From 2d01257db9fe593bd1f0758c40570663c992960e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nikodem=20Rabuli=C5=84ski?= Date: Tue, 4 Feb 2025 23:29:50 +0100 Subject: [PATCH 1/6] services/kanidm: init --- secrets/kanidm-admin-pass.age | 7 +++ secrets/kanidm-idm-admin-pass.age | 8 +++ secrets/secrets.nix | 8 +++ services/default.nix | 1 + services/kanidm.nix | 85 +++++++++++++++++++++++++++++++ 5 files changed, 109 insertions(+) create mode 100644 secrets/kanidm-admin-pass.age create mode 100644 secrets/kanidm-idm-admin-pass.age create mode 100644 services/kanidm.nix diff --git a/secrets/kanidm-admin-pass.age b/secrets/kanidm-admin-pass.age new file mode 100644 index 0000000..2b229b2 --- /dev/null +++ b/secrets/kanidm-admin-pass.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 84j9mw W4+Z4WjOyUl4mWPqVykNWRhf2/8qfVOSM7QCFPNMZTA +0ndQjslMwjQqguN25nBQtCchpCLhoD/vrxh1yNVeTNw +-> ssh-ed25519 GKhvwg H8XcFJDZTA3IzxmK6wbB+PVM2gCZ4ysAPjL5j0LgeE0 +kehTMRIVOZ5ubtO7w8WF+gU3sjYXMQtd5hH+wcv3uSE +--- 72ntrRbWq8pdkk/GrsVupTttfY9t+w3l+2KQbQyNn/I +iyd$vVl TK$4G[MI[#tz:r9~ESA6}׵ \ No newline at end of file diff --git a/secrets/kanidm-idm-admin-pass.age b/secrets/kanidm-idm-admin-pass.age new file mode 100644 index 0000000..0eac321 --- /dev/null +++ b/secrets/kanidm-idm-admin-pass.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 84j9mw 8zYeVXx36dpC8TxMdoM1GdERoNNj902KwTF4h/r4inM +n3mYra0BeM4gWsZ7Roilu14o/GajX1iWw0fcy0q31yc +-> ssh-ed25519 GKhvwg cqd7YmVpbxqZxaVluHDZ8Yw0gNfJCKMmoWa4mEoXym8 +Gbcj+PJaqyPRRGX4olr7mmJ5IoEGlQaogYbj7i9E/98 +--- LoQPWI+m8s3NjalUh0+xdW54c8lgddBmhPoIiPbmR8I +Җ܉Y +9!42DVP9N]G;?ЉS ' \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 57943fa..552e4e3 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -97,4 +97,12 @@ in keys.system.ude keys.other.bootstrap ]; + "kanidm-admin-pass.age".publicKeys = [ + keys.system.kazuki + keys.other.bootstrap + ]; + "kanidm-idm-admin-pass.age".publicKeys = [ + keys.system.kazuki + keys.other.bootstrap + ]; } diff --git a/services/default.nix b/services/default.nix index 1837462..8cf5ccf 100644 --- a/services/default.nix +++ b/services/default.nix @@ -2,5 +2,6 @@ imports = [ ./attic.nix ./forgejo-runner.nix + ./kanidm.nix ]; } diff --git a/services/kanidm.nix b/services/kanidm.nix new file mode 100644 index 0000000..b288e14 --- /dev/null +++ b/services/kanidm.nix @@ -0,0 +1,85 @@ +{ + services.kanidm = + let + port = 8443; + domain = "auth.rabulinski.com"; + in + { + host = "kazuki"; + ports = [ port ]; + config = + { config, pkgs, ... }: + let + cert = config.security.acme.certs.${domain}; + in + { + age.secrets.rabulinski-com-cf = { + file = ../secrets/rabulinski-com-cf.age; + owner = config.services.nginx.user; + }; + age.secrets.kanidm-admin-pass = { + file = ../secrets/kanidm-admin-pass.age; + owner = "kanidm"; + }; + age.secrets.kanidm-idm-admin-pass = { + file = ../secrets/kanidm-idm-admin-pass.age; + owner = "kanidm"; + }; + + services.kanidm = { + enableServer = true; + package = pkgs.kanidmWithSecretProvisioning; + serverSettings = { + bindaddress = "127.0.0.1:${toString port}"; + inherit domain; + origin = "https://${domain}"; + trust_x_forward_for = true; + tls_chain = "${cert.directory}/fullchain.pem"; + tls_key = "${cert.directory}/key.pem"; + }; + provision = { + enable = true; + idmAdminPasswordFile = config.age.secrets.kanidm-idm-admin-pass.path; + adminPasswordFile = config.age.secrets.kanidm-admin-pass.path; + }; + }; + + systemd.services.kanidm.serviceConfig = { + SupplementaryGroups = [ cert.group ]; + }; + + users.users.nginx.extraGroups = [ "acme" ]; + networking.firewall.allowedTCPPorts = [ + 80 + 443 + ]; + + services.nginx = { + enable = true; + recommendedProxySettings = true; + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedTlsSettings = true; + virtualHosts."auth.rabulinski.com" = { + forceSSL = true; + enableACME = true; + acmeRoot = null; + locations."/" = { + proxyPass = "https://localhost:${toString port}"; + proxyWebsockets = true; + extraConfig = '' + proxy_ssl_verify off; + proxy_ssl_name ${domain}; + ''; + }; + }; + }; + + security.acme.certs.