!F^cfZ zKPN^$CfqUpkkSwyzS;8IcU2gu{_}z2;zW;B>JOM*|Hkq{eFODT;$OH&^Oo0s$iL+^ zD0dToFU|UHWX$1h-}eHNb`$RlHJ>Q>Sb@)WE`na;Ve-y!RhAqS7y7r z>}3oBWYi0F4!k&(l3a^WE|W`51?m2fKgwVeF1*hHPZn=Ge#c^uPug?uI**dBHC3T~ ziR%E%zaj|k52s@XoSrZEfwMDYuKKFO3cO*G?^o)K%ZW)~Lnr`xAiC;2Kckf!X;fKw zcQR@7b|L%Oswna4f>$Q)vEi~W>lWq|SF-ZATW%byx zPRGbUTF2P#rT9j0Xm!c%9M>@5iG>0H^*=}$)%eX3N47Es&b>1@5%}?v6A#5K7OOJ9 zMo9qv6}0k9Zx@uJKFG)WK-Z7P?h|&*Q7C~6^uivhJ>N?;IJz}ckx&hhm`_^a7$4(apR z*M}+X;8>Mgz!r38b~qBpp1^AF4*5Xl=i~K3e+jTQa8~Rbf7Pce8HeG!X}#T>S?~=t zDK4!6jM1WE@iIsghk1ue8Ho3d)oVizO3PoL_^Yj2Y&M|Jnq^FscpJEM&xoA!RQTDc((7882Dq9x+nCu_OScU2ETxVO z@UMNO&@$o3+Lch?!}zW}DEWj0>1j4iFrOOaWZtrh4%>xuOfalQa+!N=Z4+>og0qWlF>sxDUI!I1*pw_vj*N_^u7umLc9dsPZpJoa;%HJnPOKDUrX+ zg0Vf09#2nLW266oPXGgslsPX-H^;IC&;}Uc|BSsQ}8a#~KQ? z6$2KWMacEah1nQ1Y4bp83=q*Nz|%`w5}koh->h7KF1c*OryIpDjTUf4Zh8={*hl_HGi;mD%j& zvV!wrJX$l=9KTWGg!?Mx9p|Cv^NRSPk}k5vwjm7#FTLU zd^#PRz?g;)0=6j&rc_nNYxyM6I#2+rE;VAI$WIuTVl_~YSiHm@(=%4jL;Ciz-)RC=>hxM})+w+ZG&l28=tERt(+@m4fC*d?@lAvSL_w<4OAY7`Q(`$Oa*pK9`c#0v5)`d#T}9 zI+D`K2WDUPp<*gf*0l^e%YO6;Qz-bmHRwkb8#sY$4nmhD{bXKpmYLOTJD(&VG5$$a zWH#knCX@YC0UuuAxnF>G+2@g&ggrce{G*AGOs0tSeDq>Fpx^M67Sz(#+X6b>t(-C! zUZjlVe2w;KIumUwL1 zKB6{ndq}h;3LC&2=^*yH%wf^qn(@ZWpkH}8JV=oKj)YpToCk>4UmF`_`%D@ZPrZ4_ z!g+{!Z=?U&Sfyn^O6_f(0e?SVFk|%b!9H*er6q=o7iH!*Ns^apINq`CiDn&CtmTi`FtCv@PL#T!w>%}A z!~Dm+bh3dDq7(3!b465(z&H8KDj8;qc8_Q7J1h@OY3F>-SPg4-(SUPp+T8e6P48<^ zHqam&gu7b-otDVZYr zDRPaPiA*z!KxxwH+e9sZ?-H48Qu2HX+AA~p5`+1{hW~CH9$Ru$mP2KDu`8W&o-3ll zgzVr#4A+v`fUQE`iSB&3_@c-oDH5G}U(w}kuJ_S|(~JD1zGk)nToG|QbquTUM@_$v zqFRdXEVfNtS*CVdo-$j}IhUn+X5MB1F}c^&ib9O+S{EKTgD>Ybkd;on_!F2tjOOE! z3P(aZ_%^mpNrV(A-b~Dw4mPrTNrh>>_MDp4I?hwZ)(aW+1cjj0${Rf*NtTf;6oT;`@a=Z(Vm=HtM%0gVHPnZdA zj^Ndfaw$XKk0D6`=>}i#nBrsKaHAjX?Zq>x7vhJ9dOS2R)q0i_<|Vl~a}fh?MUdpX zX0#b-fL_3`S9`jzz*CUs<0*6f#}>SEsA2*Bq$X$_mM^>^(%OaZbGw+Jk}p}ZF=#IAQyfDOuDM%!_z8CoSJ0(Iio5e5 zK?qO4(u)A_=)k-HXV$@azT9J)M|#D!-M`_iZwZKe@v`kXpgYu#GUrK&XTx@q;_O10xjT+F=t!X6kKOT%es>yv^~ z&|J#5wfNWh?4~@Hw=*;7uU^fKGoj_r^z%9C97ueuxJ1|1JH}}nan)F`#GYPo0tH!YevDdBF2M&YV2Z@ zhd_glVJhn+q*G`T_eg41MbKS%_w?pm5Sd^Bw#$g9qV{oj^E^*bf^HN7_jrwe-zb1- z8{=}Y?%c`A(X0s~!`s_Gi7Qi54E!_=75W16C6fcR4)C}l5c{|7yao4P;G>hhC&G&G z3M|16xn!VqTl4gIq**>hTk;%S9Wjug6SE8`a-HDz?3NkRa-z=8# zU|Jmf(I*(ys668+Q|jA(C60fzX>>p*2<2C=Dd7@DM>(jx7Wj=WKgC6Og3lg8XoiQM ziS#+lHyP2GeUus9v{_e^Kdtq;ylY6a z<1PwpNA<@Q)+CF96l&YP5p19m&xt0UZO23f$7rKrjX{tG1GwaWe0=3SfrL3H88I2B z$OSIik5V!0_CJ;y;#7alqyh*_@vkrPgo&!iiD zgVjxGzv^NXidLUSwu`V2upReB!5+9w`A6wVf5iB`0N?F5C_XZKw!E+|CCkVhX4OIO z?EP=!PPwA8@W)j04}l+CM6~e}u=y1y1UA2pwJ+8GXU^zon#Y?>5rU0+bjDjd`w31I z2gfYQ9~|f?{jgG~!Mh7f$rcDM_HPz7hg1JoIU_^pcLyaw^@9=3MhQEm|6Xjg4*9*3 z?6TwogNdn0F7)w6ymC-E%#XhtB3{NK~N4cH{fLv3ZY!RqTvU?M>Bujh~WSJx) z_R%fu9+r$xHA3ywP8Xxk_2w;&eFINA|5hbSnOtj*BvixvXiz#c)gKh&lEt9J;JKmT z({a7Af_Axfgsm1h_skY^pBm`BdF-d)ddxdzQ|i^mTHYdW=IdruW+1A|4Pn+-Tp9-3>l>N-wlls zEmKd75fOj2%V+_JgK5~)SO#)q(}T-2X%qFXC*aE`D{l>RX-g+j=fE(wlSdz3g^@q^ zdNl%Xp$uK0Spc%U$mq^|2)fK38RtLd<AZYwFDAdI$fNr zhk15yt7p#)&pT+#MA|fxJr4L7Hv;f_xj!?kx5e2f2YW?W9dfj<^huRsnco&-;pscI zYh3Iu_&{IS|I&ymZs+FcOLeg7&|>ht+2-Vq(}E6J>laSBkK%gzM}(ue7| z@e#xJ$6>xS4%fu(0KzW0MB@vXgIe!)wH~4jO$}=LSY9>*MeIW9Mt-us#9l*UN;3|y zu+FSf3lsCL^Rd&8(_`YURj_3JCwOhIQ>N(c*epmspz-87ftBX85hDgGcoEoud#OaM zS9(SqUuzjJyvY}_ROBUBs6`aZ#G=w%o`};(8VmSgl40tT@Y>1T_=ekrqCQTISEF%0 z3O?=@ToGlXA2yf?#RUa*7?T34~Lon|L%heyHj@r= zKYUB7ewieJh1B-F=EaB08tsI4J|~(7-+wNC+gvcGCuasVD#Bq@kw0Chs7sZh`2}#? zpXKqsthuoDp#dM1r96RUtbq&8{x2@Ow1`}6mDMf}U0(MIcEpi)+NX=}|F)1czg{%d zA#a#DyGYh*Ul>jd)bi1|Ro;~Y@}uu~E0KdGv%%hagXv?|8a<%T9xde-AetFQtpPz^ zCyjba`t><^`j-#vu<(nMwwUq*;qBy{@_S&aSC?^uuCWHno-ogtS_52Ac09YfJCt48IF~P(^xDy(Ddy+Gu()mAn(R>z4{l{LH5vD zkF%rno?oe-o*{dMDk8*{e_rjw$zqP%gxTb;-q2h3GzxDTPb?#KYREfR;DEDJ0z1$B zVvs|$EI^Fu5w9>;J6eoa9h5C+?+CTj8WFsUp7muA&L4I26E$Kss{r`%jC#}qQF7cE zNY*&A7nt*7!tJmXAerQYxhC=BkBc<~VcR^Em(OXc0eP8(!N1Isg!=_u$6Fr7LFt8~ z^^aQH0YBqileT2%=Zp2dw?(2s>GRsIcs#Vekp{J56s2cK-&%E&YKDA>V_&N<7~b>x zaHuS%sP{u#v{oBYk`6PBU7g_K+jD_L_^ba`MmI!yBcBN(Nrg2Pxri z7bO52qIdki}`7B`C73;)n##{)=s9ai(Jlk7RD_i`S zag1_xvpAco#$Ee8G1d^F1YaC##sy7Fe~w#cCpF~>hY(a%h+f_8we^{3GMoCJ_{SVE zK4FSjo-`1Y?ie5n-4|zdgtqf3kC}lGpa2+gfOY|!;zDRt14?p_TAX`a0YM(z#^Mq8 zNfw`b0=-|MrescwhLZqaE0j^2?Z&9UL-H5%1%1m>-Os@}MbVX^jB*dX9uv@P@YJ#{ zvE|nZt-FPW5nKJUMgod)MOC0F&HG(E35mUlqPDDDYS6h8Xx+TP%ezb!5&rehB{~_BUqeP^3>3NFdxZoINw~jG#K9?R z7qCSv1W_;PhVP}+L96R!dJr%fxqGCa-7XO-68893&_6JRblg-J|6r6kgZbEa`TuQo zw|)7X*k3@8Qd&M2ymaiH7+SVOD-e)s)duN1G_&cbC0$Zk03fS^j;U`3p2yT6$hDt6 zje;4M`8UP>awQ=!6{aLOoIY&k^1^581S@^jPe2s|S}$Wu;M)s@S}aS{LCwNtUw#yu zrnJ&8CV^5*6fw>QSC*C|tVr*Jo4UyX7X!9tjj`ZV79pRIDE0OH(R2NWT(7m2bA{QZ z4+ByfQ@rOQ0k#Dkj~g~PnhqMjl)oi>^yNHeRV4R1|C-PCU4ikGd zKD>8E-l->+;1)#Gb6`H1R8}RUq|(Q#jZLL#+gym)RUYe1HEU)3JwE7pRj53Kq&aWN zdIH4Y^mpSbED6kyP0HHIe!)JcBBAYxPFN+eIv$dkD6hF>PI1>VcE00ZhV$XnZkbDx zERpa)@)jHB!RjsjaYqoXpqIB5GLtQaTGgXdy6o3Z0>YTiL-9QCbjv({-UigdXlaAk zR9%1MqHY-luMLqR|4P=}rz)3;Jj+h2opcBYylrItD^w7xTyi%dpz0>)N(}-KgY0)C zp5q!9$cz^vm5~#YQka}`x`S_2g?VdyX~4-^`n;j?6Sp{posn1h z%EStR{{IeA>(+SIe^FMI$!fQ34xil%kvSGI&yWj;=#vqo|xvXLxz&N zhOMOZA43X)_kLG(nwG>Sz@Z{Sf>hp6Z-N&R!U8Sy!bXcaC`%Nnhavf~{C)7N6AMUR zJ$@#Sdlr85XUH`4#s;7{yyDw+t%tbgj3!gh3_ILw_1U47N?=E}QiTjSf^5=a>b)~o z1bK(SX_Zh6^46rAaYXiO(qYCai2pgw==kbr`>|Po+DWB{I5u2ygv0cj_ZEOANda%! zqP`GD8=8Dg^CqTO)(Z)d1nW{)ZoIo|zNiO2SZMX9&r}MJsv!QST~cXw)JeZytVn!o zS)8YIiW#0>57rU8U|xv#s)`fWfr)~Y(4>~RJVY$8^N>wOzT>#UIrDI=?cO?1wDIFd zAa}QO7Kk>$9FZ$j4lYV%3L3Ue2)f*kE?&~S&9yjj_Uqv-2eO&kQWx@(Ppx75?_ZN0 z+4E%TW$m4q6iAiaR_nlJGMQgL^8>l0O4b~qQ;;3BHVWak^7RkGlJW=6gidGkiXt0f zx6rlXYzF=qIAN@-Wg_|Bea6o}&)5;@^4h}w2^H7doq}I3Z-3)~0~=Rg;035Zn#Z5T zmGh?4=a1G8XD^WKaEX%d|LfYQ6X{5a7gL^8i$-2E(^}qFph_6?*%9YT|1m5cb{{zD z&A@Y8M!ZvLjCk4p7_ij+e6YKIr^6yDPu zs})%(^6?!v4jBEbs3(|9Pls;O;FIuPlrf-u8n8Vs_6{|l*L+fV_-)Rs3KYv>LK-03SCTi8 zNU_7-*E0ttOY+q}5V7aHdtbcoz;V~#;Eh+Jex0vD;8;#%;xv&D`7&Y%_ed(I$92%c zxZ68`;*S?0UjOSuyXOF*)$ec5Y%e>~$ch;asX?bt(2E1;B6`X0^FXi+cDb12R4N#Ii49**KhX%0Ia&mc_R+i(B~^#19`C-G zx12XTJDeKD;8n%Ufd&^@32B#7;#wQTQ+A$ji6j%wWqiFx~w(*@&l{%AC}a8?`*zV_(dn)yG`*}Sd33Zf`<4aSR4Bhc-h%9%P$m%JV`?}GQm z5QB=yD*7iffzXDOw8081;~;J;agLQ~1iqa@i83XqJg3 z7L9WqhwcN2R*&1b~9(Jru)rM2+&JeYtWeSp(1)rUQU8I7%7WQA}c`esXF~r zq_Nr9s#Q(#mihDd#YU!}A6CGYL4Bp4QUm6M;`B~E{ywJQxPuK`@hR9|ngvW=ii0~Q zMleQ3qW@iNs9Qul`LkGI>3o|YNN<@d)i$c6FvC{eQ0#``+kG#wQflUZTXZZx09(G0 znJr>E>&E+tWo++Eh~&L;KJY=W0vowuU_O-wMdv@erAA*DDl-#)}Aae>(WpS>hPE|B-JPn_yoV67f z_MgxH&VGT$6+QO_w6`w2vF1b|q%v$No5?i$K)NzW#nt2di1J{hK@KrhBBEcUptUX^ z*{-Dd&kyPGm~h-Sj<40cFS^+$fO1I%W-RncL305h};k#4iN`1u^nXSol%k71x6lS|!i@RFLw4&XU>DGD#?njHV-ov z(=T?f5B*DB7qh6hpbS?y`7eL#q72jQbgK6?wUEhh4r`z+cFJ~8H36mVHuyEV*i)6a zuLwu#M8Ch%RF;qaRO&;?G_(?Ywq6ttH>)^J{^i9xj+ptz95_KeT5JYLK%uKT?KSUL zh!btAHp+UiYKn=?u=6RC&g1Vowc&hd!F>=@c zp()O+hrq;dYm(z`_Pmew?%f(l18Y!Y@9@S1)lWQCY@nlTp1A3g4>>c#;h~SE&EZz^ z+Sg%K(msg&{WXwdDP-MZM;36`3W&3;n2fPc|6&aHL`82ciu-+rrZf&P`5N3px z$6MQxq~b8?_3jvx(%#s|ki|8*m+#ZehEo>wD~`aU8Sr|eVPC!NlZBqMG+Xg>6Wp~< z2$N;+LleN~Qw%zW!XK+Tu;0a9Q%s0Q>Y-}b@~Bynjw0{qF|_Y&K&gW6vbvxPP-R@7 zv`p11|4SH|4MQn|RpVv;9V@o7TVICwIdrgMftF#osx`Q7Av2fq zP$%FOL1*1L?S#{*Wou==G05Ilz|M5{Z1aOXYWgQ!r4Py%*9S3vJ=M}6pnUmf!A@lU z)^EjC)+b>{YXOenJ1GgS=uAmu(?;y_^@(v4< z3VIB+KX}W_=UNHv`T)QFU6g~DGY-N!*fEJ(j|!#A-YT^-qSf%?@#h;<( z*1OaEY59zt;-=NIA|Q$5d{=FX7bPP(SdbFi#yfn#k$*s3BJRqK<)be*N&b=Jt6dMn2lia5D-ZNM?lEcnDiK~6 zIwHHV=f$w3Q-e#Zc)`=l&G+3Sc-->dneeW|WP0V@?k&_)K$Z+4K`Fu_XS~wp<*i!;0iW^u&4Rx+~pKXc3^8zVv#28duh&3iE#7_@pi&fhW8^hQaOt zNHUar`1Ce;UcNj_99WtP^;SEB5{wQs&-Kxs!~5V!R`Xel-S^9pa^6W~xjM)BQ|Xzu ze`zYnZhr|g#TnE!u4_Uys?nu&p|!3Sk<>*- z-8gSrb_59co{kd+)febBR4l@WzZZzD*NSW}8W4Rx-+WZW5< zp#+ZPoI?_#2tT@*8{(ku=Q6FfAWl8yyXq051{eEJ;K5RqppDFiy z(RcR}x??r0rsyJ~_gmlEOGgK-Pd{QY5_HJ*ee!DCdMPM&3Y4DoLjf;&2D0j)#)X&g ztd4q8YqEh014$I~{Tgi~lULc>m9sMAM~~EsEse+{H$1yi74u`vq_tj1x&=B+lU?im zk&V$uNmcmp4Fs?bf|IL1^;Iw#4&4I|Pq;3TE6$4ts&lhD1^w7JJ{;?%@RT??R&k=O`@|!glEH_NwXyKw89lsqGv(<+pd73C{eUPWvSet;a zMZ@C4a}*(N{Va=>n-8EAynn*0V!Vn<<#UcPgpvhP>aULFfj_O?>}9jvUFeYwA83Jl z;fvk4vg{10=u`_aw$3fEvo(dMCK+zcaUDjWst|Try_^UdSL|VV` zth!XA$WPvrAZ@VU9(8%TY!sodFvaT;nyh2z-50`aS)BsE)PG^)2yCq9xfHvT13_v& z6I2{`?}OZ3{A)-P8{>y#kVL7XSVvsj`I-WR9#WocZu9K|1YEF$Zr11wV*lgAdA^Sm z9fNW0v&*yv1^s;LIQ!?$h20?kfeU81P-NC|Rw|Av9SgToP-T$` zONYY{$cJ<>_N;!ew=aqXUM72!w^N2ew{MFraP6evP%86kGQjiMTzBc+?@`-G(8J>e zb=V*@^*<(_djG&)u>S2{{}6P7^Jyv41PD^#KcH6h{0V2Jr>3L>7utM8p!QSPXQjAyAW0PAfYgR4Ue zY#Y)p1?h%Bt2gq=zHx7q&pdsp6GG{UaP@?qK*lom1yaiQ=&*TR)kNnp)8=>|snjIi zN(r^qUIEr`P+9Ot8Z}W8Pz}tG8%d_P$T*|SFUQT?kYOfMyQ5_LXbL`t4$^y&5BzE1 ze$y#2F5L!4e6FOj49c16hgms((?Y&?18wrF7cIupAd0BAqJZyeUW+oIs zJ4G{TtPbl?k35ymsY+3p)UwWwX5Xaf(H#bv$w|VBLAwHw6}ug z@*X}-39t_ylD|UOdi^orLfssVl6@1L60-Y3?=)31VRv$)Qo&)_>p0L*$Q!V~FRJuX z4_EAlw{6D5i9+gRUC2^bOu!6`|appZbvzbi99iT@(boRpPwC_)nW{Je=ySN1`mx z*F1J2rIdWuT4O)C@%S^umt6x9Pd6eYIKq|FNZqQ7vN@Hoyz^|ZF9in|ql*z@jlq>o zDtX-`h$uIQ!Na(KPl1%N>e4&Y1MT$~h?P0Z>#~sYv4?yG2@_YU*a5z!Z#j?E~ zZk451$0j>93&D&bEGbW=7Z{(BVI6Abzk_gPpqtxvCF&E#$jlLvHD!sC7*dj)NUR2; zr)Ox?Vjy(Xg`IlGu9IS+v)ba%%PtYt-fJ#o^E#@6o0J+CmTVN&R3$T|vZ7{#5sI|l z5B%#*`Sq~Av+i)wJlDem$a=}_!k#wRF+AV!&uyMvfBETu*>QZRC%0hMa9us<)M>}_ z#yFg#-l)TR z&gkK3tgo*dHIHgg@bAQ3h7D0q(@}rqhRlsa19t3_dmg~L8UXn1n4DF(AW}(1ei^cN zQx6@m#^hfhrG*&ZnvnylnAu2>N38F(e86X!vvFR9Yy2wpkm)$D-?)7u-|8AiyH`gO z3s1U_N{vAuszj;BRXsl5==Xg^wl&8jiJf&Y4N816I$7p=b!P!!>J~GPZ!Jy|bK~c( zcE3{JsLk=k@*Sc5w*rQJ70SP^(xcP^6-`I)pS9}{8scbV7JO&ktt-4{Gf^u}q?-H~ z0~36N+xc$=vJeIwO~9|u!PH5GtRt3hu>`@6|GlSI8^m--y=76|i0P-G8r6`n*@go? zGN?}sCUAKg*jK6lh4Z~HQuqChV;%QwM`ed4**}|v4_as}Z)=_xh!<(qZ~>O%8Xl(3 zC1fnG8FWDP!YiY0pm^QX56-G-`L?P+SnM4tEo}?5y@$xYE|qi2hxt5Kx5fJKP1gU7 zpa?>b!v(R=g_EL{(T)9|s5kx_^`~@jS7@GX-w$!)UWuNUm)bwNn$}a_EImyg;Wz4y zk*UdKB8zUbiCPlC)xHR!hoUzk=g#dnAH%&sW^JM$`-DefO|bi=oA`f&bc^?#A^NEle4saWZT8h! zU!rzQJ)tRdFK9xi{V4&^yHNL1_`llw?x?1l?oSlOM+8w35fMRAL6BYrA@p9PD=kV# zdT&AmrFW#aNJkJ5q_>DtL`s0rLx>W34>bu%z8jw3yYIW_?AhJ3XaC$M-#;=l-y!fCx)xQfq28R;cy% zxfy$K@4`&rz*fsUAH+d-zwjIcLib31KNpCqVPZRE#t8JHg)aZbBam^0tOvqGO*Hm@gDXXh8 zad!o+cHg|APINg?l6ISr3M|ZHcD`#PE?&7_Sze$9qHYp;oI=`hm0%f4Z@i9SwYPrVXu^{k>lKm+a3?mge|ZEK}^V z5rJnr0x?X?xrwQ^(RA`s_IedHh3OfmB)Yc$9Vv-0x{hUbA@yL(=<1c{)*F*hNtBy3uy*+Lib)JRae2gdZ2dPq z&AK}x?X`TjUmv>kAx0csRZZWGWe))o$9e_ah9^mD)PBUP7%ymWV;v309?-muUiLe9 zCU#$%T*ZrN{9rsqqu4i6xJVmC;SNp&Gib?g$vgYF2>y!)58^Qy0|m8fu!EKvQejKl z%zao@nj2rpkQ2V0VmFOBUG_~>R=)c#;1>SN2mrWl*T%b_0! zbU=tx)bk%D$$CKS>I%4eINq#rzgS6PwoE;xYyOt258n!V*tK0_L}?2fYPGZrapk z^xw}3VA=<)06gz7#Dg5W56-V}s4INJy9}hnB?uxqB5JJi%JsM9-Ezj#b zQCL;S7(5)_(jYZk+ZWh}6k1B3an1b~`Iq9|!m%yZF}T#wT;>nA!ztubOK$=pgA?oA zn1SeoChK3?btp+Do+!$c8H-gFd#3un&vkV|erc$&_VDl4{j26_Z`y5t>C(X=UyNb- z%Zxpkqew?lo>Zz|{ZwPC3mXE%0>+H%tcV&_%t(gQ+5mprxikIj@b6%5BfofR*84$k z@A9@Or@s>N_cjZ<+Jp8S*ur<7&U^7(^0L--!!r zWid8PWLtqs0)Hp|m^r)ummR%YBei0fbSi~rrV!9gWZc&s1PQYr*hh5$gyT{^>Al?6 z(D~8fsa9Wk9gdj`bdLBtW)VFvhu}n~dKXBHUaCsTgb416 zKA>H`>G*d+$|4CI2a5Y3EL=CDckQ$lhSVOUcfx|qVK*h)9{AW?joR1Eg)9)?{V`Bc zxgn+T({XFCLAD;{L*cO-7mICr-iubDEI1N-9XHC<9nvNPO+JKK2n7BZpFFqxl{^&h z`&G>6xT1DO@Fef@j6W(|irI#d)cf|@a|Uid$7ZoGMQR!rXR9Ma%Hl=H@UnMUkZPOr z-kWaKYd2m4oSiltdv3Z4dcafL9$bxBZP_w96JkaFL)T3->ocv6I*pXXI+&~W5j9)5 z`;%I}58izHg1-t1vN=k`Gelm&M{U$lj*Q&c$pkP&E)lC-$`?$+0$5Be(0ANt+-l$S zS%Cz)(d{s9J@=BHOR#w;I`DRfsK#jHp%5;*cKe`74%@UB?`t|)RY2K_n=-I$CNyoi zF-{s|V-he_TT&)pz?*->)I z@-jU{)_u1@n5%Kaub1u5%Z7QSMx&T{iubI@EQ?6Zc^^CoX-<#FgO-7%1Bwy=3qm?Y4HPqbIazLY*gs%eMU z$6(-DQ5X>T&<*NDy=v9mxYVcEKBK8m!_oMUl_v#gVYSrLCi1ij#({sCXeu4ayAt{B+q7OfnVK@$= zzgm%S6Oght92pieZfdSy&9ovX7q3d4N_>G(q$3n(MUFq!a8l+^(;$V0)}9i_zUwPs z^_XfuEU_&b6rr&{M!6l!J|R~7OOK`ifLCcFRfS)t-BEiYy+nblmSnmEDor~|iVJ8T z?&+4Gx`y^cf?wMeU`~~5V`K6T9}?*`IzKCBkp7b_;7#TX;lELlp>NyL zUfg?2w*}5A`$!_TCuOSTZdLj>Tr394V0;@Whlmv0noFcz#efp8^~bBH%e4(h7a0vg z#Ccl$KeGSj4R+c zJQu^*)BYu+LBMu$?`y}Riuny@;Y;HCJj)QB?w8S&j)o8?<`wcFt_!SNqAO6}u~~g+ z&=gTXw|)h${_s(Fdt2t{uWI}Jr04B6**sxq5%(ON zneUtq*00nD;awEWvJES>3f*JJe%hotFZKD)?VS8 zpQ=1|{pIoNOV_um55wP~fRBOyR}7AUVLqyd&7h2qm2NKkK$4tIt7A5f{^GClxVkh~ z*jdosX{?AW%9Pt!4ts@-dv31%#CH1S@5y3Sk|U3#iyq|10!wXkw&&ku)e{K_L-*N2 zazu}am510;>Z^C5W*_bxmVNqN&sRi1*851yxXYx0A}D``gk%<))bIZw+4V=ZuG*T5pPNd|Hw%0X;58l@y93YncYQWtH6IuEM&szlQw>eb6F#ky5;Ee zuJAPol8-24IOhN#42TCeXCeB*C>~H zL=gshlAOAkG}IZQuX;Tg3^flj_Kzlfc&bENvid2uKwDBA*&Wq#ZCS2bhPPdbq<-gy zI>}|OJ#T(dPPZQV)S|JH){j^bkdf>Jd)5cNXaS)k`{)JQQAQr(IY=KAmS>?0kAS_57*_kaOAqAJNx_{t&sAxvu+$XhRq z&0q2&F`l6N29&`tOlfi>P9^K#%A`ENSI@%fLT3^FHPZ?fA z$m{J=rT3+{GHS`|eQcpK+p#O)l(#4sOH;VGJ2N*~oJ=_r|s$&-4*h z!^hxsPprs@SL3?+gAgHLbd@qb3_}cQPywRDfCqUfe6%W|nH;r|NN(>kx#K}%ngain z^CM7<@Md!H_vcDe(45t1-%e)FSpufm^SEw$bZh zPZvv^6-V>Dq3F%K^2U!YH{WIT(~Hk|8KNp3u*kMG;07SSHuYb&EpZT3cx`p2`;5f> z_Ei;cjMx=(H=bK@NgS2eFU%#yx0Uxg{ZCY;zN?m8?j?E33sorcFZ`kCg~*X=Z68`{e6u3ocATX@S_=fOPTPk(MI zCx(Xe{!gBsGZHo!{tE1^zp5pe=vCB`jAE!=fA(4!{=?8e68eADA*}0cJ15%G8O(-3 z-k>Pg)=fEz-hOZ6IA%YzE}y=ohN`%G<(H(#sw1C~$vLVgbd@&>;us_IC-r@l&pV@Z zY7z?2pPNnk9Bj@gOr*z~xT&%R4OF$>qf$e(hAVvP-a+|6X5C=H2-!*#``3pbZJj=y zz7*Y3`!^Y?q`YRqi?+Fv2leR{yl3AkeMz|fpBiVPFMW8{8?C7OUj@%?{8R8B;ry2Z zas>Mfwyq_Eu$8R$Tt@0p>kaBgrbR^<> zyV3q7{usc+gN>zve>`$7fTZ;a=5*6Kh$?b8wUtXyPteher?)E+e}X2y3ui(0YE_0# zEjm>`CDO(xDlWF%M|*;!j31g}YN{u4LSLu-CcN@GHH;N~u3>Z|72-fy{KU;O^kZ6& zXeubwr09;Y|7A~K5&~AAMd4NLXh1=7@2=~#8N1O`u-tNf91u;h{MakPGa=sG-9%0i zYCGDRfJ)rDX$MPrI?lR0_cubvG{^RiSIf-25TLa+=x4ccc_nz`GlA~;-C#xXFb{fs zsTezCrV?;hs<(=0j&x&?8jz(nRzrr(YFz=rq$0$tgA0T2pFRIL{MoUNgjEV|w)u=W zxdu$Mqt*2A8@5r0@g;9@w=CP_?Qep$K>G*K5h6&XG1k)W#WL1+>FAB2r-7_2ujDIR zztS-fzHgQFUvk z_2M#gwn>%qsue)Nr0C-eRmY+EK>Dx4NcKY`)+gWp#$0fT_?kg#pU#)pr(hnWw($`1 z5tDg?B+#!bCB_+-#PqY5bqeA^YUyzpZiX7Vq)PThfHNPkkFgc^sOTd`MV;m21DMuJzF^|Lt2yQnwj zTS<-WTUog32LRHb9IQdG>a?pQY4ZWS~yprt$aq!0F5Vt6V1noa;aT_u3DPm@V%`b?0}M^=((5o&1V2CWr== zg~u8ZhZ`d?ZZjUzDChZ4?21d;nQ$Ec3Jj=- z=i;qFDfy7?uNMad=seN&>r0S6KD63SAP~7fTrK@dI}m>!(318+)<^E|Sf%l~H(Epi zKRFYNLBtwJiWxL$cxLSz^<}lD5KQC2j1wTmri5#;VLf4ri51f%o^%4F1L+# zO9`&`5dxCVXrft9S$?~0$8P(I8r#*T4B*{Z(FNt@X5(qbZ&De2KP18#5st8PXv%xv3|DXE};+36S=jh znFU-M_I-Q&K=weK1Jhw*%x$}&2~!VgvvKe^^a+%nx4c2^@QWBH1*wU}n$$$S>1b{# zZO-L8MW(FC*mriu+A0hN!i7eIFpB+8M6!!+n;UQs-#A60H$(RsAarRfOY|FM`y>-- z#Vz{7sX2!Xi(eScg0pT9>8<%io>tN6MZL)5@JKwU(F&zyvdNz~QX*D)7v(j*LYW2@ z%DBbEuQs~tZ38Av=;sg#=GDTf6%0_}Wsr=tIZ z!uhOoTib209R46=n`iXmrKW|K1xjb%AW50l30gG)OXqupa^!Zp^~yOU>Sy!I0nZWk z3|teMJoM&q@z>O9(s$!Q z=vOIvJ(r7oQh7wUgRAQEt>g=a+G+*5#EnT)}<~u1JU)8@b%b4VE zzw$PgRIwRXQPE9Qk|ynblbDruU7`;Xt-hSv`8tus$jI#ZhaQb*9P{a31655WejPiC zS%;}b30lmg$_(4Ny04bEK!j=QwI==mP4csK@`cTekd-C@aTn2-)U$V3{fZi$S<(6f z4{bm6q;ocJ)e6hvC_qzZU4WSs?i)42)~%Uan!japYwhIVIw8VfvMeJX2peU;?4lLx zv=g@7dXj&T&Wp}-yS>x2BfEyfOsT2YE5+24yBWtsAnRJKOO`={v=|-&rsNop0ugGc0J0^HzCD~7;6c6kzJ5@{__hjtw1J}L&grZ;bl%Fv?t#v>#Nsm z-akgZDn>?yVlO_QJHL>ZSG1^{3@lkfYJmn*k&22N75{lr4$)8^2Un$21Qu?keS=p% zlp;dzC+ms&R}W1p9~4!*F8G(cW}avy5Q+?yNE5I7%PUN||HDranVX5SQ^!=8LOSMu zAPxFok*>|$NCdO}=u2^{&rq!z5UT7ODJt3%Qwzm+k*%CcNY|fC#;S!V8U`!$qs1urPSf# zht*O-z*<)%yGBj$4kX#}Xmq&XK`RHiq={+Nt9-eue}(SsT|;@&szv~5ds;y8LX z#E@3U$FSZnBr48pi^Lw-YRUj3pl_c|HeE1c?tFjNS|iUT_Bfw(oRtp{Ro@I#?Ok5` zdN12TmBd%J50lv|kDCT4colOWY)FoR15uo00vS*UauhzLsRx`s%PZ%@X|rF6*xBED zlQcH&)Yx{D0vBzP_Tjx09q%X#-W3`zF#|+IL>zl!m<|N_jdq9gL_~Wx=mqjF@O&wn ze+7ENaW{M+w>Xu#=#K|5o6I>G;1GK1{i0a2-k)=1W5h=nOI*L)gDqWx0Sr$M+ygPT zJ8Fqfj~quA)?f2Noi(FT;WdOJK1#sEPHVm{gwUj|NmRkKtDjB*q1Mnd`(_LYh zVRNB&0s?db!aJ@VZY1b#=w#|Np?pnIx zSZ;>zA+Q>KG_XcFY~f1FDES)g5Tn%#b1!`jk{e+!-CIP)14M(7=6e>Bi}B1Bq^ zFbIFW01Wv^+z+_`WHJ$tZ}gRt;JgO~&E;Ces4jv|V$y4RW8t)=3uYjH424Hz&XsrtFyyAMJrnB(6bJ-2My8yLJFB7F=0zVnq#htxw| zE7!9ddE|{mo|!iPVc<<-f`seq9>dNW0tj>@)HynAY)MR*7^+tDx7*4oFA`H^cAT1h zPxaiYQjfQ8GcK6Xr^#;h-j-?3l`GPq(P34BQtK#x*%m%Nk*`9JH%#||@8_G<1V8pd zhJyKY_$QFhGRs;3Jedn2|260`EBa$dUmHlS4JN`Cg8P7QqTCQaXBKao+?>DS{ikEJnVi(5McxmHY$U*X;ANA7A3b&HX=9lIsc&_ses4!@s(EZPCK z;IcEkg*W0p?5&NM=o}Rpa2rv5QA1fZt%}JQti2^2X=hjj>X|mYeh~1!MWQJ{KUJ5kQ`!ne0Gy46g?JK48N`>(eT8gDh+8yKFJ(DQSO;2*1QxOnDE zw{elN%?!)Q!*$ocyHNZt)xY}C8m)w?Vrf-tn|yfg+qKiKwzc2PDgTGLe%^hrG~TtVemdf$8i~QxWmfB%b1&dYF6WVId!P`}eCDSQ!QusfZ6|KWVT0?& zn5AbMV;_-^%yx>+wMrUP*$a^E*N*@LXq$L2c~-#F6Cr~eY~{l9(e1dL_kVlYVH1^-?7Z`eR2;CXf62Mq0f8`Sus#Qgb5`F zEsz~R{Z0Y6WU*JO9$dy{!2w&s!AfV6@z``$zU)Ja5$5GX>;Tq5YG}fdpFbl)fb<<+ zTn5F9N|5Id+JJ{8efqQZu!*%1cETU;RR)ldjM_;%W)itiwGyE^Vz9^Dc@TbGJpl*; z9kB1mA2HQeQI-L22|noKZ8$byu*S53ViK}PcdWFbOZcFLTrjA-E)ts6lm%AyM$w<{ znw4ZYN8m%%>ITrFe&=g6=?}7y-`(`g)!6BT%zNecJpQWo#&yt|OiS?JV4cq}MV)=pvWJ#>%4?+8Av4AX*-#7I^TdZ}ld8M1UzlM1}RVIRhN=0mJ0Aeky@WkwvHHLykC?S;evHvu6sUV$DY zvd8o=gcgN_oci*YVW)1xSV{m`@+Ko&F}_lVL&YBwLB4uu;I|1o<@g}ZwLhwNbQqrQ zQlWx^1W`dd9o~?wVedXRzv7K*K)-bv164bo+wZ6kM3WF97jCB-*UW=RY!}@Y3i)r1 R=2KBV>dHDw)e0}e{u?Zlr9uDz literal 0 HcmV?d00001 diff --git a/static/img/preflight1.png b/static/img/preflight1.png new file mode 100644 index 0000000000000000000000000000000000000000..2433f93580d134c61cbc44330ed216760c2662e6 GIT binary patch literal 51427 zcmd?RRahNO8a0Xrx1hn@-66QUySux)LvVL@cMA}7_Syv_U(@hF{vtTDsP*?vuK@8@kIn z#^)E0HVx?T10o^{#}^mx@BNN-P0H|*ST9p7z;&*N{mb?55B{4sxh%}s+^$x$QP9Ys z!~ziEASi@jA_34oR$z^J9bhVa|2h2cxos3eL#buZzrkK}!GMrs^H~HHn7_&+gMKY_ zLHKX6|5S+qA(8Hfu_2K1@5BF{`>gQ)H2NRt|DP3Zk7Jawx4KEEez4o@W5Lj3zBLMM z<;My@%zK$_eKbo5Rn}c5i%)OzdOet)Cnlt{Zi&Zz47FI^$O{!2AJx8nLByc<8oSku zok9rduRb(%j4>NM}D6KAOIhNQxI=4@bT!#JYkXH&bZD4E+8*^fa&Oa)u7r?)-RCjNe zsH4iQ-33wn3|qcQT*brzMR8OJ5R$gWAu~O&nz*l;IGLt3hR$8|a|I5-TxV#si4 zcpFGCq5M8>+f<#Mt?LVAUzcTv_iJVKcaO*WnX^SyXQz*(D>uBCOY1CFO!c=UV3w z`B*u*aQHVS`zaesB~@+QZ{N5yf6vX$S&hdtSK5J<$>$9G>TpJ%sB5S?ogbD*rZ#mv zIXQ_h_P1Z9OrP~XZc481_98{V?x59aM2oZRF_%AG`!19FT$7#sI@_Ou^rPF0IZqzE z$H36a(z2ww`V}xeJ+`{EIU9jmN?lpW>vh*q-#9fo)$M!3J-j+IGE!tt5X>DG0dw{4 zCm;F(^5k+h$Hq>++8!uvsJNqBw{~n#5t-A4?Mz4i1Kg+=uhBI06_nin{!n z#iAcMUEsNmfed=%p7z4Q?YNN}wqS^?a56M~7=nQsP&6 z{O{Qr3A2kuWt~BKQ?VsoMzT^6|hrI>EiFfjp!h~$QD($9ylz|F9VW)cuG^0`er@&Yr_t}9d~v4Y4~*aD zAkJ{U`tEvVvDyh)db5ME=WhJj|otjQshz&yS?rdYYM6u}3T3uXJ3|60d?udk_R5>{8 zoZCf3Sse}mvD;ICo1b|p@F0ga@F0z-Re(aK|w}ts@uz9OMV*Y z2=dQ}o~ghuDaIxjsRJhX5JTU$Jx7~tmU*w}5m`|u@|{LD64Bf%4m+Vn)H z^UsSv?#WKWr)CDdaM|eYi&qo_Y)|LzEZWUBq2AQngHcR-L-sG;Hxb6ehi{L{%XauZ zH5!|pqS8JYua^T6bZhPcThp0Lc%w|{eD0e_WpcRzenw0jwi;W7sx(mI6grkT%XR)2 z5AZBaU0yfQ5BzjG)m2q%4a%6-I9U}*sMp6u&Ocu>8$K3Jm5`byociipn}YdGY-CHH1_y^zJR=_|jh^7DeXJMROW z*q`5<+)n$w^!Li@u3+qkXM6jm-cR?-bwv%05du&)Tt=i&x>&fx zhqFm#rLxbZh9sDdqmZ!N{`WHDYBl09--4@Hxu}j;68h748JIYC-<_*XOb-mMM5EN` z^}|Mje;{VDnx3??lznLR$Yt^{=yuhXmye_*W@K>X%QNWQD0kXQ~mpza46)tydn8!~>#>LG|4S1@)#NN7I!));fn$8xlykGig+U;yT#*U*r3JRv{jzhsW*4=j8B_ku;2(jlF#wPO89@sK*p-Vp zwIg|UIQ2_48@uiE?K^q8bf>%4N=iW%`;9-sS*|ZiV5XkbMwJ}z;jeuzfuFq0)%Oa=~>B4C`}3lxOpPu zcM`x~V)3{YmRH)`dq9Q0^}r#kBX~nml>f}}x9|2lU~Y!~f)19^`@zP><~knMviZ}# z)%`N00gBk=d=qs#5!~B-v+V@NkSJaxAOPZ!cIU1tcV=KZmuK~tGY*{N97 za7Mf9Nu+?KSEpcqmq>Ihr^+%x#o}| z07{4&^3i#w&Lbg`8hV6a#pc3!8I;F%7hG~lW#v+%tG3RGIMPL( zvBipeuQr7-9-eO6kgOa&Z?w32(U5HBPb=qxxllZR`+CBriC(CY*~ zqSz0CJm0-<{F2Y(8DgsDd$d>I!vAobSAG52@1MOmx3qctz<%rP;NalmqLSry4n(=x z)}i93)!5(PhscwpFYfMooA~WasFy~oMVK#jhXB81zkarV_PT#Xl8w!10W7APZwmoH z84tw<&sz!l_0`~T(9+WSznvqw{b)>&N_~%(aR}zHI*UAoCe-Wj%HC`sKJ_m%tn#1XaTeN9A_QqVb=><6GUyn1t`ajNa z@bTe?n@wZ}KL&)+U~Kg&^p_t26N<#5u@Mk_cUKg%MUQ_V;%-Y}4pHhfRBTNNAY$S3 zct0;JEx8>K_!}A2o6eK_#E>u-^YqZ7%1sHi1%cQ;jcw&S*6DVEP4c?GBgHT8D#3(o zb?wDCDkhaquAsRU4aJ~<_QO-%bh=yto}A6EVk2V30NL5Nufw-;9B~)N$CeKlo3r!t z{atahZ~)QP%&NGsu%SkM_1$;f4vPYT8%TOrN7pJPjs~YaBjcH}Za%(8tZyi>ADNk2 zIw^m)oe6;@u*xH{={Wk3S3_HU_If*lBOxTsaNPrj8v}zstS?RuqN15?GI(Bg+gY%5 z0M*ycyW_f#ko`orI_$Kz?w8vYho{a+V#+?>`YKSCYYP*w64Tzk>s~fDtE|{uY+c!HwBq?|o}6GK7ahsv36b0DL2k6UY3k{L zqGbNGx!c~v3+I8hn2tKSxxU6`^?4D+1@3ZHC&FAgjxdstfJ2%Vm+^bQDkw`QjejF^ zY7u3n?+!~{`GvS;&7`PkfR2Lyg$xQOg)wO+-e4s|NjdRyy&I-UJjrYlw6(b!ja@|~ z%q=8rNSm=Bdg6)YBlzi?#*C7;xH*ho&2D92D&R1t;m6ke@C=5>7;JK4MuOkz5SvKA zVL%`*cw!`<6&N@jZe@O_=Nsh}Szvpci+iVCAl5T<5#}E{k*ell6bgEF#19G|7ENhs z@0-#XaYVcU@$_F9AFt9D4kOW)%1n*Vp1++S0F3Om*QD|N9Bhcdpih-vn^*S5h!-bWFRsDb7CAE{8MTl*O1q=zusLZn3 z%|<98b=>bEW`~DB``{Rau!)MK?g;23-ls?XN3U-zPLFltei+c0@8QEo0}Y?gH8!YW zh_{G*9lKMohmZ{A;mV2z`PA7t9xy=s!^mi$Rw!}x_u`N1-UpozP;gI@NNaWfY!3H} z>Wn{p(Kg=qCzC0m)*b>|oAot~$XLhzdhaxm+K+oaKK;-t75X2b0Jap>Aw!QdbJM@Q2+cX%qxQ?}YnGuV7aq?n!?C;WzWx{dK1fx)pu2Ujx> zps@-2fz!UY0>pbgN1<@1%eA2N7LND4mUf1LwdP(DZ5BH=hBYFrAbp_bTL)gCB=MhX z#Txyl=QOgYYH^rfXGo#XiJwN{&V$M*+Hyk&Hi>(BL)0|tPXGXCM#kO4GWhtoYk zR2?h1aB52~BZQoQ-wiDiSDC5p_sz{U%6Y=2up`~>bPSEfNc|49e!I_8Sc^5rDkLrWF^1B9ddbPZwY;^-5GI0W0nR=01}I*(V!3{dxzPQ zdqOoOFbTQbXW?D4Qq{5mBXxBc*{Q{PfRH9?G#oFA|TrjTzw~%^B*rN{v z9SSWbwa-d}hgFl%&OV%ohd!NF zT4I|Dsq@zAv>%tve@E#aMSlhova=5V0+L2T(vgYckTChm3}#C1WR|L~>p3dgRONnG5x(F@2 z9tQd@Dhm;N;+PC?kT+hOVP^p>Ftxb24vPw^s(9c1h+jOe0PQ2;(73|)czg~Z*93Mr zj4eh+XkV}rOa;kziCiAH-_t-rr7>s)WU#a}>>joF{cfSjnF?5taeba?PM<1x)M)1@mlqUq`O!O!DbHm*j2l!k-2#rUA;%H4S{eI*FHZ<>sI@DFE z(+>{~0Dpvk_fui=3riJ3W!yZ><2RL@F{K>b>rL%4C-1myd-cD;@8l=bp z*BDiKed-U|h+TFl9K zv`&Nz5C+Dl0uUmT&yX^T5fb9E(~AAS+7y12G~UDbo(=t5FPa zqM@b^nd{i~6x2DyqT1CKSl6V-&0yh&C`eEAK@BCAh7BNN=Anh4Z%S2Tw_SAwcDn|* zTfWmE=v$V5)%FVd?GvZx+iADS$il+!|C}7o{P>$FqrBCC2u_-^7Q2Kjg|>k1MI74+ z9YkAhoEWIzMPHa2BuIQpg)FH-tiHOZBWpmoqe2B{*xdWk^YdnXHvItR`75?Wy%u`j z)oX84QVzg56Gj;xp3x9CVyITw48pVqgA%TvsMyqu(TA)im`5P~@53B!6EG0q5>BI+Y#z41;}EI*M=Ad2Id)W=gQvh%QTlTrHY%-~>)r1HoN&T_3_I^Ydu3r8OR#_Y*a zb0_XaF2op#uaVx&6}ei*(^EtQLMHJI3NdIoC$TZnZ_qS2tud1MSI6dJWDfF8PjSc* zD^e3ZZLAKOTTDZoO*7#RV(2$~a4Zh@2aNO*yEVki8g2GG9zS>hT5h9JBqXa|``1QO znD#K^6e1oOgPkFWyS}%Vv>J_3Vu5-&Tz-ro^iX4J5c}#jt536&iJ45RST18c5v2Kt~ zKN(jlvLF9Mj#*iwy*y%uZZ5`2ad0*4Xo^ zXP`DlV>dLza65Es%?B~l)DTHm{5z^(2vFFh!<4`p|g%&+=yxjgq> z{z#XHHCp{isv7B;3oLt$p;TX#S02N;d`(T!AEtB-$3Zc6oD7ozs|;rKBA30WD9VND z@q{7l@f1>7)aAalM4uwq7ekJV!KKaaKkH&u>~kirn@_VP}){juyzpd zkM%m6?Y?l<1;`o|&RBLn=4oOc$;_US=z*FU8Sa-r{Qg9JODd}MpHN1-8jo_A8NwA7S=rNu6E5!SFKbHO9^mznm|>K_&a;zQyrs60atW+`hY7$H zKMyUM8gQv*ZT;?kXn4ui!!F#=uz*{IX~ z@b<&)d?oe;vPj%d-JXd&SZh$Uvw=12^f8VT*l6(0=owDk;O+UInwt6#N!xUxs0P9p z5{@WBnqi##aB2E=rD$nGBbjJ<0sY6{bttr&#=il&5S3`?kDgb=KH#_S!@qTPs`PtyWg!ef$#8}4@i{}H zVC~cUA-lIW6D!&l1{Y;B?YJNW$1I7j#FrM4ij0~EtD>S8ni3CS;m{tHot=7<1Sy|!ga0)F& z+sL~3$YI=&$9NP42M*kMfn(6{aExF~ze0%*Gi(ilk|o!^cdUIlZS-sS~f$ z>;3NXIFg4!hw}4Y!UQqiF&xPgHURIts~B!N!N4MF6pq4DxT0|;t8Jv{mc|6=1|jnr zHDn=-hk%hG1Fl#WhdpT0C{!ka!*2u5Ky7#qXq~Djgo$b+1uiVwKG>jd{hM!| zyC>1Iqz*amr<lKZu#3M93-VZ0O;XCRl zpvPk}kg`X*ebD?cs_`du+Uq$fONtlHI`%RDBW`>K4=NQ?ZL5zxpIoqR=i$n*l z4%_0R4z;jJ}a)?P*=hWYpsj`}0wEA1+n~c>c@vhWtW7V;6FlkYoLEhD;+P zR#kz}`7-t=usp0p$dvFdKcij_k;Yi<^$JSu)Hs{4Q3oTuvhYyg2OX6HvKwhYfOeB# ze{@FE^X&oMSuiMmltI0RgigU%W=wZ#u8aprL`*RcgZ=}Q;kF7O0r;0{Rjn>J-qax3 zH#hD9nq*vna-!!Fg!(c$-uIge&OmhsMtRSlc5C-_ll}yJeqdWbS}-00dT%d4d|(xr zG`wRE;cG!1!#fK(D!E)xPe$8*(BML)>n_%`r`c%Zfd1Zgus`2VAR0w92Q)4@V@aqpPWKAXS2|Ct?BaDeD0Cx<9#Rs zKD*OxTLjl{O^R6DuNRCKB-PttJLbE|$H0(&W^&pEaBN@`j3iy17tY5*u_oe@97J0?G1FQbThXt6W0UPi{8>v#^PcB`FF{XaSz99_Gn za(KOm*WkirjE$2H_!$P(>ES=p+lCP!S*VBn(xZCoWDKuf2zsu}o|ps!wFKMxM<{fl zJk$(|D68LwJCXS(R?p9a=yBcnH<5GG6 zflyH^^;&_pk?Vbv2)`q(+0?6Oa?==v`Uhd$^#Uue^-p$B?(sKFE_=0Ae&E~xnG5g2 z%gIJjTI&UwCa0Cf5RV2}M+ZcQAx_I@=!xW4LKyrRoYH)8v&EEyt_X=~R{J1#6NB+C zGAdVyF++OiX0@9`i!-m57AAz(mCgFO-hP*pmgQhe6#}h70y+XWqRFYuj1pGU;^7@a zr$5BbT0Rs+N%JocNw2!(cGNA?8@2Z?oE2KD34pz1h2!MD=iwl=8-|fdilDuciAmSm z%+B-tn(VR3$m;MoNnCX@a2GZ3fgEHFpFETaFFJ*r(eju3*~k;H%RM(a{$KVM;1&^K zS#ja}mL*+Fvlevkq`^S?)lNa5#vsGoNyOdWDtE_f4@mjb zr;Fyl9+yWQXrF|rJU&bh6{NpSGJz)~0)Xac4JEn1E+zyc5cqV|K=l?C{{vkV4+ycm zYbehCuSe(Kwetmlz|12Bh)YKNZKA1+`$SKSCAm;Q|7y<%0*#;1gXO zPIMv$`>VZ25HM01eh_>zvcJ)CzE89&j_g3>e@>x)@e2AcXAcOEl+@p-g6}7)Mj$;F z@jo6ujX&Gq(D96KARfudf1~-&pJ)wVYBDOy=QaN&t``cK(C`@)NJ;fKDscB{Lelc3 zrK0$&Ysi5}gaUwD@NGq>?b_ ztdJt)lD53%Nyx-&E4fasQ)6vYQqrmXIYh{4HLE*oty0&gsXuB4*Y5Dq_!a-&0hxX5jVU#iRw}rVIz97+`l`RF2 z|Kssrkuir7;Ngv5R7|R0^~?F zC<@|)SQyLCA!r!6D7UDZe*2`-qEPKd+@o}Sr6ltgc|Ktfghvpm^>DEBaSdO3l#ug^ zXQZq}QT`F>R*3=mj5VW;6|{eq{EWWde|gd{!T%1CPYc<$uN%lBo27-tJRb!cG11B| zO8&hj3nP!v*lcfD5Mj&yko%EnijPvnf$1Aws$* zc%ja7GSSi@Ps;Vus7^5$M5y5Y-6sJA}wwV@+Ff36^#FPxj}e79q9(Ft%iPgE!Q*r z-0YX@r7-MrGMXUek~DCM^d&4;>hQm)VH5ehGqe-{_AAcX^KxPW)z~zts+Mq<$lza{ z-R2j_A6pZ3lv!|{L{n|HHY1piv!ZcTQ~#zUJ}s#$s;oDqDcqu&R|r^nZG3GkTzSnF z|0dc1`4KoCkSXy$#{R{__FHI0b`Ud<>?M9WVIxYc9ZQXN^bm7J2!~#G*`eQvUKxR8 ziq+`2EIU)WNp)QbA++GA24sv-wc_!Z>0!o_n4a?|QlIN-zoc5fc^--Z zDpm508mX^WbrGU_ek!>xB{xo?#r%(=N2ITe*8H`1513Clddn^HKk|H$3)O}z$4{04 zGTd*6b%rJsxb(8&k+l)SUYl-`>w)_!QrOQM977VZBsyV$ zxbKAb2k6iWHg>R07FN*&X-l)dW=;db({~rpeL{Yl&%SH-iqq3lc~9ao?SL_p#0tTb z$oOT|YL;%jp_Jm=aYaFzWoEXqax!%E6-s<;$Xvy; z!Ws$UP$6EWCTh}-Jz814*v^7E{8^Y$^%~+VnWi1{3#{M$VobgZH*`r?nKHeLeQzod^SV_3 zmM(YTf~FKZAeHxuNn;$&GQdDnr>dl9S63S3F7JCDE3apo7H=PLOW0GK&T{hYe(r-C z@;4(%mm4>>sOf=xlg0NPhU3iQj?W1WI0}=DW-`pn_cmH}^`yQX972@|b)@);jJEkI zd(Qdfe}{d~?lXg5iAJuP9f{Qawnzs^Jul2L1AfYkeV;XK=1YTcXhp&Bam_)Ho@WQh$BkHkUw2uFVitOeqt<>up zn5yNTW4Y=T(rA{GT^!$w8l@EMi4XQwPXo?m>%+WAj8{79y2v*cLSJu~7>Dh`cKHU1 zj1C<708`w*Tvd<0uJD-Cp*>LfC}<*NKZSED5rU0`nsqNZvml{Vy?RafQretnTqu8;jEmyU(M0KWktnO$?LV6sm#y^C%3o8 zN4PTMubC-6MCJTy)>_bFQm)kOD}(Rk0gLm;YGstQjF+ORK&n7w992^cCqh25DgfU} zO75Gu2+uxMb=g^RXY@q0m#cw6lak_)NRPVLlKsvVS4rmxzxFqOYpo+GD>EfUM+V=V z*SW@dNy{Gbfx3G3{!}Q3bct$(1HD_(@ zy8{XD0>W>jTwhreA3e)&n98DRZpOY%Q(jt-rl#MG5_epCa2p9nnbp}!A*5{t3_a}Q%Ey`H7W3IojaN9DY^IqYxCq=KRHYMl zK@~%5!8X4(5+2<7W?7UxA07I^#%5V0$^Ey1%$$~X|G8tlz*G#|q8}@VRe3>VEz&5> z3VxOkb%OfZmW>Pr_Gytk1!UM>QFoz_LDd&dizi0pS%-kbe6?6B>QK`Iz6`GMej~@e z`U$dZY@_n;-L-zcY$^MNyGfFk)+DGPs1>9xfo;md2zN8%658^bmaQ2?nL3s^kgIY8 z|9RkfL2cod@v~4Lvof+KUeu2C?p9;jEtzgdW3Qf$9Tf_JF9TE(U1lt?;$D}2jm}_B z4&R!7Khz0oGF|eN-kyKgaLu^*YON};bZW~G8rI8}yWx@Ss9W|V?EAP!A z_)>BznpPVk)xgZPBhz`i5 zuVwY3Xq#L}EXg&CE-%=PqR+1=x6jy8Bruz- z*|Y_{$aJOoBT}lPa+CR8v869bgr)e%F_tsC*G_E@vMe<$0}Ar;g7^gJCMJZwgqraz z1Ah>fpMlmPr_^VSb{(1VBH(YqzV93K`>g|WSlsF8=Cy^lx?S83et5%2;2m>AD&l(G z&1&tr(LDQR8h)TUa%B7Z;)*+JsNUP5*I^=J?Pb`N?*8}Bp7*~h^pICh3=mblD0sc6 ztT*jf-i=JbP{P>54l(n=NTP2E4ZR5r! z*c`^9MQus<@@(T^zkrWTX^CG)0Rq^pl}ckw>zC^fcFJ85qt(7gGz2cL?`#Ldn(YcZ zVBdrW@~kWnG7!;owe`Lvbf_vL&>$x$5SI3e!=oc|YmSaBNKw*;k#*+OEhzU?}$~mU} z*Scw&UxJWj>|>{tNT(k`*Gt3gJvA>_vPqCgeaT#eM|gXD4-Ov3YrD6%uS-qSa;1gt z;J|d0!JeG&fz^&ZKtH`yoaat!6VVAdYyxm*BC47r^*gf}_ufEPpS17gxK`5C)E@I^ z$ksX{4)saKw>up{S#d$t@tKmB^E_>IGqN2#C)422HBxBhoqeb4NQIIZin9e)$Bu@2 zrpid}kue&o%Ht8L3ZX>3TvI)@X9gVQk`%O9g%;H(4V^f$dku?^=c(4$>VZS>Wh2mT zhf?Ui_fm~>2#N(O#gb}h3+1+qM%QOzxD@1Y+X5NYWC&t`l>0k4426Obv%etj_n z5Y3)w&{2e}2+^53Q}Kcux!tYZFSu?B5JF&HJifNh5AFJ)*TE5J9|ipRQUxK|mpu-? z$RNBBlMtRn3SAviuoEo?G6Iy5r&rNGd5{t7;=Oca{_K@@gWf;92Gdl#*tW2d9`P@) zBdZF{B0lJE`|`4(ipp0yR2}H?Yc7O#`sHYYK*CFY+J>Jyb8ru##9O@47J4Z_@?FsO zw|&R+KFx6^QOJ~x;nL|?85%!GLs@?Sz%?j0?zyoIpkL@G3P%tQHT0$q#p3H}IjZ@U zQ<8!WU0qFlN)n!E0*pWi$p>V1TG%@Bscp_ML#LaJe`D#eujwP-OixBh>Qh&f4%N%wZn9xbP-_OecDaFYD z*+5V-&Rhw6gJqT^zr?fo&>ysIwR zg*pagFGRG@MoB6j|dOvPeZF$*9T5+U{}HV%^Z9 zi1lnv$OitQnwSKNxTP=FG}IDPJ?-RmFvDM!G|BlP#5v?-_R3aeq+^cD1`C*UJVgA6 ze8Byh*h3Zi*&*Xcz-}I^`GBSn#2UwTmDGaoxiT{SXZ$k_V!YF%(lqpjw&K?bVl4@< z+5`em)T3iTs(PW~5PHVoLVMJ&5Ppmt0RM!90%lE<_s^Ule^PQR@-19xjbnaUemtRi zbnO6BCv&>mI~|W*P(ycjVNgq@(>A~J8=##C0%6!6)l{^u^j=+w*}mA+&@SiZ6gdMT zFh0GWV-KV&_@kGTnh<^t_udJn%)l}XdPo8U%7I5f$U_#3imG`@P28BwB``#J*GgjN zKRa|nvcT6{4L0!ch3%K{y8J@2x&iNK3=^`FAH0BD-f;+JU`gnQmNBeqWwGg>uDLE! ze(AMN$GxjHQcU&iG)*m?{6b}p?|B?8&?Rs=nHalpmav+md992z?bXG94inAd7ogSW zSOXwcOq?Xb9q1}3X}|Os;Dkx{%IxU65(;r%Wb;l4iiFd zwwd#zCRO=sgUuJqhHWa6-HQ3`lt}EBh9aw*OF1k~_b?CijLzor0QZxtCl$rMaV>z*hi* zB22p6AOJI+g{dU!F+J%(iKznn<j)~A* z9hnU;Q$H%2c(0lg&wm{S*h_B%sJ7QTwz6;{Z1_e z0>>h8L*oIH068c1h@}lw`&HCr&?qW{;AulL^ee>(ZmU-8YZ@-~w?=zU4P5xH4J+$D zRWxSz7F%9UgL=~X$3}3|-|oyguDAdMw1eOD#ttQHifX+Fq&sNVw6#o}T+qwnLYNYq zWZ6hUB1@VkGO+(AdDmu7ZF$0x(Woyb#tyLN@Zs$%=H%F$O+`TjPx}u4SVBlbwEYLk z<}jxp{j9xpc4ach&p#mv`TB5|`i`3&LENr45F$6QER`ExBaH56_GUkTB3Em^5hRV{a5mh^ztL;t-{U*47^z!F@VVb4 zw!4(_aa85}pbk}$O$QjFNuL$SUS-Ksl2gzr85EUMr|23d;L*U_yfRex)ma^L#mzy6 zR0s_+q)B-gTIJTvYT8)BLy2o_|pJos)Z-+!yIMae-n~kg)t9q#Z z3Q=-^l>!@gWHk2UVM3ULB1S3^NC4JZ3912m;SP_8dG)W%Ui{x5Z#5g1XLVHAD zp88#&%2pJ`S{i(yZdUzQGXaV_4nEWrG6f<#RuM7K2DrLrw!3$f(AJ&x=4zInHQj#p zj2tmd>C0h|vkF%^0_G+C{o8h4?6Hn73=7;sk_&iY6wbbJ_f;Z8DuBqrt2L*iVk2Jaw8YBt#U7UJm%v+mm{LF9soX zjckKb70MCEEATsZV)y+M>$hr=knx(Cyv+|pV`@bh`Y}5J}@vZQxDwKgNReG+tN1WSLBt35Ni# z;IC`e^|qd^IH!I?yq-5&0rhvHt$pBUEyLLS=&ZLonTvKmmG@b?H#Dz5JU*U^0276y z82+NF(LP;xKpN&iwy8P#B3N?br7D|VxL}T%)@NsBGEelK4vhaXMD#OvoD!E7m)g0F z%j6bTY2~O<#t<)}Cd#NC2>rN|SHmO;{5B}$@h7@^PKi@WsIPYuN?%5#J3A2uO8HSU z*SR5vmNF!)cYr2!>MXiu^-|gpk{gW;DB)wb^%Ix+Iv^29v7cx z5>tDjM!n$>rd74(86ivbUE?yw%>-xUb$#7 zyihE6>fnjsD717aFqJ&q^V*aJBDB214LwX80$J(1(v5ee)H~ z{VGP>J_We?lSi1^g!gD7Y_K8RJQG6Mz)zz}xM)wKrG>KV~D#iTgL z$%vRx^}>W5l4+Iwg=f{2i8Djm?z-{qpB%ss&9}b zri?Fw;`dkHB(KWZ8hc1<_>F_tBq~n5H`~09qrmhKl~8qXA0;S0q_AqV+R<}Z4&}~z zW3+b`!$@#?++kt85P=8)7=km^KDHL=4hLfunr0gxEyUqDy}X_w49Y}F`iR&^;d^yp zc)-}B`H>*6u`qogu7P?kE>>))wS;L+C7SZc+D}ks%vr*^26^f)NL&sfBNO=VyZRXV zw}%EF$jMQ6GRK1@D;}Wm8Anwi%5Ba0(T2mJz8p<$CcY|Q^zb^m<*jZ1ny1sl_PODP z%l^;Oo)9b%=2JcD%wiH*Kg2;nZSQ2F<=l7A{#FnGCiE7E8nE@r>4+<9jP3Xb$-$J@SmqP zl}Px9c=!kd4XfO(%V3STFig+dw7_XFR9oGIgj#BL8?>rUChemBt$8>=K!jTA zh^3?n`*Kdk>Hd-a{P4-71yAe8&&Mt)hP%=r{ts2!+b9Lqv3TNt6a=Coqm@n?(|Bd`Spj6jd^lnEi($1OW{VJC7qsJ!{Ek z#VYDZd0XTLzqD=sb`vbABRF0oQ}3C?dN5Wwa(sXAcF6ew#}7r;DW{*gPKo%pKoTGU z76d>`xZj*FXR?h9Qpg_3RJGq;vgpeZ%wbcJ=V-1_$r4Jz_Oqt%WKk(yF8ke`@717S z_ZPvR!dN(RDHWGfRh>oNjdHNntHgL>JRP$*3MKU5B1r6c!|1FJzvQ%($*KwD-7$iMDzh9d+JyYx7vJ zdz8O2^r8_E$D#He<|UElYXN{ByJLezbZ~0eH6y+yXsSi_8JuGZzRy~JMzm&}Q zH^yM{t16M`zsFEO3haZ<5SEffPrMd3E-5iqfOSPmITq-*)LF^!`6;h(QHQFm>dh5i z4$egGLsCvx@JJyJyA_YmEoVa6CW*ro65K7q`<-)}4*5M|EHO)RQW6fA+v@<;RwPf9 zz`o}2jD)ndci-H>W4XGv|2v>$m$*mYBW}}ot<~MTr&)r{>y_g^Hi+NmWwTvT=)dZk z{oSmC5n`rvd2MV?$HyY^87j&vP0Yd3Zr3GQwQ4#C~sHMqOGyF0->5FCO8 zcXxMpf_rdxmsja?yKkQ{-jB;a_THmvu2og5=9-_(oDx#{0v0lcm8-%;cGa?Q@a zzPxC$R}52AI3LdA)ph|k3BGdpUS4Y@D!LWL`M+}AIz4a4n3$RE)|y6Wel*+yDtg!H zxtS-YvEBUFJQ(REdIBNHQ_)GP=A#MP0~6IYGZr5k|HK=1SY=e|L>`xyJ{f8MNJ zegXdGvvYnqyV^L_qUe~Sx3^xu?;a9?iqBRp*tTjYnKj~IraVEBq=JaGG|P=4=Ee&X z|B9;3vY@u@N}a)Z#VMlf#C8UET%OXt?M2FJwaIL;k$4)5l>$M`2PP(A@u)Ad(tvNm zEncNoU`PxgNntKB;?TdSI##2z(Qf3TBl|>!wv2^Z;!!#;j(DhcsHFYce=A zR50}+=G zTDq#XhMIDOPzW+IAZ>1gR@YCg$ORyy#4Hx`tNRuAE&P5`(qT@=a}a+ngH+4|pltx4 z-zoWgVlQz=t%JWxz5w4Opfa(`Z`tr^m|H~`F-aamqOPfFvA)zdkWxWAQCmCxWTl># zni}o=`ygU3l}2MlbyCCp__3NjU?ky`C#nkEeBh96& zC_q>n|Mbl3bUrq_N?d(>cpNE>IBN$8hAVU~gBC?KIXOMH*5js-xkUd5tly+216Vdn zt`&_7GU)vJ7xL=o`h{(-y8uL6VIOR-s-VC~OB?+oA|k5mLsEsAsj-knwLn3Zv$OMY zs+PW3`lyJY!sRa9JD``Sb35j+AF|KufARI!UOhw`TyAyilV(3jc$>`XhEUC*z|3%X zcYB40hnM#ovn|Xo7#eARMxifgK~DbORz*mRC>8z1KH>R1qvQf66X{zbU35C3(*utL z@{M*ucsNWHhB$oWJu~xqMZ(uW5nJ0B0ff4`y4iOFL`rzkQDT9K8n6nBKeq&8=huB- zxh=fQo8jD<`1o&|3q9>h5SZwR|Fg(tKNq zeGoe0<9br){W${M?vnX?eQLtDTXt$@w23qZVq!A*49SRy?V55HT*M#9uB{C=238kX zG#aWFs0Np?N~P7|Fj5rs^hjoq0n#|rC{bG*Vk(Aq)OhI) zzs&F0by}@8wBMKG^t1=Msx0G12>gBROFs+n6=cPa4-XolqWad{D;^yjQBzfe&*WWKQGs6&CQD+Pl%_+*Y}fZaH%J zhKXpGsseq>9@|_>QYu0!Vhd)vA&`5LK*+nfXIKL|$(gY$vv7aH8BV2E8*P4-Y0;1L=UBL8!*)(|q|yzH$w(buPuWyPv{C0wUZ1FD{i0vF zQ1>q9Yi{#xSycx6fN2AxLd<>rXtF+9aJIB`7=N7~k{!l-Eja^%Yzhy8tDv+n3E35o z(-ns{f3+()J^lSw;IrLZ`zB05H{F`2H@h1jO|boV(5}kof~Y9x6Kn?SIqWg#UJbNC zz*#~>?85qI55077X=$lZH)h?5upWVJg&v1#K9RbJosku{(H#%V>cT$Xs(NTF{_{eb zN+Q`#tiKOf3;|zQupaW|ABAuskR$NCK?7=a@>u+%#eQKmHLOgKK_mhYr#Ml4+D-=7 z;o-Q?7rT+Ryj}#{-U3Z-B1uC3Y)CphK>^3HpMF03PPUIB29(UPb8i_|5-!g#F#7!9 z)`K|Y|71S_l_CEAMI@1jYO}R--%3#Y`Gq&$z#=1I zNk~XE8!fQ#@I*`MEWs(+{{HdSw;DoGA3a#HA0!@-P5-G7;qG z?B7TEYlFfn3{W-4?F$tDYr8^41jK?W;GFhP`Ut>{*`|M(j~^$LVgE_+fCo;1^bdCu zG)(rtc1v^cz{yy9QzZdz$=@7F5R{@Ifa@sk2k9iL?gaI&;5>HNR``+IoGLcn-Q z{SR3FYYgLmPR5*3jQ(GNN&XoxIPwp&{~E(b;AH>j$rb1@jVQiTEVH&Q<&_)xZ?=~y zOx^|7eLn1L)8b-UzF7XhwnRV~oIQZ-edJrgRcSi?uK2&_;6fLegAOb<$^Rm@%CG&o z4D1RcvHzZ#&30f2KJ?ZJ|0c|dWVgTo1GD{^K=AKL=<)*CiBGzV6e$1xRKNx8L9sEi z#1@e?E-ND=BO)T==g*&QZJ$p_Nl8UTMIRp@^Yel7E-h8yzfPP5_2CQb;dRlLnj)Np zA_4*e+$2D0?2;;HQ2-CgsXs3>^8ZS1sP%L4<`6I480jNIHfS2xra{H*^z zR^lHH?Z=!W4kQ&zThp|7Y^S$XFmrhgjis6htSePT#h&+`9-%O0RprgmWO^`A+#ea= zJ`*#g)mgaQfb0tXGj-m7QGah_zfz(%C>ALW$w(-sh%$=X+1c?sA55v1Yo?~936%`= z^*ua1;PQI15E6o52(e_cm8-zPFqX?XJrT5jF9P}J2H9jL6aaYAp5$HH5g)ywWuWEN zzW^2o^m>RNTa1U}Wq)uj0e{QOEv>Ee+D*s-et-zZx+pAUNaAad1YJc$;Y0?n-|%-Y z0$vBly^|$WT=ls9SUAi~9v{<-sT}Q0Fen5e#34x`L1Jo#{bvsea{~*?tCLWutAz%S z$RrA@oucU>*U2|9^WvZvZnx8jq4wt+j4-gP<>h5dOH0%l$HG1nVi`@kiPUQ>w%1p; z#Q3Tq;N@kr+)&E073vny9tfr`lgXtbq|rp^cD}MuSV<@c^W}3Es)miWuXs$>!D8|E zojOo68|zcC=pPJDXD=|{3tW%am8uQjwq`q)TU|2vtSU-MN`@@mZw`L7iBi8QwX}F{ zjKAp`8^Z(uQv4>t&m!4Me?8R5MYC0*&sjMqYj0}rVoHb>^G=V*OartboUuz0xF?}y zOit-9L>l2zQa#GJsg`hqmgEnK+mv6EYih2-(a14rHS_ZGgF!izC=m6(sHmxB@%z0U z&K447s(XJHafDG3EYV`O+x8h;!5RF)<#xE5U)uC=dwQzXXo2>!Hx3xhHE~FT1_9KY)iKPNE99#}>5b zLc#dm$!bz^GP%hcXEWzQg>tkF;MS*9;8&PmPHTelhn^Ym&J^%ccfc*BbLsn{_C9to z7+r`v!{Cqvk~e(wy`+A;UsM9g2ieK3vZ?kL>KkQeUuph_EI%>^10gse^B%+&%U>lO zKF^+BUhhxGm6w;7(0#DvZBr3I%!$-$>rD>5y}d?jEiPl`5kaUl*%HC#R%-9z_kjHt zx91LnP+3{IC{w_Zi>s}_60p_(nEH_>Mq#ZbEGs@EDt4-j7|l0cAgrS! z#IjtUj+L2Nm`X-QMp(GFgsgJwp+Y8&&*P;Dm@N(5v3y>y`woZGPpjFYVnqX8)XBW8 z^>tisXEY|6z*Z&>WeZ4`clUOTO^vmiodq|#vKu-&{+cfM3kE(BpS;PoqACW8i~O5Q z2h#h4HSw#3uQ$yKf5_JzzMv*1{T?6P_sN2TbTqKu9}-0OKcZ@umst^$6cW-2={j=M z75|wfS-yfqeU>!+l4*(S@f#{0&LF2CL3G#}m*e@_0-4^+U!`hlW$M*d3l&^0RTBL0 za!hb=kwCURH8sWQv(w zl4NjjSe!qyn!?MvoKJ&!fu5{(APm}2??vXAi$~*wF@j_C+(7M(T-vYIdfh(&)`T*d zQ5WIg$y!+);}R3SUJg)Zm>8q$ZjV=tOy|40HqU-=PeodbVv%eDCPOO(r4`y8@U)BB z2E7+mRXW^mLEunEckh)l>2}(knMp~OR#uJX-EuDQ2;_39N1F%gfMMWaPw?--7}&YH z;7)#V45i1EJ3KCPLZPUrsDjB13j+g>(~-o1iVDEgj3flnfU(}CF1b?OKy8DM<6#`I zZ4>#v|Nej`+YA^z0`6!0?+-slk)arHknownnRtnawuW*7@6XrJQojIuu^zA6!`WPM zx%TCHM(f2I4<%`57EoGRT5{<$V;h_A>FG|lBZ)@hF;%aa>U`sA?0R*^hfbYloisX@ zMn>GW+u(B_#aNxkC-7F_g6?!dA^@@Y^#Zbx@z9jP>DuaMw7;X9^~xs{lx|{Zw*dQd zu(BZ28t(zQjK#`#|K3nUd`{;u>K4Gjz~1@pvUyTS_3bUxDG<`HT#w!TfWd>a84ywu zGR>cM6M(2)jU8?fFF(MbJtJUOIbZ%Pl*?RP;SRGZv#(cDQrc+qJzX!JeRSG?SfM-P z;HCYQuV4gtm`*Fig$1UY^roqBbnQG`OdGM4>y4tuq;ov(-Iji<`jnQY)8fL;#yCDP z((>Dd`tt(2lO9ED7jzZq62M%acN(^Ra8|_XfeP4h)Rr1SL^b?os zp{BaL`@(aBy;hxzvsmnpi-ne7DdZoSx6;KskkZ)finFtk(Xs7+UB}zM05vTK>W_0C z>`j(SE#*?b2dXRw2SoI^{1DZ$?Wth@O2`;MVdP}l)4adoEw~<-FWJPzCmDzp*%j?) zA^(Ub!;_a^5DrQfH#HOQtU9b!pR8!l_-SdnGn;L64OfeL%!X5DcK&9#fgV$+iD%XN zHp(jfBhrbP*w#A2%l-yT;d{R_sz8zA={(ocWX)&M_-))-3Z(++fO;_c6tGKzo}PsT zc23TZ4Kw1g_=1U!h2M7PU>o^;9Y|_$rL`y0c%jalulIyC1#wp|uY|@dW((cUmu464 z0~(Xnpx7HzYxh?>-LOD)i@>7O~uLK^Y-w8jV8U1 z$jr5{Ih^wA>&wa_;_r;Al?B!Q?uXkaA?}GYh|O#lnO7xr`m9~$9{&A%?Kv3115rw9 z`nCAMN~IrAQ`qqhghUXJ!iAx|I#phe25*G=pb`Pi|8j$t=f9sHX=zz9Rk??WNkbhV zjU2WooyJ2-NqM-s#Jsn+7nw{KoC#8j(fMv*VuFyar>XfA7MIK8d9z6cM#N|LhGdYF zL+$s9!4Q|H%UjF*{;an->R++e5{<*Io2_GNy5~?`y-J60LZf^*wbhG;hHAUsgh(Em zKbqvk#=J#`eCA_JoRiw->T(LJ5}^RzNhR7;%WO9Q6?y$Y&1rhlWG0t|o}2)W&s1mk z{swxx&$sQFG^M^}S^L#rAtSIrK(JB|VvE=KVaTq)ccnQ!G(Yj68I(@tJwTX&v&!k% zH0#;z`Gx?RT?VKYzXgUo@HKTht!%(tUba77EpN{({+cfCewW4Nt}+X}=6SZZwf6f&1u)+HGHY5GLlDdl)`6f|XG!}li0>~A z*#iuE-rz751-0dzDtnC+ZZpwN&pBUbtC=Xj9fNOSM*MQ^X>Np*VwMd~D!w-XU7qDr zl3WA)oz5&mt7ck57GZqen!jGHk>0xAG~L6hBZV>qD_-1m9@6K?Vs%yNMAKEN*o}VX zaGxPKSCOzid?mX2BoIS zBQi~8FVlk3I$VE+dLZc{hJ&NCuI6?-N6}!Ub5uh@!X;s95OLr9J)1A3rlX_ds>*>D zi_beP19(}EPL3|j%^mG+O#_al=IHQjhebh=W=&L8JEb&!X&iNB_EM~3GA&`-40kK z#tw!g)CJ7of$QuD9pZ><>obep}u$jahhs{B&U(QACE#~)6;ZcJ$$jW@- z^xZ*zCX15?|ATRD^2=toVcOk0hau$_1b)x-Drj#Gl#6R@_+`T;GFamwIVBS#chml= zpv%1l22!q(kzSEawOpyAs*6&nuOj2?&~FuBq+xLhg-T{X^+}(#L{SyQ^z`=j_Hq## zC{@D33K3?~ttx>}au&!NT;1H?+ii64))fP_52#lPeJiE$F4u9##-35%b7Pn4^ z-&_SDam>!WEuHI+hV$iCG~bZY2Sa~;?M|dM1BAt#_>GI%u#5n1tl0gb;P8+CMg}SH zA|vbqgREay5)otHq#iT!(gf)opWHNYKokY5V-x~Xk7NXv!A?^PaT7MAr z4F~61^XBQ+>SYj~1|3Wp6zkolpQ%qZD)O-*V5<%CXT1Aw5KNI5tO@Y?{xDGHW$mjL zm*W~=sNdtF$OoX>7Q|k9#>@sqVtnf6!IC{tShFKzIsv1& z8i_EkpdTTb!~ElrSf~qQAv6PG<8i33Mhq$l+Z58!>EWnL^MXW*UXtlwE<-qQxD8M< z1cU+u-xFJixub}uSTjmt&~l;2h9u153=aFasBo>Uj`dsGWLg{d-cL?wOh`?#yxPvs z0H2WF5Lg0`%JhY4u0_gpHoNHp9Vh{>onw-2m4xOciRl7Oz}1@OQ>Pj{+~I0Dw#eQe3WwhVHL&GM|sV?5%pe?f-Dw^Sx&%%PzB6HfboaEw5{m zW2(8Loc=%@-p%<}PyWQ|K zKbM;HL3{&=W5>s6)w#&B9sEi4PH4>tXvIhNqH$7_(MOQt%A^CrS%ye!zSc`ifBQP@ z%psmSlc*gL4eEzKFUYax-PS%WabT24R6syi#ptD2X(cVwBOd00QlzcyFNN+R` z^DFFB{0A^7NC-$>4nO?xZ?>cFnq2Rb!O$~4moJ=G+Zs6B457qD8>lw2z2}Aes;!Z+?VDlJLV9s2o z2eaNlZ^0fwCnF+Je|0GR_>pLh{+<$!rLMlN3ll1lYX334+FIMuEO=!SKT91eXc9J$ z#bUYVeEir<4!_pF=)Nd~RD%XngHSkN{S)@5uRIO8hWR1UpPb&$@bn1Iv$OrNCbPDWd#b-E ziJ+fs)RqdEQZfV8soe;F-B-G5I}bw^62_^dXLfX_}WHpph(X7vp=q`YG+NCoka7P?Y+qQ zm(jK=-9w@8W*rftLbIl0?m%APm5gYACi`H+vrPbrh`(B|=I|T^&rX(KNbHp)D8$_7k+K7_?w5C$=$c ziAZJjAo7IlWw+>fP3v6>i#|J;R;ykpo7O3;hONsl${r%fX;X1alhu0%n!<>in>&x; zHJVWQMHw9O(*mt(PIU%GeLbn0YEycX=GVZ$2hl2fd^!lrGMAORrXGGss4bE}UKzlQ zxB3<}=_4g2_3v=#ig8E;yru8>xJMSn7JzX>7xLze-BJN9o6D8ob%DZnQ)uj9c$IfupELXmIhyCdTg1T)WEtsEOYbdzCW8-vtK|3Hs`| z`8wN1&!3}36@IAvXvwl0#0JSyxFx_UfY#Z4;&a){ut{g{>mOJKdMI#nWb(Lju+kzp z;v%`AhD}of>+A^02MrAm69i{%!FENJ71<|5+e!ATJEmB7-+~E$zu#b4q#>P*_V&!S ztb5(tZQ~xu))DYmRGJ!x!%e*<$65zV_Y!Y6r*vHgW5dHCz6i~=%qLsjCuP!{5GF9x zPx(P|J$0aPL?+AV$II2r#S+_+k5C}@wC40LbLP2X(N%$zuG0h@_JmHVj8OQtrDNhv z`rV)$9E_1rv_l1L`M46skrO)aRz^ln*8{gI)T;V5O)}{Xi>oNqrLNX1R8=V<Jld1C%n@2|g+FonO>y$VnizQ(xaJw5U(0 z#8ODU%2)p^iVcNA9}fRLcz3==-A(8Q3xU!EBe=9We0W!`HARpTo+OWaU9Nr=8+`h0 z=%oi8Pp{n(!u9xMH6JeTx&Yxgr$5zCZE^Wf=^X&%^lR12I6Q!4dihsr%BBDovgY!1 zJz5W=+v#e64(P)uK94&{jQUH(hY(0DuN=CU4-kf5s-H3ZWXoWLGfM5-pYKomRi=BE zKJqcUyEfV`(MZQrlRDmrx_+10%_S6by`R97Pg=w`m60vlfs2X7juAc;NMpJ6ljiSorrLXt?@1d2=o3TAw(WCss~N&l*-LsF{JM zXIh|<5lyLh;1*r~D%WRjCL>B8W^ywc)1DJo^|KM$sX)(O>xTn}n2T^-4zILbp6d;m z2SSHk5pmH>E(dr{UV`;xwQqxIRHUM$WdprjZlBkiJ#u}-7vhZkz+BzMP!=O>GHutI z=Bu5s%GAFK0MwPw0z?`9R#eMVO%}}7Z+~id1raAbvE-g!?Q_gi=j`Sbd=1}*4i;ip zKEnYe*#uHhs>CQwn(asKY$h}zA6@ICWbBdW=;0=i$@~2`rt@m~;-7+wO&g`B!VLYf zHx!kT4J3CDCwRwxj+q*b5Ci3dhWE4nk<_%Fw7={Q$fO7Erw9sk_Viu&x8;S;PQx#E z*U)`;NOKhw>dX!RPan6XdVEG^S-1+d*KWzwTy(Jr?Zh7bqy1O(G`pT47_0d*jaFBi z$xPlYyI!tBppYLL8k(zE_U7Q=AlOn`N)1kpYr$+bq1|BpQJXpG_7mou%TpjlL;;Au zI#@54FNbqu3mkrsVJ?k)K4S2A@#krspsD#||3RVT<6&ryKk;mRLtGGArlUfFcq!1U z7}z`?T-by|;=dt9t#+XFmUvJgI59oi+^llimu*7TFdZw}rd6igBh8VFvl+!)=gS41 zkTMwE<%IZNtM0#jHjULnN>ZlX>TZx;11= zl(7;2gIbLseMlR5XPb`;b)Og|_UoQh1}3SjQamcRwUrz6qh6c4LZK{PpORrPUnw02 z2L}TK@&{LF#Xk7ksT|?zW3=sld3k-Xr zVRgL>%@DkS&VAHqy>!(T0M_nxe|LR-Jd+Qn6$ds+fyp79Xov#idv~}uo<0<%#p-J2 zeVWxMr&P^eS47=4bH&>l=@YupF%}k`_Gk_ zQueKmMdZm2Ac}ifBU$w%Vh8-wP3-La-d;TV5*?+atC+w#U+P?rRjnOjyOatf6~G~u zFc13IB}@Jnd?WYqN%Q~ZzfVC z*APzG5NVk1E1XD-Quyt|(zlPILpo2)A)!Zv|3HY6kRPs6-trv$`+{!zs2oK_6PJ@3 zP%VRTFdXuSS zHwC~w9eEz+T!7cm->_%GX8^U7nlYEx`uh`P01=J>a6sC@Ksg=qf5HnB_(BZ8vH#bD z=DV~~fC=};2gNP_H`ojf+Wlf8S;~L_xa)~56hr?rBp@aM7-Ic*9W5Ysa0CR_|B5{o zi2aJ^Y0mB6u@nA@eM(EE$u{)v4uSI+0(vBUg{9UKAj|8!6w_9E0E`J;lN;o;(< zA_^+1kx{9h%+%D>xVX5qw6w%Tz_xtk-{v2Rasu%}RJT8_g0%6$5_4>}Aix`}b|QghKM;Ln=m5MYCBx1a8kEv=oOF8)w?I}3o59(fzv?Q z(%?Jyua&hQwM(Pp2$=ekLZZYt3?3uO=w%wENkg^#nL`_zgJRJNYJi)%f$PG$&p|Qx zv&~AQ_#T~3E6mOZ4;vdBpc@8^Nwd;+l!Q{!sMFC&^KCjCMiKOAS=rB-GLJ|hbab^m zH-h`uP(*s|Ht;p5jNSJ#feG*DqRPtHvD*C!G`7mC+O+=du9M%GEPvxrU}tKg6C%uowX7UR>u=}AFy7@ zM5=c_i-@5N{`jI?C6kMbI9jd7R}_-6vH$}h%v*v+r83M6t@=lsZ32MrcJ>OHlB$(W z7gIar85)giq&_aOQw&OKc;MxALoJW;HYWBfIuxEjxsHmihAm0`Mtdtn+#@vUy6==BAe(UFT+2au> zN<#xQl(E|Tefs)x$V>-@CSYzX3>C`VXctNIAcgvpQwOF>k>VxUmnVu#IO@66|Ct&yU^P@bLl$Kbmb;9v8#WbPQ zetG&u4Fhwj?WyQE^J^38XWudLEt6?irJ$*_XoiQ%p5!p;elXykFa;BAY zp(r_4F5g(Py$LYGSwj=<_nkQ%B)I40Atfb~FdjAH=aCFYME58uLLD|5A<>ZeVqmUf zV^GjrqFSfA+wcE21Q&m~w$dn{e-ZfhdcPr`?{>DT(dK?xD3|pu3`5qv8|ch4Hj^&} zIG(Qq*9$-+nF}dlB`^GcqSpwTZk?Z-_~G$6BU6&qTSZ#aDg$r1Tl=HmgRu^m4m7bH z0UxdgMZ|y8vXl;e?fk4@Y^5R9V7p$owc!F`gJGL7Ffc%oUtC;VSg1C&&Clrv_8bEA zX`qdloOXa_Z3?pw*oyz%czC)SOuheDYbQskIIq68h;53ovl}_7M`t1>VtRbIcZXQn zXeXLU+am%3j|6u-Ju2gwzQnoYzPIBSPJR47kgUfKG{5M)^r5A5%9%}6NkH4a-l1SlpG41`qQX_Kr*}9D-;y*TmQ% z3>a9qIlOk>T3bWGe+p8<)6uCW?*g_i_NzQ@9oP}BKye0H_+fj1iAHy%`uFgcFRiX; zxLn?giwe2l_`G*0R-PJaY8(N|te^&2LELOl5318sOG^vzbOh@fQ@3CP0QB)&{mc1i zGMymYd~G!hJoI9<&kEo-nQb~>zG45mTu-mZm!6tBnaWyQlDS?qZ3H0p4&)v7XSlcu zpyk1!`fQg3N{?Y&_HM_)Mq{k8SqwR*&4CC9xRN^OSRfhdc)CYU)nphTj5 z{(B(mEiEo!%+ayNXdv2d{imq5Hf{(u3K>x3&__Y3;;GWpdvkRhbk9EeeYQ1ML)t?Q zV!4tuE+{B?Qr0zv4x?gwN?1}`YgOg9p{ttAVM~Ljrr_wvvBV{*SlA!wha1YR$l02yM%$b1?G@Te z?kB(LZa?Qa>#1k4T%DUKkp=kD+Tjm7^K8tO8l&K9JpdtJ-L$XC?*-d?e?EGVUazd| zc#|fhNp;?((fTF1Q?FYvfQTSaN1NLz-25{!_=~sC@m%c}IjKPLhKLGV-j$~>;a|*u zJ-hMWjLEOemHC2sahzCP@QDn|5qL2f_KL^0JDf_w?WKG@t=`CeJv*PUu*ZFUQmvya%kE3ofDmcD}(Uw8ZmCAr1xG zlLaH3II=e4qWWlS9%>RbnJxoOgOwCDz#B${=ehE&=#?ftM&($O?t5b0%{HIAZ_@*k zh}mo0Gx{7gN$;`ncT{1Zls-{zefGJq=o7)q%Xpl{Axs=3Vmq}~!__)-TB$_2rOh>d zBumthuS^VFO9$Ue+`*)12f}ZrZ-WV;+v?Ii)d%iF@?i=gA;pTH&%&Y-GYgtBq;sS2 zc|XNoxp(7*y*J5ud3uV8i}xnp?hK<9DW0L9M15q2eD9aJ_QB!T&=6_fI*%=$B`gQb zkoRN zZ4~`r_;+$MQ&S=^Vx=D$KY*oZ`}Rl$=o2#-^M3aq`1-?Ih0imltZWbXa)T8V-s8zI z+6i-&{j{NoTn!Jx3C_*I5;Y|yj9z`%uiCmAF26Htd3i$k7S|)1ntIRy1^f9`50|64 zTkjj><(?)ngg5xLmiwWh2iRu4%1oKgw^xTy{}~}jXnQqI;J7+~ED{hfgMz65l@X#-l4TA7j= zinZPzbjx1GCR{Y-{sw#UB-|gxq9=s^hF;pASW{VZ4po0>+L8%YHT?`!xFN5 zmXoPLjMyPV?O$~Goz7z8dAt{GrB=B(U&-$^p-q==U+X}{LW3^I;rwgI^9s#&ytdY!op6Q*(VaH`-O6|NDz^X)75e) zWg1kyXLn&xSaoEL(cIAc94i9eCZt1;^NI3%yVvveW(XC{{0Q6q3SOYH(_nKQ5_WNs zX?sS27|1GPDeQN?NQKRYcd^A=r)IjR79h55Wzf5XppW_C7%w~MPKlz%0 zkutJhf(C_53|yGsE9`diY6}2#CTwQ6(Q>)<%I#2s4hbxJfff|#9uJ$k3;6BI%F1zJ z20cpDEWG}WwhQ>l2z)5*YtIl6;MQvomHW9+fbaRQ@{vd?Oby(_CPC-p!=!{1_s5?H z`m`2P3i!m|FmdQgv&)Kdax3g?*ZfYOoksELtP+v0O4g@N9VIR48xSATZXWxS-m1^> z34@f&CCkllyu2!$yDO5!WP3$sn9rLz7*B2kNom)AXn+ToWUDF|vmK%h8>J0KJWA%s zEP3GyBwlgL=bKSwpshoP)nYbNA#a>`-JkV0eonVDoIz_;OxX5uIosfO*cNg3Nn^Ew zbc5JWL2npVl&^AGv18hPYxk>VAK4i2&SeEvIM<**{Y?FPhAekT_!Cd9G5)77oqtmrL1IM})r!iyV!Yt(H&@ygoMYYtxI?Q zJvjYi0!0~Z3Og1W;D-a)F zPHMx)da%GyKR~@#2TA0yZixh7D;<1RZnS#FZ2GK#;?&yXH%vws6j_VD<9+f7t-sa# zjE*1TP^n%`tSX7e+eCo1pT5BN%>>kh(RgM7wE5)xo{WM4M2s-yXnD^yI{jxnmti$_qtVDLL%O8mY4h24*!=FWb z)X30XP?Eh;Cs^y|iZoMCV^s>YYhhjYMEL3K2mkk!?WiheZ?Owf5OK=1{r%@pzef$X z8Rsv46Hg!S!twYLR<}4H1i5x8MDPR<@NIU3teZot#`QaN`gepn23MK7Aq z24ujtt<7%T&)6+;AN}g5w>#g~xfrK~MD(GWcZ~9I3Z%w%^gAD1SwR6v0gtSls)8ya zeI!hyBh=gIZ6(v|$##=96BAEoA62xOKj(dCc!dnrOUKNiGQrTF?*KNoO}P(GPaPiD zkl{_i_V+yA(^co6nt0mV+5qx*woIu?>42joHb3^^d@~x;W(6SlB&EaS*6s8~Q0lFM zf2{FbYgCs83$#-V{AhgrAg^rSWH>+&j(~@^^{E?+B4!IIkgESLb^rq*{i4VI-Ra9I z%;QibZrCJ(X1^NMJEiN%{@^iLa-YZ#D|{y1m`P}34GTOhNm5A@dH<^6b|Xx-WlU|?Wu zG4Lqb;Z~}Z+Y_o4+8;?G;ZweZPIceB&X1?Jx}NiS_etz*HLEoEq^lU`pPb@UXtjpa zcKP`iLbvskK%v7IUN^<{u#!2hruHCPd?VfN27zeC;IVJMgq!`gst(b%y}i99^_xx; z29ikEp>VJt{xZl~jZUwJAh~m>_^L4oqR!aN$61q-Y4hZP&sRk>>A(MGe7WnIcS0&GpP8(lCs| zG$-@E!MITA0FWadR*~XdC*9UHrZx=iJb>5?P-|&Mk z?4;Mw7OSpoQ;|MwrrITG7b_BD*^q(0c^HvV_$q^e6ne3?~DMsgWkCUz4Z(BZ!Q3Y zgrLT3-Ke$7nx=(Ama*}!(oYYh(w@o%DDq#{&tARZh0L?4Bw1OAZ8dCi&#-2RbiqNz z&KbTOSQ&~ZF)?0j2?+OVpY^dl7I{IS9w!billwF3D`Sy(!T@q+iv1v^yIeA@&Q~xA za1~b8hhAjI5k2th2X`ywcCI&dE^T`C<@3h_ly%ehcd~m<_9|4y1RA7*<-~-9=KoLw zmNIELf*-YC_UAY3@1`B|?ADv&Jig?-APjXYMm zxUA2pC=k?~{M^(4-UYFNeKzi1V>roKUQL@8+&@hs-k16+Sn{GanykLQn`f6zfQ#Fw zLOvFK$j|e3Ddml6UFGoVsg3$TcmuR7#VI917u2qeo5;N9^V?I=Y)bxOGYg=v45MSl z8+padum*sglbne=(@Ur9uf8#u&L5z^zJA;%kKH;OdqyWLxpI<*C+5yaABV7f2Q*_B zYT3j?@L9wQ8XV2d7El$zAdZJGOH-?O-~-NL7dv8m(rXDzjC9GPd8R=P$H4UhEIb(GMZ+frZj$U#zC z96jRwi2L!QSfkwbM*z-tV5ZOAJ6)Gfm9+1Z+ffDZ(-vELJe{F==&)XY@wxLWfns z*{bqsS1Co%wz0(^5k5vBHrOm=!m!5KG`ZeVwPC5h&H`;DRIC;ZFtE-d!~FcI>#Q2j zKmgY1S42D=6v&Z?UMNUjza_6SX|tOg**<9)Pm7+zCPfYE!)n2BnY7^Q$txrm=gW5$ZC%hRxmB}6OY3i1nM3G1^`tH^eP zHo|7KME@FJO&C629WnMEsQhTd6w1CYWK8`F?G)lS7{PhR*uj9cJYr5T za(4c1O3QHj0V9S~9$Dx`EU!#dAplD%;=s(hG$`Cugo(x3dakxHw5o{894?ZLzXdFm z!Vn+1$->I){i%L)fc@aB(=nU7?GCMlb?w~8z)H211_eA(o;z;+fAfXpZGUmi~{`^(o?in)Q zEf?LB6<{-59m!{DvSq^2pIM%|VAlN=!rp$H4dj2h0SHAk!#eV9mi-aHcA&vxw!ta6 zLS2K^>dE=8eL%zL`T>c+Hyy9n(Q79l!^D?_j{H-t^K{Si{h8r#Lv%Uqo-wLiLXWlWP_=zlT@kN!WAt~@2NGOQ=%Zn;Edk%+}MbAUmKq0|C5#U2sH%Cx9X?rPK zjDqLt9fDFh!njALpTA4hD!Qhe&t@RDU50-KThFNG)z22b^&T<0$8O37D#2>O>YrjE zPC>YT;cjv5$?dQB!CfT<;&&Mch1Avi;U4G2$f|ND0lnzL^;8F0s^uul@4?AXX7PGe zbct9G>h2Wm%j$sZ*`n|DfXf!oV@#_(N>YvGF09BWeeawBWEL7aoa7h-p~}|#uAi9G z^ktFa&@||%L44ZN*Zbob_?{IzNQ(V5AIxB%;GZG&alqe9VVt-u3a+-;`}+w!n%e`7NO;`!3Bab&^CUziC@`_3v3YH$rcj#lP^K4a zV_VU8!D}-(T|l=sa|hob!>`Y1c`P>?jzm-~EW5wrLwOISvks!>Yb{h7)IS_tqA~n- zco`zHFl7M8QO-DL%=d?yM#&v?J(zoZTU)VaaF3v!t4gm9ieYi zR#WYdS#mZZws6gjH2h~QGMU}@oM*C6@;v5R$E*9+u6|( zY4>+UR%{u)ef^je|Zdpg%OM{ z;vKPqFo8H^^?6qJo*cV3hzQ1Ag?7~RpjSx2upk-u zBY5Sly}O2Hl90{#V)+YrlKGAm@Ozhxlle~&uX}tOEe`fcNqs+n_0)5)M4;D27Jz+( zAx)9~sq+;T^Wn;q_oMJ&895#@%GdYg-Z90)$FDRaOUb*jd@o6&PoQ9oNh8n8%j<9O zAy%IQ$!jW^)mpy{?le!WiURe+8~D|d4cgC8&@?po74YCzalIcuyU zpx0Ce{R$toT=&+%ZBNa4S6*sb$5I{|8X4(FXb&ZP&@2mv#VErmUVB!rQe}J0&+Rw~ zy%E(!?HxjdUnX3Y7+`Y#!2`0S_p`OFygpg!ba;@-e*8+=#pHI0!wgqr8_PsZ#S503 z$?qE6G5(ftjh+-p!h+TjYgx)&uSU%3un2gM9M(F(NAUPRI}IY53&K~laRT&=uTQF9 zebYU=(0GT#V7|>g`A$-?&|X=|{tv^z90H;%27?!!S(nHiZm70xj*FoL~4-3glFaOEvI$;sx5_K+L$u^0-Y*u_7Et!Hxlo2mEx!VmN`uNfX8 zJrQ?hh^CxeZe4DvzxukckS6)r*K$P&(tj;G09q0^kQDb`N%&wo$&i;Glx+T=*ONFd zK!u^TBoRLTtIQ7{HYt$s4|_%B82Xp`I5!+%5lph^Piz01)&@e$0ilQYI^^sBeKvpr zu?X-hsQ(Xx@|i8u40TLY)MVye{ZCmU7-X0oZyoi3{UB#+Gu{6Yp^LME-=8GODBR|{ zGZkL`-8Daz>~V>iIS~L6gYP#_Bg5e*zow}_QeEa><_5Aa!%vBRBDVO!-y{kkFlt^d zFvSW5b`h(1U}2bVoZlucc`7+DI1u-Sa{GS@2$7M2 z^GhjDoaHjL+i6`6ks!|Cn86my`@SK1@ssO-R#W|Kwd8O-iy!T6(D!VtFQ1$$ub}X{ zZYf)ZHf6cWGYCWuOFj@Ouhr}vAC=!A1E`Y0ElnqD)Y{M=8(m=SAcWf3hYepcGM?i% zUu!ox82}sHy|uI#L44VtiYX&<2|S_uh557!<#RXqdU#_19IgPy+s@9eK;mqMasta9 z9v-a(0OBQRzt}zp#NW}DB)y<~%r9Z1L8ub@IdsT)AhzWa%xemB_T|}i#DwNo0TIoiTInlWBy2WW^al2@COZaZ+rUBvQs(iF96g!)68+ z_v1y(Y;Sm6Ci){g*#-(_GnGfxQI8&+H+l-cz9%)zP{>W?i=}AV>x%A%j>Kmto`^?f zxZ`dDWQM5@RuRGIY#fb?}`q%Y!oq)h4?U7Z(m_l@&F3Tn-6^iH$8S zTub5aW$>D9kCQ4MJ(?$40u;tqS^-`qfL`pK?ACh@$ALg}dYqz#CI*}~AY_1)0QNi+=b)Oyyh&~0=~u2XVwG%#rA^1k~xUY1Hv|LviVo=hU{@$vF- zZVX?Gq1_9g#}4i0{kyjgxgSQ*E=akQCUS}ihj*geE)h3zS!%u3RVJSS` zDCE&7uFIINmuD(LJ{S^|7C9G3+r}0a!(}Ed=&V1^;NSq01gpi8#e`DVnTAv*JTp@`?lOa!$rEU^B8S_ z$#eYt+GXURkco7m@n_k%KHY$I49pFLF`eWPu=Y|>-Md3|Np5d#TO=lo=rowhKDSNi zJ@f%YuQ-}#TshCd!NG<`AZv5F`|GPR&hQDO1Pa%<=? zyY58BofBe0+tGaCIgkgmg=3~DE&x(Z*07_j89ELQX)*gN+4*sGEL-qD7RE}|Jx3p! zJoZty2iluq<#e(gs0+^z zi}VuU_}A6c;IMm`irZB&2@_8ELTHNs?i_88(EdR|I_+*yBm?U61-7qYFm1z4Tm>h! zYjk-6Ya^S3zEqu!;?AYJoTZrvhhu*)6_Me4VIwLmSfZ|`5s5>OK#ms$uo*U}-+lyC ze2*(F{9t6#{EwUKTM900?)Mk_22Y)ENbsEY2kkV=E|tSUNN+m2!CnR%4O}0z+B~Hc z72)_{tlYG+KRv8r&G%_FclRL?{TMT?9rH=koZTOiEA+r}3R*wQZLOTOh6|Mj_u;e*&F?L)Hw z&7@Lb%z$;EAz;MT1|bn#9L+*GkB*E;vf&W9K~kv{8$&9E2oB`weS#iK;X#)k0u)Hd z9K_$jI7xyK_ZJIEmeL2njv@4Vwwa2wJ@03!y~j4G8*Hr>P(wf+ZLOYemwdPxH5qn5 z!rvy*)`Ec1&Sh?_Y_42eh*-1kMkiMs-KE`z&U@_0%hOHfAsn+3te+?bQH73y!j6wO zQhT|n0!+Lnj+4~J2gjR$wQnXDzc|awQ(GER>R?Y%OjOk7aG|wbgrK203WhuU89?hZ z#MfD_Yz}8uTUmRsP1#tisK(j`XcS9SZ70@<$f_**oi19PBdwyOe0cRQO!YW{JY(+r zNCFY*`X5^BpZ#S6qhcpTb#--hu2+7vy3wIIA>wpsEc7)(Ev*;8OYiZ%lSVF!kw6h? zE=qfImlk*Uq0RO2Zt6W3`9fDC=~KB@wfRjH{~Igr_1S<8G#DJ;;nBHk=BmzU*vyyx zj9*KQcXnJp`1}|j9P>Io!uI~UCdy-ffF{B2pv&9tG=6;$aL&xe24m#u={cUt-kpff z{=*6JC{uhL^JK0cQR~KJL1zF-huN)j_012}t=w1NmI`bQH0K%fo_s@101ZGi0g~BX zs(++>wBjgp*nNzcDMGy37Ab|*68ts!Yq3bwUwb^#C_dNI1bveNh*GC7T#9s1p9Y;b z-j2fi!z<| zs~^W2Ev=r1!iRO1wif-BjRB;11yP?yVDA?DO@5Rlk_8CcL5-*Kj2cU~wzk@Qoh>7~ zDqMS7Zf+}g<=8*n6e;lAzHqy&GH7O*m{L|&W;UPg67;s}b{V$n>h3z#sW+biz{G6u zU=N>)z7`gh+790V8i2&up)N0vYTpa~?qar!)O)7XghWc3TPJ5kOJucB zR`P6(iX@W9VRwB{bx=eb;<@tZ5r`g^y^Ck6VYiTtQqAOjs)q$q_BN@KSgg{zZ_>9t z0O76QYpT)`KBTXgE^onH6=UL(LJ$B+YA=az4E4zM0lJ9@FolT)y>159hx@^onvg9g zoEi|g2)I#MNPozmY%GH3u1WR3LLb#&tM(fbA42637gAy_4t-X5S4QtjPmfL!+#;BZ z?Yz%x)U`+Ui*+o^02_m;7xE|`>I9}+QQ&W;shQR>ijiGLm^@pmz5UG_%+O+&M(Y$h ze{MyKvlq%rSQwgU^Tv2`YI3FBJ3S!*2EPx9 zV*MEfpyRD>h$J#YR@ku<@HC9;!1Zh9zZDf$eoMnse*eH;`Tkps+0^$MOK25RNSYEo z_4IA;+YR;&3oQKe8A|lTQd-1v_m6W%cmJ7Uq36mQJlUz0?mQohpN}N z@yz>&=chK;%}`#$y0UJ2>Rk)}(4p*r z5pZm`0JysOsX|avTCmu9KQ1Z-35So2jwaIes@aC4NCT4you*4(FoN@ts?45d+SkZf zMzAZdN9!Qi1dHAdEsYzDAbLuZAC@3Dt0-xv_nG|l99EeUF|C|gpVpmBA|1y+)?YD_ z5ZfOTHtJJDCbWiLqQ2C-%73Jp&JD!`1?`I-K@Y+w6sx`VO|G|I-iTWR>1eyTxhfn) zIe*-Do_eBx@6utkT5}>vcOB!UEo1$-EU!Y39^R_;hV{BB#)dB}a}(5*m`ITd^6 zHBPrW61kNmXY&1q*MK%}J=%Ev!PWU>sZ43ua5y40h1r%Mm$)#gH~?5}tit?xFie+7 z=QDq~C;3ha@i|24?;i-XmG;s`>?DgA2DWpKy7P$j*jdLlP8bW#k`keuA2na;XStf$ z$Rg*J0&JsTGQKU7;idq1ef79e9s{#iaY~)IAq zq)VJ$Uw`80IWW$TYY7(ir=ZcPgd0`3dG^DCHOl1*$Wr%BkTP-9}2G6Kx z_}1>y0wal`5b5pWIQE}-cejumvFMuMKps( zlh=le1Z9Jn=`EzhnJr?6QW%*w4TO^Bd4;I-68Ydhh5SdKyT16{kh)rn4jQ4ai+Q*# z)>`dm@Xrd!-qggjjwOAcD1-=5h#`FE^Rzh2f`6^+)RKH34E!0-^FCP z??$t8%bv_S=EZD;mOC=yU|bj;S4DcV)XsR=XRng>&Q|Z8BX+s z??R3TlTeQgWn=JQ086h3#G{FN@WF>lIZ!YE?StcwMRZQ3OgJ(Z$pHBH#U|I+P7-{% zs{E1cMv$~#2(JPuU*Sl*k#rg7N=8fKHmONSSo92hn`eWqzN+}Vy(X@5UVLg%P*5+wbnssUau`qFvt=?|tUo(BH4x1{hM}GMm&*U(N!A ziSzA?XH|=9tVYdYbCF?>0j?T1ZnD<>D?WMyZVVdHBP`Of*R*HyB0kKagDcg~U~qQh z)6>w!~3l`vkM|^5?C&K<~Lu4Qyl(_y+X1MAbKKZbmCS@n7J@T`^LPhL7zj zwzynuygM~l-ayFeN+q-Q50&PIVq`4lL z9IlfKQ~4DxFiCIZ;1XieulnDTajh>_K7A&=+wL3gG8kI1+lLU!0MQYC|z&L;Vk+^^^oi*CpefF@&Yzm@K9@aR3GV5R4#YdVz!9QGpUtrlF?vG%KfgZxt!9VIqR>R*T;7)n$cUn6oJfC|CgWd)Fn zo?0lBbjHiaW)Y5vBPH4WFF^E8md4*q*d|HbQ>^^~l0GRa4n{t-Tx@Yz7>sm8JW%4F zg0a7z1Zbt4_rT@kUg_kV%o=Bryy&7|{AdxLYSKNwc(IYc{~Iu+^|hL%>1%YV17}@9 zAYLA@KPidE|0@JCI5HV+7n+vTxwN>a9OUaeItT@a%fHY>9~d-hU%R)G;54U;@inZ2 zydRKz^#sM?0e`BY=R3@}KDi4J<3AXqMX#s~Me=~U-6e`SG(!Snm2^9x&H7%p3zAayVPoT=VZFvD z4UcB{3jM?6LP$u7l%Af5lag}PtMcL2m~s{Y6k!3l#BC{&k&_n}o?mTC$;e!vx+!g4 z4HEwDWnUek49z103It64toFmu&TYKmjJY9VIcfRd22|OTh>~99R0?%-jsHfLLj8+qaht3(VW8kTamwVVmo$9d29ZoSc+z zb~sThRlkgiiUb^#KEs}pt+c9~fGX(5gRZrj9VDd1i!6<`0luh*$5P_6w11$7zma>8 zu#^Uy(m83DK1S}Dy34{!&B*VBV+!=+nSzSgZB#dp*{YB9H*50QfMHA?vnA+ZStaNq@7Znr` ze>CV$ie=lIXe_o3PbwrIq`O~x(xL-uI#^|bGBP+zzc&sH54s{?dF(%^L54iEZpkRZ z4Igtjd^q6=2DeIL3pL6u`aNIyByHpfM0?WGay#_`RK+DJ@Dn-0(Y+ z5EJ|Sc$QcTUj4xB?ylMFvA#M(*(D&rb%!Lcxbf&fA&4+N54hWBWfMmeZA|4m7C)c5 z-FB7vwt|?yHK@TCsG7oyDv4qk78uFn%AXDRdN$Wt2UfhMnanGN?*cRyn%)}&M53zj z@Df|T507}STfIhyTAS+y3ARJqf`zEFlznfqkIMj#c*d!;ouM& zT%II#b-@k*-28-77ZhqDGgqSe5|B@2^X`nQQHLinak}kweC>|}%>q=*7w%4$>h+5q z6-n;xzV9R7tW+9(O$>-lWG^31ZN3EP$cqmri_Z}RW!5IE8JQ%goQ}u7EY=GZKYG3i z5Z{MRNKSmOwLH)BKIPP72v26gH1>TbvghVm>5N_rZv zXIS3dor`a#qt%Q{tH;yP@GjO3iEUWo4?xhA?F!=sx^lzD#0<^%i&`VRc$Fq6L3wDQ zLX#N{!14e>{-K(GWoYPbqj8GNuZOd~?7Th^pV#YRZK92v?w)y*aw$ES26>Dm3W7*O zNrvE+G}#fTVj>9X$KrJP_?f6F5koL88u)$3tC?4?_J&6-RFM6`2$9LZ-|o~R>2?vm z5z;p>_;%>gEP(yzTa5PF*N!7rN0O;G@$&rAY;9t1;kAstgvHG|n=ABt9U$L(tFmX{ zge6SZnjAIoy@Q}Quc8CW{&2+3BPF<0b)Cq-r12ve6!{1$JuJ-xMX-vHP%o{{*%ihO z7G4j--ob%Bk2+xSQuL}bT9bUNtzke~lqrt=-8*q9B}CuKJ(Xl98lVz|(f%I%2r=Q8 zc2bYrEM_LAp4bo3K>om&W{ujzKV=i!T2D$rfw8>l##+mmaaweIY|PI&%4lF{=a^rE zp7qXtq5>twHrUz`F%6~XWrbjYw(cwT>A5E&FDnff7w_7-NWpQ;pRLQhQ1|f3=Uwl$xPI+)|ARc zBj=49oqWM>P~96E@7rBHO`o;VdK?<1V<|@1>g5qvM5x1ryV#sWG&sS<1YlyT;HUHl*S0#{>bI3guJF~Vt^aUU#hM)S7@xr zO%R=+fn~n{6dqDVhotw{Rmih#PaGZW%yCL~!naYD(OIpvaE21BqafEimUDB%;fmkE zhy!FbXlO2N8fMy-TAG!CdGbc7EXP{fJl-M1E9KhyYVt<-_&3bW4u=a%jjf>U_~_%;g;%d zO#@DFN?j5icP(|toF5jdccE=MvM8h3$)kTK|M@CW2_wxaHy(}guDz&SG3FgneIr$9 zwf5#4ai z7y5UY4(y}zgBdLkq|@2neT43;6%dXH?ATCp-YkmAW#gO= zU0Z8gKIUl9PvzM;jl}2Z@JQ)G7ZdGNCySTX>XS+cBZDCmS`oj6L$A;!C_d|dU_p60 zN}i(;XnaSwlSGv^dgO z{G{!61oDkYZTeZ80rhGyJ4m}+ThtVb6G|sLc{D7~PlN@Zs!UK+=OK)5b_4kF2R9)IH=SN}M0hW~2l_rk#I>k}s2+u|AO^}$F; zsrR2lWXO=ZSltT~To$daqIVc+Y%VusOORPsq9dIzkvl0rN8cf}h*=g7965NMw32ti{nn8ejrp9ZD}zmaULm-w!tO9Y}MY zEDzQXjE?{kj=Cz$;Jn8~#EhmJSlv%bg4uurR6@m{!`IC=V9fCxj|9&AxBbX=%+LQb z<(qHySE+;y|JNBZ+A(_DX@?P4&0l2wL96?p#~a)8jXT|X@^)?WyYlKf@Y;rg?B zLQ5Fa<=4L$Fr+B}1Lpq){r|V=S#C}CyFBCEn(gV2f3-H?#Qr*XT|`bjz|2JzE1c~2 z8SfVbfp7mE;8k*NM$zsN`K~tYuQoRNSzm&IF=iU&uTU{oK*vd3-^d;Q-Elt)XHYW= zh~fWL4Fd=abeuyZ!T$|G2jUacL>Ev1mvF!y1E?B7ey&hwCrSvELSbiT=izC?yGm`6 z{0)w*VWI+Qcttrmevy1}X(wrMaX7OG9hXt`tOE+AB0&)m%q-pY5Hd2df}(;A@OSUt zagc0UtcS_|2d`vgKn{IV)jnS-ez{HZy0c{Zm|t&+MJ7wm*5Ek;0U`#JQ;4cW-cT zO~wX0FaBOd(m$wxomfT-j6#W17WRXkYrwN?zU}A)MU@I}a~v9)ynOc=DfQ3dAv*>eB|ESS z(Xkls#=`QDc!bLWSj`RQW2IscgDrc22IQ!zEi)On>Ge9Zgj~AF4Y=njtrSc;+@7Sd znQ=cZ8oiSL7=z<6h3P zEfb}&ZK*N8S42TnLOlx9;d(*Q$+G2U0TX}&N;I?7Ma)f2%|<4wCGg3pNUeAlFhl^z zGKmRMHh0tBbLCnBZh#j}rbLx})%Q9J-j5(ceEd{7gT91mmPgQ2Yh=B1YLjC;m3r_; z;^8w^(-lA7R_#{v$r>{y?$&|eU;${PHkT&^Y~@llcTmR@U_8IpkQDtbM5%ar+3ge) z&9%j0!LFtv;Op0xmM$F$jL;JNq2~PLm_xC@Gl+W|k7p!hI^A!MXA7D-df7II- zhfJy5^scU~l@b@{YIyEA)?oeSC8$uMQSCO;VA~#!kBf;Jghpv`NDdfM<1@kZ1Ls)i zR|JV%wjZ8-U(jkd_!PruVzxi>WY!g$>GE}?EjI&r#|fv)K(@>YaDoowc|)`_mIhV- z7`^#E5E1(UKyd?uwm=VIW-dmk+-T&A)j3HyI-a+ddgxZorCt^s zY82qAldCXE!g#GeuRdJdz#J!C882fNDKdzEep+(}ST)n`ws>Tz|9pDhzRoE081$g< zc(|cwXCLgE4B77H;@Q%DWtG`j9)eCe`fR@*YBFvtoeU>6+rOM``}N%s+H?+J_3h_s zpE+qflJ*)Mo!Mk|?2dUwz~e∾_%6`&13Z?R4_}y7zn+ zpwnT@odF(abry480EtTile(v-*&w?QwP?-Ja`p%g-40_c{rbA9U2=5fB@%wfL#cXw z=V~4z?#_5B$@_9T8_*h1kc6H@WNjL7?1)8F3TZGH&*kHgDpFLEnw5%EZ<-U1+2#e{6c!38#BYpeF%Co2x+(zKG}GnZNm(y4cM zh|8+zIDyJY@wFcI9|O(i8g;(5aXk#f!pWEOM|zCUe!O;9|2W?&B$a0A(C^WdCA?Bz zZI1n&TXk_`^xHliOe;KMzIyI#_jYN^b=YL_YQSN<{|j(8y`{aO&`&+L$Vsc!DcoQEQggw#QItrd z)d?Ze%~5+kDap!mipE~&80XYQNd(a|)LaUhuc05h-NoL}%>(&l0g2Xh$?X#hP~dXo z2gLmZ^!?$hMJkeh_b+qKHs`$byPaQl80_Ez!|#ZDTXyw>mz&RzHz3k+>fcam;{UFP z0 zFF7jVZg%1~;R{_ep>{r=k4{X)euJUh-iE(qJV2NUj3w<>4_CmeCFjBU%s(I(N^ujY z^Kouj(}3{g^#pJ(d({B5MZvljzz+k|%j15B=E`EJ+HO0nY?~MLN++YN4Dd^0OyqR! zuPc>^qXz6@eA?Q0wlF=qL1|?=&4H!;Uv%@?q&rUzXPYB^wgEkR3Y$|&L6OB|$-=xG z2}%(PGP2F}SZZH*G9ElT#Ag08C$N$noAlWry6~KR+}lIO!-E`kyT76?0|y+!XTrmQ zY;$z-?s}A7H^8mZ?I|rO0X8K>!YBzAn%RN5xq#W!>TQCfC8u{wEi)rEinn&Nh*4gj zO5xo4=J7H1=N6F9n#OkoyrnK~q)n_Q3Qoqy&{fL@qHeB8zIxBo_F}DKB8yM{)hFYR zv9S>ZMx!wbvOuxb7?s%p(J-7TR(yRvhGE{jH6(3e#}~sMr*Nth z)rWWcr*b#=a&$-EIuED=y<12)q?v{eA@Di|Ffeaawbd9YNtoYLDs)e9982s~Bf5S_ zX}=0KdCv8MMOk>Gl^lUWE1fUs*`Ze8#_jolWdQ;x3udOK1(})a*E@*s zB@q!2G63P?N_PpLZC=jX>P^5YfvTrMojE%y3b{Z&?hO`}uDN-j0j$yO_pOtY{#MV; z`c36-eb>TZ8btF8p+%%+|G%v=8kA6*SFDVymfwNv7C zyUB1SaAty48M`3&w%Lz5YA{wV)f$#(U~GpV@;4jTwvx>S{6pqZx=?8;ivf`t2+6-H z?#)sn73tNZ03Ml{qF5-r2{~JCjvDj0u{hT&J3C}h5+eDa#K<~S?v^{o>nUKB?s%Q} zFi0TONSq*J(jS%2=JTHUQX=gI7KJR19)&Ky*mu6>IDwhF)I_yB*~Wt#q#HP65^hQo zs0fYCxNK^7+E0sDytRbfKbq-gFK$HjI2jtn#MRxzP+X%o2BWh~R=zR6A`i*w4W!(W z-%gSviU-pUrli}atKC0xueg0$I%@!viIaZ*XDbP8dqop=WJXq33Bcn4gYtvf((8u> zg&lmuUU`KnK#AAld~KyiX=b)hg>qW>KyPnDyrXf&Y2kqjMrf*pG27-n2%ihX8Ym(5 z>|HEahX-9~OcQH$2@s{~|3iPB&Cot`I-#dq5p6Q!= zpB>&*X79nDCu5XS2#HM6b(opOQYh&&pcOG)!H*{fVKQa#$z(F;OD0>H%n{-c;mgS_ zsYzb<_XtK3Fb3wX;RuA0mqnQ|8h3#|Z&kk62U{~_W@P>83fw*#mV-qqrIi;|H0|h% zDkT%9JUeURn$bk3Lpu@Z*H(L`itb@Bm2dLi_L3#dHnjZ4xm7?YSlEaHdrV^A{B{iD z4x-#}E0mF}IHPE^7a^GLl3TTbohXUEu{=W=#p2nb1}{8V=1G2HV@acDt;%3VlfZc0cL|h~#0H_|gXp57u>zpMo+241={IRfD4)%DZT!FEu$|#fI<7FB_gH69NOM(G^~# zvO74ngc&DR`NC|7_`M*k$wXJznSx7Nx+Gu^nu|$uplEmuWC16VKoj)CpujU+%rcZG zMVIKxm%-ch78AO6BZ+KQ3q`eJ$BV%HTxob(g|gpOohux6ecjmhkn)0!oJcHGGq$Ra z*9DYe{S0p7O6)Z~IJj{Bjl?z;(1R(L0^-BFvE!3CXgxHWpnG?)#h)i=xXFxpttNsgNhKs84!od8L2ou zEi_zuUmCpctu=^ioAE~N2J0ugU7lUnwEL#~%LV(i6ZXPHR|+9>^PA#*@kgIESp%43k7K$x z9{e~afdwWC+oX`Vi^7*PWlIwUE}zY+%?2hKX6>P$o+mc$h8UY-SLJ1PY)tuC$=;Tf zZMd_pZY!1`dh5_rXVZ5lZsDdng+Y zZYW;;&h9Y>WYY%72brS1>XUW!NWzvF0?9| zyRBZyIA+h81ve-mF0Ndvo&5}bh-MkB2&dwnJ9E*GS!^S6eP@!BI|KYFs^H?{W(5k> z8eM2hHe=?KC95}-Pdh?1JAG7fn$y6VwVtoA?{~5!IyQD&bS){ZU))+-6n`TMQy~Tf6Na0dcT6)}q`N8Psa@Q-RiiMYyDup?t0Zm*o+>;BMklIaIL4(8t9V>y` z4UUDg`+-5g5KgrEkWf`!dMRHYKO9W4VzAA5(hW_=06tYkMe5?Ll8@x}dl*IXerF3~ z%hu^Uj^eeu2mG*9R8*QWP?PPOo10UZv~qmYcG*QSVUxt%G~yc6t4p(I{`il*eSL-I z8jZ^6r(;D$d&yb#kIkhM$Bku-(=R^N^ee*KeHIhjO&z;l8D)HflIxccHnLrm{4Gs- zhQf>uh(ly{y>f&;%*gD&0#xA0Mv6qkXu8USVz*S{(u}gkbKq>6ea4_s&*6Bp9I5Pr z&+XrHGKYtTxXi?GA(8ohP6s;53Rmr01=ms` z9FBNhbBqZG_t@9rfVUwb@2V=pG{aVJDCYI{mdj+cAHZYokAYuinVrl|v)NY%`%#z3 z3O#2%UjUI;2YaI{SYJ(=&}6hu2(-Nq7=))*h5+5Ra@#R)fig0IE7fD#LUnCc;c^^c z_&RGZMvbjxq*|9ZIrjD9F*tR%1LgPg?3F_(ZhwCoHvhCAS3eH2yp&x`PZ`IbS#@@G%&TZX6a4xOWC8A1sPoJv`RdOvFnHj8W@`_# z9tyuN;p-@ef*?&`VPUD`rd%oaMt-*|1JPvcuzfQXmH_|HTR*B1%K8E(KqP2)GvY&rlchUta!dJ{UsX z&wLq>3VQ6RN}ZiAy1Tm?^Q{MSry@DOp=TWms)Uv$dOa}Tn*Ve0O)?)CcYjUgsX3q{ z6BO)O>-=>2PR9G5G(qMX!j01G8j zMi%`)L4Zg;TEI=shWnU*?&0f*0qdMb!wmo34?wUZ;HE`ViT2+w4Ft;rdNHrTH0<}o z01Xij+(e^xC-m?CrX%H}W9}6)`0w$WA@9uTfN4<|>hJYeaLhft-8)0N(gIiTFXh8?&L3|SZX0QngCbYlc26PZIWZC|}x*caYUyAj1Q!7Z9{_TAgXFYsOk z&5%qG{MR_W5Ft4zpKx}ToxCJ9yVJ7Q<8c>e0+M-VY6 z`(N|4VotQlFL$0)D4RRX)qgTO5o3G(U;BiPoR03q1)&lLLE7a(mP-Gf#l?*AH9 nm5`6F7A%_P-?o8l!MuSEK`SmZTSR&U1OCK>qy@`9==%MCikZNa literal 0 HcmV?d00001 From 38dbfb256772f2fa8c6fc199b317f16d8f132203 Mon Sep 17 00:00:00 2001 From: Max Moon Date: Thu, 25 May 2023 11:47:24 -0700 Subject: [PATCH 65/89] Pipelines maintain changes after review session (#817) * address feedback from review session w Eben --- _docs-sources/pipelines/maintain/extending.md | 85 +++++++++++------- _docs-sources/pipelines/maintain/updating.md | 28 +++--- docs/pipelines/maintain/extending.md | 87 ++++++++++++------- docs/pipelines/maintain/updating.md | 30 ++++--- 4 files changed, 142 insertions(+), 88 deletions(-) diff --git a/_docs-sources/pipelines/maintain/extending.md b/_docs-sources/pipelines/maintain/extending.md index 4db2a6e284..9a03cf19e0 100644 --- a/_docs-sources/pipelines/maintain/extending.md +++ b/_docs-sources/pipelines/maintain/extending.md @@ -1,35 +1,46 @@ +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + # Extending your Pipeline -Pipelines can be extended to support building and deploying application code in many repositories. This guide demonstrates how to update which repositories are allowed to submit requests to Pipelines to build docker images. +Pipelines can be extended in several ways: +- Adding repositories to supporting building Docker images for many applications +- Updating which branches can kick off which jobs +- Adding additional build scripts that can run in Pipelines +- Adding permissions to Pipelines ## Adding a repository Pipelines has separate configurations for each type of job that can be performed (e.g., building a docker image, running terraform plan, running terraform apply). An allow-list of repos and branches is defined for each job type, which can be updated to extend your usage of pipelines to additional application repositories. -This guide focuses on building Docker images for applications repos, if you have repositories for which you would like to run `terraform plan` or `terraform apply` jobs, similar steps can be followed, modifying the appropriate task configurations. +This portion of the guide focuses on building Docker images for application repos. If you have repositories for which you would like to run `terraform plan` or `terraform apply` jobs, similar steps can be followed, modifying the appropriate task configurations. -### RefArch + + -First, define a module for your application by following the guide on [how to deploy your apps into the Reference Architecture](../../guides/reference-architecture/example-usage-guide/deploy-apps/intro). +If you’ve deployed Pipelines as a part of your Reference Architecture, we recommend following the guide on [how to deploy your apps into the Reference Architecture](../../guides/reference-architecture/example-usage-guide/deploy-apps/intro) to learn how to define a module for your application. -Next, open `shared//mgmt/ecs-deploy-runner/terragrunt.hcl` and update `docker_image_builder_config.allowed_repos` to include the HTTPS Git URL of the application repo for which you would like to deploy Docker images. +To allow Pipelines jobs to be started by events in your repository, open `shared//mgmt/ecs-deploy-runner/terragrunt.hcl` and update `docker_image_builder_config.allowed_repos` to include the HTTPS Git URL of the application repo for which you would like to deploy Docker images. Since pipelines [cannot update itself](./updating.md), you must run `terragrunt plan` and `terragrunt apply` manually to deploy the change from your local machine. Run `terragrunt plan` to inspect the changes that will be made to your pipeline. Once the changes have been reviewed, run `terragrunt apply` to deploy the changes. -### Standalone + + -If you've deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, you will need to locate the file in which you've defined a module block sourcing the `ecs-deploy-runner` service. +If you’ve deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, you will need to locate the file in which you’ve defined a module block sourcing the `ecs-deploy-runner` service. Once the `ecs-deploy-runner` module block is located, update the `allowed_repos` list in the `docker_image_builder_config` variable to include the HTTPS Git URL of the application repo for which you would like to deploy Docker images. Refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for full configuration details. Run `terraform plan` to inspect the changes that will be made to your pipeline. Once the changes have been reviewed, run `terraform apply` to deploy the changes. To deploy the application to ECS or EKS you will need to deploy a task definition (ECS) or Deployment (EKS) that references the newly built image. + + -### Adding infrastructure deployer to the new repo (RefArch & Standalone) +### Adding infrastructure deployer to the new repo -Pipelines can be triggered from Github events in many repositories. In order to configure Pipelines for the new repository, you need to add a step in your CI/CD configuration for the repository that uses the `infrastructure-deployer` CLI tool to trigger Docker image builds. +Pipelines can be triggered from GitHub events in many repositories. In order to configure Pipelines for the new repository, you need to add a step in your CI/CD configuration for the repository that uses the `infrastructure-deployer` CLI tool to trigger Docker image builds. ```sh export ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text) @@ -50,27 +61,36 @@ infrastructure-deployer --aws-region "us-east-1" -- docker-image-builder build-d Pipelines can be configured to only allow jobs to be performed on specific branches. For example, a common configuration is to allow `terraform plan` or `terragrunt plan` jobs for Pull Requests, and only allow `terraform apply` or `terragrunt apply` to run on merges to the main branch. -Depending on your use case, you may need to modify the allow-list to only allow a pre-defined list of branch names. +Depending on your use case, you may need to modify the `allowed_apply_git_refs` attribute to update the allow-list of branch names that can kick off the `plan` and `apply` jobs. + +For example, a common configuration for `apply` jobs is to specify that this job can only run on the `main` branch: +```tf +allowed_apply_git_refs = ["main", "origin/main"] +``` -### RefArch + + -Open `shared//mgmt/ecs-deploy-runner/terragrunt.hcl` and update the values the `allowed_apply_git_refs` attribute for the job configuration you would like to modify (either `terraform_planner_config` or `terraform_applier_config`). +If you’ve deployed Pipelines as a part of your Reference Architecture, open `shared//mgmt/ecs-deploy-runner/terragrunt.hcl` and update the values in the `allowed_apply_git_refs` attribute for the job configuration you would like to modify (either `terraform_planner_config` or `terraform_applier_config`). Run `terragrunt plan` to inspect the changes that will be made to your pipeline. Once the changes have been reviewed, run `terragrunt apply` to deploy the changes. -### Standalone + + -If you've deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, you will need to locate the file in which you've defined a module block sourcing the `ecs-deploy-runner` service. +If you’ve deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, you will need to locate the file in which you’ve defined a module block sourcing the `ecs-deploy-runner` service. By default, the `ecs-deploy-runner` service from the Service Catalog allows any git ref to be applied. After you locate the module block for `ecs-deploy-runner`, modify the `allowed_apply_git_refs` attribute for the job configuration that you would like to modify (either `terraform_planner_config` or `terraform_applier_config`). Run `terraform plan` to inspect the changes that will be made to your pipeline. Once the changes have been reviewed, run `terraform apply` to deploy the changes. + + -## Adding script arguments +## Adding scripts that can be run in Pipelines The `deploy-runner` Docker image for Pipelines only allows scripts within a single directory to be executed in the ECS task as an additional security measure. -By default, the `deploy-runner` ships with three scripts - one to build HashiCorp Packer images, one to run `terraform plan` and `terraform apply`, and one to automatically update the value of a variable in a Terraform tfvars or Terragrunt HCL file. +By default, the `deploy-runner` ships with three scripts — one to build HashiCorp Packer images, one to run `terraform plan` and `terraform apply`, and one to automatically update the value of a variable in a Terraform tfvars or Terragrunt HCL file. If you need to run a custom script in the `deploy-runner`, you must fork the image code, add an additional line to copy your script into directory designated by the `trigger_directory` argument. Then, you will need to rebuild the Docker image, push to ECR, then update your Pipelines deployment following the steps in [Updating Pipelines](./updating.md). @@ -78,42 +98,43 @@ If you need to run a custom script in the `deploy-runner`, you must fork the ima Pipelines executes in ECS tasks running in your AWS account(s). Each task (terraform planner, applier, docker builder, ami builder) has a distinct execution IAM role with only the permissions each task requires to complete successfully. -If you are expanding your usage of AWS to include an AWS service you've never used before, you will need to grant each job sufficient permissions to access that service. +If you are expanding your usage of AWS to include an AWS service you’ve never used before, you will need to grant each job sufficient permissions to access that service. For example, if you need to create an Amazon DynamoDB Table using Pipelines for the first time, you would want to add (at a minimum) the ability to list and describe tables to the policy for the `planner` IAM role, and all permissions for DynamoDB to the IAM policy for the `terraform-applier` IAM role. -We recommend that the `planner` configuration have read only access to resources, and the applier be able to read, create, modify, and destroy resources. +We recommend that the `planner` configuration have read-only access to resources, and the applier be able to read, create, modify, and destroy resources. -### RefArch + + -If you've deployed Pipelines as a part of your Reference Architecture, the permissions for the `terraform-planner` task are located in `_envcommon/mgmt/read_only_permissions.yml` and the permissions for the `terraform-applier` task are located in `_envcommon/mgmt/deploy_permissions.yml`. Open and add the required permissions to each file. +If you’ve deployed Pipelines as a part of your Reference Architecture, the permissions for the `terraform-planner` task are located in `_envcommon/mgmt/read_only_permissions.yml` and the permissions for the `terraform-applier` task are located in `_envcommon/mgmt/deploy_permissions.yml`. Open and add the required permissions to each file. After you are done updating both files, you will need to run `terragrunt plan`, review the changes, then `terragrunt apply` for each account in your Reference Architecture. ```sh cd logs/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner -aws-vault exec your-logs -- terragrunt apply --terragrunt-source-update -auto-approve +aws-vault exec -- terragrunt apply --terragrunt-source-update -auto-approve cd shared/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner -aws-vault exec your-shared -- terragrunt apply --terragrunt-source-update -auto-approve +aws-vault exec -- terragrunt apply --terragrunt-source-update -auto-approve cd security/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner -aws-vault exec your-security -- terragrunt apply --terragrunt-source-update -auto-approve +aws-vault exec -- terragrunt apply --terragrunt-source-update -auto-approve cd dev/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner -aws-vault exec your-dev -- terragrunt apply --terragrunt-source-update -auto-approve +aws-vault exec -- terragrunt apply --terragrunt-source-update -auto-approve cd stage/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner -aws-vault exec your-stage -- terragrunt apply --terragrunt-source-update -auto-approve +aws-vault exec -- terragrunt apply --terragrunt-source-update -auto-approve cd prod/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner -aws-vault exec your-prod -- terragrunt apply --terragrunt-source-update -auto-approve +aws-vault exec -- terragrunt apply --terragrunt-source-update -auto-approve ``` + + -### Standalone - -If you've deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, , you will need to locate the file in which you've defined a module block sourcing the `ecs-deploy-runner` service. - -Modify the AWS IAM policy document being passed into the `iam_policy` variable for the [terraform_applier_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_applier_config) and the [terraform_planner_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_planner_config) variables. +If you’ve deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, , you will need to locate the file in which you’ve defined a module block sourcing the `ecs-deploy-runner` service. -Refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for the full set of configuration details for this service. +Modify the AWS IAM policy document being passed into the `iam_policy` variable for the [`terraform_applier_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_applier_config) and the [`terraform_planner_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_planner_config) variables. Refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for the full set of configuration details for this service. After you are done updating the IAM policy documents, run `terraform plan` then review the changes that will be made. Finally, run `terraform apply` to apply the changes. + + diff --git a/_docs-sources/pipelines/maintain/updating.md b/_docs-sources/pipelines/maintain/updating.md index 4e72fb1c88..2143e73ecf 100644 --- a/_docs-sources/pipelines/maintain/updating.md +++ b/_docs-sources/pipelines/maintain/updating.md @@ -1,8 +1,11 @@ +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + # Updating Your Pipeline -Pipelines is built using the terraform-aws-ci module. We recommend updating your pipeline whenever there's a new release of the module. +Pipelines is built using the [terraform-aws-ci](../../reference/modules/terraform-aws-ci/ecs-deploy-runner/) module. We recommend updating your pipeline whenever there’s a new release of the module. -By default, Pipelines cannot update it's own infrastructure (ECS cluster, AWS Lambda function, etc). This safeguard is in place to prevent you from accidentally locking yourself out of the pipeline when applying a change to permissions. +By default, Pipelines cannot update it’s own infrastructure (ECS cluster, AWS Lambda function, etc), so you must run upgrades to Pipelines manually from your local machine. This safeguard is in place to prevent you from accidentally locking yourself out of the Pipeline when applying a change to permissions. For example, if you change the IAM permissions of the CI user, you may no longer be able to run the pipeline. The pipeline job that updates the permissions will also be affected by the change. This is a difficult scenario to recover from, since you will have lost access to make further changes using Pipelines. @@ -17,7 +20,7 @@ This guide assumes you have the following: ## Updating container images -Gruntwork Pipelines uses two images - one for the [Deploy Runner](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/docker/deploy-runner/Dockerfile) and one for [Kaniko](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/docker/kaniko/Dockerfile). To update pipelines to the latest version, you must build and push new versions of each image. +Gruntwork Pipelines uses two images — one for the [Deploy Runner](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/docker/deploy-runner/Dockerfile) and one for [Kaniko](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/docker/kaniko/Dockerfile). To update pipelines to the latest version, you must build and push new versions of each image. ### Build and push images @@ -48,15 +51,16 @@ infrastructure-deployer --aws-region "$DEPLOY_RUNNER_REGION" -- docker-image-bui --docker-image-tag "${ECR_REPO_URL}/kaniko:${TERRAFORM_AWS_CI_VERSION}" \ --build-arg "module_ci_tag=$TERRAFORM_AWS_CI_VERSION" ``` -Each image may take a few minutes to build and push, this is expected. Once both images are built, you can update the image tag in your terraform module and update the infrastructure. +Each image may take a few minutes to build and push. Once both images are built, you can update the image tag in your terraform module and update the infrastructure. ## Updating infrastructure -Next, update the references to these images to the new tag values. This will vary depending on if you're using Pipelines as configured by the Reference Architecture or if you've deployed Pipelines as a standalone framework. +Next, update the references to these images to the new tag values. This will vary depending on if you’re using Pipelines as configured by the Reference Architecture or if you’ve deployed Pipelines as a standalone framework. -### Updating tag values (RefArch) + + -Update `common.hcl` with new tag values for these images. The new tag value will be version of terraform-aws-ci that the images use. For example, if your newly created images are using the v0.52.1 release of terraform-aws-ci, update common.hcl to: +To update the image tags for pipelines deployed by a Reference Architecture, you update `common.hcl` with the new tag values for these images. The new tag value will be version of terraform-aws-ci that the images use. For example, if your newly created images are using the v0.52.1 release of terraform-aws-ci, update common.hcl to: ``` deploy_runner_container_image_tag = "v0.52.1" @@ -83,14 +87,16 @@ aws-vault exec your-stage -- terragrunt apply --terragrunt-source-update -auto-a cd prod/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner aws-vault exec your-prod -- terragrunt apply --terragrunt-source-update -auto-approve ``` + + -### Updating tag values (standalone) - -If you've deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for configuration details. You will need to update the `docker_tag` value in the `container_image` object for the [ami_builder_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#ami_builder_config), [docker_image_builder_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#docker_image_builder_config), [terraform_applier_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_applier_config), and [terraform_planner_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_planner_config) variables. +If you’ve deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for configuration details. You will need to update the `docker_tag` value in the `container_image` object for the [`ami_builder_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#ami_builder_config), [`docker_image_builder_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#docker_image_builder_config), [`terraform_applier_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_applier_config), and [`terraform_planner_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_planner_config) variables. Once you have updated any references to the container image tags, you will need to run `terraform plan` and `terraform apply` in each account where pipelines is deployed. + + ### What's next -Now that you've learned how to update your pipeline, the next step is to extend your pipeline to customize the configuration to suite your needs. +Now that you’ve learned how to update your pipeline, the next step is to extend your pipeline to customize the configuration to suit your needs. diff --git a/docs/pipelines/maintain/extending.md b/docs/pipelines/maintain/extending.md index 30b7083f33..52cb9ef089 100644 --- a/docs/pipelines/maintain/extending.md +++ b/docs/pipelines/maintain/extending.md @@ -1,35 +1,46 @@ +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + # Extending your Pipeline -Pipelines can be extended to support building and deploying application code in many repositories. This guide demonstrates how to update which repositories are allowed to submit requests to Pipelines to build docker images. +Pipelines can be extended in several ways: +- Adding repositories to supporting building Docker images for many applications +- Updating which branches can kick off which jobs +- Adding additional build scripts that can run in Pipelines +- Adding permissions to Pipelines ## Adding a repository Pipelines has separate configurations for each type of job that can be performed (e.g., building a docker image, running terraform plan, running terraform apply). An allow-list of repos and branches is defined for each job type, which can be updated to extend your usage of pipelines to additional application repositories. -This guide focuses on building Docker images for applications repos, if you have repositories for which you would like to run `terraform plan` or `terraform apply` jobs, similar steps can be followed, modifying the appropriate task configurations. +This portion of the guide focuses on building Docker images for application repos. If you have repositories for which you would like to run `terraform plan` or `terraform apply` jobs, similar steps can be followed, modifying the appropriate task configurations. -### RefArch + + -First, define a module for your application by following the guide on [how to deploy your apps into the Reference Architecture](../../guides/reference-architecture/example-usage-guide/deploy-apps/intro). +If you’ve deployed Pipelines as a part of your Reference Architecture, we recommend following the guide on [how to deploy your apps into the Reference Architecture](../../guides/reference-architecture/example-usage-guide/deploy-apps/intro) to learn how to define a module for your application. -Next, open `shared//mgmt/ecs-deploy-runner/terragrunt.hcl` and update `docker_image_builder_config.allowed_repos` to include the HTTPS Git URL of the application repo for which you would like to deploy Docker images. +To allow Pipelines jobs to be started by events in your repository, open `shared//mgmt/ecs-deploy-runner/terragrunt.hcl` and update `docker_image_builder_config.allowed_repos` to include the HTTPS Git URL of the application repo for which you would like to deploy Docker images. Since pipelines [cannot update itself](./updating.md), you must run `terragrunt plan` and `terragrunt apply` manually to deploy the change from your local machine. Run `terragrunt plan` to inspect the changes that will be made to your pipeline. Once the changes have been reviewed, run `terragrunt apply` to deploy the changes. -### Standalone + + -If you've deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, you will need to locate the file in which you've defined a module block sourcing the `ecs-deploy-runner` service. +If you’ve deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, you will need to locate the file in which you’ve defined a module block sourcing the `ecs-deploy-runner` service. Once the `ecs-deploy-runner` module block is located, update the `allowed_repos` list in the `docker_image_builder_config` variable to include the HTTPS Git URL of the application repo for which you would like to deploy Docker images. Refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for full configuration details. Run `terraform plan` to inspect the changes that will be made to your pipeline. Once the changes have been reviewed, run `terraform apply` to deploy the changes. To deploy the application to ECS or EKS you will need to deploy a task definition (ECS) or Deployment (EKS) that references the newly built image. + + -### Adding infrastructure deployer to the new repo (RefArch & Standalone) +### Adding infrastructure deployer to the new repo -Pipelines can be triggered from Github events in many repositories. In order to configure Pipelines for the new repository, you need to add a step in your CI/CD configuration for the repository that uses the `infrastructure-deployer` CLI tool to trigger Docker image builds. +Pipelines can be triggered from GitHub events in many repositories. In order to configure Pipelines for the new repository, you need to add a step in your CI/CD configuration for the repository that uses the `infrastructure-deployer` CLI tool to trigger Docker image builds. ```sh export ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text) @@ -50,27 +61,36 @@ infrastructure-deployer --aws-region "us-east-1" -- docker-image-builder build-d Pipelines can be configured to only allow jobs to be performed on specific branches. For example, a common configuration is to allow `terraform plan` or `terragrunt plan` jobs for Pull Requests, and only allow `terraform apply` or `terragrunt apply` to run on merges to the main branch. -Depending on your use case, you may need to modify the allow-list to only allow a pre-defined list of branch names. +Depending on your use case, you may need to modify the `allowed_apply_git_refs` attribute to update the allow-list of branch names that can kick off the `plan` and `apply` jobs. + +For example, a common configuration for `apply` jobs is to specify that this job can only run on the `main` branch: +```tf +allowed_apply_git_refs = ["main", "origin/main"] +``` -### RefArch + + -Open `shared//mgmt/ecs-deploy-runner/terragrunt.hcl` and update the values the `allowed_apply_git_refs` attribute for the job configuration you would like to modify (either `terraform_planner_config` or `terraform_applier_config`). +If you’ve deployed Pipelines as a part of your Reference Architecture, open `shared//mgmt/ecs-deploy-runner/terragrunt.hcl` and update the values in the `allowed_apply_git_refs` attribute for the job configuration you would like to modify (either `terraform_planner_config` or `terraform_applier_config`). Run `terragrunt plan` to inspect the changes that will be made to your pipeline. Once the changes have been reviewed, run `terragrunt apply` to deploy the changes. -### Standalone + + -If you've deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, you will need to locate the file in which you've defined a module block sourcing the `ecs-deploy-runner` service. +If you’ve deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, you will need to locate the file in which you’ve defined a module block sourcing the `ecs-deploy-runner` service. By default, the `ecs-deploy-runner` service from the Service Catalog allows any git ref to be applied. After you locate the module block for `ecs-deploy-runner`, modify the `allowed_apply_git_refs` attribute for the job configuration that you would like to modify (either `terraform_planner_config` or `terraform_applier_config`). Run `terraform plan` to inspect the changes that will be made to your pipeline. Once the changes have been reviewed, run `terraform apply` to deploy the changes. + + -## Adding script arguments +## Adding scripts that can be run in Pipelines The `deploy-runner` Docker image for Pipelines only allows scripts within a single directory to be executed in the ECS task as an additional security measure. -By default, the `deploy-runner` ships with three scripts - one to build HashiCorp Packer images, one to run `terraform plan` and `terraform apply`, and one to automatically update the value of a variable in a Terraform tfvars or Terragrunt HCL file. +By default, the `deploy-runner` ships with three scripts — one to build HashiCorp Packer images, one to run `terraform plan` and `terraform apply`, and one to automatically update the value of a variable in a Terraform tfvars or Terragrunt HCL file. If you need to run a custom script in the `deploy-runner`, you must fork the image code, add an additional line to copy your script into directory designated by the `trigger_directory` argument. Then, you will need to rebuild the Docker image, push to ECR, then update your Pipelines deployment following the steps in [Updating Pipelines](./updating.md). @@ -78,50 +98,51 @@ If you need to run a custom script in the `deploy-runner`, you must fork the ima Pipelines executes in ECS tasks running in your AWS account(s). Each task (terraform planner, applier, docker builder, ami builder) has a distinct execution IAM role with only the permissions each task requires to complete successfully. -If you are expanding your usage of AWS to include an AWS service you've never used before, you will need to grant each job sufficient permissions to access that service. +If you are expanding your usage of AWS to include an AWS service you’ve never used before, you will need to grant each job sufficient permissions to access that service. For example, if you need to create an Amazon DynamoDB Table using Pipelines for the first time, you would want to add (at a minimum) the ability to list and describe tables to the policy for the `planner` IAM role, and all permissions for DynamoDB to the IAM policy for the `terraform-applier` IAM role. -We recommend that the `planner` configuration have read only access to resources, and the applier be able to read, create, modify, and destroy resources. +We recommend that the `planner` configuration have read-only access to resources, and the applier be able to read, create, modify, and destroy resources. -### RefArch + + -If you've deployed Pipelines as a part of your Reference Architecture, the permissions for the `terraform-planner` task are located in `_envcommon/mgmt/read_only_permissions.yml` and the permissions for the `terraform-applier` task are located in `_envcommon/mgmt/deploy_permissions.yml`. Open and add the required permissions to each file. +If you’ve deployed Pipelines as a part of your Reference Architecture, the permissions for the `terraform-planner` task are located in `_envcommon/mgmt/read_only_permissions.yml` and the permissions for the `terraform-applier` task are located in `_envcommon/mgmt/deploy_permissions.yml`. Open and add the required permissions to each file. After you are done updating both files, you will need to run `terragrunt plan`, review the changes, then `terragrunt apply` for each account in your Reference Architecture. ```sh cd logs/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner -aws-vault exec your-logs -- terragrunt apply --terragrunt-source-update -auto-approve +aws-vault exec -- terragrunt apply --terragrunt-source-update -auto-approve cd shared/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner -aws-vault exec your-shared -- terragrunt apply --terragrunt-source-update -auto-approve +aws-vault exec -- terragrunt apply --terragrunt-source-update -auto-approve cd security/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner -aws-vault exec your-security -- terragrunt apply --terragrunt-source-update -auto-approve +aws-vault exec -- terragrunt apply --terragrunt-source-update -auto-approve cd dev/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner -aws-vault exec your-dev -- terragrunt apply --terragrunt-source-update -auto-approve +aws-vault exec -- terragrunt apply --terragrunt-source-update -auto-approve cd stage/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner -aws-vault exec your-stage -- terragrunt apply --terragrunt-source-update -auto-approve +aws-vault exec -- terragrunt apply --terragrunt-source-update -auto-approve cd prod/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner -aws-vault exec your-prod -- terragrunt apply --terragrunt-source-update -auto-approve +aws-vault exec -- terragrunt apply --terragrunt-source-update -auto-approve ``` + + -### Standalone - -If you've deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, , you will need to locate the file in which you've defined a module block sourcing the `ecs-deploy-runner` service. - -Modify the AWS IAM policy document being passed into the `iam_policy` variable for the [terraform_applier_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_applier_config) and the [terraform_planner_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_planner_config) variables. +If you’ve deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, , you will need to locate the file in which you’ve defined a module block sourcing the `ecs-deploy-runner` service. -Refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for the full set of configuration details for this service. +Modify the AWS IAM policy document being passed into the `iam_policy` variable for the [`terraform_applier_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_applier_config) and the [`terraform_planner_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_planner_config) variables. Refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for the full set of configuration details for this service. After you are done updating the IAM policy documents, run `terraform plan` then review the changes that will be made. Finally, run `terraform apply` to apply the changes. + + diff --git a/docs/pipelines/maintain/updating.md b/docs/pipelines/maintain/updating.md index 8ef74d3d33..1f2748cfb9 100644 --- a/docs/pipelines/maintain/updating.md +++ b/docs/pipelines/maintain/updating.md @@ -1,8 +1,11 @@ +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + # Updating Your Pipeline -Pipelines is built using the terraform-aws-ci module. We recommend updating your pipeline whenever there's a new release of the module. +Pipelines is built using the [terraform-aws-ci](../../reference/modules/terraform-aws-ci/ecs-deploy-runner/) module. We recommend updating your pipeline whenever there’s a new release of the module. -By default, Pipelines cannot update it's own infrastructure (ECS cluster, AWS Lambda function, etc). This safeguard is in place to prevent you from accidentally locking yourself out of the pipeline when applying a change to permissions. +By default, Pipelines cannot update it’s own infrastructure (ECS cluster, AWS Lambda function, etc), so you must run upgrades to Pipelines manually from your local machine. This safeguard is in place to prevent you from accidentally locking yourself out of the Pipeline when applying a change to permissions. For example, if you change the IAM permissions of the CI user, you may no longer be able to run the pipeline. The pipeline job that updates the permissions will also be affected by the change. This is a difficult scenario to recover from, since you will have lost access to make further changes using Pipelines. @@ -17,7 +20,7 @@ This guide assumes you have the following: ## Updating container images -Gruntwork Pipelines uses two images - one for the [Deploy Runner](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/docker/deploy-runner/Dockerfile) and one for [Kaniko](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/docker/kaniko/Dockerfile). To update pipelines to the latest version, you must build and push new versions of each image. +Gruntwork Pipelines uses two images — one for the [Deploy Runner](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/docker/deploy-runner/Dockerfile) and one for [Kaniko](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/docker/kaniko/Dockerfile). To update pipelines to the latest version, you must build and push new versions of each image. ### Build and push images @@ -48,15 +51,16 @@ infrastructure-deployer --aws-region "$DEPLOY_RUNNER_REGION" -- docker-image-bui --docker-image-tag "${ECR_REPO_URL}/kaniko:${TERRAFORM_AWS_CI_VERSION}" \ --build-arg "module_ci_tag=$TERRAFORM_AWS_CI_VERSION" ``` -Each image may take a few minutes to build and push, this is expected. Once both images are built, you can update the image tag in your terraform module and update the infrastructure. +Each image may take a few minutes to build and push. Once both images are built, you can update the image tag in your terraform module and update the infrastructure. ## Updating infrastructure -Next, update the references to these images to the new tag values. This will vary depending on if you're using Pipelines as configured by the Reference Architecture or if you've deployed Pipelines as a standalone framework. +Next, update the references to these images to the new tag values. This will vary depending on if you’re using Pipelines as configured by the Reference Architecture or if you’ve deployed Pipelines as a standalone framework. -### Updating tag values (RefArch) + + -Update `common.hcl` with new tag values for these images. The new tag value will be version of terraform-aws-ci that the images use. For example, if your newly created images are using the v0.52.1 release of terraform-aws-ci, update common.hcl to: +To update the image tags for pipelines deployed by a Reference Architecture, you update `common.hcl` with the new tag values for these images. The new tag value will be version of terraform-aws-ci that the images use. For example, if your newly created images are using the v0.52.1 release of terraform-aws-ci, update common.hcl to: ``` deploy_runner_container_image_tag = "v0.52.1" @@ -83,22 +87,24 @@ aws-vault exec your-stage -- terragrunt apply --terragrunt-source-update -auto-a cd prod/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner aws-vault exec your-prod -- terragrunt apply --terragrunt-source-update -auto-approve ``` + + -### Updating tag values (standalone) - -If you've deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for configuration details. You will need to update the `docker_tag` value in the `container_image` object for the [ami_builder_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#ami_builder_config), [docker_image_builder_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#docker_image_builder_config), [terraform_applier_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_applier_config), and [terraform_planner_config](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_planner_config) variables. +If you’ve deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for configuration details. You will need to update the `docker_tag` value in the `container_image` object for the [`ami_builder_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#ami_builder_config), [`docker_image_builder_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#docker_image_builder_config), [`terraform_applier_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_applier_config), and [`terraform_planner_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_planner_config) variables. Once you have updated any references to the container image tags, you will need to run `terraform plan` and `terraform apply` in each account where pipelines is deployed. + + ### What's next -Now that you've learned how to update your pipeline, the next step is to extend your pipeline to customize the configuration to suite your needs. +Now that you’ve learned how to update your pipeline, the next step is to extend your pipeline to customize the configuration to suit your needs. From c9849a5db0d6b40a4eab96f6471481afe6307810 Mon Sep 17 00:00:00 2001 From: Eugene Kolnick <34349331+eak12913@users.noreply.github.com> Date: Thu, 25 May 2023 16:05:30 -0400 Subject: [PATCH 66/89] [CORE-911] Review comments for intro section (#816) * [CORE-911] Review comments for intro section This PR has changes from the review of the new IA of the intro section. * Update _docs-sources/intro/overview/intro-to-gruntwork.md Co-authored-by: Oreoluwa Agunbiade <21035422+oredavids@users.noreply.github.com> --------- Co-authored-by: Oreoluwa Agunbiade <21035422+oredavids@users.noreply.github.com> --- .../intro/overview/intro-to-gruntwork.md | 12 +++++------ _docs-sources/intro/overview/prerequisites.md | 6 +++++- .../intro/overview/what-we-provide.md | 18 ++++++++--------- docs/intro/overview/intro-to-gruntwork.md | 14 ++++++------- docs/intro/overview/prerequisites.md | 8 ++++++-- docs/intro/overview/what-we-provide.md | 20 +++++++++---------- sidebars/intro-guide.js | 2 +- 7 files changed, 42 insertions(+), 38 deletions(-) diff --git a/_docs-sources/intro/overview/intro-to-gruntwork.md b/_docs-sources/intro/overview/intro-to-gruntwork.md index dd81dc7fa4..291e619296 100644 --- a/_docs-sources/intro/overview/intro-to-gruntwork.md +++ b/_docs-sources/intro/overview/intro-to-gruntwork.md @@ -1,14 +1,12 @@ # What we do -**Gruntwork is a "DevOps accelerator" that gets you to a world-class DevOps setup leveraging infrastructure-as-code in just a few days.