${domain} = { + dnsProvider = "cloudflare"; + credentialsFile = config.age.secrets.rabulinski-com-cf.path; + reloadServices = [ "kanidm" ]; + }; + }; + }; +} From 5e8eeb032e662327a31e9130d722bdce0822c16a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nikodem=20Rabuli=C5=84ski?= Date: Wed, 5 Feb 2025 16:28:31 +0100 Subject: [PATCH 2/6] services/forgejo: move from hosts/kazuki --- hosts/kazuki/default.nix | 1 - hosts/kazuki/forgejo.nix | 62 ------------------------------------ services/default.nix | 1 + services/forgejo.nix | 69 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 70 insertions(+), 63 deletions(-) delete mode 100644 hosts/kazuki/forgejo.nix create mode 100644 services/forgejo.nix diff --git a/hosts/kazuki/default.nix b/hosts/kazuki/default.nix index df92f1c..8464cb5 100644 --- a/hosts/kazuki/default.nix +++ b/hosts/kazuki/default.nix @@ -15,7 +15,6 @@ ./storage.nix ./ntfy.nix ./zitadel.nix - ./forgejo.nix ./prometheus.nix ]; diff --git a/hosts/kazuki/forgejo.nix b/hosts/kazuki/forgejo.nix deleted file mode 100644 index 9f200e2..0000000 --- a/hosts/kazuki/forgejo.nix +++ /dev/null @@ -1,62 +0,0 @@ -{ config, ... }: -{ - age.secrets.rab-lol-cf = { - file = ../../secrets/rab-lol-cf.age; - owner = config.services.nginx.user; - }; - - services.forgejo = { - enable = true; - settings = { - server = { - DOMAIN = "git.rab.lol"; - ROOT_URL = "https://git.rab.lol/"; - }; - oauth2_client = { - REGISTER_EMAIL_CONFIRM = false; - ENABLE_AUTO_REGISTRATION = true; - ACCOUNT_LINKING = "auto"; - UPDATE_AVATAR = true; - }; - service = { - DISABLE_REGISTRATION = false; - ALLOW_ONLY_INTERNAL_REGISTRATION = false; - ALLOW_ONLY_EXTERNAL_REGISTRATION = true; - }; - federation.ENABLED = true; - }; - repositoryRoot = "/storage-box/forgejo/repos"; - lfs = { - enable = true; - contentDir = "/storage-box/forgejo/lfs"; - }; - }; - - services.nginx = { - enable = true; - recommendedProxySettings = true; - recommendedGzipSettings = true; - recommendedOptimisation = true; - recommendedTlsSettings = true; - virtualHosts."git.rab.lol" = { - forceSSL = true; - enableACME = true; - acmeRoot = null; - locations."/" = { - proxyPass = "http://127.0.0.1:3000"; - extraConfig = '' - proxy_set_header Connection $http_connection; - proxy_set_header Upgrade $http_upgrade; - ''; - }; - }; - }; - - users.users.nginx.extraGroups = [ "acme" ]; - security.acme.acceptTerms = true; - security.acme.certs."git.rab.lol" = { - dnsProvider = "cloudflare"; - credentialsFile = config.age.secrets.rab-lol-cf.path; - email = "nikodem@rabulinski.com"; - }; -} diff --git a/services/default.nix b/services/default.nix index 8cf5ccf..6da3b28 100644 --- a/services/default.nix +++ b/services/default.nix @@ -3,5 +3,6 @@ ./attic.nix ./forgejo-runner.nix ./kanidm.nix + ./forgejo.nix ]; } diff --git a/services/forgejo.nix b/services/forgejo.nix new file mode 100644 index 0000000..2f69a55 --- /dev/null +++ b/services/forgejo.nix @@ -0,0 +1,69 @@ +{ + services.forgejo = { + host = "kazuki"; + ports = [ 3000 ]; + config = + { config, ... }: + { + age.secrets.rab-lol-cf = { + file = ../secrets/rab-lol-cf.age; + owner = config.services.nginx.user; + }; + + services.forgejo = { + enable = true; + settings = { + server = { + DOMAIN = "git.rab.lol"; + ROOT_URL = "https://git.rab.lol/"; + }; + oauth2_client = { + REGISTER_EMAIL_CONFIRM = false; + ENABLE_AUTO_REGISTRATION = true; + ACCOUNT_LINKING = "auto"; + UPDATE_AVATAR = true; + }; + service = { + DISABLE_REGISTRATION = false; + ALLOW_ONLY_INTERNAL_REGISTRATION = false; + ALLOW_ONLY_EXTERNAL_REGISTRATION = true; + }; + federation.ENABLED = true; + }; + repositoryRoot = "/storage-box/forgejo/repos"; + lfs = { + enable = true; + contentDir = "/storage-box/forgejo/lfs"; + }; + }; + + services.nginx = { + enable = true; + recommendedProxySettings = true; + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedTlsSettings = true; + virtualHosts."git.rab.lol" = { + forceSSL = true; + enableACME = true; + acmeRoot = null; + locations."/" = { + proxyPass = "http://127.0.0.1:3000"; + extraConfig = '' + proxy_set_header Connection $http_connection; + proxy_set_header Upgrade $http_upgrade; + ''; + }; + }; + }; + + users.users.nginx.extraGroups = [ "acme" ]; + security.acme.acceptTerms = true; + security.acme.certs."git.rab.lol" = { + dnsProvider = "cloudflare"; + credentialsFile = config.age.secrets.rab-lol-cf.path; + email = "nikodem@rabulinski.com"; + }; + }; + }; +} From 34ceff5b9dee965ddadba6dbab35a0ca23c6f0e6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nikodem=20Rabuli=C5=84ski?= Date: Tue, 4 Mar 2025 13:47:56 +0100 Subject: [PATCH 3/6] modules/system/containers: enable nat for container interfaces --- modules/system/containers.nix | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/modules/system/containers.nix b/modules/system/containers.nix index a0942f9..26e7e7e 100644 --- a/modules/system/containers.nix +++ b/modules/system/containers.nix @@ -85,6 +85,12 @@ let services.openssh.hostKeys = [ ]; system.stateVersion = lib.mkDefault config.system.stateVersion; + + networking.useHostResolvConf = false; + networking.nameservers = [ + "1.1.1.1" + "1.0.0.1" + ]; }; bindMounts = { @@ -95,6 +101,11 @@ let privateNetwork = lib.mkForce true; } ) config.settei.containers; + + networking.nat = lib.mkIf (config.settei.containers != { }) { + enable = true; + internalInterfaces = [ "ve-+" ]; + }; }; darwinConfig = lib.optionalAttrs (!isLinux) { From 755d759137ed5abbd574e4cbf279d20ca9b9d198 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nikodem=20Rabuli=C5=84ski?= Date: Sat, 22 Mar 2025 00:30:42 +0100 Subject: [PATCH 4/6] services/forgejo: forgejo but make it COOL --- assets/forgejo/apple-touch-icon.png | Bin 0 -> 8193 bytes assets/forgejo/avatar_default.png | Bin 0 -> 9082 bytes assets/forgejo/favicon.png | Bin 0 -> 8186 bytes assets/forgejo/favicon.svg | 1 + assets/forgejo/logo.png | Bin 0 -> 27336 bytes assets/forgejo/logo.svg | 1 + flake.nix | 4 ++++ services/forgejo.nix | 13 +++++++++++++ 8 files changed, 19 insertions(+) create mode 100644 assets/forgejo/apple-touch-icon.png create mode 100644 assets/forgejo/avatar_default.png create mode 100644 assets/forgejo/favicon.png create mode 100644 assets/forgejo/favicon.svg create mode 100644 assets/forgejo/logo.png create mode 100644 assets/forgejo/logo.svg diff --git a/assets/forgejo/apple-touch-icon.png b/assets/forgejo/apple-touch-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..f082d31578d19b35f5f794c814f7040a461662bc GIT binary patch literal 8193 zcmeAS@N?(olHy`uVBq!ia0y~yVAuk}9Bd2>47O+4j2IZ?Pk6dGhEy=VnZdX`DNx|} zYOdIIN+McZtN|?!UnQ9sn;1mD$}%xAdATfVSkt25vdTr;Ra?RP8El>fpwiOkJz7DSfp@xzF7Z*VNaaC2p6mC z(jdmeCl0oA+uQaz8Gg%u=qEVDO;8 z;(`C9lPb0On{RH2T6@6Y@IwK+`Tn1pX2ohv{k2y5`|sLUH>7&m7GLy;Tj;z{KvqYt z|FPur&yscf=Vvt?RCqh{ddlv*LDxf9UwzX2G2tbKEm=&B4K+^sV%)o2FGU#6 z^!Xrm`l(RZ>aQPr4A!&sF8%Vp^=6J5yN{Z1*HNXX_Z#Ah14UNuyO?o8xx{L2-JLDp zC3x5_yetWc*AO|dhwbxE8T*^2%zUlQ3SG=jE-#&@Fa>f>SS7;3$f6Y3pw;0bs3^e7 z)TH3x;KK5NV@ilf0E6p{&uq*Oc9or<`d9G6yMH&gZ#MpHCd2o6pR$p7x9hvEzb#dJ z&pl>pWH_=u{(|20ZgH7jw=cp4ULWhbk2@LhD!!qt zcg~Z%?cVRZ8QVGzKYXzFOV!><+N+a{W+vp7oLXT1v}xMp8yO}qL@)FmENxQzRbr)j zxVq44uEta^NA5lSFT4)C4CXarntisd^nt}{Q4=o9E%6gB=WLIzni{wMxO~@f--@QJ z3hoC2-tjjdf6TbQJICyF_Eay`txfMrtR6jBu_!>JV}8Be{Fnce99WJOv$2@`Ntkjs z&-@b4yeVCp&BvOw98U}HKbYXKs=`K2r2FU+qhqrt)VDL58~r+YL;cB_`k88r4otDB z-59Y#@Jrg}i8Y>Iot1aE=WU<;{CtX$zxZsnzk-+YwtxP|((HKaZP}OWOD<=|?Z29} zQm|zA-DjMOFRs|e@u0+tGkePE)L&`uc@$RtY|`LUVF?J)(CXk~6lHK)%Hrk1sQEF!Cty{NLKKls2 z;aL^?;KwQB3@v+|EBEi`Pi62_uV24wm(}aCl?E@K2di@$vD$3acDTGSDJGJQ_xcGZ zYisK;O^+Fe&Zf3|$VmqHg@uL|-k(_2rBuvzFQo;_!5 zl`@Yy?9rN$krJJoyEem8egT_cORlQ4iTK-)?cZL%UY+$TDDEiNGv^K4Se}0V{MoJM zWUYjR#Dddp)4kUIsONj+f9lZxW1P|_Pd|UYe6!)_FJHEFIwrAy;IwO(!P?DFNwKiRg(%$glB$+39jDUH}}`St78b-WdxIrsYY>*;HD@7*iw z8Ta$Yj|>Cnj{BjL`}dp6H-2$y?)Eaw=yXi5oRj-Ea5H1^ z*CZynsjrs_T8P~e)IVny86Tf-^scRqZSi4d{dmm{-YXtXnQ$Upq4&bO@JWt`)jZZc z*Z2|C&|_tGQRK6;iLdE97am>x-h*5-JsjNK+$6Xs{>Wf_D#yd|Nm59&(AHJj#C*PP z(8eXNpGNU8AGWiw*ihtXbe#LptP8E44NQW%|0jtQeEIh6(b>r_j1>1h&tIVVEiRky z_R*~$dTuaw8)c}uXw^NN9>cE4F5VF+FDo0l^Tmr72J7nU>+K7VJ$&@2X_}d&nPS`; z+p5i*H&5cv;F*42VgBX4i|iDd_14|tz5j|kLE1#T>E@NE4Vm_9Os%Z4rZU}|X_@!Q zPGv&st8kA1(^+OK)KV@kd;k9ZQOPYWcSZPWn4VUqe%!zrc<_k)+Tct_F{uyBmZ_b+ z+jjKfe`VDrZ{NN>W~CwS+*EQg!@A2TV^cvL#)mW>EmAMnT4`@)TeNMSp+1ZL zTs1j4xiuR%243!Z@%#6E@sICgo<3L*+im5N*xdHwdAnq^0F%b|uH|W`^``2F?b)__ zcXnnoTWW@_r=8}NCy$_be9XUEHD| zHQ()$N2>93F;`wmMd>g1?#0zLx4oJuCo$L2;lZO$XK%g#i;9>1?Y{3^_LA!Y^J`U6 zVdsY~GP?K8IYn)4ZI4!F*jeb8HLy!cc_@APsAO{QXx_;Uyo)YKbU)?#aLz`%wL@jS z*Ngv(#uapVpL=0X;;}88TE(@tE;=YDFF$?4e4FMaGZiNvS+jEWc?0UtNqWnzo0T&bHZO}$3-aFFYqheh6y9q3D9k=P)xD;^{<4I(_g=>9R+VC6Vovkpl?288H1<1s zU-4&?H44Z)7@=`-@tQO1S{l}LD9H@5Q61**@do!jueqxRdul()abW3OKR zeD3qscVBI?