** +**Gruntwork is a “DevOps accelerator” that gets you to a world-class DevOps setup leveraging infrastructure-as-code in just a few days.** -All Gruntwork products exist within a [framework](/guides/production-framework) we’ve devised specifically to emphasize DevOps industry best-practices and maximize your team’s efficiency. +Gruntwork works best for teams building new infrastructure (“greenfield”), either from scratch or as part of a migration. However, it can also be used by teams with existing infrastructure (“brownfield”) if they have sufficient DevOps experience. All Gruntwork products exist within a [framework](/guides/production-framework) we’ve devised specifically to emphasize DevOps industry best-practices and maximize your team’s efficiency. -Gruntwork works best for teams building new infrastructure ("greenfield"), either from scratch or as part of a migration. However, it can also be used by teams with existing infrastructure ("brownfield") if they have sufficient DevOps experience. - -All Gruntwork products are built on and fully compatible with [Terraform](https://terraform.io). The one exception to this is the [Gruntwork Reference Architecture](https://gruntwork.io/reference-architecture/), which uses [Terragrunt](https://terragrunt.gruntwork.io/) (one of our open source tools) to implement an end-to-end architecture. +All Gruntwork products are built on and fully compatible with [Terraform](https://terraform.io). The one exception to this is the [Gruntwork Reference Architecture](/refarch/whats-this/what-is-a-reference-architecture), which uses [Terragrunt](https://terragrunt.gruntwork.io/) (one of our open source tools) to implement an end-to-end architecture. There are two fundamental ways to engage Gruntwork: -1. **Gruntwork builds your architecture.** We generate the [Reference Architecture](https://gruntwork.io/reference-architecture/) based on your needs, deploy into your AWS accounts, and give you 100% of the code. Since you have all the code, you can extend, enhance, and customize the environment exactly according to your needs. See [the docs](/refarch/whats-this/what-is-a-reference-architecture) for more information about our Reference Architecture. -2. **Build it yourself.** The Gruntwork IaC library empowers you to construct your own bespoke architecture in record time. By mix-and-matching our [modules](/iac/overview/modules) and [services](/iac/overview/services) you can quickly define a custom architecture to suit your needs, all with the confidence of having world-class, battle-tested code running under the hood. +1. **Gruntwork builds your architecture.** We generate a Reference Architecture based on your needs, deploy into your AWS accounts, and give you 100% of the code. Since you have all the code, you can extend, enhance, and customize the environment exactly according to your needs. See [the docs](/refarch/whats-this/what-is-a-reference-architecture) for more information about our Reference Architecture. +2. **Build it yourself.** The [Gruntwork IaC library](/iac/overview/) empowers you to construct your own bespoke architecture in record time. By mix-and-matching our [modules](/iac/overview/modules) and [services](/iac/overview/services) you can quickly define a custom architecture to suit your needs, all with the confidence of having world-class, battle-tested code running under the hood. diff --git a/_docs-sources/intro/overview/prerequisites.md b/_docs-sources/intro/overview/prerequisites.md index 5f4119128f..fc2eacbe80 100644 --- a/_docs-sources/intro/overview/prerequisites.md +++ b/_docs-sources/intro/overview/prerequisites.md @@ -19,10 +19,14 @@ See [How to Manage Multiple Environments with Terraform](https://blog.gruntwork. Our code is stored in Git repositories in GitHub. You must have a working knowledge of Git via SSH (`add`, `commit`, `pull`, branches, et cetera) and GitHub (Pull requests, issues, et cetera) in order to interface with the Reference Architecture and our code library. +## Knowledge of Go, Shell, and Python + +Some of the modules we have leverage Go, Shell scripting and Python. To customize these to suit your needs, you may need to dive in and make changes. In addition, all of our automated testing is written in Go, so familiarity with Go is highly recommended. + ## AWS To be successful with the infrastructure provisioned by us, you must have a decent working knowledge of AWS, its permissions schemes ([IAM](https://aws.amazon.com/iam/)), services, and APIs. While having AWS certification is not required, it is certainly helpful. Since Gruntwork is an accelerator for your AWS infrastructure and not an abstraction layer in front of AWS, knowledge of AWS and the services you intend to use is required. ## Containerization tools like Docker and Packer -We create Docker containers throughout our code library, and use them heavily in our [Gruntwork Pipelines](https://gruntwork.io/pipelines/) product, an important piece of the Reference Architecture. Containerization is an important part of helping many companies scale in the cloud, and we’re no exception. Familiarity with creating docker images and pushing and pulling them from repositories is required. Likewise, we use Packer to build AMIs. Understanding Packer will enable you to build your own AMIs for your own infrastructure and make modifications to the infrastructure we provision for you. +We create Docker containers throughout our code library, and use them heavily in our [Gruntwork Pipelines](/pipelines/what-is-it/) product, an important piece of the Reference Architecture. Containerization is an important part of helping many companies scale in the cloud, and we’re no exception. Familiarity with creating docker images and pushing and pulling them from repositories is required. Likewise, we use Packer to build AMIs. Understanding Packer will enable you to build your own AMIs for your own infrastructure and make modifications to the infrastructure we provision for you. diff --git a/_docs-sources/intro/overview/what-we-provide.md b/_docs-sources/intro/overview/what-we-provide.md index 4643f9022d..a12027bea1 100644 --- a/_docs-sources/intro/overview/what-we-provide.md +++ b/_docs-sources/intro/overview/what-we-provide.md @@ -2,7 +2,7 @@ ## Gruntwork IaC Library -A battle-tested, production-grade _catalog_ of infrastructure code that contains the core "building blocks" of infrastructure. It includes everything you’ll need to set up: +A battle-tested, production-grade _[catalog](/iac/reference/)_ of infrastructure code that contains the core “building blocks” of infrastructure. It includes everything you’ll need to set up: - A Multi-account structure - An infrastructure CI/CD Pipeline @@ -10,14 +10,7 @@ A battle-tested, production-grade _catalog_ of infrastructure code that contains - App orchestration — ECS, EC2, Kubernetes, and more - Data storage — Aurora, Elasticache, RDS, and more - Best-practice security baselines -- _and [more…](/iac/overview)_ - -## Support - -Gruntwork offers basic and paid support options: - -- **[Community support](/support#get-support).** Get help via a [Gruntwork Community Slack](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) and our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) where we maintain healthy communities where other engineers (including Grunts) post & answer questions. -- **[Paid support](/support#paid-support-tiers).** Get help via email or a private Slack channel with response times backed by SLAs. +- _and [more…](/iac/reference/)_ ## Gruntwork Compliance @@ -39,3 +32,10 @@ An optional end-to-end, multi-account architecture that Gruntwork deploys into y - An overview of how to use the Reference Architecture Once the infrastructure is deployed, Gruntwork engineers deliver the full Infrastructure as Code to you. + +## Support + +Gruntwork offers basic and paid support options: + +- **[Community support](/support#get-support).** Get help via a [Gruntwork Community Slack](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) and our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) where we maintain healthy communities where other engineers (including Grunts) post & answer questions. +- **[Paid support](/support#paid-support-tiers).** Get help via email or a private Slack channel with response times backed by SLAs. diff --git a/docs/intro/overview/intro-to-gruntwork.md b/docs/intro/overview/intro-to-gruntwork.md index b970d87311..cc1026def2 100644 --- a/docs/intro/overview/intro-to-gruntwork.md +++ b/docs/intro/overview/intro-to-gruntwork.md @@ -1,22 +1,20 @@ # What we do -**Gruntwork is a "DevOps accelerator" that gets you to a world-class DevOps setup leveraging infrastructure-as-code in just a few days.** +**Gruntwork is a “DevOps accelerator” that gets you to a world-class DevOps setup leveraging infrastructure-as-code in just a few days.** -All Gruntwork products exist within a [framework](/guides/production-framework) we’ve devised specifically to emphasize DevOps industry best-practices and maximize your team’s efficiency. +Gruntwork works best for teams building new infrastructure (“greenfield”), either from scratch or as part of a migration. However, it can also be used by teams with existing infrastructure (“brownfield”) if they have sufficient DevOps experience. All Gruntwork products exist within a [framework](/guides/production-framework) we’ve devised specifically to emphasize DevOps industry best-practices and maximize your team’s efficiency. -Gruntwork works best for teams building new infrastructure ("greenfield"), either from scratch or as part of a migration. However, it can also be used by teams with existing infrastructure ("brownfield") if they have sufficient DevOps experience. - -All Gruntwork products are built on and fully compatible with [Terraform](https://terraform.io). The one exception to this is the [Gruntwork Reference Architecture](https://gruntwork.io/reference-architecture/), which uses [Terragrunt](https://terragrunt.gruntwork.io/) (one of our open source tools) to implement an end-to-end architecture. +All Gruntwork products are built on and fully compatible with [Terraform](https://terraform.io). The one exception to this is the [Gruntwork Reference Architecture](/refarch/whats-this/what-is-a-reference-architecture), which uses [Terragrunt](https://terragrunt.gruntwork.io/) (one of our open source tools) to implement an end-to-end architecture. There are two fundamental ways to engage Gruntwork: -1. **Gruntwork builds your architecture.** We generate the [Reference Architecture](https://gruntwork.io/reference-architecture/) based on your needs, deploy into your AWS accounts, and give you 100% of the code. Since you have all the code, you can extend, enhance, and customize the environment exactly according to your needs. See [the docs](/refarch/whats-this/what-is-a-reference-architecture) for more information about our Reference Architecture. -2. **Build it yourself.** The Gruntwork IaC library empowers you to construct your own bespoke architecture in record time. By mix-and-matching our [modules](/iac/overview/modules) and [services](/iac/overview/services) you can quickly define a custom architecture to suit your needs, all with the confidence of having world-class, battle-tested code running under the hood. +1. **Gruntwork builds your architecture.** We generate the [Reference Architecture](/refarch/whats-this/what-is-a-reference-architecture) based on your needs, deploy into your AWS accounts, and give you 100% of the code. Since you have all the code, you can extend, enhance, and customize the environment exactly according to your needs. See [the docs](/refarch/whats-this/what-is-a-reference-architecture) for more information about our Reference Architecture. +2. **Build it yourself.** The [Gruntwork IaC library](/iac/overview/) empowers you to construct your own bespoke architecture in record time. By mix-and-matching our [modules](/iac/overview/modules) and [services](/iac/overview/services) you can quickly define a custom architecture to suit your needs, all with the confidence of having world-class, battle-tested code running under the hood. diff --git a/docs/intro/overview/prerequisites.md b/docs/intro/overview/prerequisites.md index e2b2e917c3..b95edff323 100644 --- a/docs/intro/overview/prerequisites.md +++ b/docs/intro/overview/prerequisites.md @@ -19,18 +19,22 @@ See [How to Manage Multiple Environments with Terraform](https://blog.gruntwork. Our code is stored in Git repositories in GitHub. You must have a working knowledge of Git via SSH (`add`, `commit`, `pull`, branches, et cetera) and GitHub (Pull requests, issues, et cetera) in order to interface with the Reference Architecture and our code library. +## Knowledge of Go, Shell, and Python + +Some of the modules we have leverage Go, Shell scripting and Python. To customize these to suit your needs, you may need to dive in and make changes. In addition, all of our automated testing is written in Go, so familiarity with Go is highly recommended. + ## AWS To be successful with the infrastructure provisioned by us, you must have a decent working knowledge of AWS, its permissions schemes ([IAM](https://aws.amazon.com/iam/)), services, and APIs. While having AWS certification is not required, it is certainly helpful. Since Gruntwork is an accelerator for your AWS infrastructure and not an abstraction layer in front of AWS, knowledge of AWS and the services you intend to use is required. ## Containerization tools like Docker and Packer -We create Docker containers throughout our code library, and use them heavily in our [Gruntwork Pipelines](https://gruntwork.io/pipelines/) product, an important piece of the Reference Architecture. Containerization is an important part of helping many companies scale in the cloud, and we’re no exception. Familiarity with creating docker images and pushing and pulling them from repositories is required. Likewise, we use Packer to build AMIs. Understanding Packer will enable you to build your own AMIs for your own infrastructure and make modifications to the infrastructure we provision for you. +We create Docker containers throughout our code library, and use them heavily in our [Gruntwork Pipelines](/pipelines/what-is-it/) product, an important piece of the Reference Architecture. Containerization is an important part of helping many companies scale in the cloud, and we’re no exception. Familiarity with creating docker images and pushing and pulling them from repositories is required. Likewise, we use Packer to build AMIs. Understanding Packer will enable you to build your own AMIs for your own infrastructure and make modifications to the infrastructure we provision for you. diff --git a/docs/intro/overview/what-we-provide.md b/docs/intro/overview/what-we-provide.md index 4f13e6f358..cdc7eb9341 100644 --- a/docs/intro/overview/what-we-provide.md +++ b/docs/intro/overview/what-we-provide.md @@ -2,7 +2,7 @@ ## Gruntwork IaC Library -A battle-tested, production-grade _catalog_ of infrastructure code that contains the core "building blocks" of infrastructure. It includes everything you’ll need to set up: +A battle-tested, production-grade _[catalog](/iac/reference/)_ of infrastructure code that contains the core “building blocks” of infrastructure. It includes everything you’ll need to set up: - A Multi-account structure - An infrastructure CI/CD Pipeline @@ -10,14 +10,7 @@ A battle-tested, production-grade _catalog_ of infrastructure code that contains - App orchestration — ECS, EC2, Kubernetes, and more - Data storage — Aurora, Elasticache, RDS, and more - Best-practice security baselines -- _and [more…](/iac/overview)_ - -## Support - -Gruntwork offers basic and paid support options: - -- **[Community support](/support#get-support).** Get help via a [Gruntwork Community Slack](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) and our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) where we maintain healthy communities where other engineers (including Grunts) post & answer questions. -- **[Paid support](/support#paid-support-tiers).** Get help via email or a private Slack channel with response times backed by SLAs. +- _and [more…](/iac/reference/)_ ## Gruntwork Compliance @@ -40,10 +33,17 @@ An optional end-to-end, multi-account architecture that Gruntwork deploys into y Once the infrastructure is deployed, Gruntwork engineers deliver the full Infrastructure as Code to you. +## Support + +Gruntwork offers basic and paid support options: + +- **[Community support](/support#get-support).** Get help via a [Gruntwork Community Slack](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) and our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) where we maintain healthy communities where other engineers (including Grunts) post & answer questions. +- **[Paid support](/support#paid-support-tiers).** Get help via email or a private Slack channel with response times backed by SLAs. + diff --git a/sidebars/intro-guide.js b/sidebars/intro-guide.js index aafc7bf2c6..db09904f8c 100644 --- a/sidebars/intro-guide.js +++ b/sidebars/intro-guide.js @@ -1,6 +1,6 @@ const sidebar = [ { - label: "Overview", + label: "Introduction", type: "category", collapsible: false, items: [ From d12093c4d072e4060f7ee4fc070bda6c3e8cf4c4 Mon Sep 17 00:00:00 2001 From: Eugene Kolnick <34349331+eak12913@users.noreply.github.com> Date: Thu, 25 May 2023 17:20:04 -0400 Subject: [PATCH 67/89] [CORE-945] Add content to RefArch usage section (#815) * [CORE-945] Add content to RefArch usage section Co-authored-by: Oreoluwa Agunbiade <21035422+oredavids@users.noreply.github.com> --- _docs-sources/intro/overview/prerequisites.md | 2 +- .../maintain-your-refarch/add-new-account.md | 9 - .../adding-new-account.md | 291 +++++++++++ .../deploying-your-apps.md | 480 +++++++++++++++++ .../usage/maintain-your-refarch/extending.md | 23 +- .../usage/maintain-your-refarch/index.md | 8 - .../usage/maintain-your-refarch/monitoring.md | 47 ++ .../maintain-your-refarch/stay-up-to-date.md | 8 - .../staying-up-to-date.md | 13 + .../usage/maintain-your-refarch/undeploy.md | 17 - .../maintain-your-refarch/undeploying.md | 204 ++++++++ .../upgrade-terraform.md | 8 - .../usage/pipelines-integration/index.md | 95 +++- docs/intro/overview/intro-to-gruntwork.md | 4 +- docs/intro/overview/prerequisites.md | 4 +- .../maintain-your-refarch/add-new-account.md | 17 - .../adding-new-account.md | 299 +++++++++++ .../deploying-your-apps.md | 488 ++++++++++++++++++ .../usage/maintain-your-refarch/extending.md | 25 +- .../usage/maintain-your-refarch/index.md | 16 - .../usage/maintain-your-refarch/monitoring.md | 55 ++ .../maintain-your-refarch/stay-up-to-date.md | 16 - .../staying-up-to-date.md | 21 + .../usage/maintain-your-refarch/undeploy.md | 25 - .../maintain-your-refarch/undeploying.md | 212 ++++++++ .../upgrade-terraform.md | 16 - .../usage/pipelines-integration/index.md | 97 +++- sidebars/refarch.js | 14 +- static/img/refarch/slack_app_scopes.png | Bin 0 -> 77108 bytes static/img/refarch/slack_auth_token_key.png | Bin 0 -> 55034 bytes static/img/refarch/slack_oauth_tokens.png | Bin 0 -> 42632 bytes 31 files changed, 2326 insertions(+), 188 deletions(-) delete mode 100644 _docs-sources/refarch/usage/maintain-your-refarch/add-new-account.md create mode 100644 _docs-sources/refarch/usage/maintain-your-refarch/adding-new-account.md create mode 100644 _docs-sources/refarch/usage/maintain-your-refarch/deploying-your-apps.md delete mode 100644 _docs-sources/refarch/usage/maintain-your-refarch/index.md create mode 100644 _docs-sources/refarch/usage/maintain-your-refarch/monitoring.md delete mode 100644 _docs-sources/refarch/usage/maintain-your-refarch/stay-up-to-date.md create mode 100644 _docs-sources/refarch/usage/maintain-your-refarch/staying-up-to-date.md delete mode 100644 _docs-sources/refarch/usage/maintain-your-refarch/undeploy.md create mode 100644 _docs-sources/refarch/usage/maintain-your-refarch/undeploying.md delete mode 100644 _docs-sources/refarch/usage/maintain-your-refarch/upgrade-terraform.md delete mode 100644 docs/refarch/usage/maintain-your-refarch/add-new-account.md create mode 100644 docs/refarch/usage/maintain-your-refarch/adding-new-account.md create mode 100644 docs/refarch/usage/maintain-your-refarch/deploying-your-apps.md delete mode 100644 docs/refarch/usage/maintain-your-refarch/index.md create mode 100644 docs/refarch/usage/maintain-your-refarch/monitoring.md delete mode 100644 docs/refarch/usage/maintain-your-refarch/stay-up-to-date.md create mode 100644 docs/refarch/usage/maintain-your-refarch/staying-up-to-date.md delete mode 100644 docs/refarch/usage/maintain-your-refarch/undeploy.md create mode 100644 docs/refarch/usage/maintain-your-refarch/undeploying.md delete mode 100644 docs/refarch/usage/maintain-your-refarch/upgrade-terraform.md create mode 100644 static/img/refarch/slack_app_scopes.png create mode 100644 static/img/refarch/slack_auth_token_key.png create mode 100644 static/img/refarch/slack_oauth_tokens.png diff --git a/_docs-sources/intro/overview/prerequisites.md b/_docs-sources/intro/overview/prerequisites.md index fc2eacbe80..8c8565348b 100644 --- a/_docs-sources/intro/overview/prerequisites.md +++ b/_docs-sources/intro/overview/prerequisites.md @@ -29,4 +29,4 @@ To be successful with the infrastructure provisioned by us, you must have a dece ## Containerization tools like Docker and Packer -We create Docker containers throughout our code library, and use them heavily in our [Gruntwork Pipelines](/pipelines/what-is-it/) product, an important piece of the Reference Architecture. Containerization is an important part of helping many companies scale in the cloud, and we’re no exception. Familiarity with creating docker images and pushing and pulling them from repositories is required. Likewise, we use Packer to build AMIs. Understanding Packer will enable you to build your own AMIs for your own infrastructure and make modifications to the infrastructure we provision for you. +We create Docker containers throughout our code library, and use them heavily in our [Gruntwork Pipelines](/pipelines/overview/) product, an important piece of the Reference Architecture. Containerization is an important part of helping many companies scale in the cloud, and we’re no exception. Familiarity with creating docker images and pushing and pulling them from repositories is required. Likewise, we use Packer to build AMIs. Understanding Packer will enable you to build your own AMIs for your own infrastructure and make modifications to the infrastructure we provision for you. diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/add-new-account.md b/_docs-sources/refarch/usage/maintain-your-refarch/add-new-account.md deleted file mode 100644 index bbf88a7a6f..0000000000 --- a/_docs-sources/refarch/usage/maintain-your-refarch/add-new-account.md +++ /dev/null @@ -1,9 +0,0 @@ - -# Add a new AWS Account - -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. - -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. - -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. - diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/adding-new-account.md b/_docs-sources/refarch/usage/maintain-your-refarch/adding-new-account.md new file mode 100644 index 0000000000..0460ccb4b8 --- /dev/null +++ b/_docs-sources/refarch/usage/maintain-your-refarch/adding-new-account.md @@ -0,0 +1,291 @@ +# Adding a new account + +This document is a guide on how to add a new AWS account to your Reference Architecture. This is useful if you have a +need to expand the Reference Architecture with more accounts, like a test or sandbox account. + +## Create new Account in your AWS Org + +The first step to adding a new account is to create the new AWS Account in your AWS Organization. This can be done +either through the AWS Web Console, or by using the [Gruntwork CLI](https://github.com/gruntwork-io/gruntwork/). If you +are doing this via the CLI, you can run the following command to create the new account: + +```bash +gruntwork aws create --account "=" +``` + +Record the account name, AWS ID, and deploy order of the new account you just created in the +`accounts.json` file so that we can reference it throughout the process. + +### Set the deploy order + +The deploy order is the order in which the accounts are deployed when a common env file is modified (the files in +`_envcommon`). Note that the deploy order does not influence how changes to individual component configurations +(child Terragrunt configurations) are rolled out. + +Set the deploy order depending on the role that the account plays and how you want changes to be promoted across your +environment. + +General guidelines: + +- The riskier the change would be, the higher you should set the deploy order. You'll have to determine the level of + risk for each kind of change. +- The lowest deploy order should be set for `dev` and `sandbox` accounts. `dev` and `sandbox` accounts are typically the + least risky to break because they only affect internal users, and thus the impact to the business of downtime to these + accounts is limited. +- `prod` accounts should be deployed after all other app accounts (`dev`, `sandbox`, `stage`) because the risk of + downtime is higher. +- It could make sense for `prod` accounts to be deployed last, after shared services accounts (`shared`, `logs`, + `security`), but it depends on your risk level. +- Shared services accounts (`shared` and `logs`) should be deployed after the app accounts (`dev`, `sandbox`, `stage`, + `prod`). + - A potential outage in `shared` could prevent access to deploy old and new code to all of your environments (e.g., + a failed deploy of `account-baseline` could cause you to lose access to the ECR repos). This could be more + damaging than just losing access to `prod`. + - Similarly, an outage in `logs` could result in losing access to audit logs which can prevent detection of + malicious activity, or loss of compliance. +- `security` should be deployed after all other accounts. + - A potential outage in `security` could prevent loss of all access to all accounts, which will prevent you from + making any changes, which is the highest impact to your operations. Therefore we recommend deploying security + last. + +For example, suppose you have the following folder structure: + +```bash title="Infrastructure Live" +. +├── accounts.json +├── _envcommon +│ └── services +│ └── my-app.hcl +├── dev +│ └── us-east-1 +│ └── dev +│ └── services +│ └── my-app +│ └── terragrunt.hcl +│ +├── stage +│ └── us-east-1 +│ └── stage +│ └── services +│ └── my-app +│ └── terragrunt.hcl +└── prod + └── us-east-1 + └── prod + └── services + └── my-app + └── terragrunt.hcl +``` + +And suppose you had the following in your `accounts.json` file: + +```json title="accounts.json" +{ + "logs": { + "deploy_order": 5, + "id": "111111111111", + "root_user_email": "" + }, + "security": { + "deploy_order": 5, + "id": "222222222222", + "root_user_email": "" + }, + "shared": { + "deploy_order": 4, + "id": "333333333333", + "root_user_email": "" + }, + "dev": { + "deploy_order": 1, + "id": "444444444444", + "root_user_email": "" + }, + "stage": { + "deploy_order": 2, + "id": "555555555555", + "root_user_email": "" + }, + "prod": { + "deploy_order": 3, + "id": "666666666666", + "root_user_email": "" + } +} +``` + +If you make a change in `_envcommon/services/my-app.hcl`, then the Infrastructure CI/CD pipeline will proceed to run +`plan` and `apply` in the deploy order specified in the `accounts.json` file. For the example, this means that the +pipeline will run `plan` and `apply` on `dev` first, then `stage`, and then finally `prod`. If anything fails in +between, then the pipeline will halt at that point. That is, if there is an error trying to deploy to `dev`, then the +pipeline will halt without moving to `stage` or `prod`. + +If instead you made a change in `dev/us-east-1/dev/services/my-app/terragrunt.hcl` and +`prod/us-east-1/prod/services/my-app/terragrunt.hcl`, then the changes are applied simultaneously, ignoring the deploy +order. This is because a child config was updated directly, instead of the common configuration file. In this way, the +deploy order only influences the pipeline for updates to the common component configurations. + +### Configure MFA + +Once the account is created, log in using the root credentials and configure MFA using [this +document](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html#enable-virt-mfa-for-root) as a guide. + +:::caution + +It is critical to enable MFA as the root user can bypass just about any other security restrictions you put in place. + +::: + +:::tip + +Make sure you keep a paper copy of the virtual device secret key so that +you have a backup in case you lose your MFA device. + +::: + +### Create a temporary IAM User + +Once MFA is configured, set up a temporary IAM User with administrator access (the AWS managed IAM Policy +`AdministratorAccess`) and create an AWS Access key pair so you can authenticate on the command line. + +:::note + +At this point, you won't need to use the root credentials again until you are ready to delete the AWS account. + +::: + +## Update Logs, Security, and Shared accounts to allow cross account access + +In the Reference Architecture, all the AWS activity logs are configured to be streamed to a dedicated `logs` account. +This ensures that having full access to a particular account does not necessarily grant you the ability to tamper with +audit logs. + +In addition, all account access is managed by a central `security` account where the IAM Users are defined. This allows +you to manage access to accounts from a central location, and your users only need to manage a single set of AWS +credentials when accessing the environment. + +If you are sharing encrypted AMIs, then you will also need to ensure the new account has access to the KMS key that +encrypts the AMI root device. This is managed in the `shared` account baseline module. + +Finally, for the [ECS Deploy +Runner](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner) to work, the new account +needs to be able to access the secrets for accessing the remote repositories and the Docker images that back the build +runners. Both of these are stored in the `shared` account. + +In order for this setup to work for each new account that is created, the `logs`, `security`, and `shared` accounts need +to be made aware of the new account. This is handled through the `accounts.json` file in your +`infrastructure-live` repository. + +Once the `accounts.json` file is updated with the new account, you will want to grant the permissions for the new +account to access the shared resources. This can be done by running `terragrunt apply` in the `account-baseline` module +for the `logs`, `shared`, and `security` account, and the `ecr-repos` and `shared-secret-resource-policies` modules in the `shared` +account: + +```bash +(cd logs/_global/account-baseline && terragrunt apply) +(cd security/_global/account-baseline && terragrunt apply) +(cd shared/_global/account-baseline && terragrunt apply) +(cd shared/us-west-2/_regional/ecr-repos && terragrunt apply) +(cd shared/us-west-2/_regional/shared-secret-resource-policies && terragrunt apply) +``` + +Each call to apply will show you the plan for making the cross account changes. Verify the plan looks correct, and then +approve it to apply the updated cross account permissions. + +## Deploy the security baseline for the app account + +Now that the cross account access is configured, you are ready to start provisioning the new account! + +First, create a new folder for your account in `infrastructure-live`. The folder name should match the name of the AWS +account. + +Once the folder is created, create the following sub-folders and files with the following content: + +- ```json title="./infrastructure-live/account.hcl" + locals { + account_name = "" + } + ``` + +- ```bash title="./infrastructure-live/_global/region.hcl" + # Modules in the account _global folder don't live in any specific AWS region, but you still have to send the API calls + # to _some_ AWS region, so here we pick a default region to use for those API calls. + locals { + aws_region = "us-east-1" + } + ``` + +Next, copy over the `account-baseline` configuration from one of the application accounts (e.g., `dev`) and place it in +the `_global` folder: + +```bash +cp -r dev/\_global/account-baseline /\_global/account-baseline +``` + +Open the `terragrunt.hcl` file in the `account-baseline` folder and sanity check the configuration. Make sure there are +no hard coded parameters that are specific to the dev account. If you have not touched the configuration since the +Reference Architecture was deployed, you won't need to change anything. + +At this point, your folder structure for the new account should look like the following: + +```bash +. +└── new-account +├── account.hcl +└── \_global +├── region.hcl +└── account-baseline +└── terragrunt.hcl + +``` + +Once the folder structure looks correct and you have confirmed the `terragrunt.hcl` configuration is accurate, you are +ready to deploy the security baseline. Authenticate to the new account on the CLI (see [this blog +post](https://blog.gruntwork.io/a-comprehensive-guide-to-authenticating-to-aws-on-the-command-line-63656a686799) for +instructions) using the access credentials for the temporary IAM User you created above and run `terragrunt apply`. + +When running `apply`, you will see the plan for applying all the security baseline to the new account. Verify the plan +looks correct, and then approve it roll out the security baseline. + +At this point, you can now use the cross account access from the `security` account to authenticate to the new account. +Use your security account IAM User to assume the `allow-full-access-from-other-accounts` IAM Role in the new account to +confirm this. + +Once you confirm you have access to the new account from the `security` account, login using the +`allow-full-access-from-other-accounts` IAM Role and remove the temporary IAM User as you will no longer need to use it. + +## Deploy the ECS Deploy Runner + +Once the security baseline is deployed on the new account, you can deploy the ECS Deploy Runner. With the ECS Deploy +Runner, you will be able to provision new resources in the new account. + +To deploy the ECS Deploy Runner, copy the terragrunt configurations for `mgmt/vpc-mgmt` and `mgmt/ecs-deploy-runner` +from the `dev` account: + +```bash +mkdir -p /us-west-2/mgmt +cp -r dev/us-west-2/mgmt/{vpc-mgmt,ecs-deploy-runner} /us-west-2/mgmt +``` + +Be sure to open the `terragrunt.hcl` file in the copied folders and sanity check the configuration. Make sure there are +no hard coded parameters that are specific to the dev account. If you have not touched the configuration since the +Reference Architecture was deployed, you won't need to change anything. + +Once the configuration looks correct, go in to the `mgmt` folder and use `terragrunt run-all apply` to deploy the ECS +Deploy Runner: + +```bash +cd /us-west-2/mgmt && terragrunt run-all apply +``` + +:::note + +Because this uses `run-all`, the command will not pause to show you the plan. If you wish to view the plan, +run `apply` in each subfolder of the `mgmt` folder, in dependency graph order. You can see the dependency graph by using +the [graph-dependencies terragrunt +command](https://terragrunt.gruntwork.io/docs/reference/cli-options/#graph-dependencies). + +::: + +At this point, the ECS Deploy Runner is provisioned in the new account, and you can start using the Gruntwork Pipeline +to provision new infrastructure in the account. diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/deploying-your-apps.md b/_docs-sources/refarch/usage/maintain-your-refarch/deploying-your-apps.md new file mode 100644 index 0000000000..9f3119a963 --- /dev/null +++ b/_docs-sources/refarch/usage/maintain-your-refarch/deploying-your-apps.md @@ -0,0 +1,480 @@ +--- +toc_max_heading_level: 2 +--- + +import Tabs from "@theme/Tabs" +import TabItem from "@theme/TabItem" + +# Deploying your apps + +In this guide, we'll walk you through deploying a Dockerized app to the App Orchestration cluster (ECS or EKS) running in +your Reference Architecture. + +## What's already deployed + +When Gruntwork initially deploys the Reference Architecture, we deploy the +[aws-sample-app](https://github.com/gruntwork-io/aws-sample-app/) into it, configured both as a frontend (i.e., +user-facing app that returns HTML) and as a backend (i.e., an app that's only accessible internally and returns JSON). +We recommend checking out the [aws-sample-app](https://github.com/gruntwork-io/aws-sample-app/) as it is designed to +deploy seamlessly into the Reference Architecture and demonstrates many important patterns you may wish to follow in +your own apps, such as how to package your app using Docker or Packer, do service discovery for microservices and data +stores in a way that works in dev and prod, securely manage secrets such as database credentials and self-signed TLS +certificates, automatically apply schema migrations to a database, and so on. + +However, for the purposes of this guide, we will create a much simpler app from scratch so you can see how all the +pieces fit together. Start with this simple app, and then, when you're ready, start adopting the more advanced +practices from [aws-sample-app](https://github.com/gruntwork-io/aws-sample-app/). + +## Deploying another app + +For this guide, we'll use a simple Node.js app as an example, but the same principles can be applied to any app. +Below is a classic, "Hello World" starter app that listens for requests on port `8080`. For this example +walkthrough, save this file as `server.js`. + +```js title="server.js" +const express = require("express") + +// Constants +const PORT = 8080 +const HOST = "0.0.0.0" + +// App +const app = express() +app.get("/simple-web-app", (req, res) => { + res.send("Hello world\n") +}) + +app.listen(PORT, HOST) +console.log(`Running on http://${HOST}:${PORT}`) +``` + +Since we need to pull in the dependencies (like ExpressJS) to run this app, we will also need a corresponding `package.json`. Please save this file along side `server.js`. + +```js title="package.json" +{ + "name": "docker_web_app", + "version": "1.0.0", + "main": "server.js", + "scripts": { + "start": "node server.js" + }, + "dependencies": { + "express": "^4.17.2" + } +} +``` + +## Dockerizing + +In order to deploy the app, we need to Dockerize the app. If you are not familiar with the basics of Docker, we +recommend you check out our "Crash Course on Docker and Packer" from the [Gruntwork Training +Library](https://training.gruntwork.io/p/a-crash-course-on-docker-packer). + +For this guide, we will use the following `Dockerfile` to package our app into a container (see [Docker +samples](https://docs.docker.com/samples/) for how to Dockerize many popular app formats): + +```docker +FROM node:14 + +# Create app directory +WORKDIR /usr/app + +COPY package*.json ./ + +RUN npm install +COPY . . + +# Ensure that our Docker image is configured to `EXPOSE` +# the port that our app is going to need for external communication. +EXPOSE 8080 +CMD [ "npm", "start" ] +``` + +The folder structure of our sample app looks like this: + +```shell +├── server.js +├── Dockerfile +└── package.json +``` + +To build this Docker image from the `Dockerfile`, run: + +```bash +docker build -t simple-web-app:latest . +``` + +Now you can test the container to see if it is working: + +```bash +docker run --rm -p 8080:8080 simple-web-app:latest +``` + +This starts the newly built container and links port `8080` on your machine to the container's port `8080`. You should +see output like below when you run this command: + +``` +> docker_web_app@1.0.0 start /usr/app +> node server.js + +Running on http://0.0.0.0:8080 +``` + +You should now be able to hit the app by opening `localhost:8080/simple-web-app` in your browser. Try it out to verify +you get the `"Hello world"` message from the server. + +## Publishing your Docker image + +Next, let's publish those images to an [ECR repo](https://aws.amazon.com/ecr/). All ECR repos are managed in the +`shared-services` AWS account in your Reference Architecture. + +First, you'll need to create the new ECR repository. + +Create a new branch on your infrastructure-live repository: + +```bash +git checkout -b simple-web-app-repo +``` + +Open `repos.yml` in `shared/us-west-2/_regional/ecr-repos` and add the desired repository name of your app. For the +purposes of our example, let's call ours `simple-web-app`: + +```yaml +simple-web-app: +external_account_ids_with_read_access: + # NOTE: we have to comment out the directives so that the python based data merger (see the `merge-data` hook under + # blueprints in this repository) can parse this yaml file. This still works when feeding through templatefile, as it + # will interleave blank comments with the list items, which yaml handles gracefully. + # %{ for account_id in account_ids } + - "${account_id}" +# %{ endfor } +external_account_ids_with_write_access: [] +tags: {} +enable_automatic_image_scanning: true +``` + +Commit and push the change: + +```bash +git add shared/us-west-2/shared/data-stores/ecr-repos/terragrunt.hcl && git commit -m 'Added simple-web-app repo' && git push +``` + +Now open a pull request on the `simple-web-app-repo` branch. + +This will cause the ECS deploy runner pipeline to run a `terragrunt plan` and append the plan output to the body of the PR you opened. If the plan output looks correct with no errors, somebody can review and approve the PR. Once approved, you can merge, which will kick off a `terragrunt apply` on the deploy runner, creating the repo. Follow the progress through your CI server. For example, you can go to GitHub actions workflows page and tail the logs from the ECS deploy runner there. + +Once the repository exists, you can use it with the Docker image. Each repo in ECR has a URL of the format `.dkr.ecr..amazonaws.com/`. For example, an ECR repo in `us-west-2`, and an app called `simple-web-app`, the registry URL would be: + +``` +.dkr.ecr.us-west-2.amazonaws.com/simple-web-app +``` + +You can create a Docker image for this repo, with a `v1` label, as follows: + +```bash +docker tag simple-web-app:latest .dkr.ecr.us-west-2.amazonaws.com/simple-web-app:v1 +``` + +Next, authenticate your Docker client with ECR in the shared-services account: + +```bash +aws ecr get-login-password --region "us-west-2" | docker login --username AWS --password-stdin .dkr.ecr.us-west-2.amazonaws.com +``` + +And finally, push your newly tagged image to publish it: + +```bash +docker push .dkr.ecr.us-west-2.amazonaws.com/simple-web-app:v1 +``` + +## Deploying your app + + + + + +Now that you have the Docker image of your app published, the next step is to deploy it to your ECS Cluster that was +set up as part of your reference architecture deployment. + +### Setting up the Application Load Balancer + +The first step is to create an [Application Load Balancer (ALB)](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html) for the app. The ALB will be exposed to the Internet and will route incoming traffic to the app. It's possible to use a single ALB with multiple applications, but for this example, we'll create a new ALB in addition to the ALB used by the aws-sample-app. + +To set up a new ALB, you'll need to create a `terragrunt.hcl` in each app environment (that is, in dev, stage, and prod). For example, for the `stage` environment, create an `alb-simple-web-app` folder in `stage/us-west-2/networking/`. Next, you can copy over the contents of the alb `terragrunt.hcl` so you have something to start with. + +With the `terragrunt.hcl` file open, update the following parameters: + +- Set `alb_name` to your desired name: e.g., `alb-simple-web-app-stage` +- Set `domain_names` to a desired DNS name: e.g., `domain_names = ["simple-web-app-stage.example.com"]` +- Note that your domain is available in an account-level `local` variable, `local.account_vars.locals.domain_name.name`. You can thus use a string interpolation to avoid hardcoding the domain name: `domain_names = ["simple-web-app-stage.${local.account_vars.locals.domain_name.name}"]` + +That's it! + +### Setting up the ECS service + +The next step is to create a `terragrunt.hcl` file to deploy your app in each app environment (i.e. in dev, stage, +prod). To do this, we will first need to define the common inputs for deploying the `simple-web-app` service. + +Copy the file `_envcommon/services/ecs-sample-app-frontend.hcl` into a new file +`_envcommon/services/ecs-simple-web-app.hcl`. + +Next, update the following in the new `ecs-simple-web-app.hcl` configuration file: + +- Locate the `dependency "alb"` block and modify it to point to the new ALB configuration you just defined. That is, change the `config_path` to the relative path to your new ALB. e.g., `config_path = "../../networking/alb-simple-web-app"` +- Set the `service_name` local to your desired name: e.g., `simple-web-app-stage`. +- Update `ecs_node_port_mappings` to only have a map value for port 8080 +- In the `container_definitions` object, set `image` to the repo url of the just published Docker image: e.g., `.dkr.ecr.us-west-2.amazonaws.com/simple-web-app` +- Set `cpu` and `memory` to a low value like 256 and 512 +- Remove all the `environment` variables, leaving only an empty list, e.g. `environment = []` +- Remove port 8443 from the `portMappings` +- Remove the unnecessary `linuxParameters` parameter +- Remove the `iam_role_name` and `iam_policy` parameters since this simple web app doesn't need any IAM permissions + +Once the envcommon file is created, you can create the `terragrunt.hcl` file to deploy it in a specific environment. +For the purpose of this example, we will assume we want to deploy the simple web app into the `dev` account first. + +1. Create a `simple-web-app` folder in `dev/us-west-2/dev/services`. +1. Copy over the contents of the `sample-app-frontend terragrunt.hcl`. +1. Update the include path for `envcommon` to reference the new `ecs-simple-web-app.hcl` envcommon file you created + above. +1. Remove the unneeded `service_environment_variables`, `tls_secrets_manager_arn`, and `db_secrets_manager_arn` local + variables, as well as all usage of it in the file. +1. Update the `tag` local variable to reference the Docker image tag we created earlier. + +### Deploying your configuration + +The above are the minimum set of configurations that you need to deploy the app. You can take a look at [`variables.tf` +of `ecs-service`](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/main/modules/services/ecs-service) +for all the options. + +Once you've verified that everything looks fine, change to the new ALB directory you created, and run: + +```bash +terragrunt apply +``` + +This will show you the plan for adding the new ALB. Verify the plan looks correct, and then approve it to apply your ALB +configuration to create a new ALB. + +Now change to the new `services/simple-web-app` folder, and run + +```bash +terragrunt apply +``` + +Similar to applying the ALB configuration, this will show you the plan for adding the new service. Verify and approve +the plan to apply your application configuration, which will create a new ECS service along with a target group that +connects the ALB to the service. + +### Monitoring your deployment progress + +Due to the asynchronous nature of ECS deployments, a successful `terragrunt apply` does not always mean your app +was deployed successfully. The following commands will help you examine the ECS cluster from the CLI. + +First, you can find the available ECS clusters: + +```bash +aws --region us-west-2 ecs list-clusters +``` + +Armed with the available clusters, you can list the available ECS services on a cluster by running: + +```bash +aws --region us-west-2 ecs list-services --cluster +``` + +The list of services should include the new `simple-web-app` service you created. You can get more information about the service by describing it: + +``` +aws --region us-west-2 ecs describe-services --cluster --services +``` + +A healthy service should show `"status": "ACTIVE"` in the output. You can also review the list of `events` to see what has happened with the service recently. If the `status` shows something else, it's time to start debugging. + +### Debugging errors + +Sometimes, things don't go as planned. And when that happens, it's always beneficial to know how to locate the +source of the problem. + +By default, all the container logs from a `service` (`stdout` and `stderr`) are sent to CloudWatch Logs. This is ideal for +debugging situations where the container starts successfully but the service doesn't work as expected. Let's assume our +`simple-web-app` containers started successfully (which they did!) but for some reason our requests to those containers +are timing out or returning wrong content. + +1. Go to the "Logs" section of the [Cloudwatch Management Console](https://console.aws.amazon.com/cloudwatch/), click on Log groups, and look for the service in the list. For example: `/stage/ecs/simple-web-app-stage`. + +1. Click on the entry. You should be presented with a real-time log stream of the container. If your app logs to `stdout`, its logs will show up here. You can export the logs and analyze it in your preferred tool or use [CloudWatch Log Insights](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html) to query the logs directly + in the AWS web console. + + + + + +Now that you have the Docker image of your app published, the next step is to deploy it to your EKS Cluster that was +set up as part of your reference architecture deployment. + +### Setting up the Kubernetes Service + +The next step is to create a `terragrunt.hcl` file to deploy your app in each app environment (i.e. in dev, stage, +prod). To do this, we will first need to define the common inputs for deploying the `simple-web-app` service. + +Copy the file `_envcommon/services/k8s-sample-app-frontend.hcl` into a new file +`_envcommon/services/k8s-simple-web-app.hcl`. + +Next, update the following in the new `k8s-simple-web-app.hcl` configuration file: + +- Set the `service_name` local to your desired name: e.g., `simple-web-app-stage`. +- In the `container_image` object, set `repository` to the repo url of the just published Docker image: e.g., `.dkr.ecr.us-west-2.amazonaws.com/simple-web-app`. +- Update the `domain_name` to configure a DNS entry for the service: e.g., `simple-web-app.${local.account_vars.local.domain_name.name}`. +- Remove the `scratch_paths` configuration, as our simple web app does not pull in secrets dynamically. +- Remove all environment variables, leaving only an empty map: e.g. `env_vars = {}`. +- Update health check paths to reflect our new service: + + - `alb_health_check_path` + - `liveness_probe_path` + - `readiness_probe_path` + +- Remove configurations for IAM Role service account binding, as our app won't be communicating with AWS: + - `service_account_name` + - `iam_role_name` + - `eks_iam_role_for_service_accounts_config` + - `iam_role_exists` + - `iam_policy` + +Once the envcommon file is created, you can create the `terragrunt.hcl` file to deploy it in a specific environment. +For the purpose of this example, we will assume we want to deploy the simple web app into the `dev` account first. + +1. Create a `simple-web-app` folder in `dev/us-west-2/dev/services`. +1. Copy over the contents of the `k8s-sample-app-frontend terragrunt.hcl`. +1. Update the include path for `envcommon` to reference the new `ecs-simple-web-app.hcl` envcommon file you created + above. +1. Remove the unneeded `tls_secrets_manager_arn` local variables, as well as all usage of it in the file. +1. Update the `tag` input variable to reference the Docker image tag we created earlier. + +### Deploying your configuration + +The above are the minimum set of configurations that you need to deploy the app. You can take a look at [`variables.tf` +of `k8s-service`](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/main/modules/services/k8s-service) +for all the available options. + +Once you've verified that everything looks fine, change to the new `services/simple-web-app` folder, and run + +```bash +terragrunt apply +``` + +This will show you the plan for deploying your new service. Verify the plan looks correct, and then approvie it to apply +your application configuration, which will create a new Kubernetes Deployment to schedule the Pods. In the process, +Kubernetes will allocate: + +- A `Service` resource to expose the Pods under a static IP within the Kubernetes cluster. +- An `Ingress` resource to expose the Pods externally under an ALB. +- A Route 53 Subdomain that binds to the ALB endpoint. + +Once the service is fully deployed, you can hit the configured DNS entry to reach your service. + +### Monitoring your deployment progress + +Due to the asynchronous nature of Kubernetes deployments, a successful `terragrunt apply` does not always mean your app +was deployed successfully. The following commands will help you examine the deployment progress from the CLI. + +First, if you haven't done so already, configure your `kubectl` client to access the EKS cluster. You can follow the +instructions [in this section of the +docs](https://github.com/gruntwork-io/terraform-aws-eks/blob/main/core-concepts.md#how-do-i-authenticate-kubectl-to-the-eks-cluster) +to configure `kubectl`. For this guide, we will use [kubergrunt](https://github.com/gruntwork-io/kubergrunt): + +``` +kubergrunt eks configure --eks-cluster-arn ARN_OF_EKS_CLUSTER +``` + +Once `kubectl` is configured, you can query the list of deployments: + +``` +kubectl get deployments --namespace applications +``` + +The list of deployments should include the new `simple-web-app` service you created. This will show you basic status +info of the deployment: + +``` +NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE +simple-web-app 3 3 3 3 5m +``` + +A stable deployment is indicated by all statuses showing the same counts. You can get more detailed information about a +deployment using the `describe deployments` command if the numbers are not aligned: + +``` +kubectl describe deployments simple-web-app --namespace applications +``` + +See the [How do I check the status of a +rollout?](https://github.com/gruntwork-io/helm-kubernetes-services/blob/main/charts/k8s-service/README.md#how-do-i-check-the-status-of-the-rollout) +documentation for more information on getting detailed information about Kubernetes Deployments. + +### Debugging errors + +Sometimes, things don't go as planned. And when that happens, it's always beneficial to know how to locate the +source of the problem. There are two places you can look for information about a failed Pod. + +### Using kubectl + +The `kubectl` CLI is a powerful tool that helps you investigate problems with your `Pods`. + +The first step is to obtain the metadata and status of the `Pods`. To lookup information about a `Pod`, retrieve them +using `kubectl`: + +```bash +kubectl get pods \ + -l "app.kubernetes.io/name=simple-web-app,app.kubernetes.io/instance=simple-web-app" \ + --all-namespaces +``` + +This will list out all the associated `Pods` with the deployment you just made. Note that this will show you a minimal +set of information about the `Pod`. However, this is a useful way to quickly scan the scope of the damage: + +- How many `Pods` are available? Are all of them failing or just a small few? +- Are the `Pods` in a crash loop? Have they booted up successfully? +- Are the `Pods` passing health checks? + +Once you can locate your failing `Pods`, you can dig deeper by using `describe pod` to get more information about a +single `Pod`. To do this, you will first need to obtain the `Namespace` and name for the `Pod`. This information should +be available in the previous command. Using that information, you can run: + +```bash +kubectl describe pod $POD_NAME -n $POD_NAMESPACE +``` + +to output the detailed information. This includes the event logs, which indicate additional information about any +failures that has happened to the `Pod`. + +You can also retrieve logs from a `Pod` (`stdout` and `stderr`) using `kubectl`: + +``` +kubectl logs $POD_NAME -n $POD_NAMESPACE +``` + +Most cluster level issues (e.g if there is not enough capacity to schedule the `Pod`) can be triaged with this +information. However, if there are issues booting up the `Pod` or if the problems lie in your application code, you will +need to dig into the logs. + +### CloudWatch Logs + +By default, all the container logs from a `Pod` (`stdout` and `stderr`) are sent to CloudWatch Logs. This is ideal for +debugging situations where the container starts successfully but the service doesn't work as expected. Let's assume our +`simple-web-app` containers started successfully (which they did!) but for some reason our requests to those containers +are timing out or returning wrong content. + +1. Go to the "Logs" section of the [Cloudwatch Management Console](https://console.aws.amazon.com/cloudwatch/) and look for the name of the EKS cluster in the table. + +1. Clicking it should take you to a new page that displays a list of entries. Each of these correspond to a `Pod` in the + cluster, and contain the `Pod` name. Look for the one that corresponds to the failing `Pod` and click it. + +1. You should be presented with a real-time log stream of the container. If your app logs to STDOUT, its logs will show + up here. You can export the logs and analyze it in your preferred tool or use [CloudWatch Log + Insights](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html) to query the logs directly + in the AWS web console. + + + + diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/extending.md b/_docs-sources/refarch/usage/maintain-your-refarch/extending.md index 9a6ea96ae4..02b9117c57 100644 --- a/_docs-sources/refarch/usage/maintain-your-refarch/extending.md +++ b/_docs-sources/refarch/usage/maintain-your-refarch/extending.md @@ -1,8 +1,23 @@ +--- +title: "Extending your Reference Architecture" +--- -# Extending and modifying your Reference Architecture +# Extending and modifying your Reference Architecture -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. +Your Reference Architecture is delivered as a collection of IaC code. You will grow and evolve this codebase through out the lifetime of your cloud deployment. There are a few ways in which you can extend and modify your Reference Architecture: -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. +- You can immediately add any off-the-shelf Gruntwork services. +- You can create your own services using any Gruntwork modules. +- You can build your own modules and combine them into your own services. -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. +## Use Gruntwork's services + +Gruntwork provides a [_catalog_ of services](/iac/reference/) that can be added by directly referencing them in your terragrunt configuration. Check out the [Using a Service](/iac/usage/using-a-service) docs to learn how you can quickly start using our services in your own Reference Architecture. + +## Composing your own services + +If Gruntwork doesn't already have the service you are looking you may be able to use our [modules](/iac/overview/modules) and [combine them into your own bespoke new services](/iac/usage/composing-your-own-service) to accelerate your development of the functionality you need. Please check out how you can start [using modules](/iac/usage/using-a-module). + +## Build your own modules + +If Gruntwork doesn't have existing modules for the AWS services that you are trying to deploy, you can always [create and deploy your own modules](/iac/getting-started/deploying-a-module), compose them into your on bespoke services and add them to your Reference Architecture. diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/index.md b/_docs-sources/refarch/usage/maintain-your-refarch/index.md deleted file mode 100644 index bfc687aa53..0000000000 --- a/_docs-sources/refarch/usage/maintain-your-refarch/index.md +++ /dev/null @@ -1,8 +0,0 @@ -# Maintain your Reference Architecture - -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. - -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. - -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. - diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/monitoring.md b/_docs-sources/refarch/usage/maintain-your-refarch/monitoring.md new file mode 100644 index 0000000000..d6531df06d --- /dev/null +++ b/_docs-sources/refarch/usage/maintain-your-refarch/monitoring.md @@ -0,0 +1,47 @@ +# Monitoring, Alerting and Logging + +You'll want to see what's happening in your AWS account: + +## Metrics + +You can find all the metrics for your AWS account on the [CloudWatch Metrics +Page](https://console.aws.amazon.com/cloudwatch/home?#metricsV2:). + +- Most AWS services emit metrics by default, which you'll find under the "AWS Namespaces" (e.g. EC2, ECS, RDS). + +- Custom metrics show up under "Custom Namespaces." In particular, the [cloudwatch-memory-disk-metrics-scripts + module](https://github.com/gruntwork-io/terraform-aws-monitoring/tree/main/modules/metrics/) is installed on every + server to emit metrics not available from AWS by default, including memory and disk usage. You'll find these under + the "Linux System" Namespace. + +You may want to create a [Dashboard](https://console.aws.amazon.com/cloudwatch/home?#dashboards:) +with the most useful metrics for your services and have that open on a big screen at all times. + +## Alerts + +A number of alerts have been configured using the [alarms modules in +terraform-aws-monitoring](https://github.com/gruntwork-io/terraform-aws-monitoring/tree/main/modules/alarms) to notify you +in case of problems, such as a service running out of disk space or a load balancer seeing too many 5xx errors. + +- You can find all the alerts in the [CloudWatch Alarms + Page](https://console.aws.amazon.com/cloudwatch/home?#alarm:alarmFilter=ANY). + +- You can also find [Route 53 Health Checks on this page](https://console.aws.amazon.com/route53/healthchecks/home#/). + These health checks test your public endpoints from all over the globe and notify you if your services are unreachable. + +That said, you probably don't want to wait for someone to check that page before realizing something is wrong, so +instead, you should subscribe to alerts via email or text message. Go to the [SNS Topics +Page](https://console.aws.amazon.com/sns/v2/home?#/topics), select the `cloudwatch-alarms` topic, and click "Actions -> +Subscribe to topic." + +If you'd like alarm notifications to go to a Slack channel, check out the [sns-to-slack +module](https://github.com/gruntwork-io/terraform-aws-monitoring/tree/main/modules/alarms/sns-to-slack). + +## Logs + +All of your services have been configured using the [cloudwatch-log-aggregation-scripts +module](https://github.com/gruntwork-io/terraform-aws-monitoring/tree/main/modules/logs/cloudwatch-log-aggregation-scripts) +to send their logs to [CloudWatch Logs](https://console.aws.amazon.com/cloudwatch/home?#logs:). Instead of SSHing to +each server to see a log file, and worrying about losing those log files if the server fails, you can just go to the +[CloudWatch Logs Page](https://console.aws.amazon.com/cloudwatch/home?#logs:) and browse and search log events for all +your servers in near-real-time. diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/stay-up-to-date.md b/_docs-sources/refarch/usage/maintain-your-refarch/stay-up-to-date.md deleted file mode 100644 index ef9a43740d..0000000000 --- a/_docs-sources/refarch/usage/maintain-your-refarch/stay-up-to-date.md +++ /dev/null @@ -1,8 +0,0 @@ - -# Stay up to date - -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. - -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. - -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/staying-up-to-date.md b/_docs-sources/refarch/usage/maintain-your-refarch/staying-up-to-date.md new file mode 100644 index 0000000000..9a7bc47b48 --- /dev/null +++ b/_docs-sources/refarch/usage/maintain-your-refarch/staying-up-to-date.md @@ -0,0 +1,13 @@ +# Staying up to date + +Keeping you Reference Architecture up to date is important for several reasons. AWS regularly releases updates and introduces changes to its services and features. By maintaining an up-to-date IaC codebase, you can adapt to these updates seamlessly. This ensures that your architecture remains aligned with the latest best practices and takes advantage of new functionalities, security enhancements, and performance optimizations offered by AWS. + +Neglecting to keep your IaC code up to date can lead to significant challenges. When you finally reach a point where an update becomes necessary, the process can become much more cumbersome and time-consuming. Outdated code may rely on deprecated or obsolete AWS resources, configurations, or APIs, making it difficult to migrate to newer versions smoothly. In such cases, the effort required to update the codebase can be substantially higher, potentially resulting in additional costs, delays, and increased risk of errors or production outages. + +## Upgrading Terraform across your modules + +It is important to regularly update your version of Terraform to ensure you have access to the latest features, bug fixes, security patches, and performance improvements necessary for smooth infrastructure provisioning and management. + +Neglecting regular updates may lead to increased complexity and difficulty when attempting to upgrade from multiple versions behind. This was particularly true during the pre-1.0 era of Terraform where significant changes and breaking modifications were more frequent. + +https://github.com/tfutils/tfenv diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/undeploy.md b/_docs-sources/refarch/usage/maintain-your-refarch/undeploy.md deleted file mode 100644 index 2744869de2..0000000000 --- a/_docs-sources/refarch/usage/maintain-your-refarch/undeploy.md +++ /dev/null @@ -1,17 +0,0 @@ - -# Undeploy individual modules - -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. - -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. - -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. - -# Undeploy the Ref Arch - -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. - -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. - -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. - diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/undeploying.md b/_docs-sources/refarch/usage/maintain-your-refarch/undeploying.md new file mode 100644 index 0000000000..24f5ea1bb3 --- /dev/null +++ b/_docs-sources/refarch/usage/maintain-your-refarch/undeploying.md @@ -0,0 +1,204 @@ +# Undeploying your Reference Architecture + +Terraform makes it fairly easy to delete resources using the `destroy` command. This is very useful in testing and +pre-prod environments, but can also be dangerous in production environments. + +:::danger + +Be especially careful when running `destroy` in any production environment so you don't accidentally end up deleting +something you'll very much regret (e.g., a production database). + +If you delete resources, **there is no undo** + +::: + +## Prerequisites + +### Understand `force_destroy` on S3 buckets + +By default, if your Terraform code includes an S3 bucket, when you run `terraform destroy`, if that bucket contains +any content, Terraform will _not_ delete the bucket and instead will give you an error like this: + +```yaml +bucketNotEmpty: The bucket you tried to delete is not empty. You must delete all versions in the bucket. +``` + +This is a safety mechanism to ensure that you don't accidentally delete your data. + +If you are absolutely sure you want to delete the contents of an S3 bucket (remember, there's no undo!), all the +services that use S3 buckets expose a `force_destroy` setting that you can set to `true` in your `terragrunt.hcl` +files to tell that service to delete the contents of the bucket when you run `destroy`. Here's a partial list of +services that expose this variable: + +:::note + +You may not have all of these in your Reference Architecture + +::: + +- `networking/alb` +- `mgmt/openvpn-server` +- `landingzone/account-baseline-app` +- `services/k8s-service` + +### Understand module dependencies + +Gruntwork Pipelines (the CI/CD pipeline deployed with your Reference Architecture) only **supports destroying modules +that have no downstream dependencies.** + +You can destroy multiple modules only if: + +- All of them have no dependencies. +- None of them are dependent on each other. + +#### Undeploying a module with many dependencies + +As an example, most modules depend on the `vpc` module, for fetching information about the VPC using [Terragrunt `dependency` +blocks](https://terragrunt.gruntwork.io/docs/reference/config-blocks-and-attributes/#dependency) or +[aws_vpc](https://www.terraform.io/docs/providers/aws/d/vpc.html) data source. If you undeploy your `vpc` +_before_ the modules that depend on it, then any command you try to run on those other modules will fail, as their +data sources will no longer be able to fetch the VPC info! + +Therefore, you should only destroy a module if you're sure no other module depends on it! Terraform does not provide +an easy way to track these sorts of dependencies. We have configured the modules here using Terragrunt [`dependency`](https://terragrunt.gruntwork.io/docs/reference/config-blocks-and-attributes/#dependency) blocks, so use those to find dependencies between modules. + +You can check the module dependency tree with `graph-dependencies` and GraphViz: + +```bash +aws-vault exec -- terragrunt graph-dependencies | dot -Tpng > dep-graph.png +open dep-graph.png +``` + +## Undeploying a module with no dependencies using Gruntwork Pipelines + +To destroy a module with no downstream dependencies, such as `route53-private` in the `dev` environment: + +1. Update the `force_destroy` variable in `dev/us-west-2/dev/networking/route53-private/terragrunt.hcl`. + [See force_destroy section](#pre-requisite-force_destroy-on-s3-buckets). + + ```json + force_destroy = true + ``` + +1. Open a pull request for that change and verify the plan in CI. You should see a trivial change to update the + module. +1. Go through the typical git workflow to get the change merged into the main branch. +1. As CI runs on the main branch, watch for the job to be held for approval. Approve the job, and wait for the + `deployment` step to complete so that the module is fully updated with the new variable. +1. Remove the module folder from the repo. For example: + + ```bash + rm -rf dev/us-west-2/dev/networking/route53-private + ``` + +1. Open a pull request for that change and verify the plan in CI. + - Make sure the `plan -destroy` output looks accurate. + - If you are deleting multiple modules (e.g., in `dev`, `stage`, and `prod`) you should see multiple plan + outputs -- one per folder deleted. You'll need to scroll through the plan output to see all of them, as + it runs `plan -destroy` for each folder individually. +1. Go through the typical git workflow to get the change merged into the main branch. +1. As CI runs on the main branch, watch for the job to be held for approval. Approve the job, and wait for the + `deployment` step to complete so that the module is fully _deleted_. +1. [Remove the Terraform state](#removing-the-terraform-state). +1. Repeat this process for upstream dependencies you may now want to destroy, always starting from the + modules that have no existing downstream dependencies. + +### Manually undeploying a single module + +You can also bypass the CI/CD pipeline and run destroy locally. For example: + +```bash +cd stage/us-west-2/stage/services/sample-app-frontend +terragrunt destroy +``` + +## Manually undeploying multiple modules or an entire environment + +_If you are absolutely sure you want to run destroy on multiple modules or an entire environment_, you can use the `destroy-all` command. For example, to undeploy the entire staging environment, you'd run: + +:::danger + +This operation cannot be undone! + +::: + +```bash +cd stage +terragrunt destroy-all +``` + +Terragrunt will then run `terragrunt destroy` in each subfolder of the current working directory, processing them in +reverse order based on the dependencies you define in the `terragrunt.hcl` files. + +To avoid interactive prompts from Terragrunt (use very carefully!!), add the `--terragrunt-non-interactive` flag: + +```bash +cd stage +terragrunt destroy-all --terragrunt-non-interactive +``` + +To undeploy everything except a couple specific sub-folders, add the `--terragrunt-exclude-dir` flag. For example, to +run `destroy` in each subfolder of the `stage` environment except MySQL and Redis, you'd run: + +``` +cd stage +terragrunt destroy-all \ + --terragrunt-exclude-dir stage/us-east-1/stage/data-stores/mysql \ + --terragrunt-exclude-dir stage/us-east-1/stage/data-stores/redis +``` + +## Removing the Terraform state + +:::danger + +Deleting state means that you lose the ability to manage your current Terraform resources! Be sure to only delete once you have confirmed all resources are destroyed. + +::: + +Once all the resources for an environment have been destroyed, you can remove the state objects managed by `terragrunt`. +The Reference Architecture manages state for each environment in an S3 bucket in each environment's AWS account. +Additionally, to prevent concurrent access to the state, it also utilizes a DynamoDB table to manage locks. + +To delete the state objects, login to the console and look for the S3 bucket in the environment you wish to undeploy. It +should begin with your company's name and end with `terraform-state`. Also look for a DynamoDB +table named `terraform-locks`. You can safely remove both **once you have confirmed all the resources have been +destroyed successfully**. + +## Useful tips + +- **Destroy resources in groups instead of all at once.** + + - There are [known instabilities](#known-errors) with destroying many modules at once. In addition, Terragrunt is + designed to process the modules in a graph, and will not continue on if there is an error. This means that you + could run into situations where Terragrunt has destroyed a module, but returns an error due to Terraform bugs that + prevent you from cleanly calling destroy twice. + - To address these instabilities, it is recommended to destroy the resources in groups. For example, you can start + by destroying all the services first (e.g., `stage/REGION/stage/services`), then the data stores (e.g., + `stage/REGION/stage/data-stores`), and finally the networking resources (e.g., `stage/REGION/stage/networking`). + - When identifying groups to destroy, use [terragrunt + graph-dependencies](https://terragrunt.gruntwork.io/docs/reference/cli-options/#graph-dependencies) to view the + dependency graph so that you destroy the modules in the right order. + +- **Empty + Delete S3 buckets using the web console (when destroying whole environments).** + - As mentioned in [Pre-requisite: force_destroy on S3 buckets](#pre-requisite-force_destroy-on-s3-buckets), it is + recommended to set `force_destroy = true` prior to running destroy so that Terraform can destroy the S3 buckets. + However, this can be cumbersome if you are destroying whole environments, as it can be difficult to flip the bit in + every single module. + - Alternatively, it is often faster and more convenient to empty and delete the buckets using the AWS web console before executing the `destroy` command with `terragrunt`. + - **IMPORTANT**: You should only do this if you are intending on destroying an entire environment. Otherwise, it is + too easy to accidentally delete the wrong S3 bucket. + +## Known Terraform errors + +If your `destroy` fails with: + +``` +variable "xxx" is nil, but no error was reported +``` + +Terraform has a couple bugs ([18197](https://github.com/hashicorp/terraform/issues/18197) and +[17862](https://github.com/hashicorp/terraform/issues/17862)) that may give this error when you run +`destroy`. + +This usually happens when the module already had `destroy` called on it previously and you re-run `destroy`. In this +case, your best bet is to skip over that module with the `--terragrunt-exclude-dir` (more details: [here](https://terragrunt.gruntwork.io/docs/reference/cli-options/#terragrunt-exclude-dir)). diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/upgrade-terraform.md b/_docs-sources/refarch/usage/maintain-your-refarch/upgrade-terraform.md deleted file mode 100644 index d8a806eff1..0000000000 --- a/_docs-sources/refarch/usage/maintain-your-refarch/upgrade-terraform.md +++ /dev/null @@ -1,8 +0,0 @@ - -# Upgrade Terraform across your modules - -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. - -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. - -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. diff --git a/_docs-sources/refarch/usage/pipelines-integration/index.md b/_docs-sources/refarch/usage/pipelines-integration/index.md index edc9308b80..eb9b36d383 100644 --- a/_docs-sources/refarch/usage/pipelines-integration/index.md +++ b/_docs-sources/refarch/usage/pipelines-integration/index.md @@ -1,29 +1,98 @@ # Pipelines integration -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. +CI/CD is a crucial tool for ensuring the smooth iteration and consistent delivery of Infrastructure as Code (IaC) to production environments. By adopting CI/CD practices, teams can automate the process of integrating and testing changes made to IaC code, allowing for frequent and reliable updates. With CI/CD, each change to the IaC codebase triggers an automated build process, ensuring that any new additions or modifications are properly incorporated. This enables developers to catch errors and conflicts early, facilitating collaboration and reducing the likelihood of issues surfacing during deployment. -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +Gruntwork Pipelines is a framework that enables you to use your preferred CI tool to securely run an end-to-end pipeline for infrastructure code (Terraform) and app code (Docker or Packer). Rather than replace your existing CI/CD provider, Gruntwork Pipelines is designed to enhance the security of your existing tool. For more information please see the [full pipelines documentation](/pipelines/overview/). -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +In the guide below, we walk through how to configure Gruntwork Pipelines in your CI/CD. -## Step 1: Set up machine user creds +## Set up machine user credentials -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. +### Get the machine user credentials from AWS -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +1. Log into the Security account in the AWS Console. +1. Go into IAM and find the ci-machine-user under Users. +1. Go to Security Credentials > Access Keys > Create Access Key. +1. Save these values as the `AWS_ACCESS_KEY_ID` and the `AWS_SECRET_ACCESS_KEY` Environment Variables in CircleCI. + + | Env var name | Value | + | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | + | AWS_ACCESS_KEY_ID | The Access Key generated for the machine user in the Security account. | + | AWS_SECRET_ACCESS_KEY | The Secret Key generated for the machine user in the Security account. | + | GITHUB_OAUTH_TOKEN | Enter the MachineUserGitHubPAT here. You can find this in `reference-architecture-form.yml` or in the shared account's Secrets Manager. | ## Verify: Testing an infrastructure change end to end -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. +You can verify the pipeline by making a change to one of the modules. For example, follow the steps below to extend the +number of replicas in the sample app: + +1. Create a new branch in the `infrastructure-live` repo. + `git checkout -B add-replica-to-sample-app`. +1. Open the file `dev/us-west-2/dev/services/sample-app-frontend` in your editor. +1. Change the input variable `desired_number_of_tasks` to `2`. +1. Commit the change. + `git commit -a`. +1. Push the branch to GitHub and open a PR. + `git push add-replica-to-sample-app` +1. Login to CircleCI. Navigate to your infrastructure-live project. +1. Click on the new pipeline job for the branch `add-replica-to-sample-app` to see the build log. +1. Verify the `plan`. Make sure that the change corresponds to adding a new replica to the ECS service. +1. When satisfied with the plan, merge the PR into `main`. +1. Go back to the project and verify that a new build is started on the `main` branch. +1. Wait for the `plan` to finish. The build should hold for approval. +1. Approve the deployment by clicking `Approve`. +1. Wait for the `apply` to finish. +1. Login to the AWS console and verify the ECS service now has 2 replicas. + +## (Optional) Configure Slack notifications + +### Create a Slack App + +1. Visit [your apps](https://api.slack.com/apps) on the Slack API website, and click `Create New App`. +1. Name your application (e.g., `CircleCI` or `CircleCI-Pipeline`). +1. Then select the Slack workspace in which to install this app. + +### Set Permissions + +On the next page select the "Permissions" area, and add these 3 "scopes". + +- `chat:write` +- `chat:write.public` +- `files:write` + +

+Slack App Scopes +Slack App Scopes +

+ +### Install and Receive Token + +Install the application into the Slack workspace and save your OAuth Access Token. This will be used in +a CircleCI environment variable. + +

+Slack OAuth Tokens +Slack OAuth Tokens +

-Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +

+Slack OAuth Access Token +Slack OAuth Access Token +

-Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +### Choose a Slack channel to notify -## (Optional) Configure Slack notifications +1. Choose or create a Slack channel in your workspace to notify with pipeline updates. +1. Right-click the channel name. You'll see a context menu. +1. Select `Copy link`. +1. Extract the Channel ID from the URL copied. E.g., `https://.slack.com/archives/` -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. +### Create env vars on CircleCI -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +1. Login to CircleCI. Navigate to Project Settings -> Environment Variables. +1. Configure the following environment variables: -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + | Env var name | Value | + | --------------------- | ----------------------------------------------------------------- | + | SLACK_ACCESS_TOKEN | The OAuth token acquired through the previous step. | + | SLACK_DEFAULT_CHANNEL | If no channel ID is specified, the app will attempt to post here. | diff --git a/docs/intro/overview/intro-to-gruntwork.md b/docs/intro/overview/intro-to-gruntwork.md index cc1026def2..72857f44b2 100644 --- a/docs/intro/overview/intro-to-gruntwork.md +++ b/docs/intro/overview/intro-to-gruntwork.md @@ -8,13 +8,13 @@ All Gruntwork products are built on and fully compatible with [Terraform](https: There are two fundamental ways to engage Gruntwork: -1. **Gruntwork builds your architecture.** We generate the [Reference Architecture](/refarch/whats-this/what-is-a-reference-architecture) based on your needs, deploy into your AWS accounts, and give you 100% of the code. Since you have all the code, you can extend, enhance, and customize the environment exactly according to your needs. See [the docs](/refarch/whats-this/what-is-a-reference-architecture) for more information about our Reference Architecture. +1. **Gruntwork builds your architecture.** We generate a Reference Architecture based on your needs, deploy into your AWS accounts, and give you 100% of the code. Since you have all the code, you can extend, enhance, and customize the environment exactly according to your needs. See [the docs](/refarch/whats-this/what-is-a-reference-architecture) for more information about our Reference Architecture. 2. **Build it yourself.** The [Gruntwork IaC library](/iac/overview/) empowers you to construct your own bespoke architecture in record time. By mix-and-matching our [modules](/iac/overview/modules) and [services](/iac/overview/services) you can quickly define a custom architecture to suit your needs, all with the confidence of having world-class, battle-tested code running under the hood. diff --git a/docs/intro/overview/prerequisites.md b/docs/intro/overview/prerequisites.md index b95edff323..ae8d8dcc8b 100644 --- a/docs/intro/overview/prerequisites.md +++ b/docs/intro/overview/prerequisites.md @@ -29,12 +29,12 @@ To be successful with the infrastructure provisioned by us, you must have a dece ## Containerization tools like Docker and Packer -We create Docker containers throughout our code library, and use them heavily in our [Gruntwork Pipelines](/pipelines/what-is-it/) product, an important piece of the Reference Architecture. Containerization is an important part of helping many companies scale in the cloud, and we’re no exception. Familiarity with creating docker images and pushing and pulling them from repositories is required. Likewise, we use Packer to build AMIs. Understanding Packer will enable you to build your own AMIs for your own infrastructure and make modifications to the infrastructure we provision for you. +We create Docker containers throughout our code library, and use them heavily in our [Gruntwork Pipelines](/pipelines/overview/) product, an important piece of the Reference Architecture. Containerization is an important part of helping many companies scale in the cloud, and we’re no exception. Familiarity with creating docker images and pushing and pulling them from repositories is required. Likewise, we use Packer to build AMIs. Understanding Packer will enable you to build your own AMIs for your own infrastructure and make modifications to the infrastructure we provision for you. diff --git a/docs/refarch/usage/maintain-your-refarch/add-new-account.md b/docs/refarch/usage/maintain-your-refarch/add-new-account.md deleted file mode 100644 index 71c6b21e59..0000000000 --- a/docs/refarch/usage/maintain-your-refarch/add-new-account.md +++ /dev/null @@ -1,17 +0,0 @@ - -# Add a new AWS Account - -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. - -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. - -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. - - - - diff --git a/docs/refarch/usage/maintain-your-refarch/adding-new-account.md b/docs/refarch/usage/maintain-your-refarch/adding-new-account.md new file mode 100644 index 0000000000..6d88fae940 --- /dev/null +++ b/docs/refarch/usage/maintain-your-refarch/adding-new-account.md @@ -0,0 +1,299 @@ +# Adding a new account + +This document is a guide on how to add a new AWS account to your Reference Architecture. This is useful if you have a +need to expand the Reference Architecture with more accounts, like a test or sandbox account. + +## Create new Account in your AWS Org + +The first step to adding a new account is to create the new AWS Account in your AWS Organization. This can be done +either through the AWS Web Console, or by using the [Gruntwork CLI](https://github.com/gruntwork-io/gruntwork/). If you +are doing this via the CLI, you can run the following command to create the new account: + +```bash +gruntwork aws create --account "=" +``` + +Record the account name, AWS ID, and deploy order of the new account you just created in the +`accounts.json` file so that we can reference it throughout the process. + +### Set the deploy order + +The deploy order is the order in which the accounts are deployed when a common env file is modified (the files in +`_envcommon`). Note that the deploy order does not influence how changes to individual component configurations +(child Terragrunt configurations) are rolled out. + +Set the deploy order depending on the role that the account plays and how you want changes to be promoted across your +environment. + +General guidelines: + +- The riskier the change would be, the higher you should set the deploy order. You'll have to determine the level of + risk for each kind of change. +- The lowest deploy order should be set for `dev` and `sandbox` accounts. `dev` and `sandbox` accounts are typically the + least risky to break because they only affect internal users, and thus the impact to the business of downtime to these + accounts is limited. +- `prod` accounts should be deployed after all other app accounts (`dev`, `sandbox`, `stage`) because the risk of + downtime is higher. +- It could make sense for `prod` accounts to be deployed last, after shared services accounts (`shared`, `logs`, + `security`), but it depends on your risk level. +- Shared services accounts (`shared` and `logs`) should be deployed after the app accounts (`dev`, `sandbox`, `stage`, + `prod`). + - A potential outage in `shared` could prevent access to deploy old and new code to all of your environments (e.g., + a failed deploy of `account-baseline` could cause you to lose access to the ECR repos). This could be more + damaging than just losing access to `prod`. + - Similarly, an outage in `logs` could result in losing access to audit logs which can prevent detection of + malicious activity, or loss of compliance. +- `security` should be deployed after all other accounts. + - A potential outage in `security` could prevent loss of all access to all accounts, which will prevent you from + making any changes, which is the highest impact to your operations. Therefore we recommend deploying security + last. + +For example, suppose you have the following folder structure: + +```bash title="Infrastructure Live" +. +├── accounts.json +├── _envcommon +│ └── services +│ └── my-app.hcl +├── dev +│ └── us-east-1 +│ └── dev +│ └── services +│ └── my-app +│ └── terragrunt.hcl +│ +├── stage +│ └── us-east-1 +│ └── stage +│ └── services +│ └── my-app +│ └── terragrunt.hcl +└── prod + └── us-east-1 + └── prod + └── services + └── my-app + └── terragrunt.hcl +``` + +And suppose you had the following in your `accounts.json` file: + +```json title="accounts.json" +{ + "logs": { + "deploy_order": 5, + "id": "111111111111", + "root_user_email": "" + }, + "security": { + "deploy_order": 5, + "id": "222222222222", + "root_user_email": "" + }, + "shared": { + "deploy_order": 4, + "id": "333333333333", + "root_user_email": "" + }, + "dev": { + "deploy_order": 1, + "id": "444444444444", + "root_user_email": "" + }, + "stage": { + "deploy_order": 2, + "id": "555555555555", + "root_user_email": "" + }, + "prod": { + "deploy_order": 3, + "id": "666666666666", + "root_user_email": "" + } +} +``` + +If you make a change in `_envcommon/services/my-app.hcl`, then the Infrastructure CI/CD pipeline will proceed to run +`plan` and `apply` in the deploy order specified in the `accounts.json` file. For the example, this means that the +pipeline will run `plan` and `apply` on `dev` first, then `stage`, and then finally `prod`. If anything fails in +between, then the pipeline will halt at that point. That is, if there is an error trying to deploy to `dev`, then the +pipeline will halt without moving to `stage` or `prod`. + +If instead you made a change in `dev/us-east-1/dev/services/my-app/terragrunt.hcl` and +`prod/us-east-1/prod/services/my-app/terragrunt.hcl`, then the changes are applied simultaneously, ignoring the deploy +order. This is because a child config was updated directly, instead of the common configuration file. In this way, the +deploy order only influences the pipeline for updates to the common component configurations. + +### Configure MFA + +Once the account is created, log in using the root credentials and configure MFA using [this +document](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html#enable-virt-mfa-for-root) as a guide. + +:::caution + +It is critical to enable MFA as the root user can bypass just about any other security restrictions you put in place. + +::: + +:::tip + +Make sure you keep a paper copy of the virtual device secret key so that +you have a backup in case you lose your MFA device. + +::: + +### Create a temporary IAM User + +Once MFA is configured, set up a temporary IAM User with administrator access (the AWS managed IAM Policy +`AdministratorAccess`) and create an AWS Access key pair so you can authenticate on the command line. + +:::note + +At this point, you won't need to use the root credentials again until you are ready to delete the AWS account. + +::: + +## Update Logs, Security, and Shared accounts to allow cross account access + +In the Reference Architecture, all the AWS activity logs are configured to be streamed to a dedicated `logs` account. +This ensures that having full access to a particular account does not necessarily grant you the ability to tamper with +audit logs. + +In addition, all account access is managed by a central `security` account where the IAM Users are defined. This allows +you to manage access to accounts from a central location, and your users only need to manage a single set of AWS +credentials when accessing the environment. + +If you are sharing encrypted AMIs, then you will also need to ensure the new account has access to the KMS key that +encrypts the AMI root device. This is managed in the `shared` account baseline module. + +Finally, for the [ECS Deploy +Runner](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner) to work, the new account +needs to be able to access the secrets for accessing the remote repositories and the Docker images that back the build +runners. Both of these are stored in the `shared` account. + +In order for this setup to work for each new account that is created, the `logs`, `security`, and `shared` accounts need +to be made aware of the new account. This is handled through the `accounts.json` file in your +`infrastructure-live` repository. + +Once the `accounts.json` file is updated with the new account, you will want to grant the permissions for the new +account to access the shared resources. This can be done by running `terragrunt apply` in the `account-baseline` module +for the `logs`, `shared`, and `security` account, and the `ecr-repos` and `shared-secret-resource-policies` modules in the `shared` +account: + +```bash +(cd logs/_global/account-baseline && terragrunt apply) +(cd security/_global/account-baseline && terragrunt apply) +(cd shared/_global/account-baseline && terragrunt apply) +(cd shared/us-west-2/_regional/ecr-repos && terragrunt apply) +(cd shared/us-west-2/_regional/shared-secret-resource-policies && terragrunt apply) +``` + +Each call to apply will show you the plan for making the cross account changes. Verify the plan looks correct, and then +approve it to apply the updated cross account permissions. + +## Deploy the security baseline for the app account + +Now that the cross account access is configured, you are ready to start provisioning the new account! + +First, create a new folder for your account in `infrastructure-live`. The folder name should match the name of the AWS +account. + +Once the folder is created, create the following sub-folders and files with the following content: + +- ```json title="./infrastructure-live/account.hcl" + locals { + account_name = "" + } + ``` + +- ```bash title="./infrastructure-live/_global/region.hcl" + # Modules in the account _global folder don't live in any specific AWS region, but you still have to send the API calls + # to _some_ AWS region, so here we pick a default region to use for those API calls. + locals { + aws_region = "us-east-1" + } + ``` + +Next, copy over the `account-baseline` configuration from one of the application accounts (e.g., `dev`) and place it in +the `_global` folder: + +```bash +cp -r dev/\_global/account-baseline /\_global/account-baseline +``` + +Open the `terragrunt.hcl` file in the `account-baseline` folder and sanity check the configuration. Make sure there are +no hard coded parameters that are specific to the dev account. If you have not touched the configuration since the +Reference Architecture was deployed, you won't need to change anything. + +At this point, your folder structure for the new account should look like the following: + +```bash +. +└── new-account +├── account.hcl +└── \_global +├── region.hcl +└── account-baseline +└── terragrunt.hcl + +``` + +Once the folder structure looks correct and you have confirmed the `terragrunt.hcl` configuration is accurate, you are +ready to deploy the security baseline. Authenticate to the new account on the CLI (see [this blog +post](https://blog.gruntwork.io/a-comprehensive-guide-to-authenticating-to-aws-on-the-command-line-63656a686799) for +instructions) using the access credentials for the temporary IAM User you created above and run `terragrunt apply`. + +When running `apply`, you will see the plan for applying all the security baseline to the new account. Verify the plan +looks correct, and then approve it roll out the security baseline. + +At this point, you can now use the cross account access from the `security` account to authenticate to the new account. +Use your security account IAM User to assume the `allow-full-access-from-other-accounts` IAM Role in the new account to +confirm this. + +Once you confirm you have access to the new account from the `security` account, login using the +`allow-full-access-from-other-accounts` IAM Role and remove the temporary IAM User as you will no longer need to use it. + +## Deploy the ECS Deploy Runner + +Once the security baseline is deployed on the new account, you can deploy the ECS Deploy Runner. With the ECS Deploy +Runner, you will be able to provision new resources in the new account. + +To deploy the ECS Deploy Runner, copy the terragrunt configurations for `mgmt/vpc-mgmt` and `mgmt/ecs-deploy-runner` +from the `dev` account: + +```bash +mkdir -p /us-west-2/mgmt +cp -r dev/us-west-2/mgmt/{vpc-mgmt,ecs-deploy-runner} /us-west-2/mgmt +``` + +Be sure to open the `terragrunt.hcl` file in the copied folders and sanity check the configuration. Make sure there are +no hard coded parameters that are specific to the dev account. If you have not touched the configuration since the +Reference Architecture was deployed, you won't need to change anything. + +Once the configuration looks correct, go in to the `mgmt` folder and use `terragrunt run-all apply` to deploy the ECS +Deploy Runner: + +```bash +cd /us-west-2/mgmt && terragrunt run-all apply +``` + +:::note + +Because this uses `run-all`, the command will not pause to show you the plan. If you wish to view the plan, +run `apply` in each subfolder of the `mgmt` folder, in dependency graph order. You can see the dependency graph by using +the [graph-dependencies terragrunt +command](https://terragrunt.gruntwork.io/docs/reference/cli-options/#graph-dependencies). + +::: + +At this point, the ECS Deploy Runner is provisioned in the new account, and you can start using the Gruntwork Pipeline +to provision new infrastructure in the account. + + + diff --git a/docs/refarch/usage/maintain-your-refarch/deploying-your-apps.md b/docs/refarch/usage/maintain-your-refarch/deploying-your-apps.md new file mode 100644 index 0000000000..539fcf5d70 --- /dev/null +++ b/docs/refarch/usage/maintain-your-refarch/deploying-your-apps.md @@ -0,0 +1,488 @@ +--- +toc_max_heading_level: 2 +--- + +import Tabs from "@theme/Tabs" +import TabItem from "@theme/TabItem" + +# Deploying your apps + +In this guide, we'll walk you through deploying a Dockerized app to the App Orchestration cluster (ECS or EKS) running in +your Reference Architecture. + +## What's already deployed + +When Gruntwork initially deploys the Reference Architecture, we deploy the +[aws-sample-app](https://github.com/gruntwork-io/aws-sample-app/) into it, configured both as a frontend (i.e., +user-facing app that returns HTML) and as a backend (i.e., an app that's only accessible internally and returns JSON). +We recommend checking out the [aws-sample-app](https://github.com/gruntwork-io/aws-sample-app/) as it is designed to +deploy seamlessly into the Reference Architecture and demonstrates many important patterns you may wish to follow in +your own apps, such as how to package your app using Docker or Packer, do service discovery for microservices and data +stores in a way that works in dev and prod, securely manage secrets such as database credentials and self-signed TLS +certificates, automatically apply schema migrations to a database, and so on. + +However, for the purposes of this guide, we will create a much simpler app from scratch so you can see how all the +pieces fit together. Start with this simple app, and then, when you're ready, start adopting the more advanced +practices from [aws-sample-app](https://github.com/gruntwork-io/aws-sample-app/). + +## Deploying another app + +For this guide, we'll use a simple Node.js app as an example, but the same principles can be applied to any app. +Below is a classic, "Hello World" starter app that listens for requests on port `8080`. For this example +walkthrough, save this file as `server.js`. + +```js title="server.js" +const express = require("express") + +// Constants +const PORT = 8080 +const HOST = "0.0.0.0" + +// App +const app = express() +app.get("/simple-web-app", (req, res) => { + res.send("Hello world\n") +}) + +app.listen(PORT, HOST) +console.log(`Running on http://${HOST}:${PORT}`) +``` + +Since we need to pull in the dependencies (like ExpressJS) to run this app, we will also need a corresponding `package.json`. Please save this file along side `server.js`. + +```js title="package.json" +{ + "name": "docker_web_app", + "version": "1.0.0", + "main": "server.js", + "scripts": { + "start": "node server.js" + }, + "dependencies": { + "express": "^4.17.2" + } +} +``` + +## Dockerizing + +In order to deploy the app, we need to Dockerize the app. If you are not familiar with the basics of Docker, we +recommend you check out our "Crash Course on Docker and Packer" from the [Gruntwork Training +Library](https://training.gruntwork.io/p/a-crash-course-on-docker-packer). + +For this guide, we will use the following `Dockerfile` to package our app into a container (see [Docker +samples](https://docs.docker.com/samples/) for how to Dockerize many popular app formats): + +```docker +FROM node:14 + +# Create app directory +WORKDIR /usr/app + +COPY package*.json ./ + +RUN npm install +COPY . . + +# Ensure that our Docker image is configured to `EXPOSE` +# the port that our app is going to need for external communication. +EXPOSE 8080 +CMD [ "npm", "start" ] +``` + +The folder structure of our sample app looks like this: + +```shell +├── server.js +├── Dockerfile +└── package.json +``` + +To build this Docker image from the `Dockerfile`, run: + +```bash +docker build -t simple-web-app:latest . +``` + +Now you can test the container to see if it is working: + +```bash +docker run --rm -p 8080:8080 simple-web-app:latest +``` + +This starts the newly built container and links port `8080` on your machine to the container's port `8080`. You should +see output like below when you run this command: + +``` +> docker_web_app@1.0.0 start /usr/app +> node server.js + +Running on http://0.0.0.0:8080 +``` + +You should now be able to hit the app by opening `localhost:8080/simple-web-app` in your browser. Try it out to verify +you get the `"Hello world"` message from the server. + +## Publishing your Docker image + +Next, let's publish those images to an [ECR repo](https://aws.amazon.com/ecr/). All ECR repos are managed in the +`shared-services` AWS account in your Reference Architecture. + +First, you'll need to create the new ECR repository. + +Create a new branch on your infrastructure-live repository: + +```bash +git checkout -b simple-web-app-repo +``` + +Open `repos.yml` in `shared/us-west-2/_regional/ecr-repos` and add the desired repository name of your app. For the +purposes of our example, let's call ours `simple-web-app`: + +```yaml +simple-web-app: +external_account_ids_with_read_access: + # NOTE: we have to comment out the directives so that the python based data merger (see the `merge-data` hook under + # blueprints in this repository) can parse this yaml file. This still works when feeding through templatefile, as it + # will interleave blank comments with the list items, which yaml handles gracefully. + # %{ for account_id in account_ids } + - "${account_id}" +# %{ endfor } +external_account_ids_with_write_access: [] +tags: {} +enable_automatic_image_scanning: true +``` + +Commit and push the change: + +```bash +git add shared/us-west-2/shared/data-stores/ecr-repos/terragrunt.hcl && git commit -m 'Added simple-web-app repo' && git push +``` + +Now open a pull request on the `simple-web-app-repo` branch. + +This will cause the ECS deploy runner pipeline to run a `terragrunt plan` and append the plan output to the body of the PR you opened. If the plan output looks correct with no errors, somebody can review and approve the PR. Once approved, you can merge, which will kick off a `terragrunt apply` on the deploy runner, creating the repo. Follow the progress through your CI server. For example, you can go to GitHub actions workflows page and tail the logs from the ECS deploy runner there. + +Once the repository exists, you can use it with the Docker image. Each repo in ECR has a URL of the format `.dkr.ecr..amazonaws.com/`. For example, an ECR repo in `us-west-2`, and an app called `simple-web-app`, the registry URL would be: + +``` +.dkr.ecr.us-west-2.amazonaws.com/simple-web-app +``` + +You can create a Docker image for this repo, with a `v1` label, as follows: + +```bash +docker tag simple-web-app:latest .dkr.ecr.us-west-2.amazonaws.com/simple-web-app:v1 +``` + +Next, authenticate your Docker client with ECR in the shared-services account: + +```bash +aws ecr get-login-password --region "us-west-2" | docker login --username AWS --password-stdin .dkr.ecr.us-west-2.amazonaws.com +``` + +And finally, push your newly tagged image to publish it: + +```bash +docker push .dkr.ecr.us-west-2.amazonaws.com/simple-web-app:v1 +``` + +## Deploying your app + + + + + +Now that you have the Docker image of your app published, the next step is to deploy it to your ECS Cluster that was +set up as part of your reference architecture deployment. + +### Setting up the Application Load Balancer + +The first step is to create an [Application Load Balancer (ALB)](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html) for the app. The ALB will be exposed to the Internet and will route incoming traffic to the app. It's possible to use a single ALB with multiple applications, but for this example, we'll create a new ALB in addition to the ALB used by the aws-sample-app. + +To set up a new ALB, you'll need to create a `terragrunt.hcl` in each app environment (that is, in dev, stage, and prod). For example, for the `stage` environment, create an `alb-simple-web-app` folder in `stage/us-west-2/networking/`. Next, you can copy over the contents of the alb `terragrunt.hcl` so you have something to start with. + +With the `terragrunt.hcl` file open, update the following parameters: + +- Set `alb_name` to your desired name: e.g., `alb-simple-web-app-stage` +- Set `domain_names` to a desired DNS name: e.g., `domain_names = ["simple-web-app-stage.example.com"]` +- Note that your domain is available in an account-level `local` variable, `local.account_vars.locals.domain_name.name`. You can thus use a string interpolation to avoid hardcoding the domain name: `domain_names = ["simple-web-app-stage.${local.account_vars.locals.domain_name.name}"]` + +That's it! + +### Setting up the ECS service + +The next step is to create a `terragrunt.hcl` file to deploy your app in each app environment (i.e. in dev, stage, +prod). To do this, we will first need to define the common inputs for deploying the `simple-web-app` service. + +Copy the file `_envcommon/services/ecs-sample-app-frontend.hcl` into a new file +`_envcommon/services/ecs-simple-web-app.hcl`. + +Next, update the following in the new `ecs-simple-web-app.hcl` configuration file: + +- Locate the `dependency "alb"` block and modify it to point to the new ALB configuration you just defined. That is, change the `config_path` to the relative path to your new ALB. e.g., `config_path = "../../networking/alb-simple-web-app"` +- Set the `service_name` local to your desired name: e.g., `simple-web-app-stage`. +- Update `ecs_node_port_mappings` to only have a map value for port 8080 +- In the `container_definitions` object, set `image` to the repo url of the just published Docker image: e.g., `.dkr.ecr.us-west-2.amazonaws.com/simple-web-app` +- Set `cpu` and `memory` to a low value like 256 and 512 +- Remove all the `environment` variables, leaving only an empty list, e.g. `environment = []` +- Remove port 8443 from the `portMappings` +- Remove the unnecessary `linuxParameters` parameter +- Remove the `iam_role_name` and `iam_policy` parameters since this simple web app doesn't need any IAM permissions + +Once the envcommon file is created, you can create the `terragrunt.hcl` file to deploy it in a specific environment. +For the purpose of this example, we will assume we want to deploy the simple web app into the `dev` account first. + +1. Create a `simple-web-app` folder in `dev/us-west-2/dev/services`. +1. Copy over the contents of the `sample-app-frontend terragrunt.hcl`. +1. Update the include path for `envcommon` to reference the new `ecs-simple-web-app.hcl` envcommon file you created + above. +1. Remove the unneeded `service_environment_variables`, `tls_secrets_manager_arn`, and `db_secrets_manager_arn` local + variables, as well as all usage of it in the file. +1. Update the `tag` local variable to reference the Docker image tag we created earlier. + +### Deploying your configuration + +The above are the minimum set of configurations that you need to deploy the app. You can take a look at [`variables.tf` +of `ecs-service`](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/main/modules/services/ecs-service) +for all the options. + +Once you've verified that everything looks fine, change to the new ALB directory you created, and run: + +```bash +terragrunt apply +``` + +This will show you the plan for adding the new ALB. Verify the plan looks correct, and then approve it to apply your ALB +configuration to create a new ALB. + +Now change to the new `services/simple-web-app` folder, and run + +```bash +terragrunt apply +``` + +Similar to applying the ALB configuration, this will show you the plan for adding the new service. Verify and approve +the plan to apply your application configuration, which will create a new ECS service along with a target group that +connects the ALB to the service. + +### Monitoring your deployment progress + +Due to the asynchronous nature of ECS deployments, a successful `terragrunt apply` does not always mean your app +was deployed successfully. The following commands will help you examine the ECS cluster from the CLI. + +First, you can find the available ECS clusters: + +```bash +aws --region us-west-2 ecs list-clusters +``` + +Armed with the available clusters, you can list the available ECS services on a cluster by running: + +```bash +aws --region us-west-2 ecs list-services --cluster +``` + +The list of services should include the new `simple-web-app` service you created. You can get more information about the service by describing it: + +``` +aws --region us-west-2 ecs describe-services --cluster --services +``` + +A healthy service should show `"status": "ACTIVE"` in the output. You can also review the list of `events` to see what has happened with the service recently. If the `status` shows something else, it's time to start debugging. + +### Debugging errors + +Sometimes, things don't go as planned. And when that happens, it's always beneficial to know how to locate the +source of the problem. + +By default, all the container logs from a `service` (`stdout` and `stderr`) are sent to CloudWatch Logs. This is ideal for +debugging situations where the container starts successfully but the service doesn't work as expected. Let's assume our +`simple-web-app` containers started successfully (which they did!) but for some reason our requests to those containers +are timing out or returning wrong content. + +1. Go to the "Logs" section of the [Cloudwatch Management Console](https://console.aws.amazon.com/cloudwatch/), click on Log groups, and look for the service in the list. For example: `/stage/ecs/simple-web-app-stage`. + +1. Click on the entry. You should be presented with a real-time log stream of the container. If your app logs to `stdout`, its logs will show up here. You can export the logs and analyze it in your preferred tool or use [CloudWatch Log Insights](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html) to query the logs directly + in the AWS web console. + + + + + +Now that you have the Docker image of your app published, the next step is to deploy it to your EKS Cluster that was +set up as part of your reference architecture deployment. + +### Setting up the Kubernetes Service + +The next step is to create a `terragrunt.hcl` file to deploy your app in each app environment (i.e. in dev, stage, +prod). To do this, we will first need to define the common inputs for deploying the `simple-web-app` service. + +Copy the file `_envcommon/services/k8s-sample-app-frontend.hcl` into a new file +`_envcommon/services/k8s-simple-web-app.hcl`. + +Next, update the following in the new `k8s-simple-web-app.hcl` configuration file: + +- Set the `service_name` local to your desired name: e.g., `simple-web-app-stage`. +- In the `container_image` object, set `repository` to the repo url of the just published Docker image: e.g., `.dkr.ecr.us-west-2.amazonaws.com/simple-web-app`. +- Update the `domain_name` to configure a DNS entry for the service: e.g., `simple-web-app.${local.account_vars.local.domain_name.name}`. +- Remove the `scratch_paths` configuration, as our simple web app does not pull in secrets dynamically. +- Remove all environment variables, leaving only an empty map: e.g. `env_vars = {}`. +- Update health check paths to reflect our new service: + + - `alb_health_check_path` + - `liveness_probe_path` + - `readiness_probe_path` + +- Remove configurations for IAM Role service account binding, as our app won't be communicating with AWS: + - `service_account_name` + - `iam_role_name` + - `eks_iam_role_for_service_accounts_config` + - `iam_role_exists` + - `iam_policy` + +Once the envcommon file is created, you can create the `terragrunt.hcl` file to deploy it in a specific environment. +For the purpose of this example, we will assume we want to deploy the simple web app into the `dev` account first. + +1. Create a `simple-web-app` folder in `dev/us-west-2/dev/services`. +1. Copy over the contents of the `k8s-sample-app-frontend terragrunt.hcl`. +1. Update the include path for `envcommon` to reference the new `ecs-simple-web-app.hcl` envcommon file you created + above. +1. Remove the unneeded `tls_secrets_manager_arn` local variables, as well as all usage of it in the file. +1. Update the `tag` input variable to reference the Docker image tag we created earlier. + +### Deploying your configuration + +The above are the minimum set of configurations that you need to deploy the app. You can take a look at [`variables.tf` +of `k8s-service`](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/main/modules/services/k8s-service) +for all the available options. + +Once you've verified that everything looks fine, change to the new `services/simple-web-app` folder, and run + +```bash +terragrunt apply +``` + +This will show you the plan for deploying your new service. Verify the plan looks correct, and then approvie it to apply +your application configuration, which will create a new Kubernetes Deployment to schedule the Pods. In the process, +Kubernetes will allocate: + +- A `Service` resource to expose the Pods under a static IP within the Kubernetes cluster. +- An `Ingress` resource to expose the Pods externally under an ALB. +- A Route 53 Subdomain that binds to the ALB endpoint. + +Once the service is fully deployed, you can hit the configured DNS entry to reach your service. + +### Monitoring your deployment progress + +Due to the asynchronous nature of Kubernetes deployments, a successful `terragrunt apply` does not always mean your app +was deployed successfully. The following commands will help you examine the deployment progress from the CLI. + +First, if you haven't done so already, configure your `kubectl` client to access the EKS cluster. You can follow the +instructions [in this section of the +docs](https://github.com/gruntwork-io/terraform-aws-eks/blob/main/core-concepts.md#how-do-i-authenticate-kubectl-to-the-eks-cluster) +to configure `kubectl`. For this guide, we will use [kubergrunt](https://github.com/gruntwork-io/kubergrunt): + +``` +kubergrunt eks configure --eks-cluster-arn ARN_OF_EKS_CLUSTER +``` + +Once `kubectl` is configured, you can query the list of deployments: + +``` +kubectl get deployments --namespace applications +``` + +The list of deployments should include the new `simple-web-app` service you created. This will show you basic status +info of the deployment: + +``` +NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE +simple-web-app 3 3 3 3 5m +``` + +A stable deployment is indicated by all statuses showing the same counts. You can get more detailed information about a +deployment using the `describe deployments` command if the numbers are not aligned: + +``` +kubectl describe deployments simple-web-app --namespace applications +``` + +See the [How do I check the status of a +rollout?](https://github.com/gruntwork-io/helm-kubernetes-services/blob/main/charts/k8s-service/README.md#how-do-i-check-the-status-of-the-rollout) +documentation for more information on getting detailed information about Kubernetes Deployments. + +### Debugging errors + +Sometimes, things don't go as planned. And when that happens, it's always beneficial to know how to locate the +source of the problem. There are two places you can look for information about a failed Pod. + +### Using kubectl + +The `kubectl` CLI is a powerful tool that helps you investigate problems with your `Pods`. + +The first step is to obtain the metadata and status of the `Pods`. To lookup information about a `Pod`, retrieve them +using `kubectl`: + +```bash +kubectl get pods \ + -l "app.kubernetes.io/name=simple-web-app,app.kubernetes.io/instance=simple-web-app" \ + --all-namespaces +``` + +This will list out all the associated `Pods` with the deployment you just made. Note that this will show you a minimal +set of information about the `Pod`. However, this is a useful way to quickly scan the scope of the damage: + +- How many `Pods` are available? Are all of them failing or just a small few? +- Are the `Pods` in a crash loop? Have they booted up successfully? +- Are the `Pods` passing health checks? + +Once you can locate your failing `Pods`, you can dig deeper by using `describe pod` to get more information about a +single `Pod`. To do this, you will first need to obtain the `Namespace` and name for the `Pod`. This information should +be available in the previous command. Using that information, you can run: + +```bash +kubectl describe pod $POD_NAME -n $POD_NAMESPACE +``` + +to output the detailed information. This includes the event logs, which indicate additional information about any +failures that has happened to the `Pod`. + +You can also retrieve logs from a `Pod` (`stdout` and `stderr`) using `kubectl`: + +``` +kubectl logs $POD_NAME -n $POD_NAMESPACE +``` + +Most cluster level issues (e.g if there is not enough capacity to schedule the `Pod`) can be triaged with this +information. However, if there are issues booting up the `Pod` or if the problems lie in your application code, you will +need to dig into the logs. + +### CloudWatch Logs + +By default, all the container logs from a `Pod` (`stdout` and `stderr`) are sent to CloudWatch Logs. This is ideal for +debugging situations where the container starts successfully but the service doesn't work as expected. Let's assume our +`simple-web-app` containers started successfully (which they did!) but for some reason our requests to those containers +are timing out or returning wrong content. + +1. Go to the "Logs" section of the [Cloudwatch Management Console](https://console.aws.amazon.com/cloudwatch/) and look for the name of the EKS cluster in the table. + +1. Clicking it should take you to a new page that displays a list of entries. Each of these correspond to a `Pod` in the + cluster, and contain the `Pod` name. Look for the one that corresponds to the failing `Pod` and click it. + +1. You should be presented with a real-time log stream of the container. If your app logs to STDOUT, its logs will show + up here. You can export the logs and analyze it in your preferred tool or use [CloudWatch Log + Insights](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html) to query the logs directly + in the AWS web console. + + + + + + + diff --git a/docs/refarch/usage/maintain-your-refarch/extending.md b/docs/refarch/usage/maintain-your-refarch/extending.md index 6e2c048fc9..767bb124c4 100644 --- a/docs/refarch/usage/maintain-your-refarch/extending.md +++ b/docs/refarch/usage/maintain-your-refarch/extending.md @@ -1,16 +1,31 @@ +--- +title: "Extending your Reference Architecture" +--- -# Extending and modifying your Reference Architecture +# Extending and modifying your Reference Architecture -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. +Your Reference Architecture is delivered as a collection of IaC code. You will grow and evolve this codebase through out the lifetime of your cloud deployment. There are a few ways in which you can extend and modify your Reference Architecture: -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. +- You can immediately add any off-the-shelf Gruntwork services. +- You can create your own services using any Gruntwork modules. +- You can build your own modules and combine them into your own services. -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. +## Use Gruntwork's services + +Gruntwork provides a [_catalog_ of services](/iac/reference/) that can be added by directly referencing them in your terragrunt configuration. Check out the [Using a Service](/iac/usage/using-a-service) docs to learn how you can quickly start using our services in your own Reference Architecture. + +## Composing your own services + +If Gruntwork doesn't already have the service you are looking you may be able to use our [modules](/iac/overview/modules) and [combine them into your own bespoke new services](/iac/usage/composing-your-own-service) to accelerate your development of the functionality you need. Please check out how you can start [using modules](/iac/usage/using-a-module). + +## Build your own modules + +If Gruntwork doesn't have existing modules for the AWS services that you are trying to deploy, you can always [create and deploy your own modules](/iac/getting-started/deploying-a-module), compose them into your on bespoke services and add them to your Reference Architecture. diff --git a/docs/refarch/usage/maintain-your-refarch/index.md b/docs/refarch/usage/maintain-your-refarch/index.md deleted file mode 100644 index 2b5e02ac4b..0000000000 --- a/docs/refarch/usage/maintain-your-refarch/index.md +++ /dev/null @@ -1,16 +0,0 @@ -# Maintain your Reference Architecture - -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. - -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. - -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. - - - - diff --git a/docs/refarch/usage/maintain-your-refarch/monitoring.md b/docs/refarch/usage/maintain-your-refarch/monitoring.md new file mode 100644 index 0000000000..b11c4930b1 --- /dev/null +++ b/docs/refarch/usage/maintain-your-refarch/monitoring.md @@ -0,0 +1,55 @@ +# Monitoring, Alerting and Logging + +You'll want to see what's happening in your AWS account: + +## Metrics + +You can find all the metrics for your AWS account on the [CloudWatch Metrics +Page](https://console.aws.amazon.com/cloudwatch/home?#metricsV2:). + +- Most AWS services emit metrics by default, which you'll find under the "AWS Namespaces" (e.g. EC2, ECS, RDS). + +- Custom metrics show up under "Custom Namespaces." In particular, the [cloudwatch-memory-disk-metrics-scripts + module](https://github.com/gruntwork-io/terraform-aws-monitoring/tree/main/modules/metrics/) is installed on every + server to emit metrics not available from AWS by default, including memory and disk usage. You'll find these under + the "Linux System" Namespace. + +You may want to create a [Dashboard](https://console.aws.amazon.com/cloudwatch/home?#dashboards:) +with the most useful metrics for your services and have that open on a big screen at all times. + +## Alerts + +A number of alerts have been configured using the [alarms modules in +terraform-aws-monitoring](https://github.com/gruntwork-io/terraform-aws-monitoring/tree/main/modules/alarms) to notify you +in case of problems, such as a service running out of disk space or a load balancer seeing too many 5xx errors. + +- You can find all the alerts in the [CloudWatch Alarms + Page](https://console.aws.amazon.com/cloudwatch/home?#alarm:alarmFilter=ANY). + +- You can also find [Route 53 Health Checks on this page](https://console.aws.amazon.com/route53/healthchecks/home#/). + These health checks test your public endpoints from all over the globe and notify you if your services are unreachable. + +That said, you probably don't want to wait for someone to check that page before realizing something is wrong, so +instead, you should subscribe to alerts via email or text message. Go to the [SNS Topics +Page](https://console.aws.amazon.com/sns/v2/home?#/topics), select the `cloudwatch-alarms` topic, and click "Actions -> +Subscribe to topic." + +If you'd like alarm notifications to go to a Slack channel, check out the [sns-to-slack +module](https://github.com/gruntwork-io/terraform-aws-monitoring/tree/main/modules/alarms/sns-to-slack). + +## Logs + +All of your services have been configured using the [cloudwatch-log-aggregation-scripts +module](https://github.com/gruntwork-io/terraform-aws-monitoring/tree/main/modules/logs/cloudwatch-log-aggregation-scripts) +to send their logs to [CloudWatch Logs](https://console.aws.amazon.com/cloudwatch/home?#logs:). Instead of SSHing to +each server to see a log file, and worrying about losing those log files if the server fails, you can just go to the +[CloudWatch Logs Page](https://console.aws.amazon.com/cloudwatch/home?#logs:) and browse and search log events for all +your servers in near-real-time. + + + diff --git a/docs/refarch/usage/maintain-your-refarch/stay-up-to-date.md b/docs/refarch/usage/maintain-your-refarch/stay-up-to-date.md deleted file mode 100644 index 13c7ea8dad..0000000000 --- a/docs/refarch/usage/maintain-your-refarch/stay-up-to-date.md +++ /dev/null @@ -1,16 +0,0 @@ - -# Stay up to date - -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. - -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. - -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. - - - diff --git a/docs/refarch/usage/maintain-your-refarch/staying-up-to-date.md b/docs/refarch/usage/maintain-your-refarch/staying-up-to-date.md new file mode 100644 index 0000000000..f117b28746 --- /dev/null +++ b/docs/refarch/usage/maintain-your-refarch/staying-up-to-date.md @@ -0,0 +1,21 @@ +# Staying up to date + +Keeping you Reference Architecture up to date is important for several reasons. AWS regularly releases updates and introduces changes to its services and features. By maintaining an up-to-date IaC codebase, you can adapt to these updates seamlessly. This ensures that your architecture remains aligned with the latest best practices and takes advantage of new functionalities, security enhancements, and performance optimizations offered by AWS. + +Neglecting to keep your IaC code up to date can lead to significant challenges. When you finally reach a point where an update becomes necessary, the process can become much more cumbersome and time-consuming. Outdated code may rely on deprecated or obsolete AWS resources, configurations, or APIs, making it difficult to migrate to newer versions smoothly. In such cases, the effort required to update the codebase can be substantially higher, potentially resulting in additional costs, delays, and increased risk of errors or production outages. + +## Upgrading Terraform across your modules + +It is important to regularly update your version of Terraform to ensure you have access to the latest features, bug fixes, security patches, and performance improvements necessary for smooth infrastructure provisioning and management. + +Neglecting regular updates may lead to increased complexity and difficulty when attempting to upgrade from multiple versions behind. This was particularly true during the pre-1.0 era of Terraform where significant changes and breaking modifications were more frequent. + +https://github.com/tfutils/tfenv + + + diff --git a/docs/refarch/usage/maintain-your-refarch/undeploy.md b/docs/refarch/usage/maintain-your-refarch/undeploy.md deleted file mode 100644 index 99952481bd..0000000000 --- a/docs/refarch/usage/maintain-your-refarch/undeploy.md +++ /dev/null @@ -1,25 +0,0 @@ - -# Undeploy individual modules - -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. - -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. - -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. - -# Undeploy the Ref Arch - -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. - -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. - -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. - - - - diff --git a/docs/refarch/usage/maintain-your-refarch/undeploying.md b/docs/refarch/usage/maintain-your-refarch/undeploying.md new file mode 100644 index 0000000000..e0cdda8626 --- /dev/null +++ b/docs/refarch/usage/maintain-your-refarch/undeploying.md @@ -0,0 +1,212 @@ +# Undeploying your Reference Architecture + +Terraform makes it fairly easy to delete resources using the `destroy` command. This is very useful in testing and +pre-prod environments, but can also be dangerous in production environments. + +:::danger + +Be especially careful when running `destroy` in any production environment so you don't accidentally end up deleting +something you'll very much regret (e.g., a production database). + +If you delete resources, **there is no undo** + +::: + +## Prerequisites + +### Understand `force_destroy` on S3 buckets + +By default, if your Terraform code includes an S3 bucket, when you run `terraform destroy`, if that bucket contains +any content, Terraform will _not_ delete the bucket and instead will give you an error like this: + +```yaml +bucketNotEmpty: The bucket you tried to delete is not empty. You must delete all versions in the bucket. +``` + +This is a safety mechanism to ensure that you don't accidentally delete your data. + +If you are absolutely sure you want to delete the contents of an S3 bucket (remember, there's no undo!), all the +services that use S3 buckets expose a `force_destroy` setting that you can set to `true` in your `terragrunt.hcl` +files to tell that service to delete the contents of the bucket when you run `destroy`. Here's a partial list of +services that expose this variable: + +:::note + +You may not have all of these in your Reference Architecture + +::: + +- `networking/alb` +- `mgmt/openvpn-server` +- `landingzone/account-baseline-app` +- `services/k8s-service` + +### Understand module dependencies + +Gruntwork Pipelines (the CI/CD pipeline deployed with your Reference Architecture) only **supports destroying modules +that have no downstream dependencies.** + +You can destroy multiple modules only if: + +- All of them have no dependencies. +- None of them are dependent on each other. + +#### Undeploying a module with many dependencies + +As an example, most modules depend on the `vpc` module, for fetching information about the VPC using [Terragrunt `dependency` +blocks](https://terragrunt.gruntwork.io/docs/reference/config-blocks-and-attributes/#dependency) or +[aws_vpc](https://www.terraform.io/docs/providers/aws/d/vpc.html) data source. If you undeploy your `vpc` +_before_ the modules that depend on it, then any command you try to run on those other modules will fail, as their +data sources will no longer be able to fetch the VPC info! + +Therefore, you should only destroy a module if you're sure no other module depends on it! Terraform does not provide +an easy way to track these sorts of dependencies. We have configured the modules here using Terragrunt [`dependency`](https://terragrunt.gruntwork.io/docs/reference/config-blocks-and-attributes/#dependency) blocks, so use those to find dependencies between modules. + +You can check the module dependency tree with `graph-dependencies` and GraphViz: + +```bash +aws-vault exec -- terragrunt graph-dependencies | dot -Tpng > dep-graph.png +open dep-graph.png +``` + +## Undeploying a module with no dependencies using Gruntwork Pipelines + +To destroy a module with no downstream dependencies, such as `route53-private` in the `dev` environment: + +1. Update the `force_destroy` variable in `dev/us-west-2/dev/networking/route53-private/terragrunt.hcl`. + [See force_destroy section](#pre-requisite-force_destroy-on-s3-buckets). + + ```json + force_destroy = true + ``` + +1. Open a pull request for that change and verify the plan in CI. You should see a trivial change to update the + module. +1. Go through the typical git workflow to get the change merged into the main branch. +1. As CI runs on the main branch, watch for the job to be held for approval. Approve the job, and wait for the + `deployment` step to complete so that the module is fully updated with the new variable. +1. Remove the module folder from the repo. For example: + + ```bash + rm -rf dev/us-west-2/dev/networking/route53-private + ``` + +1. Open a pull request for that change and verify the plan in CI. + - Make sure the `plan -destroy` output looks accurate. + - If you are deleting multiple modules (e.g., in `dev`, `stage`, and `prod`) you should see multiple plan + outputs -- one per folder deleted. You'll need to scroll through the plan output to see all of them, as + it runs `plan -destroy` for each folder individually. +1. Go through the typical git workflow to get the change merged into the main branch. +1. As CI runs on the main branch, watch for the job to be held for approval. Approve the job, and wait for the + `deployment` step to complete so that the module is fully _deleted_. +1. [Remove the Terraform state](#removing-the-terraform-state). +1. Repeat this process for upstream dependencies you may now want to destroy, always starting from the + modules that have no existing downstream dependencies. + +### Manually undeploying a single module + +You can also bypass the CI/CD pipeline and run destroy locally. For example: + +```bash +cd stage/us-west-2/stage/services/sample-app-frontend +terragrunt destroy +``` + +## Manually undeploying multiple modules or an entire environment + +_If you are absolutely sure you want to run destroy on multiple modules or an entire environment_, you can use the `destroy-all` command. For example, to undeploy the entire staging environment, you'd run: + +:::danger + +This operation cannot be undone! + +::: + +```bash +cd stage +terragrunt destroy-all +``` + +Terragrunt will then run `terragrunt destroy` in each subfolder of the current working directory, processing them in +reverse order based on the dependencies you define in the `terragrunt.hcl` files. + +To avoid interactive prompts from Terragrunt (use very carefully!!), add the `--terragrunt-non-interactive` flag: + +```bash +cd stage +terragrunt destroy-all --terragrunt-non-interactive +``` + +To undeploy everything except a couple specific sub-folders, add the `--terragrunt-exclude-dir` flag. For example, to +run `destroy` in each subfolder of the `stage` environment except MySQL and Redis, you'd run: + +``` +cd stage +terragrunt destroy-all \ + --terragrunt-exclude-dir stage/us-east-1/stage/data-stores/mysql \ + --terragrunt-exclude-dir stage/us-east-1/stage/data-stores/redis +``` + +## Removing the Terraform state + +:::danger + +Deleting state means that you lose the ability to manage your current Terraform resources! Be sure to only delete once you have confirmed all resources are destroyed. + +::: + +Once all the resources for an environment have been destroyed, you can remove the state objects managed by `terragrunt`. +The Reference Architecture manages state for each environment in an S3 bucket in each environment's AWS account. +Additionally, to prevent concurrent access to the state, it also utilizes a DynamoDB table to manage locks. + +To delete the state objects, login to the console and look for the S3 bucket in the environment you wish to undeploy. It +should begin with your company's name and end with `terraform-state`. Also look for a DynamoDB +table named `terraform-locks`. You can safely remove both **once you have confirmed all the resources have been +destroyed successfully**. + +## Useful tips + +- **Destroy resources in groups instead of all at once.** + + - There are [known instabilities](#known-errors) with destroying many modules at once. In addition, Terragrunt is + designed to process the modules in a graph, and will not continue on if there is an error. This means that you + could run into situations where Terragrunt has destroyed a module, but returns an error due to Terraform bugs that + prevent you from cleanly calling destroy twice. + - To address these instabilities, it is recommended to destroy the resources in groups. For example, you can start + by destroying all the services first (e.g., `stage/REGION/stage/services`), then the data stores (e.g., + `stage/REGION/stage/data-stores`), and finally the networking resources (e.g., `stage/REGION/stage/networking`). + - When identifying groups to destroy, use [terragrunt + graph-dependencies](https://terragrunt.gruntwork.io/docs/reference/cli-options/#graph-dependencies) to view the + dependency graph so that you destroy the modules in the right order. + +- **Empty + Delete S3 buckets using the web console (when destroying whole environments).** + - As mentioned in [Pre-requisite: force_destroy on S3 buckets](#pre-requisite-force_destroy-on-s3-buckets), it is + recommended to set `force_destroy = true` prior to running destroy so that Terraform can destroy the S3 buckets. + However, this can be cumbersome if you are destroying whole environments, as it can be difficult to flip the bit in + every single module. + - Alternatively, it is often faster and more convenient to empty and delete the buckets using the AWS web console before executing the `destroy` command with `terragrunt`. + - **IMPORTANT**: You should only do this if you are intending on destroying an entire environment. Otherwise, it is + too easy to accidentally delete the wrong S3 bucket. + +## Known Terraform errors + +If your `destroy` fails with: + +``` +variable "xxx" is nil, but no error was reported +``` + +Terraform has a couple bugs ([18197](https://github.com/hashicorp/terraform/issues/18197) and +[17862](https://github.com/hashicorp/terraform/issues/17862)) that may give this error when you run +`destroy`. + +This usually happens when the module already had `destroy` called on it previously and you re-run `destroy`. In this +case, your best bet is to skip over that module with the `--terragrunt-exclude-dir` (more details: [here](https://terragrunt.gruntwork.io/docs/reference/cli-options/#terragrunt-exclude-dir)). + + + diff --git a/docs/refarch/usage/maintain-your-refarch/upgrade-terraform.md b/docs/refarch/usage/maintain-your-refarch/upgrade-terraform.md deleted file mode 100644 index 9328acf44c..0000000000 --- a/docs/refarch/usage/maintain-your-refarch/upgrade-terraform.md +++ /dev/null @@ -1,16 +0,0 @@ - -# Upgrade Terraform across your modules - -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. - -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. - -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. - - - diff --git a/docs/refarch/usage/pipelines-integration/index.md b/docs/refarch/usage/pipelines-integration/index.md index d56e62f8ee..23a161afe8 100644 --- a/docs/refarch/usage/pipelines-integration/index.md +++ b/docs/refarch/usage/pipelines-integration/index.md @@ -1,37 +1,106 @@ # Pipelines integration -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. +CI/CD is a crucial tool for ensuring the smooth iteration and consistent delivery of Infrastructure as Code (IaC) to production environments. By adopting CI/CD practices, teams can automate the process of integrating and testing changes made to IaC code, allowing for frequent and reliable updates. With CI/CD, each change to the IaC codebase triggers an automated build process, ensuring that any new additions or modifications are properly incorporated. This enables developers to catch errors and conflicts early, facilitating collaboration and reducing the likelihood of issues surfacing during deployment. -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +Gruntwork Pipelines is a framework that enables you to use your preferred CI tool to securely run an end-to-end pipeline for infrastructure code (Terraform) and app code (Docker or Packer). Rather than replace your existing CI/CD provider, Gruntwork Pipelines is designed to enhance the security of your existing tool. For more information please see the [full pipelines documentation](/pipelines/overview/). -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +In the guide below, we walk through how to configure Gruntwork Pipelines in your CI/CD. -## Step 1: Set up machine user creds +## Set up machine user credentials -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. +### Get the machine user credentials from AWS -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +1. Log into the Security account in the AWS Console. +1. Go into IAM and find the ci-machine-user under Users. +1. Go to Security Credentials > Access Keys > Create Access Key. +1. Save these values as the `AWS_ACCESS_KEY_ID` and the `AWS_SECRET_ACCESS_KEY` Environment Variables in CircleCI. + + | Env var name | Value | + | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | + | AWS_ACCESS_KEY_ID | The Access Key generated for the machine user in the Security account. | + | AWS_SECRET_ACCESS_KEY | The Secret Key generated for the machine user in the Security account. | + | GITHUB_OAUTH_TOKEN | Enter the MachineUserGitHubPAT here. You can find this in `reference-architecture-form.yml` or in the shared account's Secrets Manager. | ## Verify: Testing an infrastructure change end to end -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. +You can verify the pipeline by making a change to one of the modules. For example, follow the steps below to extend the +number of replicas in the sample app: + +1. Create a new branch in the `infrastructure-live` repo. + `git checkout -B add-replica-to-sample-app`. +1. Open the file `dev/us-west-2/dev/services/sample-app-frontend` in your editor. +1. Change the input variable `desired_number_of_tasks` to `2`. +1. Commit the change. + `git commit -a`. +1. Push the branch to GitHub and open a PR. + `git push add-replica-to-sample-app` +1. Login to CircleCI. Navigate to your infrastructure-live project. +1. Click on the new pipeline job for the branch `add-replica-to-sample-app` to see the build log. +1. Verify the `plan`. Make sure that the change corresponds to adding a new replica to the ECS service. +1. When satisfied with the plan, merge the PR into `main`. +1. Go back to the project and verify that a new build is started on the `main` branch. +1. Wait for the `plan` to finish. The build should hold for approval. +1. Approve the deployment by clicking `Approve`. +1. Wait for the `apply` to finish. +1. Login to the AWS console and verify the ECS service now has 2 replicas. + +## (Optional) Configure Slack notifications + +### Create a Slack App + +1. Visit [your apps](https://api.slack.com/apps) on the Slack API website, and click `Create New App`. +1. Name your application (e.g., `CircleCI` or `CircleCI-Pipeline`). +1. Then select the Slack workspace in which to install this app. + +### Set Permissions + +On the next page select the "Permissions" area, and add these 3 "scopes". + +- `chat:write` +- `chat:write.public` +- `files:write` + +

+Slack App Scopes +Slack App Scopes +

+ +### Install and Receive Token + +Install the application into the Slack workspace and save your OAuth Access Token. This will be used in +a CircleCI environment variable. + +