@9q4z_0`}xN4<{vUR(QT{r{s0g>#fs-Mbt%x|$y^Y{F827@w;X+eG}9k=nE@7`7gKK!{xy`yMjj&Tg*0fwC$8I63v*}`8e*-8ROop zZywFd26iJN3j;OL?C5rfV6^eV!o}7mpkEMc-30bxS0~RBJqbeW?j{Kd^$tm z_q-U>aMf))1KC$;ZPk4KTFrm%0(*(?w-1@zT5vY&o8#0?sSK&P+D1#gcFBHvy-DWQ zPtVUr2~U%B(|gJuJSaEL&|Y^wv)SqHo_D)muQ~Q>3Emv=?l0BTW%ehG`UPGwo z>eGN%Z>w+nDW$8qW#6f2=9{H5bFIsw<-F30b@ulb)M}&&stMV)I7MW%^qXfK(z08V zZ8h4lrB2Yn0nHU^~q!2Sy_Ae*GF$(=c!WFaY5GQyhQ#5 zf18gj{N~r=>uV>!P~PMvQ8Q--w=kP+oUHA{7vgMHae}9hNo@&CJLu-E@{7%B+M8fT zfn!o8OTWLE>g^V_D8EDE{j})3nP(Q9jCB=npSRm(k^hb#kGgNFeY%;##(R-v)n3(! zFStLXd@#SEmi1u?Tke6B_q%2Zck}^>f#3Gag#!tPT^9NO``l}O@5X^6 zY_hLBr38g-oy)2&Ys@*fz;sGmLNfoeP<5fSl`TBdzvrA=plB7&u}Vj(^GNOYyXFQ{ zbF!M_c9*Rc&d|vf>vVCNeKm9WTrp*hG^325|9%dCY9?xZ=wu1Id*H*enLM|m3r}e- zw-8)`4>Yl2|RQZpH?wH2qyUQBrc{T*t{w1)GY`+m=WEPCt^~lOOP^{_|P$wN864KVJOs zSjP4B@%@~c_qb2COcdf>C@y<@>wMMrv`yk)S1g}jcWae-!3Fm3k@k;UFWh{WekACT z7F&+q&a|vgd~q^XlCr!j`4fL-+{#P8z!KV2y~?*<@PqjcJxQ5=tKXjA;5v8zHjm)7 zJd8?Kd8tNBGrCqx?YeV7G(5)fcjRY%OQuaMOgveOy``P^$0cmy^vfos(vT@h_4RybX7p*4uriOZb@S6i*tPUVc+>RF?1eVJD)7q{jHU6HXff<`S@YG{I}gZ&HhcRV#`fcS-JGW zruzT?u1$`ezU$_sr!BEOD*cUbQ)F4eL@6o-ab=J4z>Z(%@ zWBy#0J1{No=`5D2U?y|BGUi1c#dE`+eJ`5%!F<6iM`xZ#Pnx%eGJOrI@Z3}C-X|kD zp`2^w+T7dQOfM@~+%e^U=gaR9w&v8=89z+97s(~+J+L{@x~0MB#RZM^c^7!jxPDyD zsuBBOUiG_=);ko8H*d(2vlY1Y(EZxY$|!-e`~Ls?-C;h9-~P{r({YY@Zao|MVrS&> zNU?FW%Uk?!WbQ>iNE2y<+O9U1FtW6n52-sb;_KE>q?nR`OaKjkof!CTd(rBllt#=e1WdBuakQY+Ac0H@%|g zz=3zOMW@HtRhBlJ1tlGH;9FJY>+wlfK*X>6mQV1BkV@Nh=WphDcRWfiCaENZMi}3B zS1o_>;L)#rw^(AWJ2|C#%J0{HKk(pe*v}_3EULfVOrKqR@eI>lgN2MrmkqU*oYqxF zbc*q){#$ijr8y)y;mHvDgL?64>ey2(^0yYq*^h(&bf%E~?|Sfc-7!L$3WtD^p~|4t4i4%~>N> zUapXM_t%7|&9&tDF*w@T@yCt-ZxydH<^Mt5Z7aQhWV^>SQ?f5rln#SVu zyH{%n3G~b=d4KkKHPTYd0q_46O;whk{!x7(G}Z#kO1e($rG zv##Q?CjQCS3ZHyG70iCS_{M_A{5>6UF1GF(<;TuWD_MVI)s=q_oFdOw88tc1x%6um z%NNmS%dMxU9K0iD`>#sESiUM}X~3h~`~hB@zMkj4Ge=>$#_DZHwb$@9_o3fm2t#d=$Pm%5<~g>C=~AywEJTkZQ~FSvhmj^ZE7rew;XU&z0S(e$V6? zUE0Eul6ooG+vZ9yP?6Ja&`O-nKO_E0`ORmkv0AG4UuOAapJ|Ein?2JgV|rJh7|R#d z)l$r1785VM;u4%QiG6kF+UV_W6Ma8iulaORz4YbcQ{8?tpZ;?wEPAUapuH-|N4Mtp z+wG?|Ki*>XD7*95$D?ywY_=TOaP8Fkvc~C&j@;$`I#+n*XI1rGm6~b)Yp>m}7mJsf z?J%2Y_2gR!%cZH6hBJ!2KhB+)^Q3Y)mrbZI>&6ntf|#)Nak{;#6_OSPm;3%c5Vo4y z#I4Ve!v0y|NB0EIeMeR;lil|$ORaYKlvjV6cCFjQ!W6q|w${vl|7NPN-udAPclrI;s^i+7O}4EwcdlMi@ju_K(qg8NwcTN{GkQlB zI2TMj@^VT3_50m*AM2;{eY~q`DsHaTr{B5r3sa}EYVpU9r=~KWf4*CF)`EI1y%+B$ z?fd-qzs9Cr`?tKfF^z*`Rb$e%J-oBzJEz!B>^k><`jk8JUbo(ttI9rpwD)Yij?ngc zEy>9S@9d@Xtq-pH*uO~l4zJMusc)`^s}^ruyF}M^GV@ZYAHSX0K7IYqXU1|Pa<=T! z#H-)`MVP$rd-X4mQ|6b)Y_FZ?t}ftA`TcbH{JLKr_b-NR-F)R??2q@{Z{HUPt}c7b zBropjd;j-sj#N+Wga4EYH>`bPclXVF@9KzHl{($XrRTi^o<+XV$h>9n;KzRFR2$bH zSJ}HSWlQ`GKl=7d{Z^*3%*!uypI$q6biv7$ZB{Q}ctN7xDA4`2NE@pMT8X<7?)h)JM3IDBr z@pT^>tKa9^=?QVhbp6+StlBrFXqR-woaX3dADotTxva5RT*~UR)Ue`$*N@Y(f+|Ve zZPn3N7vz>Io>`GICqknO zT5`+N|1+XaaxSeute0Bfbp33G;Jgz@cI7+YNtIy}w0);<$uTwDQK0$zR$0SaUuAdA z_4J&R;Lyn{bWC@$FbwPVR-03v+Ugc8Q+;yUb0`M2gwu{i1V14oa+>GJH)WCT;vZbII*f3wBCBoH0LO z^XBx;UY{A>FXv^i*tX+L-UUU+rDvbJFdx1)cjLMzM+y&4 zP5F7)MbTGxK|=ka=0Z!WwkxqOyjQoM$-5x9b^pI#uX$C31fy>rWyy9^&px|4=RlI# z*#lPfPUeQs`p)NFcrwpvt*lVy38wo3Qq#jGKb*PMdVbLL>i2uy7hON+Ug%(``imP> za!oM4z@ig2^X7uNDwo{+)D)ZoCOHNEle2o_$uDD}kn5_s@8|bJhd&s3?4PiEYTvGn z6ONyJcd1li-Mwm+7mXh3ZsFT@vE1%hrK&6}@p|o-|IY2{=W4H}9Zy)hPpR=~jQS%Kb2^HwlY1UJnIe$Id&X-cl)i(;) zZO{>#G<(XDVqu9%4=3K7$n|#4gZFPQ|92ISDsL3bc~Sdmt8=^k1+6u2UiXG+C@g#D zYnDKTsJ}jbThpCtCTB`4=AXwFyLz7g^BzI%JPp(1hd(6PC^&ab z=`Ci}7g(II-1f(VW+U#Rqt2hww@hO#ztj26sv`5kS_gHB^AQEF4z}3EE~)ik)V|8? z@$3 z!N|Qn+!5>Eb@d1(`f7&j*PoxrwswQD()E>9rWZdbtm{5F%SCKrk6G@mCG*d63%^|X zlx6BplNa-pj-_)HsXS4AHt}WXDvdkGweG$u;7b;t#$2GZ=fG_9e81**E8Pk;YUDO= z(_gvX`__g4<<}yuA6PYFm3C+x){=`@dfw`_PF@d#mfC;mu*D8nbeK8*B~957tHHag z|Ht)3E03+n-~08Nn&HnSv3fHnm7Sl!w)V2J%bBfaz3xee+juW7Zf~2wcGo<>t~b=Z z+AnF(87H2nme1!DhcI7W@SDxVng2xA+Nv26>pvGhY!yGYB4tXm$%}mt|NVa7@AtCA zUM={LQtaz_FRyzyzf%?wZknupciC>GLZ20j+8PAz`AC(>FPy91_DjNZ`C&D~vb^n6 zR9n}Wys%>mfB0;6{ zi@BMu6f9-3O5ep9h_l0|^W&pADcmn&mpgvf zQ9Zi%fYD`rb4ekM9X(N(U8G9xtue}*f7f1xlroMoYw8i zrrYcO{!