+Slack OAuth Tokens +Slack OAuth Tokens +

-Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +

+Slack OAuth Access Token +Slack OAuth Access Token +

-Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +### Choose a Slack channel to notify -## (Optional) Configure Slack notifications +1. Choose or create a Slack channel in your workspace to notify with pipeline updates. +1. Right-click the channel name. You'll see a context menu. +1. Select `Copy link`. +1. Extract the Channel ID from the URL copied. E.g., `https://.slack.com/archives/` -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. +### Create env vars on CircleCI -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +1. Login to CircleCI. Navigate to Project Settings -> Environment Variables. +1. Configure the following environment variables: -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. + | Env var name | Value | + | --------------------- | ----------------------------------------------------------------- | + | SLACK_ACCESS_TOKEN | The OAuth token acquired through the previous step. | + | SLACK_DEFAULT_CHANNEL | If no channel ID is specified, the app will attempt to post here. | diff --git a/sidebars/refarch.js b/sidebars/refarch.js index 8ed25a1be4..3f2e3431da 100644 --- a/sidebars/refarch.js +++ b/sidebars/refarch.js @@ -11,8 +11,8 @@ const sidebar = [ items: [ "refarch/whats-this/what-is-a-reference-architecture", "refarch/whats-this/how-does-the-gruntwork-reference-architecture-differ", - "refarch/whats-this/understanding-the-deployment-process" - ] + "refarch/whats-this/understanding-the-deployment-process", + ], }, { label: "Configuration", @@ -40,13 +40,13 @@ const sidebar = [ type: "category", collapsible: false, items: [ - "refarch/usage/maintain-your-refarch/index", - "refarch/usage/maintain-your-refarch/add-new-account", - "refarch/usage/maintain-your-refarch/undeploy", - "refarch/usage/maintain-your-refarch/stay-up-to-date", - "refarch/usage/maintain-your-refarch/upgrade-terraform", + "refarch/usage/maintain-your-refarch/deploying-your-apps", + "refarch/usage/maintain-your-refarch/monitoring", + "refarch/usage/maintain-your-refarch/adding-new-account", + "refarch/usage/maintain-your-refarch/staying-up-to-date", "refarch/usage/maintain-your-refarch/extending", "refarch/usage/pipelines-integration/index", + "refarch/usage/maintain-your-refarch/undeploying", ], }, ], diff --git a/static/img/refarch/slack_app_scopes.png b/static/img/refarch/slack_app_scopes.png new file mode 100644 index 0000000000000000000000000000000000000000..a399dcb6ca2a0df180cfcb6882280a0bb4eff15c GIT binary patch literal 77108 zcmdRWhdZ3l*SACxL|KW57OMr3V3ig{0Spf&fl?4aqlMfCK8e8>g0|&>E z3kPS*00&1X76*sICb9Y*7~2pE(U37!P{4VLE#u?dxp4;v7hAf4a})dL{(s6huw`nT z-#ueXIBGX&{weF-c=Ct-i#g7%|InCXufIQUu;1T2|Gwg;-uTmF>dpUB-_%IO{crgO zc5FB}Zql9I*b9Np8%=v0973|+-y1mbiImvcBg|Db95fW&NdGSq2MZBK4Fx5738)=}o}ZJ8lZ#RG zE1a))}VPyO*=%3HO$LU~h`bUzr{ePx~ zognCU3y7PO3-o_ugSeRgKiGb^{G07x^ZK_q@bAuqB%oF{b`X1e?65?+!T%EQKkEJr z@89&w5PPVlEbW<@pcG|Em7qT#9z)5bU!2X8T9V-*x|+Ug-nW0gAmvcIL)1 z)(#Lm>=6IM{a=CqZ;HSA`aN$UC36>urG})r6~y}Av*dY!?d1R3^uJjppq5ZO6&pii z$nR1Ai{-DX|4scbL7IOAy%6{xa{g-h4<{J(TM_1vuN(i?43uW#Ry-*JCXLt0aFa<8VQMz|O^vgjW9 zrm|Lb&4BPiRqx>eO0Ss$Ryh%Oah_uD3p||_-ko0h|v2@FaQU(5qB_Nn}ei?pu#pwvnjqBl|3C>9T^adGVP0}Ql!+p{feC6&;3$r zCDkwoMAN8y23|=x%@+GMhrUUgcFfc~GF{7ms$HHJNX;i(f3;F+9}~C3hfkfNpm+sZLw9opR5VI0)Ul>>P-ep~Tyc-}Db`h+u6fVdDIw z%XdLHpOr~&+!?Ng9j)f^4ur4kyUc&QoO51~33$k%EYV@uNzDuFm_nGW*cFzxQ<(c4 z@m80dmw>Gu$Rm?edM}T=yL-El+d3lt1B$^%h4QY^0tLALtY7K@-zGh+DbC=J4zGKq_Om#_~BQ z?WPx(YYEU*)PiS>`AGIuLNMi*Rc8Q&nSlFO(tHfWoPvn+E zi9W-RLj&+unM}V3N{2l()9C!0OwU7(2s+P8+qlbvpA6BB+p7~FS05{auOyYTO{gNg z5_k4}$fj974nEcco{y2r1%sD6A!jA9f+}>pBr)4F*&uphMM^P-sUKr+qt{!@Sy?2$ zkSI)7KvN0>QS)vCNSl|6pc?1>`7YZI+8AiE1VHflP|#I0z@tz<1Sk?Nf|})B0ACB9 ziFHlrdnTl%P@xc=TEeBZt+1B_E zi*-e@^XE+&z9>BJpNc7>UE75X$$>Ni{m3nzc^+V23pi@QDvF^L&57^q z3S!fit1Xnaiv4w{ z`Gjn8hoLeH^_9YRbyCBXwkwh-evEGvLMEnaBH4|ZNh**F7?{a#HJxd`;CYR)JKAel zxa!&%$_UD7si7TqcbP?IQ0Ti4xs+SiIyNga9?zBzWSu9wS!?22P*K5h^Lr#;|Iz$g z-yYt)ea$OgreoJ7235+IrxHxtCE#&i<+}KGQ8uCXjBi3$yp1D@7|`4%_QIJ)hY#cX&mouAe~5xx|9q`F%X3jA}egXd=vA-j2U z_Q)}H{jTN51F1iinfDdMO~gHl}{yIh=-(7%S#53`)4S0j0NH)dX1{YuA zwqhs^q0fXiRK$FyJRjcua-p6#(~k&flps_9$;OS zc9%_)pW-nOUuS*QFp=E8?(B6hI%*q14hma`Y+o5WS1o^gW|Es<&f`4*2@SDZ>rb#q ziCN?YkV<9jiScG^9d-a?^y=I+!PmKA`nl2ht5NFuVZ;KnHd*z%khqmU2hmO6`(E#P zic0Q;dGg*h#x*7cz1tkl%94p-VIy_1I`eq2@cHAfcT7~G?v?V1;CI;rofmX|?DvpX zYyyF^i%m7H&e@6B6C4sl(BrX{_?b@ktbDA#quNJZ)DTifwnvt;ERn zo_7XPARM3SK2@x+)Ds1Edprxw#hlI!L<=t!>NnJzm0}?EwO^AjkxWElTsE&l#`Cok zxPAA;9Il(frGhEhHi*a{_uT&3dVe2VoK=##%xzvK=?HR?hYhUtbY7a2Uky(aM4$J3w z6~&m=lbs7-Ws|DG6BfE~-ovaI{ct3tXEVWlLDoNB&fJ-K0UV_R06tgF#J%-38oUiOi0d2@z4^zIObgQmJDOp89 zdz4Cu?x<4F3Gbn^{+a#G1So>)Gljlgv1Q%Kcrjj&7W@ga_v|+lg5(=yUhCesPPNnB;;)+bdB(M!>sD7n#L7L(B<_eR zqmey@4>}d=@0`#~OM{oxas4CUU2_fIZPMZidk5?4>vim6&fDXCNE;iGu%lr)5J!a$ zay$9yg~n6I+THP)=pN5q&q9S`&!<|NhiO9(kd^;~U;ak@~%lN|H?2dvyBAQbX8nnTkm)7quH1j)wqLJCI@_A-u5~C9EM|T-D|cXRGU)@dz7C@+eyS&*QGt8?RpS2>Q}a^>lr%udY#)* zX0?Y17Z1Tc2a8?s*>*oQ%(O;eM?Cel0O@lxP!!aq_NL$Fd_*ZXID{xj>M?0fjQ779#2 z#O;5iybP1ZN?}}Reb@A7)ig$aqaE4zLXdyxQaiCy)WV?4-wpmuFwY!2L9LOm(y%{L zlveL)JR{0`EaS6q9itYLcwGqe<-YDVh_TAhxw6y}KhdX3{){Z>I-9M|?66EiYN!TJ0uX}TaIX%VW)KV`X{SK5Df2y1Kk zzerhU-m!i5K&g|m#F5?PCrDj)D{96RxNdgq!5A7uk@zY;)~e!_mamcXpc>XHR4IZ9aiS!i8_c_UD9dmER`>v>SH#cB5%HpA-~T99}D5Uvgbt zZyhOiUS4lKILGx$|MYTJ`*j-mwI1!&_&m^Z^O_BmMgBhraR&{C(3G5sIQ=1-doUe6}eb=pXXQ z;HsDV`GtXVAI1|H<9aOJt;8_zrI_7QG zI943mZ@9Kb3?v8)d^;$){(-#ft+UsL9fpj@)w!99z{H9^0q~aER3nn+JJuU3 z*)5;x#-Qd>oYH5-lL@}{^EvHk2%-}05tm2(F{lMM{kOuq&jqm#C1kBPPPx{_7PeE| zk!d!N%p&befoz!3_*UrSF^8dGRW6(+5fV-rweh! zWww4;9g$*j4HK&E_ij48JQ~n`x1p$|7R~&?=E+xzsq-jbN|102tG1+d{Px`etUqmh zhj(I%2Va7c_O~;D1%A4l_v^fzhDuJ#UaUu6BOm{wOT&L) z&6&2uE;K4Ch6AtOQp?&Sre&%}tMkdhCW zc$VHK)Nbaf>EWQA$@4}(v%ykRE_$ObF`FY7&wN!k-O(0k!ama-DD2t2E+p4U&lzGi zRiX>vnsnZWBbo_0RqJc3kp|~2D6!b@mj?_@D}ong9d7!a?FmI$=irc}n9C^-AN!e- z)XF@fm|etr48K{w&Ncw7A)J!3Ggh>z5rGE;n37l}2Nv|XirPE1xJ~i$jrPdYBEJ$UWLGPB6ov(~C$1#U zj2D15r-ZUT+i@m}X`5;2c!=|WQ;r}fsUYk6wzVI&8<E1b< zvM5xy);vH+A4pU|!ss5Al$1I$iZp;VJwVXc)vFUyt0yj?j_r0q?cgIAEK%2UYw^5v zbBe#e+fJ9wTi<%#Qi!J{R`sW97tmU#JcW%yP#apO(2dnVo~0up^a-+CthVnS4{R&* zLBMd9Y|o7gy3k;%sS6qyDWLUsSMQ3(>DPNIIvr=1ohSXElYw8gf}KakO5~*;ZF)dZ+!}2!%36>Qm6y|mwT@WD>ebi0^WiPXsDEESm?`V!Qgy9a| zyK_uOzdfPlN!1eILbrIJcJN^Q`w+`V@F=%nXGebUy(VRrc_AW6B7%Vq6^3e~7xdma z)%oSqvOiUS7(whKqByk23%YnA-48Y=3R9@K6D&*oyN-fC%FCVjQa}ej-N2QP!CK4B zE|@il4E}&pzE+vZh=Kqg5Samj7*C$;&PDjnircENp5dl}i0Ay}uReB#9tMD8dh)NnRsyp8{2u^ZP&*%5T#wGC)kZ?` zIO{5ykmo~#9im55SEP_&P@zLizfbHmaocz9ciC7x9)Ay-V0ej^nR|=a!R$!=)M-WOBKg zRfjS{u14RN4Hs`f60FLLT|t997NdEFm>|*0Ij0%T!{b8Rm3GbRqiU{LFU_v|uy(G> z!^O{Oa>6zXgJ%9Y$;UbVWUS^10>4Ur1XTD}aPz>>+2CmSW{$OF20olplkekbk*HKG z|4Lf>%*{IU>&=mz98~suqs^w7XnM>|cv^nNyjFMAGqZ`vz7l2>ADn6*f8Opmfm>vM zevu&nJj(El?1rXpr=nOo=WK3gI-RS2+l8##pxK!w)lUj5xmdT^3j*V&v%{6XN)DCm zz^(_wD6&q*PnDg4=^hUt>)yHYQW;!E0165aPt{u_a!o6 zJn0HCHI^PlPxQT+7D6LmmkFQIx(eVm%1OLT|q~zoPeLgYXvx2@V>UQoT@bZuk+d3zauzL*)dO zFeOE02L-3rcjFQIy6fz2(*&#NV6y_U0&#z+xc)V?pM3^;o=tSIzbKOh(B0YIwQvGeM|~A3~@0 z>ue|%=`J3fDN3H>G8nFsGi$kJ{Ke}4raNyk747epaHoz$Y{$mjUW2B_P{?uXG2&Td z%vxWu@iEm`r%XM81&301)ULA=e1%wG+MwCz z?gH-sIM*$zzUb=Jg6r
}=6R`ji7Y^W(-xIq~q>$fnXD8iIrIo(++EMGZ=Y!9Mi zrO;G#EtHDyd*K0#gt!TKhh}YBh{x|l22h-} zk}3WYr>s(8Q4C{fAP$q`tZof_%wiV(o+@>}5<_A>RN|Y5g)RA&Dg=K8QE?LseEdME zYv1QtCKg=kUy40vhVx*&ypJ{ZGU>R#dJEpUgL#y^U09<>0^WGJLc?zvtK&HKzFaX_ z2#nsyco;H27$SBWIsiCI-04n}9XImj^BU9)sQ;14+J6lkJQ^{3I*Fp#BuyLh^ z<9QrhGy^5qL-t{U_=^yk3v4K~&Av+KOj4V!kxLhRp<^$d7KFuz9nTrxritrx%5 zV*_6iV+r+5;S@ZS0i4xmj5Nlvt8O3Ys<837qjqt)20aMiU`cR;H4tCzIVDX~H)2Gf zQfhxeS~1)LIC1y^$xg**9q+Iys9bLKt3DE>E!!@i$RHp(rdf@m;RqPTaV<9X{GnX$ z^ZdJtZqQFnyOjw2ZWLT9H;h|R?<_ARn64C(pm5TpiSWGMwt?lfDDu1}E~Rq~iA?rx z@5bz-!n1=uc2s3fzwf4Fzi$(=gAFqvyL$>dqttcH?Po*gJfCMo7BkN1Z-!9l z*m$+s0z?ic$?Pr7TpCWw+|pfz(v#5md z1%K!-c#L-p5*j^f+L*z@;|h1+dzntGapJ9f@VvwEpe(JikK=j*b1o6b+Y1B0#rdJS z>e+~2%tz}!hh!$*qin-D&U7{U8}??&w%PLW;4TN_lqUe`*$GW|iEY_DpaJ&#NVIc1i@jDBEYxcj}!(27KE^hNOjY&|Jv!yszoWoT-ItI2)7Xm$m> z64n0F0Wj8fFPHi35jtP%bm}d7TZ{IXZ8lvG8}>8lSnDIB)rs&Wq+rH^nQnH-E>_lQ zFAiN|z=%HU9m4HQv!w#v>c{BkW@5*~OSGO8Xg}j7gRrKHB>95=d;U{+H3Y2X%3?2xcjH={Y4v)1&Z>)xnujdxl^LU)h zhb1OD&!2ZS;n6121Cpddu9$vkW|-a#4y^|pTn2ZLtLubqJpN!V^hqn8+VtT#0nZP; zEZ20YqD^t_&(0Xv6S5?mKxyK>%qzc>2(k9SVy-V2`we1gw5h!PFIu*+H%u~!NtjGZ z462yad!Lr{KAh(<+mK9;!{Jqilypg(X##5j&B<+6sB{u3c1=SOIr?SL1yRAHUS48p zMsq??NWHwrTxqn+!aIqcWrv%*RL=7-v-F5CUHg|Y*qG+b*2}Y0ZxY$x@%NUFiyV@` zo{g+K*}jF9mv?K_2gQTvT5eOJQw>puSg@QxOL)O~0qzu3Aap*>ck)XA z#^Gccwy|h!$Tu0Tjdg#}H1~epgE2j$XP{q<;g}eTyIj)hY>V>zSi{QY?o*M6@1? zVz;mSg(}XEI*;*aT|!TWu<0<&+E!(b>2gKmB=hZ~c;G6r!6>(qadg>z-M0eVEnfhN zP9Mu6=4Loi*s!C5b_xQ6leSo7!VTqHct-q{v^yel_*kk5Vw#dO;{h1RiQboq+8h%@dCBhvck;1$_ zcP`Fj(eExtC-l*X$LZC)j%`%7uKRvR*Rdwd_}TgDWKP7}1;F$9fribLH``yrgBJj@ zYkm5$?5a}&;Bjuj$8z~SeydV1=mlFb&M`q(!Dk+~0$@6HQBF z=(@0x4Qsm>T%z0F1t+x4tVs@bc2kfTZGHM3lp94-41IebHuIss0F&yLHd3rz7d5>v zP{e=e;F$V&qHLh&2y5xER(noIHZ@AJM& zc~zjPV!=IObS71AI@M%6r$I8MT3OIT<^B@wSMf-KnBWctcsE;4Jkjt8o9K{$A$!A7 z4Hup2hsQ#=FgT+jU>J7}GCrtkElurZ>?*tCqI z+iq9Gyi*^0@`t<5yPp-vLzP*SO&~$B!_2Zd8jLSvc*2c?1zFw!zID|c_1A3fpaqM_4-nqIsX_Fellydl|d) z&ab8ug0xs@neulDtW;WXcj|Oj&1{*N;EDnPtXtw`SE+7yBg~Rv?P%3PeYdGpNg&Zp zeECvu7F$a9t)$``v0OZ`myJ)HnnNvWA;yG8vwSmYnxE5%eh9P^kqT6DC*gib*hFzf*|zMXx@)l=P+H>C)JJbn8U zzK17R?TPQV?j<8AhsZ_pt@zk&fapBV(hgzQr~IE&xVuYUAlVj8l|0rjpBYGX)p&P25^#>2un_a`#}^E0 zMhteIRf|W(g2CnjjYe2La%PHn!*z0MZ`>X9Z1@MNUwA)J^pbSqhjC73F?H-lTF+j# z82o199TLj#01Fs^>=*AU+O?r_-M662lhciZD*cXfv{Z1M<(&~IQ@dHluIsT2?Er}< z<2ih_1eUyiAYq3jhSChIFPtip)FOjS>Zw)U9`rPYutwzc$=)Fz!JG94%6XhQe&AU| zaX;LfmbhrT5yG0$@m5Ak=?WO~IK^{LF{oG!Vseqx(-vEg-pUpE(2lk!ToZXo8kg_| zFFJ_YI?`chlDlsOP;g9$HeL{gk9+|Vv3Y9r&L7#Y_bQxzsFOzH_!qY%#%ARfRtv$7 z!=yQ6MLNbsJJmpuL7KnBFrlJtl}%-??4^u5@q#zZpE z*XOQTrv_{|o2FF*qSx|L!PIO3(Sy`wPUW8tZ0|DU=3yw>s^#uyz3?9f@wpR}$1h_M zTsq;GHpMH9BG~LGlZrW~QU^YsK-vn{0#nhdMvs_7vUa(sZ|^NZJ|vm#E%)(OVUxL^ zg7Z$Cwx<;eYLT+qMh6%sP55F4(Hr4x_v0mL9(cRMj07LFNoRxxxO>1tCQ56Ncg60w z;Ug27ji|eq>Fv#tK|gZxnGR{E$!JiOQC~d^vye-X?RAs~y6Di+R$8&O@__n6I4k?k zH$Smq6N-w7==f((^D%=Mya+-uNb`!>h&0OW<>+l{A&2h{m$ezYa`6IU`(+=IFI_V- z-NIzB6P_~Bj7!CE{XLZg}D zt`LLWW@Tb**JgerD02$dRVNR%ol^Ct_$7grL;5Z>*3GR1JQis7mZ;|kh?uOMl7%8e z2`f*M&C1QG1YEtH*PS811Os(gs_8?RWssYzR&I|+m5L!U(K?|&6hD^>_`0ti)~T)@ zA}rANg^F}q`P@P$EmkExL28VJK}}wDR0k5Z9PK6dT)!`I2rSr@elPxrqJp}WJm{&H zj_!LawE6g1O06CsdcG%;-ME@Dq@=QNa=is<31lv@X?ishbV0=^=C=Bs)$PH#`xh+e z*_B>6=e>2iyw2cY=*y*i-Pnr?Qc_HAgU`&7NS?idZz))*P>ft99@?H4!Iy7y`%au%T|)E3{*o=;x5mTW!<(dd2+ zYBRxr3zFFn7JSwmbaMUZK@;@7G{9rOXK;fSG|ii~yD(G=>e)OvgOk+kI19dcLF#BC zs6_X4H+d0gWEB9BnpR`gG^Dv5x%>iZer-6SdgB(THO|glCAyknUJ@er`R$q?>q+fi z^)`DSYEk1QV3ctA>J-j5dP9Druzt0_KF_zB_NI|Oduu&scPbzi7wTS0M}*}5TK$T( z!n^=;z-sQWD_vqSHf-1TZl*_%gFi~peqFAGr_ECFf%}%@urXtn1Kre)rhS%pmNGV* zMz3LYxB31ztG+FA$Ymf{_nXDk5k;jGYyEK`$K06cCZ>~o zEnk(~>{w>x^px<2Ia%4DpX93n38>JSg-x~#@R%-e*38)4t%!3$?MXyAtE>1in+NGG zK=hJ+`o=8%KAuhpB|qa_!fOq>uP>%%Guyu}^;7-;m?W}r<-F0vRs^ALv9NDo%hzn#m=eeB@pQjBj$CMElb_wSH!8q& zF~5&$gkcYoV;n5f9?dsJ*E>wVLJUpGz;ziMuR^=br@QE};Sw59_Ew5(e3?LiwL9=8 z@3+ZK-Z7#6b|a{%la=e!vHnBwsZg<5BP*1ycWLQD0-N~~uH!P~TTb_-%yWEas0qbj z<1L&1txco9443OUO_wYL0{&o?6~0G6p65kF@$L9CA) zkKggjfKkWxoAjyk&U0sH>we}A@dfSV78ue9SbjAufsx}?2VP*wB|hy_wSo`umJxqk zP{SeBlgW*)tGdgt;@+5-*lZU+hn=&k{0jiBkUaJC@6et3XtB*(ljXbqb^~>&$>iHa z3D&yRS%}77ZFx%3OAf8LKbiW)8_ordc&W^{t8m!HDK=;Nwu{u=p z$`IKYnVCLT^+A)HPB*oAKk?XR7T;L7Am81EM-b;92aruC8%Pn7v0j)=KJF6@1vx4v zyP8{pNKyAEhk>Q0YYLwhMW9QyzvlJCfFFOV^~}^NoXc0w`(*<#EF%T8&|@h2Svxs8 z$-ZB(NK2oI=+0Kx(2@I`=eXK$JX#8&I@h}W+@e1Pl&7@N{r+iBdk}v)zf`kC3yNj~Kdwgi{m9qsBJ#s< zFN5}Z*3RP0M=W-oJ(5r^-=C`ajMefcb{vfBI8N5HRr2WB&%T6rYbow6oiGD1)Dl5; z?xZLbHs6YIhq&dec6C_JQt_F&ho^8kr8{##l>EgbFezpe1b-C-T&^5QyS`i(GyR}V zZ~v)dyE(zbC--}k-QJLJSMddub>Z@|W(RI>MunDi{GpZgnJB4xkUxd#Rh1PPcp|GO zGThLf;@LwOVC%FbrQJC4J!izk{H#7?bi;^Dq$*9*e)LQ${X`ia#;v&$Jn!ko76&Wh zZqNE6;xwzO#c%$kMM^PxWqj`C0l4GoOu zGFRWS1j)P9rpz^VQ@=R=qRf1RW_90KG4@%1rq8*bb+`HWq>q0_)j@DB;@WOJpCvt) z_%yYwBiRifU>V3Z8iEPqO!0V0*PLd9jR|*SBidHgr8&d;%Hl4ZZ#~(H@Lyk^yVNGi z!g89P3^CsnT=F5?F^?tA!J~B#)h+cu^xL*B>bmQ}g7?*HbLk6Rmm4p{oXUk`aZikzFT4JCB?| zt+3`fwTmXV7$$I}&!FSY%d1b~xTBRlyunoRa2!;vk1l}U-snTAZOm2c<6LXk1j<^X zfey`tR(xnW8A!(gogP7TOvI1f65_#F5B0~r+jI$TVG2TuXPgNZ_*KlK7Hfxr*OXi4 zlt9dpxDaR{#SvF{%ZFQ$F85uT-yGq=p-FdRz!!golUj~jhO^v_pO5^|?d(X$uCC!m z{1sVLbJp3+t@kYZeHzBYxafDBC(8u1#(pwU#LLwt9Mz9k^EO2~Z+Wf+3H+=;GP=p& zdVoJ{vnP>2gYGd!7SkWTtSmDb0{;Zjtc2PN!pFYcij(T9z7 zK^{+UhI}P67TlE(IxndvOXhY_D`eM>T5R~-4{{oCwKnopLJ3#En-Sc9CHT*s4m z9+icyG2+d#iQK0h{687#9C~P42H}3LnR}S;4UZ;E(hiSEr=Y`+;(jK~Ce33?3KJ`J z6^_1*<*GuFLf+`BNEA>?nLznc0}pz=dmwYZz%C)%Dq#BusCkspZhWwS}!|8 zLM65tKq5+aq&)a#Yu60?Db^cyueV|7^(;G_8wUh}aGMV4fio-SGs+&hEPAcI^HxmI zWKoEVr1m}Fy|zhd0)YAn+tt3pQn;CC)Y;SU>5%dl2-Q$8ZyJ22w4}F#(1w$8-#Txb zY+l^eSX<-X>f0I(g0@xwT69evcY1=96;6AbOwQ7YBeh34{}W;W_vX9}d|q4ax!>OF zA{Xi)KiJl0j%7Nfs8OXO$$VZ-Ii`%C;6Tb7RCn-AxWF-*ag%*YKrM7cOE+cxr}PJ1 zS{Jho`gR&Y(j@;Thy=VPSOAavIVF41GOWg1;0Zm8Z#@Rxo#Z@g4y_mxFWwQmT3vZS z*DXE||M-1zsU`M8DdutUm1g;;#T)uICYqlGq6U*HLSxm!g@&Lt7j`T-LF$?KA2hh$5?c)cSN2e>y(vcJhQIMlHU%hPz8 zZB6V@GAyF(*K&JZkA5G1mdp`!_>gLMAOfTxmjhf}k*sSXLGePH#wPqDyJ%Mog-`VQ z#}JUO0+MjSmLsD_Rc67E=kviP=U?|f@l6wtM18^ved<35zI`yM%7qV(XiX`jLKXE@ut3_a_c+Do^ z(qJq9TFmMEz&w7lw!=h{a~7vZBu)sYu5b=K_yt$a!r(R6b6Dv{Ug(BpZ)!+A^rpeEBBZ67V8mx zZ=%(>Zb9qL)v6ZL345P?n(v@JDR>s}EylY&;NLi1c5&)`PDCyo*X7c5rXJBH9Ch?R>#&opHwPwwm z5pBl=?`(l77hPD%5!B9ZTgtAtUSTzR#3^cJZ|g}*dtay(^?0ay{SXI5!f2=jYPKC2 z&G}y0?``ZeR6V-RawawY_zIrx{=(&(y9+`TT~r(l%Mh)yRGh*TfL3>Ipfw|1-)FWc zW4CKVx+efnX!-rxR6;3b&!N#_IY)o2Wu3yCdm?!Up7+)q zuWHo?;%duhKg!`w9d_P)&ARB9#lSE?2=KeFSU|}#+d7*{Dj?EMeAvo8d3|OKm{aE+ zB_cKn3+Womx26tIkL5;J+QO=RU4)De?585-yp0`TW;XE6MtS^5g%+kStV%+Uq?WL+ zAbux92%g@$13;9vzQoX<2D+zTkh@@_MP3rw5d~h+vKwo;#tIr|!{fbfB>U5@e6D^W zT2!T{bF`!uD3F|-U^&ssLbePeR~Hb7zwtS(qp=sqw<9<>z#aU+An2V}+FJWdiguL((5a1!-Dla*btyl^-T`bz=pP2>gwRZW0L2JN}KABy|*t{3h}Bc;tsIC4W`anJAZu6&ijt0WC0hgZ^~Rn5+= zjStcX!aDYe(YH~Al-Lw2dB-1R@(HjD*mYy0!TrUnoczOKMt~06%=RL{GE%z1;AWaa z6-uV3{9de4?ct#@@HFu(Z0c#0Svm}-!n(E$#_+)n{T#(?wPFQ+(@>gy(?mr#+}5afD5#6S!1a-1CNY=l z#t1mk1=AF86)fOm+jH>(eU9-8K4|fFCt}*;-6M>V)|^*w3RlNyvNTURz;#o0;+)dl z15Ng1SS*(tgZaO-2UA(J--I_`5XdFC3lM;Z@CFE6OnZ>^+$ti9a6AkHQ-{JBROfx9 zskQ)DVOWl0JioT;oSzbp`jQS4TbK?*$9(x%FZv#MRY>0<`gfoPIPSt<5|aNVcIJqlZI;*^<9 z(p-!Eg5n=zJZUW27fFJ)<&qp@JkrIFKxF`haj1j`Z$?bHcVjGEb@5Z!rg3Tv0m))F z*jGBd2qlhYGiF5*t=w1BFQ}Mt?u_2Z2{0tAU zLc4-zOb_>g*tXv~t4yJi(C{*3@94Cv+tlxE>!k>k>&^XjgpX;b20ZCY5a89NDvSke zZO=+vxOsGQ4rh|vM{p1+Mu&8Mb}7AScVseBGEwC|WpgT& z&{0?x!R%-;QCblR=0x=-JgnItM}ve4-<0>TeFZg~T`ubcr<~02$_Qg_Npa@O&m#^) zqZ5*?a%O+c+7yWT=$eYxKBLhmO^K;8k-38J4;(j)_l;ccKwOffgSs!|y{Yf_8=0Ni z!D0*tKjpa9e!(Qtq!6zoU8v0_IA}T?#bI9u6na4Y2n4cv=WUrbYW?v1 zFkfD)pq9L=EBol&SB*nE8_KvP@yY!D^3VVNF93?FUcm&jIG?N=!&qT$tw(De+vZhf z>nHZsLQ9{A!Fn-Q;kyHHSX>3Z{n6$Z$s@A5S5xPvT0bLV^hp)1-J?BUPeNc}8QQnQ zg|;V(E3WZ#n_A4PBA>OysXx$Hs$NIgThprXr>ui|*Y7_w7BP~sU>;!wHlK&xG#}bS zFf1y@+}+~QECH`dn0nNAN!nF0Xd&(*XJy8(}ToVhrcVTu?{aG*z#ic6a*I= zF~d2xmb+Gj=yQ~_x=SQRc6Zq#Sh?99kgipF56wFIdtNVGo-H!ZZ;RLG?EwLFhZ_KZ zA~m=RDY<{b%#k3_fEEgg*+e(>IF{ERASIlabt#$;$oj_#^_F$jSF5a7o$UmHPE^?U ziBt19`?t}}+qdWpCl(M)6Kn$gC#-Wl;(pt&YPWBUUs{mHNY{|X4Wh0i^|`ySqcWyF(=7au?LyK@G`|zZteuz~FDJpO{Wf(R$>_&;lxa7x!V9hg>NME4=>47b4z1K7=uRa5 zsFl12r15Jh1mRd$XwI* zC+du~-4;=4drQynU(We5wH9{JL#PH}Flh8!a2g!=`AxlOsf>$;bV6lLJSUx-OoRIP zux?YL4oW_M@v1g=no&xV*fpr1tl!fV)N!LZn0GDtfRkm`L=ixW3Piym!PV z&XB?VE}MGO^v0&x=E}mHBfgQ*|BzR&uVdEobCH@r4er`0ZEnAbnk%02+t(r}HLk}JBJR;&WDmr5LDw|_}R1}WZ`OJ4{sK;-_)LNH&208zgr@n!{MV6} zp7@ReUxuKq`FRPL*#DF5!QD~7j}Haj%EtFw$9S6Qg+#}$L2-mhLPEwqXWXR1%4)7h zCNu`FdsJrZ24pt^{x$uLFG}PQ;s_rrWJ^UBH(d7AF|-HcvKysR zey8(F_vq3to!3owFhfB8$A{N6*luKJm$Vw?lRa}k+r#9`^!wnTnstspA!oZbu%S-U zdxi@wbvciKL>z4*fdiE-8d0`%GF83HN!${J9~6)jbiaqPMcs37e<&8#AV`G2_`7__ za37k6c^m2xNmV;383zuc6?8{aL%;fyB+*cyX<>GJH9gHRI6otCd<2}d$E7@J7fXlIaD#qqSk{Vl#sphReWmC z7-gF}j3sFy@hkN{ie7R0HVl z^?E0ntY?3AcJCKD!~+V_6TdzhhWZz0vo_%$@)f1&8?UWj%YA!ith@H6?_J-(8Ijxh zlE3xolmRqe)7=OG=X$E!_1a>BNh%~$5AZk7AjC4nJFHKi9F@iIeRhO>H+4Quy1wwukxi$csA%jD$p=&!dDRMI zJv^S9(UD;fevcz~c^NhjMVTV>i!3?@i#R^$#>CXIIuFuD_Qp2$(tnq42IC7)9sT(_ zr>(TjS+0`lwS2>BqsP8V-A#f>e%Pac_{g~yqp<4?)Is{RJb>Rg44fpIBXR*v-FUM% zm0JmiR#^-3{LKet{crl!A(Z?`I-#WV#mss=nXdP;o&z7{>^8Dw7N@9Pz&_GN1T=}!ccF+rP3ZhZ0!IQ`-xtC-Ylt|YSGy)`~W;C|dN9(X3 zwW=hVy&@OOc$X?Br`)+D|yB4q6`)F+IC~UYy zK&bk*W~WcE&C?pzk9zxa6f?)I!vUo7M5@rI^W8dv<$Xtb;fe!9nPb=~=La7Wb^RdNsDvKWhG z99f-O$I;#%nRNmAQ3AP`b3NM5)GccWehyH?LECXPX~*6uy`|U>f)+=l@whmb;%Dv6 zXwp=S7wc>RTA-ip{_GU0WJ2z}wwwU~sM(%JWdpn>t|x4{)UrSJ@#;6*Elzi*VB7h{ zJ@;HLyJ`1Y;#E*kVOe>~KtX%}Y(e5Gsmm+ev=_bNt-B%?%R)mVG( z_V#Ko{hkqfxGk??4Y=Sckn0-wgiUJ=0!5uy_=6t&r91Ss zR5RwaW}w>IzWQZFR&2V$BtCa2YCBWJ|I?MzaHe?RemXPf*_?xBPmYLMX(x$`^0iE% zy+l9PPC=$>><=7Xu;rtH`jFaq@#TcNO=vsd;myO)Ng$Igo4F($!8;Shnglr_iq;#% z4%wgQTJ<1%#b)UpkxJ}+)HAG8{mbUHCzWj{zEi~&Ls5m5vv2wwR7{CD{=oH3u zZG4ag@h5e6v|f6Qt9t$gTSjbjQhZcPVr0xwdOCHI9)wf>yA^{k=KF_uy`wu|JvC2 zK7aVhjd?8bdpOUja`J-xj9HZ~VBVGQ4Dep{4!hB7PB|}+sgPf+hI_TQsa9C0Ew$L4 zo~=g9Qf=ciIc-aekJQ+2CB66h-0GJVeFkXjhOQK%VNw^fC9od-=SM+$X!k5@sIr&~ zC?`pwBP7u)sMeW>$=-wf%R`7YupSyZDUBvupPi^+265ZKUetsU8J<2z634}d(AFhz z!x9cu%*}b1-xUY=1}TxAC?^dor`)vWM}2JUj}UonZRU_Yzyk}Ue@vi>!+q>;u^p4w zJsw(BY0D_jkkQ?dAgpN%0jC+=O694y zF)T0cp`DR$!YE6HUH6=R=d*n?!c%dD@Z{Z+R`klVJcsmoDt{jRT|4i}DSbk23_M2u zhM_es!>T!lXrRNGC{hDvVsB!LU%u5Jz+?^5y*ZhPZ+?WRmP8=CMNM`d^Z0mbBYjGq z%HpFSrDROZy(*P%9U>(fN&u9UhrVfnuY2huZU_=MIm zBeHv+GV||Ff-*d7A2?5c>8vH_go&G!4omt-+7y&}eXN$yOJvhY+AN)CPB(p}`L&J+ zu;yVv>n8~!A1S#WtxwpG;M%7$Kh-<4(m1E>Kh%Ef95?D+PUhl1JK2+cRndsG8LRh} z<0^pc)RWwwMfcznZ9w1Q=KBKW`Lo(l1>NK(ah+C(OH|0Qo)BA#5QSejCTddP3N_Hf zSWp?Hxciy@T*FbssL&7fFP$O^Tk@J8Z0p80v-$NnjznF_+caavVXzsoo5W?G958ls zj;||nLhzUb+2$QrSP1RBA_fp#+)bHDSvUp~3Y33p_eg%4f{s;rXb!Et|Jxg!p+(U7HWNfNT?E^A_gPKli>0WiMQT`7EEo2Abw%hX*Z#@~QCUpn= zoO5MTxhlQpLoNU1TZ;OzmQdowT*^GbvblSbPd0wY-4!D>|dvKf`x2oHK_iL8E zzB$pD?t0$r4?D*Wm-Khw?!r+s{S5S%EDx>z7pypiilHM!Wo~VW{usBKGd-$ysKzQ z=OQ@h{9XSnwuZmtgo5dncn4a2hFV1>z5=a?y7MNC0zq_xfg74b z>S26Xb2wMWnsuUpfH}_+QY3`V+164cx3CSD>ljBikEy$b^xlGctD2Mt>!j4qN9 zl+CT-97OgP;2=VKJIoD)LDAVVrH%y_j0I}NMZQ<3TQqoSqh1!F0-{7tznspJ06^VB z%xxFb|A{MEN$yM~u`Z05TXlng-8`j2tod0XhoE_wji znIjz+-%c2GDGnbzGQgVYGzpJheXE||9F=WwvT~W1lg9jM@d~(%#V_Tn|19;LA)4-R zocvPN3SKp>E3i>Rp)Y1}24(f`cx;-y9)wTly{C~A>-M%R0)Jqo5LvZhy=2Yml3By6!zoJ>P$JRds-{2g0ws*uaS=;YkFqPP5Ly z!kW%@fJkfx3ts|B+!TA}`GSWl^^;=kv{Z(M^A^}<4$1C}y6c13-x5C&gQZtoSAx*C zUA1B%j#UTzhm=lrR$5I6jt#iJ4*8#I?Y9u@9vN+U)p#Q(Ll5VdBDJx(xb)*i{833> ze5$c$;@w8qcfFW9i}|Uv4J5WdEo_E(9UIOqU(eGZ-6WgNwB0V;zp-BeHdv&l%dN3X z_qidBOFfZ7|K{j-QH*>B$skj0gSXr+n}aF~?lI}k*Shm{((E&%5EWVsgumVxO`2HB zuOICcPsNe8enHcV4`(zlb%}Mg9*}5RJjkjtz3x%p=&|`ec(k7F;=0eNYLXG6Q`WJ06#MZBL z&k*bHE{F5d!&F|A-iNOCBd-!5O?7i~zcyGYdtps|XF45J#I#;&U4|ge#;YV_oifb1qi*KJ#tBu+n3bHET9Lk^Jt7iB}7YkJWT#>xVJ~ zcsMzOtj-*GQTB9oT-g=5r-j?HEqDMa%&7{ZhLq=leRK30MVe(1ZTJT2TJ{Dtb@;Zt*mRDb;r~oppP>Q!2%nEEKW={K3XktR>lkbN-uFH3Ki8Td z0u-l^c<&(G5KCl?56%P$?Z1X6iUCcf#c72RJb3@ho&IE*ieH)**h-WE2rp2Wo6!={ zPi1+BIP5F1(2_yn*2YIEhj)xd{69=+%&X~*g*7|HJ8J1Wh-YKs`qJ3f(WHnagyrqg ztMrI!suJZH=m9T|WSWVKq_6vbh85QI245KuQ`jkLWk&A(DWNL*Xi&c}aq{!A#thpK z3is-T!8ZYX%m4e9Z=OvO7S;m_4|g0Em94jbA)+ zLRrqny2C|(w6vy1Qv4%~wmXsQMIVd;+VGv>to-BatemXxh+MjB(Ghg%_9Uqx?8xY)FsXAC^+L?|ypTE{Ss|OgbE~a#04eS>vkIVDCSO_HeqWb7er` zDUG2^cZ_eZxE(R6K3P}OTk`gW-_yKn0%{ZLdArj~sdU~?^UgbT_;2+?^t$_Y?0R}u zxbmZ+4iFnXU8henZ2iTB1;Q6qUh(4i2S+yFTwAK09f^60C$h+RKBc99A}Os`mxXpj zA~3Ahtj5KTwcnQ_UW*m4Wo^WZ5Um=ie5#k~C;7eR%ximcX|0jAui|7yeE*7VN_wZ2 z1yM$|r9Hd`ndb0mTjg+>f$ZA?yaO4|wP*Lvwp&tovNG;afy_gww2tLVj7Dz=-@#%t z8DC5~>Vjl!vOYeDsQA2rs)t=?8>k_qRmL?v-10tDNBKr>FxR{GS984>S-Hp=bUeGY z>GF_IoI+t}BqJ8zh))i4ZOu`hzoW3_>{_3;v*tnR`F%pJc{+Wx5kGKIC$(|HSZcj8 zICi&&ey5+iCPSC?VN1Rw`_8`W=!&yy7bJs(40g_d5|s&#y}0yJ2*!r`jn<2KfO%W5 zaVs8h7eo6xnm4xEBp-&qoMH}@#b^_luR_Mn>}1wcE~*n!9FQtM;oMH6!ANV|tYi5; zQJhf<;ZX~lAg>~t$j`9Vy-sC`S9?zknVaFsH&OrNhg8Bw{{GrI>-pv1ZeR?ql+7Fr$Z9neEcC+ZM{aD#sVQ&a6JmeH;H}o zG3v?lH_8MeL?mQXx<%X`Qz{~1M6ZFBYdHt$b)*-$&ovP1_c-qq8bntE5fiI?js2c6 zNjQ+-&oqV{UPj^y^4+mB--7{V1_PB@%?w;_3b@{J<1;%3j1@{HGH-oB zumFa^_b#+J%Xxe!XQY23DJEqg57~$(u$70oQF`H0^V~KCfmro!8r6$K+h}L z8AgoO3eX3&nh7uFrfByO;J6m;3t2WQ11v5TO%aCez=vCS3T%2Y^dD76+v3bW)vBmv za63EWD`t=&xir2YJ;Oc|1e1qG*ptF;k>-@pjN#K`m7#8%f#Ep=_*cdElCzi2U)h}_!u+vZs|~6*>KR-JxX>s3lYV^sAu(m`bd$nz**T%< zMmJm4wU!3EluqXA(?us@8C)I0i4o-nk5KKG=z4#u$qntq1KWaSqCdO$?ui#%T4(%6 ze=p1yOV53vt|qjk%kbaLm_0lSD_zr9OTuExxO>2PS9hd0nk&~aou@->G*%jW{Ch!j zG8sfPR|#JQUSQ7wFBw{3>{@|uh5AF5=OU)uY-XGaZer;^EL#cVkpY?M%ir~9X({g0 zTg<@mns61r?H=$=mO3n*1DaE2lW|%aLSk|R1FGhD4aaWOiq3RL!3I^XrLiIfQ4)_` ztLl|7Zrvu&hp?7lh9@rmjA?k2Oa$m$2mBY{*fA3{1xO+weqt!HS>dJMT%JXP(R}2+ zUKGm5*3&-}*eL6VK$p904w@06_xKt%Umac?T~ZaJ5Q2{W#3%dM{#5R0-CwD;!{Yjw zPZ6+fXKc%)`x0L4gUBqlte#KlM?q?-+ zE8khL+h8C?$t79IoI>wgO*BX&4~|`$WD2Z5yd;EuqsQj{T)<{NtIT`3NfFMh4rDWG zBW2dHJ+O{s3%u-6pTM8yb2a0)o8jb^ttaeVdsTDhc7_YLT-DOWq`xCV9y$0QS<_cvwdP zVn_tg?khN-?CZ&;yPYNi&{V(v)|wunvtUrUSI1h{q& zs`x&4T5J_!__GTCIA|8wA#Hlr%V%OI9l9Nzuq(egydGaNnWBvi-zX6 z4Xj>WCR+@{7Aa(?;e)vWi5Ht#ccernM!fYBE!rU6X?%FhCT6to6Z;VL{)Y~r4NAN( z&fxGa2T(kn!-&h?T8+wOr$loh9#jg=U9CBtpxjOr!=Y8z;@WOY%Wc--iVlPg$x<^! zf0g|mCJmDD|{XofR)Co0~;?wDt4#YVG;A z;E_wO=WBV?O~ahIRjtdmQ8FiT#qW}eqW{4{6VC6eK{o6C(j%l!tC6dLo#`bd&f!ux zPNQT@^@D-TOC#MA=S_(msjIZ8e#Q@GDhR{_3AzKFrDzLCFjsi?Mn|5qO406*DQQTL zGFF;gB9@K@>wQMQH}d#~UFh44TtAwu{h8744oq`tiSs4u+vVn=nGvRsvY+LD3bwza zc3;^T1U{fZ;UOJDS`e8d;+Ax~9Lzv9_Tz)(sF1$hJU9lTfqI!;TIoAv$|)xm`$SPC zg`k(pr^K02Aw?ZAVbmlcS1!FLgW`55xua-t-96GR>1gccL?nqwldQo!x{;T%mDd1k71AXg_c6zxR$BUX4pjh)dGS;)nm2wU?(`>Q@UU zX5k6w>y_|66TWpSEhEiO5sca;pT$Q}!r}%Gym!mac(cpmJ^DE}x(={f>0AKOTNo|j z!-rNsv@d$7skXFXYiMyR${jEsvDZh#D5;K_t`{&IZw!V9l5a5QOL$a&lLKp{Qbzwc zI@O*umt7;M$fDJ6p0gg10jFlK9R6DLMxnh1I)Wtjym040xms1s`xn|G7k zDExFmMd741wUNK#W8{$qPz7l}>^7}eyw_y?I-50x$ra8Cb;L%vodRI>CvwG zenZY6v;z)a!7pGM{hMy~4$Hm09{L8iF8x!!CP!v!m9~k-RQI6AYk~VH&>K07=~0dk z1}}%vXlm? zGvbrZS1L}+KC)>!?1V071%LGE#9Qr)W)JkygEMJG*n49US7|n*C|wiswt1RAwN5%% zu?Nm#T)ReiMAr;K=dH!J6P<#gbIjcDD_g|Ts@mJX>Y!^dFo$^}p^!r-h~Xfa)1nt* zrsAIJ%dM2RWt7>#S|Qnl$jDF?SrUgq{M^)c#;aknu2rf(C7Fl%@P*e&F!N~lBrwd$ z^|#+^^mseQ5=j!EKA52KW9PvH{InNpxx68|8Lv&F3L(?a?{n|C+f}{s@uMk|SoR~2 zk8Q_XwM#`zR2l@GVn3De3mDC07aA8aURjgA1%Vq}m?uR^EqTOQF$g_M+dLaL{LQdw>7uyy`Gj*k1J&d5n zWZ0HQi(rM*BMUk&KRVrN%0$mQXaI>z6 z=diN8xET3<;y*3#e_uG(ClZ)wFg+_9Y-%*GQ!d*k+h{0w`DTFA|0-xsXOFB$< zIBPT4U9p=w%HRR5;Q|87myDu&g)&9>F4H2VhY-i(oe5cFm!%eAZ_W#ICxBCQ zXTKyer6o&dE`Q{m7MGSS-iA#Z$`$;arYPHVI|~Do7wP##@9X`t46HbEA^$EAZcxlF zWJ$!!j~EtjxQMH6did*bcL`zeW$r{QNfDC}Jrr%iIJo_6qBvI)aqIH~X6WbKC;h~Is( zvu-o+w`Z%%Qb3HhU1d8eC;A#|acc%glcv?~M;tOUg-Su+#nIY?cJqfk!Ur#r>0}w> zw?)iv1gHSRHJ`>^cZCy#5yyE~gZBPCb`zTMrig?H?#71?M07;LBS*N?ia=+9iMU{f z24&U{=hce_`UH)@jSq!`)Ml5-3ai`Z7C)oz0%ra*QdRp6FOG%iW!pKw^9=F0j9UU( zwJ3>QW|SI>%Q?J&9rGf4J8lu%V14>_xJGA!n}m} z1tn|3{%NwOG52Os6|507MA^uO76(G5{7zzMZBV3iBStz5RXU=dbc_s!N^eBeDZ*Kh z9yBPOvwiIoOb)>K4Dn2TTtdX9o10?Y^O~TYN5`$aI-GR4A@oeTLrrBJb6Ur>7Rjnw zeZ>V=%5k{f#es6=9I{lUJ85(~38Chdbrc#Kj{N+vVDNnfBqM8p~FZFY|0=lx>5U9qB@|oj*61hYvw$j4Kt7St+o%;B*BBN6H1L68F9MWbl&GLh}H4F3! z-+ukfrCw?)ZmpxeqP^nhctA%x6R{`8Q^ymKjg0*)85{no0{)UG4q_Lsru)}l%7jh1 zzjNH$dy68_h{C24Y8J*nNh`&jjgH7*OC_0#!5=JzGR>>LJh*wY-D6BKhWeUs+?-pL zS@(&7od$o2y})%GgBpDfk%xq(`hG-#PfhO^<27>Uh*xZLOP}kKSUU8XypU@oX7LOR(u1pz0{xP2IKNc&3usx zI0xBE;!EX2tJdBgC^B267HYH3{^19FHdbH(gwXr(+{X~z1|Fp>qSA+3LkVD18w4eZkY9SoFS{9LZCE(fkYB)Cg4)4X8TTA)ttd8Mo#wrYONIRm0cxEG&sVB3Ujq-hYY{!51(3>kAEulRe zjg#X6O{CNH5H-B!Qx;6xAVY0ODB1{8GF>tyFMjsY@@qB@iu_^}3ubMuC;iQD9!Woz z-AYI#)2;h@+=eZiyVX>qf3uiGZQVr}43iT;v9V|5TSb}1=}kHGr1I?x{>?#t2ZJ&w z(Y0@v427VjOE=|oF_TK{Pl*NZWof}{ z7e|85IxfRSvSy`?qS}3V&a;zWnwmQsXfj9y%!34qMIThA5fxG|I!ZX%P_o~NF>>%& z-aRU{pHp>HgXQI<%M(q;Fw(XAm5>6 zjmY~569bbc0DjL4o{@pX?O1NEi99_g#Z}^|LdOYUC`15{BvnR4#7--ojy0<^oN|u| zO^5oYsOzu2PJb`BdQc+yS8=P?Xe@l}gZeb$(`uq!O3X;{_C}t+8=_}3>j?g-d;63l zJL=uCnfe7hoKBD*;&8QfyTpluc5j3cM*|E-Bk_&w?R|X|6`iz_POYdQjD~rz?z8zy zN|lOJe#C$pW`uy7{VK0B)vDL-(fX_O{Ke4s{Z1ptQT_3T$rA+{6!`hfnR2Zns=K2@z%s^Ae;t+S z%X9&9(33R(Yj5&&MaR;O=Qn&Q1i(B5`@T5?rkXKadpCu%PCloU?x+MYp}WZkFc0!p>Ma~2JpTghf6||5;1kf zgln++;wpxI@hUvJFfn=XRR+F~V?tuD?owOWmY?(>T+);4Y|F{cyCBR?q*Bl7V0&!S zmDUa9**+tVc?RBKf!c1#gm1aeyr42&{la)g+{q&y}BE2JmNYx6f z74jIG*Qn16_j6s*Ql6KGUKW^zAiHU&ocH6q>D}U?+q7=H9(=`wgZbf7fMAlTqt|8H zttk}&;3pabWfpKl9o%2?xnsArErMukcQV5P2R*<5%fSRe+1XcsvE`GD}=C@ zaii$3kIr{!a@nRFO}YSChldTqGl}MsqG4_v7ry`6vP7tcov9lbC12#)67oc`>w(9u z{G*j11uko~a>K7@tVeMd7LJy(CG?iXmKOX?v=JR{&CX514@CMm3BM#&z@;-vd7Qq+ z+fHIJvNoJ}Nm+l~*HG4xqRq=lb<%R9$qGrpjA-W=(cBJN(KS2#4vs1gxY{RPrr5Lu z`N5lZn&2TL=sOclx?m4hn0!5fCE_`{$#R^36lOUb2N`;oF!*!9#mbEg1`%yG$- z*tJG&>aPNrGEXMf^4=0xKC>(J4h%{k&)0dAmt5C3 zR@fbIMo!~2Dip9G*>-)mU=~Zw{xSd&E8t6Fd|-Gu>q6MFG-tWiVM)bhmEy)YtW$5= zNpUi>N4mbU)V@~&!AOzbwV1rFt~86RSOfC z!i=9OO@0frN5FTqa^EIar#-HDs_oL_QRd@L9JlE13c7v8#!ou-Edps1J44qQRx3ug zacUOg#<0!bm5imQ9Wz-VNk-h8B;mD!GjIzE|K6^0CEY;0vSL`8J8@8DeF!E7OEk^V zBU1VXp3vX1rkiTcl9HHiwyZvF&Raba@#0J2XThWjuTvWtV*9j@ny;}jVtzJY53sH! zv>L_?)?J^K-feSk86xHRKyXgy7`~o-m8C*)U3Q{n5Zx}ZDs_ax;t6CwY3WXS37b#j zEhEP*^dv*V^4!W!-*>D=GK5*Eqp!Y6^MmwYb>Wh#ElXur1ab(f>l@=ItNA5&i^Uvk zf{@4({+1ZtUd-o2mfcF4jEJ@?0pD6xt5wT}oWJ0FnnNG;ZFk#_KUWZ zYHkEJ_l^|YXCdmDmC>hf`K*^`W%u$mx&NF|)MO=UShSBIIZ<)qPPB+yGTXgpLPE3G_4+jEVi{L*C|L!GR?epeKYVPgQKS3Q>1Ak(>k4UDcrE?!yoq7Je%>Sf| zi%6@M@F`kr2MFp;5v^F3-m$HSleHW7_xk6SwImOzm1{|Ciihr(-81|lXZ@tLh(R3|= z(ex}m+MToc?{^S+eF_J|{uEw4vH5p2oJ3$WoUWerE`NtzvIB-)vBPvm@ORS4{K05w z{4q)#2L2A)o(Bxuo@ZU-pJV3F9sZwAVl7W|&^NL3qx;EHp*V2Z4{uap+ZlH(_-D2r zAg$ieFq%%68wG3A4p-Z3#Hm+X-!wW72gpj#ywK_KjU{&$?a8VPhLuBoC=O&Pno`yV zy!)0uvECK%=6jfQI`VQ?t&I0L*8OL3gi%D$&=w^-_?pJ}x9L_GCE!uK%L}&OwqyG- z{gw8v{F>M}#K0b&8EbO-24?YS^$gm`1E}# z(^eRdN6BYNzE+I$51uMBfcE0Q&CJe0BSH`s2me$PdZe>x<~U7o_Aen1Lg(r{$*A*aRHG z6r?9vaZ5>%aU6=+q#=(}Jb2rA_`O{}G(z3ww!l);E#_40-tVP)P>BlTG22@eUeBM^ z?M~Z}USnPr_gc+gmHb3{_rQkU9*D-InK_9HiI5fTM>?dVs4Yn9W$!yV=E;5c8wG76 zp{j1`Z8HYU;#D^3XHOFE{_KSaO1LRDtkROw3>iE=0S(tfVU=>j$Pan)!r({I$t{xM zs@r<8fZB_IA~SocEZ@xsE{A>E1-G+QBG-fF=?ANAxaKcbCXUwoq8I${=n+Y5GoqM_ zemCrxbDl@|#A-!O;5hb7UjWPfwF`{_Xr_2{rpz1{>{vloGM@fZ=EohyB>ze^9>tEZ zN;%8E>Kn7!UvjY3ZXs52{7e;BNT05W{@oM>W{Hb7fFEJNp{>!>IY+6kZUMrVmu*@_j zYAEo!rzc*=(kS+T0&AApOr?C?J1dn6OhN_f_EeNG@vS9UlMyK@md?#{Ve8O%S*TnGTMA&`c7yg7t6qqt5mA(qJ?VRQF;SEfQIv@Wp!tA&2LHqQFbjTw zh>ce!(z4-ro4qtmh@p7j&(`9|x$IUZ7jXKEl=!SkI*fPSa0{ek5>2@D>aQ&7ZvAFm z2I{TPcpN0b+K*9x*pG8WWoTkHFW~qDm%iXAz=b~F3E^i?Doxcq_bR!%?V+%9Cb7K- zX0xlmW8(E=6x=TG!}Bp{GUH##36i)hTfI)p`_xa|KhxbvjUAYt;QBvOoX)H5Bdfi$KK(_>HJn!k`32)@je7cnTVs%v}SvF@qc5 z7ELe?LzEvHfic0FTNzW^Sph|x-%tN9LK5fs>eZ!|>9$;KhA%fqFQIL@<#6H7WYq(yPJELaS*gW$7ko#Uh!)@(jcQQjUZ?5Itx1p9V;fggL zcel(|E$`eGIj#d*vjAbhIUJk_{_=U+K+^o{=gR7&PI#;jI^%-oo-VbmXUM=jY#?wMEOsa8>MxG1})AD>2R@w>`OFXgn?@F^aEvh^8|3GUFy7`GsL+(-ltgU42uW6U|H~X_)Z7~MfA09YS3~H8rRdF$`ChgXABLU zSjbI&ZmsFG_51>~|H%R!KIIz)+_tO?FjRorDSKfE7=X`zs|HQ!E`C_26(PgjJ?bo*7PaqLFb_Cr&MBC(^;S&kOVZ2 zE;g4=vq62sYDv%+G+1GXK|mw;f*2&W2D$9|-qI?w!&aCD+UkOh+t>w!Am#gb{nG?-YBX-GnPqa60c|@p)dS0|L6IRG`(T@6Z9Rz;J28B(*={*CPfFO;w^n z!J4^YX;O(nJPM&5(>c{X@Y@{HL5Ct~=#Ub|f5HN_7bTy(pAVS7gW`OsrNXch4#F8i z)1CcgRfBa9BkdXDdev7Y@t%x4;h=XF$1ysF_9OF_R$5vbNkWj=cahLhFA_N45z85& znICWIRkHy?lb0>wYj7LGps7)#G4YYad6nF()rdOnzLoCBWi|jnxDCrnN=AbkLcVEA zlvM!VUiruelR;pjl&4zw;~I;_svOIVK=zcQ=esY>hhGs=X!^3QgX?{%IqqzxDf!Hb z-3|-x)TROOtyE1RhLBQv2D>Z89Ll5DgXOZdd*WwjshEK^n4x5tw2uNXAj5}JqD#X`X$8`CYsSFmp(q(8N zY=tVdB4l2^PjI3rgX6`bv!zGNl{2(jL}}(p=yv&BP~i@LZnz7qbo;cMnOTfnJg$Bt zSNEkrxms|cX3yS*osw%T|Ko(y4S+Z#B3pzrXUyh45c&o3T#!WtzOad|?jsdo{UzX~ zd)C>3Mwn%J*pgT+tcl7*_uCKcoOfO362hELhjzyhkYSXA^}q>=bcS47VG%gPGwYH( zszj?2nEs!D`kL=PC23D~jYtJ0X@MJ7Wyhh}I?!~GS-%(W#7tYEIej%KzbN9~W$g!N z&A~U6wO=dY*ev1+=RwcuvfX9M{e0bS>n_BZg=VMiOn@CH3iloU*I^12w{>lc3ydn$Lh#;dI5QNxrSGKqR(}C^sIHU=??De(B+LZCvWIotL9KRjS7f8ZMv6r95TH)c0HYiXiyq_p@|H zCT;jx=kPCAUz%>JZM)@pHZ=I(Dt^~Tt6!h@(H#=;p5s;*%4QU}1zeY;jz>rYY&|cq zmvI^qIjdl*O&wN^{#+sXmU9jDGoeuWx0^>}87S0^sl6 zbo7(^6Md5%P$Wbz<3xLUn_g?`}&F)XV8dI2cseS4a| zQ&cZ=kJRB>vEk1=W2}}+g|JpnmUWd)u5iN+d@v+u?9J|JgT{)xjv}Hba$cJ!yHg5B z2WCYgS1j__C>EMLz^B;Qod~p;*P_yW+jc=5I&t;8zWA0dL8hPQxB4E#NxCB}&>A#@ zKzJ)bbHQr3Gs$SxRV5ww-Jb{XVHdhhL=^%P#foJ=QOj8bJJKGZCBznT+$1!dZAR$U z#E;@jaXkU}No5`(WE?NM>*eF)|uW6Ml%{LPvC)`>cUn{pDHT~g+R z6z;xG0DdW%Bm8BLo36#3apph4@FJ3_SCi)D;41<$S5f5zmBFFi#YZhI!Px=q(dUlj zUVVs1guzU*oe?YncmxbRM_xiW<~UYT5vvVwl;ySZt*VX``-V75R{_2oo^b77_&@^`&Ty#C(Zk<~!W@JsgBhNIP^ zDUQJl`-HguSO^{0LTCEypISPFpSt3uqYj<03 zbm3ZHReC|*g?zEX+GWL`@X_TB9Jf@-gCOBp-wC)ct>t3tge};15M_L*$;GnnWBk=J zzG$Ohh!ZDuYPqAzb}37LAxS^7BI(9q=^=CGkok2F==z&?*M>nw*wX=3*6flE$f4A} zc90b!<83VXtWg}C728td^9I*%hjppJ zBd!qHIy$xd)@e)z1K7=fQuzq}MFy;b6jYLAL_&YWzc>JZY~H}_ho*WHtv-qJRrLIh zD7xr@{E+4SwbOsVhjRxkOSJLE;Kqslf1v`H4=1$NngmYh|AmA!1_SuO1J|Q??k@sh zO?D4lEM_>z{{=1<7lZ+1@_*gY%k)Np^LS<<7wYx>_b2PWutZ}>Qzh?CjG1=@9l1xf zp2pzc+XJX2fWH!XeEZ-xMiIsxThddyJKhiIDNp7p|Nh2FdbmVVitrY8L=-;{>^Kh( z&in{7?{;c-ES%d7|JxG&6bZg^gKLeHV2&c&%VGHMx7mY?bX;pFckgG# zrzy)~=-*EO28Hcqc9HWNvw1o$!=ubcqw3GH_%Eb`4R=diFlWS4NB0*+iJ-s);17l0 z5I4YL{s;bG-yY|Q)CjdnMX+{+uwPJ_~V$P-tC5aaIlK@e*XJS zB{SqD3b%Pgw?-|!9#`+Vk*qFgNGXM7p4~!;aVw+Aebm>2y2~rAU+$$Ba4Qz3|HY!3 z=tcO?oKLT$(zH8gueqVzoV(8g557LfH(BkBRM0#1){`hQJP!Nvj+z}ig_tJwCW%bR zaJmE70MjTIj#ZkYsm-@A##`JyxD;KHdRRW{*IK^}-@{c8i74+b!=ZWTjg+|Sc;UzyJn)8|m9GD+;l?a# zv~XT>{`?rXFOJ%QUgZ~yPtjO3#%blbUajYaJ@7hYsO4L~5EL5fJTM12_bV(T%bM;g2VRAMfU zHs2R}tzbkQ?b@miayDgnu{p0mX%XSWr<4Zy*-JhUr-Y2J(oQK~+OPS;kX(G{gLqHu z8||sp)Q7Ely)nYWM;$AyG6Lwt!j(M(1#OoRw42mn{8Vr%a|s^pANDP4-h-XzkmixEvRxDJ8TJal;ZQF5%bQ1N|UVS|1fTq+y#6>?UC+By~D_rERU&2!S zNk$@G%rKqz+Bp+)JI^@PXioWBF_WK6kZ>)}!LKVrGe-<6GPbr=)exU&6W;^iw#>^u zQgP?BP$pwho*}Jn%`7SC_UsA|zZ?z4*)OvY>7FaT zCc`);CO1ef~hiHkb{((&vCt0Ezf0} z9ConZ5e+5C`mqOi`*Br`}^^HeLg`M5gGiV9G#dO-q0d5?;g1fuByE_DT2=4CgZnwDa&7Jwn*PU*f6@FhfD?T$!!gQ*p}IF^A@XZe?@ z1}G7mQ1=f!AvP-3H;N?7^iQCl8pt46TTdqj67vRxsRBZhL7$ z%#!zDRah2`J&0*+HnUPlvYvzmSc;!#U;dnZ_Qsv5c&-?HgNccplwI5E|KRA2K z#Jzc^h|9wi>9sX&A#HE320$a#oJetc8j6WVjND8p^%%BY;I9UkSF`Vrl zM?^6hG>g<0iRrc5$})Mt0{)EA5>mOYED95e2J-;0cfNUZ4U5$puUegTG#xPYh~Pe= zDpo5k0IuW6C-|?++#h!nDJYihxYdXqW2(;kzSeNFmo8ul_Ya@@?vF&Cr_s>kDo>XY zL|S4>n>OoD)jfVym>-(`bv(29m@qz0FLszrMyGOMeZx=Vwa^Bu0$X>yGxeY)(M1zoilSO$x;ZS*K7Fiez0 z=ODv{vvowj=vU;>-a?GJw}V`^1~ ztr^FOvsY_;wdE3)WwS$A^#d^U6f5)D5UJyf#hTPOOZ9`9D68-??$hyK);VjINKe54 z#kwP?Mh08A1KSGALh8Kcm3(TmIE)jIb4x}Rq20oojynPj2hgEc({dpCB-|9vb!{LH zRDe6O=HUvT()*#GVNa}Ey^xEya#(KazpTESy0f^=yeWs&&zm!GA$fbeBG)8sNSIhM zx*b?HvQ2WEEmfJ9GOL|6*`>ESn%wE%mVru2!k;R)+@eXSOiFvVIqkkX3Z38HcS8c> zC`_P3Is^5E3>&<+ONU@FcKrGjg27m@C)B#%sG)<0!%;b>G4!3(qI&`+g?h2DX-1B= zvY8VCM42`To63T<#6k{t%nm#s!d8Lb>H)u-JKR@O2GOt^w(Et{O(I}awN5ew>PrL5 zgIWA2+qwU(EW5NnJO+%Ma;pA%i`!u)EMJKUM)OX(ysew_G4f9b+f|mS0uv@k&znGd zZWARYYN(v~q9(;+Rmo7g5mnl;60BJ8I~h*Y;06Yylt0owb+)^v;XUuBG8f3Ss>GS2 z+D&x!#F1g?EvlBTFSQ%f7#u`NhJ8Xcyn|$Z^#UT;pJ&D27xhr8{0Y9y0*0KA%0x1H zdYR`)aB?rdhX5beU0|tU0L=P+Zi#SnUJZvKP@`IUN{1>G%3^RZjgmCLE*rKxU;f^V z97`JuY}qDRqZlV~;_Z?TO#V`inB)Y9iEwWWGbcK{5n9E(vK+;E<{?G84)lrNQdeGS z#Va+`!=oXYkW0oz0XeQHb_u2fM!>Re1hf}79!vv+QQriY7R$7{NC7^hIvs^JRU2wRurMcse+Z1OCLjM8Le-{6 z+f4m@Mo!inm8qB|0QFBBj-}*ZgPSvzqW%rxg@~2wEb0XMp}9SE&<2to`(ybnjND;$ z`ZdX;GC^0nyVq=rW(m|YD+5-`Iv~Egk zQhWB>Ze~_W8aC7b;4`e`foF)a(Hj`z zIR^$xgl=W-0FNTcQj8pp%1{AA_*?T0%O*=6eRH+`Xpe@uF@EKr| z03DHb{w?giP&#)#%bKrI `47${?CLirN7WDkt@V z9b=+y#1q<0*{}EP{Qh&d>mYD5Hr4=>aU{s6$BE75=|vpLllO?z_&dvKDbavP%>?OW zl7wB3JepzP^1<3cu6OD*W9#|$f#30ZSVE;%p}~0T?dida#(HqKhW8MY)nv%Q1od@J z*4R{&0j-J{ft3p-cj5E1{53ul>+#I>sijAD)aYjTy3$?euIWCQ#JtMkvL`uLPM$rii3 zbjJ9+C)qH)10eG{Uf~06Vo3RmNmx4$oApm}3skwZm2E6=sVO-aX*9Wjz=U5Nvm)AV zCt6I@LcKBA2h9+DQ1}Lj!j+a~IZVEIlO5awk)*=I?SaV12;Qy1B8^5%d16pX;L`~& zufNHg09{TNYS4!Zue}548_L;8!-xEWkq!{olRzU=jzNzhZaN?!ly~;$f`gCjZ@*hI zlmFL$@c1t~ZUO`HOTi(a9S4L~}2G;qVnkWKB-;`;UEt zOYLYNF_va~?S^Lv%ka2UvmmkouyC6h;IyGK&q6&t1l+Vm^LFhq_lp2vnEje>O`Iyf z%wdt6*jmmNOI!#xEeCGsJe(`qG&w1|$Yu>;XHW=>Ge@JH2qL&v|;rJ1|pMp9j{IxRBxT zTZDsg1&}^jCf;=-VayKe_S-U(fIYC}fdxtjRot!4(&P6jSf{|>I(KCd$9mCrlrM6y z&)g3KW+TIKaUC>q$C>R4LUsH$<6~gZkHgH*=XMviM6krLIH02KqO?4y3B|K#_~03p zaEi0{tqC;%nW*9sEP2Mv6TvIA%53ir7`+og{w9KyDOp4Ic)AHLQ7TWs?>t*Q|KTD? zitW$YfsS{v`PKrg9&>?Mv}yANQ|&bPDj&E%_9af{ zM)Idf*SMsHEp(w})HL9kZ;k(|<27}gJ(iT!dVVM@ns5`&*?My@{fcLN3h}i-Wi^Z8lK6`7?Xl5(g>ObJ)O-5Pm)%8qDcfAedTJDt26F1r3aIU zc_j*O3FNi%cr&Z}8kO9d@%(kLi3gX-0 zi+7Jn5hs7hr&{ftRPfKStgd2SVVU{6-La*FuSOFh#Gc?#;Zo>qVDg36B__Am{i zJTV5P6~u+x^?SPXM}^Q;ihlt>aiHc6fsy4pl+L*h?MdLN1rcLMnTB|xt9do8euYdOdvyR5h6sF(}PqK1b**GrLhyR&NO+!F2; zBl19R2l84eP(y#D(JY%E_ln%^&s;N}z&GhNtHjaM8e=7HAf<^lMIpLK9C*tn=0wqS zJWhcxVnr(LP2=G>>V!DnDeY9TIZi3RD0vV>8r!&UZ6&#tjUTo)5JQ+uV%Ez6YGFy? zQu6g%>Pc}>d8%D{UqYY>F}2*-nK?;zjWRtPdDYIb%u>k()Q{(i@epy@#B+aMR=Inw z*r8T65B7`$V!$k9xD`8OzK0*Sr#h#&Y}Qdey}nYoTkCZ9;;J(228liYTeILIxI|5m65n$i^EKsavQv2#rY1@}S(oUcM!?~x*@%HNK z@>*=r%@+VsJl>;Nm*?WU8VM*m!!oE{d~h?YyDrD_RJ+=)p7TV0=9-$YW1K0J`q+20 zdNPezI7V14mj!6rdBJl%UIaXq(++bW%icHgdq%O9YO7g`%K2&9+B<_+sioTnBWD}- zVZC8Ch( zi}ByN9#NMZqY1W6V&gkmgvsJZ;>=znYFi4m8V{z-pxRG!tEe-ZmtAVGDBUYy$sZ}= zg021Xc*(Unh9UiPMWeY}lO>*GKFR1~S=jM|nD=B~*Ve321LLIXvAEf6Y>E8|(_EQU zfZ%wpLSdTFkjLHAbgnG<#U8?-dn=cMYn)jOaCS%$|1z~CL9CtOyI;vYHJi!{=DogQ zHSORADwAfzMBgul4zGoXnlA(JcBjS@B^sBl;B!jX-a(zWfS6$0>E70%DWRKoCgHPW+!pqDMu{@ zpL0z@jIgmH0;nr>^^|E8tDq|3W62s^C(Psk1AwM!G5t` zLG;@;3@$FyZ zrsP=V@Up*;YU7Mmvu(+DE>k1cbJS#xR50G?@aG$%@jW-zj?R0<#9;&3ig7F#AmoeD zf|kOu>ZT`H7Y4rb;I~BLuNFk_ghwYs)pyfg%sYrTz;eY4y*g=4W=!X4ql=95Z+_|< zd1(``RBjIA6?b7^5zbwTzjf2n-_t8D6V&C+lc`mo;(jSdB2uQu4$2t{X6&HoiF6|b zyOc>=t3|ERty&B$v`xl^nFVkHst>#fiGaH(6E@FxjLqxqrA2L1u6IvD&4(UJ3e!JP zl7-S_a|28W}N&)m0Kk%|LJG^d0 z2v{^qJ?Ab%XIAJQ@u0JDei==hsxwh=IX-Q?VK;U!spxnzy^Z|cvxlEq%F#t>GIqoc zTn#D@c?vu%6j4HJ({W5?Il#Yxo=qI;vgLC{k47MaeK-DLGSz+}$$9%g8<0RR*03oE z<$?CCpsu^-eOJiL!fM;$;zIG$rFsMB3o+L2KVFMKik2$zmt*qN(?6`2`3ql`lc<4Z zF=YxprGO2w?=UG;w;J#%Bo0)_ay?gneUXiEk=9W(e9ALzc(?acsOh-TC}e(o3Co=P z4Bha2ubVRCqiMHrB3Z||g>B#qv|v+I)6qn?elCmR2yK4#kDpn5Q03pb`~uid^SkBLyy4$JrC(q8I{fj@3y2u1Ltq&EJOO18K&oK!R~_#BEBK&M)^)LRn^u z$SVmP!SGN%ag5VAd`Z)Fg3`{dx>2U{_~n|}7Xca3v{%^8!)^Pw<=;tFXh>grhcImX zocV&W`ykC5V0Ku4>cj4kjO&vnqzaS?d7VhzkZ>&;UghqxaNYC`r$~d&TwoS>|Kg;2 zxq6SK$wZ-yva)Q1elF3~-TnrA87cY-;o=diBVC~pv$X9R7zFEiDpkt!J+jTVIM6)+Y*ey+DiLs?zEGmEJ*h~0gL z5u|M1;cCn1T4Q3i`u?#fo4<}I5cHK*-pPJ29kk=ZG$#zTz zO!Hga5CFjF(I|3u%_r0?y@W2mqTbKlkj;|DF+jmbj!XzR+35$ydEBB^2oZi27Fy1! z=Y#e%+r^AO<=Y?5c^PE@5BUn_hF{hSkV+}%>zV@$N=Sa8R@&K%-lN&5!p|6^CMA8% zw+R|bXqYbr_Ll|jtvySJp@_!0f8#)Gq7dUo6Uq4y0o7l_@Y&TPb%3A>0}xp%dxdt| zL)h-R&nmM@;o1#sE4cjtX1^%bIn<^9LC~rphREdL%G&)blzQ0d;pp8AX~M-|obqoR zH7U0aZA)w;e5BhS4&LDpJu-5aW|AhB!m{yv8~Wv`)4FMAl&@ycgU9_UWtX3fB204w zaZE3^=qTX*1xGytWpy@qe>=*0C&c$YCDFN#c266qY*cX+o2o7E5-O5iW%4d(MnT&m zCY0>x*6spQR9De_hf7X^ zi05~n?~iiwB>9^{Iw{MrX9JBm)8i?*?fI?si7Q|OkDNg6JP9H;JQLB;K=ik8*9^qr zUxcAlZv_fDc|-`S{A`;bGe;C3sEtTeFDlecT$eV7K#m@;)Y$pTBzpgc3GV{=Yuiaue}x!~cmNzMtN4JotO%FGb(wbN)^j(fOF z4mQg05OrQgk&(3~P7IEvq>;!$G(R%VA`U@mNv<_4S&ZX^Jfws`m=bjZBEjSz!jG8m zRrn9L0Zl``&C>zrtaXU~aO4P$OiIO4P`U`ZG#N18Uvdi{Xlwd@n+@`;q@P})}aICK4rO>uC~l}FGQ93;NE?R`V~Rrf z);6YWvM3uGH)GPPQ$7BcN3g0ZrXbV4z%W~G2>YKoHinks zkFC#}`ejpKE`4=CLm}2sX=Qs!W^)#wd&r;j^ImX6UiSg)$cutsOpSz81}rirm+qH# zM-bPr+myzc$+UNo3sWlnk=1{0at!dfe&?~7EPa=0M{(-#>gQ~RL19^%SYT=h;~|TK zhNuhHMEeV`<{shW(%$}QQUuD5C}*rG#Sx>E2c`h^m%gCSA=*96?%x#qqu*%==clvB zhi;f)jzocpA~&pGBl+HvDkerjgsL|3*dWU`{*6m6Xu@7q#s^-Y#?Q-1i>qs?b}#kb z5sS1cm(y7Ju{LB`ne*qhk%P?R1Dcm_~i4K+3h)O>L9F8ilWH>ny)ZN%m%Vs+u}jj)-l`Y2o2 z1Ix^0Nh%~#aWb>~{nr+!_&%QxyRv!z9YIhCwvIdf9i=oeGYFn2iM)JSmXwo`YTpy| zX%Kv(7x+ms^)Q{k*T~z8))0`qE5&Ciqh-q9xps|G^^EyGE=K72ozQbhv^=`^!h=Z`!r*X!7Y6o4SaBlwyfdmH?SQS z%D6C+Y{JRfWwj$Zt#&Mlq8mn&BYc^DIH0BAVG==lb4=1BQJv9Km!a)puIEcIywpT1 zBfy-vog1eg>&Gm|v%qcU4V3nLbrVLg`M1UsL-Xype@6hFf?+YZ=`Sg zbp`d)=TwEZ^0CgZHe*WjMNqh7)K*AWcO37gkYZz;cn)AXz!g~(Iw=jW+8Ol{KB=({DBlbJKJ%e#oa|1Z`v( z$x;ibxvUdjDhma1!yL4-ldK(=|MF9Sd*CxfjU(B@=g%3l|HB{wAA}T;^s)#J)c!A( z^@sGL5lCy@Hj>zX{x1{+;Do^dtVMr$LHobt(;EjsAH8w-F??js{_}#~^dD(2azfAD z|AIylf7e9;hHE|GALM^ICBUdc4m`i1x2N(y&;3ZRJuCyH($g|Z%cuW+sfO>s^AnsO z;{S^@eFO8t^KM&=kBW{a`H0Z0Y-*>!X~Vt5*6@_}71#W%tPLH}rceC!_-^0vYw>NS z9PMWO7fqNSpdvibJ;p|m;+$KP@tFo=OYD< z6f4*p=B6Rt%jp07*gM?^I4J30x$rjs@6-Rk50$Or(AzZn&%gVBGkxeEnLc#vUqSzU z8{fcEKaLa*Jm|lfKH%wv!~p+Q`1e5Qe-Fw+81PE}{~7)Njvx=Dx49QIZ9NA+uj%`m z+zXx>F432u<^KD|pM9q_X3sjNZDXxvww1<_B7a;GSGn%xCMJK;dx<@D&{7O)AHGN2 zY*r4gtGza~L}O)IVG>0yt2vyRbIr}o@LLne)wjl%x;cx`=y1wFr(m*Z9M^}s}}21o1T zR?VyXgs4uSv|lhRMU9ODnO?zY>}LQH_(Rk`d=*wNF~x2$_x133%s9Ex**}JM_(WFs zX(j*a`rvR0dMRK1+gq{QxKm{T1@3O=I~okoudELA%ETLJ%$KQ=;^5$@@q1`^KX`m# z*va2)a>!5XaxG9oG3jGINU^z!-HtJGK=rU>;y`TtaIp!LmY~PWtQ!F?N<0p8@wrPY zK6|xylL^3@NdvSw$Td)xqK$L{;lDmJV6Uq2YkF&&({zT40Q7_tIZ+bfyb`e^Ll6AX z15y}(#tE+vl(FBq?uj-7T7M*SJ60E&?Q2L$dRgbtI~l*C?Y< zoA!!Xf~Apoda_x5+5eQ7x;k+)nw+fyg>J~%Uk*2!8FI_Pv^RZ4O z9443=G(}_@#aFn{5sC32Q>L;cPq!eZ?!*jq#$h6AM{nvG{UD>O!PDRAX3AG3qS}^lP?`@36L-Cw_1UWKMF^|=2gr{FE4A-j4+}GTH1d1 z!5!MDAamtz<6JG3Rt`N}ZZ~4j)3#`mfZX4EFuzKBDqGaB@mR_;ISRJKPta8Msb#26 z?ohiN^rUgw!%hn}j%=T}WnwV&s>B@Ib)WHN~ zOgoq>!3X0F@#bxBkp92rff151Q>l#6hwmlgn_z-Fg8AfLYrMF9J45Nu@7Le9l2>#w zB=BVfPKpkb=P&I>VsHy(ssm!EuX&w)O`>01>_#91=MoZTL!|tt`q(UYOB`w@%3pVm zX^~=RFeD|jA8P$InHCpH-5Vr1p$C&pL z`~fmSy!v0P75qZV-(9&>7NAhPnVVWo zKXgr&$__D|`wi3=0m+;R+d%&_dqSHF+6eifT6o|Pl}bk%I(@=H>hN#+q4r(Z?mg2} zm&3lqJU~zR6AluFwCmDTFJ= z<+EuZ7HcIoRu@h*Vzf(N+P572FvFWLZ~X^_MTOzeJ@`XmEa^xr1rFs-@^KT*JAcdt zG+{+br!Yx;7zI6a1WDQ5=IFQ%Hhg!1$EsZQsfOdQie|WPNpM}}q1^(UYEZ#AY|3e8zAI(&GAEbom z@PkeJL@k#A(JVAlZ{KH1tyUI=POGVN-3!+}U$IUFpI8ge~R>K9qMp?4LgXpQ)>XsGjjB=KR?^upQSI)qcmWuMuNUr zlR|zX%th+EGKDmxnQwrZLK7-HhB#dro)5?Gx2o7Asd5S}r?0vSxm z7Q$-?aGZh+tJrXuG)ZaK#Okf3YPY^~ z?hUZj6)Tsg^haBD`9PYceCHrx5GMT%x_n|bVgQz!?5H+if~^RxWlvTMRcg7xOJt+WAZ>8DE3tt$-!cHM&A~(`RflaZ!pL> z-i4%`_+%D`kR8S-)gJ8Um&a?${o%QOO-RGHKVu(YGuAKn=yBQ#5?^I#Y!v7@Oav?@ zQbu*sR7&Ltwyh+qVv-0nWRyBIF!?5HU3$I4QScom(YyiQa6UcfX&Ful;6KqW;CKo% zLLKBjtc!l^Lk*|84vR`ipb!o~hzCbDr#4D=NQhuuDg(kZeDl(3FF!c9#h10+H$_~Y zUmHJSpeeONeQ?0UcUqsC;5{4`tudU>qFZ0HMf$L69sOV1oDsvne=H3;VyUorz6g8% zyTX`uL1u2mlVNYMdMFDFT}y-C5#UE_;?430M%IT_wy~ska~^kA+?aHCVzwZ!#QT>J zZ4HmrZHH0A(L#T0D8`YN!S5VipNo#Vp$WR_E|y~(c; zHc}b)*bW(tm5L`uKp*AI9G{Z>tQ6%kS^aI*yq|BS7QVYS5~=vLkr<_h_3Vt2l5JIr zJJT_12j0)r`~u$WUwh|^{cCm%kLLR06-x8&3HZ(`qv&vt_E^*qqkUYaXDZ#j*IS|c z-0QdGR-NRuyNh{Son4`+(sioCr}6Wvi^XTDWy5;KIW((xGDcZ-8Z)piw>pcKG_T)w z)LLZbVVeO0)4N@$Ob|ItVq18sU-_BER0Y%q)qbcsGkRd&_@n1%M$~SZi@;32&hVE zxADU*u{Y@&?jW;-a6E<3Rz?B-?9vxbEiYkCjRW=fe@Io_k8!c}@1hXQ5*`2cA#abl zF0#Ns!t6h56eZ}1-mAHb_klh$`KcNJRG=oAl3}^dM*RXosO|MyA3>W+MWMsSL_vBP zQGbxcY6)C-wS1uqTG9<9!t6g#T+MO=t!sEbT^gPCeB?yw!R5bwGuA(VHY^6%S46Wz z(Z#|^e%tZp{UXc&ZkSQjy=f^y;fG_!P8!s%QPDqP0x3-Sx<6UFrEvXp@5&ah09)+v z3*@!IZbCGtH(S=e^SM>8dA+Xa~sc#sRTPV~vWA zJ=4#uOQIUYjA#_HQGm7&T4q|%cEx7ku&s_CVC%$2iLQD4vX)*7%SE$>r2ed+5L2SG zTnW;C*Qr36vl?7#L_!E7PIlje+2#Oj*e0_jv+tzdgSq7aM9#h34Gl*9llH_)+mPB0f(g;b_pSR>v;1TV9E%c;r8Zboq? zW`=d^`mipx@xFZa^C^x;<*QV14&=@ahnrOSPe=oc4OuLFEx8I_Pi?Le38lx2WNPm+ zx^+z!@XkNIyMf?hgRqSV38j%{RIKM*S`2(S75J{xiC6nO&8E`LkB?URe~TWk9_s^# zS`+cf9(~79!D^isX_^bBk*BtOQ8!^pB2N^`^LQPvjg$E~jnjm%xjY-(UoRkByapAM zJE`RF<-DXZTpT*`lo;~W|8#VY#)6-{(@5WFPCdVPfN{|fhbELot%EX4W8Ev^@^`}e zXc1%f~d-sL^tD2QW%V`9dK=bbnUc48}o3BdGwWf~J?N5d$F4|IrdR zB*VF$hj-n)pO$LBWKb{Q(YA^6bDfP}5;n$+Scl&2!@oy7wje$#V**dmG1cO5izfQIJ@_2f1g)$vnH= zAC}|B4GX%>0HNa59VFfh0rt>pK}*`K`j7QIzQc^XDO5?T)30oXEm&i(2%fhlVy|%f z*78(MyHj>asK0)nn*E6L^7Ds)t~MHrrMl=t)`DXSg7Z#P(yBm|w{JIM>>}xah}7rN z>4B(6>Dpg<5ZaKuAAG%)6bU3$aqOBN0j(#Uxo8agp!~~WSE**b<9Ub_8T6I!?2IJy z_Ly=5?$V^;{jCeVUQq(JH#9t9;BPr-ZT=x<^Fo?K=d!@fbn97qRMjKz6HdB|K-#a=ug88uQ0rXc902f7xq%BwIRiZo zJAhXq`U91=Y~IEE&;-zFCoE*<7%Nnj?aWqhcI5)wOxx~Y%7Y{Y4*m*Fx53Xaez1+J zDELmXE)`AtJw>zem6Vl-OQtL|}LZ<`7Aw7;?uq zrlqRp$4Lb%cf6sY36beNx;b~!w=}{fH#s)moyLn7H{q`)Z^k#vNr#gu^~brho9B;C zUO_t>lsRhf31$t5cpU1EptEckKY!5Tbyf2B_t*1X`GqX@2tC!f+m}V7jPUNQ^7*bj z2>8%$s3E;qh!( z!ea$ca;msYHUHHZyO?1`=ZZx}OqCRhdFL5tIH!o}zd_`nKnkHl%7iqeyPAj*n@k20 zk)73wBI1c`2J>mraUYM?=4>of+6dC3<_ETbO->$HafzHpniAzVxWIp|4xMqY%YIwC zjeT%9U*l^5zUlSIbAp-#G}$ZUGWq3+{WbEufUZ_~VslhIL7g=7G9P8ZOSoPtHHsuS z_K1!@u-kzM{UGx)dE#pMS69Rwft0$@U0uSPqgkm5UkW-n^;D{;=%5BPpF1f7YuWa` z5cE*dNZhgf0AOdTHr+!}_Dx>SSwdjj$586}2Lt~*L+ee=K`t_AI1WXm^W{nky)I9l zmu`svVLd(NoujHwH1M};uyfz-pX6%jFFoZ4uUNE3%Yi}yF>TLFgPZYXE3qyY?dR^c zuS|))0ZQkEQjG0v0Ok~$v(1f<)&4Ryk`h4|Yb5rCLM|ic6^YTSs4Z(%YOi%a!z~9$ zwgj1nL}ma7!otW_Q@KpDcz+Xd)j4735!hGZth!H+$vdltFaWmhBCGX|p*m-cm}t+d zNa9a(g3l%QnAiR;Y25pc%6-f1sNE#s-t$!y4=k4yT3Po;>xyI#{N+=Q!WEtL{X4 zDO-b9Q`>RoXUT0>rP;<3HD6Pj@J!QqNr~83$)WS@J@Hx~$JMTFG~}_*kx1e-3X}OO ziJEq|jgvdO9ym1IxXy#C$WT(#i!=A^-7fW!5YCHN_LEWB|Q9CgV`l z3wy{Q?W<>EeyLaVS3zG6uSa#0)wZ;!-#-L%GS%aOneq{5j|ZydS{_dKI48t9{EM8k z5F%$qj)7sMwXYekT+8)7dB)2%6cM#s%YeC$3)DKn)tAVIqnn7rkzUwfIj)Pm$mA$W z$MI*VYo$WjeG|U8PO`S(zGHg*r@Nr7^LklR3!Mu+)){dJa3K7g;3if_39Zv1N^+Uj-Rb zVAx2FclyH!axZs8&~~&FEdJvHFnaqoNDfj>75zL$R6qpgDZXJW#=0GCcq-yH*`j2| z9ym#H0R;`VN9G<*6IWV<`vt$Yd>m+wldhN8>EZKsg{gD7Et!3yptg-d4N6#X8A#_= zIY7R(uB-aJ3s30NuY>rwY-yobj4{o2dnMm?wyos^d_{HE)K_n?D4*|r@6hbHQUurjkp0Q7 zmm_`ICldbCoUixgLCmzOZswuWE}h=T03)e~8=qFLV4Gr()7wssf-j)-!s~4#?(MlG z+*Uev%2w^7R2|D5j{rAELyeK*s3d#mokiR<$m8UyKs%i~K0N8$p%N-88?(YO&;teZ5 zJ$_Fi6cMvn2F+~gO@Zz*FNzUNnBi@7X)hRMqa!H2%cKQoGoasj>xfbj2vJch> z`{9!UiFC7dRx6t&eG6uv>{sM%J;0UDoVM`=)gC|lSE@u}wC)ZQ;Wg%{QW^99B2>iU zaN7A$&x6J{faPehVXZ(R*@@0E+g7vl5j2^i|&&?4L8B*;VFcG?{3?#hq>f4CMNlQ;N#e<|qLgxdU_%ouRF}qDs%jvlO)PdA%FGvLl_3fB zU6vTF{ID{_?^4Ng@6}F(f0WTxh(JC!Yo#|7zXZCFLjH*MO{}$2RQL80LiP!rw11Z= z(+S2v#V{{Ik1h}g;PJIpE6@E7JGF{?jE&+A9`N(Cvp81P_vF>b^JLcAY|N8VrA|YU z=AHMYVK+`9EChVz!4Re3@HMDcrjNXM%E_No^_i$4TF#Ns*8!>hJ*7N-Re9AyQ5W4? z?aB=&t&!oM?UHJJqE;!m{$Mteij&+f*;PN~hfh`eg8C)l0s^f?J;YaC+a#D13>@{@mqx;LA^R@V8q>I0FUG+-@+o@e!V(Nk9SyoF(Au z)`vbKzSQv_ga087!2-^MO`dlVcCjFB&tI$iAOf6!jLkP+R(nF~jB&BQUk+RX{aj&# zHgTz4r-4KRWYFJ^unJgXX%Dg8iHSr)$;~T?p?AU!N7DEnn)?5xdJ{b}n1?TP!dv*q zNAF%2Ba2p)TSjFurRVu(psF5e=Qs!N{FUUNV_-L(ivpUp{Gl&G^a+iP=#XytSWe1& z1*G`PhZ1wvbmLeKOae#0Bu z&}(2=RpiZk_j>@}PFi)yDQTwU7cGt~7Zv!O9UZPtHdJccR+L_E06$@Y3;SzXmf&~( z-F;*W?IgH)PsjkeydXWqaUBz9($sR4Et`v;=*+%aSEheL_6M*5%#33RkiRf>GlW+VM?UOcG|Y+fZu!?~voTQuC~eE%+mtSMA-`%dgdc#KBR-wV zfHouhsOL2u!mBv(y@0WNKJVMYb_oeo{_YEHBGmi#+Fz|K{6AcHk+TY0n>&r;X ztz1;NmFXEyHD;q4J2Sr4R}|66;3_6A!mA9+m#@X?Sr*a0zB#m@!)h?HAx!^4o41M$ zW|WP^3m_{1qgA1zzokKsEwp?TT_d#aumu0iByBYON2KPgpf{D*v#F2Px8;3|yymv6 z7w_lgmrcR-ydZlw-KaQP9(7CjQlvVkGRLzJ1ru$1_WT~K03rVdfKKKBQc!kqLw*&*AyEnXe3 zxAYG=@Qhyyz$@FfB%1-!I3MV9#|>0+=E!1sSn*na{c@53BxZ;vZ_KH1%(?OaDdrGC z>tb@63A3{P>f*L60X8ZWtRAF#mDnWbyNliaaG-8HTEIbEIyADvZ_YLQT+;$^Jztbf z&Q3$8KT--;f;H*>y{yyn zWH8IY{ck9S=840Mm%uxjOD=wst-;7pDj?Pdn&pc-9E6mU2y<4x6@1!G!FfqKO93$o zhAe1@)M4W*yd|?5ntCFbi`t6oAzgV3f~M7wL046>us-zT;u~nX7{;Y@<@Qpa#bF?7 zW^mY z#(WT?{uMG67;OYJO*)NVag90V;PhxW!NtjyF8!hhtTG{VRcn4n!++xeCx!SI=t0eomD9M~Dp9@Fck}kCGUNVk#yimsT5P?L zXq!fcjWf=pJ||TFXPDHtZjPI;BNRX3Af#zOuT`7?(qP_>4&> z%jTsS=a%y+WxemB#xd&W?3mN!W%mt&Sk5~8@G;uq&zi% zPl1I4qtC0;xD|h{x^2k?gI<$KniD;KoW6%;y^1?u_x7i5NOejaqC%2I>U>mgiz19w zbSi|#ODQ*Jl$5M#xdYtk?hYK&DmgUTlNsP@uz!XymvE-aE#A000)oC*P=OHDtZY0# z(X1Bkd+dMcE%mImNDK%>Qh*QqRbd=7)PSy|UI=888Swoi1KxnI9e9`sWSB|<0%!Gj zsTLSvk{4!}RI{5+2*nrGjMB+Zmm3q+bw3&XF=~DV5PyGq1nW!aFTPX|ko3#F5@-%t zBz!v|-k}~LQINsEVY&4~t=ZU7zzKC^a5?3#U=IH%qI%67$hTY}#)x|)3;kXi2!h@H zqySaSq8t1^&{YwpWc(}Q{EPSrEDc^cf&#aW$gfd(hJ?OY%pACe6BCTEeuvUOAFfW- zaPcNS>Dxz4OY0D6e6B6YLQ$I z6k`6<=UFBGX@PoQis(B%CK31nV(G<6(<%q3QkKa#!J4ihYJ-B+q=Hn8I_?|DhPABr z?eXF8xqz2R?9IRF?oq--I%big&>T}W3R*Cr(syFtvO0YXS`D)wj#~<{gMUk^x-ai6 z8!3aMcL$=2`K$x-1gjQYcXnc1O$p;-8~ogbo`6alLS+W6(p^qlVXo*NcGZ83Ko?z> zg?~Zl;nIhmu%his^0aV4$Q#)M`L~ez+o+A~dcNj{zjAQPmfRyTv)?8i!EHV$o7ykQ zVxdWJIe}MZdxX!2cZ$PuN_DpeF3wu{bIntg@`2Y(;#;@muO-}8@e6PKFQSWpe~`rC zcxKjC@S(};z;1^QP7f8%b$Lf|S&|(YJh!`hPu=CN%hJ=MRz%17b z!OjY*B)SJ>DZkBHge9FNGguevIxkRg;_qW%2pVHDw%8ixCsMbt6JWe z((0N&yKYFq%e1Ypv3N9(A~S`%?F-!gHITk`6ZRL&+1i6h(nLlXhy7^viz3$Rv3X-j z`*epTDYGUTPY!usc6NOC7u&5K^AGeLovol{Ztqwv^<6we97+f7kk>FO)%MvB&t-Po z`iIZkTi%&2$dv-%U_~##ybZ?3trBoKIT>o&jqGQJ!k_vk=oxtn;;ayTRK4dAmeE=Z}h-L34Yz%>Gu!NePfWH1v`_~IK zjX9_E3*9w5#^jtOOoj!poPr)7mYkYd4AB!)JmcaR${y^<-qvDbv~flRwfRN_2`IfY zwOx5qF0T*AYhqK>)qn!)-NMH`GAm;{mMev^faB6_WAsFMRqLUZInSD~EF6N4$Slo_ z=?C>>LLb~urSO$CCF(T=F z!}n|T|6n7r`h5FgkoM-*{U4Lqg(it!0g^%YJTqOM+h!M(GH-%9wpwLZcfxUbi#+BZ zq1M}7?hH1sVLH(}7r?x~D*mBtE_1cENfRe&{~h4#B*guQk(9hf3mXQBfS3H7c?bwQ zos`s(^u%u_Ecp{;01F?($HO20!f|?xVnjW!X=Z};`hT4@IoA*ZW81H8d0FgxrRcA{ zw?^1Z+bloZDOhZOvQR+2zW$fWtGpvYs(CYp%u&BG9y+zVSM>K%2g`MN$x8Wl%P>C) zGtU6FKZWm?PSlAzS>6tDx!;?``yV9IPZ!w_E@HkSIpCMG|BVId3Frz9?4;_)Q>mT_ zg#I=UWh7^bwz^6(Y6`)?e|SN?fka}yxPd6#iZs3eSX!thSG0x_#=calu&lM^0%BM< zf?ep{FP~%$5}Iolpiw#518He@oZHiac4~;v{`+sWhx(Y=!k6Z@M6dOyQtR@7HqWtW znkHRALZwvs+k{UfN?P2$eEAmmMicqq9v7G!`bUprKiPNfaL4?(WJpud!z(sn@?MKC z*LMFG)#p^ir|MsO(<2OWxZn9-{`YexA#L&|o=lGm1U_p6-1*QoWrn9Bs8wo$%1WDh6PY3iX z%$9F%Ehr4*uoyI00yJ+`j%U-{4>{-Q2hjorsHNA9jTNNPq@Tj|#?rZ!G#aewC-|iN0R_iMlc5 zh1m)E6DfrEaYkfop-s~zh0`aq^?F){SMH<6Gfd3`FnrGk zNS1fIe7sJ>li*d+glJKe;5=Y1i_&bFX;;XW!6R%kZJ zqXISA5>fYQ=F0_OGJsu0-(tQLCa)+c6Y!KM>-e-apwX(zR(vm2W6L;^&eNg%)Vg3%7bqW?QcB2w=}*J+XZKMQ2 zsL6(eu(ZAN8&lV@itnNmTro!k0^oMS03$!=mrhxPnO_jF=+oC6eb8pS)* zZP1X6zy3q~3gG|*aQ?@>HauWO`LM)%Is-$QPQ$;ot`vlTPXmiV2Xr?Ax$fO} za|p0qKfZ+@Bp(aMo{2M~uXq9LI=Wf5crUMp572ra;M$*Vl&kzU)}RkNm;CR#)Q0(y z(|*HarC+8Vk;u0Irdt^Rf0~{$TYk>@0LAZ(Yyy>4XpA~qK~Y!?hywT7T6S*tY@#W> zh1iqk%=v@NXVOUw^aFSv;jM4$9@Ta`6c5i=jE=hW9PJMOZ9J*8A>Mq_JJmeh%U_d0 z_BC9pT?cyJZ@_<>rmMlLRsHC9DQDTPbONV^CRV;YM*yYZOJQ$WYH1WJ7s(1%)g*Oq z_Wf5CItW-Y6I~!AiIR}?-e{#%d3dRx$mGpcqbnURcP_Vg>Ces&{<~OvFan(V?Rx!X z>}deBP%@E{-GH)Qx|llNV6s_Thz)K$$~Ykddzm|c8UDxqsPo>8($*f@>id6|`wHUC z66m`+j4RMTUseC#fAf=tt_3q=#lN)n$v=HC$7zGG|EF!`3FrL>`~UkTTf{3-JY-Fj z*$oB`UHjs;s+d+%c&u6*O`iD@*IRe&w+{jfbu3cRu!pLRpjWBoq*ueKhQRH1F69#O zLz8jZm6E?m$3^wa?AUyYGp!J82xHQZlyl*~*f`kM%dWj7DapwVR!IHn3x-i#yhh|2f!IDUUO|Tt6hqU8VNc z($L`5K$EF(GjZ)7NygDNQs0ix9g@D3_W(K)q1`hIB6)|{_IS_rPNPI>$wcobo4Mko*l`cp7siBsH+N;RqSy-! zRyx>qq5vsfNsTeGV}lfrQ)T16eFw28!Lde#=RQyxD9)=jXZ#*`j=OaERk=gLAiC2( zeHL;v!n(bj^|N3E_TljPOWe5NS)tiXyyTAIw#^N3WQIw?cXPf7+&KIsVYT8F!8y{J zV}NHJ-lx|j18^lHjJ}uuSx^7@PD6#h$XNW*7bdgS{c~oXbKp~nUXDoh+beN1YH6)d zbK$=a)-LfUe~yw5tyHK78ziHju$cY3?=ylK; z-`LAmR-=G|B_?S9PbpDkCj&{PW(l+lGh)>L@c>5(Wr_f9+DvonivL#VyoVE>G2Xuc z=)d0b{ky9oQUElxvI&`gzX6O62(TvU z%G><5>K|FCkMy?Vb_7fM0C#K@m36>{8g(BmOw{rU3NHGqqZ8wmgMa&zzA@1ZSbe;#+Pl^O}RKb~hoWUt6T!3&B^>@@Lff4k(aMI-l2vx1HMjh213R$&QDS zB%6aThyu>ALyx(rWgAbguWeUvMp3p|=|q)RYq4=?DZT2go)LTx`+5&%!=4es!Hb$} zAeH02HpYSB>!uMD@#l<@$EyjLQi^dcI)yfNu>#}x5vJOmAUVywu~)&tVBM%0`-+uH z_4Su+$`n3}%k|GrnN&&q&-Io|B!JiL9~~{=IU`?buvvK2eA?r{5)6M8es|>H-$%b# z?8U9@z2*+(t^qK&XbQhay(;{4RRh;CDgZqs0zi>@!(&Jc73p`1IG$~&re9B|^iB=- zqrg_^y%=Pv)vd<;)coly=Mfj6VN3w%zvi`AgT0|MQ#E^lX<{@2dLBIZ`-OIY4%$)afq-#hQBE|@l9A#Y$wXts>0gF0T^Fj`yAPP`MJV{7Nl%QidM}GS zxbLzp)mt41PfeR?D}m-mS-iK6SS_!Uzj6L1H$0W)lM~nikduUt3|1lIan14kd3Ivj z7~`2lEBiAC(%n$R0rUH0YS`WI9i8ZbjYpk&lMr#8Rxhazhse}fAA6XO%NegVKzO3* z<#r_>*oJ~GL=j~GMZjLB$61WimcAu8lGVq<>W+*jyWhG4JH0*B3=1puRx-Cf1b`R# zt|M;Y@;;sNaXgama%TcW$yeu~mW;o{)Hfp0xQCe(+A%yPm5gI-CR@IT3OMQpuEL+< z1PCw~qlW75j~B|4&V#%uX;n)niMF>DM~pAonc}isx#bYR@2CsYNmxxrCzXM5!d$hH z%7Uv-?+#BL-{m#N_|z~`l5l^~Aw9f4I21xWAdO*LGPdI$3_B3_bm(RM!45E-w)_nMszsP4L{F{0&wrkc|Oy z80s9>tAD;J?K$APPz(%@BXgRJ<0aHszqq$i5SS^=Sm>o@&3f+KaHx~*0LPTKl)|hS zV88sA{WYGv@WG7a?LixP@Uj7#nmof7m)hrE#tGtfg3(@#oLZ$c8uE0)DX7M=L$)O= z*6$hH{J@X2V8n|sGKrdzeKtOCrt&$IlWh7bn3PT{FfGgCN~vNO+|M=CHY_$|VZZYT z~m}81c2nAHF zLH_)Fw*VZ?kq!a9VybKwhxU8*j?r*@46ny3HQ@)NzR``vW28Y|L_!Rkb z#qRCJWfjQdB&d)i5i__|HWpQf2&uK=;c)J}e)%r(Ooe+{8a@=xvTKK*WVWRmIm>i) z@cwLYYpfqWleBTxoE;1fy!UNn`nc9b+kiQ2)f=pY6t z#YBXG+9V0U=uuF1diPDR>AeFZS`=Z52Pvsz)_zlRiGE}BC zJ9MkpOGlhdK@WN`-pu(Wv?(62Db?~Nsw<2NWsp*f1~)Ydw4ZrOfn}oS!`0CI1thce z5g7Hi(#qK~9f5}nqSMryG{f<3^sSGSfaFJ=TDz60O;+_&%8m&`oG1-uLQzeUROq&N zp6B6@NB=f%Q|r%|tGXBrnxrKQRInybptKz4{d&#_o_;S?#iekD>L$ybXJQ7kY- z_G42_TI!1Ov{0rdMIS~}Sci5NwbiP3Z!6Vlp`L9>FNJqXN3Q+4t4TRaXkQ1<4f{PP z%~Oy&ThWaEc)x7LaNa*bqajte-W)_>75gH(_UEb>J1ozVYUg9Z@L!}xemELh4y(9d znyz7?BHF*CO7`pW?5X0ohpUyI0zqih%0zCYntXyl9ig+rg)!eni65xp_?6;)^4{fi zJdgfrd+C>A2FXVK-WnI1FKy0cQ}FJBwci^))V$ptihDoODFUTa8IL$InDkm?GD-9a z8g=G}zEyUjuCxl_Ff=2>f&1Z}GC=-_)nt5@a|1Y17PUTH?T>)aM}P(~d_)`E4^*(1 z+$dSW%|By4>JOF!ii&s|6&g323auu^jSK8SM6S&bH-(JbllDS z?`82KKVi+5qN6l{+Bx|>3c1#HiZFX*jDcVfN$`D*@z}gy`n^Gac+BTLS}6ccVrR5K zm4b2FTCOA)c(qt4pS#tqcPtu(_X>Oj!t<&#q=fKhKw2oU`FG4mk8NM0*4ArMHu_rd zmw^zly@D*9_FWmxa_uzJ5x}XsmEd^k3P6ZH>}M~CtCaaNN%H-NK!f{e2Jd(F2F?x7 z8aAtCp(_ic-j}jiAY{`{DOQO zNETgBJmPo{YS%laBt}?(KG+NoymYmpoyYY8{;>%82NZdq`uajdY>sR7?aS|F8te(e z%gU0T$6>0BN2C1m?OYd&mEHmIw7T-l5VS`Kk=JgkKr34waC#bYj#|(py`Rtt7J4P< zGWt%F={Aqtjw2xcdbyiqzvEj3I+;9VA(kz{Ujls~|Dxc@|BVJ?LqXuhJ5}p;AIq)y zP0UP#r-Q9j`^y)J4Lx4R!yR4eyNSXf2gazF2Utw06$%w{A6MG90|(vVG*V2dhwg{H z<&SYjH?2nY%3-OXht13BmyUql#Q=+uK%r=arrN0IB5m{{ou*pLwcDE3i!&zf!y;n) zabhT{hc1T0V#%lAMwz^;oSQveMo((e0=oDnzgZ`N6YZi!IDZvc9Q+y0NWQ$%cv?-7 za-T=o2is{DYV5~H_!r8dg8Y&^r4@JoviXb&Z-#?*4vlpz;AZ3&msV1hx;QWN2~4Xr z&WF{#KLOM?IA^%I;aJ7J}ht9pN4>qrvpQ9;0!Kfb- zgJzw)`NnNd{92`Oq_wu>7xjuNhdlStm)%o8)ZO8AgWXHNxZUjOCz)K|E#Om~zkrFF zXE_CCKRg9R^R3KhT~o1R`gNMdbk7z%SRtW9@J8G;iyCwijm_dV>u5HY9UD)pB1_0L zAGuW56l@aZTgQ)hVz)Ce1aiI&n}mlf-%rhNyYF8V_T`A8BkxY_~Lt{SoK3ZVQy!ffW@od5u3;G z51mf6nnt~4Q2?abAKJXlrLUBb7$Nu%a;a=z+;2~?2Z!kDG>=yrDhQ^~gb1)&TU^c= zawQ`YV{#>=-xQu?fFMaih!7~5zzaa6Yx&+YCO;smK7j9DaRL>VZWn$~Mz`rp)#iIN z@77c{vuQD?dGD9UAyGsDva9{^xL5E;*xp1YHUf$O9ld0c$g{Qs9c&iIkkMoTQ7Xn8 zLnLotY@KI1^;^2U(#ajbaq|IQQA20Ai)}(w|H!pF@UkniFst8Url1amEkq1p`|Aij zaSGPj5uBY&#fbmHRm%zs0HC@#c;E@KXwV4NGsIKL7&U* zKKtn}l+;_UK=yApKS?L{;p$)nNX?Xg%2CXh9&*>rcxS@hwjMCq1R-4vS=i+W{n&ta z)0k<$JM*x2e9EmOln1mXXKi;nrd+;66Z(H0Dn1T)Y8VrM!bSej{P5@9p>7uze6DG9CNt&m+2T zzr~`w-$q#{sF1zRHYTWH^420&{RFwj0moW9!F`=~+yO#c zs!(vrOju10n;2kiH)~mDrP5wMYrrHz!lBY^uv&4BU^N~Fw5=W_&D-mUzxCAcAzJeP z&LIX%hJ7!M*dNu!_>wm88@9Ov)r;3$gN-^+cjYQTN`nsr!anyf;G@g+c>|;*u{rBRuGZjkZ@E$7->azWLx`q6h!F!nFT+Z|e7+ z1zS|G4)z}q2AwuOd&_ph1<(E0>-oamSsT!3U(Bp4*W>0D;q_x8lwkPo@K&Kce68?+-{YApu zD@4y|ZtyjZ7CI2>&oE5?=~R~$!oC?H#5B@-xZ#`Ylk7fnLE&%f1{aw}2!Aw)mS`#@ zf{2;JM)|3?43N(hpvlh7whHOi%c<@r%H7icI(ID8$;OAJELoW0tO4|naJEsPoZ_x~ zvU@X`&)@rf65HA$`01xuVbgqAKm`~64T~ywgrSYDc`FE)&3iIjOk3d$2g1OrZT|p} zvW2{-Biab~T&0w&)rP3xSls#Tdk3lD(7s_I<<#@F9@rDj)>D zXBdzaMn#^2oK0%Ao2N(*kR+;``X)($4pEH`0Z+0%b=MPQrXKXufQaeaB%Rp19Mcg9 z&025?4(8C?#xu$yiUSv-dT6y`--!B<&5B@+tmaGI9D(G|&t~~44g`rg8bP?TR02=1 z93^f&wJNPX!!=VxTenR=s9Gy3h03H~2v#nCwq;tJPu-7-LL;5Lns#O z1ADlLcf&LN-2kD_Zx%3^d6w5bMxUwnDzmGCKc+c9rhsWlnNz-35W{@}qEu{j5R@e;xY zrB)Jcf0Y8-@$+tKpZs3~a-+UVOiz|y!(MbF7b^A*Ygi9|ZxY#~Y85iY61?<~2nX?u9rO71Abgo(MlVn(8S){q{^^aNBXeq5p z1PR64F4N7BBKNTg&Rj5L`a8Yr!_81>(DL)c+~4VzjRo6~61)e)>uryXLnpO9?BNSn zHnUrlw%aUS!jCPSgD}aKbsXs)g-YOFw)Qe#l%Cwh_I>|S4t^&?U#sIx#+`N`mB zoj^j!L35R2ao}#U%>Cu2!Y9JNzR&*#iw#Ly%93f<6kOi*IHFj!Jhip|t+EF}2H^-= z4~ZKH;HV@bvk+{;(eQ1?2sd#zK=FbLuL|=;LW4_AQcyEjGuc+zrw|4x0{9H6AyT9z zDRl3{#@j3APY5uawPA2|QlCMk$!0U0N>~j@engvB3Z1A+zEeE)0Y@(5LXh9VjNhl; zwcb!vm4X;1CRS`cl_Jl4XvNqgA_Nt%`Di?cdwd|^HgwDC!^^@XDs8(7k8us_u<4(L zoD~QD0Iz`stNOfLYmEva7xCzHKCcafp66nW)q5DGKPB#Xqw?M29@yRBY1)nqcfrV5B;5LFeCS#EaveVgnpu;ShI z9nrLD&nF>{zg5(CTSQj$xYrMs6!yS8JM|!uifg)e=zNBglyU_^LEclCrg4DiO+9xe zin=34Bu<#n?P@Gzpcjy>K4CI~VQfS#kqT)}*=+k1c~N*!bBD#W!K;4lO4V?lD~4CB zRb{R-`J5qq`paKkN3o7Z7>7e*pG`ZN#NY2Z(=x%Puq?VjMLO`J zOfgT0cnPJTbMoFA`c_Fi3{CmLNCqAKRmADj(5dEp^b8>m9U`3;g8>C&yppDBq5)zN z<$<8UR|dp-MS}uJ_WKz0eEWw$xvu62&ArOc;(5{!fo-sRLW!lHjeg5O4b=W1GBLO5 z``q8%Wo%|uc^o?oVRTZ8&eFDk1iURN>}f|<`hyR9-jAigvAAJj38t6ntGbmrNV%Uu zS--myWs1?1pMW+5ET!mNJ5ergR?c7*BSDkWA30j$W440C`G%FSalanGDbhrFV!+HV zY`6n=hCkKc)9KW!(y&u8>`7zHLHm86SSJ0GRt4^m^aMRQU^ZbpbELdtm%#($Q&ZzPoA9l z=P&w6;FIS9L&knu3!_xIS>-&Yk?{&Err>WZ7Ag4ZI@WVx*o=xf7(-CT-v|xfnC>*L z&I3QlZf5(-=MSti3rAm|50=)PPN;KljNnWMaIrLf#q{^skxV}^3jdPSE7YI-X7Hw; zsjpVIzb3)8mXgC$KbnY(kGJ6nO?5KlFBq z!YyBzv*TbdhUrFhvs}Wl^!&hhqwV*XP=P76ufli69kCL$AfCBDE=zFS+*8dKs7o z)(+7a*exo*AiJw6qLXFL9=;|*bvwLJ)6afryYL`2yk2DwP4FlF_NSpdo)+yS&el%) z165-{B|D9ZkN_@++~X^gt~GD2N~K*fNu3OOd__kV4QT;G!c5d3{P0aw+6y8K%?79+ zHBM=0Ls?81%3pF!w>o%K54OG&@%7T5|IYDdv8i!Essd6#3X8!Qe#(Z`oLM4K;{amgPGLg-GdR6zokF& z!yI!?Xfos^!Px=Z8je-!GTjqqu%HtDPi|CKM8q&E_yW8U!MjA5WiQ#}RigxnP#*0Mk;~r--<8 zxBV1zD75wce86zseF+RWk`x3U#J;ScC+QNKWI7c%o-V6cg=2l{VT;`l<;Um;Ey6J; z>jnEqpd++YfaBu-0a4=yz}Bm)x@-&WV#!KEZQCoV1tB*5MH?)ugR!%%jX=o`e@f^o z6B|Mq@`^#J>TXM@Qc!FTwyFBvX9#?;@FY*S?{0^7j(VMgFMZxxJ$DN`CKePrLHN>-cj|OfH82b`3RLv^f>P|*?6AVSKBjXk zMl$99AS7lW#!;<6UV!cjyhL^MgS2C4yJtCc9yk?4wFC#kZ@CXvh>T8j z+1U*9E^rFN%EgXDd4dy^JY4m5yFViq(rr7^U8h5*TiqPWpl-qoIa5-Zi$oji?vN!3 zh`|MLv-_{^g6I`1xdTjNC`@7M-h?uH*qWBXrYYUJ^k5N5i;?giNylyLogsH({lo;W zPFO+THlk`f1c3(fWyDVQI!hX|XQ5x8(da5sV@TkBFSM#V^d<9bmg2c1dtY!i#X}8* zNjFvR#Wwyad;_=*raXLgOR+RNIo*813z4)HhN=?=*rM7ZWZ!)#RrreO;{XhrOFcc6 zl@Pm{o};FS;+vQs5Ak`)Ty1{EXPByIXwirItfP15Srls%+-maH8*HUSbd)toR`E1_ zu*+B?Q3(B;E98q*Lmca%9(XSEZmq+YA=5b);sy;hKbJ9LmEA7y9iyFnE5!~~a%zGQ z-GP0Te3Qj({qdu*>1I2oW<-Q_#k{ZH)as^CQ=PiJK!byE^reIpAM|9Z(5q^Nf~CZF z*3#EwS7q_Tmp()FI^%%&&!2)d^?Dc8s|8HsChOafIbQIdd*H-^(uh8wyKY@Kg{C=J zAU!TkQj_%E#zA%owdqaru@`-n)p;}vEkyv?=8CRij0rmvIdmQ3nz#ARr5m~9pVWiR z$B7?d#zWT8{HBWQema=pG5h3AbD~D!DHSIqAgDvCiwOGwDcLq?ur)oWVM5-Dvn|-< z=gYt7=4voF7BE53um4Mu@V4%F_8a_s(?MoQP{S_lH@(g6vBb3W2GeOkQ7530Z;tNO zx$R;(U@#Y*>VSLQ{&0)y1tbVkm>lwKW|{Pfq6il_^fd5l!NtQU*fb(=IaN=klPPBO zAWaBP3NrM3DG1?m0_4JRU}`iF1YakUiAWb6i(&)}5kw83Q3GKO45lL=y_F|VDA-Do zNNNeNqzUbMk)_4TETfU2p$!oRh{W+bWrt*gAYo#ie@vdN0ev3QlXPCsQV)|MIWawc z8+HTug%VG2rX0RL=&Jr4W~*Wm_4EX0c39{gz^Jb|Hq2rq(Wqp#@A$Z4{@c! z7ght&R#+3Wz|hGSO5vC`k6QJQnmy58s)=wwGd#*fv8^`HM0H9Tm=XXt>0>LIJ>_xc zMvrK3CK!TTa%;OUndVP;BVquhZ(Q|Zxvr75dotS_{1o$g>0Q+@&bK2A} z7)JW|2~Z)!K35?=^RIyzLA4-iS+lw31aX<$n7rVuXRwbK`Cg6ZkDil~ubzEbDyVLf zcf7m%xHj{B{MX{?YlQAq!GheAdPZ>1#JRUtN5ON%WxKySd}zeTwu~#ghcNBM?h>0{z`Z~4SPZ#8*iRqj)qj4Y_iG$%kTF`@KuygQ**e|+ zyRWhvdC)&RldF?(HZYga^0xYopraswtt~$*Uho*b>0Ge!!#ob|$vmai^$l6EL&6_BYo;lbZ^0r6&u0Zn zG1n5gNSOl88kbbPkwmz0zI+1(Yt`88?1~yR<-%$>4~k&fKHi%?&LPb=-eb`(whMsE zXc1VwhtU~D%MIk4*Gm60@U86l%fuT29p)OJ+Bz!)s>hY0YJ4u>mxLoE76+Sx4H`m$ zTX1@eAwSU#p3{PpjfeV;Vd;?9|B<~GFS=p9&3z<4NxOKD_+&+RLu1aFhov(Dn^)qj z{lFR@j~K$#-QOz>B}j&$P0VEkfkUSI!{`Uod<%aa~+^h8qiTJy*GrQnkhIj2qLYxNn1GX*_al6E|ATNy?)A` zc(T{%oWcW{F^2G#J0y)aFPBQ^4}-EW-%5;{03*U~&BrV=AA?7Dk$IRb9^UBfPlC3f)ZF$CfbolYV5uqA^Ew_MY}w& z=0ix>4h{*LiM=N#xf&q4 zs0fTTd$H-jM^iOwFTa~k&g%bL%elhhDfk0OQli&C!32gy7^gs0y^6H!!BfPaCu-Wn z^sL~QYpm&|6)x*?bhh1ZhlQq|@WxN!nGt^yU*(hi@PX>|ipIGJa>Sf8C<3ayC%hs`dBvrs|fWTC8VR^u->yZGfQ zPh}>x*o{O^t*Q{GBp0EaaQz-Mlvf$>m{WE{QGnc|qqGr`LM-D?{|yLw^*C;RY|fgm z&7R^uyO8*eYX>=W63otH8k@>iN>S%e0T=AG;6nU1>?g&BC-=F*zzhS~&!gQXiaiEDa)B*-Y0_M3yqNi6z)^)MRdo#Um1}l+ zG4kSr&`yut{%8u%Uk7>hds4;%$;vptY$l@E0id^xQl&&W!TsjAh;Mx{dT4Wq$k#wf zIISyIwR{#c=y2sb@d+sdU zkGyPVi~Y=PpS#3vOH*nbrBUp^ENveu?uEaYm4@SFOx_CB6QStAs^>=L4SXY9j%QI4 zBv|kIszbPMIzdFf2}xlp(^+J-Qh%iIxHpnWt8eaLi(7UMOo(% zh+^TlxQmAD^@dYoOSy*839rNkcZn0lT4A0Ph=-NTxIe-0f}kg`(xf!)J?w~9io+cl zR!~A>3U?j1LliMz>JIdX7J%(vizwe{bNBY4e6Rw zaqBEss(!zMs{WA~)*Vl(% zd-=*kipAmweL=T7{-u=q?XSKU|2%uSjL8_9Jv9jN-GpgGjjEeK&H;fA;o zdH?)va^m6n=qwnxGr%nt(wH}Z9Q+w&oLm1W)*jV+kt{mUvB*ADp}8{W6SIFS+}0M2 zzF^{DfNNl$0wIVPOprJ>VQDyikTa%Z4smIBXyyA>_E;S2h`F{hoc