$BEuF-1zcHX`}pH639=$COfuye!Q)sN|WTSbevaDX}=TxNucJX z$qP%tYt4z<)6PmU8A~O33VS$Se7B%TDrtf<`(ZzsYQ~O0fubvSm3gBs7eTctv+DQyDL2)V`fpQ-<^`nzO}qNE-y%avO!W`SkdvO=@b56 zM~-+mtF4gR>{L`bPfu5>b=unK?aLg$vtFE)>gAB6_2S3N$w8q~Tf!DA+!YA$KeKJO z;KnIhzRmAEKeqDEozZ(#f|udghoz4C5;KzJ+76x0@mLeP`Bx)YAgkHjlIY`j_UXB$j_0dcoO>#6@2xHmX79|Hc4KRHxYU3~M9S&0}CtcJy>{45?szJC}7ri2L<6 zY3_GAE)4=sJl(t5Z|`_;vYoAS_X0tkcYH@K?qE82SGDnhz@1p}yPx;Jk1t)dYg>Zk z&hlsH?$)iE_scG4lX3Cyd+#nUKX1sXATGnT{ow2chaYZO!P;@YazV_xn97l_^ zY))Fp@D*#>uq=(-oHofkKTcNVy=1%cMiE2CC$1WcbA=%&fk-0@A)rXrtip| zCF}=%EN-xL>?z=#!Y*GE;E|TL?8^H1c=i)=5mzl_{>9e&AG#Z$6Fsw`fM4X-dHeqz zo2tL(S$@A${IxxnrCTz;&|+QVe}{!zv#w6Eez(JU{m!`?7I88tFNi5VYdUG_&f@1@ z3!PfOu*;?FIrz|{IsTB3#`1Ypt9WEA0#1B;d;4eh-e+}&p3ijtD*pcZTK)K=)$8|d zlCSQUY**g5ciXc9?i2$Lx#~BD>#C2oH6PveEYHmIiLXXxW@gcY1B{k(Z*OnEF8@tn z&q0^|!-br4_*&y?zh1RkYOi)ZzJ9Om-t*~`92|Fup89;=UjJs{hX;=P6sv_lmOL(S zar69PXtT=vvHrdvP7)la`u6|-7hUxH+}i6g(UVzbIh~xUJzXb$UyR?8HeTr^H9tT7 zVm@yslW_BKfl2f11s{^0`=s37mMf&`JImza>s-+@`9f#n1M+q}Wb2%Ab91`)!6w$P z?eFqs`jUeg|8cg))qFf^lzYphb6P96xYsT)Q({Nu_q*j^S3b0?{{C+2BG>L$rPnUL-`g)65Lffj^<$HwbK8xHZFa{5%eoHN z1-y7VJzlR{TwiQ|=FLq@SF^`3v7Zyn0&%U)ad%69e#2I-qiP0VQi`!qFvv|xi)2eipioi0bLaX<$ zO;-2pJ9ysix6huo@=3S0X1|uc!J94N9$}QvAunj9Xh)#>G$W<==AI z{qZv2*+=+iOpRO{Wm+q&onSfnl*PKH*CmSoUM`>SW%Tm)_Vsg3qHjzumM?vEMbJKS zSINpLda<{pUTV(T{Ir5YuH{g3@#kk}C#P&qIVn^v8+7~i@h6EIwZFay?w2&roAc!S z{P_DP&KvZ5ipsDi#A|%{b~}H%taX`3zy`kHy*V~d95sG^dOCS+^mZ?$AMbX*e^c_* z-&gCw3XXK=ws%jbhR1!(%|G0HXU)cA&c_^fKAje=GI7t(XS2U4f2@4WVKn{F*ML(~ zG?fpx^G{d!^srt2)z>KxL%IH(oVD}x(L7lm)X zSG8KDyQha|nSJ!r7^Y3`kIeqxYjTR-p0{@QqsHZFXJ^d|{im~Pq17@4bzwI4HCEBt zlj1&~5Y7HA#`X5%;`Sv%z0&5_UT5qOFZN#OuES6BYS>mf4BaEIraa33W@A^7_urvv$pyF0ik0PPk5OvHhE&7aDc(nbzWEKv!T^j?o?K|nYVZz7hNd{u;?`ZCevW zXPBo*HylMqweakAB2S0v3pZ}J7 z+x-4e?H{|?O(sVwXG@#sJz41?XeF9*_1)>M6c_01vj!N-diOEkVL?zfv{aG1IB+VcpF zS6|(yYK5w_KHPKD&bG|Oyyel7Nz2N>8KTQoeg1*XmbC z@c2*Giu&AB?Pb}h8NBSq{F|0)PI?VaGX*5XEbgA#q*iHhZpmKW0J+L16A!Sc%?M0T zEqK?$>+^)?O4+I3-``J{VUTXP#r%XxSaI#wcPqLt81PPdc6RpdW|euo9?}k5v*LXr`yS3)TP{_dRzJ71n0X14$ST+UPIev^wwvsilqYda zG;4IK>@n^zNIe=gU8bSj@hN-m)47*#?5W)R^{)Fhk8f2PQ@Z!cFnyl;hX2)ViA(1D z+JhFkbRM|Zdb4Rw-rZegD|VZnVczZ{NficB1p;vb*&~NxUKvm(~{e=_uXBFm+Y;v^NO_2oZomV=v+%?*yP{p4>)`)w?Eyl z8NF@Ii}jUJZ#N#7OEzRs;~b;TIm&K57knCIj?Xg9e#2NaxwBzwK*c33 z^+RXv<}JALCZg)?*6XLP$JeiIJ|w6lrW=*QKjE|w%bTmsMwYpUJC@e$P+s>mH*fdb zZ4=zfWQ^0#ZDIG=>e1Dl%JzH4+V8TZyGvdwwQ`G#$x57^Wjgt2w|KYm7Xy}j{s~^s zSf(^MNgn3^&1bdT_vxvr!u#TT@0^`y8!cnm4r*#JtDK$FFeyMo**MXTc|mW*3s>=2 zm7XZeBDwqZ|7%0iFLgUF-2dlOcMGpu&W+a-BAKF+zxA5mOZc_>y}$Og_o=3Z?>25| zH9LHm-|oi(9yyzcN$rnM>+j#PnXAaPC?WoZzx`j8#NgVk(Jg?T%-+%fv z-Doau|NVbHoj$b8K!^MADRHg&YxbP@di_r2b4|N{vHxbL&#QF1wKZG)PRs63r?i*W z{QR`bxZdZy)oYzXmPNPU&hrS~-umgHu-gs2#?H<==Xbo@_4>w2ug~jiCQJ9}Ogdxy zn1^A5jaI+V2jgdKi>%U`$U)2}mw@s2eE-&{NXH(x%@&7?H|C03c^A26m zzx?oL$cb0X{5A*dm)|jev_G*s$F5dVHc{ow+qo<<*Mu)jS>&;LCP!+tZoBfEh@Tnz z-ELj_t|4;IRkm+K@yn&tUorf=;c}u+rr^#r3mKilCCp1UcTV`fV1w|a!-8oN_qIoU z-)bOeB+PZ*&_ZV6`6s;#pPc7->-nOfWoG8(WjC3Ztm>R_Fd%R5*RVp1Lv?#@-E!5> zQF;=rafh|c;*ihrKH1U+o&H_-bb?i6`V0>5>%RD=QNvfUf7Y(p1ossiXYqeE3M`Nm zIc0Z`&pjfWFM|7vwXet&uEJBh4=;4x`bUA%zq7OPWx$NJ zuL@cOSI;fGKchM&zUZXtBM#-fzlm3^SLY`!*ebRmjnSlC+2zBD&3t`_H|*$a{JbC_ z{LBGCqlmq3>?aC@m3KbaCa{gUY{$#cX*~CC{1iSVTYg88&po2z?bhoh1#jAq`pA?t z1+5BM8DMg$(4s;%d_{mGyNA56y6J)o`~Us&mgx(5emj5v*68|hQ@ITcT-p^+WbVXH zvo%)pou#7l=FBw?`#&F=H=N>qU4L==y(;ertCQ10W2H5g7`fc_5&F0dEKY2Ebtfv^Io@!aJb5HW|KG{RJ4*P6Qn8vc&=U(;u zy@#GzuDKn$r=l>no;~vA%+9ze|Rit$$>)yWF-5c)z zxVYH8x$fMoyPc8uy9GVw@jPwQzdlKQPsYwlx3AZyYKKod)+_ya<$;4oe#Nh8Ij?@q zaK6Ix`Str=yf&En=i_mC@qf|(czC{TIPdlK)z#Kkp&RS^E-vx6|7)T+QTz4Z?}l=l zO&m z-q^5k18?NosI5;Pb?ZM9Kf&GX?;GagvovVonvX}iKkpE?H?Lc~Qt9Wf*X!MFE#B{Z zF86T1ZomSD<(ZBv9<9%P_ChVM0I+m$S)DOaH;T*xg*- z#h=a{=6aJpuX5Q2NwwK`J~KTFX%H_sIZ1Wva(Aax`7aHJ&K;Sz?|Oun{oDKd<8QFd z{y$Gp*{*Uj=Y8jETgujJa`RWrxO=*FmRL#OX(iV#j@_G!4uq@@^R;M*`2X$M?EGt8 zmHSTU+ctbC{_v%?$WV@3J8aE`uRPZ+Jl}@p?d%VnhhDJ1zWr(C!nd93{`1aoa4Zj~>2jSSe@sr{9)F*M`JLyy zhcACWne}z!q0F`WKy3rni#?LY$Nt&09o%!webs@(ov&hdWL?#ID|%uZlMuK4|391a znOoxPF5K9h-hci5C+h% zme>AYyPd!P?QMoc{s|0a&%b`MtunNIB;p?5y}6;q3#<;y$1BER{f(f6LE){d>b?_k$+xA8I=tRSOsRTGdXBUCDH>$H?IQhLiK{>nEJfs8ZFp z^Ou@a#NWOCxUWlpg2sP=cwxDQ`G;4jIqX>?5Z$kACn;OwNF8kBR zzAOHh`~Pq8hq@aA*Dn8xhzsP*Yr1o=&-%;hyWxKYB;|U9ef>WB=DDzOzVomAZ)bb+ zN%F7Gwm3`Cp0a|CCrpf0t|jRjUzgY{+~vQ{T&~#i4!>mB)QSY7g>LKj+(_4q+OlFj zb4&TP206A*R~9+-L2GOw%-@7LX0dAIO(V`jjm?fLP~zTNzk zcKWl%6x(-SW4OPcT;kp@ck5}GY)Z`nIk95r53EPGN@QMHAz1IA_u>fmscE{eUo#|% zsCxYQ`F#GoefH~5pD*%nU4MN`W^iYlYq!