4#x8wf;6l2 zVD%#kW6XDvJ&V^oVoS+P-XkeICQ7<*IzK3nEcfb~$wUB#N=Q#~qpn_tt@6eKB#Q|p z_-e}sx4m%qTzZ-B6&^2RFTi zS^I|tE!`~xq#<<*z=^+eZL4RhQqn4zXYSh=N%8mZpeC{Ozl3CEz-_C!aSdQY-WL{d z3U2q#AR|h?UfTE0XfBOT7^-Vbo9s&_bMMCWgQAiawrznx7vVu(KAkC4%B!(C;*XyO zHx#M(Gu>)l&^6Co1H@S!s`~CL-9(b6UKb7S>fVFZ4w27gYE2@Ko{N&~?$I{WBEu;d zVsVl>?x9xBD1}7K-*J#a9wL6QODGKR-R^AkEeJm|qMCy*S<_xVjGrvCgFoaomv(R45sS-e zv-XXkS+x@O?mRS+M&m*!L*k_ktk|?@j|&`}=+WW}_%v8qRG&{}mA(DQ9bI5mI}9%) zsJCg|J^do+L=g>3Kh%PdHyoh)XWKOj%m+}oCA zBDrs|s5MGWU2|kkZUzJb7XKVMP|BYFXzrBRfbroG9-7On&q6KL`b*q8V;9g@DC!_w z8fN?HwG#T`Vuw*c?|fMAB^bh(u>yy-qI!;iqMm}WG>XE{DI&WvFkB(YuZXOQO_YI#PD~VUg<}y#1I2i z6U|$ItdO4|1sI<}M z@rNcrcr30V=`Lq()47s}+UjDj7`K}7eOExif!_wC-|3b|hb7stLrM~LySQ4t<+j1G z=Ua@8(e|Wq?$U7Cfv-iSciQcZ)~heHEvkrrBefEY$}=SSXhF{QYhE9+wT&F9WW=mZ z8MfBl#+z?Cz-K;QE;r)AHe3&GPwb|hxbltDr(d}~&mOzF%LEV_ZJKUjVCXytPN>_- zCF9481Xy)Ehc;WUHhxhpS4$~nz1+47jS5>}_mCCDRg^cQb97U2-+xW;!@rHvTEznNbmZy${f`>)XSb z8x$!HcLcfV<@Jk773&%=TwY&tB_{o(>|rq$J6(?4#eVx>?RSx*Ltv;n;JOxSVNXve zm!(f?qj`=d**e?-rfdv~c*{+wQ;R%(86nv&o7lFa98)ZJnq8^Ico8vq02h<3o6^zrq+ zNWe`we#eXBx1xzfuW@{&dIny)q4Z(V(+9WGWG5E1MCp-11{ zis0OcR+1MGC*pd~*6HbKcX)fH@Vb;2@SoPsaF{kK z6)2=J9Hcu$q7(tsOxmV|ZXmk*PU0)Js9JH~tvVR}jn0{_F;Pf}x;;!t(v686a8?Fe z+`DI>Igbe@{Kox0sVh~lks#E22kF_w1M1JGBng2@nVUFJvP%KDOpz^#h`jfS+!6Vo zqlwP{=0+tFxZHkak+}bTq5ro7AU*9jyzT%(UM62+3@1@GY8G1-={LS$_H{)aZ$rZzX!{i3jM`!;tj&SyS)OQgO!m{|t zp<6Hh1%Ag->#jTSZ3qD#X#0;o#LQR<65n;boE#_k@5p+xB$q#Ip!p5^ADn=A%b9|&+Khr^GpBJ+7$prx$}0F^%gGAbD0-X zy+t9P{>N?**F`V4f9fF1tNh^Ea;cU42#6S>3H&Pd_Ct~Yl*^th&oc@FYt;OEw2GBd zXtiH(4gf&yS0oSU4;4~{VQRL~FB}fjKYO*$;KVXPQP`{$=6J)%wTj;+b&8&ae#C7R zQNAmc`(bD?;)GEt$d1sViyk2&bkX2erF-%~t7)})&pz!phKTS`aLx1ySr{^v0; zYcV&fw_c&4%y5hyKV*duGUy{dGSwmy;5k*Hl~u4>N|g%B;%?9Q$qEnq#L;J!*xe&k z_!QE^hFPM!KbA)MGYmuCJR6!d_~f^^v=rddpAEZ~y<@(S!m5_zm(Lso>O=j*@i|rZ zN96`himg@`FNaiIOv4somb6l;jg)BtOq%*CRxsn4k{Nz}zHCL=0g^y9>z#U}P)I4g z9|K~ZGy0zG?sMksQbs)Jq$;XPzkl|yTP({)#mAU+G#Y%q+)uN{7#6}Q;I)`5rl!R6 z@n?b<`IRHrwU~MPJ9CzhZqmEypG+)K1JdHdP`sw1b|h)^0ur=A4YqNE#e%$5>|*R@ z2x(;W2t$kPX<4P{4A3*)^xN*B+P5VR zn&EIdrxQfnU)ZV8^0Jc(+;Ftgg|`mXXs#KfLDyXJEkqAu z)zJ)~GyV}kyOHPqs3}6e{t!+xF#PPp(bAK`0lUOC_#ux-9`3yj945}!JX`*Ck&6Fq z^$JH4HUGKR(k=QV%V)q!A(ccN6~rDTG(McbQ0Vr(SoMoiZjSk4rT#CnZ`F#`hC>-g za{QB0*k;=y`t5TzZn-1HV3ex9lukjm-@SU+kCZk1!5aPqgm==qhA5&3b1bfud6eUhq`@#-CWNA_J!jl?*YEL%7c<{6XXZHPT-P<% z`|}a^Y93@dq52gRK{~^>X(Zp=Wf|wmZxOosEIW@X*Uk9kyNoQcNAZhI$feP(rhNFi zt^G9U9YGqsaNCtOdnHs>D;N=nec*^Oy+<8LQ*E*_XsEA=@4I5VF537*-0UW0cE*nT zsQ)pW>69Iy9~4D*Pv5|mp0x;cAgGY+A~K}erJR#kcNOLQPvb z1@gOFD~P67x-Eq*p=1<^a}ucr>eiNAfpZB(*r1)lg2+g6ovaT*Jq;(9rxMwYms-6r zZjUb1gI9PWLk>wlC3o1z3CTH9RH@Iyz_04P_y(IMyQl*9+U;@ZL@ zN?)psM>9pXUc;l%_*iAognUY35C8ajp_m2BN0{lJGM<%d)YSURejWaza>c^i!4LN& zF+PuG}HGNdh@@ZA-fJ4!4S_^2EhS$n^hRQ;Z zPM>F?kA96(i{qp5LNg!hM-6x-9|hWI@a{`go(cB5);UZq@f&Re&n@cpjB(byI>$Dm zRXIIp?V~T-JZ`Jx3oy+%cVZjIPNc#!jDhlBNiLeDGDXFZWU zBJxrpdl#(6eL^rvK5Bd!cj~^4%{xtd2CjS4Xh@3`*a>7j@Co6Y`d4sZj^rig#b%I_ z!Vg8QwJWQ`DE!<))MW2+od;iVcqk-4*gPn{gfIx0m`&&E?wdL#dtKn3=vzXI}UhSNEa- zqpw9j>Hgzg1`^_^*KsCwj|#H>MqPo6n*tb}AD5i|-!5ND<|L#(vhCuZTnn7px514o z3VxaWf4Eh4bS2pMv}j_2{{E}@UD9rNds+VJ9~f7b+zC3mJ~UFz zw+?>z`883C=4dOc7^dhRlK0#%^EQ|$&zd*P6nL|Y#J3j|--%PiwtR2xy*_W3$e@i& zZ`C%*ZWt4-vMwA6@*ev>RQ~k(8!31H9h0Jxh`g!A@83nbGv^xlo&1?rCc6+X=9Zne zXV(QOz!mO1^RG4^GcA}!u2@uk>p#eZ?0wk3ySJU`v?o{KDG&JJnR|Paf4y5^7Q89F z~W5x@k0smu$Rv!tN{r6#S8UHrJ!yv)Di+8mDH3%@p=SWk`?3zjVYtU%m%oc`4 zN^>3tFeI#*q$cAIC}x)zsIO{&X5=HpE>0;{Asnmj*T^hl1w^hGuE*|6g=YJ z2g)&w@`h2BZ8Z5%2ZU5pkbP#83;tvMMyQ9(Jwmln_ks_@yFfse?r-oljUO87!6JA? z?VkV3__OdI_kRCRVW^=5Xj3_w@w$}vf(`&+A1^olJWw!tL@lTDvI~Q_D}6`GWjF~y z1x{IOOU<%c|L)?Ua10CBl`sVY#rN52$AQko1CUm9B?-c@LPm+e3FZd&P0I#^98-)% zm~;V0usk3)Pa?1Q%>wgQ8q$8fkW@IvHcZO4op$Wi?Rt`uy0;T&;tgmh3TIxWl_u>* zq(t;=kw35bHCk@W%BdXP@2;bG%Mni`A%B9{GM|ZHF@KbdM>gr*q({M7|&re zULmnT5Xo9@_P!F9KF65ykS(x%9@MrDC+!ePzXjRLr$iv=qM?u&+mWm9-<=bFF)g-D z;HB^8U*+nNs9y`Pl+(xBZ|Ch;1k0J%%sU-~`1}XXqZ?SzQx8xe0M{H{;LZqFQ-YC} z-9vuegWrRlBu>O&oQ2ITh>})QSlr}k1jD}&lMKWhz4pmnz(DZt;w(X>up3bsXYf{{-L z!-Oz?_9cvp#s`!wLVj?c=_aOrBgmdXdgZZ?tjh|T73HyyuU_8%F&qCdkFmDUS5?nB zW43&D`lR$HJU(Mj^}|AzIcMV^@d5NQ^oP;0WV(J(V90$5uyOI_T^n+n%PHq;R2fVo zqY&W4;#^6~U3t;wJ}o=bkpZRss?EYlUm@;US#z^tGr98Slr=b+d8h9DYzRKsUfg)! z`z6o)eVx{pFsFGj$oJLSZm%^_m%EOMUzFi-+Ro$bGnE3Ff3oPcQf1>Pz}XRfojHWl zar7rZXFl?4i3E1pYI_l3zqLH3g}>xD>fvs$gT>DKh9-KnG}}FrM^KOawK2mMA?X$7cAUQ)1-@$uLM(4e8^xNvnCXT=YAmNxD06ElRX zlOLPHv6t52W?_M74!=k4XO5(%D!A1RmKYiKo=WI}YOv?9Jyl_U za5eks1(4-dSuSSXQ5Y)0@GvaE;=2&nXK5c zG*Iw)o)i$tJ^cxgfP2&=*wMcAF7$%$Xt}+1p;di#l%XDx77Z|{*e>24;1sCUcAv>N z%@;TsvJT^ITFxSEk0)O+D!lTKXT+d5uXBWd!JGZ&KijGJKOap7Q0K*F!N+}Ykm08L z5GOVD6!(32#Ru|r2gD>*Nc9!x_n( z?%Aw{T+-(+j9QFbyoQMptutN8#XohPD8&I1ijE}Gh1{NdIG=3cZV;4TV@!QLLNz?H z<-;-Y<{Q@z4&ocNzkF!GLZATj%IdVy;1sf|&lCnAbCS%50C=J9EfNeC^nF#+>qjf2 zJ^|Ekgh<4x|5T8P)+x~(J7^+>V2Md%X4IYaHWn{nm(+Rf=f+6hO3Dx&9qVdRX#s?_ z0)Soo^ZFSVq;$@3^4(VW1XtYu_E4SyA}no=k?oIVlhYG0Y`c%G+@m^v3PaL$Isy3D zrK!fogR-v|oIDB0#bs~1iD9??p92RQV0F1zV-POdKos3nQ)c~0xb4wAHF$(2i-1M+~2vKBz@7om1={f%C%4Y_&BT~KOK!) z+D^F^TqsV?{h(PgE0g+3u8mER;d4Pm+yyE+!&8^ytVyMZK^GCe2l|5&jzyBfj`@-+ z6E_=iBY?;4`<$)Z?}A`sX=&u*+y@n)VGklRB(=SEbJ!wRuftbsMr&eCgPj;bV|V`e zmW4r2P!Ms`cf^V%!~er}U(YmG={h<#SBWy0S3BA9!n>BJa)aKYB`J;c=^U2Sy~{Vp zMXk4Vp47egz2}2K>7z+14{dmf-ovsD`nNRZIrO{10#wJDF;Xrggopa_f}ju-DQsCI zwnmmP?t9YEBJwz&E53Iv8z-3Fh`Cy7X*QcAVr3q`#b~aspL$dkKD@j6q1<7UbrWv4 zTOEPE9V^BZUGdGaz+b=YY;2(Z>#)Y(^Hg)w&gnZ-#4hQmIbnEjq>>r9F+2 z482i=1C3N+QIN4gjt=MqB7NSe_(&(4N#T_z?sG8~jqVMcvwjBDTweG}`DafjLv~jV zeQO$T9cXv6UrI>#+i|)tk)}kvVR#=@DGiZHOQ3l*g_L^@6`MpCz7Fo+!l<4VrtbA< zHVqZKy+bQ#lAkW3q~u)%6sl?gP?cyH?l~c>`#=9oyyT5tr*aaw2oTE8fcC&3y%#@e z)rn-(6CR{WG;gb&zityj!FGYg+G0@Ata_i3tM{lP@rYnp z#1+2$tw-1Gn~s!sV-fr$GX0ywXX6sn^9|CoK_d8$qRVArVk>n>28HGEH|H;!R$l5u zc^jD}KesIPGg1D^_w(gSmUGZ>i5WRt%bWh~zCRlk2)#$7OhF4%aGYZiAVc6XK9GVTcfr^kUg-#O>pn7{oFB;x=%mgT*Unu zIEB9FAuGSDL%geev3(vaYMe862PE+g)jDT2Aa#9Lk_Z|m(k6K@4?4w-=Jsa`@b zT3%UJ#`V%NjYF%~*L;qML`qkVzA6`!K(J968Tx|n-S7S1Mn3ZCc&bXjCe~JUffaKO=k}rOwf8~dQo%VdALN7p%^%_Tw)XPLrs<(sRFwb|IzE@LqWm2VNQ8g< z6iAeLCfc2HF2x{MLo=3DDi5?(keZK&MwO0}h*aKV7~naVsZ(&KX@)?omv|?u+WqD# z%)W6e&E=`ZcXut>_INH)us%#q-lgqdGXaV@*_uLJ1Z^^2+mh3J0+?2FDVNSj7Hfej z=aK%6Fbe=KP=@<;L2{IXG^~n@aYbn*JjxFv3>4A?(>n{^O+`1n$fwpFoI3EsS$a%U znaj-KMVUu+0U&EGd6WB``Pl<8>u6M;ga4#w^bABW!VxQErPaw@OdGVdEJ%Vas#%KZ zoaDB?vnqy!tqu%<{^pF~stv~`@ojWO0@pxc(tFZpZimSOCItlT4A_YChSCDreW7-b z&KXMg`Qjb2=i`Ni*}mF}z3@JI;~n=kS-4ZWDlJSaVise&NQ8#;IzxN5u;sGA47YIP zN5M|c5|1K+W;&@uQa1f@g{&tXy`OR9abDNXEB1`-gZuz|yy2@E%ho8p!e$s*Bdai& zQIlMt4gsB{4hR`>Sc0pOC*ZG(`1+b>HU!|CWFA{sVatK)8*>7?nde=uNDc%lPu;BgM>XO10fkTrgZPT z?~ha6dKT<^&?9RX=1!1*qhmgMdQ3}(Dpd|yd+PVop}uIqEW+%KP%%+!D@yOf3soYI zr;gK_1uHJlQNlh3yWap2@|DJr{g(z#&;KiKVCcw^Q54 z%Y3~R1>IY_-LY{JKiGm<}-{{V!323;QWO(lXQ>L$9TAk>ETbIN65&f z$hcT>$a_3Wq+ci@NmRo4uB+t7z;%cBqH~4}1)mj}{kecL$~Zm!aYWXYO4#85z;$RV zw5v5;clpZ+)^5FF5v<;?J6@M5oj6(%=*!lzeqMLr>j!hTmJbmp1qO$^9)hE c=j&%0-@&ktkvXA(N5GfnKYD7VDyXpk0}^o49RL6T literal 0 HcmV?d00001 diff --git a/static/img/refarch/slack_auth_token_key.png b/static/img/refarch/slack_auth_token_key.png new file mode 100644 index 0000000000000000000000000000000000000000..e8917f1d5823cf279bc0936fa366f88e623f30df GIT binary patch literal 55034 zcmdqJ^B;P9`ARy5qARuC)p#T!u z@gPj#lzWbe*0f}kR`&SKWPvU z1b|Nj1msM_|EA1D`ui>tZ6@;H*N9jT3Gb_=)qn=9S*mC_YskrhjO}cg3{C8eOqswo z_74dV_`o3G(#F);kOFLDZR-RA^Hcsw0RpZc#LScwf08&`@l$HZDN=~qIhs;%GO;kR zPzpSyprGJ$G%*7yy%+y0JMfL4(!$x<9>mP-=H|xa#?EBtXwJ;a!^6YO!p6+T#t5Wf zbaJ|C7rDJdTc`seRI^>ns0`)^6M zPJcBEXdv^$9cET07Uut3HdCjp=xXCEWq|xmj4m|Z!QH#OH-g*9a>4kpfyL@RX1F z9}O0G`d-N4IRb(Zg4BCq6)@sn+LL*OE_hE*^I;sL4E6Q%r#N4w(c`7Z0?#Wg@2j5X zSWNtovsjX{RM%q2A2p)2QKB_{g7f`a@bJXN_QdPjC*v_T**%Zm2z-&(X=5;XWH61# z$!w#)#sS*h`(%9}F>-)2@9p>=^u}ErzadxYZAGohO&v}()mD^FF{xCZbA2|t0#hiz zd3S~;$u<|40FUl*#dgBM#~W9KE@ zIk%sghvAZtR4G7{d)gVCBV%rVQMV>j82e{146`uLWt=1Nl1u- z;@LAav`3GspZVRii9iF32rjC*W4HHO#g!EU2(g3taRHo>N7=6fpi=I8} zC4KZcI)=9vCI4TKwSI-vCJ7Ni_&=YC>SvI>hE**5@t?wxkhFt^Sd^-twMOy%RiB5_ z=7lK;XzTo~qKN)f@lOR>Us65`i(`Dm@*4YJb#i-#CN6!jOq7lC|C?$)-H4dklL`OP z3#b|M^%GYLdFT7h3||%B{?e=jWKzt{n@fM)dSs68_diAWA>{jgCCn{Fw={-m52J~M z#QO^AG8-CNeYRW=C@a{2OLjZyRf}?Ut+V>>Afo_{CF9U}GuzQx+_4dllU8@?5piIp zu@$aC+=Q!*rSkfI%}8p$95r*EVcgixLd!^gDyiR64MrApeizVGe&RIzSBeZt!h?Ra!57FH&8 zlct4QRsA+IrEPd`6?oUPpCq>n> zC2`an!LZt*`&;;uR?u%_`O_iW#gqZ_?$3lDlKUW29yHUF)x(193?e!}g`zl+=B(>_ z4jG!S4|w70iTd>!J~w?fGqr8;Z}r;uwcOR!OZ52F3)C1%-+SM!8EHtc+b#0JVLjvx zpC6;w)2aTdMaJT$NOlQLXC!A&+Jk&)zT8MT2%8wOcRBwBCG)v3oD^hlVocMWF3~?+ zbl)Vcv4*gz*V-GBf`df^JIY=c7&JS)zr%QhO6nX%uUqe2jrwb)BdEcuq-jbQyb^Gb zn_@fe$4uk#t(kXxvIKp0Jc!(9ORYq&sP>)p%;riu{-em#kZ*-a5dV0}|Cl9L%KhpSEUqecRi93TvDMd_M%nH}Ket;w1537mcTvSALOTiSmAFXczYwUj+a8jHKB%Q35G{1+^D13!#rrPni2_ zY9F>tiB)&S{V>6_Ux5JxO|+($7x4WFuB+1tg^7^aJ^Kk^lu?bKIol@21UFb0e$R^A zqPsasx+=t|yT}W=NsprP&StjKV(1&kw@~s;b1T!Ey^4|5avkR}G1kzG;e#M7QlgXQ z`@3t_L%WvSmqFKO&?R!0wGU&ShfVl-WpFW!Z0`M1!;V$(06P{M7qCjUx=K(?^V1%$ z?(UgR6>1i{pKOc=-N^Jf3wFmds!!bl%6JffuV*il$n4^ef<4}%AaL1PWicjV&U+_2 zwB~(1RC925edrcW#OVkOy-UX6MJMYnXf>FsdM9ivCsEHaFWuvp=UTMHJZ)a;^IiX- z4zu~VUgtQX$(twa*ckBq;CF*q$@x&J_B4gdPBaGw>Q^mlLt0t_(L0>BGe0XXL;`RJ zq~B!l?F*<1EF;G=XtJp~Cm8kyu?*a6Y)Hry3Y5CQ(Of;*13H@(-#&cAkVsAss(S%X4r)Dyyer_CWq45=fa8jrSHv# zQ}Y*ztRlbJPejHC_3Rm-wB-1;NX5R957Sexm0Z!-J7_p0TT(A+PFd9c#%(ka9+211 zTTyGm!$&L#Z{}-vH=`}nxz90OZKFM1E+(Vi_}-zYfTv=!7A^>0YT~{VyY+;IbIrG*l9MEMB|--j3clbQ zf-f|{V=J7%&NS1Hw)QL9h?M(46(f!=zMxj$=Tn=-MW`cH&t*$j% z*?re3Ra)Q4$qDpH5Q}3>-{uJvZ8P$U_0lJ4#0uUinlOBDYi>HzX}ki7w>w_WleKF) zOZeKb{26^-Rb6-eD<1s@$nAjP3Ir@a){qSpfsq6|O6T+dGW83tFQVi^XoMae)F&i;Poo9Qku+{QZ+bw%XO z)_SfT>&)w3&}ruuHtg&a=;TPp|E@KE65J=2A>gfZ_Hl9nSk4c$YHUg2xXmQ`J|O<( zO=g-y5s>Dq2jiia5Gffx%M*J>ZmahZga~p%LtfuVv2*2`xA(_rb#cL^L1s$ffzMho zyDhj(*J;}|O%~mH79B5nPwRp{Q3c5(Y0k4(kaD@E9-nTFb)>m(Bzp*c{QWjr$~OlN z+4hQK9m2j`9=ebP8NBsvexyS1oRj53iZKlAU_~6h4`VImYd^H@fynsaaOH+H>1(^6Arfn9k+?76z39bS+xY`V+N8A z93wkqxDKSTez&-xzG4_OP-V3w4}~C84TO4(U|(Hdn5)vT?RDJ{WKNm&#+qleM!RKO zO&5Rs0=c7ZIjH3-By6-nkYLv5S~JVn{(41|)+a$$Do(-SD|s3DTgJ!ACW56xA%6Fa3b;(=hznGWhAk7J!6Qw;}a? zBB!F=q81v#J5Sbd_&trSf>_T3B<;KWiJXfeZD0n!yIzysyl(EWb|KBDd%M`@_6mj| zoxJU==YEFAD8T-D36IHYwD?1oI9!;O6W>~43`{?*sOv~XrIduB0TTgH3bOErmXHdCZi zr!;Vr1x{sZxM6cy61=}TvF#2c1X+}QC$vLxdGAgUJF?Mdshn5W)xtRCVbnpNUJ7hx zRB81N+}-<3@vdW=%*_|=hK1!A;=Gg*oXF8MhGs$*25$s8Kg9-m?sS&+C_Xagw0_x} z@lzRBEcqpa#pD zHrs)GF(L4Jf z60hI_+C@2x_X&-QFUj71y>rMC4^OC89~*lk588gsu_v3(X0x9mhn3>{+OB|W)<%Fe z=_wxF*3MJ`@usBrMx3nMc)t(9Z3j#EU5L&t%9+cPkfA%jhqHmsdm#{wJAREoUucm? z26**J{qtMT(=iE-Fh1pVdeZRjNHTtqJe7c*lm2Y zI=U3U4s%1pF!J&4igS-P58vVV zF(N2qy~>fCsOy@1oZ&Uz2kX`>Ply#OOBMD8U*MEl$$_1$Vjc}_>SE@B$Z|4ps~^!)h53j@RV6MJ>$#C`%m9^)2P{{~3TlLqyKcAe ztEwBb#i=$VvNJg1vdjLrJuKmU`C!fp*CN>XbS?JYc1;|0mhGJs=hv6aT72?{yMUdv zDMqhWs3#pYR2ScV@Wk1Nhdv-ZFt`ZY)p-U z36TUJOKCsgqq+!4LQTlEUem0-n;(ZAWcXZd6X~0efT9UhQvs2 zjPIhmjc5vbLAE2jyprjUJzff5^c^Xa!Y_ZP;|8H--8HkMPCj}r^!ON0@ld*KwTnbT zpbP9EX8)<~_ycnj@of&4*@q^mzFwi+SWtkusLf=T@D zb%^H;tjE}H2KCT4v(ef^-0qx1u>|}S1)Hd_$4koitfxtV?bB9PYM9bUB!);mM!T6+ zBUT_DoWZk~qEJHBn{fL;dHqQs2`)ZVliw?w|LSL!spa>iuWbWkIWqW7<_dTcW^FZZ_Z{lY`kfhcHCq}y*qJybr6xtPMm zpY#bxrjBdro*O)>D}xoozoF1h;VFUBSD_h%8H1y8Gu8&a8_DLC2U`<*UNAAY+p}rj z-3f+!hR%Sk2meMM+Dw?R-h7dGv#fhGR5N&}HK#%{IdN#s5%G(nkcs6#l(esKXMf>KgAn}^2UEzsJ_$2CqBXtPYsM#L*bB{xcPd}X z+_+{W(}-d44-t>xO2i)mR;6TErzA#xtxjH=tJeG**jFJn8iUk$n)R|CGG)!<{dkPS zCys@Dx%7sA*8ieVq2hh1Xe^;VGjG1&osd=rpY`=fo}>jrRw|#BOZ?O5CPv`+R`FK7 z%t-9^XtEMJZ<~yOlc$_#I+!1UhnjPk=(g#=uF2FaLVj@Ed$y?C_9|HY@dyS@qRFyz z3-jdyV|3&f;S~0{;|cqBgbFy$<9#%Bz~=PRO$3EL?L&Ob$p{&f7{vYVRXv`rYVKy;{2ZV*C!Ch@@}-kX?)n zfIf+8>nY1XDUqMH)dlQh-C~Us94@oly$oSHRx;Jkr1%nCr5dtoP z^$iWn?dT+AB)r{M6AFTL(Nq$2+Eu?MU*OAcej@cuwO}@tj(5->yc20+t(>SaEy3=@ z(c(=Q33(wO^{PhC-=iMJr5jsSEvq?0jJ)#r1+r2T$@2T!1JUHDnFiG?GfW=JMnyQ$ zcifc9wmi)VGY^nNm>fU&hMKIgBgOoiO!o9U3V72aj%9V ztJ2<$CHI%!eF;BJU514~x4>vH4T!pD?2=}N-~#_4L8n0KE78E8HBS$pq-PDzegwJy zZTr_5WsmYe3>2GnE;Xn))69ZqzF4X>dARJ8xOcnoA9Qu*lYyRUI!(8IYTV-6<|cTi zR;ab|#+QYMQ>l=hJvldpKaUvWMt%sS4BAmiVFeY@%rV4tYN6}Z zLc%QH;w$BK9BU@tt#_xVI9pE4 zhYzfg0&|xuCYBGP3TSahAU`IxD3Ee=n8j;6w69g?*tP)dBA!=!v*wIoC ztR)Yt({9SA#%+7?$DU9jg0&9~$*gI4y@ zi}Z~6L@QCt)P>($&rVaWXNsD2TU++_prAV+@4ovG+*vZ%VH}Cx;|^i}q!(9=!hcae#|NX4$QhF-LT`8g8T7y_XZ z_SvJ-y4;lJ_;`Up@P%oxmuHwxKh*`QPgElDIfR`G(Ks~gY;7d-r^9E|FEA9Qvz=+> z4n$)jqYNoW{vRD1&)l^zN5PRu32!jFC{@K-kOb$srDz zz`b|rX|iq~G5@Glr#IF7D_tyy@|&F4*YYK>ApEb&fnfYI{wNUEiwCny_mSg}WLd=X znrk1M^NHcl$(RxvfG^N@zw$PM%Ga+GJ)+?<;d{-NMAhv6k~}~1i{#F|)64I<2^&uhI z?extr5G5UK>f_-qKEHQYCTd9^O*AEMw)5}#oI}NF(R|sRa^*|7V%Sz8(sa2l@q*pQ z+5hOd@b4#$1au5JB#^VW@VkcNt`CrTv@(p(d5rOVrbj-5yPeD74v4Om-vN7lTLO)y ziMNmcZU!1b)$&YSXNZVn0UO=d9(=nz6c#lCQ=O&Jqh}}D)6Hb;-e-Lrk=(~wxYwV_ zc+K&S`KWrRe%oYu@~3V?wfG5{9|u8JO5fVk2=VIE_u3T(7yI7q0{7A>t5)L#v;_HU z0YM`svFX(p&`800{2uC^QsG;aSu@#)oeC+;Fb3zGM(`LJ;YqNM8G;_?rwUnrzK&Uw zEtgn~{z)a6InOBauXpr4X;!08A*^CwO=b=h@p5@?lu4@$a`+XLOl)i4ivr6@5s=LB zv-GJ{o{#H3m?-UT0|&+3?N2~!2W<;09^p0wWe~n15OF?m9$YqG&#WNlwJq$ffs_oj zSiw>-gus`MbTTi?VXBuG^DPUwqm5##EldWAUc4N1e z2@nV}k3>oju)kBSL9O8!-{K2iC)5+XU<>5T>^vd#ZKG?Qb@5O^7abJ~Ee;~v2j-owmYhXsSQ-VfQE#P7U z!{p}bna{&PxhSx;#co**_p*e-v(2H4Ez5AjFSOdYC*t4-ITD|E1A%}fT+yJ?3tjnHR5NW zw-thcSzoaEjz013?p6G@5+Z7;Xk%pTAaA?6M=C=_F%F4T6;>0tjKpEjro!T>w(A6m zv{z7$v+f2Rr6vh%c-LOUgmT!1k+`8K_qPTb-EmofT&OyRQ69GwlE~@-ZqKt?`W0^v zcnIq2`8yKRfD3&vtATwTyGH4&`0!#>noOZT^Uh)k+lRqpiZA zShMqCgl3@#iW9_ly#k#Z#CQgBdV}rj+Fboyw;kKIy>g-|%$y;|(Sixl7ydIOvbhZC z<&c-UN|-AB41xw7xvITkDD5nRKL;8Png?zhx6IWQ?ixO)1kD#-t7?2+?l2uajm#}* z3nK&9kA@(|L_+##V`daBCx68sL;dP*tLM&YIj_nRgYTmgvB^cIn%Nq-n3EY_wS^7` zF2HC=6r!|C?fpFbXSl;{_cVwl+1(^KX zr38v;Hz|Fn?Alz0vmz1K%K8%rvU9<1X&OA$5-ol#_}S5Y5TvB}2A*YHZppmr+jQn$ zx2f^^HK`^E4RUOt6iu!=q?WK}!3o|%?mW@^LNGAa`AalINSEcl#m{)TMjFS#<3Mf! zO|JCV$g0`j7-m`?}3k;vj84zVlbY$1!%Bo#ku9bPigpowY+pVa>l8-(PYU z@9kQ_xv-j9k#N&_)U4KgYa`%@KZ+dQ3r6eT)!xMn^uXL>Gj{sR93z;BL(1a(S`_a@ z2-8h@hBc^Wz3Gxkasp#qUJV|tAzPhWeo|pWi_KY;p)eT?xXt5|q#1$gA zV*xvg^Z=_A5=)eJWr^7bMiS%>Bpwm6o9*D3LZkWl#~gad@CV{>1Iq?g)_)JSD?G$( z#n9Gf(_grk#V7HH1cK;IHaZz%Oi9gj1#d56ht-lup-6Uh3NmLFzZWZ+dmK8c~OSBQb|LHJ3DcR&}tD?p&3|C@Y;m2hh^SxdPUSrIm ztM^?q!SQQl>mWfw&55e%E!7#i3IT))XyF-trFiv9sV}+YE1b z2y2!X5W;jc8m(o`>e(8M^7zgN&eE_lmkJq~ibdVMBe^tVM${wHE;n%P|6nG7E#It$ zswT_#tZ-eqN9`paaq2fPe8J6yTspbj^z^=KyPIj6R2*?7}Jr29fEmukkhxXEe)Njw>iaz#vUSQhRP->0{2K9U` zF~MdGinEzjNH5GK9zDC}1sOvo5OYpMSQ0O&E5O zq|<{8>Xrz#GzSY@Qc$Ld3SOVG*Btc(?C}4%EtM7Jk>g~0i!7rHws4INFW7UZ)1@op znQ?}dtRbdXVzR!Ov}*T-wf0daxLaVKA{um?>C4+jXEY)A{wM^8Xpk9K6uR#fhTE?j zN2Ug6-6JS08uE!P_dFrJZZ&4J?KOImlywaLc4TpkDAHJWO3ZLuCJgwNB9t@(1N6J? z$sepn(nrUv$jbr4HmhQR49xSn1lW582KJdy7W{^h0e&W(VEKL!6{aN2m=qp;e|DA|M9Xk$di)~HwO3KouXEx&vXS$ zi-NeaWh;(xFx=6s*{L3%ZE^4ARLd`@ z^A><(qv>qQQ%%TBPR!FHU|HCWeK$T{zuxs3cDFDVZ}*EV2HLrv3dzg&+psys1m(a= zwpm6Bb$mPyCi*BM+6GE8oK3%Q<;7uD3_44w_fFH|1t$0P=BEqznmHc7-8h0UdzKd!A)Z&jYE!nW*Jdj-mlu{>7lWA)M3W6Q|lT3iF8 zZ+;uJs@JT|m}-|yq?^a~r@^~q3m&19lfM|6>5Z7*+c7Iwg5jE7nW|wySv8Ne2;kyh zay&SFE|ys-=QnGP>>u!_Y9^$)E=fqe7~1$B5a~bY)C?icgZ?%2fAJ5c)H)mvAWp6aSC~2Ie+ZoiPAXjtAe`K*cRsKFLru-p;h>5459_vkcm7A# zTLBPP)FW!TivPuz#P$ zW(9S9MS*`>$jkiD&F;ILaSZ>++=(8#d3y)F|DSF$*nAjCUb}_BnE!UO0@Xt|>v{`c z{Kk=fr>eSG}tl0V3=q+;P{J zez?yd3@aro2m>y!WUKv~lb!3xpp;%Q^ON+lyHkIv>bbzdw*3&6g4(6^5O@i#H{-sg z+R62lgK)dQk>d=r{O=)#11Ci)YA)2}$pZD=y=sjzqhkA&_PWS%wcb~xWZUgrTmve{ zN&z;-H~Z1Ho;xi*w;nZSLqzHnzK9RxMPmP_S+b-re1DqLdXM_(>4x~L|5Wq?Ef?#t#E&BNI$E8YFsDqSF!Iq}PwZH4rmeH1as`ezEr z<(Jh&Zny`H>sng}3Z&)!ZcgsoyS||`-s#($iIIa-c6qn6oyob6SK0y-c?xdq=EKf- z^eWD%6|v-QaG#<3RDXccrTXyb=y9tEHxH2 z4W;wXRoP5Voq_5S0pCc9Zr4}5d;gqu^5VZ#urwYgYFOjysz?TyP>Ozlhv}KqquAHG zElwl+>Jym?bZI8~pSnZwsX+%bP?Zhd!^SMbgbabbOu;Si$q<)$>uOe{!0fLpV%w9= zk;s#}!{+OE*rDts=7UK%Cw%aECqi&F-j`fl7Y`s{Um%bMa`_4l4CeA)@;VvPSi%;( zQG|xD69Umr?YO0N^>lz&v${#R(P%b8D;V4u`X~FZv3Jt@KS*Y%%Fh2 zN#~z-AZ#e^vmUQr?|lxL#w7R2vl`D1F|K?1gQSm*L&WE%QI2a>Ry|{+edl*RG~M^k z-EFU|rylTe^pHA_3V$ux{w!g>)*Jopv>lzleYH|NQa-#*)=>ye_4xyN%U5*Trvo?-vWqe6{{Ag{i1iLKrLAi zJjUJu2q?V}Dx323-qQ{*emRNu<%(nVVkIC>;z7(j^3v?;CsK+J2KEIbrlC)BLPiOG zYr@~326@3Plr`$>vRiYcTZK~zVOpP0;4ij zfO#@&gD4hH=a1C_%%={Y<|#r2voLqLwu%BE9CZ~{5rXlup;U~dRW2K@RgJYokqb1N z#*G3Q0fZ%kryN_OOuEh?{i{+P88FRS-HB}}FSGj3HY2zm^?B(&{rtD569+p5B@vf| zYh4{bG*ew?E$atG1@aRlMu$cQrYHKX)b%q|Or;|>A>+V$E_t#Nw9dk=1lDT=ml1oM zD5}5peN}Upadr>@Sij!a=PsrL3DjEKq0G&ryU_~~&H%SK|Kb}90u=SI`jFZ1q zLwPMs<(-l?fvAT|`R|qfMEb*7H;a<%ms_788884X{1v9_3h4q+yY>e*^wC~gZvWcabKNmYv96P{$O5${twOH#_L-}-SOpSK+RpgZj z5V+3YX<@okJ*0K(K*3xnj(3}MrdKa^Cigup^GNBmcG!BDr1j6Kr8^gssAUprLvU&8 z12Ku~f#sZDEo1oVH^*E5f`f{V9KeKFJvm-wkA;{6=cI$5U319{LSXb(r9^Mx z0ix8(jTF4oXrf&Hrq7w)49xHP`=6l%9|3S_y7EmUKzSBRM3Mneoil0q)Ybt#jMvngacn=40vtjv`r^f@#R=MT#S<`@rQ+!&_si+(0@V@DM)(W09wMcJ&5w9HF@ad{?=F)hfYEwC3?g8?0av4tF5dtmuX%6 z0sJiC6Al6Is0`EtUm3}RZ33J5BfVu-lip{ThaT^z zCBxL>sb#EbPhy9lM9hIjz`pj@16Zim(d_Z|LvQ_V%;W8(GX3%7v7 z(^>FM_Xmu53>O11iNgiX7!YwNx%}3s5n}(qf&gYZJJMjWqwZtkFfXcrw&#?-APM45 z`CU(~*Lli6N;Z8-`A<&S9eS)%s0kGT|3lGAxv#M4sFXT`{)di5FccFLx*14pJ6d|L zd)a~p{p>e_5)-Q+Ky5S{aD$k2FLp~6h5~DTznSKip4+nZBQ!43QO66`Ma1cGnq;xk z9sm;hYEJ0^Ou~2?ymaf@Mp!p7#{zB4VGp_Qb5?^8b*d|X=Kdk__^H)AF#E{*26?_w z`Paf~tmc@ET0axa6Y7`?XRZBaRZLnYq15{KO$90-q* zVfx@+i5^DZ-syx}6SCxc&;N0*x+u_i%~<6XE-7>E@@KTc%-s?hg55^*PGft`G{e)- zJn_pL&TPaLnm^{PwZx<9hG-Fp4aHBjA`g@iLc{Dv6JCY5kH%)niC`&WWXvxP2;E0$)w5fQpy0P{jp?%c^Kn2HutZA1La|^=WAWt zxa0lDB7=#LaF;6rwCsk}V|upI0TeY%!TZJ&s2>svO0OQjr)BC;DR3YmLE(%|6V8Mi zh=0QTg<+fBrC5&pj-PpuWqb zszVYXE#?lFA~LCU-$*)CXv1d#W&3gPS-p{d?F66}yQNr#2Ei0j*I4_!Z!-wlq21vVn`Av_7Ye*J z=Z1&sfYD9G=P9tl|61P@zmUl*{f}D*n0NR{_qUaKry6sgvs)cF0m5wTx&vE~Ve#}Q zF&_2r=44j0K>|47@Y*5s6I8#=zkzl~I3?;)*PpA!+i3z+&B5)-X^T$J!-#^4YIeg`zNdmXSyPF3@K8e>BR}%7k zZ2gCcQpk@Bn5x(2H2L(c=Q@pp?p5M?+6o7yc(YcS%p7(M7bV!pVzkVCq18U8%`;vA2HJCS;GICbjNXTMG+ZAvG)TwOZS&iN zA5OfpTNKIgy@KUoutAhXcnwRQTxZj%Nv|2(MDTMd0zSfe$Mt^N=E^6h)mJrch+bV3 zZblco4XwP7<)gsrryng(|Kr_9^xF>;Dz-@-lB!edMNtWkj39(a;oc(~TTK^D0&C-j zy1w_&Pzt+3Y_NH&*nKY=EtHhB2*$$Q#1FICZ;b9j>6dO$ailp1jZG$C_X=~i-T{Qo zf{BGYE^=AOZxqIeJ;#wxE-PaA9~%pA8~prHc0yjD7!o^kI8I>eGXw-z;J)0tNJ-W4 zyI3YQahOk})BGBWd+3J+dgBJ?ca6McBUT9(CFgwNwm&t=55IAeKd<9Pk)mRkbS)^; z_Nwn;p=tT0`m0W?<)%=a$kKYWx}dMjyhEvji;%(kF5t#b8JY7olO{>YHR7dcx$OE( z>)?iVZy4%9cu@E_@S=;;gy1)Mduy~1eCdo`u0nFCiHkJkSx41hoU+V3~>(uE2lV+8y4ul5-yDLo%ekjOrp{7qd2_2YIi=xt}$PK zgi*2dQx*muovMBLeC&6*pP7I7$48G`5gt`HMaLw`n!WW%E`I|3f;AhAm?}H~(r8as z9rv4qiye?UM5a4iysA*tG#gE3%oCy5t>j5#yD47z_=ttYfMI6Z)@Br5;#wlYd27E0 z2}4Dp0tkolHZ_Hd<>ZyhC;t4%xMWc(fzo{7fmRzhMiM}?44o2c5M1;gj!Ztm#zZb7 zBso&TBF+X6he>YYu2%?0*`EyGFwnRTmLfZK5FtNqANAwTK~5esMgERi&ACiJkz2Up zXDu`xlubV2RMK?rs7kNyqCb2+-Zvf;YsyCBNq_nU!!!^(y}vDmJ|1 z0N9oAZqd0lzl~2w=Oz-KZ)kqEZF_Q=fNJx6Rb`Y>)b7LOZw|K6x#FYjkN00tA6R$b zu!f8X?APgK4XU(bGa0#l{l71t2kA$t+-zpI2yVCOaQA;6kvNx zo*-jqtN~t{0;Wx`lYOpwYY|-oj3kUOln8@?zBg`pUX|G8)ExBCZ0;Ml5sjzHyW&t2c#Z-| ze?e@|q3APOBh-vk>{>Kirk&pA&(D-?nh}y3qj)Zl>hcv%tpSn6QYYrVIRC2PNTNj! zylkVkz}&Hj&>RYD1*id@sogc_ue**G_<|vGF4LVgs%($UV6FJR-(#qyyOHTG%1)_L z>^ZQoah8M)OS*aOTC%ut947CJzqarj$%ySCf5w*`i;XN0Ch!wCd#ADZGX3CVpi0B- z94&evPA8Wk#SYa*G$QfpHJu`~Tkf>~)4*NSE{aaxNDWrQWZ#B%je)SyW^LrYH#$A+_jb?8gwOkrbcusY&_&HKyzaU->m|Of zlR$)a4}6z>biexN*)&w^tgdIq)2r?H+Dm%IDoe^oe6eaI6hkGk|1@U|=bu+rpg#Y$ z?DwN^gzqGbcli_Y8JWM9yq{%#iftq92fHP&f+dty((TED#GM`JKSOA3_b7WJv5d}5 z3Il!U6Es^%@3!L5I@nDJ%565_AQK8NNqx=A-&I7q-!RhL--9Dh6``W`R$sVd-vq6P zdB3-aInuNJ()E!EjWzc;J+f44V%pbFE)xQU<4JpH17-GH);XDn2#UZ2rtE$vF5ewFO|FSM z?MoSch$S5qx>cMO6^+O&u+ZUP0=~!%j@~vNxtm-yi3)e&zRZq=9#*zm@%^q@AE^;A zsgo1aj+CYL$;Yj&jsu*OG< z2tl(#2J_xeMKqY)Z5>MT6J~O{j1B`S7~rHfb{W(BFAAA5J-^bQ@;ys6X{Gu+KswFq zDQ15O{cf<3vHs}3AnQfayQAL;;g!`lNN)!9AhmsWp`6!MAMB7SOqvV(r3e#(Bqs_r z+2d25@=c_aL><%gDCibU6{+a2QXCs?48>rRy)ON!E8`5w%SmYKmq@1NW%rf;SxPvu zme-%c61w>U^}-(MOJ((k>D86>*O>a;V)&PwAwCXM2~WLrc`QHo2sJ{UO5?f zw8235)gdP@$ii&{!XnUU1%CHardfP%U|9uMABjoxS2nJw5}X8Qq?v+q>GPy*!+!35 zU=!0#iwZcg(_rfU`DaJsspSFoMeI9l`qJ;Z39-ztYZ5s9%zKRdDM^yOD8R)=iU zyA#u_T#scpq6ENV135Gk;ha_8TyM$s&ra_l8sYJ=$9UOU%;Y-EM3=K8h z4O-x1j)Du5yCahSoU9)s-P=<1uFnr@`>!CttPRg)CAQrX=0&TSg~-=X2|ICY*=m1T z$E?X@zgkQrJh6_kv|M?`IFf)5Pe|}`KkujwS}x;$2<>jioUo{ca%p~zLtOI9Qh-h<0&4`^l&B>AM zV#4CZJBmNt3ZftBBR?CnYz_BVUL*8P>4&D=H32VNi~l+@N!|uq8y93KIL@YSZ4Hz; z=O42)uQe*grC_(^A*jm@GX4LU zI_t2g!fx%WD2N~kNJ&eKzyQ(>A_5{M-Cfc!(lCSwNO!{^lG2?+cXu~K4b9N~ZQu8t z?>hf-4Qyt|v)8lk`~Ix}H%Pr>t;Vc|S1eS)HsMRdc63(n#W*ROy1thg-wg!ZID8m* zwc6x~z?}Y%5L8M_Q#u&$;hgmmL-&8>72tWDImVmG0rV_Sz8?YqU#EKh9B6m~GLqEa zpx@mOSWm4FdmcjC0zUp1e!%j{Amvbc_9OHkbpa;XvP=-2i-jNiUmN`aSHQ7 z#K<}4TGTkGJ;E_%zFM|xGiUhkP}1??=X#SI^ZZ)JLnzY{1r4|a*+6R$ZzcKSrDy?h z|CNFf=msT%b*@PPPF42#fPl~P+lGl71F5ICeWoy>mq+8yrG#sZFg!A_b9-%+2 ze(I~Ec~I7MkIYT4Z#by$7rs4eKj;OeI}VH76fWUXi7WsCe-GRH+bi4ck&FW%Z9m2l z$x4U^V`9x+Wk?xv05*Hq=7!E^rdlx3+ao_Ru5VupL0xg3*yeoA?dZx)v`-_4d z0SnaVzc~9F8;ERide{1!h)zT6LfwXQ(SYRMQn*@?)<$vTxmJxyFMg-x(MoIh{c{dV z8RPQ(oj_%CWd?=OcQWRl+huz9>b9J3++3DCPvpXQGACU3clxVKRi+Cse$>?e(_}>UK1H!dwDh z+Z>R`{um!#z&4K3uGnPbHJhLDqPd2 zhf_S#)t}`=SvW8-PjaRqf#^Ji@iP$yQO>(a2_bmau^S838aVZRJM0GUBHSL(dB$B~ zNLSI93f7Gzd|w>qx=K1P+@V*RE8U8IQZDY=k~WUM|R(^>n#c|9vtzWIhV?O zLypiKBAcKBXV?wnU9tzXPEgPd=*vVz3EM@N)y1ZS7U~9{*JVgYZudc>$tw|9Pbd1t zal=&(Umy3nYI%8)$`N1IDG*BueS)WVwbfqFw43u?2`!jQ0{ea^CH7li!i?jhY6?1Vr^Xk>W@8;qDh;7 z7yeFyD11I} z$ywJkS4(p&t3k(>x4JzH3qp|M5?%D|a$Aq5+_vHguloKH=N*rG@Aw|d2%`A2y4J6B z$Ah#&dEULG9lO4c!Z2|!213Q@EVyHXiTvX2d$|DAx9ZzEUR{|4#{DmGtl1X(7$PX2$SwV|)*CUkf~lJw zL524OkJ_m9iTe!q!(D-mc!5+Ki~O@5TnC2kwpuNUtJ+sX707`GaZ1V9-ab>f&c77? ze>8P~LSU)Yj|&~0??Yp|*fu$=>x2SL^fL3Qv39$|l;+f_3}|4j$nJE>;h793+FL@k z_=rhuK%5(6RUd}kNd!QMShOZaH)%YkBhB4^%!-md^nPV%kL2o-dV?*{-r9ga19!3A+myM!@5(FSY$kaDg1P?r zCt~wRjscfXP{7r3XQGz^(nG@(LE2YP(zKKHMHk3A|C6HEU6F-ik-Qe^?mHG~67nem zgJ*nAfe3m^Q7`yVWa?>!$K+x^h0B6Nu_JOUnTm}$4DBs$d^v05snX>BY839SELrBt zy0W|)#lxks|A0G8g?}LNpYS)CEt9~?ga8}_5CxIrEM}eBQmc_t-#2z7RykY1W4a3T zy^sRVdwI9D`hc~ zx=~?&Uvh!B&36)b?sGXU1SWxGbOD|;#ccnlMc_ST_aB*96nrbzS33a!7f5ZFp%;@0 z55P9n-n@qsjh_qPFHGkt($)aM#CpK>FwUY|Kk<@`XMo#wVTJ;r4;%p9ewPU0>%>fv zlZ}2h!@xQ~X3-ySx?Bq>{=E9ub~3$S0TCg5P~31Y&`F*&FxPql?8a3V6C0b(rnH$# z%)*inZn1{cNnLI8A^`JfUcx`U_{_ial?bqFjm0>8e5RIXKvQ!=*utPW8&|>Scte`omwF?V8T!x_R5?!IvcOTL67l_KL*%o5BQ|i47SP=5|f0 z{;#!j)E~=;(5kdXCUe{Dh&)cs!&E<^=VY~(;WR58BBHyl|j4ioFx`=Wka z0N3n*h)r+L%$t4wOrR{GK;>_=2O!2#96o`?0jFI7L|BPACUP>sSucbIBjLjyimXyy z!rDo}d~Wl|{iqe=pUY+u5EKfBC&)bE&9VY{xTVJB_H!1wb>SF}p@MV3ZTs=W_u&_9 z_y|wGK>#JU<%E5O*&syU^B$0PXN(sVr6{tID-z3YCrz=}uD!YrorKr2+A!|#@hL*4 z<$^%OeG$;03pR4u))vLh=UCHjirQ_Rq$r@V1?nZRoq_1nHGSd+SfjgTBmU>+GeC)K zh{6qXOwjd8$|2)43$1pV+tNXHyPpe*odtLUG=*d;Nel@4zmiG3=wZr6%c@ZkJ@iRm z7_r|)u0pzq7OufSgP~1SeQubT!N)f{lxVv>nc)-nKRA?|aYZg8;mpl-M1$J3NGkb+ z>S@{WSzO4r-!|=$d#0!j-XSlE9|$T7IEWU3WJbY$NF|tTRGp(YGki3TD~I-q(*ULC z$$D0)A@qDPd~Y*c2=#d|+4SKbCPtze3;}v@USO(-n^PoJo&VU@NW2B7L95^g3Yv7$ z(yResDN2t&nbNj%8cgAx_F4mUVn{@&TgUNGn+(;`9|^3%>7~Kh3iF0(J?NmWSLcS7 za{vtG6vwPSbrE>pi9$wTc{?hIo>a=qveh0viBq^*9X_EW1ex~!%K~6Z zn#0`80z$K%BsxoQkVqOm{WNB9=5~eJz(cP42bma*aw#2;VuDg%^@flFJ|1($U9}=w zH@vsVpP2yX=#$$zeF*TmdyTS>>88I!D52|$jS2FyrYPz(C|%b_F589LZ>>L`MLB+r z;`+7i6OQp|tVfmj@8!1l!%cb)p&zy7bamQNh(m@zA2lV-$?3R!#JcGi-#W~F=P%xM z|DM>@0hxn79g!m!08)X*%fG`f&^%;}aTJK!bNQ8pP$T8o9b>*uo!R}=C?)Eq$o;aM zhBPq~5G}XwOcQj8!pH>W53|23rPlsnyzKKz{wzQNjTd98-%Pf8>sIzUg3J!iK1DT9 z)C7=?NdMVsq8vA)z%TR2OL-TwE2eKRqlWa|>JsER@rO0(ZusB6|Kn-&PLftiq%hIP zbns2pAB*vvR?4Vm5>dR`&)o$3%eD`B|I}w>Y9(w`e<3S>+Bia(2+C@Mo^*F}5ns5(Nv1`&?#^8t#=Z?nV z!xvX}z&8fhuLh8*fV@@$^ST=j>$MO6x|Dtrr6mQwR@jN-n+tMHsuU9P6LlO9kK@XBNxiSI(%`~;_+#5gen!d zU+2!>@!CW|gw7_E^AQ6{6)NcPo>#Oqf0lY4e*58!H9gIK&5T4)JMwSseLrnPB%RAN zh*y*NDRx2#tAt;fJ9RaZY%8Xy*}Nq+IBTQ{b^b@Aij$z|F_GO(s09!Pzw%_}(C7## z_d`y_yb2#4DK9Bpj!?)p-9ljHx&U)*E`Aj2>eMEH^N&Mx8 zl_J9NdNj)&gHZihtVV^JfGy`Uwt<`sDNTWBDbRybc%J5QwwHYvdS(|Yc*;rTdE|?_ z2YfDl^Epl_wffWsmuc;^v!E=8m9T}HB~KZ4P$S-qk8~mKjSX3k!9bx8YSUvgB58P_wDhD&sk9KJ;?gwW+BGN|nE? z8i(Qm*rQ4BV2N)ff_Lso&E%}_fomWmASi`l=0DI>_RXnIywKb%Yd|H5eswTX{*yVx zIawN;xHDrzghe+fntlSsi%S4|h5Y3-#mEL9;<2TKRJ8j&k#jeXZpTkZkTNd=5`n4| zS<2r#gNeq^Y|VlPYO^z4fL-|b?1LY!P+mnemG`A0i&r1}xqlfG0r_R7S4))er`WVv zHclfm#-6>ARs9Q2OvYxU9KTHLy9`cT6HcqgF-_2$Z}-6CPRJxRi(AXkSow*Oc;jFMR zyLlz>aZK}_Eyp$z{NnC>xjD@UgdR5!5D^5(x|n^J_V|C>_!W_0&DlQB^=f`S{HT7# zB138&EMC6;f(Yl34=XVfAY7_Cm#1YJgfU>{J`>vtG@{oh1=TRo=Xyn)9{d|?8Kl?HC zY-WBFLDLe@Q_^RDae^kWQR3 z&6IqZMpCDxKd}CwaWAz{J@wG2H;+mAt#l4pu8j)c-AL^OY2?AimVPjoYr=M1yhQiY z3&Co3PCFA0gf4%xDBr_XUY$Apb0BzhQhtQv8Kr((5R6$;)U_z7l&UeMgQq5FqDxc|<9^(B88_D^r42Mi%j7o0LyP6*@=>XfWoyN@j z`6{ce;sj@gE}yT<0|0okD>q%8&YUPp-#?m8n)fK6ECE zkuT}&>;!egMvna;r?V4NRdzex88_!CcB+(zFDdzp;mYuvZ5)O)L6@mp*97VUb7)Vd zXkGO}%nRT>=34!@rI_pO8v-`5Tr|PDe|$atM*`2$@z6QmG-}Mr3q7$#-NYVk_Tsnas|OYYBkJYsVo z*tOP*o4^qEsnE#D?hh}k0s4*;M;;9Z8m5tMvgA)aEJEq)G>7|j|1=`+PetrsQ zKejz*WCRr8;xF-#P;6S5gWKE(Uqc_AbusH1@{2XTPE2E)X|cZ77W6_Sv;kesB zbo#`-_KXqGtoyu+sUq#&-_MDzOzltRU({+O^~^iYHs9SJ>~Rh|qnT)iXR9&17`eb| zntuGl1GS~wGNXBP_vD8PapUZ1%)7&DzF)W0#Xzz;19`4-e^R= zIcA~D;gUnTIhr8q9o1d`-t2cBMs^d1MnOierXg`x-XAADYZls^iRKneoGVH-4>pCubHP=5wIrvd&+;CBxd0UW=9pA zM8+AHVI67wGF}a|Mgige!~?~I5}Ueu?VaRva%kY2;&+%R2yI-mzLF<pMSJ?@sB$~#8Nh9xck(H@J!>@N(V_}EX-A$qQ6L@FE?*ki^WK0p{G+t~Y8?L-IG z`-PX3TpAbhBd*(DZ59`YBhYJQvUS&fKe@u%#NBl)vP7|+JW z$#*-FmyM=*L*MM`kqi`kNg1QZzeU;5(_-*$ND6hby1%aAe*BMT^+Lel!^gr|BYUx< z3Wbj6{5fbOUl~HB(3|gxFQ!Qa*ftv0q706BjeeWHud3WON0X{6-{4Z%nVL>XnotnE zUoUPv(Apm%89{!aMpX_)wodd(QKDhIbgWtM4Cx2?Rqac#3)j9yqxEtA401dC=hC;pC2}dbb5{Fy2NDrwNL6m8ON3sh_Xd!1sqhX-lA#-g*wX2|#J~w5VGRQAF#)`ZW9|N6duDGFTk0VN|ygM&M*aE1|0#~g+ zy;%~bJ-8Cb;CyE?+xtgZk3G`7*DKSixK0bh9o_KgCr|KwljkXSW_Y=wuBOo8`+D>PYufk!k0&3i_rE~ed@FDsmwFCIBYq-nZZro?FFbu(E`mfqP z_$IzG1dDHrH*o$rWQPA;W&y9NNw)W2)<(PZD$yg{4aza^Zfv(R??-r9G)h}^J;F}q zICu;n8Tx#HvjNF%kxE66O)bmu203_K!VUaOP_!-DKIvy@0)?j1YB}2{eSGD|>MU>) zvH|R3_}Z5$E_O+K8spdRdm0&1Vz+BA+vUEPhiFHeK0<%La6TXlSWCRxbKa7^U-sIv zxg$bn>yfx)gP6k{azr?(`|2B5Ge;g5MkQT_AoM4E;|I(Cv0y4x7F@XWG^te55=WE6 z;oAgyNxvzAH`(l#Zc8?IPXJTc1brA@YybSc&-pPmdI@)7W6ELCvU${*TBlz^lo*xn ze6Pu$h?`^+C3jtMR*o9Hl8X<9U31D&;SP>_u#+8BneS~deHPx5}+T0S+nK+P4nQv&V|&+d(+7TU+T~Q$zmpVUVPnp9#)8m4A1lO-Fo546b0$9Ea+* z_yknpA17GIhBdx?5ETMfKI3_T)8M3`qYt?INru(7!S~VO1Ha_`<$4^yZHkrh6<4y& z?e?=Z7E*9`#X>Wm2zQBys_706%-PdMka9}KjALe`<0W#$Ji+C`AtEpil5;sK-RmtU zaC#WEwJ_W`th`2yb?7w(-OUmILRdkb1oFO$)R+Y z1r7i31?A(}@oX4Q=!O@}NW|X?+B{y#563I5Pd~>qVGa8y=_W#W6~(7Vm2<8SLRb2R=G59D_eaT9&nh2`>} z!wnL%$J7pyhK&=Xl{)boiK#iXJ3n3Gud_Z?)_~eP$ z&rx5FaRX~uh{&KNo7iVPJtN~lQ}p5zeLct`43Zz z!MK=qNqWZLFjZKtL*549)O$5v3m6;P{}}~P?_+76s9vqveDg(jf$^-9PA3@*am^zG zaJ({=&gm!H)UUs`PPnTPZ$5dT7QZKaf}4GiL9@PPc#mE@ZUlcV&`*Po(hqnnC7f-k^l3R zVP^(32i8+ud*5+H;)|KfS5H1izr-tfr(~YmRq8^?-$ToC9Z5u+bjKHG()`pfwlA7T zEQyiolaw6U?_r<4#??MSsp}=Edx1`A7NvmGK~^m%_4`%Bqsr5jp_ZSDfvkI+83P8^ zKdtBX4ys(HIp|OG^EWbdKXhagABuuPNCxt(&P6pJ0%-yt<1C#jQs8dqEq_Q7Hm{!I zhbh7BCmtV?-{GO6q;Jq^cLK6CX7d=A`IB<@2|V9pzXO@3@*C$I4E`=E&$6g+=@auX z9c%UQDf4ZWYWylivJ(6F&qIN>=;%c>Rj%%~AQE)ES!vUdzLqtB^0NjO7>x5$ANrec z@WVw1r_x^|dhUSjz-`ePk0L- z%7nxph8z041g@W7TU?W0vskfhKTm2hsOdiN*#1ie7lC8I$15K**ntIk>_&BV)4kT9 z#~-|pT5rPdc)*%t57f<{N8bjsUH#$I7$y2fAf#TRrkilX&dLw%FiD3OE##}{T}R=l zIW8Z6ZV8V=9U?x|MGaAVWs!Snu1oa4A{I44bR{5`V75(|1z4foQ z108_tfu#_Ba-tBr+KF1% zj3bD*yfQV%Frg{C!oEFNSzydfv;6aU(xy?OR zKuLvndMfMU_j35&QTF&`g6ZKewuo^bqt_N+3wLwOu7Q}PMEO>~`Lu^V!{h(_*OwZ$ z_$5@Jt}qxr-M~9eQsf%g#!Owb2>3#dy*3>t*=@sXx2HepMalH_nr$nD8Tq*vO5LC7 z$Zcx3FktM)CXqZ%*DO*}v}8|7XpN|-?6ufSD$s0SScJNyV}9% zUve{#cX9aG`(m7EVDDqhk9&t1KuHO=PJVeU))ryYj!H1OvqurVM~89|>wH+e&^7m1 zfj-a~mbbu{a89VwBtHjOL=%Sm#CPG9rl}#21e|Yg`JmLf8xQA5w!iYijYW;$HKwwZlV9k3bp^)2lmPi!_`BW-`!qsp(d3Tc5rpOZE8R0M$Rni za^1{4?B+3>M8PyW)Eb5d}f?%@&y7)~A`(|CTlc$a8H zhJAo-FlNQKm7&CYtjEENz=nG=rj{usT~ zEd^o7IKtS((}_?=$pSH57-Gz1jyXV~irDBp=|Vglcxof7x%E?*!$&%h-`n_YI>w%D z9#UXxhKZSNbdK|Z*0YY|Nxd9qIr|dyC_VMQ+H1srku%4P*vPp=eU~(Sh;eZ56gAJNsF^_AbVp6fsap71-@fpXD^*KaP~`n0u<+e#|HZ4GIte64tKA3PN2>$q{h ztPXX0c+{E-dEv)P$0nq)>v6;zdsq^n%m4;PboAo$K-B-{(f?WIXrAIP$q0UW^Xvau z+@3!-p?Wf#pJh;uNYLwfC(;Oi$l=p}d&xUFyZa@5M)NFCVcRdeJaLX?B%Y~>{?4E5aF`IB$9Ve(W)Nsa$@%VZ-&|^=gI6TC-iZe?*ycR4N zldEv)sdSx??%fNq3Z5Q3UOy9WQrY7>{H*K3qbB$kQT*G`E}gJoYVID~@WXqB6fk7& zX+AdziC$yy5V`PZI|j{AGA~S=6}a=@p)4TI2WNLQu57TNb`T!5d?UkPznsmJv7SRw zHW2p`@?E$0UoKd8#9s&>1@iBPp#B(qLB)Mc=m;i~-gOQoxg_UG&pyASYN4+h+Vk2o z?Y=th{T8vcO`|FqagmwO>P1^g+=_e%=h2f)tx4!TWU9P!eP6iKfJ(`(VJi$ z*6yXN@B#hU8D-!%W2Kirc6G4n5uH*Vnnn%PO%HC+$cuhWw!JUv&FS5CGRhPhK6G%nU;T$xx!n5CNmWSNlU8aLgU-voRJ`)R<%I)dVFr2d zjlG{g(Vs+wc#K>bMCcPpy(!6dtH;}+QlM>qfRl$)c1OW)fs+e6;LNUp85ni|sb zotM&l#W_Z<66cprT)6d|uf$eBljXK>zdU`sxYqQz0axXB~bDNNHs~g?(ZSyS%jx`Lb z{>9ZS^8tN#zr=CVOZ45!;nR!@IFdQ4nvl3W-0}Ta zq6(BIvbRFQG+3Va$8}X~4Y#QcVC|j1PTY0($=)(abF2YDh(E4K?&mq(TO}NH2i!#I zU=R&0>UZTjJDh;y)fPts_9_W*2j6~wT5jss+CeQZ3$b?XWcXqo*%9!0PoVGT%vI~q z`63K3mdyoNfU(L9W0s$HM^M@Ef_Oat2ssOF^v20$*OFe!`O^9>a?LI+G#~Xo4Wxgf zXZ@*XQ^)fv<`&2wMpao&B|r0%E7XWLLNKt!p!lRR+Ui>*RYnMSopw|-o2=_>tR+Mk zKJ!f}7)OOeP=F}kn`92N=*QF0oKXp8_gnCXXw^mf=yR zVE=i~Uqtwd+0V*(-(*~%?}J%i_Q8ro1HQ&k+mqHDiz5SdZPa*9Pqhy3$(szDp3QGZ z{zPs%K@PX8euRBjrH(z4QKy7sEw5pfq$xdRWz?QCJ+Br@SISn2^y#u?y*m7sfB0h+ z!g|moi$BwpFi%dL0fd7ptGNJY+J`lXkd56{eeL;HssVCySA(KIcWY3RtL+B8YC9fu z(LNs>nR&bBd$W1CGJ}J4Z5=S%<;I8s^=h~)AoMZMfH=b;=c%zh6~9rIVJ}}6Hp&lc ztG$w~T!!0qoVYb%5Z8kFns48C!Fp`Vsa#U-Cg$r$NG~dGcfGL$^yLPD8*e1>A}9NY z!L1XTcsrdy#VYJXeqeoFVdx9bc;Z*=bWd( zai!)My#I29vpBgiAi4OpdT!SSnYmfpNLlN>xBc9{K}En|79N_+uXPK>pSc7pk^rW` z3&3ezZ$6Z4;bhq0;EZcZtQkwuXV$G?vOSg^!m{|Au522sp|AeW69B&eV>^wV{cbkD z9!9?RweNff=z)|=qf6}jQ?m5{v!IL!Sc4^V<jFj?Y)Jw6@_}S?bWM$ zwtZnU7W_@ZM>fdunuygSphd3*ovBOc-EYO9tXwqd4diG&CxSG-MHzxG zgz@2=LwxPAxd+28>Qq5;48#O%NFcslzHjh?YA$3^c9%+V*|{7RUEO{Jc;}eVs%-Zx z-KW!BG^q?~^wxKliW&}3@EUMpbBlAesrf{TZN0SRM4{ms^5Kj3{9P(P1@y6)Hb*PB))O$^PUcb(2N zX1&J%S*WULT~ST(=Rw^K<@_vZr@x5Q@^Ptzv?jA~;4Mu;+SkR{*K1_~uk_r_W3eCH z0w(g*B++q5OP~gE6AL9jWYZfpZ1+Vz^$`z(l+D@V^wLA)a->w0B_wX_4olV(f+{xp zsqSOju1-F8mUnJk=ZYp^db38}T4voC?|ej_Ao=*~R_~QQ+~CV_J~bgj?LV!%%3f8< zH?U2rF{tyrUsSpJeqbc5pAkF+L7p!S_vPj@(O#LNLj56b#HvE7=&?~A*J06fH$=Q% zwBD(26>x9$at5{NGC|--W1NDw1i6DTLw8M4?YQqih}@xs*38_`?Q?NX7)X`|!xZY( ze@M!s;a4LmVN2cRAlKRYLcB%5N*rZ7Oo61c8<>!yX3{N}&EjpRI|IhW>NUI|BZJxhh*hDkL2t z4Y4nWCAkjmSZ_;l27RQLT1CZM=f<-m*=h5)Y4AN%q(I;&ONnDT!5w9Hm0ahv&j3i; zHEoY}@qV!wQC`7p8+c9;ef4`%T1csrfi$;YG>TPq#;GW|s`?8Wt}|*vdhY#5?iwAg ze9K;bL2)_X{r0Cf6y6KRc%ILD)@)9Jk#kaa*Jl;3_ooMo-E#x9r+?>N^SE37IIf*# z71^s{DXHYBkjkL(&W)nkKo`ooB`niQ->D|Q^`h(wryx^Z%Kh?*^eJk*8jA@0Yl4YD zl}VpbNt8%N{2+d-I@F8e!ipnZ3kw`3ny(>Qe^;m5E*?iFxD|1*i$7W5^7D*zj-1l6 z^>a?e$-50@bKKKu0tLR&YYHdz4Q^@idn_&8SI7WUnDEY0qg2+HTHWrlF*%G(Uo;FY zIMdH4rq>J@P9?e(&Jc6cD%hvf62NxEs~baDPn|D(JB3SMdn!Px1b#3yGJq znktSUVp9l}KrJ10V2rLPHh+Jk`*4Xdx;PAdWAnK|Zcw}OZN8ht^7fV}KJ=&1;Qfi@ z>He@X-(*=cBjfyh`onA8vmOtk;dH?UFY>!wE29hDVz%1D{q24`e9t)-%GZr28}SbJ zXNl5^F=Y4%&j|(PxBOfF-{$tXQq>BB!t0P#+ZTVe57;j9LiIysV>gUnP}2N+eLP_M zTHk?16gUM8249Tq+@AP@I?V=?k&O!0n12x5>M64n-?mjN_!VH&HQa<0q6^6ptZg8l8adIuEWkMH z?DLiIZ#gpzq%c#c7n&_!?;OK#e(N7Hqs+SLUZ{lY=>B0yWY^ll#X_(G9?PWq<^J*x zw}SQbaCsS4&-ncidd?H_Wb615L(jfpEvxpniCIEVVBB^eb1@f&O1#|jiB1PIqz|u| z##l@82e+mBcz%|LE;&r{UzrO(6F$7f2>&HDQDWZzqNDVu!s@OQz^6*am`D(@H<5I0@Hi^~*1H12m?oumrb;@j&3C#te(WhO+Wc=_k9EA{;djae#u$bT;9 zvP8DIL3-!Y@7^&xA+x@2n zDf!E%p5>+3*MU{`Yf64`nY{C^zkyL$TMfb`IrA^8br73&sHi5bapAA5S2{Qm7i1zr zLiT;<=q}9 zIPA!oUsq(Vf4&>ZU+x*$+>SI)wM9jy_x>zb$UjKdTmsb?OlD5eb@<&Zb-FHq3optxvbaV5nvZAK(SB7 z2Yi$1e%S_htF9zVe9f#jfnu-A+tIk*C-s6rahW7`ihfK$uOGX`k(2IYHdGzb# zScrU3jJpWOqTZiLvo1?*1Ah#Tq!HjDuo*|iiVr53M6)hBQgKP*2>&jeC{)ryIKt`Y zLB~8p@u=^A(|gS{OZxl+U*?BW%UDudrZEvv@-R`z@Kf?^S55l~_7kb#^ZPJr7FW|E z?K4;jgEte#QzpJXqi;sdyfdfLm+E$XLPq`_^R&#dqrCFyA9rVl=P8Fb_FOebH6t;v zpeM#{SKs(5Kz*^Edeq$8bU(K{w%sGCM%mZG1*M-v^LkqRjn0ldxrgkH<#ly=kU2_H zY}F>*uK7moALfJ~n3Fg7v2}gb7c}nLlV*kWT2CYf+l!<}?l+Fm9g%E`D`N>zGMhP! zYyhSDnZ5R|RDj#}t=SkxqBmfMj%;*>(rlS{2GH~3sD2POij#3=J%sH^ld!=L{7-f3 z=0=jN46okrPyCJXyc`YO!ETuGd~2^_)&>#{FS+#pknjeM4P+dC608G>sZtq+Zshm_ zmp8d5({nxa7f<@y8ZQ=^M^S;_I z$yhAbS1q_KLpL*h@ddP@{=YXcnpifv-8NL!lS?p3 zM$Mkye%A9snr71AatPgy(3;`>x!W8}u`>3DzoXO`|26#1^~O{5+T$dn?(qI53m5{e z1Z03tFn-{W=E^5oZa9R|%O-RV)I8S&-HNncV_B?(j0NDn_J#A^x!-{~_Hk)@Wg zafDs%uJ&rKi1h1C*cny-8~ua($I&z_UxO*< zR>;R#vh~jJb704O=&q;R_x@xjvMe9Uh$47G=&j+4QKGKU6jnm4t+=rrx(2nA^+})Jv}=ocLGw|KV$dwa8awz1PTN2OwQ_7ZqBjt7ynr{;F(qna^9co?FGTCWw=Mm9Tl@J<4m44lBd4W2d2K(9sR)C z-xRf;Q6Kxrf(>pg9I25&$97e=>#ExbWEY)TmwzlP4{mk+eTzpcMQ8Uec3&ZZPespT zunMwxHa$zn`MpcF%8L$`X#d${&0Oit!@O(VNwHv251=B+0CM}r*m=SncRW!ni5}En zUB@{d!?t!6z2en-#jrcK!egF~jpCd%?1p&vH>ci%s}~FLTUxs4jhvs|n`XutBxB3Q zf@?kv}D)ruzO*xSG&6P>2^Zab3&p#8aOf*qHotF7LvdLiEP zgfa*~-%H`nu{&(4o@kq=8hPJ}r@{1ymRvRIk;7||tBDvnv$@}$bu8=gDR%7UaD})$DnMF zh=ZI*q4!>n(KvPSEc#|LVyT&YPTM1`3{zNa@DXyu-Uy*eDriYq^|VdRA`_6>jDj*B zG6O?!x!#^@M|-2)5=rr9|(nIec+)?jddXuQ~H9ZGYm zI~XxZX+Q;y$?~ms5EKrba+9Z(G_ShX-In)f&uR`1jNZaL4&&Pa-i}*?@baL2(_VSM zYydFCS3}7AYaikZiNjJ;D5<@~YRC0SdxU6W+ZRf3m;(8y|78I%q(kqMgn;bHRA8CV zTB@wKnke;O4-H*pM))piyVh5Ib>hkp`Hg(sRck2;JGNYffPgLbLezr6BH?)KPqS6&M zS#?%uAN(=8wozXkyy1aXl z{P#iF_s|T-hVxIeUtMGNrf*eAmk`+eJEeEgHits(?EjW+k*DQ%6_?nSwuwTjMo|WT zoWFDY;lMoR8j4{L#%d*es)yJJigyKL7T$46yC0R;Z8D}oK6kHu@PXxO!`j?fzK^y^ zD3vKmD0?Pe2GPFPTut#|`|PfedrAA1NR12zxoX1Xg%sk$|MW$F8r0&pY5P8VOe6M~ z=DlXc5>>)9{wb~qZqFbY#e~CkC32H@4dR0v^HyQ^sVC=Ah1lp5;tSBqnWCPIDXC9Q z_8N&F4a!)Kf4jwRAUcW(3*txk1+V-P^`=P(4jDArvg1plzV7aSgaOtCi~Hg!%%mDi zKh}$cRgFbB~XA0 zn5C&yt)p2G^KjfGM&b7T#WR8{VHn_Fx_%psbH_uut<5`1#BW0wt~chY=!9LjAxWaL3#YjXUyS44Wr|Jw4%U6qw7 zP63X`ZQjb!Tku9=b_`QAZdObFu`1t+c*`}rVIR4&D~`%+FtHq*rpn~XQnSjvXiu4D zHD;}LO@Y&4N2lWaYr^`U`qfHt4hYlQ(|YjL$-Ic57aUZ%SycqHKN~uIxe}}!%lae^yF?DGCb}rogyZl^a&6i7Nvk`(@%-M=u z?P3PA*SNZ77J3KOQ#2LjW6bUS!=bFgq`eBCi@cd4CLqcsMUgY(JD}kyQHP6%m*bpBChsg`Iy3PCF)4=%RLjX)5 z09U2QlRBb>xGnMFtRHi^y4g4BbR&e*Aj-R9{2F?tiHlx0``$>Z5u?@CzP2cz4OUiM z)345{AnuIoqY#W&t+TPW@Yaq0N7`8iMA7|kUujf8Ny#OoOObA*b1CUiVQEB`kZwV` zySqcWyO-|n?(TSo`*+9x{quHY*V&nK=FGXi-|KS)QC<1J#>-xw!Tx#Um32C8zmNw7 zVGq94Eybi6)jviFTqS72eK>}wg<(R;tUQLcBGgwjPED5&l+D&N*URi=(}^&;_0}mu zkOl|G4I-y^4SfHSib~p0_OPXU(WUWF;NcwK!xaVW`OzInE!3qox*I;Fn>dn}tPg*= zj1Z6@em%AST2N?eTnY~Sz$7mAER5vSU!aSrNR+*Z^(1ZemS!H(kWt`ox>1)8*RJZ$ z66AeIg`d8~km5B1t)uO&_sqXo_b*kVq%^d3=A(!$|5hEJ{w^Ydug+O`|KFlx$t*c= zY`${aW9eUl##GrG6sg{%`NmY+|BjhI9s53OEp+rRKVxqi1%VPW_4h1BM_8$0l|_#BzsGDfpN`G4Yrp<4EWnW+PDpaPY?fo}zp#Kh#;0TE z@k}TrfAL+OPMnX>JtbprdY{k)@84tdxKGC_W$_UH%Q8p`6kJGDXrS>6khL|tmz&;> zG(8TJzDl0|s<|5-S};q$2)v3G4s4I}q?eZZ{S;dVD#l&Rz|6}}AB98#Q&3pz@AKUw zLD8?H?4ZV6T1r5*9nF%pZDf4SC2L^6%DZw+E=ePPTwTEXb2{eTwE~CBHe&Q}@b-ES zO%ThfH9(Y=Q~dz@ycjRU6xm1H(uz}+WyV=y2>h=EHOYf3`jRrob!RLj5ooDD?02Km)lP@p#_bINC zB0RW6%?f>W{)W#5&A2=T-w9xFmd;hoT#HbW``};{Th9-eQ+pEWs}gK3)Ft_IA%q|A!{6vew_V%2 zsLC%r_H!(D4+=aoB!GT2KUaMGeN%eL@93yfR*=%ym&l{KKzvp-mZL5l#CM@4eF?qa z63Lw$696aivf~$PR>?i>q@L80n(F=z&B)a=mounJff^Y+GJ3?xI*d>*V%_+-KEW~Z zCo4(qSSepndi0@v6oWeXVf}s3Fd)gRzF1@a0`x?#im5j^R3rde_0vM%_C_N+y8ute zP6%LiPy&`+o@m$EpeR~K&^jqRnNF6d*Z&yGq@*DqUpI$^5x2mc*Fwc(P}2Ybp1T$Z zi%kcp{j=wQz0cUJ2M|m(eFYQb6mhd(2tKh9Me`8eojOhfVC?cz?()MBnN<<$svH2Z zrT{>*9~9ZQ!)v;+nZg zAEi^TcKl=xjY`rue5bG{f)lU>$gqA?atTI%@>PmTp(IX6Eow!K&<=`*JHVXJLOZ+G z6VB+LojEaF%yq+s;F3g;9B1$=``&l7eRY*JuU@opzye3xT46UwGF(q)07wQ9+pmz_ z9p@pBd;hgnC4-40l$gghK-qViZk~DN`nPoCEadbqcajA3v?4r3g_P{RmT+w#e|eq_ zxFBIt0Gj!BE%nh+LM)hsF|VZidNY|Bu-{i?tLd^Y=c=WaaJtrxOMcb?V5E+cs$!Jpcefvo*h7>NNl0c)Z_T~GXh zb04sPGXbITX#jl&<79d>Su%OSStJre;g?j9z=NGaW~)&SVN^il{ml&4V<`@74e*Ut zu`<7u_La-S-K<{*KT8MnSU_*|H6?N5ceft?x6jUMX=e%ymSy4{Vl02#cD8 zo&dWFh`psD8){fW#KiDLw85a#<5gag;0lxTyzw4R=9gNkMN=MSqan!`vS?~Qb?hse z>hqd5lMfAgp6GD(cPG*;&@~jUqh@$Ubd8-A=U?4nl+sdwznx+JF$6;=X>hxqKVtcO zEx{UYdyLHM@8@DS7x4TDYZVcs0pcr&)hl}dhA-=wZxn^QuTCK%`?ZdJN8|}m2AzI) zI-Q-|^Eq0V@;oSq`pF_+57<$o1o&eaG%ID)2qe&Cc4U@hQ~;eYdbg-fE-2@xmlm{# zlI8mxr@t;x^x_35+9OxpozN9u>fR?QwSz&oQR{pCvDh^r1Fb(k96n}D$M&10*^&(X z+#czOibLnwdr$w8S{vI(^LtH4DH;K5cNq*wXcsNShfYJHdjQk|-F)(4k}?CJ2UB*j za&_*!dLC{7RFNP@(VmcvfLN$(mnp!*LXQB(i{?SYrA|H;)@kvoOC$hBlsfm!gEd^v z(VI;F@x`TdU+R(!r|OYrZg^)tQ~3uP`dkY|rjJGl011TyY0JGp1)CPY4Al;&l>=1= zO`Le8wQ?nJIG$r;O#2c*ONbr?^Jt?_)&ku6vMeu!36Sd@*`$_LAd#il%G?E}0{!pf zuaW_fc%*Z}Zh!*~=_R_>?yRr96Zz5M!TJdR83AL1_9S`sfdVjzmzRH^pP6aLJjduo zF&9lq2K;S3M-VRmb+#yXqtlH|)@We-51hy*a*xkk0DSFG)8ZNxKU~JV7bE#9xK69i zFqGEhzwhuA{rer(DyEpdG>p(`i=H; z%rgL?7xC(!l3Z?#%UFN(ul+t>0jQkrzvi4^{T|_Yr(ajz5djYk+q08u8tvM0T4f+* zRAR#w;DDQ@br~YMMqCQm>1N5uMYwn9pIxTQ@^8_;EHLOxAj_1B4(k+Wi}DSpl7gLT z%!mXN(KrF#=)V9AI*#{j_G`o985WC;A=Jl5sEdr$K19&pUu?)z5HMrbcm$@@pTJ1h zhf3gBxaBC62+W8~WRflY^G0$wFT)n7z z<%MZHnXr$7D+5d<43ao2?P=bh}>_g>FkJ6;Wb^-2_ApG#6M8P4WN~6k0_Qu^hGy;QFg(R;SX6 zmzx9S+Ct{ay7I)Y&c_{iFrY|ov|jzn_RU|q&C`1^lPKwIBsLIAI9&!A*yB=6`SRSc zcRe@$z1h@zo^LgPrzuOF_qW~Q{AC6}Cx*^hcJ*Wh#;*aalBgYIRj}OM+SgC&(HqJ; zlP+hHagrd@mr^eb9)MD?@YtqMXCN{4z0S5FE_M_n@W?>ORaZ)=wAvgnXyF9h_f?9D zTC~SbVsCHTW~mxQJ~bpeok-Sf%$PEW7iv^wn8iX*o&-5I@VytWedX2rLtS&%GISg! zEj2mLWdv#Q8ZLm9AS)zvA&0TR4A^@C$8}r`^aHeALW#ROz=;N`CaI<&y!Fc>W!)Cgk z(<$CFPFx&y{c=OP1rE_X7dc^&Ym>+-M5lu8&skd--iy}j!U2x1Z`fE}%thAZO=OVt%C<{bQn7m-;2{K(t{kzupV?Cb5Ld)~~%CbFrsky)m~k)dFZv zF%qlcv^FBNQfT!yB3E1K!8Wu89<;^+IUQg2rgXi07b6+(KA}XkKod?2)c&mKuEd_H zzW@Rcg7wFDJ{uG^f9fPu0snN?;MSQRF8C&EbG`Q~i4V;xs#Z-d4P&Vcuti_0xpa-k zv_IJK48(pE_rqiS&Jrr~5LaQ+8$u>5W4m)dkn(e{|BojI_f+q@#nxXhxw;3N?id6f z&eGLaBN`P36*0Eg z!~Jc%WD+mKEH(foqY^Gsz^-SYx_YV*K#-#Jfx4a?F8<{%XBqkuNJubrDH1R*N=070 zaW3nQ(wAscT!wLLVcG34>t;DA9=n0~srl_sZqB$2lPR)unmUs|K9qBRdGmGTCq1yo ztt=~bINzZJ3hEzRXb6Bcw{*P_$fTGGcLhceLoztZ9=aKNPB=lCe8s5n$Z60m59l6B zJG^KMjyPaW8mvvfLEy}(#M!wOnSl2xCBYIGB71!bCAh8td_8CgD4F>ECm}LyMwPK3 zPR8_dd*1!#u+KHn^|dHXtVWKg5Bp#=8)Xt8!->|J#*T*hYGmn9xb9D1yCMm{AcJlu zl7*@&QoeE#IZTDB;LBLD^_?bquGMc^l5#8;YEB5qvF{IbvEefJ+u0{5{!5 zsvN@Rx_KP4#nprqQTC7jZE~Opa5vU@R-Y!2nJ0CHT&^BTf*cy==oL4?j{VB_A_3dw z#-n>0{fD7(s}w6ZF%r~r(vuu~dm8s7X@HY|c!fq22aabGXQI{yqk^}V7b_PlH<82C zRwYA9D5DpAcBL0AzJpDe+vJ;>i>Y5;-}$l_NL8XCU^k0t7|3fx4b^zTK(atm&p+_< zB%?=Rf%lprS%WeS=ntY(L{_UKdH=;NH1{x2JD;t?|4%yIH-%|MNILM!Eqap}B7x(+ zRU(YxKc>L3b0UJ5p33XNjWc_W6)f<^nQbp$BD!dgfQT>WSL=%M@Nter^eDqYVby|E z=e6%moZ8F?r8I@jvr4N9IT4@{LdSX)jYEw4T6~Aq^myl;=~RX3PveYwRweKyrlW z5~^Bg8S4U3i=W3Rz4V)_syUZi*FMANuvZoi_2(O!2HG|E0#(xfxQqcD7O7uw><=4$ zic-s!4CD$Y^D>ckpTp=lZ`h5dnxmrTf)RYCW-4}L z(rFuCbK4Uzu5%cTHLrPq_?he1)3LJuN>E~jhA9`Qwd}OB^gh1@k%C-L{zObv`TTHO zXC%J^nx3L5-!8bce3)Q_=X`hS$0Tj2MwY;_4Rp-nFtFFNb+E`l&OhT{O$aLd8s>Kq zPds|Q+~qT27rtetourrh>tdgzZAT;nyZ|^s`aUHt5jDh`9R~6u)x|rm6Q1os2Kl@H_Mh4Q}72A*T2P&FVW;7 z>HPk|Bg^3kn+Qzlvy{q4p>9mOB%N9{8Wu zk$OYMq-%oD<3PNbsBnGEo9m>wE5m(#%{3qw9>-AzO{7Yqb~)I_Ctj_u^kGUr`Q-GE zj6i^3>l@bEF7yNOosCC;t_AF!uuJdBNy_pj7Nq{wK;qB4gz7Okh5mK_mU7Q{-*rYZ)v$Jb^6_OFn zT*fjYO~KRvRkZKCh9*gct8*QfpXmdNTz?&-(+cZxDJNJK_WNf$r_$Iz8_hbhl8&Ip zI!ThXr`XDW?ntm0>1wep%+XmxXT;- zeOaGAUx(zrcd-p)r=(=!Tr6AiFP$#5+>fJr@n0n4(V>vrb>gA(F%ER&{K_eLoCfGj z$Ha^2U$~OT=fT7R{ZDRtI%haIe2NgIO(_o6A8V`eW{|c@YO^nd$(J9CrZ2MfVY7Tp z47UX(=}fw>&+qjsb=w8s{HsH`V!#!>l3%^zn&fY~39asfyIvvF(J_Ezh>It-tZQqeGCFu=~B) zMPjno6@>-b2@Q81pQ1+-%@cHos}v_WnY)XF4qDgXf>kf?~gC^j0}>A)W}0)LMb;Hs0lg{`F5~+sv_g`f@hr#l2IB}d<6nWY+ZI7l z`yDhd9^sVkt6@)-I32Cq?=0lsc4R*PcPJhBG?Ub{kfKWf+|qC$CU1|`+~U&ohSc(( zDH?=wCFKqqI0*rw+?eWucwinYC!2365ks!+pB-IQWLuqeO7z1sMqxF&a5$V9*#mnI zS;^^gW2Ll$!Y1R@g1xuQ(I`!F>&uhJ>3HR3#tFrskKsKKX=Y~Q<0X3zam^AcJ{=ct z);|~1O2*ACer@)!ti4>Jfv;4-K|F8=yVyypms z^m{|2e}j5tz}@xfY?odR`|UIH1tMcDe%LO^FWo(b>_?;VDpmS1_+sWkC=52T>bm3u zAL1&AtYP%~QZNqoi=o@EgX+PB^Z2*~N7nt0Dwu~T6oWr@oImEBNkb=Rk&;R4faG!DTp2^a4?noplBX**xEfkjCxP z{c;pZtJ(P-^OZ_(>M-Xe^Sm6uBECS+1E7ZMo-_;cG|WKHKRY+58yJ3*?z!>gI|4|o z#hR9$q>1%&zf)Gz*;$!5U_iv48i_tNu{sxZUmO?gf@=xq;{x-~xJ;=sA($vhFO5Q) zmzg2~qoToJoH^FWjE!laH?;d{f74$kDHYAs5XmAqUEisa`U!Cr){i(B@->~#4473P z7?wNw9Utnivl8sD*I@C?#m;;o4q?dP?-$x>vN?~y2I`e+BaIASfEYxh`bX+GfSnH1 zIBa0RaBBWt_$EfJW>`pAeay3zGYpyJNUAqW_q~^QIVY&m48=AAQDu#cbP#I(@rU?9 z>3T2KHJ}4euGn`q*&SnQY$Eh8_K1PV!MS0X?{won$>7tg6olMepAeFq@$CpNa9M4{ z@UGFSmu4J`sHCeGvF7E(navm`AWgsWtk})4jvY}!hy0*)c^^2*i!cTO!lzMYO^nr*B;9cUa$9-%O;hmC^V9P9gFOqXgv{{D#WC3Lr`SQ zJd%L%HpJ(GY~hv*R?JU(WA{nS<5a!OA#i*YlFmF@gfKJS={?en75548WzP;0TXT0(bMLl6fSrryU>%U=n(dX}csl^fwir`)*y`{$FEqVZWl zx}7-tlCI)RYgW@nN;}K@XcJ_6P6$RAot@Q|s~K{M+#?5Jwj)`xguCfLs!@g0T~C)H zz;iOquC|sF7m#8eDnhuSwO1@2O`ndntaGYC{!;y1HkMbkmVbU63DxuANyY-`-hD_f zr8&TS=Mi@RQ0)ZJM_{JK4d300G#aD;*;y!_=&fDT-JSoLQ)>3}{y+zhM%X<7=<4~o z7#IcgmrEgGkeG42e72D#q&Kv+=IppMdvd+0JB8-+{O-&(xzhLNdS2wn_Jf?Ql1EpL z!eXx*2NFPVzSjvYZX)@+XvoPc~DVH+ne6!ejGyH{eAu4oHOS zGm7~Q&}RLw2j7PZ3~dW3vAm$`pM1QXVTF{~Z+Aqm)mb!sB>0}Ao#dow92Gy;4SH-C zT1C88IVGp}6UJjqM%8Qe63Dncou_1ZsqBKEb54A|PZQ6Xymyija1SXM?u%s;uiawX zXE9!RXMa%h-BvG?1VB<^vIndYIl0^&i>EJ(p`&pO0BTfRy|t}=cB8=kS=sXa(IX!N zz?H2VPI2QuA9F1%bh$rQwO{^)7eLKwQGe|1^mzX^e^D=(pXo`f8}3Ws8l4HfplHx- za_O<%o3E=1m@KtgAD~PG0x{)fTHJyuZ1!&gD%egg4(4G4#*Z$}w>?kNDR0fGkt3h} z;e+r;zy_2Ls#erp6Jmmch6RP$E#6t^4AfED=asL&nQ@DA(Z27IX1GWxQ_5& zUtwJX!yC;LC=YB^-%MP+Z^W-!(}QzeIi`N~(un_d&#JJ^Q0x?NHK;#6C)}CMl*WT` znD4OKZ^Rmgt@=@~ylJZn$OpMd1kmruPM1@I2fBOIyfH4ri@lv8CqpDa24F*?(qUKX zu{#8|WMbeiG2=zngZ!GG{`F8}S%?#{N?PTiZ%VZLbmo(qxz_BR5+GDLu2M0g;6 zR94-=HX^!CEP3 zG)oBvab@``=c~wCyc+BU5V;UP3~(;*I4Lz4Eizv@YBR}MB`C+$E8xZ;LLDr}cdqQH zxZdL>Y4k)z7J95NH~r~*oTK)~QFPs#f@|OJ< z9S@~?v*Q7J@=yfc2$**n!O4<>N(pnE$#^wXAcAFV+8%GdGcRH-7sG00`-i2-ze(aM&}zzzzx}dc;w)t>Dc_J z-LI;WoYt}r1fQvxKYm;Fbdu3I-<^!+Z@BIDl?6utSq5=^pj|KdG!aYFL*^zTv$x?* zz;b_5OP9I#W>^hz3qLM0c3n8PcSlQIg{mMd!cz0-M!@@ExVV?@RmBjBZw%8NW^0 zdcOn+tC=xPq?^ewgiY#N8Lha{Jk63<$yvgrsn6Rd)W zo(i@KyQ8PS@G=L;Z1nf0{;>BX0kF^sSN0vOV~+Gj$+P2wLFwIzLP)an#Rq=ora4$r zQfDxT`79X#n7<9&YWUStC)Q6e0n(^2fs_u5E2!)eD-1?lqH!!*QnTM*xX6oIboi~00NFZ(g!!Li-=<@&JWn>v>$8uN{0Y*N=D)gB_d&SM#+f%-BS0b{-fV)oY0iX|2_STi_+WGFV z)aaPJ3_8UBWZXIyXTKUT6aaA5{rP(G{R?WLRQYLsP}MwZT6+bYdl+-wTqmhhOg&+) znWxXI3YRXqqVD%V>SNv4O(p4RQ*Kds}Vs*n)p=_cQ6}%PFE}X z<72!=V*`nURLf^WT7)xFD)F#ZZu4F}1$<}yNYBt;*9u+GIJ6_uTXw<5gkwit%yT-xv6=#QU46vaN^Ge{9HCFMN!h)>#X>6 z;AKbDVb!MirfZe+`0`=Jxw6fej5Pz-=C@e zC~d2dV{yh$3|Tw_j57=v5AnCdomtRo#%Byz0j+ac1p<^P*=mnF<7N1F#B_@D=`@E$ zd&QH@7#AQD)FWGdu;SkbO@|K>$;#o*p%25^V9@F*AmZb*%cUm=1r^nv28Bui-k*x@U8`+=>hZ@zf+VhT3x@<`TIiNc=JEyz(oi?S{4^j zl}LhBp9y&DM1uDx_5crQ3IU>QlCpm%C`edA-P9>Ptp#PYkiDfrpAV1rTb6R2V z{pp})uu$Sr`stu)=4xf#v9~w-NW8@u(3X?qx!`GZ$q6d4uyM)H0Wv9iED=FB?N7!4 z^K6y;LZfCc$59{+#7K<`bh8Tt;TW#^xyWcbIG;TyH*p^Bm;vj2s5f%eUwxR$9fco` zRMo=I?a-s=&r4B%lwV(*!HjE4lhMw; z^v&hg2??|v*m@vd8BLz7#KG$%uC@~R#*5X=OJW3qb5_K0Tf38Z^qd$iu0N5A$4F3d z{%of8!@@0yE9||~)sH$V9ma-G{@3bv0J_!Sev#=6tc5P%gSYC-mDJo2T=Q!QIwgvG z-}8Z=_Jvz);qVx4P7h{(SPBOlZNYAxhVCfA@Z3r6wnB@%ZV*~jaP}xF7FC=8;x$8t zvD1(eJDJ6Tm*}(P$oMg-HfV5hQ|LhW>nxTqGK%XHQ1F# zAsNSQyuCB$GS0o5)oikF99sbZEb9esAU|0u+G+gp=BrgyG}sHO_>%`3o(`>GG473Kl{nt8o?i7GiKDa?O0lynu@e*MmPjBdkx zeSJB+L@fCNWr(wL2_CeIbyF@SF=E7LlNNG*W5s{u=X z(8(#hX%s+y&+pBE@M^o`t=t4&`?rDgMN={|1%X=4?0$Z?acl9``?qu-)i;+ zsw_>GpDN<&Wrovyzfc&K5H@g5pi^wt_^#*Y$FziFxP5Y+wh>R>0N!!~xm7(Edb zf}eBcFqW$=J~?_QeZ%=hg*bh8H74yoyhU%kUgNXu$SbOeICYRKptzZ#x)Ua&Q8B7k zxYnUUJt5md$rFW^OTT*XtnjJmM`FD`5I)5YnA|WyqzP@)Cneo%3=;5eFI`2Gb}teN zg(+Tg)I{qZP%@wGrE(mi8OVuJxfFbi{%oZ&Sp=q@oJbWyZME2_`97$TsD4Q$5RSIH z*Dt?8CaDAdI^jTAQlvr?C>jIo@Xf)F}7{hnUWWHpX^2P-BnW07r? z)BphaW)#Pz#pkKt?&KG-Jfc#ubMu)_f?SSL<1z$TbrGE0s<(%kZpN5_Wh7!QgG%g< zdTVUVQ#R|pQro8Lx&7Nr*qfmr!j9XS(KgemHCoogzYGSl%i0VJZj@eqeoVMr0O{Mv zo6i|-u{Df&xpv|kZedPl8u*E${z5vXG}r$i7pe0O-nK9puj{g8z zSl1AhJef`i@P@RV$a5GS2|V9D;7gjM^lb=pd4Fc(L_xQ$XdKNHEUkLJ=|;^OAap}0 z?H+K+JXRb~E7(@cE6q2^dl|rZ4#jXoatUbBY0#~_=-TWw9?MIS4q+=GKAKF`PD$0d zDy;{?YaE(l4bN@k0GIMi=>?z>#=?>$#+qB$tfrT*>w zL-7Qw_5fhf@m50@f1Y(%;w0OEjP9fqU2R?ezUT#ICofAGf^&Zbv5oN!7oq7x3dED) zZh9M~n!Ht-!o-q&61kJ(m}aINM7B^PjiE>+lt(m1m&@sqadDx z5CE+?5VfN2LCp!Sn~HR`R#f04+x3t`P1NDIf@xUi5XSqVYA{k_}W*1(BLa-$i~B?_=x{;@vA}CoXnTp4PWY{_xud_)jcjF z89kK@o;7%*1P0I@A>xp2TWuEnyY(;hp1cgpB@rIEH{ThNtv;G($c4Ru5ymXo%(EyW zi=}_%+5`NY9HXUjf|UrX=D^1K5pP?>h_`qYg4=*kfCj_ftl(YjYmdqM5KR$}j`ERh z6vL<(-Q?3Hgu&+QqteH>xtN&qu8;Rox)y0BMfE)2xPDWX(T|n)mp&IF*6p_rn%2A* z?~4F03h_skG^30Eauz zukBcT#zb}@<6!8;!!1apYThCKT-XMajp(;HNtB*iYll|<3ASE9v*I#52JaX1?zakE zcK*nVDx12mhpXN*>Nmo<&+8=7gU!af9`9m^o5b4BLQ+~!;{mfd#x(<)8GkkS!q=Ug-=^~&{ybc{E( zV^%)%;A${$#%1+GEiY=rB0WCOaO0)m zNk~gRo)lmdH6E9{ZE?+_VQ-E?h3DhcVWr*?^NVOC8fE^O+T= zg+HkPdUFIKXd$Zk13DI6u~TT!gm3zH66anj5SX45UI~wQj*6au(O?Z|N}@6@SBhmA z^IU%!Wsx!*@5c2qO1Vp6t?iAU?I-phEo;ur?#OC7J8eo;wjyO2Zn2Yr)aUg#Yhw0C zT`j0OycOSUmLruC-}SqX8<&tDNgV-z)jnPnVpiUU6A@!plNVVea>BPmat@=cU6Mya zOhg4G*2~xu$HCt%7wY$NOE;?sH}}_blep zbLO>;&ni)^A+gQz(wrZaHi3*J2_SESA&J_=g%eXzH9;oPAmKv%hTske_HuRnCTfrr z)bbp^q;x3ThHcMN7BaOcXv5%mzh`3{as1k|aDaA2wo>~$YFhr&PIb#Q>q@S)k zB5oO^UHv6>nDiy9nrld)e7Vtw7C(42=YW$f*pk#^3e(UR9R2H1h+;`W9uQ%v872^{;`xxlDU=Y26+CV<}S#p3nCwD zh9{#_^p09u!-tMhar|9`EhEzc%CT6>E>3rETa{m3`kqLy?jGFCc*(35bCv&uojcFq z+N(L7IN~`uX?=URJBkF{`wO1As@nbHmBCHVnI0JsE< zVHli^G0b5E?tD2g-ssiF=f{D+EpTAn-;gSFk7PpTJj{^YVa>}n7R|BL5?s|bb|~i^ z{Pz1L#wJ#AX4mjw&El#Nj1SGn<|Ztd@X7$v{Xxoa@kkyHMH&03MjZ})o1{86B$$x1 z#X^7X+1rE+%Yopf!2Rnd&oQLSe)ubjrHd9%;VCI-vwM@ZTi6~UDC14N6G8MTr)&b) zfpq}+L8tPRY+zT6fCKEpL~ofC?R50hiLV$IA+_rC7(~SsK03sIhf+>v6Ljj1WMAJe zxkwV%cV$QLKvBP3%IK8P`N5VT82RHG^-z=1Pq1DXC1>Dd_&j*C49DIaPZ}HfDy~8p4%2^^Az0a4Z|%CzWjMbx_A*F zbR=e*Eol)TPxYLC?VKGN*SE7;D&)Br8`z=DU)~ioWHy(fXDR%Rp;X@!6tNnm;0g}L zIJb&@<#t33dz}LMkX0!v=}x;Z2$Diu;NQ+n?K`4+C&i0_gTU6+@1DJFk-u}v-2!0A4zOT4pxc&q0!s*ShT_#)o>18Qj z@TkMWm|f9hkaub7W$6R0Y&}sgbb963GM1>yZXrPbqfAY&)3yvbC zSysNeFxI)|k!{1+k!BIk)8oc+KGq=$&(Sq8bQj}e+pr623jPhRMB7K%iOoZ!Z>x{V zBcwb6pXiX7J{t3c2d~ypl$vA6iaF)b_o|{ydp^7R9vtR@eI~oLV!m-7Za0FOffY=t z5N*^aHVm4iMpR9UW#AW2<_(yyLqM22T49f*bAqT!`WQ( zIKNpH^AI7|frw80Elcs4XV7Rep6k8eW_3KWbV<{nlh3Z&4|D%8Vaoj^gDY1O+h5Up z&qN~K?Bv)5uks1b582pB6;`Zt>qfcPD!?TsIsNM`!ouHd)tPW)oP)iB_Bt+k zm@83uE7y>Ao=E<5Cv{p52qGnA{u{LQ|9oVGZv;OGDl`uhQae&To)wVIs%h0uE8>LP zW%Z4WzJ|yuQCeV@u>}1ns!vu zVV1~b9-EHT6R9%YNobh-9t}leY-Fte?2W}FEk>g{O8rXxzuUD}r2K#SL+Y^L z)Tn`4`nL&e9p^#c=c0)CmW}KCtVAw9EK z=`U(7`qT{C`=fZ&AG()t^|L&P=3U>anu}A7j|KCw1JDSwab>2U_zW)SxITBN84nPx|Q|9Zy|ve-4Q&UNA4sGcFtc_8HFr zgtaw_AN7@cJRF7<%xF%fcY5Ek2`udH&q|$TLni@P_!{az{Zvn#LGu{TBi=L`^{EyF zkMgOPJ`;(w9oe|>`RIW|@$GFkiPZ9&oJN?KYb z&aRXMeVejhC;zn?nZ7w12QJNO*&H<`dhE-_k2*?zr)Zo1-cA5d$_zKX>={O93AAAi zm>DX!+yB!0KTTMUNN}3A8?zsGuuT5zh;nNt@eq_(ya@4rHU7WmD&Py7lf0jfmE)qF zqyBq;{{Q~2SDktB&4^<4#$2!~*;Rb`*@>aJmca=GxyhV%RKJ(9 z#s)s;^?yISjv}N`%Fi{B>4UMsd&?}b+X~RAFlX8SJ|-7JR-t3e!gcWQp<&GIUw$gk zat04Kot4qvwBGb}RP5_zdjeAI6 zMmu%aR{>{gcyT8x!ihrJz2)%Aek-}>UxGu0qwSjczz=s&IsC=dyJycZ?M6>sQVHbd9koKf!LEuH*v_iardTQoXwH?M$(b6ULi}!VGzOAj{HxXAZZsx$hnl1 zM&t+UBdR@uD3?86)e*I@RfTD7MCBAAdru9yJw|;ujQ^%g9WC7S?FWu1iceFNC^4?k zX4mL1pqPIe-6lvw%%iZeEO?UFVwLO(JK!hW%>OjKO)UBt`jbbUJKvnY*80ddIa}4O zC-Z!I!XZOd?DxxmM{N_1``%~8O89Y!>^r!cQz;>vI}wFt&;!oySQTQ|U;w{NR0@n* z^kgGEl5i4s(@*$Q;`4HTH4O>=aVi}RamNX62ydPZ!)%Gli_IQt#PLVHnwvRNQ!OEu z8rFu8hY;iQPBhI-B^{LiI}ZZ{gX9%s?oM|Ig{&rvB2e@3^0Pw3o1~(|(fd>-=x~^d zeC_oa!|S;;%yM7(3F`FoIPODZ%grjsX#NC8^y*$Qzi7kt3mEjCoto@j10Md5j{m# z!xF`r@m~Yypctt*4XqkgiN_eTt}GMXq{!8${W!E;$jpi8$w0wkW&$1gxPOFq*12OsIKHJTvX>k6-N5q&+4)KhEcqy5A-Jo?T70rX_=N9 z3jSSGY(;AonGwtMR6Q{2MOyLkTgl*~;|}w6*Rm{D!&=+dt6y?ea;oVB?f2S@2qTj$f(wS%6OHrg%efD% zX?4>gcsW)mxXM~Ap;OP<^jpVJPdfW7p=R#nrA#w4_MdyMjOXd>b48JJf66n){`pc= zZhxSoo*EVDQOh9OoqY}q?}W!c&1W#JXsn53*Zn>Mjc*m!Ad%IZe)&@Nzu|UOMH)g8 z5mC*I+&ma7pz8g2(m<4lb=UIwBARgEJAE=Q@D;jM8jZT_N+OXjctuQb7F92p6ji)~ z2`M`Ku*2UpJ&-DvcsZ3Dc{BACU`>}OR=Bs;YAH(uDZWIF3MZ46P(l=oHp@t1qAb*< z$W{g5F>)5PhiH$A24{70c@q{C!ZdpGC#*Lf&}yb>>+Fjm-h+3ph`4ljle>;V94~ti9U9f3uQ_^i;mq@-u`;s0ew8jkmf=hSGX8l|G2() z!;xq6uDD*nBql-S(TFQ|L1AZTL^Z2Oiy@kgS2l>Vr1I7EHX&D`4i>F~8T0kl>{saJ zkju#sYP3Y#j!*YcvRIF=4+(9ie{=-6@m7jE@J5gzFU z#^*M~IU*HJa=8wEY3_wT8h?xX zL$Pqid0aFCNqw=SJey*mtzPWH26jD;8Y_gl^~|R_=-JzkNkb(f3D?#f0y7l?YfHbK z(}n-3?B)D6W1(1~MQQAC6*?k68daplr1sV1GmrcRv*tTKS3)v0|LCgB0_9yLt)Rax zJ5MhYe9ztY?qg;zNHe7Iug6XVb1D`A=!vIu#y;(4_Z*NEJm3O`38M{``?`!2Y@amW zI_sBw*Qr)rCO=vF!w6Z1I#U3!(equ%`AvoGL)TeP>EQS}WJxu7=KRgLNw@p0vUEl+ zWbMlEAY@~3o>JSpfx*+;_3Lr6^Q{2aT~Qp%_YIMnKV5B#XBSZ;D@|4L6c*;6{a!>B zQ8^ueATPQm7==C~MK=AuDRN4ONpeh>(q&%KkqO8?XnQxF)jJi!6uioUIpy@XwIY?G z(^v!Iuj2PcYwMfwHs{&V8Wa|@3!I0sTOsJG670Vwhko{f(Y#fvk zgWVUM!kofSt(cYDrz(IG5oi3ffd(`;(-A>^r;g63{HjSCZF}lN-|*-4!9-~}-hvOY z8B)KT*Xjnlq_8SZUI*n^{_f^S+mj_L!ei9@#xkJ6nk-FQrz)u_x8gJq_KVzJB#SAg zKNFiaz(V$UODMZ>&!33DI5GcwN;p!%aeb1M?7Ows7oPF98{O;+LHaq46J>9rya3jz z-J-=mxecCx!!neKES;PPKfx%Ermy`OWh&sL^J1O(i!lx69ZFUKc9Dq%s%4@oPRR50 z3kSrz;-<{YXD@;7%;%kkp ziL4}NUoAXi?`KNqeftwXQK(#G+gghApXx1on5l~NI?MX!H`DLv&+EVCmO}f#_Mb5( zfBv1(>)rb3FOfO2zUMHpaxH0pn)?2pNl`XB2ZdgxNM3x&=3)YTmtPRESw~` z$Bg65qTsGiD5C?8OhYS1-|5cKH_-?>GZDUP`|hZLUg+d@tWoqps=IY5tCC5J#u%5t za45hh(i<&BgT~pIl&A7$jZQfwWKGdja@ph8+4&}K?Nqq*YJ`vXT`zpc*VZ`7k;b0b z%2(%QOy|lC2D-WbuaawzXF`4Bh?7(ly1I?xm|MrCxs5ht(I=a0E}2}*EkF0U&Gisv zWKnZjstuD%cL*W|_36czfq`jJ)C*{xq|nO?oquqUV~Rv!4zGa3y;JnAT-sA^s668pyd@)sqtq5=~j*PEj^zSI*d8I zMei9v!{oGM`|S1?GWmr1oB?KP++F{pX|YLz%(Lo;I5-aAX}SE`%<7>}j)gE%%vQhO z{i+CbZNKzbge?Fntpq)C(cR&G#J#im7Q;0IdGp5u@@ksO5=_IRqNt;e#;D$*@WRyz ze2K0^>v(ry+D}#px^;1WYjVn9jftpN?K3Rh(nxJtruw#8H@Un#cKKH zFrfnuGZ^D-wmH9?zBf2hr^={}Q5)M>#~S?j^7y7nv}p}XO=Y_pBYWX=LTvoZ1T(*+ zmWqE|>(w&1q*vJjJgBGBxzW77f_$3WJm}ffe0jnMeD!aYyTPHaOJ$s zU=GA}U~)ocE4-E>OU~C`0gX17*hUrLWv%kj5PP&j@Aoy&`P$c^=&Kq5=Ts6LR*Dg= zhiAZlQR*Q%Zd;iN)B%_|(>!ya80HhasIxFCIZis}T^)w&zM4`WVk4XBYhA_gP@SU~ zmDjVJM`%M*8~0n!7C$0f);!+@qj{*dTOSTyi9_W@&cP*5->a*nNMFcS&&e|8;1MvV z8DMA=&v9W?o8Z}T#`;inM%PK(v4Y2JZ0NHttqPGAHbt~==vyIleYE4VF=OD@K*L%|g9JL}KE zguCQwsZ-JUX`|>h@l5PYFCs45-_tHVgzkR| ziFCjrXBmZYj#2m5^IDYu>_u|j{Il)Fl(Ob>jY=c^Ra{qZxKsc-1uda(Zl~txisf!r z_{PA11#sELNb$5`vI>)HcoL%KDoGzbND>ed-OLd_{X|)r`Ms#A zuG47nQu+MLY0K);H!=jb{E#vGwv@Ur;kNKm@3?3r zwp!hIQ3ssQEHrB5&`9tb1m042=Nfyu-@*chAFs@)6#$n@YTI(lbn9js*^@crnVO->j&vK_>^&8k$gXW=s>S-){kQI znxmuW-Q9~ruKefw48CLc0^WktV?OA9F^Tfg zCidTFPjuYzU~&3z95@$KlIJI?3Zb_?0GY~sk&oALVXlf9Djbs9p(!BLqk`aqfxsjf zi4bEcE+_A#^!ZcgY6Ne3u|8(T3$D^U#w^>$YXEeyx3DgH%=w_m-bM{_xa-RD_)u`= z`9};}&lph1Cz+CvZyvJ2U4IlIQ^oFhhVL|opzvw4Qa@=+1WK z83dPVGSn7!IZH;Q7f9qK+7uOPCjIOZq0dcIjhD?y#Tb)4fXk(2&@A`>Jm9N;n#8Y= zMFEIR0TVU#elNE@H%BUp1fbTV6(rGJF$9Ixjsh-`EbavFdgCYRmXI(o@@bjUKjs!m z0HUO3)8IR zy@G5JF76K2nF{g)d59Hj?u99;mj(eH_s5CasqD*7H!u?y`XxZvxjqmG6xI0j=~K;B gNr8U|m><|Ym>RkfB&Vb;EWlq@7i}zR%&w>WA0TiAr~m)} literal 0 HcmV?d00001 diff --git a/static/img/refarch/slack_oauth_tokens.png b/static/img/refarch/slack_oauth_tokens.png new file mode 100644 index 0000000000000000000000000000000000000000..cd0f300aee5e4699238048b8c95df7b432a0117f GIT binary patch literal 42632 zcmeF3glGGf%Q7vuBND&&*zX)^8OXN@c9Y=TqBZvHUR)9P5@y0GXNkE z4*(F_CD$nd5ho%|G^9-B05kmqzL44r-GmeCalK>t|M#KPWNTmN0 z*F$3bcm5y?z|()`F-067Ump?gN11;dk<*a=U1Hjkf8~Cnk%s)QIH2ZH%zlRZ3*vxo z_fgXU0Kk0t_(lRGCKDlg54ZTF;iw@eD_~@6&2C_9YiPm_v9^1Z0stWbh^V!RqX8Af z+RDa303t;5R}KM0{4tq>hU%{@j$edmG~^Vi#B9MPR6OjQ?3^^h7*teLK(Mi?fbs{4 ze~Kf%3DKB4I@$?vaJaa*u)Dlvw*{MVyy55P=iubx;NoIKF+r%eOqdK#u?Gss9!gv$e7XtJoPBnLM`oFOk0` z{dexaD$@LSMci-r|6b4E&iqpn$niK3{x&fFG3x$GMGQM(3?Rq<3}Io6oYu{506+vF z^+EI#1Zg(~1*YD9+>FMAE-E7MR7pe;S6t-H(e(Vhf>P={`R~D;Mzhbtn3#gkkYAx7 zzs`KIrT7DtNxbzW_24$XZGp1My_Qi2e&@2kaX-+pySr=EKd?Wo!m1ScOzFvg22$B4 zN!FawKNO=y{v-HEQ889 zYw1t_BlzLZ{%1|isIelSN_a{{XlogL{~msSZs)hmh)gkwU74hO53v+yt_;<}YsNT^B`pob>%s%9c%#^V?Wt8FZ@5wW3?Q zSdY>dI366gId0QWwcGH#I);~-57TJ>iDp)nW>zbRXE#?X)S{D#V~@eWXD-0mqG@OQ z?Tybw8_;E?yO)dmnnoHiKbjvRpWaunwc2qe@;hY9Ci4y7d*5G~sno?k+a4>T4I|}^ zwH(ja)QG3A$M$%Sv{61N97XAUJ4|0(=d{xUb>B}2Yizmwh2QFWxY6~4HcKvvCw9_1 z^|m;9aoNMc{kAUt@K`>PTM8AMj8QfcduVB~g~75lgpkALrCGUYzwt(j3s1BYe9JYA zgkM^#+QQmG&*Mm(|L$~j6n*;SS|8%(`lI*T3tHpL!(~6PW}}X)MTs186e-4f-P(GY z9q?760_g73dViAH8T_oZ+;MB9Y+OxSs?u^iQ$9sNxy)EfX5S)ZA`qf1JkxS{v~i)W5n(rYU}inSXHolju+U(# z+#2BLe$a3c>vpzXs2az9@p$0^vB@phzDyJ_?afvb+ER{Y%SCZC-HvRB2snC0vSHG1 zmq~RTIeZG`hp>5kxS@C6ZV2(n6ic1{!xHQNqKA9N~C3A#Zxw31NP;JfC zI*eGxshMN&KU^$)Iau4ufy%EBrrKHnt$9W%?(Z%Zi^U}w1jQyr-wIAso-3pZ3te6B z6sz2KwViBD7VG!)is1-FufvZlM1;d*Sk$%p&?r43N4gc{Yg;M3HkYH1>y90-&JGqq z{W1(o+;ylmYz;LkCsFQ?)Jt?eX$_?*+D<}0QwOHV5kjH~q z;z(~KYJoF^?<_AwR?Fs^dg&;C_$9~APH_`-1$uFD!aB1m{BV21&0f$n)G!Hkr{icm zG<-jgoOyOS2zu~Hysz6Sl9>(e)b_i4iI{_jASPcL(9?9~iWn&Kd+>hkM$fcaDw~EJ zna1*7?S|fd%%Jdt?110{kpBU8VsgCJy~X@STrp_$wQLM|sKDBiSms^hUjJUc$|28F zz7&1$yK&Yhg<6$(YArsU%je_lHq~lNditN;U;I|DhFYn3ljdqRWOG{$Db7^b&|1${ z#8g?&_MFRARUc}-v()6fgjX{T8Z}U@)qV&D^*7h*0gG|KQ)+siXR5U;JuIwOAolAZ z*ii>5cu?q~D_n4wQ2}`M6?nawk^a)a(w>o#lJylpp`a*BIvOtp0zYiSjvJL1lnV## zLxuxBNUz-A9K?~k%qh+8;9`z;gTiKU!y{9-Rr5)uSk19DHhieX-d@!^jg9gzq#ixL ziDdRG>t(P1SR5g&#i8arWq>yQYZ^P2p4Ek&2Hq1ZC*l@TkXMq`F!^4<*&9h(3c6;+VjLO@F)dP z>8A#_Gdz0yXyL;#KZ6bHZ_j&|yf%jM&_Gv5yNrK=_y#gMgW#tnR%ER${@8E^;Uspx z+L0I7uXs|QpC{^%4BM>tCD3vJAN<61>{?Jpjt0V&Yr!TNz2#y-*gOVM#}TPkwVgVu zXmo3rs~&jkADM>T(oTvhT@`+$usomy~qpKHbe5l!uEFx!P!?BHXPJ}29T{CLnZhBD1 zqPe@swo2RcC`%l#5`<}4FloRuKlIQ$*wnRYE1|7eRE4)vbZxD=t$V+7JQmhAicP}( zFw`yT<+_EwS<;4W$=tnC)0+t&B&#IByNVkQ1ODnFMF zbc&f61jtVhJvKJvYG<4#bxjuLuBt*7O0UAdNEz1eRh5@>nx#0!YNA}99WW>eUuDiY zj>_>!aXsUg!*f{p>LAway78dvh^ZVHLByUyvGw|)=8|#*v1kDO%X4rnAVl1Adr=ey zKC6RJA;FhvO^qY{gWJe#K~`?ih|ZfRk8i8E;B!&q0qlb2_%D$Bt(serto zpu%9=>b(BYsC~mNby25@!q4#4qkWtsU=dXvbilstl%jKVwXI}m&vkR6=$7*iEmYw4 zuuTPyQO8JzSO$NvRTspoWK%ad)#iW7H4H`7=dnPS zJm%snw)iRlWLGD;gm$oH@1yA(sbpd1Gs4#vTP%VsFfe-Y2}fGVM_Tn26FDg^j^QlE zQ-=n80bZ5U+efrbRaW2bqlhi%)Gy7Dwo0y5i}iFP=VP^PEVu{xH^?;WjB|C|rnA;3 z*_?;jRu-*GC4>Rs-dOTwcF^35N44^P29J>oB{YUAig4CLUDq>aw`$hrcwAk-8*u|- zDAMtLiOu|+-l}@ebt8qx{N3+G5t~{#0ssBwDqHe6HF9yz)@Y6b^WNS0titJSAd}J4 zZA}c760%9OyadZF5fg5$-!~+A?>jXHHA{Hrhzf zv$3sSaBZ^d!9Fmn&TvJD1Co{L-lC1=$fq#7Ewr;fUwT`rmiLKi(KpJ&b0`3t%g}FG zq^h_Gy%UU518+V02(sM=5`zq2-N?NJJtSy0JNe2I9v?fu8Q(>M9>!7|BGV=a)$SOv ztRkLtY}f{OZ&Ssxkcf{8T5*O4s{~=nskPMURs(O{Nyn7cJlqcde8L zdS=l`u0{c^%B8Le{e`S!DM!Cx$9*X5GW6YLCR`IEbTY9-%=T;I4P-8Jr54~pUMvlq zAZ@m#1g^uy8Y!dlCE=U7a*1GPk|!{Sk6v>%_Qz4|cqMZ~60ky_9pF_|31ZR=thFLJ zS7rZBvNHK|#19ZQ?IS98R90Zqs^HWd4d;svlTFOK&EKK6A;9xT#hR#oLD;ije_&JQ zEU+f7+gz+E$MUJ-_}4c;_=ZAHU_ium&b@i3#sS~y;FE8V8BRVJq?v%ax#o@ADX%og zC_y5(MVZ?4b9>tR+p2BeFF6(DkWAT%K_2Vb%-Vqz!AU!v7CBmsWjkWukV=aDcgJ+e zZKtOha?5gS?_a%3|A2n`5b5K*K!Zdc$(nj7lB<pofcqGbF;;?&FQZr5t_a9r2``XDk>n1vk_DNBlR3&Thy4q>gy5CzvVM zQ7jf}S93#=^P77)nvw&ptM{C{d9bRa?hYYve035ibEL&(!^J`p?6`*|cd_@l`tCk< z^MmDOw3+S_*Kjuz|87Z}vYXdufoSxa`8sErQxCO}jjLnWL*va$J#GLDMm-4g!R@e5 z(;uwNst|tIbqL*%WLRF?uiuwnZS|n=x?KL+*5ebWRLB>YKg%8r{UKA-a6VHxl4sbU zc9RAzu2~7GwCh$_{3+w;*Bce#>PN}Jz#&Iw*X%11Byi|Rfs=Y4L6&mh^NAuSXB7R- zaCrceH;fzb`$0YRi-nJI(EMYGTgMB8j$LqxA={ zdII4so0{c7<4Lu8Ei#)yqt>tJOu|7Gs=v7EDp)*sCRX&uym(A{qBH0BzhHmQ58&(f zo+>d2ZuE>Fu@~NYS@$k+rIrkx=#9sR^o`*OX|b7|qK1L%-^^APFsPvHCnSYCXwV61 zPxCw(7_|ER?Fe^WgBc70d%Irt?1qo)36OmkCnp&!Jrk~KFMo-4eSXK!iuY&nQMqh_Jq_veYwsbybhBH>71(dO+q12r zQDK_yftKKY%s`H4*!ODoMeBMyC~P#WAy5Lb<5Wjumgyx9K3eV61QsWk_pIroX=$Th z>`ssBbuOBvdRmEZ5@0XR&>BFf##etWFUv_FzuEvjFr}VfjivKxS8V9H zCnj-Gy6oC>*$s&>m1;`W?uBd15hU}v?f&RoL+C zEBhq1+^198ACgd6=Datfh6-t}YgI*#0NvMcE9Xxh)ingr`Fq@ZE;hj@v~BSRWJ}p3 zlX_GMjAfEqXdIUV2)iUH&$u*iHx?g$%pTMTS*xsVaK9IzAn3`Vs;({`O814I?71vd z83&Pj{np$$Y$ioJaH6T^n;H8RL}3ZvytB7;J*!mT>x*bqHRH-4(@+%NKKnuD**9F} zS?Mtic4x}8X{dA7eHwI5YCYMtNoQ%`nC3y&x{*vo@Q#BP_^2xkm}045D&tggmcKjj zvGRpdo=5xR@K4R%?3WiO+pVBG+mfhlJ=|Y3ftP&I@~l8yz2((XtjcWKRTbQ~$zC&C zrVSn2Clg7w-3=G>EPEGUY$vz}%m)$#B~h`6j4vQZt&zg~t1^+A@dUltTI6NoUK$v-q*+v=P7&^PTs@+mtMfPWPvy3cV%2+II8M zaDideovD9~N9favC>zHiq>1CtF_cC7wO)XsmM&TUHG{_Ja3oy7g*%nVvW2 z=*2s<3@fVC(nXEemZ8Xx-7(KQR;-l+#cFD^yA?^b;$2Y2+}|c^5twAbtpD! ztxT5aE6h)4aKXns(>V&13w5b#d@fB`{;=H@o8={N~EJ8Q>czngn?QxXW6wdB8y%Ji(Ri`idAUH0N$^O zUu|wB0h9}JdvT%SPdf$m(RD;!@kr*e})oI(k_3iJ=VuIRl{ zpmshn?m?J>T`g#o$t(6$79cMD!0h48%KB_r2^*tb<7I?ByTi z0k#kJ!f4Iln|ri_r1}gBXeand-3Os<>y#0I;;CVWxqEOlRL}855w&%DE$$DUise&Neh8gLu!U2%`xJDEVJ9wY>{Rw5RV(I%HZ-eP$=kEdM z43#0s8l6XipDQ!inFKGzb-gxdg)8$h zs&3W0E@zA&Z~oU>itSTdl8$loaRVaI1*UYn^ zQs44ZIkjla=B@Y~AIfNyDnD{_7qTAEhw3|<`aLxj$7M`SC9}35lZE)zdwQGwjY5s$ zx7S!4M4MOi37q!t^BlRh1ntyc;#SFQbLe+%=6n%XDF$dy!&sk)piw~5S&_6S=e5R; z&24wIpwh)3y7AK0$fkc?VP}6EE&}wdlngfBWJ;%1zl>-*FsML7+f=FkQ#jJLPAC29 z;&-ybLBir}IKv2@wJHx|iZiGMdU{A8HW_Z;(J8*hh{dr>!k_J1V0KWd84pD2U?7P&$;mb($R~Ka6^8Eo9V_xlR4r zGTyp+wH{ms;8VDNZB@QPY(y2JN+eIV6oq0I8ba7Bi!C1ki4MU+sS`KEczLQ-VfBMK z`EVVXI|{VnNLI$MGT{~=kt2_z&5h9yLpjM>=D`|$>!8<>>fOz#z~*AXgu^2IaMjYM z`F77*ZY2e0E?=!^#Q+2Ac$wq7iwS=3>x*QAD`dynu6zCq@JKg9!p~0`rePklcorQV zZzb3pFAbByt601<42Ft~dLCQi(+{>cNhm8LG8~m)L+fK1%TkG2Ke!1mO|6%jI-UA+ z*!j#CXVXATJC6EOu!@%e=pU*N3E$>Kv}k5s=1Mg7`v zQmY%bE1MPR2{&Wm{<%P!UP%$)tg6UtW2Y}_FoMN>Iq9bd`!l;l=&PBv4X1+;w4)@8 zdOPoE6-HF%nmmWY9CGvw&Bf0|(_kl;hmJ7a{ z#(`GM&(|xRf;5Tdh>F`9e+x0Wy}RI=r5akvwx)cR06^PXwp5$dsa~38TrxrCH7l2E zi6x#@6gd}3Ovz5W1Y-O=*2Yca0Fo7sOFO zY-hL~ayOkOb<8H@v8|Eo_n_03C(hg4U?DN_z?e`Vn!9oTnD1Cs^ zam>~>^mdJA-^5?QN7pjADg?AWnM@rTc(J{w!3p{FtOkchV4T~g&fw!XIW+#d_7|Zu z?m`Q1#mT=ocI7nsTim(a>{VA6v|T%Av8*u(rgCCm2-K-lI1;FO_>cLorXjNfe(!$O8$~fy zC1oC`Rv-TJ|(}0X?bx(eW{wDE0HHs@tsBN+EwV@@2-HRlOV($Zyg+sGWthy`=Nf z*6FC5yuc4&yKT=N)J+WX;VaW5Nj(?LEY$YhDJs0Y*RKw8U@XA?B2 zr_!H7AuH(f%&`6$2F$?gvmNak3dZW2sTwgWU6E9~!?GU?ChxDDOr9m{aGh1uLc2Om z))Y3c0;;T3CyG>Nt27+4aN16rJ+@P_)XaRUo}~_9!?z7Ao;dl4@kO#g?KXaFoVzVx zEqM@y@KVCoJ&faVY!(bX5k?X&HI+)5n++#L+;ZPSPj&3txR5%r7R!Q-i~FMp@2Q~q z=>f5O1L0}M_f03VMDUf=#ypOvQ&p>BybGU0(FY>r6M@|W&#GoKQex;p{9jKq1QFK8 zr9s3*BnMw0;e8oL#u5IUS~}&j=(%TSjJ^2bxDIgXdim`(G+nBt+_dRBcvkb0lYSd4rU1fX zZ0wQ0^9n8OP%8+XMYD0UDtf1hYA^RhD4aU*!l;z$K5SKBgPAj!8Eng}_lR)MrD^*H1_3moR0He@L1X*`#^=((zv#{!5=GL|joO z4TIW*8pusx+ZLmIPKsCJf|TPgSh`uRM#IIVyWdn#{o0DmTFq)ixu7@SMl%CgBUs>2 zEfIP7dG>RWWh(el!Rdp2H^_MU*o4by{rjmE76AvgUj}0&$mPSEq1p4G1*AV0ou}y% zw5yK9I=+V|@2m(*NIIm~LxQOb?~f`BG&c3rJ-+SOP!`M&j-ojWPc9!$Wke*Pgg9`@ zdK`W;?3rd>DkvW;tB$e@LT+Lq|5{$@^k-S}4UH{7?L+xOa5u6pR{%a9Wfs~W z4qx^R`RB4gmYm(zS_~{$YbSL)!^kJlA`Ygl>*ccLHJ%QknX8NuFGAP$gc=A$pkCV+ zvo^1>&^C}>wI$g$PP4W~2k=rT1x}a2tG^!HexLzHzAJ*sPeV&GLkiT*z=V zzIMa^x*7ANgTXapb1SR-ykA@$!VmL20hS6b2>oViIxcPC5$x zy$i^82(>G%&W<`t^pp%e=XS=9+8DH*HMEFnv4OXk9=bQ}C=Cio&Pf)+)CLe9wwBG-7?5E)6` zr1)@s?ct`5^VE^5`o?>V#$>B@16>iN4Z61aAV8!QuLXWy?N+(njj#(s7u2)-8v=F$ zzMqd-Cw~CFx84`S7JfZ!OP{D+Xd%(Lg+&3JYIU(JRZ-5+3i|*$w)E0vBh`br#Mu~W z5`mx#SE8tO*3ljH-$#6!mn~}1c7D@N&ZQSp_VKWW>a!W`vthv9M}isX+=RrSoRybZ z7xbb&Nv%TtC;7HT7r@&5Z+!c|EoZZ>)3t?S87|oD-5YXNU5ge>!^zq>J!g9kuh0*0 zZ}J}03HGm+hQGWTsSswAxeRNjxt`xG&zogt6)6aB zt!286Z!@v&$BqQEBP@odB-v5FhSwP~gBE8~m}7#OF)T>dwvP0KRbNFJg$vWSFH^ix zCBTXhtcC%BwGFyB@SVaFw9IAvUe${F_>Ta}g^0v=)~0-&o1StDrnzY5BAA-|I8h98 z@>&OpwQTpv<%3f24j~PORFAS{hc=-L4p(8IkkCbVfX928>h6iU>6Du)vN6lVXl5k= zxttKWbh8A!{SmNM*PO5L{&HS(COoa^QW-f?7sr5z%ky-&Q<+4bWislfHJL!6c(4Q~ z)&81z>(0GPG=^f;mxDy4e4M>-H`kU~n-7%tT04GHvIvG=fBI7h*7 z%^NO1y}QWGSQjnSoIO}JvAEt}HJve$5kmWJa+E$}6+R|H00OP(7?o2)0tSGP$Svstc^(cD!6D`i} zN%VMcsD2^3z;bHb`syvG&(66#GjH6NuD36Fmt0pQw!kEowPn4c=#t$uHW%~G3ajKe zCeP~XXwb%e1TG-2ty2(cz@Nl!CKh z8TQ)OS<4lt?!Lh`f)Hh5;-_E&vecKnYdLospVQ)cV8tPits(N z`n6RJz>33JC~L1}KlGRu{+#~-%}wUL*6|_48?U<;VC72lwu*#VwdnPDo_dtDw&?(E z02s@4AQq>LPQNN2a4aDKD_IhuATzwTSXOY3K{d(7US@j=3F0tU_MRqW3_Q}~QBWXr z^4m>QNcohnraP;$PUR?SO%;vlgwfQ6N-Wa5<*Enl4&D1`2Vl26V*?HLZqd9vbn=s* zwRfH-bE$%&8*8hM8_p`fk8OM>&S!1EPj&}641v?rt~J+|Y6i?4I%a0W7=pt=Q@$PxnXiMkTc!(o{=CQ`>K4IlP{578yHqge_ z!HH%4OxQwl$j)Q&8hi!u8mnghlKcGTXfRI*PVaV}bKM*8FUO_3tS4CCG0&bTXP>dz zYyUg@={+9CguV**kNn5){|<|Yj=&QG7dtIw@&6MLwD^d?7Lz1|#MvLW$Nm*~s2{n- zmw5$UmVbjBo3p8Xe}A?nIeS(6{ckYi)YsPt$WZQg8BPA*k;bIJr|Eu`7Go-FTz?}E zKfnC>2rvHX2`PBojQLlvBEkEHF_EpL@T2$Ntw!KWA0MH}ugolEB!6pm$^To8j%JkB zi+at(S&sk=@rm@Ke^3`6!tZY(I_e&xFxuEfZO1`g(Dl_(5~bJkMLxVVsG+VE*)#$E zxJD4E!iaEqyYTUiiO$$w`R|jPyPsDl$^;20y)6FN(TgBMjZ(va0dF?5DBCw}m1C1O6v5i*FSqG@a5P&e{e;*?4Usj@S(u zYau7n1L3rCqFZTqv$nxjRhn;9?5?q)R1J+pwE9@7%uzXmF>EZ+F(GhX!fa`dC{U+D z3SC3vt=jfv5lxm%%*WMVTYNQ0lf)hacTVlhqPa6xPMV!^DYOr}BMRr{dg{_~tOnA! zKz^c#kovU^ljHr)Hj|;Q+~d7W;wLy6oeFU;jJzZ7+j6?n+d(q^b=sO-BQ?M-%!^T5 zZ@Tggj#vq8bs5*bb$p%X(G~hGS2W6Jt4A*jMtJ_bOMV&UtFtxHqb;~&nq*Di8_O0I zMB(-kt|z-aQOMHZei6&7=Ph{+MdGVfG&v;PkOicH=Nfh>+}Ez6g=*Ux8t z%2l4YD!=+ldgyReo;VJ~X)8A@WKu1vm^O&^g)!mS51{Q^>1=e{x1J|cHs+vPEC&WE z?5>49Y@~X}BFY>*F4S-G(h|IU4?m|9AVk8&!A-W2PhCZX&`vWL1EAJm3~?&$po*vGxb_T*^h)$ zE8oWQ5-<+(17e?+%VWxJ8i5XVyyY7pv{~b^U-_^#btG?* zW7LAM-$9G#zKa~LI+no!(q8so{Rc&RLwD&F`UKUwsCXy9z% zwVBgkR?RaG#Ej^TfpV{D;_5E}7_Y~Ot#K&`I5cV0bzNiNs#((bN%ca-vLSu823!6q zlv|Y!`r}ON*`>@8Rt+MXO;E6w@z(hmUO51#d)N*KE-R67)O59 zJk*E;>a!wO$?NANwwuJ)2_bs9Ju-1nTKHI7ea~U(Xo}ADQ{JbrTfs%4>+f7yT}NJ; zRXPhK{3@~eD=4qj;TQ{K`YKv{?RuBJ(pOt?s$35nG2ppT{a%$+S=_UpWI7h(?&Fv; zX*g0^nrPeISGiPSeR$*3oRNX(MOVP2aqf3Ki8|RL;)N6f``e)7KXSoJMAXl1cp$=h z^w6)hlpZJ4nG!nS5^u|6og?lxh*>>KFU-nflOs8e*m#o~!U|%r z&-9HwS-CVIt6B0Ke_+uDuHg7qK*R0kzVd(dnsFS&aqsEDXJHdiuT5cy$RNWWU{Hv_ zIl(@f+Z&9;F?SP|e~W(Y+6CG=G7EC$8$|Fmy`C2f3>#4QA{_*9nXTgr+ya6i&Y&Ye z=$Qe+k^;QOELv@$ZJs+pki&`Tp-pLJFBLS)dpE#q-A!@mFe_rWnO%>MQF5eOP~q<< z6;KWj*9AS{YqsVS1iKrH{*pdEH8o2nPCAaTZt8N?*TAi{%%UxIH2b*$@N(dhnTDrS zFG}q=W`#2;++Ro~^|l!8qw>l|B$Y%8*GxyUA>ZESr0Hf*UHQf7dq`(|BNGRs_L7c^ zqLIJ8Mea|07o{I}$2_U$ZVgSRi4VbNSx3)!uhTq~eoQte2ZR7@Y#A?er*I?qHiFGi z8H{QTXLqkV-DCo|=-{Jh@@kkPiLh`AE~WFj?40jzd9d9Q>%ws$eiXWjX%DQusmEUz z`zOw|LL?8{woEQw0_yrHTT}sM1gWq=Ecfq96B0}rxhhsR?daLLRy?d{&o$KKXGo7W zC}(-(F7_@kjZ@bv;g`tH(rxc0J1{z4=OWu287iBe{Is0z=0>t^&FeB*>#Q;eUa6UU ze*A}8J(1r-kS&L@N7$*jBMYd=j$K!)YL1JR zovNp9jY9+3q${P& z?3y%2!@uNzGoa=8F1q%?oq-(HH!WBuYuu5(tA4Au%jXqKfnFz@I5qMNO_0tr2t9ib z(0jonfseYphK4fd<$6;`O0~5p=8k1bozw9l>AHArvZ==4(vr&zu)3(JGMY`DM-HlM z(}~iuib4B!ke85>0<}Mqz^nP>`4QKfs|Nw{=+saSm`3Bnk$bLEh6MDf{9y0$kF^bZ z-Z?vewAr^-85%{thV492YW2I!+E%3jS6B9l@}0DE2PQOg^8@9pZe$ifT@C#|W*aJs zu+dfYuNGoW;@c5%F&jQe$ZO61*r$vZBbmYbihc5TdZ;))IQPq>hp>467ObPTGT)o| ziUVT=2G56;Hkx^Kp6k&Pq{n^@MZK1vY@4H8-}7)y2B!p7SFZTqKbhZ!4CXUJ#nV44 z;XajH{qXTwL<|wjb(TzQUchgiI=^hO&%e@2VHXQG$_P4=f4^om6AbU6$6yE6g&>@w~D{ubYH!JR~Fbz3K8C%{~MNCCGm|Bv$wa zlC{MRh&vuHkvhJey5c$rR*|iJPmGlFm08w(zpM}lIS)ThokZ;(<)x_ALVvL(Wd4&o zPgQgP2v)c7-b(^sS4@vo7|5+!tj~!bZ!HCbr}X5qS}g-C{!}map4NuK(}WVG2fY@1 znuAX=w+U2CT3t?zi`8al2xvoFlwNv8+eex8Z04SHyWIfQLKs_1O>X?Em{lt;5CmWeKSeSWp~NLdfRGGmrE%6i+%1lFfl@}bUC zK-%=SLY730gJW-&`)8smOEx*N7aA7XYfLY#v@@5qtQJ^UZfarUquoN-s5AWC=sgk| z+2>h>v+ao}Q$gs~5Mn@GNT5$LnUoL*Xmq0i%m}rj#k%7O#kw`p-P%Q`% zOiK(Z7D<;u5V@%}8`;Me|0Yp?)ai%xfY7x_F`Uvp&XquHVrJ0&Wd@n^rGdr1hPjfZ z;-LU&QPXrVfz7tzEY?cXLdIgTvEk^Q^$d3}DMi=Kl0QytVO5XSmKTD-Q2zBEMYF=Z z)F!Brogo!mR$)CmQMK~Th$WooyRz8LpVs$$+SL7tJW&}D{4)grt6m&3PQ_SOJwr(R z*%oh7-1JX$aNnEGkCm1QY$gSa zO>_z8$hz0;6Q#Th5HYQ48@AK82l@!yJ4W-ZS$9hinH3lKYQzk5dni^OsG6_UzfDLY zSUDwCl~<=aWBcQUhZ0EkCnf=FY#iE>D{6BKhbA)o?eeh1+X!HtQVTea_Vxv%}MoOW`H`Tk2@_2 zduBbT-#K|O+RPrF>UKEOFI>367`$g6Y?T|_oK{1*juaA_k6=@^kdrW8lc06Mt{_T} z_yH6X9uC?G^0fuA}rk{Sg_+?=QSMJ8>F= zP<3bh`~|X_5Plv|`nR?@_g~qqV~>k;DwUn*>?LPo15h0Z_nwkev?CZRkZv=TQ8>)* z4~j66y15G!XBAiSGf`Zf^PZ*0+a?1$K;#`C`Gv6ZwMLNk{@6$~{bJ(1>(=1NP1Hga zotAxX$b`bq4x}5#Yqb9S3NbjXSX&@Uvg&YFKj%ej7p4YRi+q)tTZBiEHPFN(ea{EE zFaAwiM;xWsWlQwi4)$%!NnMx9Yv<__xqc1ZN-fo`k*v^gUb(Cmo>>iV6ImnHYXl)@ zQa$hdvO}9d-$zs5sesPA$NSFVBkG+C6VR$fgwO>i@uKe$S3P&SkVJ*h&b;==U=(F8WZKu5YZ2X(F6v6xwX3M#Qq58Db!xp*eQ#RV0K-|)RD&#E}C ztdQOx7pKtyGF~sTXSGweX_I!QOQX)eFw@DzL?@i6*@{_`VUc|{>`2_wmX(#rfx6{! znhSEq%O?Qa1uhW!AG=X!*cl^Bxx2Kv9yJw?PxxIOGlMKa!8*~}Oyw6dSD!W?@ILtIqWRkfBj_i{Gj#-0Z1l)pZPfw0&)9UjhLqa-Ey)J&%`~GIl+nRHU z4BelW02kE=)qKEbh-YWA*j9Q>iUDdI8ls}WKMoxd(KH;Xulx)GO^b=M?gD2v(KF zXIL`AQ79G-gH|Mgm}uGl`jqm~dyc1;s!2a?hpI>c;QEVIQEjt@QUr+c60BQfg5&{i zzq>sd%=a5pk9??_wPv~56hUudOh5FIRTKzL75Y+jS<7Lr7$}Kw5(y)D$JK88fP7wE zsJNN_VIJJec6^7k*vpiYOmn6>K|XNsc@K+1(8Wuy2zD&3ZD$V+cJsQcoRqT{L#@DK zrDY873bPOKUEEe=OOM7}Sadrn?9-??XawI_SI-(NkcF^EiJV!ETjPmMyPg#C7E&w? z!X<7*q{O;iKChUJz%QRRYe07GJGD}?t%e5L#dG&Pvsu}JoiD`=rajEo+ZNWg zV<_D932g7jcQG?mi$&;ox3{cQdt@3mCA;|Crz^tVTWKMTN4oBvfK zRJ<4J)?$72TNDtV9ZT6k745bO7Pbr`cP`-%fhqY2>e%@P4BMb#lQ2Hq*=BPL6C7+p zf|!)L%z{h><7LxA!EcNYhh%TY-k{P&yIsyM-e;TH6KXzu9Y7&xFX8D2b`h=Kp*M0g zoGPm<4GP~_?VOxq&O9%}^cBe9XyXt>&l<<^x$rwj-wqOXoUfdm*7!i?Sk!dymXL?R z0MAn|hU$2Zk56>`5_3P~LBc-qh}ui)`XNcdWR~h0u2>AfWa;=8r{^X`Xg53K7si#Y z@#K{Fl_vqu_tfOkd0qJ4+3J~9m-tae0JHMY6D==+ExJ5S2CdR{hUABndoR88my$iB z2xOr1d$ReeyyMW@YORbBh!9bNj(t0RFt%5BX(w6I@1;>bm$~Vqfk*d9N89xLb>pV< z8@jqDr6n2s1n2#KD5DG+?s*g5xcgqYd%xr1->a&QiplSN z=X~6kc@@Ax@8GRvcw{Lmja_?wW_%87U*FicQ;>WeH#a$doBxT7VeZzH>oh6X;`Xo< z^cri>ojQTvR*A&9*QnvA*}|@wSDXP!F7`2Kwa6vPY=QW5OB1_(0+~Y_X}7zlWR`hT zkw(IG^qU%9-i#e|T{C1F@d|=oWyJne{I1QQ*^t%#&K#3MG7npnDdA`7K<<>PB zn2qrPyhRsBAE)b4X*vjJz z^ViRjNz(%2=|0ndG5d9^s_VwAtkfVJRbP_7VwH{QG_K~Ur>iTIws!<8IIhUt@eK&y zBv;%mxF2|SBRm;nI(Ceq6$_P4%pmfmmz5tf?-()*F)?-+D6;)6(vcOVF*~m|Qd2jX zM_Y?(ZbJ}Pdh!%UG82}kQ#*Odpkx#?R@;tniwa|pp_w4xUk!RECJTjMn>X3se296r8elJqPaGkC%BlyRHi=6} zwHIYW3*Hc4lH;9E{!Q1jf&;q!wuV?n-tmGeNaF~-M)t~1*tdv8XX`gxL%(tPm>uJE z(#*&OVUx4o>pxtpgFE+J3OeNRQaT9ULLHVNEAWD0EO`Gp(O`yTnDnX> z($AjnBDN<2{Msq5`iB+YTk=>*$jt>5ak|79L`d^Vc`cJSCn_WvER|#&LxDD` zDzO5UJFnf&dD=lcedRy(gxnMK2{D7&*+=*wEV?kq^m-zK^VEl1hT4bwn|{x`Gv3$N zT%sX6*d1<{8Mb_zp%lUF75${)q+JCD{(-?-{N(REmAx&mqCch^GjV8z{n z6icvBd7rBEa-zVza8Cws+f)-{$72tu+T} z%5A8vVbiZ}cr%|C zRsUWth~5acESF~sOXaEy=nNa8DcZWGk9=%pUNmx#6+@Q0Te2{`m$}C$)?%~WRYt#NQYPE~w)5b0 zxCYz>d%ZQ>c7GZ|wFgr<_n7~hL3Hd7t}5v93lrh0ixiZw3z+I(z9r0|HwD!Hp<-8U z2}e1`dy>9rk)v>0dC#uIp;slVFWi`fw!~zqz0~vA({gGSa^Gk@^d1URO65p(Dkp*5 znCm;t-^htjYnJwizeMPO!bLt3jpAuFOvIz(F>fZ=>ir8Fclh^f z5QApoezx1*yB(?6;>d&1kso6z+w3c)I@*)c+Cdlv+3gGoBC8~SP$^%HpavraR&S8o z`*6ot`r1mZ@ujtSZo29qG-hT~649MEY$_^|Zj#HHPIi)g_AY9NNnb zj+$1Y2id&;sgo1uQ3976b}|VZR8k-=?4{P<^Q_D4@w8l$3 zbv;f(K5(PzkuC9IR`|Chzn<^G&Cy-m-KVhBb?`UyxuP(1l)#Y8yoEHBljjytIP|#HP$z$k$^H6_aL4)44 z)<%hz_ERp(4>f^Z$Iaz)Jz3T7i>=4BYJn*|K8fJD3PpzGUyKX+um9L*L=g9K&6k!r znIc*!_xrQ%;M|giy;+r~I;leTVGdYMWj5x^0a8qQa-OJ(vt<(_1ax`6L)ITD9ys;d zhNC~OUNT_+p8N9a^G^#OYAoBQRT&`u%U(*-ro;iGvy7y^N4EiCX3WZ;WgD zP2At*pT*+G(o=iN+17uDvJSUAQE0~Gvx@TD%74p=SJbly_I z{_sl&>C;+k7oaot9ZGdO(6@;;AggkvE;NkJS(N52cIU|yts@vQbjy)hF>Xa!J@#6A zWy6v5TAR(*;1B-GB_{NH{5%fwzXmdFPMSLNFoxVnND`HIEpzQHEvMvjhZ0*lH)r|# zN)BU5pfj!xj`n8~M$I+CSSlRHZ+;u}6?-IESkAa2(=L=zM?VO2Qa=&D#O~0~5b$du z)cq<78xDU!IefYJ5F+Qtb+YGmy?<|zx>s1kV6{lon#T6(NaOpvpE_z>LV<#;h8-nr zFGWHQQFi(C>Xo8;f`f7>gP7uz0UP=&%?@;rk!ne~&j@5m@pi%Oa3gbcBCCZd7-)R0 z7=I@2U|9MkHmjvHRG(%)LNS9A|2SHT;d9c~dTW|%I$Q2yxN3%sYqcP^sQGx{pME22 zH1U=;wP{CNm7TAuykbE|p|EMP?wlNOU(S>-na>_|oO+sAqc657A1Ov4u;k(BC|7c& zgB^JB`UcH~cYF|VcSi|QIx_p+=ZaKg8yZZ}^A?KGdQg;zt3ROdT{IL@2y5Tjg@lRckI#$Ygq^k?Xje=%0a5|W5=wDp-fs%kkly5b@ZZ{ zCdyMe18vp9Cf_|RS5!{eX{D<2o%6<8oKhV@?CeAdVIRPAs6=iPg+@eC(CV4h}CS~(_=i7AOyS; za}(z9K_})qr*u&qcFAX8DD?%mO~ys?ad@voghViaD0nLR&*g;*?G|a=02-G9qsE)A zNe0niUN(oYJt#;DOYGJ#vY`HkfYbyvUZ%FFN$yq^aytm6W5+jf!W!_q|S~%}M3Kx=WA@<-W!EreM!eNXYFNV!fdj=lwE}q?m=SXnP zmk4+l+;ldtx?0HX_xSQHgK`&Y5UeGE;G>Um3Cmlo^9EF@a5Q2cf>t|Qg4*pCf>P7x zz?Nu~_z;2*b}ur%&HNBv9rVS*bb8J0zmAk0W^ETBW{LC*BXj#AdVbNq?fn7~aa)!F zjy}j`Mw;PVN1eQMIuenp5vz~IxW0F*GMX*QS__zYa?_3K9Yss0Wf9D8jDI-UdE6fj z;otw4iRTfaVRAq5pr4v)ttLOLp3Q7{*zXc0H|`;KmiGrTseGu>)WJ*on{Ic^gzW3F zT;_P!WBISo+9?L}HFT!<*%p`6_ll61ZXw%_zta_w5uApX*`KTR_B=b5v^6 zj=~;Kh)$Se`kzg}>sEDjeZ_z$EghN{Fh$ta;D&klZhK2g;c^r&>q)+l{v>{!Am?&- zcs2ak6?o!HN{B}a9!o~ekV1*TWBeu+>xE7L)X>POz-R`6p3ldN}9E< z^X}Li>isAD+=n1BQR-Xi$IavuR*wTC7%(+!9Hdwo2vC4}1)bg}PJ#C#jwnMI!Gy`7 zbC*0X6;SrecTc^uj4E`G$%mr(7{K_wnTj;G357DUtt)#+HhBWd^w4bS6%}fe&1o>n z{l>rZ%;r}ng}wUqI|4O4HSe8g)=aoi$oq=suTN`q7Bdsx_wEg5TqA3k%bBdUGVV}g zua;LqVfO@oCvaJ}a&Jgrk(-?4{^yOYG(4E(nZ!^&%g}1QN{hUv6!A`DV$6a&WA8^# zuQUw2s@BQ-YyPO8ncrw!xJ^2iIP_VNJ66a$eV;BTg-nuD9aaETQC~;{$Ywfy(J^sA z3`*|*I!Po3rDUhH6mvYTL~?{0%{(v=|ExU zA>V;~vcnzuS8q^GUfCSj+B6Z*MqSI$I;qf6`_V#3MVge4b433=bS1RhpVC~dv2xqA1E^?Zem^&1hnwR=-BgiLy2JU=kK1M)EtEuC_bH2lq zT^-WojP!K3L|FGo{*~8~E0!p(^tJYteNpl8& zlH9D7N56e{x0=r}wd(7}8u#+!g?8nqDMd{&?8kK82R~R>k8kH%nG@cWt zt#XTf5INIUuL&xO&+&KRM>tJc90`Akdsp>oc-FCotZ0GY*9e0%AXPK@%Q$N1`&s$+ zOputbD;pINIme7*P_xqjLt`8d$q_`*Juoe8)kUDtQ?UIoQGGw%R99(mC3SCK z9XzVv`6qQ@vbFx5B zWmc+dig(6+DN$K=xd+1sBli`SFyN^65vAS1_K)=5my0E#F5{IoF*6M8wh1(RM1! zbH6HKpH+6m{@y;1d2&sh>318up)}OT??dXd)42ZyWU}$#x23Y_HlRkHqNKcMf@`Ts z4C#Eue}jZz%)K&{(Xyh8W^4&1)FX^Z=SZWJoN}qvHxe>ZM+mE|U&h6G*`}gK$~-oo z%(qB{kuCVQd+7`+p1U_d>yPY2Q4kD2{Is1SN>CVz4AS zXmc8LjI{WD1ZO)SE%PZ#E&C{Y!zCfJS4jE7^4Ooj0KVI&DFG^HQ#A_7{;HU11hSy- zq(tZ}G(&jxBcmJVozsKQ>ZdPBA+^rKpycw6OpXGy0(`NhBh+0~`oehwiFhnczoW%S#Od6h;#B>hSEm_~% z<H1yqHDWR9Ut zz1+g1K8{BFjj|tsb+=Ezx$=A2CXZ8a(=P@F%U<(3IrSo1ChvBbJoYsZO_^LRMsfgB zwMFD%-1ZA;@>E%C_F!r72dtDrQ$TaN=!Iovsie@f*9g!a`$G=5e23@xm(zrFjis-< za#&Vj*G@NG`o1f8(aa5as4FZ=4%Sj(>B<@2LTLlaOe`B~i=Kf|gdNFld93g6d@oVV zCbpF*$M*UR!5e}VK_;>;bdtlQn{f;LASS_=BI3Fw3lBf|T<25;^?T(ITSM_Do8L^qaaQVNX?PA%}>q)=9A{%D4iO(^?rPfAu<68@k;K5~B9ed(B2|NSXw8-qOS z)7Twov^0IG2ulKW1@nXdwV0P<_b*PN9$G#j8hD?1;joYll_l>ZvKg7JotdtjfVMk< zMBt_LNGZNXp`1I{x1|#lw@h8&wtgX02cZX<%=^~B;Ua-v%`SI2H|y_WgOtD>#;1ok z+zMS6J9uR0rz>J|7g{QmV;^g<`S2PGis6tz?&P$_{vLKT{AA1zGM3}mh5rJ1Y<^O# z1-O|vt3VaPfWj6f97atV$0uwt--lFxs*H8r2;1Lq7%ua&y0QBRv?WDoAaxbFD$}bo zLE6gd*KGUNiw6WAc%1HeHVa)td|w7U>{c5JQ#2V_Rm*ouh%LIasuth>{Zm$dR?D3Z zxeEQ1(xB5ppsQG|EIDOBCn{KNvkaLTmyiUCZL|>FIxo(v6fl4v=^VXQ-rZ}DaO}&Dj|#Lrq%Ys_4@0{-;}UelUM!1RgSGSY?D-rEe*%0Ua604b{lUQB&U)I z7P?O6t2jL8-QIuN^rA*KZ`^7e!1C|k8`Bi4)A(a~F4&=YykQDF7sG#DHBzY?tQPXV z)T?@>EZCJSL@E_EL5gI5d^M_-;TKx&JVl#Ehi`MnADY!9BmOO#SShnUT{I6A9sR@T zd@+4qVIhd#x4OW>Lmuo@PD3@UxKaU^;Bf)M+9xec@o7hAG`{v(Le!ViQ<=QWFtVM4 zj-tpiS_1*v%sy5?*9!*%-hPBI{lE+$Tku#)x*-7lZ%>R+lHO|i(lhI0&^FgVG6-raoiPAOXlBtrw?H+7p%a5S5HPQ zBgIHKrB_Xym{Ho(p0qipQVXD7nvZp+R^LohqG~23^FCA9zRW>05YL>XaFfrLU&p6g z2FQ+cgk4O#bn|TBtKgMmKA06L)-5g-6$HZwO3B0eTOQ4ei~g=4qH4*_x~i~ijdge_ zBm&>8!3xF3LhdGqI%3oU2>ZJ*xx7^AOa+>`0z2M5X&KJV0w z&YD60&3n(Gx0urh^`RFn@1n&GS8~z^zN$<1o#RqA*#c8=Tmo6RuQc%?lII}b_VMxI zuyI_Y6)NlUTJ!gEg;!Ts>}1@?mIs416ZeK+c+IX9_#~-C#=kU>MbL2Qio8Z97?>_B zra^wCwTA&f5#vdt1JsJ%V<`bov#Xs_P-}sA zTrSVGB!5T1e&OAIs?bZrJDVSG#1VDa()4AArws`lQ2RN+V=F8;2FE4 z4yj+JRMz1F?U=E0o8B#&MS&vE-c#5co&3<955CF@$7stblWf#%987$NH8RLK;y_)V zXxavb-oB0h>$X?)Dl)>UoC^7}BNKFZ)AV!|r$ZFC3o{}&k-9_-2?NX}+F@_R6I#2g zt1DiAipw`b0vPv;^1~(!q?X_1NJ8Rqi1D_OdV~} z=e8A1aztgNwmGt80*`R1&V9rh?OyFc;>OkT*=ebrliNZbF8Jy*eb(Boa#erv*h%LY zy&LpdLu^;YIF~opFna{^tw|cBtV@HBV5s#QPZ)KJ~NV2bUuFI$x;Vm z8-$(T%V?F2je>6Yryi9Y@UHg-&)tQY59+sZz*eRncywB`=RE<|RyBT`?i{wAn{5v4 zL*H&a%2s3?O@l7=gSiNlks$`(d2jb!C&;Fug+Tlnq&!S8P0l%C$=5w zLExI2peVO(BH(hlY2d*XZR@TVOiD=8x9j3B<{F+HH8<)N2AmzaNzU_mQp`TR>H6lr zQsOFNo)HDz8G>Jm<#263Laj_8t+R5@ugQOlz}cjA^2ItaJa{D{^XHs=v^HxXaX z6ARx)BySvv(t4n{xR3(JCN6yriWFX72yYIyH1wY0)|3wsz@aisy#WleE zL&nBqoVrQyF4@a`c2ghx@gonnnQPFu@fyR!a6W?ZGZ+Cpgp4RM;!NdlR((HWj0?@K zKwZrB4ElW&K1@KkEk+}`H#aEmJoeF#>yLHfWQ&t_^98qY$8WNafj>}I)WC3;*LzSm zoFmdR*WbGWfr4{XYu6CFq+$A!SSspS)Qj&!b%PN!4pD>Ex#oHM4K`i~FUfMwZbXy))I^qXJxh z+d7neBuP(WnROMozkNGqBeQR)fe`pii%6}fyGIP|ljoVzhDX^gC6%AM?F~cbA};A^ z211N14ZfwHayfJuA&Q7*x$KhnvSY&-W1b&&8hw|So>X=ESC&G*U;XE$d1^y%!0Jn| z2t;#~vKzRXp+P!W>dfCJnC6djg9i8Rd(|1)^q&8DQY%w1UX*_({TUic-8L*#9p>&DL`S`a+J_W02;W-pK#$ zonZ-y<^IpE1EK^|3k0L{{EIv|A^5l&jlI>~vop4igsLWBY-aX})~F z2Jfx|B?RTEuL{RY`fSMW$f)u|uv6*Q)~aWV|7Ep3ROy?y=XjsJL%sVQ8dRGAVY;Aq zK2tB^yj(`-YC&(Xv-$@g9F2gsA%=(n8nkCN+rST)NHtY%z!+-pBIB7uuou@oA|kn` zpe;e7ft|zAXD>Sew1MuD*Ek0q6a78<3ef#9@ZBBT`q2D|L*+iyMTS;J%o~2?pYNje z1f~s`;F2CP)p%;(8F+9Tl1V>qG6Esi|wdspYX&4S(26|xZ{(E~ltXED`WO;&bw^^-(ZsxM;4gaS-2C>SeF`GVX$J1_W+=FT z3??TOSRNrM%Dr=k#XZ5GqR_MKdY4EJ`6~p0Ag-@2u+{>>G_b$!kQIga%RzErSNCC2 zObJv$y!3&L5<{8cn?PRwsN5pa6BYsG zCIc|`pukhxu@u%D*X0DY=AVD&;*&`Ujk$j<;swStI1h+Vy}1IPgmm>oYHZ4n?n=;?XZSYrBuGFg!qTOZQsN`MAPqIkH4clq{Y;!hT*Ex9EB(k zKAqmQH~<9re9J@HXf52|Brf};-FEwp)>+rX9;960&YO;-#nU^ zf1Fx9F9F_SLhA+z8+|1H;uDO$E&~Gso@9iBcYR5snwQ3G7XL?) zEZa@9;Wd+l)gj^k_hsi9pk(YIh^do8dAhAkQ4g+dc-+prmOob53n* z=b9?^uOJq77>i*`ReAp@67l@)O&m* zF-lFk{f?m8|EaNenSTiSHeig9A6AN1aolbM)dpzicAX=j;%+NP<%&oV-VX+7;(ckH zE!tB%;MjG(Lh~lVD*+2Y%Yp1dL|)3Qf5>M(4L{`@lXUtkga^@nDwK&D`*+^WE%^*< z)Th1EA=^JH^c*5T{T_6??p-Z`*b#Hp;Wn`OPs0nk+m5>VY5S{ptYRopG8%l z#@GVp-QS)&TNh1~T=FphtQ7M`svO!Ic)G4?BC%Hm%4= zM`)h^!}ApP4W8z zDEVYf{Eiq;)SGNz<&M*Ytn7|2O>Fs_hKOSr z&CD6{Mw&OjTr?E3m&#SE*9*J1R(=_H*gA4iN^aWFQS>8)M)(sml0qGA@S;7Pl{NpdDhPFtw5w;dz{L-%iL(1_b?a*Z9obO_?87@!#wf`-D_S` zVfn)d%9_h+h0nF8cJD2#+nA&bTCe z!(W;X=UlYccVZW&LSz)i?S~0F>(qig*qlu~=eeH+0L1PJoK}Kde^-FoVG`M*4IeyC z7C3iw2fxhLno73XB7Qil`>i@gkBokquQRu74TcrB-T{2)SP+-39Y|Z`J{%(9T@ux{ zCEZsxTc&DQnfW>S?R(~jLE)EGy)mBgJ5^*@)6SnH37&TpG+_}&k#f_cqflQ&GX(@K1V6vb01w?} zO4ogDSbFDhrg*(e)_!=hFSgjpBV)GZTyk@{D#M!+i+^o+f*Nb}&#zBw+;dvGNL+LY z(hK3_8p9354RR#o;63tqr==zTi2k7AZhbcL>TxEw~*aKH&* z1Afw53LB50gD(5U8a1vURVf(w0nVzBMaO%Eqi@hM{r)tB!Tz;p4(}Gece0{5dey7{ zblvvpzSE7+N*EH*IyRQd9{*-EaLN_!;rLgr68vD&7@=j*>e=8Tz1r=6ofdBs$f26` z&ed{glEOXW`X++hB!O7>hl`-hT9sS1i#xa(Wg}3cJ^FNzNJt<1a0v7%bi=yM>&rw2 z@oNc?Pl;;xow+)_aSDSga`t(;{v>vD?crc<-SqN5Oq_|Ag*{#Vl#EO%Xon;9fDtJ# zWoJERysi&JcXm>Y!mrL)l4{8PD&(7A(_2mB@y@rqrzhNV%g!Q-@S;R@`6y;F_)5q- zM1xMMTcvg5+W0(9n-?QL&fy7p8061MD;cbL-8+Td`fiP z`-Vn=uti-HWniD)i^R(62kZvHLH7cipBUo~z}rPng)MsA94W4Q+- zjgNAXx#W@`|0@9F=<-8s-RKGfuGQR~E7Rmj1~=ouZjOzXG~)Gi*7 zHUz>-ouPfLH!uB=m-LNim~(H>qx4ToS63wo8MG-1B1HwR;h4btK2Q<2QM}odcRaCg zTg_G3xOEUxH!6)>g$P*dU7%IOG@>4#AIdx3$B>1um4I7d75N|+<$;=(PI=q?P*vs4$f%H>&jUdsd9)DSW#qh6}e6QX;y) z@>`|}yv`pSdBwihIi+cb4VbocY zyYYOLki?ZvfT%@^hq3d_3I*vpHq068F-WI^fK1Jz* z0=0qU*KNr&qqKHf+|t6$;L1c%YZ47jq={{My}S5epHSh_1>A_4zklY!Bjp-(gS2KK zUCNu#GxYKx9^26pCu{uAetw7edbdxFe4E=X&o)%m;$6`JE7*BMjHvC=yHlO89_ z$b;V7KxlSG$K@6ubB*(SseaBpGcAirt4uAiJTEZX!AYgfzO*-kqoL_J!=ELr(q?-= zZr13$Fuzdo~j8B^N9w$V|~)^Wj#4BzGRt+xP`HzHZmGSG-Bp54sug*t#^8R2gr%GtDg7d zYdK~+;ZIEjw*XEF=sPxT3BueB7Cn)h|E|tCZ;Y$3OUQirFm^`0C%@|oa_BSCnzTyU~7VOakA$J-c-(c zCB&r_ApIX8Pt;iH>;=b{gN{ylv-xA%Z1(H%<9#7$aUBZ*l*18zp+a27E%SC`eW59zSb3^^sz}&g{`*vCJ4ES_-q15g@c>ZVWiyEB!@q9oELoHw{wG^;&carC^BHMTr z#{aD3!)XymG!1J|qoX=a)tVHv=I0|6nWH$vL64iv5{$96HTGu%xcR}~yJ9s{qk5x( z8uXqk;w4wM4<843!ip+oiuYAV%syVk!6qmd829Athd}aV2Y6ZhFWiT34V|afo{4iVP1#eK&;Ch>ORDCuH>lFJ122BzZ5+i0Ss5h}=vrBbzpL6S74oiQ6Nd z3%nlZn4$B(?o(btmf)VB;XiW?u@%dmCgkpt%=jooy{h1j7Bkl|4bITMezY2DPV-?O z5A%-jVX1HM_!KK_*@?LS-bIK>|@`&&8`dVj_eSOJV^9gg}b?p2vIK zY|3mBJq!73_+?qPQ_@DazbHS}Q{>N6mmU`X+mbP)%7_|aF<7|iP!*`A1)xew$H>q9 zC?vL#=W-`D;h(x;9j0PgChm@mQ+bNLjQh)bFz-8sfC`D(k{d-Ci*QKevrzwKM+o0$ z?;>M=N|5nnQ$KQ3QuZFAS6UpYh-10uzdx98U_kc?vPLhP?n(VFtj=R<1&Lt*ZyBOb&}B;1|f|JfZNmL5uO{F&%siJo|Q{Ye2-Sa(i!?Y1s8KqtNSfoFKH`>f;S z4V=@*vBhpq{#fwq)-bkYEqiST-;Xd7ics+QxC}KMJWl&N;kxNVKf}R4q;*&JV@+*T zaV=gtipoNO->s|FQ9_N3L;~1UMnbaWr`cNKwU~(bhSXyC+S>^a-oj)a@(o zouz}BI$WLc@GACjOeMgoJj+3T^wm6VsHW1-_ zjyE$pZ^;xryuEU?$X6oCO+hnuwcjlHW1ScRf;!$FVS0T3+HrHX&K!S2BN+nXm^K?K zgUG{14(ou#E8i!x1v){XI-IVn9p%|#e}K2bq%lv-0?>m&=(K6>ZM#>4;lqs5_FQl+ zc?iY`w?^!1LAMpsCZG^bF=YYGY$AqH``iTAokYl-=5CIWGHu6m;Wq%4wW~)wH_7=3 z>u$5<;>|bwl3L@|n+nw&p%;#yE2zD64yY*`@vdB-ytg~e^QUq_#Kwo+Iajfh&#{-z zBS9vJ_`y$;*{}(I_0CS)v+#iDeu2)uVao2{bXF>_ja!7`?H*=P+}yi>GN*TXff7Cw zbTfkMpyY?gjoxvrV{jN*xl{Lw8kJNpOO(R|-X{4bnZgdGWbN_?(lD=A4f1Bma-A3R zT9ze&VRdEEymJ1aqYLHS;V@sBt^1IRDD)~reuw`{p-Qgfh!^JykjxIgAihv zUuNZaF4hRjsgzd+8gjNJa}C?WI+NFZNFn*m)kH1}-I{`NBp|+-AFiq$1tlD(W(FlD z$68t?3@Q`6lA9IW6hc_aHSPyAD=^>9DfdN8#G!K~NoinHS@+efvRb1o;_mm|H^@ut zi^ms$O&tr17c*RULP1k^u3BLb4mf~s#9$vvf#@H{!u~tiy2f$WN8(^qBd{3;WhcoELs(HWb)c4ekEar6rZoMkCJ5sX$ z=XbyDlZ*FeNPl&i8oqqVi5?PhywSVK?r7MOsyp1hBY;a?<@$Q)C>3S7z&NiVjAP<6 zmfDLL6i@YRfj`3Sq~LZy6GWKG{8XfQ{Y_wcPf~C&ZhnUgQ_xMjjWM;AGc09vw$sMh zH{juOK~GF`(4tR^_c&@F_78xK5ks;KeD;w}`o-LNLx<9}8aWhN?#rZ_^Hy-< z-PpcN3vY*F%lY(1Vk z+zW{U5?wbY{(8P*e(&p;n7A05a$DYW-jKqkuQU&qM#dS^MvcSH(>u#+kyX3nIt6)2 zrmb!^YwbPI%#IxKBtt5q9h0^FI?Yh-@n$cYSXYQ2{OkDRnh7wN?t{@ZZbRMfo#?~t z_NOi@S7hQssMyV+rJBqLo=hfiLUV%YDqn6Bg0u2dw>M9$y6mgK=Y!X>v~v-g)V6pH zjZBOnQdHs(q|v@-19;pX+3(6E54b%mdeg6jtK-=vZ&%w1ov~jt(N3fYWy^%qu_-Ez zREBL`Zi|+WUm}G-Z2T{RR>sw3PU_M;G>bnqmA@kM zGLNH*!{L<3jHO^I;QbGLBFf`1lvg^A5rB~p8F9qY(!B1t-CiI590NS+gTxLtb)wAU z_Z&*MZ+M7(R$w7L!0C7*Z2szVYhp6+K^>{FA7;_{FCvcB&(W2% zBv3_-e^gbQr|QmJPIeAU_{&BEnY16BioT!L0LY4?kA{?Yk!}~AUUtwO`E)7*lX=!t z=GnfK{``$Br2Gxen$@3b-9=(mY`jMs!uqFet~!s=PYN1(bBDSYm?2n(*gvpj0Xe+N zY8mgO?yvqb><-7f+pj#{uAgtvL{f(%AxUl7ZOBMOAvlA&7<`X$|A_Rll=Fpaf8U)e z+DI6a(Wcl%A1z86`ZpjTatj4wFicu*8_->~HvhA?tn;XVtHyUk>>rwe1<#GavsvfO zI?;$KI_yYR(yt8q#oj=0FErM1J2c`2PGA0a6r8^DV7x@tv1}qD2zOCQJ&`-=lcJy< zm&DjVpW|&_OR_g-H*IampjWc?YzAOFE+qF~tYKf9kS_+Rx0F#IM+OJm%mK#nwc}Py zaCDyP>}KH(f1kXxAv!m|dV2lLw9N={HUl0dthm|IT~>7KgeeYVl3UNgM=UnH{hOEX zaja;oJOPzr`BZMs0$Mc%o*)%ptp|&4PmZCiz7S3Y;!pj89jy;Z{7__%Uo~w&|6gp> zg7Ymk5xz>9UjC?0fHHjnnzL`^YMI9qZ%1CyfHo7UfPgdEfagQO9(#_9`N5@n%6pG@ z(GG4YXzT*K0<0^HcO93W+lqW2(cmF`83KA%0ko#jsoc)BVeo;9_#I^kyE>Lzy6DNS z{*>;wmP0_vj}N{hCrO7VzrAb4U!zS}%(|pn7pDNk*UWg74*=7G+bXg=4x{BhxFo-IsGIO(fxUD$Xm-K%86zSRr!OCf?hrJeD%m}>mOREgp^*`>-sDQU7 z-^3sy7a{{m^eiR*ob)RFVRH&BWQ9f!ZN7D-af#)dY_luQ&L7$5L|6Opcp=mvUoqF_PkE^K5)sy~46C;wtf%F(NlaZ7@i-%)#ap0XFuJ&0WJY!hCwyzH4;Uykfbf{+ zXeyQAm~7P=MI)j%llGpzBkrK5m~8SZN=mzI*CMV36(?K0u&_lEM?)TTH`0(~rMia* zk1m?%DP%d_^pym*ZEPFL{4(16}?@ zPNP66?bSvEG`6`C_AQd}$jc9_O=iy@D}4@RlWm2fNT37x>U^ z2AVR8Q~nqBg&evnuJhVAjyV_9FYH>y2UZfzyNMG7Ac|zX9Ib=bSffk84Ib zCl{+TbBDBUnz@_R!`>O-@1!dk#B`tJoYW`^aU_KHY?ss=~Qd(6D0VC?Kul+edG!h%F%3b!l+sv`< z`3EN+#8Hw(t8m|MkeaSvhT}<))_v;dp9XcP{E988TK>~4scITs5np7vFwT|R z;U0Z^O3Nv!$6Q?lWiI?BIN0{5U=-6+Kg4cFa}y5p|H$YQKoveV*33ZS6<+iBXfo-IzJyL78Z$#251P zWPCDb?1xX-4`0zwgq`W#P*C3JE6PfJPCpDbe%Fg0trJCWhE4H8Qoe6t5ol?_8`<}r z&PDdt|4nJ&ewWc*_+e*;seYAdsc+qd&jZ^Fz2eAV`ipGozFOw`rkC__p*KTkhY)1qIQ)0E|9#T>xM1QcJs^EDq4`&zupIqj*a1yRxkY?D!Hd&2zGnVDjfg^VUKO_@<}HH(=5{Mm$Lib>nG1_p*;pBzzXDO);`Y#>~fq(!fMQmDnE&GqU~p3BUb*mHb%wPwnf! zg^d51;?8IxM$CG&Oe*2X&9t^q5NbKj2sAStVx}NNCr=b?CG4nu5IAQrG?I})@xP|< z-g|Vl;~4o#C|j*6AbIf&&4KWLCieq1x*A*mz3_`C1M5&K`-^|IjOr$Ki*;k{4AyS{ z^RL=tdcmt+$Fmr2s+N__Lv8Hc|9~j1lh{8r`Tny^wTFDV%`zgHbGP2=yBhrQTO5=c z)W{$w2`;3<@B3Mh6~g)d{*QWX(ABa43lP-I*xqkWOA#>g6tsJb*((__Uu;I9%MZdI zWfok87Hy7`;}O#L9QuKd$`K~^<^4_i15@wR_(9ktI1d5Psxj^nI1`QBEs6ROutx=_-@qZ527Ik@QMh z1qT9 z#REuHKw3bME?s(ww9so56Cj~Vl`cq=-V&sX^w1>qVi1vD4J86Xq)X@}ltAFe^E}6M zKE40JyFcwu>)O}Mtl9V6_pCMgw|MV_Gz8W-vRRSMGp_D|K`n5$Jr? zm2{9{5B;}o(_lkand0?;B2%O968sFj9zWgKN}YkC|D-yOOTwC;hDRTm_68d=j=YQ% z)2tA3M-HU=$>%(brPbo^>Gm+qOT6JiwvYMh!F`C~z~p&^Tp9RLZKkPQSR-USgP6Tq zymgJ>%0-NPv6?~lgZ`AlX}rys-ueA4)r!<0DwMPtXbNCxA?m`c^54@^1S*9M`J*?! z$R8P$%45r4IhfT4RG&DEPoZT3a^Mj+WSr89xb2f#CSvP8w+LE|C;?Og$?8n(Kba4R zt})#aQ#gCOD2<43*gKEXHaUrk#jmCBo)i}pCw)DFH7{&$ECYA*eRr&S-HwiV?&fRy z^QD#Kub$qzTwvyQ*@s+RvP0~=&!U5fN==j`Sv};Ujp_l4;*pgSQ}`RG=6R8KD*c4PR5<&b1)33E@^y_Hz^7DC#V}EpZ4DokeIsEr1IFgZwr}_t0wO1~05v?_-BBuy1P)bdn!cG7!2y1`B zUJM!ZLF3iEnA0I4znbj1u&CYy0}74u-Z2j#!_kX*^Tzo;?|g@MT5-?m^cfSvVzcYI z+kMh|qor<9-(}(p{CIWUkYz~^LDBgA#*1;_s66?D3XJrr`C(44=*igkBo?scYPX@g zHM{!FmCL8P_J@y;6lJ4|_hG5AD<_|JIt7g@s$XdfZOwa(Jt#a9 z4jX3E^Pls~{0+8^#2#gyUuQIT9Hb|#W<04XKN&ZY$0S($DDVs$^1tl)hCSi<`Zty~ zY53()YDoi0vr7vR)Sk|STNCJ@R1q2?SIAniW@$d$Go2fmXc!>1u(n>>zKtrU9TObW z<`weWFGI39No)Eia)|hK!HJpxfYVMY(##^Y)U5J-B-|Y0jjGWWsC=g06H3c-$thfE zn1##r8(+!R#Ya8HDxvEveV9%dj-|V7e~W$yC+jx~A>lNK<3_bt3~p@bqjT)`hh` z4vx-jG|_$^BlObuFEu(y(YUbRl$Oakc}<&C=N=(8Ed0norR$mILcbMUX>d3-m|lMk z`MQF)0l4ekR=3Zk1vcR$y^KRY+Sebm#E6GOD<<=)yyd%S?3l zhgrg6ZD#M;ZGg(PH<7GX-xj2DG-$@^YEgIZh@^Vfc%fJE8 zyr#!~dTPv^90nZirtmDxj;Qy*oSJ)UgcOk1#0eS(h{Xs`KDUF=Wk?=;8pV~8#3&=# zO^j{oM%Y>Yic~zJEr9fJmO=@cW^U*GoeQ~vIL%7qtbC7mNob#AW1rn>nA=(XNI`Sb zO)<;bl$&y`aLkF%$TjsVt0q7Y_8}If!^u~iUMkj+ZW|b{hv& zV+sz@vOyc*f`B|@Ew<=h6tx3%t*mFKa#KFR!8}W_a!AfhCkV}FC$-VRyB7n75WUde=Ix9R3Mb^HIiZDB2lYPE05fE| zPCH6nQr)p@;I)Z!j-38ABj*S8dyIf`W-)|~*6p_C#GcCT-t|>zGA*uoDvQ0Sew7_s zb7n!e?A>~(v2kdVWNBRa*3ymO1gZuZO?-B#Y!O}!XmlSu#;U$sxX6XS4Wasj_MbYl z-=4bCH!Y=F*v#gGLIPSn9v%j9GH_mQ1*R=SvZ?P?`dZF%=0f_gqT0HhF zo!+0o=u@R(?Bhl(kJkSJRe1-YEXR*-GX5wjax_M(S-OxvHy(afUHBX^7(eOT&K2O3 z-}bZKirnsN40|}RDv=V?|ICLluL-J!Fs}Tlsm&ZiN4Ff1c#=#T<3uHq_QTJ-)}|j( zh>GOfte{19GJ%Wh1z=#K4Oc-TJceMRo%BfSRur9ff}r`SGoonzE>3fOZZQ)^)pWVR4P%HJPyC)XkC>1m;UZ@7P#e+T%Td8Kx7I0J3S!y zTa1~Jb_l3GM-0T$ww1hzK?b9y33`=jWs|jIu-XS!Lj7l^GfjIJ8AluI^9e&NPSdr@ zO%e{A18~U%IvS@W8(dY)`vYzizyq)~oG0c|KUB4?IMUhkr|g5>l%n?HH>a zyu$_p)DhK}3dFc?uQS!9Yy+1y?uz%+VSVd2Cl)`InKnhmfMU3Xj@5j{9Lo#)MIp`O zLwBRHGHR009YC%2DN^6>i}l^qb~NrzB1^YN_uf)KCws$ohM|(p_hF|t+p;C)3!5&= zm0sl6khW(lWwuLX)X_~^dy{wn{+wHHUs89pZq*BGG^W0(KH$h0F`(z&x)+*4-hEKN zojR_49FnfhRboSjJ262uqK*$^L8lwDI}4fK3;Vd7SKBiC8;NjlumBEoR`%?~rYTc_ zWL$FCg%TlzMOgW^Gu7sMAPhJP1(&(jL2>@SWMg${3M<_$JiR9?eG~)|>tgK2CdqmY#W+k<#NV}MnKZG$*}!6%X$wL(F?<7DmhA~7qp1wR$w#2IY&)i^q77`j+rKrBXUEAIxIUVm;dEg*LIM`CzI$K^7 zuZRF&^InS;AG^bP(o7qTOp0fSs0BiSDad2#TS+@wd*jZQLPLQfQdrx{Yvt1iT%|}L zrKjU&-lX{Jbt7Fozov-^!fbc>3D(Ul^&+7=XDM??e@*USgE`3`Z-h3WWDY+4EV{#~ z{&Dzb_Wn>`zISYRoMrAS7E!V`pAXJ;<@Asa^x0n6F0cc)R%eo(qGf_J49T49-iW*v zu$aCg)Qixa;eu9f0^YJUkIkAXcQxv^W3cs}cDR|=8AcwWvqn>8U5dC|3CHl0{x|`^0pg$Oo3Nt+x#Og*B47D zW4%j^c~7j1uqbkx{DFH3xVrA9QEZo#m2NT&Ue~-c5Tu2;LLB=3W%cf$@$PgdD>Jkj z{vo{nH^%{u75lrxU3=bQjM~81P*=z*LjdyTe}M#2p(lDZTF?ZLqHv#&&cuEy_-=m(2_ zCg7@26{&(};u8h7qady4gyQNWic_PXd7>(fbJ5AraV0LVqZ@q$)(l9t{JROu+Gj#meyJw`tF}IbEE8xap@Z~AF>}?M z=^kDA`EWuDS!ow--*L1pm=sZp^VW>_J z(G?z-0zA&)%&2!l@PP;1bn9M_=2tLzqs(plM86jSB&Ti6x|>sb9KqXgy2k)e)$pMf zRdlL-JeC>$qo{rZ;4qrVEGa0lyVyLM=r^WR)RC(|F?#1Dfy90E>D7#i`rh20=4WM6 z=ucbm62y0&L(AQW*X@S)D6$h$IyU=mj5!zZHv&*gPqQN}kBBmGo14j>1h{hWupFNV zIw9l5u#Z$;E{3ABZaB-AW1}zjk9Q)%0Nu9BLE&aqm~?Ehdz?J1LC&eN&%$&bSF-fj zbHxwTprOxDZ^BB-V(~?S2N0hDqj&hs+V5zRFraro=I?@E`A~QhxX1*rWJ!|%&PQy` zIvYOF82|G00@Na)JMwfHShz3gaeXcmjG3rXgiKrV6{brDx2Z&;0FMsw6`;H5;l#~i3%?uwQmuvVO;!r5dugY`w+`sJLhf66<@ zWG0yoe!fXB^>5YR81~fhuD}zzo2qYR*yNX+-9;4gbxT>t1-8R?Oe(S-FnF)=y9}ny z`ls`zmV~anNhe%i9929i-*rLiXN7CY5ve&^$Q==Gdg2_i<1}e)-{>7h53^3fh$W5M zgp=t?BZhE9wGdMQ$`%_UUA0RI9ojkFDVLdJ!K+u!l zcS%N=(jh0Jml_+GDJ&n-#QG}=u8RK13i|9AoX?*NsIZl{Huy#Q;1*Qv{~}bTV!Y^% zU2(X!mIOk`=p|jD3x|WGOG={!XrTase*%_Z=>y*r(aLUFGFrx~UA{kfru1&$MbyWL zED9rufUq#0VEgEbphYD!)DOc^9=eFqR*U8+&&B9cw%d`97bz1KznbfY$K6rc4n9ro z4sy=U-&{f!y+pF-2!S84GS_?f;72GfdX-Y5i%C7Xvr{Nt%D@tpSl0sSK?Sjet7$>g zoFc>~6Ubad1PN8@77^joioRLc2`QDlwDg)ahl7g3Aw-Oa{ix-&l9w`*@idrI z%R$0V;HkWSihrxTDrk>S;`%*-zPnc|A4S)cGw;TE1o&3L4Lo^W<~|k$?xqRo9GT83 zTS03vN^`TicqE4O&~i~^ae?MhGeG}(#$%rw6*cgt;oGs~U#vb3Gkt@M*;;dkBOWk( z+n_fr3?9UmxfSwom7jSFI9Xb$Y;V=n)KdG)eWgg3eZ1VR!#N#2k$VLdn7FyT%~nKojb#`Jy4O(xgj8YtYhU*C ziYy+xEbL@W<)3qnIvL_YL)@^u%CZKN0Gud705<6A`_1p1I75m$KaF9L5AWzDsX*LKoHL|r;?qvR?+irF zcQ+=~ORG?;bRVESkY9;Xn22`g(KxeRhw7!yxUF90d#_n&&V&djxm4X51UP?W=3A zgEt?TjuvP&uYU$g;iaya)~eN@6w%Cq%wH`i=jZNO^TY$+iXaMFLsaRIF;y&3?!6$`(UKiH7xe`Ez?!AWD4>~;g5oubMj)Nw=6)WB18@>Q zATK+}bf-iDRxjUnI6kS0N}S|BW830sRCzbnMUa)Zom@>a{FwO+{8-abOHv||VTaH$_g(+BX_y7*$WE8{|sKjfu2-mM@N-;2)IyVwDI-LPnTzDR*@32OB z-qs*dzTBlQA7+!@W(#9Y{*Ic=UR<%ixVky!d;RC#k3%;|J0qQo4&4>xV@NiuQ2hQJ&Dm{h$HNd7Z5N!4Buhf!O0JqLL^}k*u{;55SMv zp-QC7EvaE<1##~CIiGAQ9JO>2OC)-K2oa+9;z<8XnR%VY$Cg%tsE^+vr&~C!teExt zgnu)C*W0K4v;v{(qG(mH*wNe5F@soD#sKa19da`?$N5cc6uq|#!MYp*Nj|;qK{dU% zO<|tv5`?eFaO3h+(jAv2%*-nxN#X(JF3NU!jwPGnbC2*;ME^?KlqJ%xOsLVM&Sg(G zJgSQhB?T|QQ{wG2dbBuA%4DgH+Eu?*Qrp;6GNimVbsXnC_WH8TuzeSO3!5UA{ z+5j-6yht@4}iq~OX)+ES$X`C#+WnPGbB zn8~Z(RO;lRl`>G7g1{6yh7 zT~IefWn*C<6u<0Em-ziUJ+JBCY|0_{b|frBwd+U2^w8|@!kbcata?`@6eU1dJ%NS; zIn}|V@-KQ1X^y^|ZdFT$3UoDnjT`%Bz;N->C7%%2Vdp~UnJXH1os`x5x7-pGq!ZM# zju0O*r^~8E$)Cy7%R2L+?NXD?tSB-ee-fcXH1AHLE`^*ou4w^WU1<&;HR%k>(YIk5 z153*6Q3;7W58^eB=FPuQ-4m&0ce%lZyTcM67hi#Yc{M2|x196UiIJ(%HJu>E3AOMVfJL7aw#b16l3R8fJ{v)Roc@#zXf@ggXXcs(#01XIzNOwk01l$wj$eWha9S=Spsn2JxXPWhJ&&mZ#f8>8XPM|$6~@Vkdr$LqN=JuTy;qaH5~$~{+uNf`CQ$lrc6KD7(Jss6 z$DA7qS@T8k$XE~3jf;Q}OT!qWuQWH;Krs&zCy2t$4bOE00dntgn7{S8dzTtxzqlkl zUzD)t0iAgfFNZjXX+zcRFQ}}(A;mdO1`Vfi3!jl^F3G7S*J_hnVa@eM#ylBQSt?z8^$5Ax`yx}Mp>5Q`ePxeQSfY-QvS z`sFOrDSc_Mvow`r(2D+#d>efCd_mYJB~prMdivY*tGsPa1hkO8<{3LnSJeB^Ie%Tb z6}HnzL2ECN?>_bq9qjt?`hs*@@A-Y;*B6NcO99F0y(9SZQ3e3;gY}@YPb9u779dK=R z3s2rYgnxnZvxJ~oT_!SjU|EJ4AKcvsW}HavBL(>tr!jYCQyn{v?C<{_fUU4AZaL3a znv)Klqyrr`ma4;h=mR)O7W}rmEtpHI-aUA+&hf^U&e zXM1+mgs2|)-=0Aa;`USqB zmPd`u{37Wre}6(%{1;75)2G4Q{H^E5$4|>1Q?_6Kt$k72xcSZ}%D-!}bBkpfhJ?8$ zl)b!Wc>Oz4dCq?e*5?0xrA-Vxct0RrXx?kM{T;?RNAmUFV&pFLDBCLSx%G|;1z6rx z!j!w&gK$_P+vb6{{UmrcU37$@Sloh5um+IZ@`jdIcb3mzvwtP}V=%uCo?CtroTIc} z`qg;GHn=@6D}~^cN6DdhsQ;(-|2H7I9j^Zn{q5uQ z?V0r-i1X!kq|cR@=N%`v)871H2G8{X-0jC92%K8~xlH;`D7{zza^1L}CXv$q-#!2z z>WiGF|9`>%hYjC658Fu}=C1rBv;2pksfxL9g&(Y;EIh11U@6DM} zf2Nd|ti8aHjIw|I@%;KXz@@89lFpWm=O^0B&nIoYzpqUX;WrKwZ~Wt*|M>YlEu1K9 X3tnZT_P^J2;r!85)lsQXdLHtBh&=38 literal 0 HcmV?d00001 From 2400d39c0d5ba56ccfeb8e19d933155a03aa4c84 Mon Sep 17 00:00:00 2001 From: Max Moon Date: Thu, 25 May 2023 14:37:16 -0700 Subject: [PATCH 68/89] Fixup Pipelines docs (#824) * Address live feedback from team on pipelines docs --- _docs-sources/pipelines/maintain/extending.md | 35 ++++++++---------- _docs-sources/pipelines/maintain/updating.md | 18 +++------ docs/pipelines/maintain/extending.md | 37 +++++++++---------- docs/pipelines/maintain/updating.md | 20 ++++------ 4 files changed, 46 insertions(+), 64 deletions(-) diff --git a/_docs-sources/pipelines/maintain/extending.md b/_docs-sources/pipelines/maintain/extending.md index 9a03cf19e0..55e9b1ed10 100644 --- a/_docs-sources/pipelines/maintain/extending.md +++ b/_docs-sources/pipelines/maintain/extending.md @@ -42,7 +42,7 @@ Run `terraform plan` to inspect the changes that will be made to your pipeline. Pipelines can be triggered from GitHub events in many repositories. In order to configure Pipelines for the new repository, you need to add a step in your CI/CD configuration for the repository that uses the `infrastructure-deployer` CLI tool to trigger Docker image builds. -```sh +```bash export ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text) export DEPLOY_RUNNER_REGION=$(aws configure get region) export ECR_REPO_URL="${ACCOUNT_ID}.dkr.ecr.${DEPLOY_RUNNER_REGION}.amazonaws.com" @@ -57,9 +57,9 @@ infrastructure-deployer --aws-region "us-east-1" -- docker-image-builder build-d --docker-image-tag "${ECR_REPO_URL}/${REPOSITORY_NAME}:${DOCKER_TAG}" \ ``` -## Updating branches that can be deployed +## Specifying branches that can be deployed -Pipelines can be configured to only allow jobs to be performed on specific branches. For example, a common configuration is to allow `terraform plan` or `terragrunt plan` jobs for Pull Requests, and only allow `terraform apply` or `terragrunt apply` to run on merges to the main branch. +Pipelines can be configured to only allow jobs to be performed on specific branches. For example, a common configuration is to allow `terraform plan` or `terragrunt plan` jobs for pull requests, and only allow `terraform apply` or `terragrunt apply` to run on merges to the main branch. Depending on your use case, you may need to modify the `allowed_apply_git_refs` attribute to update the allow-list of branch names that can kick off the `plan` and `apply` jobs. @@ -86,20 +86,9 @@ Run `terraform plan` to inspect the changes that will be made to your pipeline. -## Adding scripts that can be run in Pipelines - -The `deploy-runner` Docker image for Pipelines only allows scripts within a single directory to be executed in the ECS task as an additional security measure. - -By default, the `deploy-runner` ships with three scripts — one to build HashiCorp Packer images, one to run `terraform plan` and `terraform apply`, and one to automatically update the value of a variable in a Terraform tfvars or Terragrunt HCL file. - -If you need to run a custom script in the `deploy-runner`, you must fork the image code, add an additional line to copy your script into directory designated by the `trigger_directory` argument. Then, you will need to rebuild the Docker image, push to ECR, then update your Pipelines deployment following the steps in [Updating Pipelines](./updating.md). - -## Adding permissions - -Pipelines executes in ECS tasks running in your AWS account(s). Each task (terraform planner, applier, docker builder, ami builder) has a distinct execution IAM role with only the permissions each task requires to complete successfully. +## Adding a new AWS Service -If you are expanding your usage of AWS to include an AWS service you’ve never used before, you will need to grant each job sufficient permissions to access that service. -For example, if you need to create an Amazon DynamoDB Table using Pipelines for the first time, you would want to add (at a minimum) the ability to list and describe tables to the policy for the `planner` IAM role, and all permissions for DynamoDB to the IAM policy for the `terraform-applier` IAM role. +If you are expanding your usage of AWS to include an AWS service you’ve never used before, you will need to grant each job sufficient permissions to access that service. Pipelines executes in ECS tasks running in your AWS account(s). Each task (terraform planner, applier, docker builder, ami builder) has a distinct execution IAM role with only the permissions each task requires to complete successfully. For example, if you need to create an Amazon DynamoDB Table using Pipelines for the first time, you would want to add (at a minimum) the ability to list and describe tables to the policy for the `planner` IAM role, and all permissions for DynamoDB to the IAM policy for the `terraform-applier` IAM role. We recommend that the `planner` configuration have read-only access to resources, and the applier be able to read, create, modify, and destroy resources. @@ -109,7 +98,7 @@ We recommend that the `planner` configuration have read-only access to resources If you’ve deployed Pipelines as a part of your Reference Architecture, the permissions for the `terraform-planner` task are located in `_envcommon/mgmt/read_only_permissions.yml` and the permissions for the `terraform-applier` task are located in `_envcommon/mgmt/deploy_permissions.yml`. Open and add the required permissions to each file. After you are done updating both files, you will need to run `terragrunt plan`, review the changes, then `terragrunt apply` for each account in your Reference Architecture. -```sh +```bash cd logs/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner aws-vault exec -- terragrunt apply --terragrunt-source-update -auto-approve @@ -131,10 +120,18 @@ aws-vault exec -- terragrunt apply --terragrunt-source-update -auto- -If you’ve deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, , you will need to locate the file in which you’ve defined a module block sourcing the `ecs-deploy-runner` service. +If you’ve deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, you will need to locate the file in which you’ve defined a module block sourcing the `ecs-deploy-runner` service. -Modify the AWS IAM policy document being passed into the `iam_policy` variable for the [`terraform_applier_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_applier_config) and the [`terraform_planner_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_planner_config) variables. Refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for the full set of configuration details for this service. +Modify the AWS IAM policy document being passed into the `iam_policy` variable for the [`terraform_applier_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_applier_config) and the [`terraform_planner_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_planner_config) variables. Refer to the [variable reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for the full set of configuration details for this service. After you are done updating the IAM policy documents, run `terraform plan` then review the changes that will be made. Finally, run `terraform apply` to apply the changes. + +## Adding scripts that can be run in Pipelines + +The `deploy-runner` Docker image for Pipelines only allows scripts within a single directory to be executed in the ECS task as an additional security measure. + +By default, the `deploy-runner` ships with three scripts — one to build HashiCorp Packer images, one to run `terraform plan` and `terraform apply`, and one to automatically update the value of a variable in a Terraform tfvars or Terragrunt HCL file. + +If you need to run a custom script in the `deploy-runner`, you must fork the image code, add an additional line to copy your script into directory designated by the `trigger_directory` argument. Then, you will need to rebuild the Docker image, push to ECR, then update your Pipelines deployment following the steps in [Updating your Pipeline](./updating.md). diff --git a/_docs-sources/pipelines/maintain/updating.md b/_docs-sources/pipelines/maintain/updating.md index 2143e73ecf..462f38f6f3 100644 --- a/_docs-sources/pipelines/maintain/updating.md +++ b/_docs-sources/pipelines/maintain/updating.md @@ -3,7 +3,7 @@ import TabItem from '@theme/TabItem'; # Updating Your Pipeline -Pipelines is built using the [terraform-aws-ci](../../reference/modules/terraform-aws-ci/ecs-deploy-runner/) module. We recommend updating your pipeline whenever there’s a new release of the module. +Pipelines is built using the [`terraform-aws-ci`](../../reference/modules/terraform-aws-ci/ecs-deploy-runner/) module. We recommend updating your pipeline whenever there’s a new release of the module. By default, Pipelines cannot update it’s own infrastructure (ECS cluster, AWS Lambda function, etc), so you must run upgrades to Pipelines manually from your local machine. This safeguard is in place to prevent you from accidentally locking yourself out of the Pipeline when applying a change to permissions. @@ -15,18 +15,16 @@ This guide assumes you have the following: - An AWS account with permissions to create the necessary resources - An [AWS Identity and Access Management](https://aws.amazon.com/iam/) (IAM) user or role with permissions to start pipelines deployments and update AWS Lambda functions - [AWS Command Line Interface](https://aws.amazon.com/cli/) (AWS CLI) installed on your local machine -- [infrastructure-deployer](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/infrastructure-deployer) CLI tool installed locally -- [aws-vault](https://www.github.com/99designs/aws-vault) installed locally for authenticating to AWS +- [`infrastructure-deployer`](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/infrastructure-deployer) CLI tool installed locally +- [`aws-vault`](https://www.github.com/99designs/aws-vault) installed locally for authenticating to AWS ## Updating container images Gruntwork Pipelines uses two images — one for the [Deploy Runner](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/docker/deploy-runner/Dockerfile) and one for [Kaniko](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/docker/kaniko/Dockerfile). To update pipelines to the latest version, you must build and push new versions of each image. -### Build and push images - Pipelines has the ability to build container images, including the images it uses. You can use the `infrastructure-deployer` CLI tool locally to start building the new image versions. This is the same tool used by Pipelines in your CI system. -```sh +```bash export ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text) export DEPLOY_RUNNER_REGION=$(aws configure get region) export DOCKERFILE_REPO="https://github.com/gruntwork-io/terraform-aws-ci.git" @@ -60,7 +58,7 @@ Next, update the references to these images to the new tag values. This will var -To update the image tags for pipelines deployed by a Reference Architecture, you update `common.hcl` with the new tag values for these images. The new tag value will be version of terraform-aws-ci that the images use. For example, if your newly created images are using the v0.52.1 release of terraform-aws-ci, update common.hcl to: +To update the image tags for pipelines deployed by a Reference Architecture, you update `common.hcl` with the new tag values for these images. The new tag value will be version of `terraform-aws-ci` that the images use. For example, if your newly created images are using the v0.52.1 release of `terraform-aws-ci`, update common.hcl to: ``` deploy_runner_container_image_tag = "v0.52.1" @@ -68,7 +66,7 @@ kaniko_container_image_tag = "v0.52.1" ``` Next, apply the ecs-deploy-runner module in each account: -```sh +```bash cd logs/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner aws-vault exec your-logs -- terragrunt apply --terragrunt-source-update -auto-approve @@ -96,7 +94,3 @@ Once you have updated any references to the container image tags, you will need - -### What's next - -Now that you’ve learned how to update your pipeline, the next step is to extend your pipeline to customize the configuration to suit your needs. diff --git a/docs/pipelines/maintain/extending.md b/docs/pipelines/maintain/extending.md index 52cb9ef089..541eb3a564 100644 --- a/docs/pipelines/maintain/extending.md +++ b/docs/pipelines/maintain/extending.md @@ -42,7 +42,7 @@ Run `terraform plan` to inspect the changes that will be made to your pipeline. Pipelines can be triggered from GitHub events in many repositories. In order to configure Pipelines for the new repository, you need to add a step in your CI/CD configuration for the repository that uses the `infrastructure-deployer` CLI tool to trigger Docker image builds. -```sh +```bash export ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text) export DEPLOY_RUNNER_REGION=$(aws configure get region) export ECR_REPO_URL="${ACCOUNT_ID}.dkr.ecr.${DEPLOY_RUNNER_REGION}.amazonaws.com" @@ -57,9 +57,9 @@ infrastructure-deployer --aws-region "us-east-1" -- docker-image-builder build-d --docker-image-tag "${ECR_REPO_URL}/${REPOSITORY_NAME}:${DOCKER_TAG}" \ ``` -## Updating branches that can be deployed +## Specifying branches that can be deployed -Pipelines can be configured to only allow jobs to be performed on specific branches. For example, a common configuration is to allow `terraform plan` or `terragrunt plan` jobs for Pull Requests, and only allow `terraform apply` or `terragrunt apply` to run on merges to the main branch. +Pipelines can be configured to only allow jobs to be performed on specific branches. For example, a common configuration is to allow `terraform plan` or `terragrunt plan` jobs for pull requests, and only allow `terraform apply` or `terragrunt apply` to run on merges to the main branch. Depending on your use case, you may need to modify the `allowed_apply_git_refs` attribute to update the allow-list of branch names that can kick off the `plan` and `apply` jobs. @@ -86,20 +86,9 @@ Run `terraform plan` to inspect the changes that will be made to your pipeline. -## Adding scripts that can be run in Pipelines - -The `deploy-runner` Docker image for Pipelines only allows scripts within a single directory to be executed in the ECS task as an additional security measure. - -By default, the `deploy-runner` ships with three scripts — one to build HashiCorp Packer images, one to run `terraform plan` and `terraform apply`, and one to automatically update the value of a variable in a Terraform tfvars or Terragrunt HCL file. - -If you need to run a custom script in the `deploy-runner`, you must fork the image code, add an additional line to copy your script into directory designated by the `trigger_directory` argument. Then, you will need to rebuild the Docker image, push to ECR, then update your Pipelines deployment following the steps in [Updating Pipelines](./updating.md). - -## Adding permissions - -Pipelines executes in ECS tasks running in your AWS account(s). Each task (terraform planner, applier, docker builder, ami builder) has a distinct execution IAM role with only the permissions each task requires to complete successfully. +## Adding a new AWS Service -If you are expanding your usage of AWS to include an AWS service you’ve never used before, you will need to grant each job sufficient permissions to access that service. -For example, if you need to create an Amazon DynamoDB Table using Pipelines for the first time, you would want to add (at a minimum) the ability to list and describe tables to the policy for the `planner` IAM role, and all permissions for DynamoDB to the IAM policy for the `terraform-applier` IAM role. +If you are expanding your usage of AWS to include an AWS service you’ve never used before, you will need to grant each job sufficient permissions to access that service. Pipelines executes in ECS tasks running in your AWS account(s). Each task (terraform planner, applier, docker builder, ami builder) has a distinct execution IAM role with only the permissions each task requires to complete successfully. For example, if you need to create an Amazon DynamoDB Table using Pipelines for the first time, you would want to add (at a minimum) the ability to list and describe tables to the policy for the `planner` IAM role, and all permissions for DynamoDB to the IAM policy for the `terraform-applier` IAM role. We recommend that the `planner` configuration have read-only access to resources, and the applier be able to read, create, modify, and destroy resources. @@ -109,7 +98,7 @@ We recommend that the `planner` configuration have read-only access to resources If you’ve deployed Pipelines as a part of your Reference Architecture, the permissions for the `terraform-planner` task are located in `_envcommon/mgmt/read_only_permissions.yml` and the permissions for the `terraform-applier` task are located in `_envcommon/mgmt/deploy_permissions.yml`. Open and add the required permissions to each file. After you are done updating both files, you will need to run `terragrunt plan`, review the changes, then `terragrunt apply` for each account in your Reference Architecture. -```sh +```bash cd logs/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner aws-vault exec -- terragrunt apply --terragrunt-source-update -auto-approve @@ -131,18 +120,26 @@ aws-vault exec -- terragrunt apply --terragrunt-source-update -auto- -If you’ve deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, , you will need to locate the file in which you’ve defined a module block sourcing the `ecs-deploy-runner` service. +If you’ve deployed Pipelines as a standalone framework using the `ecs-deploy-runner` service in the Service Catalog, you will need to locate the file in which you’ve defined a module block sourcing the `ecs-deploy-runner` service. -Modify the AWS IAM policy document being passed into the `iam_policy` variable for the [`terraform_applier_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_applier_config) and the [`terraform_planner_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_planner_config) variables. Refer to the [Variable Reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for the full set of configuration details for this service. +Modify the AWS IAM policy document being passed into the `iam_policy` variable for the [`terraform_applier_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_applier_config) and the [`terraform_planner_config`](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#terraform_planner_config) variables. Refer to the [variable reference](../../reference/services/ci-cd-pipeline/ecs-deploy-runner#reference) section for the service in the Library Reference for the full set of configuration details for this service. After you are done updating the IAM policy documents, run `terraform plan` then review the changes that will be made. Finally, run `terraform apply` to apply the changes. +## Adding scripts that can be run in Pipelines + +The `deploy-runner` Docker image for Pipelines only allows scripts within a single directory to be executed in the ECS task as an additional security measure. + +By default, the `deploy-runner` ships with three scripts — one to build HashiCorp Packer images, one to run `terraform plan` and `terraform apply`, and one to automatically update the value of a variable in a Terraform tfvars or Terragrunt HCL file. + +If you need to run a custom script in the `deploy-runner`, you must fork the image code, add an additional line to copy your script into directory designated by the `trigger_directory` argument. Then, you will need to rebuild the Docker image, push to ECR, then update your Pipelines deployment following the steps in [Updating your Pipeline](./updating.md). + diff --git a/docs/pipelines/maintain/updating.md b/docs/pipelines/maintain/updating.md index 1f2748cfb9..3528b8e45f 100644 --- a/docs/pipelines/maintain/updating.md +++ b/docs/pipelines/maintain/updating.md @@ -3,7 +3,7 @@ import TabItem from '@theme/TabItem'; # Updating Your Pipeline -Pipelines is built using the [terraform-aws-ci](../../reference/modules/terraform-aws-ci/ecs-deploy-runner/) module. We recommend updating your pipeline whenever there’s a new release of the module. +Pipelines is built using the [`terraform-aws-ci`](../../reference/modules/terraform-aws-ci/ecs-deploy-runner/) module. We recommend updating your pipeline whenever there’s a new release of the module. By default, Pipelines cannot update it’s own infrastructure (ECS cluster, AWS Lambda function, etc), so you must run upgrades to Pipelines manually from your local machine. This safeguard is in place to prevent you from accidentally locking yourself out of the Pipeline when applying a change to permissions. @@ -15,18 +15,16 @@ This guide assumes you have the following: - An AWS account with permissions to create the necessary resources - An [AWS Identity and Access Management](https://aws.amazon.com/iam/) (IAM) user or role with permissions to start pipelines deployments and update AWS Lambda functions - [AWS Command Line Interface](https://aws.amazon.com/cli/) (AWS CLI) installed on your local machine -- [infrastructure-deployer](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/infrastructure-deployer) CLI tool installed locally -- [aws-vault](https://www.github.com/99designs/aws-vault) installed locally for authenticating to AWS +- [`infrastructure-deployer`](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/infrastructure-deployer) CLI tool installed locally +- [`aws-vault`](https://www.github.com/99designs/aws-vault) installed locally for authenticating to AWS ## Updating container images Gruntwork Pipelines uses two images — one for the [Deploy Runner](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/docker/deploy-runner/Dockerfile) and one for [Kaniko](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/docker/kaniko/Dockerfile). To update pipelines to the latest version, you must build and push new versions of each image. -### Build and push images - Pipelines has the ability to build container images, including the images it uses. You can use the `infrastructure-deployer` CLI tool locally to start building the new image versions. This is the same tool used by Pipelines in your CI system. -```sh +```bash export ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text) export DEPLOY_RUNNER_REGION=$(aws configure get region) export DOCKERFILE_REPO="https://github.com/gruntwork-io/terraform-aws-ci.git" @@ -60,7 +58,7 @@ Next, update the references to these images to the new tag values. This will var -To update the image tags for pipelines deployed by a Reference Architecture, you update `common.hcl` with the new tag values for these images. The new tag value will be version of terraform-aws-ci that the images use. For example, if your newly created images are using the v0.52.1 release of terraform-aws-ci, update common.hcl to: +To update the image tags for pipelines deployed by a Reference Architecture, you update `common.hcl` with the new tag values for these images. The new tag value will be version of `terraform-aws-ci` that the images use. For example, if your newly created images are using the v0.52.1 release of `terraform-aws-ci`, update common.hcl to: ``` deploy_runner_container_image_tag = "v0.52.1" @@ -68,7 +66,7 @@ kaniko_container_image_tag = "v0.52.1" ``` Next, apply the ecs-deploy-runner module in each account: -```sh +```bash cd logs/$DEPLOY_RUNNER_REGION/mgmt/ecs-deploy-runner aws-vault exec your-logs -- terragrunt apply --terragrunt-source-update -auto-approve @@ -97,14 +95,10 @@ Once you have updated any references to the container image tags, you will need -### What's next - -Now that you’ve learned how to update your pipeline, the next step is to extend your pipeline to customize the configuration to suit your needs. - From f9b51a8cc7a89ea778720a59e548fc8d6d7b6006 Mon Sep 17 00:00:00 2001 From: Ryan Russell Date: Thu, 25 May 2023 14:43:53 -0700 Subject: [PATCH 69/89] Add Library Reference placeholder page (#821) --- _docs-sources/iac/reference/index.md | 6 +++++- docs/iac/reference/index.md | 7 +++++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/_docs-sources/iac/reference/index.md b/_docs-sources/iac/reference/index.md index fa56d0f3ab..0b2d8a653b 100644 --- a/_docs-sources/iac/reference/index.md +++ b/_docs-sources/iac/reference/index.md @@ -1,3 +1,7 @@ # Library Reference -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Lacus viverra vitae congue eu. Aliquam eleifend mi in nulla posuere sollicitudin. Imperdiet proin fermentum leo vel orci porta. Proin fermentum leo vel orci porta non pulvinar. Hac habitasse platea dictumst quisque sagittis purus sit. Malesuada bibendum arcu vitae elementum curabitur. Ultrices eros in cursus turpis massa tincidunt. Molestie ac feugiat sed lectus. Donec ac odio tempor orci dapibus ultrices in iaculis. Id ornare arcu odio ut sem. Condimentum lacinia quis vel eros donec ac odio. Enim eu turpis egestas pretium aenean pharetra magna ac placerat. Vulputate sapien nec sagittis aliquam malesuada. Ipsum consequat nisl vel pretium. Ipsum a arcu cursus vitae congue. Sit amet nisl purus in. Et ligula ullamcorper malesuada proin libero nunc consequat interdum. +The Library Reference serves as the definitive index for all actively maintained Modules and Services within the Gruntwork Infrastructure as Code Library. This comprehensive reference provides a dedicated page for each module and service providing descriptions, detailed information on input and output variables, and sample code to help you get started. + +If you're already familiar with the IaC Library and are ready to dive right in, you can find the full Service Catalog and Module catalog reference in the left sidebar. + +For an introduction to the Gruntwork IaC Library, check out the [Overview](/iac/overview) page. This page introduces the concept of Modules and Services, clarifies their respective purposes, and offers guidance on when and how to effectively utilize them. The overview is a great starting point for understanding what the library can offer and how to best navigate it. \ No newline at end of file diff --git a/docs/iac/reference/index.md b/docs/iac/reference/index.md index e722d889eb..d1be2d7937 100644 --- a/docs/iac/reference/index.md +++ b/docs/iac/reference/index.md @@ -1,11 +1,14 @@ # Library Reference -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Lacus viverra vitae congue eu. Aliquam eleifend mi in nulla posuere sollicitudin. Imperdiet proin fermentum leo vel orci porta. Proin fermentum leo vel orci porta non pulvinar. Hac habitasse platea dictumst quisque sagittis purus sit. Malesuada bibendum arcu vitae elementum curabitur. Ultrices eros in cursus turpis massa tincidunt. Molestie ac feugiat sed lectus. Donec ac odio tempor orci dapibus ultrices in iaculis. Id ornare arcu odio ut sem. Condimentum lacinia quis vel eros donec ac odio. Enim eu turpis egestas pretium aenean pharetra magna ac placerat. Vulputate sapien nec sagittis aliquam malesuada. Ipsum consequat nisl vel pretium. Ipsum a arcu cursus vitae congue. Sit amet nisl purus in. Et ligula ullamcorper malesuada proin libero nunc consequat interdum. +The Library Reference serves as the definitive index for all actively maintained Modules and Services within the Gruntwork Infrastructure as Code Library. This comprehensive reference provides a dedicated page for each module and service providing descriptions, detailed information on input and output variables, and sample code to help you get started. +If you're already familiar with the IaC Library and are ready to dive right in, you can find the full Service Catalog and Module catalog reference in the left sidebar. + +For an introduction to the Gruntwork IaC Library, check out the [Overview](/iac/overview) page. This page introduces the concept of Modules and Services, clarifies their respective purposes, and offers guidance on when and how to effectively utilize them. The overview is a great starting point for understanding what the library can offer and how to best navigate it. From 3d84b64594081d0193a079824b2d5d8c6b09490c Mon Sep 17 00:00:00 2001 From: Ryan Russell Date: Thu, 25 May 2023 15:01:39 -0700 Subject: [PATCH 70/89] IaC Overview live fixes (#825) --- _docs-sources/iac/overview/index.md | 4 ++-- _docs-sources/iac/overview/modules.md | 4 ++-- _docs-sources/iac/overview/services.md | 4 ++-- docs/iac/overview/index.md | 6 +++--- docs/iac/overview/modules.md | 6 +++--- docs/iac/overview/services.md | 6 +++--- 6 files changed, 15 insertions(+), 15 deletions(-) diff --git a/_docs-sources/iac/overview/index.md b/_docs-sources/iac/overview/index.md index fd2a1d19c6..deb4e70fc0 100644 --- a/_docs-sources/iac/overview/index.md +++ b/_docs-sources/iac/overview/index.md @@ -2,8 +2,6 @@ The Gruntwork Infrastructure as Code Library (IaC Library) is a collection of reusable code that enables you to deploy and manage infrastructure quickly and reliably. It promotes code reusability, modularity, and consistency in infrastructure deployments. We’ve taken the thousands of hours we spent building infrastructure on AWS and condensed all that experience and code into pre-built packages or modules. -The library consists of two types of code: Modules & Services - ## Modules Modules are reusable code components that are used to deploy and manage specific pieces of infrastructure. These modules encapsulate the configuration and resource definitions required to create and manage a particular component, such as a VPC, ECS cluster, or an Auto Scaling Group. For more information on modules check out the [Modules page](/iac/overview/modules/). @@ -25,3 +23,5 @@ The Gruntwork IaC Library is deployed using the following tools: 1. [Packer](https://www.packer.io/). Used to define and manage _machine images_ (e.g., VM images). The main use case is to package code as [Amazon Machine Images (AMIs)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html) that run on EC2 instances. Once you’ve built an AMI, you use Terraform to deploy it into AWS. + +1. [Terratest](https://terratest.gruntwork.io/). Used for automated testing of modules and services. diff --git a/_docs-sources/iac/overview/modules.md b/_docs-sources/iac/overview/modules.md index b79224b468..fe714a773b 100644 --- a/_docs-sources/iac/overview/modules.md +++ b/_docs-sources/iac/overview/modules.md @@ -1,12 +1,12 @@ # What is a Module? -Modules are reusable code components that encapsulate the configuration and resource definitions needed to deploy and manage a specific piece of infrastructure, such as a VPC, ECS cluster, or Auto Scaling Group. Each module defines several AWS resources. For example, the VPC module contains resource definitions for subnets, nat gateways, and more. Modules promote code reusability, modularity, and consistency in infrastructure deployments and can be customized in a variety of ways. +Modules are reusable code components that encapsulate the configuration and resource definitions needed to deploy and manage a specific piece of infrastructure, such as a VPC, ECS cluster, or Auto Scaling Group. Each module defines several AWS resources. For example, the VPC module contains resource definitions for subnets, NAT gateways, and more. Modules promote code reusability, modularity, and consistency in infrastructure deployments and can be customized in a variety of ways. Gruntwork modules are tested in AWS, in a randomly selected region, each time it changes to verify the infrastructure created matches the desired configuration. ## When should I use a module? -The Gruntwork Infrastructure as Code (IaC) Library contains hundreds of modules that you can use and combine. These modules are fairly generic building blocks, so you don’t typically deploy a single module directly. Instead, you write code that combines the modules you need for a specific use case. +The Gruntwork Infrastructure as Code (IaC) Library contains [hundreds of modules](/iac/reference/) that you can use and combine. These modules are fairly generic building blocks, so you don’t typically deploy a single module directly. Instead, you write code that combines the modules you need for a specific use case. For example, one module might deploy the control plane for Kubernetes and a separate module could deploy worker nodes; you may need to combine both modules together to deploy a Kubernetes cluster. diff --git a/_docs-sources/iac/overview/services.md b/_docs-sources/iac/overview/services.md index dafc476029..a3b19d73e9 100644 --- a/_docs-sources/iac/overview/services.md +++ b/_docs-sources/iac/overview/services.md @@ -1,10 +1,10 @@ # What is a Service? -The Gruntwork Service Catalog consists of a number of customizable, production-grade infrastructure-as-code services that you can use to deploy and manage your infrastructure. This includes Docker orchestration, EC2 orchestration, load balancing, networking, databases, caches, monitoring, alerting, CI/CD, secrets management, VPN, and much more. +The Gruntwork Service Catalog consists of a number of customizable, production-grade infrastructure-as-code services that you can use to deploy and manage your infrastructure. This includes Docker orchestration, EC2 orchestration, load balancing, networking, databases, caches, monitoring, alerting, CI/CD, secrets management, VPN, and much more. Services combine multiple modules to configure an end-to-end solution. ## When should I use a service? -Services combine multiple modules to configure an end-to-end solution. These are designed for specific use cases such as EKS and ECS clusters, VPCs with public and private subnets, and databases. Using a service can save you time piecing together individual modules and testing that they’re correctly referencing each other. +Using a service can save you time piecing together individual modules and testing that they’re correctly referencing each other. These are designed for specific use cases such as EKS and ECS clusters, VPCs with public and private subnets, and databases. For example, the `eks-cluster` service combines all the modules you need to run an EKS (Kubernetes) cluster in a typical production environment, including modules for the control plane, worker nodes, secrets management, log aggregation, alerting, and so on. diff --git a/docs/iac/overview/index.md b/docs/iac/overview/index.md index e0b5e7552e..2c595f9ab3 100644 --- a/docs/iac/overview/index.md +++ b/docs/iac/overview/index.md @@ -2,8 +2,6 @@ The Gruntwork Infrastructure as Code Library (IaC Library) is a collection of reusable code that enables you to deploy and manage infrastructure quickly and reliably. It promotes code reusability, modularity, and consistency in infrastructure deployments. We’ve taken the thousands of hours we spent building infrastructure on AWS and condensed all that experience and code into pre-built packages or modules. -The library consists of two types of code: Modules & Services - ## Modules Modules are reusable code components that are used to deploy and manage specific pieces of infrastructure. These modules encapsulate the configuration and resource definitions required to create and manage a particular component, such as a VPC, ECS cluster, or an Auto Scaling Group. For more information on modules check out the [Modules page](/iac/overview/modules/). @@ -26,10 +24,12 @@ The Gruntwork IaC Library is deployed using the following tools: to package code as [Amazon Machine Images (AMIs)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html) that run on EC2 instances. Once you’ve built an AMI, you use Terraform to deploy it into AWS. +1. [Terratest](https://terratest.gruntwork.io/). Used for automated testing of modules and services. + diff --git a/docs/iac/overview/modules.md b/docs/iac/overview/modules.md index 3d57edc987..2db5020d65 100644 --- a/docs/iac/overview/modules.md +++ b/docs/iac/overview/modules.md @@ -1,12 +1,12 @@ # What is a Module? -Modules are reusable code components that encapsulate the configuration and resource definitions needed to deploy and manage a specific piece of infrastructure, such as a VPC, ECS cluster, or Auto Scaling Group. Each module defines several AWS resources. For example, the VPC module contains resource definitions for subnets, nat gateways, and more. Modules promote code reusability, modularity, and consistency in infrastructure deployments and can be customized in a variety of ways. +Modules are reusable code components that encapsulate the configuration and resource definitions needed to deploy and manage a specific piece of infrastructure, such as a VPC, ECS cluster, or Auto Scaling Group. Each module defines several AWS resources. For example, the VPC module contains resource definitions for subnets, NAT gateways, and more. Modules promote code reusability, modularity, and consistency in infrastructure deployments and can be customized in a variety of ways. Gruntwork modules are tested in AWS, in a randomly selected region, each time it changes to verify the infrastructure created matches the desired configuration. ## When should I use a module? -The Gruntwork Infrastructure as Code (IaC) Library contains hundreds of modules that you can use and combine. These modules are fairly generic building blocks, so you don’t typically deploy a single module directly. Instead, you write code that combines the modules you need for a specific use case. +The Gruntwork Infrastructure as Code (IaC) Library contains [hundreds of modules](/iac/reference/) that you can use and combine. These modules are fairly generic building blocks, so you don’t typically deploy a single module directly. Instead, you write code that combines the modules you need for a specific use case. For example, one module might deploy the control plane for Kubernetes and a separate module could deploy worker nodes; you may need to combine both modules together to deploy a Kubernetes cluster. @@ -25,6 +25,6 @@ The code in the module repos are organized into three primary folders: diff --git a/docs/iac/overview/services.md b/docs/iac/overview/services.md index 67e3b33970..2069a2adda 100644 --- a/docs/iac/overview/services.md +++ b/docs/iac/overview/services.md @@ -1,10 +1,10 @@ # What is a Service? -The Gruntwork Service Catalog consists of a number of customizable, production-grade infrastructure-as-code services that you can use to deploy and manage your infrastructure. This includes Docker orchestration, EC2 orchestration, load balancing, networking, databases, caches, monitoring, alerting, CI/CD, secrets management, VPN, and much more. +The Gruntwork Service Catalog consists of a number of customizable, production-grade infrastructure-as-code services that you can use to deploy and manage your infrastructure. This includes Docker orchestration, EC2 orchestration, load balancing, networking, databases, caches, monitoring, alerting, CI/CD, secrets management, VPN, and much more. Services combine multiple modules to configure an end-to-end solution. ## When should I use a service? -Services combine multiple modules to configure an end-to-end solution. These are designed for specific use cases such as EKS and ECS clusters, VPCs with public and private subnets, and databases. Using a service can save you time piecing together individual modules and testing that they’re correctly referencing each other. +Using a service can save you time piecing together individual modules and testing that they’re correctly referencing each other. These are designed for specific use cases such as EKS and ECS clusters, VPCs with public and private subnets, and databases. For example, the `eks-cluster` service combines all the modules you need to run an EKS (Kubernetes) cluster in a typical production environment, including modules for the control plane, worker nodes, secrets management, log aggregation, alerting, and so on. @@ -39,6 +39,6 @@ The code in the `terraform-aws-service-catalog` repo is organized into three pri From 01d3ac05fde9dd1afc5da8fff71f0f7bbff5cb59 Mon Sep 17 00:00:00 2001 From: Max Moon Date: Fri, 26 May 2023 05:33:13 -0700 Subject: [PATCH 71/89] Remove links to incomplete pages for IaC library docs (#830) * remove links to incomplete pages for iac library docs * remove file ext --- _docs-sources/iac/getting-started/deploying-a-module.md | 2 -- .../refarch/usage/maintain-your-refarch/extending.md | 4 ++-- docs/iac/getting-started/deploying-a-module.md | 4 +--- docs/refarch/usage/maintain-your-refarch/extending.md | 6 +++--- 4 files changed, 6 insertions(+), 10 deletions(-) diff --git a/_docs-sources/iac/getting-started/deploying-a-module.md b/_docs-sources/iac/getting-started/deploying-a-module.md index ab97257b23..41db109899 100644 --- a/_docs-sources/iac/getting-started/deploying-a-module.md +++ b/_docs-sources/iac/getting-started/deploying-a-module.md @@ -253,5 +253,3 @@ Finally, when prompted, enter `yes` to confirm the resource deletion. Terraform Now that you’ve developed and deployed your first Terraform module, try creating another module that leverages the module you just created. For example, make your Lambda function available via a URL using an [AWS API Gateway HTTP API](../../reference/modules/terraform-aws-lambda/api-gateway-proxy/) with an AWS Lambda integration. Then, write a test using [Terratest](https://terratest.gruntwork.io/) that confirms your module creates resources as you’d expect. Finally, consider what other resources you would create to make your modules ready to use in production. For example, you would likely need to add [metrics](../../reference/modules/terraform-aws-monitoring/metrics/metrics.md) and [alerting](../../reference/modules/terraform-aws-monitoring/alarms/alarms.md). - -In [Using a module](../usage/using-a-module.md), you’ll learn how to create the same resources defined in these modules using a pre-built Gruntwork module. diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/extending.md b/_docs-sources/refarch/usage/maintain-your-refarch/extending.md index 02b9117c57..0e664f5fd5 100644 --- a/_docs-sources/refarch/usage/maintain-your-refarch/extending.md +++ b/_docs-sources/refarch/usage/maintain-your-refarch/extending.md @@ -12,11 +12,11 @@ Your Reference Architecture is delivered as a collection of IaC code. You will g ## Use Gruntwork's services -Gruntwork provides a [_catalog_ of services](/iac/reference/) that can be added by directly referencing them in your terragrunt configuration. Check out the [Using a Service](/iac/usage/using-a-service) docs to learn how you can quickly start using our services in your own Reference Architecture. +Gruntwork provides a [_catalog_ of services](/iac/reference/) that can be added by directly referencing them in your terragrunt configuration. You can add these services to your architecture by creating references to them in the `_envcommon` directory, then each respective environment directory. ## Composing your own services -If Gruntwork doesn't already have the service you are looking you may be able to use our [modules](/iac/overview/modules) and [combine them into your own bespoke new services](/iac/usage/composing-your-own-service) to accelerate your development of the functionality you need. Please check out how you can start [using modules](/iac/usage/using-a-module). +If Gruntwork doesn't already have the service you are looking you may be able to use our [modules](../../../iac/overview/modules) and combine them into your own bespoke new services to accelerate your development of the functionality you need. ## Build your own modules diff --git a/docs/iac/getting-started/deploying-a-module.md b/docs/iac/getting-started/deploying-a-module.md index f8fdb27ef1..7cd856602a 100644 --- a/docs/iac/getting-started/deploying-a-module.md +++ b/docs/iac/getting-started/deploying-a-module.md @@ -254,12 +254,10 @@ Now that you’ve developed and deployed your first Terraform module, try creati Finally, consider what other resources you would create to make your modules ready to use in production. For example, you would likely need to add [metrics](../../reference/modules/terraform-aws-monitoring/metrics/metrics.md) and [alerting](../../reference/modules/terraform-aws-monitoring/alarms/alarms.md). -In [Using a module](../usage/using-a-module.md), you’ll learn how to create the same resources defined in these modules using a pre-built Gruntwork module. - diff --git a/docs/refarch/usage/maintain-your-refarch/extending.md b/docs/refarch/usage/maintain-your-refarch/extending.md index 767bb124c4..af1c9a922c 100644 --- a/docs/refarch/usage/maintain-your-refarch/extending.md +++ b/docs/refarch/usage/maintain-your-refarch/extending.md @@ -12,11 +12,11 @@ Your Reference Architecture is delivered as a collection of IaC code. You will g ## Use Gruntwork's services -Gruntwork provides a [_catalog_ of services](/iac/reference/) that can be added by directly referencing them in your terragrunt configuration. Check out the [Using a Service](/iac/usage/using-a-service) docs to learn how you can quickly start using our services in your own Reference Architecture. +Gruntwork provides a [_catalog_ of services](/iac/reference/) that can be added by directly referencing them in your terragrunt configuration. You can add these services to your architecture by creating references to them in the `_envcommon` directory, then each respective environment directory. ## Composing your own services -If Gruntwork doesn't already have the service you are looking you may be able to use our [modules](/iac/overview/modules) and [combine them into your own bespoke new services](/iac/usage/composing-your-own-service) to accelerate your development of the functionality you need. Please check out how you can start [using modules](/iac/usage/using-a-module). +If Gruntwork doesn't already have the service you are looking you may be able to use our [modules](../../../iac/overview/modules) and combine them into your own bespoke new services to accelerate your development of the functionality you need. ## Build your own modules @@ -26,6 +26,6 @@ If Gruntwork doesn't have existing modules for the AWS services that you are try From 13561336794c7eafae1cf0f2d33c962538aef044 Mon Sep 17 00:00:00 2001 From: Andrew Ellison Date: Fri, 26 May 2023 07:48:05 -0500 Subject: [PATCH 72/89] Address live review comments (#827) Co-authored-by: Eugene K --- _docs-sources/pipelines/how-it-works/index.md | 16 +++++++-------- _docs-sources/pipelines/overview/index.md | 18 +++++------------ docs/pipelines/how-it-works/index.md | 18 ++++++++--------- docs/pipelines/overview/index.md | 20 ++++++------------- sidebars/pipelines.js | 10 +++++----- 5 files changed, 33 insertions(+), 49 deletions(-) diff --git a/_docs-sources/pipelines/how-it-works/index.md b/_docs-sources/pipelines/how-it-works/index.md index c5a8cf321c..051d397032 100644 --- a/_docs-sources/pipelines/how-it-works/index.md +++ b/_docs-sources/pipelines/how-it-works/index.md @@ -4,7 +4,7 @@ ## External CI Tool -Gruntwork Pipelines has been validated with CircleCI, Github Actions, and Gitlab. However, it can be used with any external CI/CD tool. +Gruntwork Pipelines has been validated with [CircleCI](https://circleci.com/), [GitHub Actions](https://github.com/features/actions), and [GitLab](https://about.gitlab.com/). However, it can be used with any external CI/CD tool. The role of the CI/CD tool is to trigger jobs inside Gruntwork Pipelines. We have [example configurations](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/master/examples/for-production/infrastructure-live/_ci/scripts) that identify changed terraform modules and call the Gruntwork Pipelines invoker Lambda function. @@ -21,9 +21,9 @@ the logs back to your CI tool as if they were running locally. ### Infrastructure Deployer CLI -The [infrastructure deployer cli tool](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/infrastructure-deployer) +The [Infrastructure Deployer CLI tool](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/infrastructure-deployer) serves as the interface between your chosen CI tool and Gruntwork Pipelines. It is used to trigger -jobs in the deploy runner. Primarily, it calls instances of the invoker lambda described in the next section. +jobs in the deploy-runner. Primarily, it calls instances of the invoker lambda described in the next section. Usage: @@ -31,7 +31,7 @@ Usage: When launching a task, you may optionally set the following useful flags: -- `max-wait-time` (default 2h0m0s) — timeout length for the action +- `max-wait-time` (default 2h0m0s) — timeout length for the action, this can be any golang parseable string - `task-cpu` — A custom number of CPU units to allocate to the ECS task - `task-memory` — A custom number of memory units to allocate to the ECS task @@ -40,13 +40,13 @@ To get the list of supported containers and scripts, pass in the `--describe-con `infrastructure-deployer --describe-containers --aws-region us-west-2` This will list all the containers and the scripts for each container that can be invoked using the invoker function of -the ECS deploy runner stack deployed in us-west-2. +the ECS deploy runner stack deployed in `us-west-2`. ### Invoker Lambda -The [Invoker Lambda](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/main_lambda.tf) -is an AWS Lambda function written in python that acts as the AWS entrypoint for your pipeline. +The [Invoker Lambda](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/invoker-lambda/invoker/index.py) +is an AWS Lambda function written in Python that acts as the AWS entrypoint for your pipeline. It has 3 primary roles: 1. Serving as a gatekeeper for pipelines runs, determining if a particular command is allowed to be run, and if the arguments are valid @@ -57,7 +57,7 @@ It has 3 primary roles: The ECS deploy runner is flexible and can be configured for many tasks. The [standard configuration](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner-standard-configuration) is a set of ECS task definitions that we ship with Pipelines by default. -Once you have your pipeline deployed you can [modify](../maintain/extending.md) the configuration as you like. +Once you have your pipeline deployed you can [modify the ECS Deploy Runner configuration](../maintain/extending.md) as you like. The configuration defines what scripts are accepted by the invoker Lambda and which arguments may be provided. The invoker Lambda will reject _any_ script or argument not defined in the ECS Deploy Runner configuration. The default tasks are defined below. diff --git a/_docs-sources/pipelines/overview/index.md b/_docs-sources/pipelines/overview/index.md index 12f7f50586..a84abcf4ca 100644 --- a/_docs-sources/pipelines/overview/index.md +++ b/_docs-sources/pipelines/overview/index.md @@ -1,24 +1,16 @@ -# Overview +# What is Gruntwork Pipelines? Gruntwork Pipelines is a framework that enables you to use your preferred CI tool to -securely run an end-to-end pipeline for infrastructure code (Terraform) and -app code (Docker or Packer). Rather than replace your existing CI/CD provider, Gruntwork Pipelines is designed to enhance the security +securely run an end-to-end pipeline for infrastructure code ([Terraform](https://www.terraform.io/)) and +app code ([Docker](https://www.docker.com/) or [Packer](https://www.packer.io/)). Rather than replace your existing CI/CD provider, Gruntwork Pipelines is designed to enhance the security of your existing tool. -Because applying Terraform requires full access to your AWS environment, -your CI/CD tool would require admin level credentials to any AWS account where you deploy infrastructure. +Without Gruntwork Pipelines, CI/CD tools require admin level credentials to any AWS account where you deploy infrastructure. This makes it trivial for anyone with access to your CI/CD system to access AWS credentials with permissions greater than they might otherwise need. Gruntwork Pipelines allows a highly restricted set of permissions to be supplied to the CI/CD tool while -infrastructure related permissions reside within your own AWS account. This reduces the exposure of your +infrastructure related permissions reside safely within your own AWS account. This reduces the exposure of your high value AWS secrets. -## Features - -- Set up a secure Terraform or Terragrunt Pipeline based on best practices -- Run deployments using EC2 or Fargate on ECS -- Build Docker or Packer images -- Stream output logs to CloudWatch - diff --git a/docs/pipelines/how-it-works/index.md b/docs/pipelines/how-it-works/index.md index e6af1c6481..216b53a8c0 100644 --- a/docs/pipelines/how-it-works/index.md +++ b/docs/pipelines/how-it-works/index.md @@ -4,7 +4,7 @@ ## External CI Tool -Gruntwork Pipelines has been validated with CircleCI, Github Actions, and Gitlab. However, it can be used with any external CI/CD tool. +Gruntwork Pipelines has been validated with [CircleCI](https://circleci.com/), [GitHub Actions](https://github.com/features/actions), and [GitLab](https://about.gitlab.com/). However, it can be used with any external CI/CD tool. The role of the CI/CD tool is to trigger jobs inside Gruntwork Pipelines. We have [example configurations](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/master/examples/for-production/infrastructure-live/_ci/scripts) that identify changed terraform modules and call the Gruntwork Pipelines invoker Lambda function. @@ -21,9 +21,9 @@ the logs back to your CI tool as if they were running locally. ### Infrastructure Deployer CLI -The [infrastructure deployer cli tool](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/infrastructure-deployer) +The [Infrastructure Deployer CLI tool](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/infrastructure-deployer) serves as the interface between your chosen CI tool and Gruntwork Pipelines. It is used to trigger -jobs in the deploy runner. Primarily, it calls instances of the invoker lambda described in the next section. +jobs in the deploy-runner. Primarily, it calls instances of the invoker lambda described in the next section. Usage: @@ -31,7 +31,7 @@ Usage: When launching a task, you may optionally set the following useful flags: -- `max-wait-time` (default 2h0m0s) — timeout length for the action +- `max-wait-time` (default 2h0m0s) — timeout length for the action, this can be any golang parseable string - `task-cpu` — A custom number of CPU units to allocate to the ECS task - `task-memory` — A custom number of memory units to allocate to the ECS task @@ -40,13 +40,13 @@ To get the list of supported containers and scripts, pass in the `--describe-con `infrastructure-deployer --describe-containers --aws-region us-west-2` This will list all the containers and the scripts for each container that can be invoked using the invoker function of -the ECS deploy runner stack deployed in us-west-2. +the ECS deploy runner stack deployed in `us-west-2`. ### Invoker Lambda -The [Invoker Lambda](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/main_lambda.tf) -is an AWS Lambda function written in python that acts as the AWS entrypoint for your pipeline. +The [Invoker Lambda](https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/invoker-lambda/invoker/index.py) +is an AWS Lambda function written in Python that acts as the AWS entrypoint for your pipeline. It has 3 primary roles: 1. Serving as a gatekeeper for pipelines runs, determining if a particular command is allowed to be run, and if the arguments are valid @@ -57,7 +57,7 @@ It has 3 primary roles: The ECS deploy runner is flexible and can be configured for many tasks. The [standard configuration](https://github.com/gruntwork-io/terraform-aws-ci/tree/main/modules/ecs-deploy-runner-standard-configuration) is a set of ECS task definitions that we ship with Pipelines by default. -Once you have your pipeline deployed you can [modify](../maintain/extending.md) the configuration as you like. +Once you have your pipeline deployed you can [modify the ECS Deploy Runner configuration](../maintain/extending.md) as you like. The configuration defines what scripts are accepted by the invoker Lambda and which arguments may be provided. The invoker Lambda will reject _any_ script or argument not defined in the ECS Deploy Runner configuration. The default tasks are defined below. @@ -83,6 +83,6 @@ as the AMI builder. diff --git a/docs/pipelines/overview/index.md b/docs/pipelines/overview/index.md index 2c2ce04377..088062fa53 100644 --- a/docs/pipelines/overview/index.md +++ b/docs/pipelines/overview/index.md @@ -1,25 +1,17 @@ -# Overview +# What is Gruntwork Pipelines? Gruntwork Pipelines is a framework that enables you to use your preferred CI tool to -securely run an end-to-end pipeline for infrastructure code (Terraform) and -app code (Docker or Packer). Rather than replace your existing CI/CD provider, Gruntwork Pipelines is designed to enhance the security +securely run an end-to-end pipeline for infrastructure code ([Terraform](https://www.terraform.io/)) and +app code ([Docker](https://www.docker.com/) or [Packer](https://www.packer.io/)). Rather than replace your existing CI/CD provider, Gruntwork Pipelines is designed to enhance the security of your existing tool. -Because applying Terraform requires full access to your AWS environment, -your CI/CD tool would require admin level credentials to any AWS account where you deploy infrastructure. +Without Gruntwork Pipelines, CI/CD tools require admin level credentials to any AWS account where you deploy infrastructure. This makes it trivial for anyone with access to your CI/CD system to access AWS credentials with permissions greater than they might otherwise need. Gruntwork Pipelines allows a highly restricted set of permissions to be supplied to the CI/CD tool while -infrastructure related permissions reside within your own AWS account. This reduces the exposure of your +infrastructure related permissions reside safely within your own AWS account. This reduces the exposure of your high value AWS secrets. -## Features - -- Set up a secure Terraform or Terragrunt Pipeline based on best practices -- Run deployments using EC2 or Fargate on ECS -- Build Docker or Packer images -- Stream output logs to CloudWatch - @@ -27,6 +19,6 @@ high value AWS secrets. diff --git a/sidebars/pipelines.js b/sidebars/pipelines.js index 200e419c08..fb8681e733 100644 --- a/sidebars/pipelines.js +++ b/sidebars/pipelines.js @@ -14,6 +14,11 @@ const sidebar = [ type: "doc", id: "pipelines/overview/index" }, + { + label: "How it works", + type: "doc", + id: "pipelines/how-it-works/index", + }, ] }, { @@ -21,11 +26,6 @@ const sidebar = [ type: "category", collapsible: false, items: [ - { - label: "How it works", - type: "doc", - id: "pipelines/how-it-works/index", - }, { label: "Single Account Tutorial", type: "doc", From 472b32e7bf0e54a6da44b46871af4fecbd46a4c4 Mon Sep 17 00:00:00 2001 From: Eugene K Date: Fri, 26 May 2023 09:05:52 -0400 Subject: [PATCH 73/89] Turn on syntax highlighting for additional languages that we use. Those don't all come turned on by default in prism (which docusaurus uses under the hood). Some of the languages may be "default" already, but I tried to be more explicit. --- docusaurus.config.js | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/docusaurus.config.js b/docusaurus.config.js index a1e2c1f636..1e443f5057 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -102,22 +102,22 @@ const config = { { type: "doc", label: "Infrastructure as Code Library", - docId: "iac/overview/index" + docId: "iac/overview/index", }, { type: "doc", label: "Gruntwork Pipelines", - docId: "pipelines/overview/index" + docId: "pipelines/overview/index", }, { type: "doc", label: "Reference Architecture", - docId: "refarch/whats-this/what-is-a-reference-architecture" + docId: "refarch/whats-this/what-is-a-reference-architecture", }, { type: "doc", label: "Developer Portal", - docId: "developer-portal/create-account" + docId: "developer-portal/create-account", }, ], }, @@ -125,7 +125,6 @@ const config = { type: "doc", label: "Library Reference", docId: "iac/reference/index", - }, { to: "/tools", label: "Tools", position: "left" }, { to: "/courses", label: "Courses", position: "left" }, @@ -268,7 +267,7 @@ const config = { prism: { theme: lightCodeTheme, darkTheme: darkCodeTheme, - additionalLanguages: ["hcl"], + additionalLanguages: ["hcl", "python", "yaml", "json", "bash", "go"], }, algolia: algoliaConfig ? { From eec1f9df23c9e2234663380980f126174d5a13b7 Mon Sep 17 00:00:00 2001 From: Max Moon Date: Fri, 26 May 2023 06:06:31 -0700 Subject: [PATCH 74/89] Update IaC sections after live team feedback (#828) * address iac getting started feedback Co-authored-by: Eugene K --- .../iac/getting-started/accessing-the-code.md | 6 ++-- .../iac/getting-started/deploying-a-module.md | 31 ++++++++-------- .../iac/getting-started/setting-up.md | 4 ++- _docs-sources/iac/stay-up-to-date/updating.md | 2 +- .../iac/stay-up-to-date/versioning.md | 10 +++--- .../iac/getting-started/accessing-the-code.md | 8 ++--- .../iac/getting-started/deploying-a-module.md | 33 +++++++++--------- docs/iac/getting-started/setting-up.md | 6 ++-- docs/iac/stay-up-to-date/updating.md | 4 +-- docs/iac/stay-up-to-date/versioning.md | 12 ++++--- .../module_release_tag_versions.png | Bin 0 -> 15448 bytes 11 files changed, 61 insertions(+), 55 deletions(-) create mode 100644 static/img/iac/stay-up-to-date/versioning/module_release_tag_versions.png diff --git a/_docs-sources/iac/getting-started/accessing-the-code.md b/_docs-sources/iac/getting-started/accessing-the-code.md index a8fbdc23c5..eecdb8862f 100644 --- a/_docs-sources/iac/getting-started/accessing-the-code.md +++ b/_docs-sources/iac/getting-started/accessing-the-code.md @@ -1,9 +1,9 @@ # Accessing the code -Gruntwork provides all code included in your subscription to the Infrastructure as Code (IaC) library through GitHub. To gain access to the IaC Library, you must first [create an account in the Developer Portal](../../developer-portal/create-account.md). Once you have an account, you must [link your Github ID](../../developer-portal/link-github-id) to your Developer Portal account to gain access to the IaC Library. +Gruntwork provides all code included in your subscription to the Infrastructure as Code (IaC) library through GitHub. To gain access to the IaC Library, you must first [create an account in the Developer Portal](../../developer-portal/create-account.md). Once you have an account, you must [link your GitHub ID](../../developer-portal/link-github-id) to your Developer Portal account to gain access to the IaC Library. ## Accessing Modules and Services in the IaC library -Once you have gained access to the Gruntwork IaC library, you can view the source code for our modules and services in [Github](https://github.com/orgs/gruntwork-io/repositories). For a full list of modules and services, check the [Library Reference](../../iac/reference/index.md). +Once you have gained access to the Gruntwork IaC library, you can view the source code for our modules and services in [GitHub](https://github.com/orgs/gruntwork-io/repositories). For a full list of modules and services, check the [Library Reference](../../iac/reference/index.md). -In Github, each IaC repository is prefixed with `terraform-aws-` then a high level description of the modules it contains. For example, Amazon SNS, SQS, MSK, and Kinesis are located in the `terraform-aws-messaging` repository. In each repository, the modules are located in the `modules` directory. Example usage and tests are provided for each module in the `examples` and `tests` directories, respectively. +In GitHub, each IaC repository is prefixed with `terraform-aws-` then a high level description of the modules it contains. For example, Amazon SNS, SQS, MSK, and Kinesis are located in the `terraform-aws-messaging` repository. In each repository, the modules are located in the `modules` directory. Example usage and tests are provided for each module in the `examples` and `tests` directories, respectively. diff --git a/_docs-sources/iac/getting-started/deploying-a-module.md b/_docs-sources/iac/getting-started/deploying-a-module.md index 41db109899..9ed81cada7 100644 --- a/_docs-sources/iac/getting-started/deploying-a-module.md +++ b/_docs-sources/iac/getting-started/deploying-a-module.md @@ -2,8 +2,6 @@ [Modules](../overview/modules.md) allow you to define an interface to create one or many resources in the cloud or on-premise, similar to how in object oriented programming you can define a class that may have different attribute values across many instances. -Modules help keep your Terraform code DRY (Don’t Repeat Yourself), and speed up development time when creating new resources. - This tutorial will teach you how to develop a Terraform module that deploys an AWS Lambda function. We will create the required file structure, define an AWS Lambda function and AWS IAM role as code, then plan and apply the resource in an AWS account. Then, we’ll verify the deployment by invoking the Lambda using the AWS CLI. Finally, we'll clean up the resources we create to avoid unexpected costs. ## Prerequisites @@ -22,7 +20,7 @@ This module could be referenced many times to create any number of AWS Lambda fu ### Create a basic file structure First, create the directories and files that will contain the Terraform configuration. -```sh +```bash mkdir -p terraform-aws-gw-lambda-tutorial/modules/lambda touch terraform-aws-gw-lambda-tutorial/modules/lambda/main.tf touch terraform-aws-gw-lambda-tutorial/modules/lambda/variables.tf @@ -34,7 +32,7 @@ touch terraform-aws-gw-lambda-tutorial/modules/lambda/outputs.tf First, define the resources that should be created by the module. This is where you define resource level blocks provided by Terraform. For this module, we need an AWS Lambda function and an IAM role that will be used by the Lambda function. Paste the following snippet in `terraform-aws-gw-lambda/modules/lambda/main.tf`. -```hcl +```hcl title="terraform-aws-gw-lambda/modules/lambda/main.tf" resource "aws_iam_role" "lambda_role" { name = "${var.lambda_name}-role" @@ -80,7 +78,7 @@ Now that you’ve defined the resources you want to create, you need to list out Copy the following snippet into `terraform-aws-gw-lambda-tutorial/modules/lambda/variables.tf`. -```tf +```hcl title="terraform-aws-gw-lambda-tutorial/modules/lambda/variables.tf" variable "lambda_name" { type = string description = "Name that will be used for the AWS Lambda function" @@ -119,7 +117,7 @@ variable "timeout" { Terraform allows you to specify values that the module will output. Outputs are convenient ways to pass values between modules when composing a service comprised of many modules. Copy the following snippet into `terraform-aws-gw-lambda-tutorial/modules/lambda/outputs.tf`. -```tf +```hcl title="terraform-aws-gw-lambda-tutorial/modules/lambda/outputs.tf" output "function_name" { value = aws_lambda_function.lambda.function_name } @@ -134,7 +132,7 @@ Now that you have defined a module that creates an AWS Lambda function and IAM r Now that you have the module defined, you need to create files which will reference the module. Typically, you would create a module in one repository, then reference it in a different repository. For this tutorial, we’ll just create the reference in the top level directory for the sake of simplicity. Create a file called `main.tf`, which will contain a reference to the module, and a file called `main.py`, which will contain the Lambda function code. -```sh +```bash touch terraform-aws-gw-lambda-tutorial/main.tf touch terraform-aws-gw-lambda-tutorial/main.py ``` @@ -144,7 +142,8 @@ touch terraform-aws-gw-lambda-tutorial/main.py Next, we’ll write a simple Python function that returns a string that will be used as the entrypoint of the AWS Lambda function. Terraform will create a zip file containing this file that will be uploaded to the Lambda function. Copy the following to `terraform-aws-gw-lambda-tutorial/main.py`. -``` + +```py title="terraform-aws-gw-lambda-tutorial/main.py" def lambda_handler(event, context): return "Hello from Gruntwork!" ``` @@ -153,7 +152,7 @@ def lambda_handler(event, context): Next, create a reference to the module you just created in `/modules/lambda/main.tf`. This code uses the `module` block from Terraform, which references the `/modules/lambda` directory using the `source` attribute. You can then specify values for the required variables specified in `/modules/lambdas/variables.tf`. Finally, we specify an output using the value of the `module.lambda.function_name` output created in `/modules/lambdas/outputs.tf` -``` +```hcl title="terraform-aws-gw-lambda-tutorial/main.tf" terraform { required_providers { aws = { @@ -188,11 +187,11 @@ Running `terraform plan` is helpful when developing modules, to confirm that the From the `terraform-aws-gw-lambda-tutorial` directory, run a plan to see what resources will be created. -```sh +```bash terraform plan ``` -Review the output of `terraform plan`, it should contain two resources - an AWS Lambda function and an AWS IAM role. +Review the output of `terraform plan`, it should contain two resources — an AWS Lambda function and an AWS IAM role. ### Run Terraform apply @@ -201,7 +200,7 @@ Terraform creates resources when using the `apply` action in a directory contain From the `terraform-aws-gw-lambda-tutorial` directory, run `terraform apply`. Terraform will pause to show you the resources it will create and prompt you to confirm resource creation. -```sh +```bash terraform apply ``` @@ -212,14 +211,14 @@ Review the output to confirm it will only create an AWS Lambda function and IAM Next, invoke the AWS Lambda function to verify it was created and is successfully executing the application code. Use `terraform output` to retrieve the name of the AWS Lambda function you provisioned. This uses the outputs we added to the module in [create a module](./deploying-a-module.md#create-a-module) to retrieve the name of the Lambda function. Then, invoke the Lambda function directly using the AWS CLI, writing the response of the Lambda to a file called `lambda_output`. -```sh +```bash #!