|PL+KaVGXKQQ_kQ%?()U@6=M54pp6G`i zUircNhV(uj`L^=Is~^tXFriaG@FaizWQm9OnBv=PPwrh1wA5=KpTM#E%}1`R46d!5 zzlXb;vETc}H-~_P_!{lZZOdzW!WI?q$MC2hc>nPC2JRf*{O0KgE+^OtF0?-~Vb6-) z&*NklT%3}9|A~o#L&4)~)4$(bA8-GWNp9Yw*RdrRT^&!xKE5eeJAd;-&$b5jQa$s; zLoBC!)j*xNpF18ZD(!r`?Y71D#apih~*fRDX zv)-NaX;PS1b;Z|MU)Ct4qr!2y-`pQnJo~*jJ>>m)&ieh8?>qSCrR#WQsWgbLQ*P9h zw^?~SxGILHsPS-%t==Sy?N2oK6g@q4bNS65|8J@UDm7k}{(9eV)>FnmKWn5FbZTT= zzVy9VYIFD?rPp17)fn*9>$|Y{Wh|G&| zvaeI8oZQZM=%of{^{$gw!{c@14kqzeEwfi>eq3A3ly%U@mSw7sgx3}Mn&;={J`${% z^Snb~{oW5>GX5X`{KUyk{pTznH(xdz+04D$`4jYn8RuuRa;;-#DwuZgvdOP@`8taq zE8pEazkctjCtpqO_h`PXiA{@C7xMdEx#f0M{(Cno3lB$&IN_5!*3N&^)^)gzS9tw{ zs1vUlKi#W-?>XUN7JNxY8W7NuJulB zT3KFDmbhWUgX1OZ^X~4N$II8YH+X@m+2Y=dZO`9^@WprSER5HhnEO|vbgNfy+JR$g ze15I}UzKz(yu)&s`Cr|X&WC|M{$4zpi(*$9)ch!z_p<-lU&EO9(X5ju``gX@&)Zgg zG=D~ZYN$yhufDNdfKPSPg>P?fzjljvN|01Y=6S7Ic{i_7l)7WXvsY&h$<@VW$v5ewQ z3w>;VzTf}%8kLP#Zo_#J2L8W%ji-mJhcy&yMVw?Y?_;{f7sR_dHVm{P^he z>G3!A4kG=s_VZ{NR@jyR$+|iGaHTJOL$c4@XO}f!Io;S@_EyOK%LdE-P}@S~J+>TIeV#cjOeoYmnyo16?mgm_1G|OI%^q4XyY;l{9JMZedI~H37 z^)KdlsOKKY%EwdcczRlq&9y|~qM)Cj{#5Vbd&K)XYoX&V$uL94h5MH+UlX%4$nQv9 zi^O!hzgv9PMNE`GV|cfvv{!lSjegTRG9}M`{eLg8Gy3wXu&4j0|2%%bBbJ}V{NqYMOm9k9%DgD_ zx0wF4*x==_*u^eBp60(`E63HK!i)2lY~pn6)qL^q==(e=A&c$G2R5>Zy8U=v8OaqY z?{;|M&KH3zt{;dB+3;~v<>zOH4;D73*qlk9+{g23ibiEBv(H@o8^NG|_~r4F8b=nCujaAaDdU;Qx=HR!_1yMfJJ==p*ypHz z_--LF#kTnQDW5Ow58oF%K1<(l@z6;E5R z#$mcao&V;GvOWG4cA6ERAHP5A(2}n&#PL_f+kZxw+QB>Qtw#CkLf;f>pIj)6lKAlb z>*47CN5vP(96Xe5Yh`ivP^Q^lZ(lbq#{DAeQk%M)gYW;}ubH$s^txJ!qSrr}XO25q zE-Z58wr>8OG+Dvxpl_U+(?$Ntm(~1^mnF?_xV%Dh#jNG>Z+PBlu5tYy{cor8Cu0Gf zZPR$l5;tGr+vDTjk|}JIEzEIx&aK_AwS}+pE!_U@PgUrOD!H;#KNUX(+KR?@{PPN9@e+uh-*MCD&BFHJy2Xi{|1+$eT(Y+=SLs@d)6C!}9lEl!FN&%ey}CQMy~@JC*=-RYif^NW*o2Zk$?N+h`ts3;WPJF_(vE8 zN9^8n>C2arZw=coKc4yFB;%0>?%PtkEN1*j-K^kza+2!XY4wjN}TR`(jbtm>* zHoiOS_(aK|r-g}pTy=s$JBw2PR{Pw3F4D2k{rs}*z8RCGEP21~@jNGOrC!$I=C;JG zS4!QA<7fk$a$TJ0-hztw)j!=HGwyfzwn&Vd{lTLd&l4h!{PKDt`7wrx+xkO;i1^h$ z;r1oQLc84$U0$V=y@WYsoj9wkn^We=J9X`c7k5u7W&hEVdZBT-&flig;GJf#udS7? zURAtnb+dD?HE*g+N=>XxUxoCw4KrqoUVO|DxwGQqBV8eNodz%m^xUz@gxR%+=l;@Fg{E@q_6umvLcka2l)|+!QXYbvlYO?;caA@Bh zX7>Zr6Kx~TRQOC@V;U{V`M{=6PeJzu#{j{a*9NJnM>v z_$nTDowY|yrFQq-y#KZ6$AWK6AsgH`>h*O^pIM;#hr5nJzOD4ZOM`GFE|Zc5`vaDS zW(D_ouODPBQ2N7L$9lglRwe&5KD(!yoC~u$UeDrs~60 z;TwY6+P^;R{ZJDjCuYFdy!gLJgk)H|c=|@EH5}e42$?mD z&eUj-VfZ&a zwefrh+jZSFQtyHcZC-6Zck9rdFDWOk%(7bP{!rxxW0-N{;XqzH{^N(3BUf!K4(@1O zZpquRKyih2;|Uofv#ptTc5Dn;8+G-b{f1Z$`ApWhySH}|ID zHm*~GAAKyBXZuX$G`xKASfl?V#}6fsJt|*0F1&N{>@JSfzjXx5zqjTBz3ey;}>aaAu>tN(u8P`JcI^#RY@x~FF+`n88{ z{kY+qf`9HEg_$d>rEM-g>)>Xyi{K1mKgm|nH zJDkfMFHSHx-{sP`xc>jYZ~r`Mg{@?Czq%x?3|iVEdTa5agKqZULbT7eFu51r;O9!s zvT>eq@o~iVJlX5TRv!DzH2W8`#jH%XiK~9Q^#`A`<&3*I{#*0RG`kn`-C4S{+2*!z z;aZ-ENH_KqLNm@Uk?AX$!PuI6TB7wM-|;&;i{J7darg0hxMFR0;k}nN_kR~~_RdZ$ zoNTni^tj)Nv>A4MeC+;dQN3=}GY&k~V4MCj@Xp)Y+q>6W+&JLIexfeoAdA%T?NPac zb9+<_cO3hBjjuZYF-P4};WAw>8NO>@u8MISJaf6|No%*_?4R=6vqg=oBx@5_Dr{qT zeDTt@+}m8`?U8qn2v+ZnU-pj0T=ia|yhzpk+V3ZY{cRL;F3y=ZPcMf*d}ESpSnK(1 z??kiHkM=aXbA8!-hmBj({Xik?ml?^3RNb$$JM=9G!6SBmz{EnD~|=4r?LPGR+1 z{%@kxQVVx1Z~t#v_j}fqqlK&@r{WanJ$#VqE304~w0+d^P)ecVosyrRrIw z?Vg@@9b=K1J{;mMZQwD{Y=4}nkrQ+Ba^bwk4;GrpD*R3moE&74=A7tp z>EZ2p9kyq8-Ce@d_bRV&p2P)(5cU(Z)lv&e8bQ?VZ@5n2Ln<-4ak9{;setdX1NkRrRsICPoLg(i$&~sb-=2ywOXBr3x9k_Gz-1Tc47O+4j2IZ?4|=*dhEy=Voy)pGxcvID z_&axB=Vjdey4LY7Ykqh3-NNz}kKXy+o#0ehUcTGHb^X(t^Tzk*&20VdHR-Oe*~9;{ zE8CRJd*}Rl`l8l>FN*Hbs{$vEZxW0<;l}_ zaKe>Uq1~54t87CUxY(K%r9(tlF}Y4XbV1WYOeaENx&QoWv-9^w_Ewopkz_j@dm+eU zLC6b7jjTQFo=d%^y4>7RxL8Ch#G`kY;1n@7XTufqQ;!rqof^LCY)<1RXF+xDEsT>G znb|t#t_)uON$0Hkbe6l^l005vFJx~VPrP;RsCc}Lgn8Z^6*aY@#E`}Bm|f?%D{98< z*f7VYGU(j%z2EO$R^QI7#VE;R?)+KdR^Ne2P(0&xb2=bsm???g^o*!#ty|tPFO~O;Zyw)N7kmxh7(F z+1e%UPEJiRRWFx*%RN$%IFWS~m-S75X^qHDDG4twEEM8kQL*Kdu~1;;5($`HDb&R= z|CPC}v6z0GPUWX37u6%AjbbEXSbf`7qPOK-S`nyhS@mTF%VF{OnuXssF`QzmJZI&> z#xJLH&>-muM{QI3LhFS;j;%SxyHV@%T#W61Ia`(8`)=5#`a8@k;#c|k>FMP9 z|9``qSj8D?n|`lR_WqN&L*`eoeyx1{AH(-SLVWUdKNj9Py?(;-FIP__Xe?Q>#N+9y zsb4+MwH7&kY>u4zIx3UD=(O(k6Q`zXALX9@oye1n({t})^lE!HsD`f0y zBG&DCrDghxG2l(|4v}BJ;ZLuvjefoA%?$DQn!wzp#!oo&GeX+UuNExWeXOkeFGE)> z&-#Q=yF=$U#q2Dq3M=dV`1tthxo^HaDOz#=$TZ#PF5$YLPsQ*01ucBO;Krc>!7r1a z9^|;7eb8h6Z3FWa2?v|9u6(b0Snap)edXt8XCF&zhBP^6*?jf9xGb%SEgz{&qi?xG=<7eeImzS+TYI zq2pSW#94x@9yoN0Y&$Z=`5NCt+qNi!v}tEJgKcM4KUR<0 zlCjXtkc(?}_SYQ;ZF)QoZuljgzb8?DmJX}rp2x{&qu*UwIr+!Li;LY?+v>C)dKT;Z zq~9d{{Jg2{a#bGjN0Kf-KfGCIXWoP-r>1)UJ-sjG=BCtdCyK%}bpACgDSm!Vi1)?f zbpZ>T_Dy&hkaxn?r+9kZtCK(ee!qY8xWRg7?u?bE50~Cmaf&jR5RI5#@%QWX*W5F? zQrq_|V)~--g`-3}L~xhHDcSa8HZqfvj&`v|#xgC>8#qZX)pOQdR%D<&8%o4x|{UsCrEa*dF7Ppe>LoS9ab?ZQ+l` ztEC#zx1=VoIaB%T=~xIeXMT?OE>jm-UGm=Y%se zjnxmQ%*?&L?d1IWf0}!%zl(jFn9%2ZZjR;G%9YogY!|98m@`2>Bj1#rODA%ZOHyyy z+gq)7%|D8DEX?o~{KC8c?>Fh**Gck7W5j~z#TPu-Y&{8sNT*%Q30 zvdlxxJ$-$r?*IQU`d;1d+}{&5MQ5?x6>hx7)UNpQ!oubw2H#Yc9$q+ae*cTeOUE}{ z?ER${yue&>c?=Wlj~ON6RgBd$zr4LY{i*l2&);NT?3W9jd8U0v@S4`M8@cwz{;Fej z%4{y&Ja7Ka++Q-=K0P&C=k{0X$&{%Rc;xNweE#sS-~Qi;NoKnf|356MP37-ctGtCb zT<7rbIe+)=vRG2^z5f62_)ftWxfjG|ve^PO4B7yIUTzxcv}433kf z*JIuJU9TuD-hQ`iw(T3a9PLL+RV(M)RBk#V9UfEITDQ+JcG3Jx-Yz#khdTx_%M+>?9N??apUvYy{%J9*yz zzfK|3-z!;HRtD5+h`fqieEd&;!XjaG@<`Fvh=Q{2M*1{L={ znW&G_;eS3H=AUF;o@e^XPVqnNS@Y%aU!JOecewW&zBpC&uPZ$5 z+#Jv2d!)W@PzbUtb}n~NR;*Ke(kdSJVChU>wVB>RZ{HZRHGKJ+)3zk-?5tx8bfp|W z{dnB(Epu4!^P9!X-3+c8MXAbv(fJ~~g~_W;MYr&D`v0zs!@v8UwP&}O_a#1^ua%q&%;L^Iu3YmQjZ&uhwfDN0 zy}x(%k`}MB@yXW1{Yg6hHwu0}oxa-9o+tH0k%yY!9F31GywikzOYd3yt~R)FXi=E+ znS!g`^S3QzejoK*GoRj0h6#Hs1}>)B*O_D}U!sQh|0{Ajy`&y;}Ag)52z zmhEA__*|>*a6-iPyt#Xo!~8UYet$ggE=CcP*9y~)cl#Si%uqkvDU@}=+}ZJS^Ziw`c-th6({8k} zwwi6-&a1M1|G!;71ez`F`DULX>-Gj*od3zw@-_7_Q_gzt$knWcS11Vq3G?_>&L$S>^Ylm zv9EFAKhMc(g`%Hg?f1RBy!>*;QpaYtGc7673EO;5Y;bM<)_pCq`%mOH=j^+?On19` zZqK`G;qYIk@Px*H-TJn8j<9W?(<`P|ytmJyETYglhJ>!W-&`H!FT+1PMf;_j#BD{1&%Uzk1cx~Gt+`;My$)u zppADMLRJQ~em-@xt>G=ljcE zlPOkTbYWJb@|PQFPV@hZoG{&2oZVsFF7WZkp?wmjSyvVuJSpsNb5PX%ck+kkMJ8$Q zyD}J7CH%A1KVm!@Z&M|4Qpp;uV3ytSxtz~#{BbhOK}6H4;(9P zIhg}=PYAzjj5vLiyQ{)+bK2P-N);@HlUkq7s=1KS{@f$HOisNst({-~+V8eAvrJE) zj&hVUev`cBexuD(^$vH2Lg~0)U(TF)w_qWt;Tzt2Q{6aiNB7QeRTVpV#Miy6;rYh= zh2h8bj;p*z}=^2~T&PrX6^Iz&U zRYp>#pK*`-$NhJk4o|oH`9ye^c&X4$p%+maNi~cYr4MrS?QlKXCED8W{XN>kBwoR9UORpI{`Fl+% zlBY|m+}X3jXwK}nw^BcxHNQWl;9*D7blzEKFa0$*bo1)nW zt;O%|>=e>+XXu*}9~C)gzT@46j29|i@Mjoq;k-4e%`Cd!p8FT86#Liqs@D&Em#19p z+#DWPxm3oYz~NBiRfAj1E%W*eE=q4&{m4rsRpL?kSJR8lPmUeXW z~|OcuDrnK zMG;f6)enpHd%w+c5l;JmQ|Mo@L(H)JnUU6Vs<{G_yYR@k>&Wt*BJdrJV%7cxb&W~4KXwIt7{rczh zDHb)}!l@}j0?J-bPfeXHr0T`ebRx;SrR?GU=gyZW6j=yocCEbQ)zr8z@VR1WK9hF& zy~^c380N{wR{5T5Us?3eTE4wAIk2Hz?^(v{*O`CirI&84m!11va_YM`H#fIip6KB- zDr~vkXOeqs%HPE^wY~LOlm9-Ks0X!vjV+R+|J&|o@cZ%a_xo7$47ub#4CfcrdG1K6 zcu#R4BlaF%gpQgL(<|YRm zW;am3IraMCSNzL)WUZ$3tA4**9V959*GCD9E)>i%wM2rd1g!TQ|?nWe7eU!OUT7XhOS$ms9I8}@z?y>tF!ZN z*Dp!9sP%t;@G_sm!$+TXxiPI+Z%(~K z>w*aytDIlod^nNUQ;G5LqCBz0vbVRc{;#~i*QGE+|J-wloQ?YBcX_4FI-)a#B&t&@ zT+h$5eH&_3Yg!=0*She&f@ai~jD%NLRz5O)WBf2}mD=5&^1G$sH;(!2x2Z1qA@Xd& z<<|$#s~4_`2gPT#=by`TJ?$)3XQzrVj5+suxf68wMm%jGlK%Xz*y ze@=RF?bP`jte=f`EO?o2$a9Ln(#dg!y4{bIKd1bxjHGgF-H^F74<-Fz!MQ{x5tJXS<))w&x|B7N)VnJqka70lXGO~mEQ${6rPhIiO~M|DXiRL9rF{!tsceH_tWX$#Ay1#Qf*@25q_O z+q7HP=LN?G^XV&DT<5I0(37z1#hg~}Jl#8W#S=cC5kH^**=oyD9U<784GIjQl-efD$O91qS}@!LlJD1Uw7vtH}f`+O^d zm-orpmSwMVQ>m0siZD97S$X@apB;xkx9U6Jx_|KGvp>FM*Q~?GMMLd{%ZAwm!Z9N>^1lQ7;o2m zvu)L1)`>Z}0b*9nADyN=G_TY9rCpqQuT59AAa3)U;Mdnb`z~Dg%KXkduL;T;Phxn> zXRUkF{ebc2VIke??BbGrhfCd*WBZhvj6K+bD(s$B?-%Ec_dHSY*zffH^LyVIc}iGc zoBX7r$`*%PNo~@Z`MrSxrx0; z|9Wsxf=`Ucn+t~zo=;$H3jUm!@#nqjiAKAZvHcn6x)N{Y9k7!*;XTWN$KQ&pwRme> zz`j5K<1GRjYee47_IIsIv$d@2`+aV~RELR5iC;2eBU1Es{m6Iz{$E7p zRyB|G_1m`c-<{?K1nrfQ`T4XZ_{5)0`vZU7=N4?a(YU~C(chT73pL_wSw9>RTz`p`X|vqT-mv?Jrz>86F|TfY3bXTnnX;2zS!Z7_ zyJ+-qrLNxon)`2dp0=9MVP5s@-zHg>%l4LkI@r$te^z0odwqGt+cRN8;u1ccSHC|{ z2$3rCiF>iaOrx`WN71JpAI@37H&||Uc`-x3_^mHX0v0-5+FhP6XMM?Q-y`06zEK$m z*6dq0G5watq%#`B=KAX*=md|oXG-jV9sO;8pFyVE|k=PzLu>*xB2QJxc z=bce*CdRz^)AK$1I_sSijc?yudpCh+ruhA!rCu+etTO%}zWL8@7mKSu-(30n`~CjS zuKMM6-y)vmd~8^|Z-Up>KB?M;QhwUezgFGu5Iwp_pzxmY>dlh>?Bc&n&bzgxGf%s$ zYx>C(haXIDd?&tb_fqRuyej?npU)V-d3`|d&7*prH|$R3i^5W)O_$Yfoh)c$*q>DM zDf3!bk=*Z}kJ8Wat_rAMXOE2=RViIkOd90`*Da7x>@A%+m`uwSx zmzVuqKjX@QzI8kt7h6}f)m+LdER;-nzE9yzi~ady3#1qRym0DG+qAQf9uz#8( zbb&b__l5TgaT6Y?>1}OMiJ$r|91mb#Ar->9i+k6(sy&keinFx^yKYMyf4}Lz^Ou+w zwqN%nSDb14ZsvR^(|4^F*HU-86(=gScw<>bn>RU#vzUCTyQUJjP;cjxNe6zP`2OI9 z0h<=jy+d3TRhum2Se}QQCh_(EXRL}!e<$IjJbP>D*Q2w4u9q^8o@7{c+}MU$kgYss zQcl~634hO;-(RD>F-z_Wix%h37De+fGFRk}?L9B{fMdhOvTiZmAB`WH1)ZP0xv{ZX zyhO^N_LWt9boe8c*Fx7gcF7o3_=vqQTVc9|!K<<55&L2O6``xcc%)~G${4WN*ZryZ z`Q@_z%g6=mBYML{8^WAy*FJV()aa7nay;*}cMZQtOKy zSvpb1dEVih&9hdEFK0dS zy0Ep`wED}7i9MWq4_}P#k7JvktTDTD{p8S>>CGP+H;b1r_=?R;aZygNmEQc?;<|EP z-}wvP{}pqj-bM2iE5;Sg$U1q&TkSHpa_F0a^-~Y~9XbBsMyo}G;4R&2cNZHzapuv_ zYCm7{X@cau^ri+UGZrkI8_Fz^@a4jU%K81(?