/bin/bash export FUNCTION_NAME=$(terraform output -raw function_name) aws lambda invoke --function-name $FUNCTION_NAME --output json lambda_output ``` The lambda `invoke` command should return a JSON blob in response with the StatusCode of 200 and the ExecutedVersion of `$LATEST`. -```sh +```json { "StatusCode": 200, "ExecutedVersion": "$LATEST" @@ -233,7 +232,7 @@ Inspect the contents of the `lambda_output` file, you should see a string statin When you’ve completed the tutorial, clean up the resources you created to avoid incurring unexpected costs. First, execute the `terraform plan -destroy` command to show the AWS resources that will be destroyed. -```sh +```bash terraform plan -destroy ``` @@ -241,7 +240,7 @@ Review the output, it should show two resources to be destroyed — an AWS Lambd Next, execute the `destroy` command. -```sh +```bash terraform destroy ``` diff --git a/_docs-sources/iac/getting-started/setting-up.md b/_docs-sources/iac/getting-started/setting-up.md index 6cf61a7c5b..4f22ca88ed 100644 --- a/_docs-sources/iac/getting-started/setting-up.md +++ b/_docs-sources/iac/getting-started/setting-up.md @@ -20,9 +20,11 @@ If you want to skip immediately to learning, you can learn how to [deploy your f ## Terragrunt -Terragrunt is a tool developed by Gruntwork that provides extra tools for keeping your Terraform configurations DRY, working with multiple Terraform modules, and managing remote state. Terragrunt allows you to execute multiple Terraform commands at once, centrally manage your Terraform state configuration, and set repeatable CLI arguments. Since Terraform is a dependency of Terragrunt, you can continue to write modules for Terraform in the Terraform configuration language, then reference and re-use the modules in different environments or applications. +[Terragrunt](https://terragrunt.gruntwork.io) is a tool developed by Gruntwork that provides extra tools for keeping your Terraform configurations DRY, working with multiple Terraform modules, and managing remote state. Terragrunt allows you to execute multiple Terraform commands at once, centrally manage your Terraform state configuration, and set repeatable CLI arguments. Since Terraform is a dependency of Terragrunt, you can continue to write modules for Terraform in the Terraform configuration language, then reference and re-use the modules in different environments or applications. +:::info Terragrunt is not a required tool to use the IaC library, but it does provide many convenience features on top of Terraform. If you are using the Gruntwork [Reference Architecture](../../refarch/whats-this/what-is-a-reference-architecture), Terragrunt is a requirement. +::: ### Installation Terragrunt is supported on Mac (x86 and Apple Silicon), Windows, and Linux. To install Terragrunt, follow the guide on how to [install Terragrunt](https://terragrunt.gruntwork.io/docs/getting-started/install/) on the Terragrunt website. diff --git a/_docs-sources/iac/stay-up-to-date/updating.md b/_docs-sources/iac/stay-up-to-date/updating.md index a356637dac..28299fbe22 100644 --- a/_docs-sources/iac/stay-up-to-date/updating.md +++ b/_docs-sources/iac/stay-up-to-date/updating.md @@ -10,7 +10,7 @@ Below is a module block referencing version `0.15.3` of the `single-server` subm To update to version `0.15.4`, you update the value to the right of `ref=` in the source attribute. Since the version number denotes that this update is backwards compatible, it should not require any other changes. -```tf +```hcl module "my_instance" { # Old # source = "git::git@github.com:gruntwork-io/terraform-aws-server.git//modules/single-server?ref=v0.15.3" diff --git a/_docs-sources/iac/stay-up-to-date/versioning.md b/_docs-sources/iac/stay-up-to-date/versioning.md index 423ecf3cc8..35601ca3b3 100644 --- a/_docs-sources/iac/stay-up-to-date/versioning.md +++ b/_docs-sources/iac/stay-up-to-date/versioning.md @@ -5,7 +5,9 @@ Gruntwork versions the IaC library using [Semantic Versioning](https://semver.or - MINOR version when we make backward incompatible API changes, and - PATCH version when we add backward compatible functionality or bug fixes -For modules that have submodules (e.g., terraform-aws-server/modules/single-server), not every release contains changes to every module. While using the latest available version is recommended, the version that most recently contains changes for a module can be found in each submodule's reference in the [Library Reference](../reference/index.md). +For modules that have submodules (e.g., terraform-aws-server/modules/single-server), not every release contains changes to every module. While using the latest available version is recommended, the version that most recently contains changes for a module can be found in each submodule’s reference in the [Library Reference](../reference/index.md). + +![Submodules show the last version in which they were modified](/img/iac/stay-up-to-date/versioning/module_release_tag_versions.png) We release new module versions using GitHub releases, refer to the release notes in the GitHub repository release page for a list of changes and migration guides (when necessary). @@ -14,7 +16,7 @@ We release new module versions using GitHub releases, refer to the release notes The git tag created by the release can then be referenced in the source argument for a module block sourcing from a git URL. For example, below is a module block referencing version `0.15.4` of the `single-server` submodule from the `terraform-aws-server` module. -```tf +```hcl module "my_instance" { source = "git::git@github.com:gruntwork-io/terraform-aws-server.git//modules/single-server?ref=v0.15.4" @@ -29,6 +31,6 @@ module "my_instance" { } ``` -## What's next +## What’s next -Once you start using versioned modules, it's important to keep the modules up to date. Refer to the [Updating](./updating.md) guide to learn more. +Once you start using versioned modules, it’s important to keep the modules up to date. Refer to the [Updating](./updating.md) guide to learn more. diff --git a/docs/iac/getting-started/accessing-the-code.md b/docs/iac/getting-started/accessing-the-code.md index 380859cc4b..1ba5be8b6f 100644 --- a/docs/iac/getting-started/accessing-the-code.md +++ b/docs/iac/getting-started/accessing-the-code.md @@ -1,17 +1,17 @@ # Accessing the code -Gruntwork provides all code included in your subscription to the Infrastructure as Code (IaC) library through GitHub. To gain access to the IaC Library, you must first [create an account in the Developer Portal](../../developer-portal/create-account.md). Once you have an account, you must [link your Github ID](../../developer-portal/link-github-id) to your Developer Portal account to gain access to the IaC Library. +Gruntwork provides all code included in your subscription to the Infrastructure as Code (IaC) library through GitHub. To gain access to the IaC Library, you must first [create an account in the Developer Portal](../../developer-portal/create-account.md). Once you have an account, you must [link your GitHub ID](../../developer-portal/link-github-id) to your Developer Portal account to gain access to the IaC Library. ## Accessing Modules and Services in the IaC library -Once you have gained access to the Gruntwork IaC library, you can view the source code for our modules and services in [Github](https://github.com/orgs/gruntwork-io/repositories). For a full list of modules and services, check the [Library Reference](../../iac/reference/index.md). +Once you have gained access to the Gruntwork IaC library, you can view the source code for our modules and services in [GitHub](https://github.com/orgs/gruntwork-io/repositories). For a full list of modules and services, check the [Library Reference](../../iac/reference/index.md). -In Github, each IaC repository is prefixed with `terraform-aws-` then a high level description of the modules it contains. For example, Amazon SNS, SQS, MSK, and Kinesis are located in the `terraform-aws-messaging` repository. In each repository, the modules are located in the `modules` directory. Example usage and tests are provided for each module in the `examples` and `tests` directories, respectively. +In GitHub, each IaC repository is prefixed with `terraform-aws-` then a high level description of the modules it contains. For example, Amazon SNS, SQS, MSK, and Kinesis are located in the `terraform-aws-messaging` repository. In each repository, the modules are located in the `modules` directory. Example usage and tests are provided for each module in the `examples` and `tests` directories, respectively. diff --git a/docs/iac/getting-started/deploying-a-module.md b/docs/iac/getting-started/deploying-a-module.md index 7cd856602a..a8610ec3d1 100644 --- a/docs/iac/getting-started/deploying-a-module.md +++ b/docs/iac/getting-started/deploying-a-module.md @@ -2,8 +2,6 @@ [Modules](../overview/modules.md) allow you to define an interface to create one or many resources in the cloud or on-premise, similar to how in object oriented programming you can define a class that may have different attribute values across many instances. -Modules help keep your Terraform code DRY (Don’t Repeat Yourself), and speed up development time when creating new resources. - This tutorial will teach you how to develop a Terraform module that deploys an AWS Lambda function. We will create the required file structure, define an AWS Lambda function and AWS IAM role as code, then plan and apply the resource in an AWS account. Then, we’ll verify the deployment by invoking the Lambda using the AWS CLI. Finally, we'll clean up the resources we create to avoid unexpected costs. ## Prerequisites @@ -22,7 +20,7 @@ This module could be referenced many times to create any number of AWS Lambda fu ### Create a basic file structure First, create the directories and files that will contain the Terraform configuration. -```sh +```bash mkdir -p terraform-aws-gw-lambda-tutorial/modules/lambda touch terraform-aws-gw-lambda-tutorial/modules/lambda/main.tf touch terraform-aws-gw-lambda-tutorial/modules/lambda/variables.tf @@ -34,7 +32,7 @@ touch terraform-aws-gw-lambda-tutorial/modules/lambda/outputs.tf First, define the resources that should be created by the module. This is where you define resource level blocks provided by Terraform. For this module, we need an AWS Lambda function and an IAM role that will be used by the Lambda function. Paste the following snippet in `terraform-aws-gw-lambda/modules/lambda/main.tf`. -```hcl +```hcl title="terraform-aws-gw-lambda/modules/lambda/main.tf" resource "aws_iam_role" "lambda_role" { name = "${var.lambda_name}-role" @@ -80,7 +78,7 @@ Now that you’ve defined the resources you want to create, you need to list out Copy the following snippet into `terraform-aws-gw-lambda-tutorial/modules/lambda/variables.tf`. -```tf +```hcl title="terraform-aws-gw-lambda-tutorial/modules/lambda/variables.tf" variable "lambda_name" { type = string description = "Name that will be used for the AWS Lambda function" @@ -119,7 +117,7 @@ variable "timeout" { Terraform allows you to specify values that the module will output. Outputs are convenient ways to pass values between modules when composing a service comprised of many modules. Copy the following snippet into `terraform-aws-gw-lambda-tutorial/modules/lambda/outputs.tf`. -```tf +```hcl title="terraform-aws-gw-lambda-tutorial/modules/lambda/outputs.tf" output "function_name" { value = aws_lambda_function.lambda.function_name } @@ -134,7 +132,7 @@ Now that you have defined a module that creates an AWS Lambda function and IAM r Now that you have the module defined, you need to create files which will reference the module. Typically, you would create a module in one repository, then reference it in a different repository. For this tutorial, we’ll just create the reference in the top level directory for the sake of simplicity. Create a file called `main.tf`, which will contain a reference to the module, and a file called `main.py`, which will contain the Lambda function code. -```sh +```bash touch terraform-aws-gw-lambda-tutorial/main.tf touch terraform-aws-gw-lambda-tutorial/main.py ``` @@ -144,7 +142,8 @@ touch terraform-aws-gw-lambda-tutorial/main.py Next, we’ll write a simple Python function that returns a string that will be used as the entrypoint of the AWS Lambda function. Terraform will create a zip file containing this file that will be uploaded to the Lambda function. Copy the following to `terraform-aws-gw-lambda-tutorial/main.py`. -``` + +```py title="terraform-aws-gw-lambda-tutorial/main.py" def lambda_handler(event, context): return "Hello from Gruntwork!" ``` @@ -153,7 +152,7 @@ def lambda_handler(event, context): Next, create a reference to the module you just created in `/modules/lambda/main.tf`. This code uses the `module` block from Terraform, which references the `/modules/lambda` directory using the `source` attribute. You can then specify values for the required variables specified in `/modules/lambdas/variables.tf`. Finally, we specify an output using the value of the `module.lambda.function_name` output created in `/modules/lambdas/outputs.tf` -``` +```hcl title="terraform-aws-gw-lambda-tutorial/main.tf" terraform { required_providers { aws = { @@ -188,11 +187,11 @@ Running `terraform plan` is helpful when developing modules, to confirm that the From the `terraform-aws-gw-lambda-tutorial` directory, run a plan to see what resources will be created. -```sh +```bash terraform plan ``` -Review the output of `terraform plan`, it should contain two resources - an AWS Lambda function and an AWS IAM role. +Review the output of `terraform plan`, it should contain two resources — an AWS Lambda function and an AWS IAM role. ### Run Terraform apply @@ -201,7 +200,7 @@ Terraform creates resources when using the `apply` action in a directory contain From the `terraform-aws-gw-lambda-tutorial` directory, run `terraform apply`. Terraform will pause to show you the resources it will create and prompt you to confirm resource creation. -```sh +```bash terraform apply ``` @@ -212,14 +211,14 @@ Review the output to confirm it will only create an AWS Lambda function and IAM Next, invoke the AWS Lambda function to verify it was created and is successfully executing the application code. Use `terraform output` to retrieve the name of the AWS Lambda function you provisioned. This uses the outputs we added to the module in [create a module](./deploying-a-module.md#create-a-module) to retrieve the name of the Lambda function. Then, invoke the Lambda function directly using the AWS CLI, writing the response of the Lambda to a file called `lambda_output`. -```sh +```bash #!/bin/bash export FUNCTION_NAME=$(terraform output -raw function_name) aws lambda invoke --function-name $FUNCTION_NAME --output json lambda_output ``` The lambda `invoke` command should return a JSON blob in response with the StatusCode of 200 and the ExecutedVersion of `$LATEST`. -```sh +```json { "StatusCode": 200, "ExecutedVersion": "$LATEST" @@ -233,7 +232,7 @@ Inspect the contents of the `lambda_output` file, you should see a string statin When you’ve completed the tutorial, clean up the resources you created to avoid incurring unexpected costs. First, execute the `terraform plan -destroy` command to show the AWS resources that will be destroyed. -```sh +```bash terraform plan -destroy ``` @@ -241,7 +240,7 @@ Review the output, it should show two resources to be destroyed — an AWS Lambd Next, execute the `destroy` command. -```sh +```bash terraform destroy ``` @@ -258,6 +257,6 @@ Finally, consider what other resources you would create to make your modules rea diff --git a/docs/iac/getting-started/setting-up.md b/docs/iac/getting-started/setting-up.md index 1ea95a38e2..4df2aec007 100644 --- a/docs/iac/getting-started/setting-up.md +++ b/docs/iac/getting-started/setting-up.md @@ -20,9 +20,11 @@ If you want to skip immediately to learning, you can learn how to [deploy your f ## Terragrunt -Terragrunt is a tool developed by Gruntwork that provides extra tools for keeping your Terraform configurations DRY, working with multiple Terraform modules, and managing remote state. Terragrunt allows you to execute multiple Terraform commands at once, centrally manage your Terraform state configuration, and set repeatable CLI arguments. Since Terraform is a dependency of Terragrunt, you can continue to write modules for Terraform in the Terraform configuration language, then reference and re-use the modules in different environments or applications. +[Terragrunt](https://terragrunt.gruntwork.io) is a tool developed by Gruntwork that provides extra tools for keeping your Terraform configurations DRY, working with multiple Terraform modules, and managing remote state. Terragrunt allows you to execute multiple Terraform commands at once, centrally manage your Terraform state configuration, and set repeatable CLI arguments. Since Terraform is a dependency of Terragrunt, you can continue to write modules for Terraform in the Terraform configuration language, then reference and re-use the modules in different environments or applications. +:::info Terragrunt is not a required tool to use the IaC library, but it does provide many convenience features on top of Terraform. If you are using the Gruntwork [Reference Architecture](../../refarch/whats-this/what-is-a-reference-architecture), Terragrunt is a requirement. +::: ### Installation Terragrunt is supported on Mac (x86 and Apple Silicon), Windows, and Linux. To install Terragrunt, follow the guide on how to [install Terragrunt](https://terragrunt.gruntwork.io/docs/getting-started/install/) on the Terragrunt website. @@ -42,6 +44,6 @@ If you’re ready to get started with creating and deploying a module, jump to [ diff --git a/docs/iac/stay-up-to-date/updating.md b/docs/iac/stay-up-to-date/updating.md index cefa6bc443..a74745ec52 100644 --- a/docs/iac/stay-up-to-date/updating.md +++ b/docs/iac/stay-up-to-date/updating.md @@ -10,7 +10,7 @@ Below is a module block referencing version `0.15.3` of the `single-server` subm To update to version `0.15.4`, you update the value to the right of `ref=` in the source attribute. Since the version number denotes that this update is backwards compatible, it should not require any other changes. -```tf +```hcl module "my_instance" { # Old # source = "git::git@github.com:gruntwork-io/terraform-aws-server.git//modules/single-server?ref=v0.15.3" @@ -39,6 +39,6 @@ Keeping track of all references to modules and services is a complicated, error diff --git a/docs/iac/stay-up-to-date/versioning.md b/docs/iac/stay-up-to-date/versioning.md index fae7340975..068cbfc8c4 100644 --- a/docs/iac/stay-up-to-date/versioning.md +++ b/docs/iac/stay-up-to-date/versioning.md @@ -5,7 +5,9 @@ Gruntwork versions the IaC library using [Semantic Versioning](https://semver.or - MINOR version when we make backward incompatible API changes, and - PATCH version when we add backward compatible functionality or bug fixes -For modules that have submodules (e.g., terraform-aws-server/modules/single-server), not every release contains changes to every module. While using the latest available version is recommended, the version that most recently contains changes for a module can be found in each submodule's reference in the [Library Reference](../reference/index.md). +For modules that have submodules (e.g., terraform-aws-server/modules/single-server), not every release contains changes to every module. While using the latest available version is recommended, the version that most recently contains changes for a module can be found in each submodule’s reference in the [Library Reference](../reference/index.md). + +![Submodules show the last version in which they were modified](/img/iac/stay-up-to-date/versioning/module_release_tag_versions.png) We release new module versions using GitHub releases, refer to the release notes in the GitHub repository release page for a list of changes and migration guides (when necessary). @@ -14,7 +16,7 @@ We release new module versions using GitHub releases, refer to the release notes The git tag created by the release can then be referenced in the source argument for a module block sourcing from a git URL. For example, below is a module block referencing version `0.15.4` of the `single-server` submodule from the `terraform-aws-server` module. -```tf +```hcl module "my_instance" { source = "git::git@github.com:gruntwork-io/terraform-aws-server.git//modules/single-server?ref=v0.15.4" @@ -29,14 +31,14 @@ module "my_instance" { } ``` -## What's next +## What’s next -Once you start using versioned modules, it's important to keep the modules up to date. Refer to the [Updating](./updating.md) guide to learn more. +Once you start using versioned modules, it’s important to keep the modules up to date. Refer to the [Updating](./updating.md) guide to learn more. diff --git a/static/img/iac/stay-up-to-date/versioning/module_release_tag_versions.png b/static/img/iac/stay-up-to-date/versioning/module_release_tag_versions.png new file mode 100644 index 0000000000000000000000000000000000000000..009d5071e04a253390bae300cb91f60ce057dce3 GIT binary patch literal 15448 zcmc(`gHD4U zJ?FXi54g#b?8%;4Yi8E$y=UgPRz9k!$f2W^f&U-8UO$s5SG>lBf`G-?cOc` z04T*aQc`Mfq@*BfE{>Kqb`}7D{Ku43BrRNB!obzh{GAU+$cQw51?%R#LH7ay2*g%68$QXL)#Jimy&WL<3g zyY93<9Q*CGxv~N9xa4RR!u|l|aV?{y+LrewIjh|su{r^uH2{DIgI}r_4dYslcyza8 zB*F)fIo&u$XZG~)^1_57?2kwYU?BSAWrWC&{%3R7>nHw4ZlHLndaHv+p>^VK^|v_R zkn?=45^;+@cqMKY-5n&WdNH5^(Dd+wM%N>8fskKnLL$+hBm1e?#TO(8alz`@qjRrV zS+gR}sgh&WD6xl=&WO(fJ|^8Zrk_ovld0q-7ujau1V=!ml81+$#2PmP6!l8YEz#lK z5|VmFbBj}DZVn|BTD~TSodrp7v#crKsX8b2(wl}i6PM2uZ#xS==DTXbKUoP#to5b# z51B`dbBOhD+lBY-dUU(<@}lZdf13cnAp1$_$Q{_+WDoByCE zaj`E^&F0xRxAEby#b|2r7uT~!Wgu(T=M21Kn(tZMpT&#^zrvyR0M+?;;7`j~JZ z&9z)$`%xpL;Q3L@u|$N1SxJx|S0tgd=~BIhM|2MG9OY5zk5 zpjSV^?BX|D*hmg|eTnw zSs@kTA`?=@lq5kblEzRFU5`Q)q8(s7f|vvMI;3a4&x!g6+RqTwb#x~L19-~d&+D$I zytiyiNFAXASb>8Orbs^1a1Ja2oX}osa zCp$^YPlTUdZJ}?$Z+V($_5BxSftzDO=gR;|&}b=7TPQT3>|OR=jx zWL=nZk$&y>x^M}nS-9Dy+02E1%V-Gq5BiqwIoX}|x%N5zpOcYzMm2mE{9wE(JOz9V zCIfY%x4q0H4BkxVc&PX{Oxf?qa;UWonWBdaDhiIj8RcUzttX?U%qt8jyi$lrX-Sby z!B4SIrb%&4E=yKrzA1q)Au`#eXr;t5$!Q;#_-1_LjCdU(X7%)?|8?WGuU1yse&O&t z*0=T=ZDsc|u@&1Tsd){$-(`+I3d$}^i%5&;`=#B>T)lHm*%lo8^OH5($L*MgM2R~$ zY%2BF^;Ch_rp@eR^G@g9xWO>wy@p(;TtNk4H76WOHrB|OUY z!u=DUJ)Tsa;t|6U)e#TS^w7f5wb2*CKZK))x5?tsy!&P$%PZ>{2xcy85cejj`-01f%oG0^QW4Fn|w4=fb=OnUcv1Ue16?e$#M8+zKh%hiQCKDw0+4)y+KX776%7c4G1 zQ{R(9TYon6Tz}4L%bKs4bm%o27ya43_$(^*5qp%u!oZ_but})gL*UQp!sJiRUuVUe zUsWts7*&w6!U>7k*4XD8p`E$|8Jj-_n#aSAadysY6~C4>Fb~xCUuAr*ARYfcYaeMd zs$@xF+V0WlMA-V(>1EKx{JVL*4}@ZcqK{%ZJ1QGHJ0)AS&Fu$H8_5sZHv6_TpT-BM z-=iBiB4{t=~&cr%4mwuTZyubckbo0hK5bv9IHYd4(K+@!ToEJ7cT(zJnZ#Vz&(Sd#jqGv2j3xhm#rn62yk+ zb=~g7SPw;nKIs_A4NnPA3K>w2R?g@V=Vqkso4=e;9A_La#hjRtU$A#x6Y=|>_7wJS z-tXDQ+8n*!^QrkZR&vx^x!pk_P~ca(Uw6J2Yb9@mGOqMxOh{;!?R|hd+u4%%z*OA8 z&bRT^W-OQ7hrHFkk+dIdStsTm*=>iuchmR-%=DF96%7Wpt+PuOzuh-lj;?T*J(kD# z4;|}P+?p0eF>)jvtoYlB%$gU^HJ^3*r z)Yf({eb1-J`|`~hzm#8JdGTrSN=1wBDQ3p;>PzB{7;l2?)8}WxUS_zGL^G;V*wXc_ zh0YsGWn};pEDZ(#BWwU5SnBW6mIU?z0N@kD0Z6bT4(ubH1NYxtIA9L^f71Z{zXc^U zrQW=O9W~8dEG!&ctsUKXZO5r$s%C7oblh~5l?2Tk?b%Gs9ZfCRyzHI+iU5SY1Yt>g z3pW#pm%W{XtDu(%^*<#9Vd=l8*{LD_6mhc^q1I7WgGf2LSU~vLIM_I-MNuFSh_H*f zrJ#ni?Ei?veu+?9ySX_Dva@@7da`+PvpKq0v2(tD{hFPFi=B&$6;^`P^@D?(i5IJb zE6snD{8x{(g{zs1jgy;=qXXoxUK3MCcQ+Ag>c18J`}$8iExc_0wcukD$)~3i5Jt|6j@f zlk@+U)ONLSk#e+$)#xVrzXS6>!v8n(e*}fu|91TU7~(%x{^u;r%%Uj5?Eem#CyF{+w3>y{t zCL!b?+SBc?9BH4&jxG6z=ss_KIr-hj^*nwkBIrrp4yLA)4aA0mh=8y|qzAY+(t~Cj z$PE_*py>p2z{Lbg2ZjNR!2kUz&La~T7HBPaCT#bw7%U(D|Hu5!k5vC{z79w<;91Gv z-+$}mL{(rQVyGQE5}O8beRFqLUPVRae5u{X?uRGFBa&o)(0c1XZJs9q8XFsTBaMD# zbfE#5KrBbo&v7$kyCucVGg*(BVMdTf2IcHM+}?6r#N*TwdtqTA8Wu60x6zI(x)J&3z!lt5v)K2*n5|A?tOB)<7lf0E-LU^SZIm=@4(=Ii-`gmIEg4i zwZWZNX5+0QI^e4Jg0H#%8Kqg8PENqA89|D|{KcbOI+oMzAa-}e$G^iGR2&0v1jY>4 z+AhpjAxs-B!(mf{V#xV}NS^1V{hfaH{vBj-EtyUu%4c>(& z_xYyos$(wotr^eiJ_7sR@B*gnFQsMQi>a@1$Ns8F4Q<~dJjF7G2^?;WMK8W-BDL`t zX!Y>3-A^2q&31UMuZ+dl?S9=UC8-^F6GEZO!jWD!n0W=Q$gWaC<)`XQ2IL^(QUnJU z7157<=2zvlsoe}Hd#m|?K|VAxqHnvo)O<1BX2mY(vQ_LcPN9N9A*hs6Hk(sxHU1Gi z%RXHpMc?9dmbXyxU9T-%Hjc!eFaA5uT!lV6s~jo6J;rqJE~i-m;9_kZekhblyF_KK z!Z7Uv2c^%=F>10H3!9e+g6!Gs_upErDt;}VC)oyy%RZNRhOIZCpLocXlHB8|dcf0n zz*;%6Pot}SGeL33esV&yAf2lzbEn+V*9JZK&4j9t*0aU*m-}H~p)JPNN8M>Pj_Zra zA^j9y{(0`v#)&&ujwiaOgo}>>uErBX@J5KuM;B95S6JC?n1ob-=YTfU&S}6Wq!0Eo zds78T+7S_u1YX6ri#6_Le91Gmvl=TuKGfNM5oZcjb9(H3<4iHn5|$Qq_`C6|%2!dE z=P%vr%t(!arVdSa8-0o`e!n#p`GuRk_7crc!*86Q9{W(=|E>^G{>m2?{`@+9vHmHR z&(T2cwd+>GLN%1?M_^ECAFA?WcNnVM%QL*7`+XhVu5iG!fu7j0m>0C1@rZ)wHmlX+ zS1c)iosU4!!sS+pW}VFifiC<0_4PBIbjj$!tYgkfn>Q9ufK=(bMhy48rH_{5UsS?S z3G-53zH^P@6waxeh)B2w+@5|4AITE(M0T}_8vR~0rr)4(W-4RTN%{0gZ?VcBJ%vqM zqYUNXX=1%6ln>t|j!Jk9e6S$(snB?J(DUiueT>}l4Y@aS!h3q2fr-)D0{tF}l{;z5 zA7YwMv&UL>1_tkE*^obI#nZQv3#p(fqzkNdtUy@-A>oV!B_dF8mcM+JB61=u^lS=c@!#_+~ zd41hKI-Dj=oec_8gq+XuuJ)JZT34!F>0?PmWLw|T>)4SCdK8MikjbJFuqJk=tVb)T zpsd4pD|At!6q|(SdL{&={MRJX;A#h?*vA7wLc++*015P>Qu>d#n@9n z6@AtJl`9po+qn9BGXKqs_0^s#WCD-XDC%vcuGCn-dzrR}%U_8?o_n&Ig(^i!roKAd zioNN^9T;S*r?+Qj-mjd>^o#fm+q{)ci?yLn8`%ul63}X1nd>Va#}zoeI<~13x$hZ2Y%S}M;5uQn+H~*^@EPc(J&ms`ZTkL z?$M~kg}7h*6^bxFOom%jTK_uF=}4j-GDD&2k~0g9Q^D9Uyan>zjvO2$@AgVOpy6JuyZ$U+>33%NBPq4BFd4CV4B}`3)iMga>bJx5jttU z*{M2e9s&F_wkC!BpGILlvja2k|s~psew*;7fry3)87U*AoriZf;&|gJMMff z8IVG!Oj5D{;W!>nDbvb#GEx34d-QD}u0RqYAP2iAVyJ(y;Y9vLDMO*n`#OhnvmY6~ zGPa-Ofh4nl6LX98$cX%rm^0br1a6X+6iE*f;lQ?ludU1pRQlL;-+`!dh1N~n6YtB!=tn# zgHVCK*K?u$pKHbKN-_pwPvlcbX%o;KmA*!3mHQg_sefpT4axIq3usi3SkB^8LL!~ODV#^zJxl!f!B;E}w5Z1ojthnfnZ z?(vo5_^quCl8{avP72Vgyh=jV51Pl4z&qHL_O|rlo`r=-*QI$%+r(xtStPZN&wQLP zI$I3Gi2sxvvk zYjHkpu&PW@vk8Jd!TS3#=#2B_O)@~PO}wdaW>*WFBGyyT^ivZlTl?8MWLEul$%B35 z+^~>!=2ErxFVm0Ce*0TC`*SCs8&0I_>dxWrHPuy13QaNw*UhYnsxe&@pEmoP}T8w{E)`KJjv^k;gh6ScjH*vz)zg82J zYO%@zy+9>vu_{X5hn#p8x6}StAuq4PRAeffp~}m{mFNAp0OR+UW>Sm-h032(r@ce< zcTd-8BqtQ#G*yBC)4;}`_pzh}Sb(ldkE6^cdu{R>aoUIB^sy8{GzBX7TaOAqWzSGL zqZ_Lm$Tz3hBS;1l4i3F%p6dYo=%z#PWGTaSyeP00XkZp#c37Gx#4oCF)4eDI)N6?! zJYY0{hdz1-1JrY*$*^N?jC3fC)C#ZtX-s2~dK zJYks_Q53mQD#w*oZbQdQ;hz{n_H2*1q#t>zs9|M*ZB2^?ZDMFwU<2R&3HEf6rz$ZR zoK((9@+$ZoONhhyQ6P#?)f$bsRz67TD}U$M8pN-|c@xo^{&cxe^=q8zK%DZ`{> z^Cbai#(*H-ZW25QZK>dzT)XQHn|7s1<8UK*AiJodYN6;`+{N4GVl+2sR4!Jknf)3Qyn3zT& z(hVwfZn4E?x<##I>JKQvDdLli>jRFnb=71CGT6*HgA$K=IbFe~eNnG?{d@V>D5wXk zQ!1rDZfJmEwNf4}wWrLM8@++Qzd=1WUaI2JD%A<{w^>$rNXE0^w_nW5j7~5!H&%UJ zV^wsqGd}XV>q|G+x533L9*y2Y$SEeMKY}R1ZEtGGwtV2|x2IYZ-q0U!rEFp1=4J$N z8&}9N>Wv~EJ6-TcdX27NgnHlE>D)3lB^4>b@l?^v@n{{uZB56s0r>aa#w#}*i7ttZ zrV=1k6{~Yi`gEZc*Zp@@u3^nx(srnef?0UqdXy7Yui~!!F?BJ99(Q_Cwnv2z4Lp)F zrk~{U@tZFUh0sDQH7w5rd4sa^LNEQ6QMRe?PTP@A2w)(bxjlJJLKoo@B~jAUt+vbl z<JeFw2e^)+#nDqR7F@(L4HTiQ0Ld^CNkLH zy~ixc0$k^5fQ)&0dk_0GGyrxH_mzUx1+)XtRa zhP9c4E);fBc;_uaf zf~b^I4Ow-HR+K`O3?*W2^NIc7H~v4%iKh!}J(;xfo6M(&66tb3;`XbTYL$cnu;ujN zCti32e|cxrQ1Aq-OO|T4Qd}J_WM%R@%7#RseOqwdR^L|20Q-R~hSNW-wE5A~JeR#K zQPQMS&3{V`Knn`0^6l(SV75}pAT(oCAC`*a|Kuc;%%mQyS7%N4>ojZ`u-xh~S>ddq z4n;hO5;e|2<7X{9f+hqM%mu1cem$cvY1|Bu3m+ zlzreqT6?|-=}N-IJ6CV`YRyg(IH~qm*CR9x7<3;vY^;wnq_qMTW7yoRAB2V?72n0G z9)vPOeP84xt(_9Pfuon+vT z$Vj9MS#v%x3Gsf=TgUWwDP7oak$lk%5$F2=w&9%K)Nq(duN3K$)Ce39(yy;ViGaeO z6jXrCuG!=5S-rD~B2h5qKrA^cE7^R@t>(yV@EaC9I5j#ycV7xLI4VQc$OZA3NUAV% zk*?JfhycnGTzIGs_91|yz7Xw#v=t*-FlNR!+UNG^!$n0WpQ51_O+RV;IINm#tD8C zpr0+%`<{Ren2q(NpHK_keOG-D^T1*?}h#Aw^FB#};aO)sI z6X=O?xY+jjG?7+1#uHB;4VxE6x1>ElRrWJZjWMkKpfQT$&!?(p743qO z)UPxCA$nD^fD_ElxS-Q{L84i|o%>OmK!~`HCvaB|)_e+d(SI5NA;S*T22c_pc4NDd z@*-?wj)`$uzj%Xnz!TrPcK(5u(g3(Bw6(EJEJUX`%p^aWK&Y5+=i?cQhY!XxcLXge zaC>5%=f9K}f3}1YH?MZVD!-m5`#A$A>fndpcx$yp@9RMuTX4V1dJnZ!0u7IIqCP$qAW0z2J zxVNZ4Cm;tW9Ci?(vMo|P>$mwour_c;5}*&vJ9nu%sXkk*J-J(7fysz(Np-%bf}Ep& z@)`ZFAvxgs|Js&_$v6IAyCH(5^{CdKT0Pw!2Tjg@_>FAXc;9V=v0SV@i$sq&$;v{w zAgA|Nwt`M;fV;c9Fk8=)rDmxj)vtUDmR>gl=5j3ZkxG8`P=POD*i~TQfJ89M@Evc` zE9^x%42qm@5txxU#td(!%!5kB+#iX^1*_6T?{C$jl1tzUbX}b{?|JuEzoFhmM;NV} z_OUW~@Aq<&2HPTg%7>fd#M)?X7^f&tQNJzX{TktAF-o9M>?xX%eG10w7?d-42-2!=VzRTddHn9(O4V|M)4xubneTbs z9Q~GixH&1BDo{jXbh+BsCJ}IgSd65`;=EG8qg~E+@O`}f!XS6XdaL|!e?MHK!~FB-s{eS` zRoJg@6mVT)?ou4v%R&uPU4A}{`f*=)-ftv}^D1TW#8HTNiEF=~&hr(+Lrbo|+j+8tR#uj+P5T#tF4qHZj!oy5yCK!qZ@Q zlgd&>jWuhA9DQ$KU{LIPcdh}2rIlu?Ek+0ye|+FBQ2m+wFU~(J_RUD>;>&vx6b8{!eXrzX8rq_C=^1r@~8_=5^5+e z6+j^PjZwQ-5QUhx{E%jT@`O=`w+sqE9+fprhJ5zgQtdo&4_JKaZ7k zR#Q@F&ShF4cS!XsPqxd}u(JK4dw#6#+sW-K+c0ff%9KlnvKj=z6&#X_j3oL{<$>EW zsg&{@Rwy62J_9akns8Iu?smb^5YIF#aJ=8WJ_t&_1ZdOnvw ziG*q!kJXd18wr={H#&GpVQ*Z&pDxDUs7b{OMSvbH)=xJ&8ry`mxE~P2lJG{IZ;vS= z?!Otw28QZynDDBeqRP|t+fX}zW z-nW4++drjP^ETE)VXF>;| zd1LzZxdCZxc`fLqNpj8SdVYSb?uixA?IGdAK7>EB3Q`maf2E8NGD`I;X|;C6YZc1} z@;y{G1>AOuk_a3+lJK9ix41nEE2r}@CzP2U^j{@P)Z1Nro}SWwSutwj^FWcX%z8rw zc<9_eKlg|efD!6%lh1y;NQx)6k64e)0V^f=Iry(T8t_s7}-Q(rf znzlTdXpJmE_k3tH>1l}L?}k`5!xosCC$>(-pH4bn%%4Bv(ks-m)|DqS!h@h0kao-Q zY-M6Db8!AsEV~#;WKLt zCBCX}=@QQwf`gCg`LaiBmhsw^&V6@6Vq3`LFr6i$y+XfHB@TZcw&l=$EHtyVU)$Om zO485_vyfr8R)Xyzg@uK|?!M2Dx?D4wMJjLB%fy4=v?`56#=e8L=j&`V7pu*Xs8k=W zj~L%1($?Ahq8kF4=#76B6N7DJG+WdXC^yHlgc=W{ODWNCyA9*WUYkFaRuZkk+#e8l&r0Il!MF$ebJqpC7fi5AEAvOgz<1?x!LeCMp9)ARkvoXD`;bH90 z&D3pt|4NzYiC+W{=o1!2P*hu_G9_-}A?8U3Sp$ppuZJLErKf+^CmVjZhO}7iUdzN5 ze;U8s;%tZl&$RyZ;Ca4s@Q!`vJ4CKd#AZ}JYVVK*6t+L*&6#iPcn|T1h9@7`l6Bpx z(||Vh-fM-RSG4;CSBobQ-^&@hxVsl=cw+^&rz`8j+fhLmJtbmW+U?n99@3gtW%7sH%Zzyw^5Rmzb8oK zn%KaGB5hB6*XJLK=~C*tg!vGD=)AY$7@w^)Htr7#Tp(np!1}CFpnyNb5_8veCLZzf zRuwbU2ThM0d~jQ+g9^LGzSUTaOjUL~Gi5BoE)rf;c#7vFI%S-L6Y_f7IhAYdQC-yu zu1^^2xmM%ZE*1DRoHKKnk__-k2#7EzRN?!X(#cF-TQD3DOaz_ zDpel;do9MlW$Nq0>N@qPgvdAt!%HG!Ux!b;wvKn&0 z5YxJ>z=uZ$3%u=ZXHCn&wJg&DVQ{94wS0XRn;#+xr$=5nQyJJaSZ00W&b6lU{yrCb zwc~)X?z)f1vtLV3I3Uh^kX7%A8gAPl-!ixw^lsHPH{)r(F02ahn5T`2+PmmIWAdN~=S;#ceMXbug{7uB$f(VKbzYAM5c)&S(brXP%Q` zGy>lsiC4;*THBxtxL*jk(v+P%t6)!*^wuc_lVJ*ehc9or>vRhyH|U52iG;V2{Pct|A?2lpfqI-r@h0uLdfMrRE5jMh=F6C3=W}`ckMs&>1X*f^>x9Pz1yY3-kB_ zIqg~usZL{l7e~Tl4XtAV@f~gvaXDat?$>^L}Kfr ziIpySC=dV-Ph|{e!qwsZC(+lM3JVkTi=RMrFj3wmV{$a@{X^}9uj~u2^mb?!T#Mg< zB^DLn=JV4dYD%R+3LiK?aC8@H3XUTcb1$qDgtDYg&o#*eMuXgg71CJccE+<)yH!3; zS%8ID))HZTtF6oH#91R4P|o}VuMin9hdYaUsi_*9`DCsI5T}45N=T|cKl{UJBHc}{ zHeUXaNV25vhhYA}pCz{YO~&uiRObf$$*hgKZ)V8j$tU7-A1bSIEBF430_hp0 zmRGHWop{yJokSA)VXxpSu)*Z%@%uAnBjvly+grUKanD0OS0!{V20BwuV1lCKvN=4t zEk_f&QHkh4ucqzgizzz@!PHSW^eQZd-15Irf%hLey#j?oWu64ok@htY3}-$bB#4fz zg$I|(rbJA@jUaivX8>x{e_H~;*7B*Y<;NGFV52GomY09QlG<1(`XohhMaX_c6)-x0L7AvDrO9yvn<<70&vL}EsO7J42Ws${ zZ8(8k>b`wgW}Gs|8&rtOOTT|Bj+`q9Z{gCp5T-}iF*Y?d4I5IVbN9Z{D$~}V_4`w{ zR>*sK1qzCU)+`G>s<<E$8*S&z!v&4p?@?HZt(Op{ksZ- zDb+Z;NN#Y2p`klLR%RJy3;~^^b<2C^FQ)DL&AImlaSd^pSss&ZnSa^ZQCQ`quJ z1GY!`gEUL4g9*XolraX`St6??q<&Y^y&ta@P(&@<-o(wZDRZ-aQc>XydwEE1dG&M; zz8v{-<+FF8(Ta*igv2cX#*`6xbw4~{`XwxTA$RnA^eh1nX_Svdge(wjDzRg^d)t=tSY#`oKM}-@h*kw40U&sVJPa~_3F)ur8;V> z+q>s5zLPDsXEzU`v^PXwDx@%#=<|tmuf`630BuXuMywjz-0m`$dpOzZ*naFH>-5`L zU(e0BL1#q-uZ83QzZ*BhcUG+@ayAx>lRl55rc+cSs z`bzC9;@NoHCeUd&x%7I`2qZ7keYCzbGO07(e>bo_wC%amG!I6g{Z)_k_DD|2jMP}9QogU497T(*q9>Gk~o}JqXhHkz)1o$cFx0NJ5H-Y#k607 z!jXOnaYzWBhIf!w0A)CeLb{mjv0{K|_@l^{9%S17W}_mCsVs?;-NKm4XbuQcK?L^e z2*TFzl%UM6A7$y-)cv{ZG}Pp8fuQm|QSbdoZ?SaiB+}paj(0 z8a~uxy#t9xY8f0A!eOcicM*&gh#5*EbJ`_^)#>l4gCfq+)8l6rHDRS=pNxe_1?T#m zf2XVl>m1@{LJtZBCNEc+g!sO|Z_r3e?usojgX2I)%dPKbV-3+EO+tk#S*6Hf>1NQ% zV0`CZ-uvLYAQ^Z`;(h=XX3*EjAhqticF}Sq9feEEa(z%G2`-6w#4WQP1nQ~?P?P5P z`ue`j%&O$WAs+TiZPAm|@y8^!)}PD8OYd%g!B(eS+3G!rirenDo&M{e9a%>Qf)2i` zH@2I{VBt&^DymA!#uTm?3cXjh!UKv<)Tn+HmatOEO8C98=zh%PcM$nj?v!eDBdoXK z)gi_NQo}kD_twcIkKZ|{+VMI6(nm^vn5pi-!SCMIQcCgQmtcWV*Q}Ja7_@>_uW_;< zVZQKPkZ+%q$wJ;8kG-ilfXJx-LQ?*vidsjq$^ea6RN1#leqE1t7qZnO_G=mc!jYe6GrY{@xJVgu7YxK33qa_oHaef@GN%$lmXG zshJCmNoQy0JdJc}B0_q=?13-}3j%DxQNyq|MI}oI`;Jv9u;@1^HK0qty@ltn*2gAd z^L^@+ANQ>;3`A})h$H5f{fS@IEzs2&i=9rtjT+>fE;PMIRSrxylahRb?Sc~}NrJf~ z(vd*CaM1}^+sHxT^L)rajB!jmeXUt^u=f1a$FqLy3ROG%ULOR!^(;8ZC8|C)HfG>a zz78{y{$icYAAL;DMo7>7mh!VH2o1{#3$vab@n+OW)PK{SPlV^=Eq0G|7LV?PNJBB9 zVb~o>yM20jEcWB_iqT5)t?gxHwXhR$=Ms8A1NC(5!}0OQ0=lweQX&7lbKNaJ+Aw_0 z%B8wOQ8WAW)`(>U=xi!iKu-%^+{Yx^8Krq9%uq^U>6|frsVe!~yL)1HnjhFCBn@!; z%4xIH-^V`-`%jP~-CtG-M$Cpq)Om}O&Y~WXX9}-iLIv0gx~RtRa#=>F!Y$Sx!U0^q zw@yRgPAsK1KP(bRot~MWcx$>Enedrk)i-t$kCnnBlzI)avX{tW zblVG(-W6|l{)g3fBLmBpfj?CWjb(9F{I)Ig7~y_g=k4`gRKcq5wEU~1*ZCtOwVwSf zWkotRM-*U|Y?cD|KUiISo(fto1b{)zXu<^F%K}yZ=R*>3Yx7!W3 zuoLI=k6YxgXCM>>hUO&^CrbF&|Lad!Y2M8KHy}M%5*Bx@)-@3J-}-_EqhZwl mljm{Mf4mxhk$y4Otyt~~TVnn1p(p_C^+rZTx Date: Fri, 26 May 2023 09:28:50 -0400 Subject: [PATCH 75/89] Added docker to be syntax highlighted --- docusaurus.config.js | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/docusaurus.config.js b/docusaurus.config.js index 1e443f5057..77509dbe34 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -267,7 +267,15 @@ const config = { prism: { theme: lightCodeTheme, darkTheme: darkCodeTheme, - additionalLanguages: ["hcl", "python", "yaml", "json", "bash", "go"], + additionalLanguages: [ + "hcl", + "python", + "yaml", + "json", + "bash", + "go", + "docker", + ], }, algolia: algoliaConfig ? { From 6d0b0da31583af75b6fb02c988e50b27ff4f8a2a Mon Sep 17 00:00:00 2001 From: Eugene K Date: Fri, 26 May 2023 09:54:57 -0400 Subject: [PATCH 76/89] Updated the staying up to date section to fill in instructions from our existing docs. --- .../staying-up-to-date.md | 18 ++++++++++++++++- .../staying-up-to-date.md | 20 +++++++++++++++++-- 2 files changed, 35 insertions(+), 3 deletions(-) diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/staying-up-to-date.md b/_docs-sources/refarch/usage/maintain-your-refarch/staying-up-to-date.md index 9a7bc47b48..00144fbd05 100644 --- a/_docs-sources/refarch/usage/maintain-your-refarch/staying-up-to-date.md +++ b/_docs-sources/refarch/usage/maintain-your-refarch/staying-up-to-date.md @@ -10,4 +10,20 @@ It is important to regularly update your version of Terraform to ensure you have Neglecting regular updates may lead to increased complexity and difficulty when attempting to upgrade from multiple versions behind. This was particularly true during the pre-1.0 era of Terraform where significant changes and breaking modifications were more frequent. -https://github.com/tfutils/tfenv +The test pipeline's workhorse, the ECS Deploy Runner, includes a Terraform version manager, +[`tfenv`](https://github.com/tfutils/tfenv), so that you can run multiple versions of Terraform with your +`infrastructure-live` repo. This is especially useful when you want to upgrade Terraform versions. + +1. You'll first need to add a `.terraform-version` file to the module directory of the module you're upgrading. +1. In that file, specify the Terraform version as a string, e.g. `1.0.8`. Then push your changes to a branch. +1. The test pipeline will detect the change to the module and run `plan` on that module. When it does this, it will + use the Terraform version you specified in the `.terraform-version` file. +1. If the `plan` output looks good and there are no issues, you can approve and merge to your default protected branch. Once the code is merged, the changes will be `apply`ed + using the newly specified Terraform version. + + :::info + + The `.tfstate` state file will be written in the version specified by the `.terraform-version` file. You can verify this by viewing the state file in the S3 + bucket containing all your Reference Architecture's state files. + + ::: diff --git a/docs/refarch/usage/maintain-your-refarch/staying-up-to-date.md b/docs/refarch/usage/maintain-your-refarch/staying-up-to-date.md index f117b28746..d3be91ad30 100644 --- a/docs/refarch/usage/maintain-your-refarch/staying-up-to-date.md +++ b/docs/refarch/usage/maintain-your-refarch/staying-up-to-date.md @@ -10,12 +10,28 @@ It is important to regularly update your version of Terraform to ensure you have Neglecting regular updates may lead to increased complexity and difficulty when attempting to upgrade from multiple versions behind. This was particularly true during the pre-1.0 era of Terraform where significant changes and breaking modifications were more frequent. -https://github.com/tfutils/tfenv +The test pipeline's workhorse, the ECS Deploy Runner, includes a Terraform version manager, +[`tfenv`](https://github.com/tfutils/tfenv), so that you can run multiple versions of Terraform with your +`infrastructure-live` repo. This is especially useful when you want to upgrade Terraform versions. + +1. You'll first need to add a `.terraform-version` file to the module directory of the module you're upgrading. +1. In that file, specify the Terraform version as a string, e.g. `1.0.8`. Then push your changes to a branch. +1. The test pipeline will detect the change to the module and run `plan` on that module. When it does this, it will + use the Terraform version you specified in the `.terraform-version` file. +1. If the `plan` output looks good and there are no issues, you can approve and merge to your default protected branch. Once the code is merged, the changes will be `apply`ed + using the newly specified Terraform version. + + :::info + + The `.tfstate` state file will be written in the version specified by the `.terraform-version` file. You can verify this by viewing the state file in the S3 + bucket containing all your Reference Architecture's state files. + + ::: From e27e5337ca2b8aaa385b64c9e1f6460c1c437dd1 Mon Sep 17 00:00:00 2001 From: Eugene K Date: Fri, 26 May 2023 10:23:41 -0400 Subject: [PATCH 77/89] Updated to remove the issues page for now. Also updated iac sidebar to hide pages with missing content. --- _docs-sources/iac/support/contributing.md | 52 +++++++++++++++++++++- _docs-sources/iac/support/issues.md | 3 -- docs/iac/support/contributing.md | 54 +++++++++++++++++++++-- docs/iac/support/issues.md | 11 ----- sidebars/iac.js | 10 ++--- 5 files changed, 106 insertions(+), 24 deletions(-) delete mode 100644 _docs-sources/iac/support/issues.md delete mode 100644 docs/iac/support/issues.md diff --git a/_docs-sources/iac/support/contributing.md b/_docs-sources/iac/support/contributing.md index 0202938475..fec7088fca 100644 --- a/_docs-sources/iac/support/contributing.md +++ b/_docs-sources/iac/support/contributing.md @@ -1,3 +1,51 @@ -# Contributing +--- +sidebar_label: "Contributing" +--- -See something you want that isn't available? Make a PR! +# Contributing to the Gruntwork Infrastructure as Code Library + +Contributions to the Gruntwork Infrastructure as Code Library are very welcome and appreciated! If you find a bug or want to add a new +feature or even contribute an entirely new module, we are very happy to accept +[pull requests](https://help.github.com/articles/about-pull-requests/), provide feedback, and run your changes through +our automated test suite. + +This section outlines the process for contributing. + +## File a GitHub issue + +Before starting any work, we recommend filing a GitHub issue in the appropriate repo. This is your chance to ask +questions and get feedback from the maintainers and the community before you sink a lot of time into writing (possibly +the wrong) code. If there is anything you’re unsure about, just ask! + +## Update the documentation + +We recommend updating the documentation _before_ updating any code (see +[Readme Driven Development](http://tom.preston-werner.com/2010/08/23/readme-driven-development.html)). This ensures the +documentation stays up to date and allows you to think through the problem at a high level before you get lost in the +weeds of coding. + +## Update the tests + +We also recommend updating the automated tests _before_ updating any code (see +[Test Driven Development](https://en.wikipedia.org/wiki/Test-driven_development)). That means you add or update a test +case, verify that it’s failing with a clear error message, and then make the code changes to get that test to pass. +This ensures the tests stay up to date and verify all the functionality in the repo, including whatever new +functionality you’re adding in your contribution. The `test` folder in every repo will have documentation on how to run +the tests locally. + +## Update the code + +At this point, make your code changes and use your new test case to verify that everything is working. + +## Create a pull request + +[Create a pull request](https://help.github.com/articles/creating-a-pull-request/) with your changes. Please make sure +to include the following: + +1. A description of the change, including a link to your GitHub issue. +2. Any notes on backwards incompatibility. + +## Merge and release + +The maintainers for the repo will review your code and provide feedback. If everything looks good, they will merge the +code and release a new version. diff --git a/_docs-sources/iac/support/issues.md b/_docs-sources/iac/support/issues.md deleted file mode 100644 index d1700cf372..0000000000 --- a/_docs-sources/iac/support/issues.md +++ /dev/null @@ -1,3 +0,0 @@ -# Submitting Issues - -You can submit issues on Github! diff --git a/docs/iac/support/contributing.md b/docs/iac/support/contributing.md index 442cad8b4c..f64bddceb3 100644 --- a/docs/iac/support/contributing.md +++ b/docs/iac/support/contributing.md @@ -1,11 +1,59 @@ -# Contributing +--- +sidebar_label: "Contributing" +--- -See something you want that isn't available? Make a PR! +# Contributing to the Gruntwork Infrastructure as Code Library + +Contributions to the Gruntwork Infrastructure as Code Library are very welcome and appreciated! If you find a bug or want to add a new +feature or even contribute an entirely new module, we are very happy to accept +[pull requests](https://help.github.com/articles/about-pull-requests/), provide feedback, and run your changes through +our automated test suite. + +This section outlines the process for contributing. + +## File a GitHub issue + +Before starting any work, we recommend filing a GitHub issue in the appropriate repo. This is your chance to ask +questions and get feedback from the maintainers and the community before you sink a lot of time into writing (possibly +the wrong) code. If there is anything you’re unsure about, just ask! + +## Update the documentation + +We recommend updating the documentation _before_ updating any code (see +[Readme Driven Development](http://tom.preston-werner.com/2010/08/23/readme-driven-development.html)). This ensures the +documentation stays up to date and allows you to think through the problem at a high level before you get lost in the +weeds of coding. + +## Update the tests + +We also recommend updating the automated tests _before_ updating any code (see +[Test Driven Development](https://en.wikipedia.org/wiki/Test-driven_development)). That means you add or update a test +case, verify that it’s failing with a clear error message, and then make the code changes to get that test to pass. +This ensures the tests stay up to date and verify all the functionality in the repo, including whatever new +functionality you’re adding in your contribution. The `test` folder in every repo will have documentation on how to run +the tests locally. + +## Update the code + +At this point, make your code changes and use your new test case to verify that everything is working. + +## Create a pull request + +[Create a pull request](https://help.github.com/articles/creating-a-pull-request/) with your changes. Please make sure +to include the following: + +1. A description of the change, including a link to your GitHub issue. +2. Any notes on backwards incompatibility. + +## Merge and release + +The maintainers for the repo will review your code and provide feedback. If everything looks good, they will merge the +code and release a new version. diff --git a/docs/iac/support/issues.md b/docs/iac/support/issues.md deleted file mode 100644 index 6f3145139b..0000000000 --- a/docs/iac/support/issues.md +++ /dev/null @@ -1,11 +0,0 @@ -# Submitting Issues - -You can submit issues on Github! - - - diff --git a/sidebars/iac.js b/sidebars/iac.js index 73bf90bc8b..2b188f5cb4 100644 --- a/sidebars/iac.js +++ b/sidebars/iac.js @@ -29,10 +29,10 @@ const sidebar = [ type: "category", collapsible: false, items: [ - "iac/usage/using-a-module", - "iac/usage/using-a-service", - "iac/usage/customizing-modules", - "iac/usage/composing-your-own-service", + // "iac/usage/using-a-module", + // "iac/usage/using-a-service", + // "iac/usage/customizing-modules", + // "iac/usage/composing-your-own-service", "guides/working-with-code/tfc-integration", ], }, @@ -49,7 +49,7 @@ const sidebar = [ label: "Support", type: "category", collapsible: false, - items: ["iac/support/issues", "iac/support/contributing"], + items: ["iac/support/contributing"], }, ], }, From 66cef51ed83bd38a2bca654a195c22a3825b411f Mon Sep 17 00:00:00 2001 From: Max Moon Date: Fri, 26 May 2023 07:39:56 -0700 Subject: [PATCH 78/89] Finish caution for installing tools manually (#832) --- _docs-sources/refarch/configuration/install-required-tools.md | 2 +- docs/refarch/configuration/install-required-tools.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/_docs-sources/refarch/configuration/install-required-tools.md b/_docs-sources/refarch/configuration/install-required-tools.md index ed915bccb6..4f91a3625d 100644 --- a/_docs-sources/refarch/configuration/install-required-tools.md +++ b/_docs-sources/refarch/configuration/install-required-tools.md @@ -20,7 +20,7 @@ In addition to installing dependencies, the bootstrap script will: ## Install manually :::caution -We do not recommend this approach. TODO: Finish this section +We do not recommend this approach. The bootstrap script performs several checks to ensure you have all tools and access required to configure your Reference Architecture. You will need to perform these checks manually if installing tools manually. ::: If you prefer to install your tools manually, see the following sections on installing Git and the Gruntwork CLI. diff --git a/docs/refarch/configuration/install-required-tools.md b/docs/refarch/configuration/install-required-tools.md index b8d4147efc..ff47e9022b 100644 --- a/docs/refarch/configuration/install-required-tools.md +++ b/docs/refarch/configuration/install-required-tools.md @@ -20,7 +20,7 @@ In addition to installing dependencies, the bootstrap script will: ## Install manually :::caution -We do not recommend this approach. TODO: Finish this section +We do not recommend this approach. The bootstrap script performs several checks to ensure you have all tools and access required to configure your Reference Architecture. You will need to perform these checks manually if installing tools manually. ::: If you prefer to install your tools manually, see the following sections on installing Git and the Gruntwork CLI. @@ -33,6 +33,6 @@ If you prefer to install your tools manually, see the following sections on inst From 10522efa98eb20e4e38dedc52302c06b4f9ac22c Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Fri, 26 May 2023 07:42:11 -0700 Subject: [PATCH 79/89] fix oxford comma --- .../refarch/usage/maintain-your-refarch/monitoring.md | 2 +- docs/refarch/usage/maintain-your-refarch/monitoring.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/_docs-sources/refarch/usage/maintain-your-refarch/monitoring.md b/_docs-sources/refarch/usage/maintain-your-refarch/monitoring.md index d6531df06d..7fdf492614 100644 --- a/_docs-sources/refarch/usage/maintain-your-refarch/monitoring.md +++ b/_docs-sources/refarch/usage/maintain-your-refarch/monitoring.md @@ -1,4 +1,4 @@ -# Monitoring, Alerting and Logging +# Monitoring, Alerting, and Logging You'll want to see what's happening in your AWS account: diff --git a/docs/refarch/usage/maintain-your-refarch/monitoring.md b/docs/refarch/usage/maintain-your-refarch/monitoring.md index b11c4930b1..fb046cda3c 100644 --- a/docs/refarch/usage/maintain-your-refarch/monitoring.md +++ b/docs/refarch/usage/maintain-your-refarch/monitoring.md @@ -1,4 +1,4 @@ -# Monitoring, Alerting and Logging +# Monitoring, Alerting, and Logging You'll want to see what's happening in your AWS account: @@ -50,6 +50,6 @@ your servers in near-real-time. From 1350fcbcb2ffd82a56e51ac7c1ba9b366a5724ea Mon Sep 17 00:00:00 2001 From: Eugene K Date: Fri, 26 May 2023 10:48:09 -0400 Subject: [PATCH 80/89] Reworded to make clearer --- _docs-sources/intro/overview/what-you-provide.md | 2 +- docs/intro/overview/what-you-provide.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/_docs-sources/intro/overview/what-you-provide.md b/_docs-sources/intro/overview/what-you-provide.md index 80b3ca2a1b..271cd5cdf3 100644 --- a/_docs-sources/intro/overview/what-you-provide.md +++ b/_docs-sources/intro/overview/what-you-provide.md @@ -12,7 +12,7 @@ With Gruntwork, you can accelerate your journey towards capturing your AWS cloud ## Implement the “last mile” -Gruntwork products strike a balance between opinionatedness and configurability. They’ll get you most of the way to your goal, but you may need to make some customizations to suit your use case. You may also need to adapt your apps and services to run in your new infrastructure by customizing/adding additional Infrastructure as Code to customize according to the requirements for your company. Our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) and [Community Slack Channel](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) provide great resources to assist you in this effort. +Gruntwork products strike a balance between being opinionated and configurable. They’ll get you most of the way to your goal, but you may need to make some customizations to suit your use case. You may also need to adapt your apps and services to run in your new infrastructure by customizing/adding additional Infrastructure as Code to customize according to the requirements for your company. Our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) and [Community Slack Channel](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) provide great resources to assist you in this effort. If you notice a limitation or bug in Gruntwork modules, we greatly appreciate and welcome [customer PRs](/iac/support/contributing) or you raising this to our attention via [bug or feature requests](/iac/support/issues). diff --git a/docs/intro/overview/what-you-provide.md b/docs/intro/overview/what-you-provide.md index c1922e595b..76181f907a 100644 --- a/docs/intro/overview/what-you-provide.md +++ b/docs/intro/overview/what-you-provide.md @@ -12,7 +12,7 @@ With Gruntwork, you can accelerate your journey towards capturing your AWS cloud ## Implement the “last mile” -Gruntwork products strike a balance between opinionatedness and configurability. They’ll get you most of the way to your goal, but you may need to make some customizations to suit your use case. You may also need to adapt your apps and services to run in your new infrastructure by customizing/adding additional Infrastructure as Code to customize according to the requirements for your company. Our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) and [Community Slack Channel](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) provide great resources to assist you in this effort. +Gruntwork products strike a balance between being opinionated and configurable. They’ll get you most of the way to your goal, but you may need to make some customizations to suit your use case. You may also need to adapt your apps and services to run in your new infrastructure by customizing/adding additional Infrastructure as Code to customize according to the requirements for your company. Our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) and [Community Slack Channel](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) provide great resources to assist you in this effort. If you notice a limitation or bug in Gruntwork modules, we greatly appreciate and welcome [customer PRs](/iac/support/contributing) or you raising this to our attention via [bug or feature requests](/iac/support/issues). @@ -54,6 +54,6 @@ Once deployed, Gruntwork hands the Reference Architecture over to your team. You From 37c3769cb5790bff415d7eafb3ba58ec5ede336c Mon Sep 17 00:00:00 2001 From: Oreoluwa Agunbiade <21035422+oredavids@users.noreply.github.com> Date: Fri, 26 May 2023 08:52:10 -0600 Subject: [PATCH 81/89] [CORE-926] Add knowledge-base sidebar link to Pipelines and RefArch (#829) * Add knowledge-base sidebar link to Pipelines and Refarch * Updated `_docs-sources` with this contribution and regenerated output. --------- Co-authored-by: Eugene K Co-authored-by: Eugene Kolnick <34349331+eak12913@users.noreply.github.com> Co-authored-by: docs-sourcer[bot] <99042413+docs-sourcer[bot]@users.noreply.github.com> --- .../developer-portal/create-account.md | 2 +- _docs-sources/developer-portal/invite-team.md | 2 +- .../developer-portal/link-github-id.md | 4 +- .../intro/overview/what-you-provide.md | 2 +- docs/developer-portal/create-account.md | 4 +- docs/developer-portal/invite-team.md | 4 +- docs/developer-portal/link-github-id.md | 6 +- docs/intro/overview/what-you-provide.md | 4 +- sidebars/developer-portal.js | 6 +- sidebars/pipelines.js | 98 ++++++++++--------- sidebars/refarch.js | 10 ++ 11 files changed, 81 insertions(+), 61 deletions(-) diff --git a/_docs-sources/developer-portal/create-account.md b/_docs-sources/developer-portal/create-account.md index 45a3158956..61aab83c05 100644 --- a/_docs-sources/developer-portal/create-account.md +++ b/_docs-sources/developer-portal/create-account.md @@ -31,7 +31,7 @@ For security, sign in emails expire after 10 minutes. You can enter your email a If you are the admin for your organization, you'll be prompted to confirm details including your company address and phone number, as well as a billing email. Provide the required information and click **Continue** to finish signing in. -## Related FAQs +## Related Knowledge Base Discussions - [Invitation to the Developer Portal not received](https://github.com/orgs/gruntwork-io/discussions/716) - [Trouble logging into the Portal with email](https://github.com/orgs/gruntwork-io/discussions/395) diff --git a/_docs-sources/developer-portal/invite-team.md b/_docs-sources/developer-portal/invite-team.md index 105657c011..056a74aa05 100644 --- a/_docs-sources/developer-portal/invite-team.md +++ b/_docs-sources/developer-portal/invite-team.md @@ -40,7 +40,7 @@ This change will take effect immediately. Any team members who have accepted the The number of licenses available depends on the level of your subscription. You can see the total number of licenses as well as the number remaining at the top of the [Team](https://app.gruntwork.io/team) page. If you need to invite more team members than your current license limit allows, you may request additional licenses, which are billed at a standard monthly rate. To do so, contact sales@gruntwork.io. -## Related FAQs +## Related Knowledge Base Discussions - [Invitation to the Developer Portal not received](https://github.com/orgs/gruntwork-io/discussions/716) - [Trouble logging into the Portal with email](https://github.com/orgs/gruntwork-io/discussions/395) diff --git a/_docs-sources/developer-portal/link-github-id.md b/_docs-sources/developer-portal/link-github-id.md index 9d16d96912..e4cbd124df 100644 --- a/_docs-sources/developer-portal/link-github-id.md +++ b/_docs-sources/developer-portal/link-github-id.md @@ -14,7 +14,7 @@ Once you’ve linked your account, the notice on the home page will disappear an ::: -## Related FAQs +## Related Knowledge Base Discussions - [I have linked my GitHub Account but do not have code access](https://github.com/orgs/gruntwork-io/discussions/715) -- [How can I change my GitHub account(unlink/link)?](https://github.com/orgs/gruntwork-io/discussions/713) +- [How can I change my GitHub account (unlink/link)?](https://github.com/orgs/gruntwork-io/discussions/713) diff --git a/_docs-sources/intro/overview/what-you-provide.md b/_docs-sources/intro/overview/what-you-provide.md index 271cd5cdf3..9db8aca398 100644 --- a/_docs-sources/intro/overview/what-you-provide.md +++ b/_docs-sources/intro/overview/what-you-provide.md @@ -14,7 +14,7 @@ With Gruntwork, you can accelerate your journey towards capturing your AWS cloud Gruntwork products strike a balance between being opinionated and configurable. They’ll get you most of the way to your goal, but you may need to make some customizations to suit your use case. You may also need to adapt your apps and services to run in your new infrastructure by customizing/adding additional Infrastructure as Code to customize according to the requirements for your company. Our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) and [Community Slack Channel](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) provide great resources to assist you in this effort. -If you notice a limitation or bug in Gruntwork modules, we greatly appreciate and welcome [customer PRs](/iac/support/contributing) or you raising this to our attention via [bug or feature requests](/iac/support/issues). +If you notice a limitation or bug in Gruntwork modules, we greatly appreciate and welcome [customer PRs](/iac/support/contributing) or you raising this to our attention via [bug or feature requests](/support#share-feedback). :::note diff --git a/docs/developer-portal/create-account.md b/docs/developer-portal/create-account.md index 5f376bd69d..265466711e 100644 --- a/docs/developer-portal/create-account.md +++ b/docs/developer-portal/create-account.md @@ -31,7 +31,7 @@ For security, sign in emails expire after 10 minutes. You can enter your email a If you are the admin for your organization, you'll be prompted to confirm details including your company address and phone number, as well as a billing email. Provide the required information and click **Continue** to finish signing in. -## Related FAQs +## Related Knowledge Base Discussions - [Invitation to the Developer Portal not received](https://github.com/orgs/gruntwork-io/discussions/716) - [Trouble logging into the Portal with email](https://github.com/orgs/gruntwork-io/discussions/395) @@ -41,6 +41,6 @@ If you are the admin for your organization, you'll be prompted to confirm detail diff --git a/docs/developer-portal/invite-team.md b/docs/developer-portal/invite-team.md index 9c9a40f7e5..62d4f770c2 100644 --- a/docs/developer-portal/invite-team.md +++ b/docs/developer-portal/invite-team.md @@ -40,7 +40,7 @@ This change will take effect immediately. Any team members who have accepted the The number of licenses available depends on the level of your subscription. You can see the total number of licenses as well as the number remaining at the top of the [Team](https://app.gruntwork.io/team) page. If you need to invite more team members than your current license limit allows, you may request additional licenses, which are billed at a standard monthly rate. To do so, contact sales@gruntwork.io. -## Related FAQs +## Related Knowledge Base Discussions - [Invitation to the Developer Portal not received](https://github.com/orgs/gruntwork-io/discussions/716) - [Trouble logging into the Portal with email](https://github.com/orgs/gruntwork-io/discussions/395) @@ -50,6 +50,6 @@ The number of licenses available depends on the level of your subscription. You diff --git a/docs/developer-portal/link-github-id.md b/docs/developer-portal/link-github-id.md index ce58e7d484..19dd783c77 100644 --- a/docs/developer-portal/link-github-id.md +++ b/docs/developer-portal/link-github-id.md @@ -14,15 +14,15 @@ Once you’ve linked your account, the notice on the home page will disappear an ::: -## Related FAQs +## Related Knowledge Base Discussions - [I have linked my GitHub Account but do not have code access](https://github.com/orgs/gruntwork-io/discussions/715) -- [How can I change my GitHub account(unlink/link)?](https://github.com/orgs/gruntwork-io/discussions/713) +- [How can I change my GitHub account (unlink/link)?](https://github.com/orgs/gruntwork-io/discussions/713) diff --git a/docs/intro/overview/what-you-provide.md b/docs/intro/overview/what-you-provide.md index 76181f907a..8f0b6138ac 100644 --- a/docs/intro/overview/what-you-provide.md +++ b/docs/intro/overview/what-you-provide.md @@ -14,7 +14,7 @@ With Gruntwork, you can accelerate your journey towards capturing your AWS cloud Gruntwork products strike a balance between being opinionated and configurable. They’ll get you most of the way to your goal, but you may need to make some customizations to suit your use case. You may also need to adapt your apps and services to run in your new infrastructure by customizing/adding additional Infrastructure as Code to customize according to the requirements for your company. Our [Knowledge Base](https://github.com/gruntwork-io/knowledge-base/discussions) and [Community Slack Channel](https://gruntwork-community.slack.com/archives/CHH9Y3Z62) provide great resources to assist you in this effort. -If you notice a limitation or bug in Gruntwork modules, we greatly appreciate and welcome [customer PRs](/iac/support/contributing) or you raising this to our attention via [bug or feature requests](/iac/support/issues). +If you notice a limitation or bug in Gruntwork modules, we greatly appreciate and welcome [customer PRs](/iac/support/contributing) or you raising this to our attention via [bug or feature requests](/support#share-feedback). :::note @@ -54,6 +54,6 @@ Once deployed, Gruntwork hands the Reference Architecture over to your team. You diff --git a/sidebars/developer-portal.js b/sidebars/developer-portal.js index d57d683f71..8560fef675 100644 --- a/sidebars/developer-portal.js +++ b/sidebars/developer-portal.js @@ -1,4 +1,4 @@ -const developerPortalKnowledgeBaseDiscussions = +const kbLink = "https://github.com/orgs/gruntwork-io/discussions?discussions_q=" + // filter by discussions with the label "s:dev-portal" & sort by top voted discussions first encodeURIComponent("label:s:dev-portal sort:top") @@ -14,8 +14,8 @@ const sidebar = [ "developer-portal/link-github-id", { type: "link", - label: "FAQ", - href: developerPortalKnowledgeBaseDiscussions, + label: "Knowledge Base", + href: kbLink, }, ], }, diff --git a/sidebars/pipelines.js b/sidebars/pipelines.js index fb8681e733..a0eca6f02b 100644 --- a/sidebars/pipelines.js +++ b/sidebars/pipelines.js @@ -1,51 +1,61 @@ +const kbLink = + "https://github.com/orgs/gruntwork-io/discussions?discussions_q=" + + // filter by discussions with the label s:CI/Pipelines & sort by top voted discussions first + encodeURIComponent("label:s:CI/Pipelines sort:top") + const sidebar = [ - { - label: "Gruntwork Pipelines", + { + label: "Gruntwork Pipelines", + type: "category", + collapsible: false, + items: [ + { + label: "Overview", + type: "category", + collapsible: false, + items: [ + { + label: "What is Gruntwork Pipelines?", + type: "doc", + id: "pipelines/overview/index", + }, + { + label: "How it works", + type: "doc", + id: "pipelines/how-it-works/index", + }, + ], + }, + { + label: "Getting Started", type: "category", collapsible: false, items: [ - { - label: "Overview", - type: "category", - collapsible: false, - items: [ - { - label: "What is Gruntwork Pipelines?", - type: "doc", - id: "pipelines/overview/index" - }, - { - label: "How it works", - type: "doc", - id: "pipelines/how-it-works/index", - }, - ] - }, - { - label: "Getting Started", - type: "category", - collapsible: false, - items: [ - { - label: "Single Account Tutorial", - type: "doc", - id: "pipelines/tutorial/index", - }, - // { - // label: "Deploying Multi-Account Pipelines", - // type: "doc", - // id: "pipelines/multi-account/index", - // }, - ] - }, - { - label: "Maintain Pipelines", - type: "category", - collapsible: false, - items: ["pipelines/maintain/updating", "pipelines/maintain/extending"], - }, - ] - } + { + label: "Single Account Tutorial", + type: "doc", + id: "pipelines/tutorial/index", + }, + // { + // label: "Deploying Multi-Account Pipelines", + // type: "doc", + // id: "pipelines/multi-account/index", + // }, + ], + }, + { + label: "Maintain Pipelines", + type: "category", + collapsible: false, + items: ["pipelines/maintain/updating", "pipelines/maintain/extending"], + }, + { + type: "link", + label: "Knowledge Base", + href: kbLink, + }, + ], + }, ] module.exports = sidebar diff --git a/sidebars/refarch.js b/sidebars/refarch.js index 3f2e3431da..baf6e1657a 100644 --- a/sidebars/refarch.js +++ b/sidebars/refarch.js @@ -1,3 +1,8 @@ +const kbLink = + "https://github.com/orgs/gruntwork-io/discussions?discussions_q=" + + // filter by discussions with the label "s:Reference Architecture" & sort by top voted discussions first + encodeURIComponent('label:"s:Reference Architecture" sort:top') + const sidebar = [ { label: "Reference Architecture", @@ -49,6 +54,11 @@ const sidebar = [ "refarch/usage/maintain-your-refarch/undeploying", ], }, + { + type: "link", + label: "Knowledge Base", + href: kbLink, + }, ], }, ] From eccb194f6cf853bdc7cb6a7040ed274e15781f27 Mon Sep 17 00:00:00 2001 From: Eugene K Date: Fri, 26 May 2023 11:11:42 -0400 Subject: [PATCH 82/89] Added releases and update guides to footer --- docusaurus.config.js | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docusaurus.config.js b/docusaurus.config.js index 77509dbe34..0eced8a87c 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -233,6 +233,14 @@ const config = { label: "Terratest", href: "https://terratest.gruntwork.io", }, + { + label: "Stay Up to Date", + to: "/guides/stay-up-to-date", + }, + { + label: "Gruntwork Releases", + to: "/guides/stay-up-to-date/releases", + }, { label: "Support", href: "/support", From 47d6778d558bc6b04fd98d10b840af394f5b856f Mon Sep 17 00:00:00 2001 From: Pete Emerson Date: Fri, 26 May 2023 11:12:15 -0400 Subject: [PATCH 83/89] Ref Arch Intro (#809) * Ref Arch Intro --------- Co-authored-by: Max Moon Co-authored-by: Ryan Russell --- _docs-sources/products.md | 2 +- _docs-sources/refarch/index.md | 13 ++++- ...gruntwork-reference-architecture-differ.md | 40 ---------------- .../understanding-the-deployment-process.md | 35 ++++++++++---- .../what-is-a-reference-architecture.md | 21 ++++++-- docs/products.md | 4 +- docs/refarch/index.md | 15 +++++- ...gruntwork-reference-architecture-differ.md | 48 ------------------- .../understanding-the-deployment-process.md | 37 +++++++++----- .../what-is-a-reference-architecture.md | 23 +++++++-- sidebars/refarch.js | 5 +- 11 files changed, 118 insertions(+), 125 deletions(-) delete mode 100644 _docs-sources/refarch/whats-this/how-does-the-gruntwork-reference-architecture-differ.md delete mode 100644 docs/refarch/whats-this/how-does-the-gruntwork-reference-architecture-differ.md diff --git a/_docs-sources/products.md b/_docs-sources/products.md index bfb98b70cc..3ee109fa60 100644 --- a/_docs-sources/products.md +++ b/_docs-sources/products.md @@ -24,7 +24,7 @@ Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor i Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + href="/pipelines/overview"> Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. + href="/pipelines/overview"> Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. diff --git a/docs/refarch/index.md b/docs/refarch/index.md index 0e56ed1e85..fbbd8a3f47 100644 --- a/docs/refarch/index.md +++ b/docs/refarch/index.md @@ -1,11 +1,22 @@ # Reference Architecture -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. +The Gruntwork Reference Architecture is an implementation of best practices for infrastructure in the cloud. It is an opinionated, end-to-end tech stack built on top of our Infrastructure as Code Library, deployed into the customer's AWS accounts. It is comprised of three pieces. +## Landing Zone + +Gruntwork Landing Zone is a Terraform-native approach to [AWS Landing zone / Control Tower](https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html). This uses Terraform to quickly create new AWS accounts, configure them with a standard security baseline, and defines a best-practices multi-account setup. + +## Sample Application + +Our [sample application](https://github.com/gruntwork-io/aws-sample-app) is built with JavaScript, Node.js, and Express.js, following [Twelve-Factor App](https://12factor.net/) practices. It consists of a load balancer, a front end, a backend, a cache, and a database. + +## Pipelines + +[Gruntwork Pipelines](/pipelines/overview/) makes the process of deploying infrastructure similar to how developers often deploy code. It is a code framework and approach that enables the customer to use your preferred CI tool to set up an end-to-end pipeline for infrastructure code. diff --git a/docs/refarch/whats-this/how-does-the-gruntwork-reference-architecture-differ.md b/docs/refarch/whats-this/how-does-the-gruntwork-reference-architecture-differ.md deleted file mode 100644 index 7fd76ce8b5..0000000000 --- a/docs/refarch/whats-this/how-does-the-gruntwork-reference-architecture-differ.md +++ /dev/null @@ -1,48 +0,0 @@ -# How does the Gruntwork Reference Architecture differ? - -Haxx0r ipsum injection server void loop semaphore Starcraft wannabee try catch over clock tcp protocol alloc it's a feature. Cd ip gcc *.* sudo todo giga shell thread /dev/null class exception big-endian lib segfault leet nak packet sniffer client bar. Strlen eof access boolean continue packet memory leak malloc stack cookie mainframe. - -Else regex continue python crack ddos bin I'm sorry Dave, I'm afraid I can't do that. Mutex foad wannabee fatal double server deadlock cookie private tarball cat bar L0phtCrack afk float mutex hexadecimal. Long ip spoof access var /dev/null boolean bubble sort. - -Float recursively try catch then it's a feature ban else ip mountain dew perl ifdef hack the mainframe continue ascii concurrently. Loop cookie semaphore terminal bang infinite loop error system hash protocol printf. Piggyback fail xss I'm compiling injection suitably small values. - -# Opinionated - -Haxx0r ipsum do shell bypass L0phtCrack back door private baz foo infinite loop while server brute force ban salt all your base are belong to us todo. Stack mountain dew throw default less null frack rm -rf continue fail stack access January 1, 1970 for error ack hello world. Ip hack the mainframe epoch root eof bubble sort bin I'm sorry Dave, I'm afraid I can't do that double warez irc concurrently rsa. - -Public while flush Donald Knuth root firewall segfault gnu script kiddies packet sniffer alloc headers Dennis Ritchie daemon. Null access wannabee if giga float buffer protected hello world for back door spoof. Brute force class leet January 1, 1970 private loop foo gc pragma race condition infinite loop kilo mainframe. - -Hack the mainframe hello world malloc James T. Kirk Linus Torvalds todo default system Dennis Ritchie hash crack long injection exception. Bytes ascii var ban data man pages cookie do L0phtCrack private. Break nak tera bar tcp deadlock bypass grep gurfle d00dz access pragma cd salt null recursively infinite loop fopen. - -# Terragrunt - -Haxx0r ipsum protocol win tarball new wombat Trojan horse lib class memory leak. Mountain dew recursively char grep Dennis Ritchie system I'm sorry Dave, I'm afraid I can't do that. Function ip it's a feature regex while bin headers thread loop ddos strlen brute force unix bit stack fail ctl-c linux rm -rf eaten by a grue. - -Cookie cat printf chown default socket foad foo case void long wabbit bypass perl protected. Boolean irc break ack malloc semaphore baz leet eaten by a grue giga warez. Rm -rf wannabee float script kiddies char infinite loop Linus Torvalds mutex d00dz. - -Protocol blob linux function tarball char shell access wannabee L0phtCrack alloc Linus Torvalds memory leak. Tcp frack mailbomb strlen unix afk terminal pwned tera flush bit fork flood fail void break gcc pragma ifdef sql script kiddies epoch irc d00dz. Infinite loop public concurrently over clock deadlock packet sniffer. - -# Delivered as code - -Haxx0r ipsum Trojan horse afk false for race condition big-endian do irc finally tera ssh continue over clock. Less suitably small values highjack Dennis Ritchie cookie protocol ack bit hack the mainframe. Function pragma mainframe int mega void else grep spoof true eaten by a grue socket L0phtCrack. - -Tarball break irc ip class gc throw continue access January 1, 1970 perl endif wombat hello world eof alloc packet sniffer. Dereference Dennis Ritchie exception fatal syn mutex chown emacs ssh eaten by a grue shell. Lib long race condition null do suitably small values packet. - -Packet stack int ssh printf fatal fail mutex access alloc bit gc tunnel in bang eof protocol Donald Knuth flood grep injection mailbomb. Socket I'm compiling deadlock perl gobble highjack James T. Kirk mountain dew recursively. All your base are belong to us sql worm bypass socket pwned I'm sorry Dave, I'm afraid I can't do that it's a feature thread. - -# _envcommon - -Haxx0r ipsum race condition case void then else todo server eaten by a grue deadlock. Bit bin dereference foo class unix bit script kiddies firewall mega new hash worm hack the mainframe loop Trojan horse Donald Knuth. Ssh emacs crack stdio.h mountain dew recursively win hexadecimal. - -Race condition rsa fopen dereference deadlock baz system nak case eaten by a grue foad bypass throw pragma mainframe injection back door. Leapfrog strlen port Starcraft ddos break bubble sort semaphore I'm compiling Linus Torvalds. Hack the mainframe vi loop gobble grep false char cache mailbomb terminal L0phtCrack lib brute force wannabee. - -Bin root emacs I'm sorry Dave, I'm afraid I can't do that. Less printf class bubble sort nak char fork cd warez ifdef if tunnel in ban continue ascii machine code injection fopen error win double system. Protected deadlock try catch python int break mutex new cat headers Dennis Ritchie epoch stack trace race condition. - - - - diff --git a/docs/refarch/whats-this/understanding-the-deployment-process.md b/docs/refarch/whats-this/understanding-the-deployment-process.md index ec39d329a9..e2c861e7fe 100644 --- a/docs/refarch/whats-this/understanding-the-deployment-process.md +++ b/docs/refarch/whats-this/understanding-the-deployment-process.md @@ -1,27 +1,42 @@ -# Understanding the deployment process +# Understanding the Deployment Process -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. +The Gruntwork Reference Architecture has three deployment phases. -Mutex overflow leet hexadecimal ifdef pragma blob afk worm hash leapfrog protected private break root. Bubble sort big-endian baz crack less grep default fail void memory leak long bar var ctl-c loop. Tera class concurrently bubble sort interpreter flush then wannabee stack hello world server sql it's a feature. +### Configuration -Double Linus Torvalds big-endian socket fail d00dz ddos bit headers daemon wannabee ascii bar buffer flood. Tunnel in leapfrog boolean port ifdef baz terminal fork tera snarf race condition irc sql interpreter pwned *.* win hello world. Warez highjack packet ip todo function giga fatal public. +Configuration of the Gruntwork Reference Architecture is primarily [your responsibility](../../intro/overview/what-you-provide). -# Phase 1: Configuration +- We deliver a templated `infrastructure-live-${YOUR_COMPANY_NAME}` repository to you in our GitHub organization +- You access the repo in GitHub via invitation in the [Gruntwork Dev Portal](https://app.gruntwork.io) +- You use the Gruntwork CLI wizard to create accounts and set config options +- Pre-flight checks run via Github Actions to determine when the repo is ready for deployment +- The AWS accounts you are deploying the Reference Architecture to should be empty at conclusion of this phase +- You merge the PR to the `main` branch to initiate the deployment phase -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. +### Deployment -# Phase 2: Delivery +The deployment phase is primarily [our responsibility](../../intro/overview/what-we-provide.md#gruntwork-reference-architecture). -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. +- We monitor the deployment and fix any errors that occur as needed +- In some cases, we may need to communicate with you to resolve issues (e.g. AWS quota problems) +- Deployment is completed and the `infrastructure-live-${YOUR_COMPANY_NAME}` repo is populated +- During the deployment phase, you should not attempt to modify resources in or respond to any automated notifications from your AWS accounts +- Once the deployment is complete, you will receive an email -# Phase 3: Adoption +### Adoption -Haxx0r ipsum Linus Torvalds hello world null python fail epoch. Less thread less xss chown over clock bin baz unix warez malloc printf packet sniffer leet semaphore linux gnu new it's a feature. Recursively tcp big-endian var ack fork else ascii foo infinite loop gobble back door vi overflow char spoof loop cat segfault. +The adoption phase is primarily [your responsibility](../../intro/overview/what-you-provide). + +- You complete “last mile” configuration following our handoff docs, including final Pipelines integrations with your CI/CD of choice +- You migrate the `infrastructure-live-${YOUR_COMPANY_NAME}` repo to your own Version Control System or Github Organization +- You revoke Gruntwork access to your AWS account +- At this points, your AWS accounts are fully in your control +- From this point forward, we expect you to self-serve, with assistance from Gruntwork Support, as needed diff --git a/docs/refarch/whats-this/what-is-a-reference-architecture.md b/docs/refarch/whats-this/what-is-a-reference-architecture.md index 01eec65913..dae437c3fa 100644 --- a/docs/refarch/whats-this/what-is-a-reference-architecture.md +++ b/docs/refarch/whats-this/what-is-a-reference-architecture.md @@ -1,16 +1,31 @@ # What is a Reference Architecture? -Haxx0r ipsum interpreter bang cookie eof over clock exception function ban mountain dew irc loop public *.* gc python hack the mainframe. Try catch ip double printf grep buffer deadlock January 1, 1970 stack todo nak throw if /dev/null infinite loop socket port chown hello world class. Giga afk Dennis Ritchie pragma I'm compiling big-endian fopen server boolean xss ddos memory leak void L0phtCrack. +The Gruntwork Reference Architecture is an implementation of best practices for infrastructure in the cloud. It is and end-to-end tech stack built on top of our Infrastructure as Code Library, deployed into your AWS accounts. -Injection rsa script kiddies salt printf gurfle int access linux stdio.h cache alloc null fail gc thread. Flush foad I'm sorry Dave, I'm afraid I can't do that else overflow emacs Starcraft unix echo ctl-c cookie. Hexadecimal injection brute force gcc warez function *.* pwned mainframe win big-endian. +The Gruntwork Reference Architecture is opinionated, and delivered as code. It is written in [Terragrunt](https://terragrunt.gruntwork.io/), our thin wrapper that provides extra tools for managing remote state and keeping your configurations [DRY](https://en.wikipedia.org/wiki/Don%27t_repeat_yourself). Our `_envcommon` pattern reduces the amount of code you need to copy from one place to another when creating additional identical infrastructure. -Mega else data d00dz nak null void protected cat ban port machine code. Interpreter bang system wabbit wannabee error syn float hack the mainframe mutex all your base are belong to us. Packet sniffer ifdef var endif gobble Trojan horse rm -rf cd bar January 1, 1970 packet race condition. +## Components +The Gruntwork Reference Architecture has three main components — Gruntwork Landing Zone, Gruntwork Pipelines, and a Sample Application. + +### Landing Zone + +Gruntwork Landing Zone is a terraform-native approach to [AWS Landing zone / Control Tower](https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html). This uses Terragrunt to quickly create new AWS accounts, configure them with a standard security baseline, and defines a best-practices multi-account setup. + + +### Pipelines + +[Gruntwork Pipelines](/pipelines/overview/) makes the process of deploying infrastructure similar to how developers often deploy code. It is a code framework and approach that enables the customer to use your preferred CI tool to set up an end-to-end pipeline for infrastructure code. + + +### Sample Application + +Our [sample application](https://github.com/gruntwork-io/aws-sample-app) is built with JavaScript, Node.js, and Express.js, following [Twelve-Factor App](https://12factor.net/) practices. It consists of a load balancer, a front end, a backend, a cache, and a database. diff --git a/sidebars/refarch.js b/sidebars/refarch.js index baf6e1657a..0c876b9c56 100644 --- a/sidebars/refarch.js +++ b/sidebars/refarch.js @@ -15,9 +15,8 @@ const sidebar = [ collapsible: false, items: [ "refarch/whats-this/what-is-a-reference-architecture", - "refarch/whats-this/how-does-the-gruntwork-reference-architecture-differ", - "refarch/whats-this/understanding-the-deployment-process", - ], + "refarch/whats-this/understanding-the-deployment-process" + ] }, { label: "Configuration", From 2c37ce667bd7eebdf9d5c38ea75f0156b575812e Mon Sep 17 00:00:00 2001 From: Max Moon Date: Fri, 26 May 2023 13:00:14 -0700 Subject: [PATCH 84/89] redo landing page (#833) --- src/pages/index.tsx | 48 ++++++++++++++------------------------------- 1 file changed, 15 insertions(+), 33 deletions(-) diff --git a/src/pages/index.tsx b/src/pages/index.tsx index ef360e26d8..6d63f2e51f 100644 --- a/src/pages/index.tsx +++ b/src/pages/index.tsx @@ -46,59 +46,41 @@ export default function Home(): JSX.Element { Bought a Reference Architecture? Get your new infrastructure up - and running quickly with our comprehensive guide. + and running quickly with our getting started guide. - Follow our tutorials and learn how to deploy Gruntwork services - to construct your own bespoke architecture. + Create your account in the Gruntwork Developer Portal and add your teammates.

-

Discover Your Use Case

+

Products

- Streamline how you create, configure, and secure your AWS - accounts using Gruntwork Landing Zone. + A collection of reusable code that enables you to deploy and manage infrastructure quickly and reliably. - Use your preferred CI tool to set up an end-to-end pipeline for - your infrastructure code. + An end-to-end tech stack built using best practices on top of our Infrastructure as Code Library, deployed into your AWS accounts. - Set up your network according to industry best practices using - our VPC service. - - - Deploy Kubernetes using EKS to host all of your apps and - services. - - - Implement the CIS AWS Foundations Benchmark using our curated - collection of modules and services. + A framework for running secure deployments for infrastructure code and application code.
From e1077f06a96930acedb8c1978b41fe89d0d48d19 Mon Sep 17 00:00:00 2001 From: Zack Proser Date: Fri, 26 May 2023 17:28:25 -0400 Subject: [PATCH 85/89] Implement RefArch Access / Set up AWS Auth (#798) * Implement RefArch Access / Set up AWS Auth --------- Co-authored-by: Pete Emerson Co-authored-by: Max Moon Co-authored-by: Ryan Russell Co-authored-by: Eugene K --- _docs-sources/products.md | 14 +- .../refarch/access/how-to-auth-CLI/index.md | 55 ++++++++ .../how-to-auth-aws-web-console/index.md | 26 ++++ .../refarch/access/how-to-auth-aws/index.md | 47 ------- .../refarch/access/how-to-auth-ec2/index.md | 62 ++++++++- .../refarch/access/how-to-auth-vpn/index.md | 42 +++++- .../refarch/access/setup-auth/index.md | 122 +++++++++++++++-- docs/products.md | 16 +-- docs/refarch/access/how-to-auth-CLI/index.md | 63 +++++++++ .../how-to-auth-aws-web-console/index.md | 34 +++++ docs/refarch/access/how-to-auth-aws/index.md | 55 -------- docs/refarch/access/how-to-auth-ec2/index.md | 64 ++++++++- docs/refarch/access/how-to-auth-vpn/index.md | 44 ++++++- docs/refarch/access/setup-auth/index.md | 124 ++++++++++++++++-- sidebars/refarch.js | 6 +- 15 files changed, 604 insertions(+), 170 deletions(-) create mode 100644 _docs-sources/refarch/access/how-to-auth-CLI/index.md create mode 100644 _docs-sources/refarch/access/how-to-auth-aws-web-console/index.md delete mode 100644 _docs-sources/refarch/access/how-to-auth-aws/index.md create mode 100644 docs/refarch/access/how-to-auth-CLI/index.md create mode 100644 docs/refarch/access/how-to-auth-aws-web-console/index.md delete mode 100644 docs/refarch/access/how-to-auth-aws/index.md diff --git a/_docs-sources/products.md b/_docs-sources/products.md index 3ee109fa60..f6a8a9e0d2 100644 --- a/_docs-sources/products.md +++ b/_docs-sources/products.md @@ -16,27 +16,21 @@ import CenterLayout from "/src/components/CenterLayout" -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. +A collection of reusable code that enables you to deploy and manage infrastructure quickly and reliably. -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. +An end-to-end tech stack built using best practices on top of our Infrastructure as Code Library, deployed into your AWS accounts. -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. +A framework for running secure deployments for infrastructure code and application code. -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. +Gain access to all resources included in your Gruntwork subscription. diff --git a/_docs-sources/refarch/access/how-to-auth-CLI/index.md b/_docs-sources/refarch/access/how-to-auth-CLI/index.md new file mode 100644 index 0000000000..a9d878bed1 --- /dev/null +++ b/_docs-sources/refarch/access/how-to-auth-CLI/index.md @@ -0,0 +1,55 @@ +# Authenticate via the AWS command line interface (CLI) + +CLI access requires [AWS access keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html). We recommend using [aws-vault](https://github.com/99designs/aws-vault) for managing all aspects related to CLI authentication. To use `aws-vault` you will need to generate AWS Access Keys for your IAM user in the security account. + +:::tip + +`aws-vault` is not the only method which can be used to authenticate on the CLI. Please refer to [A Comprehensive Guide to Authenticating to AWS on the Command Line](https://blog.gruntwork.io/a-comprehensive-guide-to-authenticating-to-aws-on-the-command-line-63656a686799) for several other options. + +::: + +:::info + +MFA is required for the Reference Architecture, including on the CLI. See [configuring your IAM user](/refarch/access/setup-auth/#configure-your-iam-user) for instructions on setting up an MFA token. + +::: + +## Access resources in the security account + +To authenticate to the security account, you only need your AWS access keys and an MFA token. See [the guide](https://github.com/99designs/aws-vault#quick-start) on adding credentials to `aws-vault`. + +You should be able to run the following command using AWS CLI + +```bash +aws-vault exec -- aws sts get-caller-identity +``` + +and expect to get an output with your user's IAM role: + +```json +{ + "UserId": "AIDAXXXXXXXXXXXX”, + "Account": “", + "Arn": "arn:aws:iam:::user/" +} +``` + +## Accessing all other accounts + +To authenticate to all other accounts (e.g., dev, stage, prod), you will need the ARN of an IAM Role in that account to assume. To configure accessing accounts using assumed roles with `aws-vault` refer to [these instructions](https://github.com/99designs/aws-vault#roles-and-mfa). + +Given the following command (where `YOUR_ACCOUNT_PROFILE_NAME` will be any account other than your security account) + +```bash +aws-vault exec -- aws sts get-caller-identity +``` + +you should expect to see the following output: + +```json +{ + "UserId": "AIDAXXXXXXXXXXXX", + "Account": "", + "Arn": "arn:aws:sts:::assumed-role//11111111111111111111" +} +``` diff --git a/_docs-sources/refarch/access/how-to-auth-aws-web-console/index.md b/_docs-sources/refarch/access/how-to-auth-aws-web-console/index.md new file mode 100644 index 0000000000..77e6ec3b24 --- /dev/null +++ b/_docs-sources/refarch/access/how-to-auth-aws-web-console/index.md @@ -0,0 +1,26 @@ +# Authenticating to the AWS web console + +## Authenticate to the AWS Web Console in the security account + +To authenticate to the security account, you will need: + +1. IAM User Credentials. See [setting up initial access](/refarch/access/setup-auth/) for how to create IAM users. +1. An MFA Token. See [Configuring your IAM user](/refarch/access/setup-auth/#configure-your-iam-user). +1. The login URL. This should be of the format `https://.signin.aws.amazon.com/console`. + +## Authenticate to the AWS Web Console in all other accounts + +To authenticate to any other account (e.g., dev, stage, prod), you need to: + +1. Authenticate to the security account. All IAM users are defined in this account, you must always authenticate to it first. +1. [Assume an IAM Role in the other AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-console.html). To access other accounts, you switch to an IAM Role defined in that account. + +:::note +Note that to be able to access an IAM Role in some account, your IAM User must be in an IAM Group that has permissions to assume that IAM Role. +::: + +See the `cross-account-iam-roles` module for the [default set of IAM Roles](https://github.com/gruntwork-io/terraform-aws-security/blob/main/modules/cross-account-iam-roles/README.md#iam-roles-intended-for-human-users) that exist in each account. For example, to assume the allow-read-only-access-from-other-accounts IAM Role in the prod account, you must be in the \_account.prod-read-only IAM Group. See [Configure other IAM Users](/refarch/access/setup-auth/#configure-other-iam-users) for how you add users to IAM Groups. + +:::note +Not all of the default roles referenced in the `cross-account-iam-roles` module are deployed in each account. +::: diff --git a/_docs-sources/refarch/access/how-to-auth-aws/index.md b/_docs-sources/refarch/access/how-to-auth-aws/index.md deleted file mode 100644 index 38ff25b2d5..0000000000 --- a/_docs-sources/refarch/access/how-to-auth-aws/index.md +++ /dev/null @@ -1,47 +0,0 @@ -# Command Line (CLI) Authentication - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. - -## Accessing resources - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. - -## Using aws-vault with the Reference Architecture - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. - -# AWS Web Console Authentication - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. - -## Security account difference - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. - -## How the IAM roles work - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. diff --git a/_docs-sources/refarch/access/how-to-auth-ec2/index.md b/_docs-sources/refarch/access/how-to-auth-ec2/index.md index 7dde22a1c8..8f61b2ce0d 100644 --- a/_docs-sources/refarch/access/how-to-auth-ec2/index.md +++ b/_docs-sources/refarch/access/how-to-auth-ec2/index.md @@ -1,9 +1,63 @@ -# SSH to an EC2 Instance +# SSH to EC2 Instances +You can SSH to any of your EC2 Instances in the Reference Architecture in two different ways: -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. +1. `ssh-grunt` (Recommended) +1. EC2 Key Pairs (For emergency / backup use only) -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +## `ssh-grunt` (Recommended) -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +[`ssh-grunt`](../../../reference/modules/terraform-aws-security/ssh-grunt/) is a tool developed by Gruntwork that automatically syncs user accounts from AWS IAM to your servers to allow individual developers to SSH onto EC2 instances using their own username and SSH keys. +In this section, you will learn how to SSH to an EC2 instance in your Reference Architecture using `ssh-grunt`. Every EC2 instance has `ssh-grunt` installed by default. + +### Add users to SSH IAM Groups + +When running `ssh-grunt`, each EC2 instance specifies from which IAM Groups it will allow SSH access, and SSH access with sudo permissions. By default, these IAM Group names are `ssh-grunt-users` and `ssh-grunt-sudo-users`, respectively. To be able to SSH to an EC2 instance, your IAM User must be added to one of these IAM Groups (see Configure other IAM Users for instructions). + +### Upload your public SSH key + +1. Authenticate to the AWS Web Console in the security account. +1. Go to your IAM User profile page, select the "Security credentials" tab, and click "Upload SSH public key". +1. Upload your public SSH key (e.g. `~/.ssh/id_rsa.pub`). Do NOT upload your private key. + +### Determine your SSH username + +Your username for SSH is typically the same as your IAM User name. However, if your IAM User name has special characters that are not allowed by operating systems (e.g., most punctuation is not allowed), your SSH username may be a bit different, as specified in the `ssh-grunt` [documentation](../../../reference/modules/terraform-aws-security/ssh-grunt/). For example: + +1. If your IAM User name is `jane`, your SSH username will also be `jane`. +1. If your IAM User name is `jane@example.com`, your SSH username will be `jane`. +1. If your IAM User name is `_example.jane.doe`, your SSH username will be `example_jane_doe`. + + +### SSH to an EC2 instance + +Since most EC2 instances in the Reference Architecture are deployed into private subnets, you won't be able to access them over the public Internet. Therefore, you must first connect to the VPN server. See [VPN Authentication](../how-to-auth-vpn/index.md) for more details. + +Given that: + +1. Your IAM User name is jane. +1. You've uploaded your public SSH key to your IAM User profile. +1. Your private key is located at `/Users/jane/.ssh/id_rsa` on your local machine. +1. Your EC2 Instance's IP address is 1.2.3.4. + + +First, add your SSH Key into the SSH Agent using the following command: + +```bash +ssh-add /Users/jane/.ssh/id_rsa +``` + +Then, use this command to SSH to the EC2 Instance: + +```bash +ssh jane@1.2.3.4 +``` + +You should now be able to execute commands on the instance. + +## EC2 Key Pairs (For emergency / backup use only) + +When you launch an EC2 Instance in AWS, you can specify an EC2 Key Pair that can be used to SSH into the EC2 Instance. This suffers from an important problem: usually more than one person needs access to the EC2 Instance, which means you have to share this key with others. Sharing secrets of this sort is a security risk. Moreover, if someone leaves the company, to ensure they no longer have access, you'd have to change the Key Pair, which requires redeploying all of your servers. + +As part of the Reference Architecture deployment, Gruntwork will create EC2 Key Pairs and put the private keys into AWS Secrets Manager. These keys are there only for emergency / backup use: e.g., if there's a bug in `ssh-grunt` that prevents you from accessing your EC2 instances. We recommend only giving a handful of trusted admins access to these Key Pairs. diff --git a/_docs-sources/refarch/access/how-to-auth-vpn/index.md b/_docs-sources/refarch/access/how-to-auth-vpn/index.md index 615cefaaa7..06fe05b672 100644 --- a/_docs-sources/refarch/access/how-to-auth-vpn/index.md +++ b/_docs-sources/refarch/access/how-to-auth-vpn/index.md @@ -1,9 +1,43 @@ -# VPN Authentcation +# VPN Authentication +Most of the AWS resources that comprise the Reference Architecture run in private subnets, which means they do not have a public IP address, and cannot be reached directly from the public Internet. This reduces the "surface area" that attackers can reach. Of course, you still need access into the VPCs so we exposed a single entrypoint into the network: an [OpenVPN server](https://openvpn.net/). -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. +## Install an OpenVPN client -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +There are free and paid OpenVPN clients available for most major operating systems. Popular options include: -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +1. OS X: [Viscosity](https://www.sparklabs.com/viscosity/) or [Tunnelblick](https://tunnelblick.net/). +1. Windows: [official client](https://openvpn.net/index.php/open-source/downloads.html). +1. Linux: + ```bash title="Debian" + apt-get install openvpn + ``` + + ```bash title="Redhat" + yum install openvpn + ``` + +## Join the OpenVPN IAM Group + +Your IAM User needs access to SQS queues used by the OpenVPN server. Since IAM users are defined only in the security account, and the OpenVPN servers are defined in separate AWS accounts (stage, prod, etc), that means you need to authenticate to the accounts with the OpenVPN servers by assuming an IAM Role that has access to the SQS queues in those accounts. + +To be able to assume an IAM Role, your IAM user needs to be part of an IAM Group with the proper permissions, such as `_account.xxx-full-access` or `_account.xxx-openvpn-users`, where `xxx` is the name of the account you want to access (stage, prod, etc). See [Configure other IAM users](/refarch/access/setup-auth/#configure-other-iam-users) for instructions on adding users to IAM Groups. + +## Use openvpn-admin to generate a configuration file + +To connect to an OpenVPN server, you need an OpenVPN configuration file, which includes a certificate that you can use to authenticate. To generate this configuration file, do the following: + +1. Install the latest [`openvpn-admin binary`](https://github.com/gruntwork-io/terraform-aws-openvpn/releases) for your OS. + +1. Authenticate to AWS via the CLI. You will need to assume an IAM Role in the AWS account with the OpenVPN server you're trying to connect to. This IAM Role must have access to the SQS queues used by OpenVPN server. Typically, the `allow-full-access-from-other-accounts` or `openvpn-server-allow-certificate-requests-for-external-accounts` IAM Role is what you want. + +1. Run `openvpn-admin request --aws-region --username `. + +1. This will create your OpenVPN configuration file in your current directory. + +1. Load this configuration file into your OpenVPN client. + +## Connect to one of your OpenVPN servers + +To connect to an OpenVPN server in one of your app accounts (Dev, Stage, Prod), click the "Connect" button next to your configuration file in the OpenVPN client. After a few seconds, you should be connected. You will now be able to access all the resources within the AWS network (e.g., SSH to EC2 instances in private subnets) as if you were "in" the VPC itself. diff --git a/_docs-sources/refarch/access/setup-auth/index.md b/_docs-sources/refarch/access/setup-auth/index.md index 2d8bdd9929..44db323f16 100644 --- a/_docs-sources/refarch/access/setup-auth/index.md +++ b/_docs-sources/refarch/access/setup-auth/index.md @@ -1,27 +1,123 @@ # Set up AWS Auth -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. +## Configure root users -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +Each of your AWS accounts has a root user that you need to configure. When you created the child AWS accounts (dev, stage, prod, etc), you provided the root user's email address for each account; if you don't know what those email addresses were, you can log in to the root account (the parent of the AWS Organization) and go to the AWS Organizations Console to find them. -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +Once you have the email addresses, you'll need the passwords. When you create child accounts in an AWS organization, AWS will not allow you to set the root password. In order to generate the root password: -## 1. Configure root user +1. Go to the AWS Console. +1. If you had previously signed into some other AWS account as an IAM User, rather than a root user, click "Sign-in using root account credentials." +1. Enter the email address of the root user. +1. Click "Forgot your password" to reset the password. +1. Check the email address associated with the root user account for a link you can use to create a new password. -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +:::danger +Please note that the root user account can do anything in your AWS account, bypassing the security restrictions you put in place, so you need to take extra care with protecting this account. +::: -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +We strongly recommend that when you reset the password for each account, you also: -## 2. Configure your IAM users +1. Use a strong password: preferably 30+ characters, randomly generated, and stored in a secrets manager. +1. Enable Multi-Factor Auth (MFA): Follow [these instructions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html#enable-virt-mfa-for-root) to enable MFA for the root user. + After this initial set up, you should _not_ use the root user account afterward except in very rare circumstances. (e.g., if you get locked out of your IAM User account and no one has permissions to reset your password). For day-to-day tasks, you should use an IAM User instead, as described in the next section. -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +Please note that you'll have to repeat the process above of resetting the password and enabling MFA for every account in your organization: dev, stage, prod, shared, security, logs, and the root account. -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +## Configure your IAM user -## 3. Configure other IAM users +The security account defines and manages all IAM Users. When deploying your Reference Architecture, Gruntwork creates an IAM User with admin permissions in the security account. The password for the IAM User is encrypted via PGP using [Keybase](https://keybase.io) (you'll need a free account) and is Base64-encoded. -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. +To access the Terraform state containing the password, you need to already be authenticated to the account. Thus to get access to the initial admin IAM User, we will use the root user credentials. To do this, you can either: -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +- Log in to the AWS Web Console using the root user credentials for the security account and set up the password and AWS Access Keys for the IAM User. -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +- Use the [Gruntwork CLI](https://github.com/gruntwork-io/gruntwork/) to rotate the password using the command: + + ```bash + gruntwork aws reset-password --iam-user-name + ``` + +Once you have access via your IAM user, finish hardening your security posture: + +1. Enable MFA for your IAM User by following [these instructions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable.html). MFA is required by the Reference Architecture, and you won't be able to access any other accounts without it. + + :::note + Note that the name of the MFA must be exactly the same as the AWS IAM Username + ::: + +1. Log out and log back in — After enabling MFA, you need to log out and then log back in. This forces AWS to prompt you for your MFA token. + + :::caution + Until you enable MFA, you will not be able to access anything else in the web console. + ::: + +1. Create access keys for yourself by following [these instructions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html). Store the access keys in a secrets manager. You will need these to authenticate to AWS from the command-line. + +## Configure other IAM users + +Now that your IAM user is all set up, you can configure IAM users for the rest of your team. + +:::note +Each of your users will need a free [Keybase](https://keybase.io/) account so that their credentials can be encrypted just for their access. +::: + +All of the IAM users are managed as code in the security account in the `account-baseline-app` module. If you open the `terragrunt.hcl` file in that repo, you should see the list of users, which will look something like: + +```yaml +jane@acme.com: + create_access_keys: false + create_login_profile: true + groups: + - full-access + pgp_key: keybase:jane_on_keybase +``` + +Here's how you would add two more users, Alice and Bob, to your security account: + +```yaml +jane@acme.com: + create_login_profile: true + groups: + - full-access + pgp_key: keybase:jane_on_keybase +alice@acme.com: + create_login_profile: true + groups: + - _account.dev-full-access + - _account.stage-full-access + - _account.prod-full-access + - iam-user-self-mgmt + pgp_key: keybase:alice_on_keybase +bob@acme.com: + create_login_profile: true + groups: + - _account.prod-read-only + - ssh-grunt-sudo-users + - iam-user-self-mgmt + pgp_key: keybase:bob_on_keybase +``` + +A few notes about the code above: + +1. **Groups**. We add each user to a set of IAM Groups: for example, we add Alice to IAM Groups that give her admin access in the dev, stage, and prod accounts, whereas Bob gets read-only access to prod, plus SSH access (with `sudo` permissions) to EC2 instances. For the full list of IAM Groups available, see the [IAM Groups module](https://github.com/gruntwork-io/terraform-aws-security/tree/main/modules/iam-groups#iam-groups). + +1. **PGP Keys**. We specify a PGP Key to use to encrypt any secrets for that user. Keys of the form `keybase:` are automatically fetched for user `` on [Keybase](https://keybase.io/). + +1. **Credentials**. For each user whose `create_login_profile` field is set to `true`, a password will be automatically generated. This password can be used to log in to the web console. This password will be encrypted with the user's PGP key and visible as a Terraform output. After you run `terragrunt apply`, you can copy/paste these encrypted credentials and send them to the user. + +To deploy this new code and create the new IAM Users, you will need to: + +1. Authenticate to AWS via the CLI. + +1. Apply your changes by running `terragrunt apply`. + +1. Share the login URL, usernames, and (encrypted) password with your team members. + + :::note + Make sure to tell each team member to follow the [Configure your IAM User instructions](#configure-your-iam-user) to log in, reset their password, and enable MFA. + ::: + + :::caution + Enabling MFA is required to access the Reference Architecture + ::: diff --git a/docs/products.md b/docs/products.md index 9165810999..1fe554c8bf 100644 --- a/docs/products.md +++ b/docs/products.md @@ -16,27 +16,21 @@ import CenterLayout from "/src/components/CenterLayout" -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. +A collection of reusable code that enables you to deploy and manage infrastructure quickly and reliably. -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. +An end-to-end tech stack built using best practices on top of our Infrastructure as Code Library, deployed into your AWS accounts. -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. +A framework for running secure deployments for infrastructure code and application code. -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. - - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Purus gravida quis blandit turpis cursus. +Gain access to all resources included in your Gruntwork subscription. @@ -47,6 +41,6 @@ Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor i diff --git a/docs/refarch/access/how-to-auth-CLI/index.md b/docs/refarch/access/how-to-auth-CLI/index.md new file mode 100644 index 0000000000..74dd7ad5da --- /dev/null +++ b/docs/refarch/access/how-to-auth-CLI/index.md @@ -0,0 +1,63 @@ +# Authenticate via the AWS command line interface (CLI) + +CLI access requires [AWS access keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html). We recommend using [aws-vault](https://github.com/99designs/aws-vault) for managing all aspects related to CLI authentication. To use `aws-vault` you will need to generate AWS Access Keys for your IAM user in the security account. + +:::tip + +`aws-vault` is not the only method which can be used to authenticate on the CLI. Please refer to [A Comprehensive Guide to Authenticating to AWS on the Command Line](https://blog.gruntwork.io/a-comprehensive-guide-to-authenticating-to-aws-on-the-command-line-63656a686799) for several other options. + +::: + +:::info + +MFA is required for the Reference Architecture, including on the CLI. See [configuring your IAM user](/refarch/access/setup-auth/#configure-your-iam-user) for instructions on setting up an MFA token. + +::: + +## Access resources in the security account + +To authenticate to the security account, you only need your AWS access keys and an MFA token. See [the guide](https://github.com/99designs/aws-vault#quick-start) on adding credentials to `aws-vault`. + +You should be able to run the following command using AWS CLI + +```bash +aws-vault exec -- aws sts get-caller-identity +``` + +and expect to get an output with your user's IAM role: + +```json +{ + "UserId": "AIDAXXXXXXXXXXXX”, + "Account": “", + "Arn": "arn:aws:iam:::user/" +} +``` + +## Accessing all other accounts + +To authenticate to all other accounts (e.g., dev, stage, prod), you will need the ARN of an IAM Role in that account to assume. To configure accessing accounts using assumed roles with `aws-vault` refer to [these instructions](https://github.com/99designs/aws-vault#roles-and-mfa). + +Given the following command (where `YOUR_ACCOUNT_PROFILE_NAME` will be any account other than your security account) + +```bash +aws-vault exec -- aws sts get-caller-identity +``` + +you should expect to see the following output: + +```json +{ + "UserId": "AIDAXXXXXXXXXXXX", + "Account": "", + "Arn": "arn:aws:sts:::assumed-role//11111111111111111111" +} +``` + + + diff --git a/docs/refarch/access/how-to-auth-aws-web-console/index.md b/docs/refarch/access/how-to-auth-aws-web-console/index.md new file mode 100644 index 0000000000..e8cb5522e5 --- /dev/null +++ b/docs/refarch/access/how-to-auth-aws-web-console/index.md @@ -0,0 +1,34 @@ +# Authenticating to the AWS web console + +## Authenticate to the AWS Web Console in the security account + +To authenticate to the security account, you will need: + +1. IAM User Credentials. See [setting up initial access](/refarch/access/setup-auth/) for how to create IAM users. +1. An MFA Token. See [Configuring your IAM user](/refarch/access/setup-auth/#configure-your-iam-user). +1. The login URL. This should be of the format `https://.signin.aws.amazon.com/console`. + +## Authenticate to the AWS Web Console in all other accounts + +To authenticate to any other account (e.g., dev, stage, prod), you need to: + +1. Authenticate to the security account. All IAM users are defined in this account, you must always authenticate to it first. +1. [Assume an IAM Role in the other AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-console.html). To access other accounts, you switch to an IAM Role defined in that account. + +:::note +Note that to be able to access an IAM Role in some account, your IAM User must be in an IAM Group that has permissions to assume that IAM Role. +::: + +See the `cross-account-iam-roles` module for the [default set of IAM Roles](https://github.com/gruntwork-io/terraform-aws-security/blob/main/modules/cross-account-iam-roles/README.md#iam-roles-intended-for-human-users) that exist in each account. For example, to assume the allow-read-only-access-from-other-accounts IAM Role in the prod account, you must be in the \_account.prod-read-only IAM Group. See [Configure other IAM Users](/refarch/access/setup-auth/#configure-other-iam-users) for how you add users to IAM Groups. + +:::note +Not all of the default roles referenced in the `cross-account-iam-roles` module are deployed in each account. +::: + + + diff --git a/docs/refarch/access/how-to-auth-aws/index.md b/docs/refarch/access/how-to-auth-aws/index.md deleted file mode 100644 index e20b88b93c..0000000000 --- a/docs/refarch/access/how-to-auth-aws/index.md +++ /dev/null @@ -1,55 +0,0 @@ -# Command Line (CLI) Authentication - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. - -## Accessing resources - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. - -## Using aws-vault with the Reference Architecture - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. - -# AWS Web Console Authentication - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. - -## Security account difference - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. - -## How the IAM roles work - -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. - -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. - -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. - - - diff --git a/docs/refarch/access/how-to-auth-ec2/index.md b/docs/refarch/access/how-to-auth-ec2/index.md index db64d7f05e..6decb2f4aa 100644 --- a/docs/refarch/access/how-to-auth-ec2/index.md +++ b/docs/refarch/access/how-to-auth-ec2/index.md @@ -1,17 +1,71 @@ -# SSH to an EC2 Instance +# SSH to EC2 Instances +You can SSH to any of your EC2 Instances in the Reference Architecture in two different ways: -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. +1. `ssh-grunt` (Recommended) +1. EC2 Key Pairs (For emergency / backup use only) -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +## `ssh-grunt` (Recommended) -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +[`ssh-grunt`](../../../reference/modules/terraform-aws-security/ssh-grunt/) is a tool developed by Gruntwork that automatically syncs user accounts from AWS IAM to your servers to allow individual developers to SSH onto EC2 instances using their own username and SSH keys. +In this section, you will learn how to SSH to an EC2 instance in your Reference Architecture using `ssh-grunt`. Every EC2 instance has `ssh-grunt` installed by default. + +### Add users to SSH IAM Groups + +When running `ssh-grunt`, each EC2 instance specifies from which IAM Groups it will allow SSH access, and SSH access with sudo permissions. By default, these IAM Group names are `ssh-grunt-users` and `ssh-grunt-sudo-users`, respectively. To be able to SSH to an EC2 instance, your IAM User must be added to one of these IAM Groups (see Configure other IAM Users for instructions). + +### Upload your public SSH key + +1. Authenticate to the AWS Web Console in the security account. +1. Go to your IAM User profile page, select the "Security credentials" tab, and click "Upload SSH public key". +1. Upload your public SSH key (e.g. `~/.ssh/id_rsa.pub`). Do NOT upload your private key. + +### Determine your SSH username + +Your username for SSH is typically the same as your IAM User name. However, if your IAM User name has special characters that are not allowed by operating systems (e.g., most punctuation is not allowed), your SSH username may be a bit different, as specified in the `ssh-grunt` [documentation](../../../reference/modules/terraform-aws-security/ssh-grunt/). For example: + +1. If your IAM User name is `jane`, your SSH username will also be `jane`. +1. If your IAM User name is `jane@example.com`, your SSH username will be `jane`. +1. If your IAM User name is `_example.jane.doe`, your SSH username will be `example_jane_doe`. + + +### SSH to an EC2 instance + +Since most EC2 instances in the Reference Architecture are deployed into private subnets, you won't be able to access them over the public Internet. Therefore, you must first connect to the VPN server. See [VPN Authentication](../how-to-auth-vpn/index.md) for more details. + +Given that: + +1. Your IAM User name is jane. +1. You've uploaded your public SSH key to your IAM User profile. +1. Your private key is located at `/Users/jane/.ssh/id_rsa` on your local machine. +1. Your EC2 Instance's IP address is 1.2.3.4. + + +First, add your SSH Key into the SSH Agent using the following command: + +```bash +ssh-add /Users/jane/.ssh/id_rsa +``` + +Then, use this command to SSH to the EC2 Instance: + +```bash +ssh jane@1.2.3.4 +``` + +You should now be able to execute commands on the instance. + +## EC2 Key Pairs (For emergency / backup use only) + +When you launch an EC2 Instance in AWS, you can specify an EC2 Key Pair that can be used to SSH into the EC2 Instance. This suffers from an important problem: usually more than one person needs access to the EC2 Instance, which means you have to share this key with others. Sharing secrets of this sort is a security risk. Moreover, if someone leaves the company, to ensure they no longer have access, you'd have to change the Key Pair, which requires redeploying all of your servers. + +As part of the Reference Architecture deployment, Gruntwork will create EC2 Key Pairs and put the private keys into AWS Secrets Manager. These keys are there only for emergency / backup use: e.g., if there's a bug in `ssh-grunt` that prevents you from accessing your EC2 instances. We recommend only giving a handful of trusted admins access to these Key Pairs. diff --git a/docs/refarch/access/how-to-auth-vpn/index.md b/docs/refarch/access/how-to-auth-vpn/index.md index 13ac872ae9..0535cfe201 100644 --- a/docs/refarch/access/how-to-auth-vpn/index.md +++ b/docs/refarch/access/how-to-auth-vpn/index.md @@ -1,17 +1,51 @@ -# VPN Authentcation +# VPN Authentication +Most of the AWS resources that comprise the Reference Architecture run in private subnets, which means they do not have a public IP address, and cannot be reached directly from the public Internet. This reduces the "surface area" that attackers can reach. Of course, you still need access into the VPCs so we exposed a single entrypoint into the network: an [OpenVPN server](https://openvpn.net/). -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. +## Install an OpenVPN client -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +There are free and paid OpenVPN clients available for most major operating systems. Popular options include: -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +1. OS X: [Viscosity](https://www.sparklabs.com/viscosity/) or [Tunnelblick](https://tunnelblick.net/). +1. Windows: [official client](https://openvpn.net/index.php/open-source/downloads.html). +1. Linux: + ```bash title="Debian" + apt-get install openvpn + ``` + + ```bash title="Redhat" + yum install openvpn + ``` + +## Join the OpenVPN IAM Group + +Your IAM User needs access to SQS queues used by the OpenVPN server. Since IAM users are defined only in the security account, and the OpenVPN servers are defined in separate AWS accounts (stage, prod, etc), that means you need to authenticate to the accounts with the OpenVPN servers by assuming an IAM Role that has access to the SQS queues in those accounts. + +To be able to assume an IAM Role, your IAM user needs to be part of an IAM Group with the proper permissions, such as `_account.xxx-full-access` or `_account.xxx-openvpn-users`, where `xxx` is the name of the account you want to access (stage, prod, etc). See [Configure other IAM users](/refarch/access/setup-auth/#configure-other-iam-users) for instructions on adding users to IAM Groups. + +## Use openvpn-admin to generate a configuration file + +To connect to an OpenVPN server, you need an OpenVPN configuration file, which includes a certificate that you can use to authenticate. To generate this configuration file, do the following: + +1. Install the latest [`openvpn-admin binary`](https://github.com/gruntwork-io/terraform-aws-openvpn/releases) for your OS. + +1. Authenticate to AWS via the CLI. You will need to assume an IAM Role in the AWS account with the OpenVPN server you're trying to connect to. This IAM Role must have access to the SQS queues used by OpenVPN server. Typically, the `allow-full-access-from-other-accounts` or `openvpn-server-allow-certificate-requests-for-external-accounts` IAM Role is what you want. + +1. Run `openvpn-admin request --aws-region --username `. + +1. This will create your OpenVPN configuration file in your current directory. + +1. Load this configuration file into your OpenVPN client. + +## Connect to one of your OpenVPN servers + +To connect to an OpenVPN server in one of your app accounts (Dev, Stage, Prod), click the "Connect" button next to your configuration file in the OpenVPN client. After a few seconds, you should be connected. You will now be able to access all the resources within the AWS network (e.g., SSH to EC2 instances in private subnets) as if you were "in" the VPC itself. diff --git a/docs/refarch/access/setup-auth/index.md b/docs/refarch/access/setup-auth/index.md index cfc5a67892..ab1f94aafe 100644 --- a/docs/refarch/access/setup-auth/index.md +++ b/docs/refarch/access/setup-auth/index.md @@ -1,35 +1,131 @@ # Set up AWS Auth -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. +## Configure root users -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +Each of your AWS accounts has a root user that you need to configure. When you created the child AWS accounts (dev, stage, prod, etc), you provided the root user's email address for each account; if you don't know what those email addresses were, you can log in to the root account (the parent of the AWS Organization) and go to the AWS Organizations Console to find them. -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +Once you have the email addresses, you'll need the passwords. When you create child accounts in an AWS organization, AWS will not allow you to set the root password. In order to generate the root password: -## 1. Configure root user +1. Go to the AWS Console. +1. If you had previously signed into some other AWS account as an IAM User, rather than a root user, click "Sign-in using root account credentials." +1. Enter the email address of the root user. +1. Click "Forgot your password" to reset the password. +1. Check the email address associated with the root user account for a link you can use to create a new password. -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +:::danger +Please note that the root user account can do anything in your AWS account, bypassing the security restrictions you put in place, so you need to take extra care with protecting this account. +::: -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +We strongly recommend that when you reset the password for each account, you also: -## 2. Configure your IAM users +1. Use a strong password: preferably 30+ characters, randomly generated, and stored in a secrets manager. +1. Enable Multi-Factor Auth (MFA): Follow [these instructions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html#enable-virt-mfa-for-root) to enable MFA for the root user. + After this initial set up, you should _not_ use the root user account afterward except in very rare circumstances. (e.g., if you get locked out of your IAM User account and no one has permissions to reset your password). For day-to-day tasks, you should use an IAM User instead, as described in the next section. -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +Please note that you'll have to repeat the process above of resetting the password and enabling MFA for every account in your organization: dev, stage, prod, shared, security, logs, and the root account. -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +## Configure your IAM user -## 3. Configure other IAM users +The security account defines and manages all IAM Users. When deploying your Reference Architecture, Gruntwork creates an IAM User with admin permissions in the security account. The password for the IAM User is encrypted via PGP using [Keybase](https://keybase.io) (you'll need a free account) and is Base64-encoded. -Haxx0r ipsum foo Trojan horse new all your base are belong to us ip error private shell fopen semaphore epoch char packet sniffer segfault gurfle bypass. Memory leak bubble sort injection leet malloc brute force double xss mega sudo mountain dew void echo win emacs linux piggyback bin. I'm compiling float bang case cat infinite loop Donald Knuth unix for /dev/null machine code then chown d00dz worm gnu crack packet bar eof while. +To access the Terraform state containing the password, you need to already be authenticated to the account. Thus to get access to the initial admin IAM User, we will use the root user credentials. To do this, you can either: -Lib void brute force bypass nak concurrently all your base are belong to us break leapfrog bit default packet sniffer Linus Torvalds. Man pages packet stack trace Starcraft Donald Knuth pwned worm hello world public giga frack gurfle. Irc fork malloc fopen script kiddies flood blob fail hexadecimal while access semaphore loop mega Trojan horse foo gobble. +- Log in to the AWS Web Console using the root user credentials for the security account and set up the password and AWS Access Keys for the IAM User. -Bang spoof *.* headers Dennis Ritchie pragma bubble sort mutex d00dz firewall wombat snarf. Win L0phtCrack back door big-endian tera injection flush suitably small values interpreter class hello world client segfault. Boolean buffer emacs highjack concurrently boolean I'm compiling malloc finally char protected void fopen ascii var cd Trojan horse public. +- Use the [Gruntwork CLI](https://github.com/gruntwork-io/gruntwork/) to rotate the password using the command: + + ```bash + gruntwork aws reset-password --iam-user-name + ``` + +Once you have access via your IAM user, finish hardening your security posture: + +1. Enable MFA for your IAM User by following [these instructions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable.html). MFA is required by the Reference Architecture, and you won't be able to access any other accounts without it. + + :::note + Note that the name of the MFA must be exactly the same as the AWS IAM Username + ::: + +1. Log out and log back in — After enabling MFA, you need to log out and then log back in. This forces AWS to prompt you for your MFA token. + + :::caution + Until you enable MFA, you will not be able to access anything else in the web console. + ::: + +1. Create access keys for yourself by following [these instructions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html). Store the access keys in a secrets manager. You will need these to authenticate to AWS from the command-line. + +## Configure other IAM users + +Now that your IAM user is all set up, you can configure IAM users for the rest of your team. + +:::note +Each of your users will need a free [Keybase](https://keybase.io/) account so that their credentials can be encrypted just for their access. +::: + +All of the IAM users are managed as code in the security account in the `account-baseline-app` module. If you open the `terragrunt.hcl` file in that repo, you should see the list of users, which will look something like: + +```yaml +jane@acme.com: + create_access_keys: false + create_login_profile: true + groups: + - full-access + pgp_key: keybase:jane_on_keybase +``` + +Here's how you would add two more users, Alice and Bob, to your security account: + +```yaml +jane@acme.com: + create_login_profile: true + groups: + - full-access + pgp_key: keybase:jane_on_keybase +alice@acme.com: + create_login_profile: true + groups: + - _account.dev-full-access + - _account.stage-full-access + - _account.prod-full-access + - iam-user-self-mgmt + pgp_key: keybase:alice_on_keybase +bob@acme.com: + create_login_profile: true + groups: + - _account.prod-read-only + - ssh-grunt-sudo-users + - iam-user-self-mgmt + pgp_key: keybase:bob_on_keybase +``` + +A few notes about the code above: + +1. **Groups**. We add each user to a set of IAM Groups: for example, we add Alice to IAM Groups that give her admin access in the dev, stage, and prod accounts, whereas Bob gets read-only access to prod, plus SSH access (with `sudo` permissions) to EC2 instances. For the full list of IAM Groups available, see the [IAM Groups module](https://github.com/gruntwork-io/terraform-aws-security/tree/main/modules/iam-groups#iam-groups). + +1. **PGP Keys**. We specify a PGP Key to use to encrypt any secrets for that user. Keys of the form `keybase:` are automatically fetched for user `` on [Keybase](https://keybase.io/). + +1. **Credentials**. For each user whose `create_login_profile` field is set to `true`, a password will be automatically generated. This password can be used to log in to the web console. This password will be encrypted with the user's PGP key and visible as a Terraform output. After you run `terragrunt apply`, you can copy/paste these encrypted credentials and send them to the user. + +To deploy this new code and create the new IAM Users, you will need to: + +1. Authenticate to AWS via the CLI. + +1. Apply your changes by running `terragrunt apply`. + +1. Share the login URL, usernames, and (encrypted) password with your team members. + + :::note + Make sure to tell each team member to follow the [Configure your IAM User instructions](#configure-your-iam-user) to log in, reset their password, and enable MFA. + ::: + + :::caution + Enabling MFA is required to access the Reference Architecture + ::: diff --git a/sidebars/refarch.js b/sidebars/refarch.js index 0c876b9c56..cb9af81a2d 100644 --- a/sidebars/refarch.js +++ b/sidebars/refarch.js @@ -15,8 +15,8 @@ const sidebar = [ collapsible: false, items: [ "refarch/whats-this/what-is-a-reference-architecture", - "refarch/whats-this/understanding-the-deployment-process" - ] + "refarch/whats-this/understanding-the-deployment-process", + ], }, { label: "Configuration", @@ -36,6 +36,8 @@ const sidebar = [ items: [ "refarch/access/setup-auth/index", "refarch/access/how-to-auth-vpn/index", + "refarch/access/how-to-auth-aws-web-console/index", + "refarch/access/how-to-auth-CLI/index", "refarch/access/how-to-auth-ec2/index", ], }, From 7d3d7e5e8dabdb971454c409129d6c1628a61283 Mon Sep 17 00:00:00 2001 From: Max Moon Date: Fri, 26 May 2023 15:15:13 -0700 Subject: [PATCH 86/89] Update docusaurus.config.js Co-authored-by: Eben Eliason --- docusaurus.config.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docusaurus.config.js b/docusaurus.config.js index 0eced8a87c..8b3257cc00 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -234,12 +234,12 @@ const config = { href: "https://terratest.gruntwork.io", }, { - label: "Stay Up to Date", + label: "Gruntwork Releases", to: "/guides/stay-up-to-date", }, { - label: "Gruntwork Releases", - to: "/guides/stay-up-to-date/releases", + label: "Style Guides", + to: "/guides/style", }, { label: "Support", From daf061dfd9cd211769f8900d940f8279aadd7569 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Tue, 30 May 2023 07:34:09 -0700 Subject: [PATCH 87/89] remove guides sidebar --- sidebars.js | 2 -- sidebars/guides-index.js | 40 ---------------------------------------- 2 files changed, 42 deletions(-) delete mode 100644 sidebars/guides-index.js diff --git a/sidebars.js b/sidebars.js index e1016aebb8..0522e727f2 100644 --- a/sidebars.js +++ b/sidebars.js @@ -10,7 +10,6 @@ */ const introSidebar = require("./sidebars/intro-guide.js") -const guidesSidebar = require("./sidebars/guides-index.js") const productionFrameworkSidebar = require("./sidebars/production-framework-guide.js") const refarchUsageSidebar = require("./sidebars/refarch-usage-guide.js") const landingZoneSidebar = require("./sidebars/landing-zone-guide.js") @@ -34,7 +33,6 @@ const refarchSidebar = require("./sidebars/refarch.js") /** @type {import('@docusaurus/plugin-content-docs').SidebarsConfig} */ const sidebars = { introSidebar, - guidesSidebar, productionFrameworkSidebar, refarchUsageSidebar, landingZoneSidebar, diff --git a/sidebars/guides-index.js b/sidebars/guides-index.js deleted file mode 100644 index ec65686747..0000000000 --- a/sidebars/guides-index.js +++ /dev/null @@ -1,40 +0,0 @@ -const sidebar = [ - { - label: "Foundations", - type: "doc", - id: "guides/index", - }, - { - label: "Reference Architecture", - type: "doc", - id: "guides/reference-architecture/index", - }, - { - label: "Build Your Own Architecture", - type: "doc", - id: "guides/build-it-yourself/index", - }, - { - label: "Update Guides", - type: "doc", - id: "guides/stay-up-to-date/index", - }, - { - label: "Style Guides", - type: "doc", - id: "guides/style/index", - }, - { - label: "Working with our code", - type: "category", - items: [ - "guides/working-with-code/using-modules", - "guides/working-with-code/tfc-integration", - "guides/working-with-code/versioning", - "guides/working-with-code/contributing", - "guides/working-with-code/forking", - ], - }, -] - -module.exports = sidebar From 8b7c4797bf5793b4a296c7dddaab4ffe5761e36d Mon Sep 17 00:00:00 2001 From: Max Moon Date: Tue, 30 May 2023 07:52:39 -0700 Subject: [PATCH 88/89] Remove lorem pages fro example (#834) * remove lorem * remove remaining lorem pages --- .../iac/usage/composing-your-own-service.md | 3 --- .../iac/usage/customizing-modules.md | 11 --------- _docs-sources/iac/usage/using-a-module.md | 15 ------------ _docs-sources/iac/usage/using-a-service.md | 15 ------------ _docs-sources/pipelines/index.md | 3 --- .../index.md | 3 --- .../refarch/usage/do-this-first-auth/index.md | 3 --- _docs-sources/refarch/usage/index.md | 3 --- docs/iac/usage/composing-your-own-service.md | 11 --------- docs/iac/usage/customizing-modules.md | 19 --------------- docs/iac/usage/using-a-module.md | 23 ------------------- docs/iac/usage/using-a-service.md | 23 ------------------- docs/pipelines/index.md | 11 --------- .../index.md | 11 --------- .../refarch/usage/do-this-first-auth/index.md | 11 --------- docs/refarch/usage/index.md | 11 --------- docs/reference/intro.md | 3 --- 17 files changed, 179 deletions(-) delete mode 100644 _docs-sources/iac/usage/composing-your-own-service.md delete mode 100644 _docs-sources/iac/usage/customizing-modules.md delete mode 100644 _docs-sources/iac/usage/using-a-module.md delete mode 100644 _docs-sources/iac/usage/using-a-service.md delete mode 100644 _docs-sources/pipelines/index.md delete mode 100644 _docs-sources/refarch/usage/complete-your-refarch-integration/index.md delete mode 100644 _docs-sources/refarch/usage/do-this-first-auth/index.md delete mode 100644 _docs-sources/refarch/usage/index.md delete mode 100644 docs/iac/usage/composing-your-own-service.md delete mode 100644 docs/iac/usage/customizing-modules.md delete mode 100644 docs/iac/usage/using-a-module.md delete mode 100644 docs/iac/usage/using-a-service.md delete mode 100644 docs/pipelines/index.md delete mode 100644 docs/refarch/usage/complete-your-refarch-integration/index.md delete mode 100644 docs/refarch/usage/do-this-first-auth/index.md delete mode 100644 docs/refarch/usage/index.md delete mode 100644 docs/reference/intro.md diff --git a/_docs-sources/iac/usage/composing-your-own-service.md b/_docs-sources/iac/usage/composing-your-own-service.md deleted file mode 100644 index 8371cf0e39..0000000000 --- a/_docs-sources/iac/usage/composing-your-own-service.md +++ /dev/null @@ -1,3 +0,0 @@ -# Composing your own service - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Fusce id velit ut tortor pretium viverra. Congue quisque egestas diam in arcu cursus euismod quis. Diam quis enim lobortis scelerisque fermentum dui. Vel pharetra vel turpis nunc eget lorem dolor. Pellentesque eu tincidunt tortor aliquam nulla facilisi cras fermentum. Enim praesent elementum facilisis leo vel fringilla. Integer feugiat scelerisque varius morbi enim nunc faucibus a pellentesque. Erat velit scelerisque in dictum non. Arcu dictum varius duis at consectetur lorem donec. Praesent elementum facilisis leo vel. Sit amet dictum sit amet justo donec enim diam. Accumsan lacus vel facilisis volutpat est velit. Egestas tellus rutrum tellus pellentesque eu tincidunt tortor aliquam. Sagittis nisl rhoncus mattis rhoncus urna. diff --git a/_docs-sources/iac/usage/customizing-modules.md b/_docs-sources/iac/usage/customizing-modules.md deleted file mode 100644 index a81c10a69d..0000000000 --- a/_docs-sources/iac/usage/customizing-modules.md +++ /dev/null @@ -1,11 +0,0 @@ -# Customizing Modules - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Dapibus ultrices in iaculis nunc sed augue lacus. Tempor orci eu lobortis elementum nibh tellus molestie. Augue eget arcu dictum varius duis at consectetur. Commodo elit at imperdiet dui accumsan sit amet nulla. Est pellentesque elit ullamcorper dignissim cras tincidunt lobortis feugiat. Nulla porttitor massa id neque aliquam vestibulum morbi blandit cursus. Id diam vel quam elementum pulvinar etiam non quam. Tortor id aliquet lectus proin. Elementum nisi quis eleifend quam adipiscing vitae. Nulla at volutpat diam ut venenatis. Diam quis enim lobortis scelerisque fermentum dui. Egestas fringilla phasellus faucibus scelerisque eleifend donec pretium vulputate. Pharetra vel turpis nunc eget lorem dolor sed. In ante metus dictum at tempor commodo. Aliquet nibh praesent tristique magna sit. Elit ut aliquam purus sit amet. - -## Forking - -Forks are useful tools for eating! - -## Submitting PRs - -Sometimes you might need to do this! diff --git a/_docs-sources/iac/usage/using-a-module.md b/_docs-sources/iac/usage/using-a-module.md deleted file mode 100644 index 378c2b6f9e..0000000000 --- a/_docs-sources/iac/usage/using-a-module.md +++ /dev/null @@ -1,15 +0,0 @@ -# Using a Module - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ullamcorper sit amet risus nullam eget felis eget nunc lobortis. Lorem mollis aliquam ut porttitor leo a diam sollicitudin tempor. Accumsan sit amet nulla facilisi morbi tempus iaculis urna. Eget dolor morbi non arcu risus quis varius quam quisque. Pharetra magna ac placerat vestibulum lectus mauris ultrices. Duis convallis convallis tellus id interdum velit laoreet id donec. Enim ut tellus elementum sagittis vitae et leo. Varius duis at consectetur lorem. Cursus risus at ultrices mi tempus imperdiet nulla malesuada. - -## With Terraform - -Here's how to use a module with terraform! - -## With Terragrunt - -Here's how to use a module with terragrunt - -## Testing - -Now that you've used a module to stand up infrastructure, try writing a test for it! Gruntwork built Terratest with this use case in mind. Checkout the [Terratest docs](https://terratest.gruntwork.io/) to learn more! diff --git a/_docs-sources/iac/usage/using-a-service.md b/_docs-sources/iac/usage/using-a-service.md deleted file mode 100644 index 6ab90ba6b3..0000000000 --- a/_docs-sources/iac/usage/using-a-service.md +++ /dev/null @@ -1,15 +0,0 @@ -# Using a Service - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Cras tincidunt lobortis feugiat vivamus at augue. Quam nulla porttitor massa id neque aliquam. Aenean vel elit scelerisque mauris pellentesque. Ac felis donec et odio pellentesque diam volutpat. Volutpat est velit egestas dui id ornare. Non consectetur a erat nam at lectus. Vitae ultricies leo integer malesuada. Sit amet venenatis urna cursus eget. Erat pellentesque adipiscing commodo elit at imperdiet. Libero nunc consequat interdum varius sit amet mattis. Semper quis lectus nulla at volutpat diam ut. Mauris augue neque gravida in fermentum et. Velit euismod in pellentesque massa placerat. Lacus suspendisse faucibus interdum posuere lorem ipsum dolor. Massa vitae tortor condimentum lacinia. Sed enim ut sem viverra. - -## With Terraform - -Here's how to use a module with terraform! - -## With Terragrunt - -Here's how to use a module with terragrunt - -## Testing - -Now that you've used a service to stand up infrastructure, try writing a test for it! Gruntwork built Terratest with this use case in mind. Checkout the [Terratest docs](https://terratest.gruntwork.io/) to learn more! diff --git a/_docs-sources/pipelines/index.md b/_docs-sources/pipelines/index.md deleted file mode 100644 index ccd9212e7f..0000000000 --- a/_docs-sources/pipelines/index.md +++ /dev/null @@ -1,3 +0,0 @@ -# Gruntwork Pipelines - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. At lectus urna duis convallis convallis tellus id interdum velit. Pretium vulputate sapien nec sagittis aliquam. Tristique senectus et netus et. Nullam eget felis eget nunc lobortis mattis aliquam faucibus purus. Aliquet sagittis id consectetur purus ut. Lectus magna fringilla urna porttitor rhoncus dolor. Eget felis eget nunc lobortis mattis aliquam faucibus purus in. Erat nam at lectus urna duis convallis convallis. Euismod lacinia at quis risus sed vulputate odio. diff --git a/_docs-sources/refarch/usage/complete-your-refarch-integration/index.md b/_docs-sources/refarch/usage/complete-your-refarch-integration/index.md deleted file mode 100644 index 45b1764832..0000000000 --- a/_docs-sources/refarch/usage/complete-your-refarch-integration/index.md +++ /dev/null @@ -1,3 +0,0 @@ -# Complete your Pipelines integration - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/usage/do-this-first-auth/index.md b/_docs-sources/refarch/usage/do-this-first-auth/index.md deleted file mode 100644 index 00ca657fd0..0000000000 --- a/_docs-sources/refarch/usage/do-this-first-auth/index.md +++ /dev/null @@ -1,3 +0,0 @@ -# 1. Do this first - get access to your Ref Arch - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/_docs-sources/refarch/usage/index.md b/_docs-sources/refarch/usage/index.md deleted file mode 100644 index 580a7ce60b..0000000000 --- a/_docs-sources/refarch/usage/index.md +++ /dev/null @@ -1,3 +0,0 @@ -# Usage - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. diff --git a/docs/iac/usage/composing-your-own-service.md b/docs/iac/usage/composing-your-own-service.md deleted file mode 100644 index d68364b262..0000000000 --- a/docs/iac/usage/composing-your-own-service.md +++ /dev/null @@ -1,11 +0,0 @@ -# Composing your own service - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Fusce id velit ut tortor pretium viverra. Congue quisque egestas diam in arcu cursus euismod quis. Diam quis enim lobortis scelerisque fermentum dui. Vel pharetra vel turpis nunc eget lorem dolor. Pellentesque eu tincidunt tortor aliquam nulla facilisi cras fermentum. Enim praesent elementum facilisis leo vel fringilla. Integer feugiat scelerisque varius morbi enim nunc faucibus a pellentesque. Erat velit scelerisque in dictum non. Arcu dictum varius duis at consectetur lorem donec. Praesent elementum facilisis leo vel. Sit amet dictum sit amet justo donec enim diam. Accumsan lacus vel facilisis volutpat est velit. Egestas tellus rutrum tellus pellentesque eu tincidunt tortor aliquam. Sagittis nisl rhoncus mattis rhoncus urna. - - - diff --git a/docs/iac/usage/customizing-modules.md b/docs/iac/usage/customizing-modules.md deleted file mode 100644 index 2d8bc7c7b3..0000000000 --- a/docs/iac/usage/customizing-modules.md +++ /dev/null @@ -1,19 +0,0 @@ -# Customizing Modules - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Dapibus ultrices in iaculis nunc sed augue lacus. Tempor orci eu lobortis elementum nibh tellus molestie. Augue eget arcu dictum varius duis at consectetur. Commodo elit at imperdiet dui accumsan sit amet nulla. Est pellentesque elit ullamcorper dignissim cras tincidunt lobortis feugiat. Nulla porttitor massa id neque aliquam vestibulum morbi blandit cursus. Id diam vel quam elementum pulvinar etiam non quam. Tortor id aliquet lectus proin. Elementum nisi quis eleifend quam adipiscing vitae. Nulla at volutpat diam ut venenatis. Diam quis enim lobortis scelerisque fermentum dui. Egestas fringilla phasellus faucibus scelerisque eleifend donec pretium vulputate. Pharetra vel turpis nunc eget lorem dolor sed. In ante metus dictum at tempor commodo. Aliquet nibh praesent tristique magna sit. Elit ut aliquam purus sit amet. - -## Forking - -Forks are useful tools for eating! - -## Submitting PRs - -Sometimes you might need to do this! - - - diff --git a/docs/iac/usage/using-a-module.md b/docs/iac/usage/using-a-module.md deleted file mode 100644 index bb26d0b0f1..0000000000 --- a/docs/iac/usage/using-a-module.md +++ /dev/null @@ -1,23 +0,0 @@ -# Using a Module - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ullamcorper sit amet risus nullam eget felis eget nunc lobortis. Lorem mollis aliquam ut porttitor leo a diam sollicitudin tempor. Accumsan sit amet nulla facilisi morbi tempus iaculis urna. Eget dolor morbi non arcu risus quis varius quam quisque. Pharetra magna ac placerat vestibulum lectus mauris ultrices. Duis convallis convallis tellus id interdum velit laoreet id donec. Enim ut tellus elementum sagittis vitae et leo. Varius duis at consectetur lorem. Cursus risus at ultrices mi tempus imperdiet nulla malesuada. - -## With Terraform - -Here's how to use a module with terraform! - -## With Terragrunt - -Here's how to use a module with terragrunt - -## Testing - -Now that you've used a module to stand up infrastructure, try writing a test for it! Gruntwork built Terratest with this use case in mind. Checkout the [Terratest docs](https://terratest.gruntwork.io/) to learn more! - - - diff --git a/docs/iac/usage/using-a-service.md b/docs/iac/usage/using-a-service.md deleted file mode 100644 index 67ecb78b89..0000000000 --- a/docs/iac/usage/using-a-service.md +++ /dev/null @@ -1,23 +0,0 @@ -# Using a Service - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Cras tincidunt lobortis feugiat vivamus at augue. Quam nulla porttitor massa id neque aliquam. Aenean vel elit scelerisque mauris pellentesque. Ac felis donec et odio pellentesque diam volutpat. Volutpat est velit egestas dui id ornare. Non consectetur a erat nam at lectus. Vitae ultricies leo integer malesuada. Sit amet venenatis urna cursus eget. Erat pellentesque adipiscing commodo elit at imperdiet. Libero nunc consequat interdum varius sit amet mattis. Semper quis lectus nulla at volutpat diam ut. Mauris augue neque gravida in fermentum et. Velit euismod in pellentesque massa placerat. Lacus suspendisse faucibus interdum posuere lorem ipsum dolor. Massa vitae tortor condimentum lacinia. Sed enim ut sem viverra. - -## With Terraform - -Here's how to use a module with terraform! - -## With Terragrunt - -Here's how to use a module with terragrunt - -## Testing - -Now that you've used a service to stand up infrastructure, try writing a test for it! Gruntwork built Terratest with this use case in mind. Checkout the [Terratest docs](https://terratest.gruntwork.io/) to learn more! - - - diff --git a/docs/pipelines/index.md b/docs/pipelines/index.md deleted file mode 100644 index 6b47829d77..0000000000 --- a/docs/pipelines/index.md +++ /dev/null @@ -1,11 +0,0 @@ -# Gruntwork Pipelines - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. At lectus urna duis convallis convallis tellus id interdum velit. Pretium vulputate sapien nec sagittis aliquam. Tristique senectus et netus et. Nullam eget felis eget nunc lobortis mattis aliquam faucibus purus. Aliquet sagittis id consectetur purus ut. Lectus magna fringilla urna porttitor rhoncus dolor. Eget felis eget nunc lobortis mattis aliquam faucibus purus in. Erat nam at lectus urna duis convallis convallis. Euismod lacinia at quis risus sed vulputate odio. - - - diff --git a/docs/refarch/usage/complete-your-refarch-integration/index.md b/docs/refarch/usage/complete-your-refarch-integration/index.md deleted file mode 100644 index b7091632f5..0000000000 --- a/docs/refarch/usage/complete-your-refarch-integration/index.md +++ /dev/null @@ -1,11 +0,0 @@ -# Complete your Pipelines integration - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. - - - diff --git a/docs/refarch/usage/do-this-first-auth/index.md b/docs/refarch/usage/do-this-first-auth/index.md deleted file mode 100644 index 4fa174bc63..0000000000 --- a/docs/refarch/usage/do-this-first-auth/index.md +++ /dev/null @@ -1,11 +0,0 @@ -# 1. Do this first - get access to your Ref Arch - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. - - - diff --git a/docs/refarch/usage/index.md b/docs/refarch/usage/index.md deleted file mode 100644 index 40c47c9e87..0000000000 --- a/docs/refarch/usage/index.md +++ /dev/null @@ -1,11 +0,0 @@ -# Usage - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Tortor vitae purus faucibus ornare suspendisse sed nisi. At tempor commodo ullamcorper a. Eu volutpat odio facilisis mauris. Nec feugiat nisl pretium fusce id velit ut. In nibh mauris cursus mattis molestie a iaculis at erat. Et magnis dis parturient montes. At tempor commodo ullamcorper a lacus. Porta nibh venenatis cras sed felis eget velit aliquet. Aenean sed adipiscing diam donec adipiscing tristique risus nec. Aenean euismod elementum nisi quis eleifend quam. Elit sed vulputate mi sit amet mauris commodo quis. - - - diff --git a/docs/reference/intro.md b/docs/reference/intro.md deleted file mode 100644 index ac0f6c7029..0000000000 --- a/docs/reference/intro.md +++ /dev/null @@ -1,3 +0,0 @@ -# Reference - -Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. From db4b9b5f577b8c20f53cac026b21cbc24349baa8 Mon Sep 17 00:00:00 2001 From: Maxwell Moon Date: Tue, 30 May 2023 08:14:26 -0700 Subject: [PATCH 89/89] add using our modules page to iac sidebar --- sidebars/iac.js | 1 + 1 file changed, 1 insertion(+) diff --git a/sidebars/iac.js b/sidebars/iac.js index 2b188f5cb4..5b8d90d4b9 100644 --- a/sidebars/iac.js +++ b/sidebars/iac.js @@ -33,6 +33,7 @@ const sidebar = [ // "iac/usage/using-a-service", // "iac/usage/customizing-modules", // "iac/usage/composing-your-own-service", + "guides/working-with-code/using-modules", "guides/working-with-code/tfc-integration", ], },