{>QPR_(I?Y{C<(aB`+``T-ex zBXvc^M)5?`SKlV^8=5pvDm|sSTKm$`0~)LPS~wieJK7!jFvHZ>bDiV*u3*_!hhM!h7OjrGRd!Q^KWVl-U(j2%?U`YVZYJ;l%Wv8=8M3bA zD#$0FU^G2!sN$F{VL9X9oPXEYo=wa4f0pt>?8I}4F2~s=1uF{Q|K-m~U$**-QN6m6 zx|T6 z=WHAk6S&q%ef6JkP~Eg+tN?| zoX)WxH+FT&&frNjuS-|gHhr}!K*S*AQq-Z1ed=?ietmhFEWdUdcb7ujn^&{4FDz)3 zm~*&ndw6{9R;f~1jV6g%uXSehSiLr8&Sz$;H`-uS^P}M9_4V<;{@-(WKSAotuM=~Z z@>VWj@wm|5#G4i&aQYfciQ~qvQ>W-gPh;Jh8P;@p1Mf?HhHZfYp$j+?R&aT;aVhNB zB)?y;ahcby#Bo0n7xz&#RjWrDm4NABsxps?nDw?F7pSPB+_D<2% zUyQ;vD*BuJby?8O4_FY?=Fcd$(iYp%3au{2Y@C+R`4luCJZ3P+$tj$zNYzAAQiX{eE3E z?=JR~jv#i`bvj7}eEL@}`i2>mw6w@h<~iq>Txt5^Zh(k^Py3zB)Px5HYEqk535YoI zL@s \ No newline at end of file diff --git a/assets/forgejo/logo.png b/assets/forgejo/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..0ee15c96e56a0e2cbc08da7760970a66c338ec2e GIT binary patch literal 27336 zcmeAS@N?(olHy`uVBq!ia0y~yU}6Aa4mJh`hA$OYelaj)^?SNFhEy=Vxyw35BwX(O zN7;jS@7@*T_G@5yB&X2DcJGLyw6vLp;2ak2Z9BYMcqce;2=f_Dc+he*wNQ4BWWtR9 zzwcH~bAPw@uJM+T@c(wtYx>t*xEgx*s;TPtf4%>vG5b1jzOahw@lqC7R#IBT>hbQC z!l~wtj*b(prxsaznEY)}ns8b`Q1D`a$}~GiJtr3zm&gm1D%0LAXrJgUASf6pt`b+m zChG3u;_`%P_JoQ^n^PSf9UU4irf!pt?Q?N)aS=I`rnqyrTd$Po-(O#I*%@;M1qB6L z7cgmXp1gZ@zI}Y3oUPW+&(FtZwm0|S>e zH`r>he-aZE4Ad5B7rMas#jwkP(dps~iAlR(Utd4}Pvrf5wYk%oo+)W7DJf}miYZ>a zBF)ON^0H+8K%4ZPA^J0xFc07Ohz!@8vS7 z@7;oBC;WF5>M8BqUHJG|r+HlEQ_OS$ts^H~)HNW3(pJbjNcUw3u zazcNgx=Q(U+v>8NH9t31JifIx`&CZk+ZS&QMdUgnHRF+DzKr-Pt*D%Z=UT>z|yNd3no2y#+=m_I7k=NWW^&Q!*5ll+=8Cd;9dw z>E}<~y|pDX`FHXrxle+>tc7A{o8?a0GRwYxUxe8&w<(-ExdjDXE2?+>-}n37VkfE%!NN2_Tw0|@9^Qc{48*RR` zQQONn16`!D>ZNoQ^ zZAZ%A+)#YEvG}=P>4$`0+uId)u}ha~f9o~BClLR^AoD_Ch(If!l9E^dbVFTdRxbO9yyyE-xMR;jg*v>ine)tQQP(6Wy$~F z@AvD6ua6UrKQQ6*Hq96HZd3RkmuPRP`}^xrw*LM+|h~@U{ZBCgEH!r5%JvGOsa?_7nz0&4af?2om{;;30SwJw*%tYj_Tas4z zx|l4FA6Fui{yP5MUHbZ(slC_?wJTS*2wv@|`&aPfgrH`?f`&|HwS{gcBs)4@aF$4P zu2r9369mda|F+fqEV^A}(|5vKx}zW_o|UQK0_9E-8`nKMPx||^?k{;6 z#Hn&RxpB6o#f0)ziWj%$-ZuNVeWJ4aExVA9GMW=QG&Gbh?tWn;6f9|!GU3LJh@EwR zcdSwuyt5etX!0akB`x$aI9~>`# zdh0UrM8l$sns-l0TbHe2@k&ZsWRh{=z&FQgX+gn>^{$KiZO>kwukJtZiuK2&W0Z?hP*VET|0-j#x%p37`?{Dp zpsZ}F`(7-?!MjBJ?bY!3sR-MIcnsRcB;`!oV3G-_K`)$oVu~tKSSGkKzh;Xi3l9rN^Q&LjWC3|_F5A!*G z@Li0xGn9SG`g<4OGr0}2EN9$ay1Tf{474xd?p#^)^wh~!p{rFyYX1NIzU+G;`&8$8 zr`@I6tLy*&6Uv!kccaW?`7eg0vVwx9ZoBu+Sa&_1`QXpo5(k+LGwxmXU|C{vdF_%D zCr(@u{59vnmzS4=7P)X!vPGthu^kP3`Y*Q)ip!d#woiu9?75eYv_u zo>BeZ&Q;NlpP!!>Up~{ac-h;a1N8xZE-o(hQ(1f6G(CJ)p1ip&|Gr+{hlA|$GwwZi z6lpvZC4TqR$?5v@Ra8|wg-hSxyIUr(VS@D3ju-l`DtBF5f2>B*reedLeYMed9({Ot zSV&a#s5=vH-PN@-%J0{P&*75yyIs(~ijkwCqhs;Uql;$GYx{V2Z}s*aeYFV-G&ORj z8r^01^!xq(?#Z#B;&z&D_N^6~D`dISU0g(Md!J2L^%g7L9P=vnbDnAbJ)6tF_jhet zyx~gl_MlZEE0q>Hob{VwTU~a!&DW(jaEGE&mxJL8EurAAudWu~jQ{)WXR1MbW2SA% zlg(ol)a8S4&R^1d}^&z;_}AK8SbT* zT{I+(QaYBaGZ!fs`x9SZUssKJ_-R|_-!HC-%FI^FqXn}*%?()6#+`R_ z)6yz_nO}x;1Ol~7cseyrx9*y?Q~%CGLHExy9~pdF^D^&(_jEna6+!-NA!{NomI-_? zQ&K8w&M>)fIbfgu-Y=6>R8%-RWo)ZL=5iXYU42SJr)F_9|NMv-5lX`|~rm zn9ZiKqr)lEbBkD~rYXz29!cXT|J}d7zHYvDbG_2_)6J7gv>zOouNN_o*ju$#>iDfK z6ZIFr>gdoAvF+AVFub}dRNJ!b&5S>yyfPLSw%n_8UiZE2-C1$XAeTv#Cm+>S^PQEl zTckih)WOANp_1{hTbBd&Eq3ppHf4&4;$GY8Z#U+#X*AwBU2@CAcSgdqU7iXd*@0?L zN?cr~UI?K-qze8$v5Ak zqhm$$a>2j1w&#P3-1heTa-)tT~-Dy^?Cixb$gt%P;B-0ccR;GZ^@jTa(33$EeG=#uyu53+}O2P z<#tEi-Cd=Vmn>0H+}|T-&AHRh{_gCx(c9Oxbh~zod8VW+$y_|2>yhjNP%FvA|NJ-o zhz$-e?j_pJy7pP{iPis$dv7KlZu7JVoNlcXzhSN84Cz@ND{O8x9tmk?<9%{rp|jJz z!he4%Z_BqlosfOy+FsAE&kRkHZp8l1yuNPkTZII}E+-e4#t#-=A4*QepDlOVxAa_t z^tIowPnfp7x|gy!?W~H-O3Mwi&GYlDIc7Bc>Fm%D`s%LfQ6j1l-~eh!{d3&7apSW4 z4Xr0cl`aV0oh@UY7ZWl6pJx2NJ#Q5h#C|dh2Ks%G6$;*(eSO;DcK+`F7rI2XeO~{! z>2gtAzw#Zgo4fnzo14>B=luP6Tz-;udEV{Ejq4SZl;VF`TQwXBnXVVBVrUrnr#tV? zj)iUhX1VRVG@kTc+q=_UzBa@|MNiMqDD_mzFNQlV{7Onn@fEDG?u)$NcB}c!P-t}4 zjow!BcEf>*FIwK6^_^|z%aHNz&dzPS9rYJVY3%LjSaeZAW!aU4)Q=xO3PoI5?k|7Y zZ06%rm;Zw*sg@R&pY<6pE-c*ko6&E;wQbD}@q6bu&FEO6Y1Qr${_V}p)O&j>oeqX?Ome+!_g_+ElGKvF@9Klf z@0sP^x>6=!aQ^UPMHiRYi@GYiv_e)WSeL&ONngMxYc=EBcjiD3sYTV!{I*{vR2&O- znxS;FOu#@wQ1IosJ>Q&@R(VcV`=fj&@mQa1_N}-=jW09i8Oz$&?Wu6fV(2^6%6*%U zX_vCAqSC3JXG(@wR|YS?GSOph>$aSmNw?Cj2W-hc_RqfZ(~=40X8HHlth+qZPNF;@ z+r=eBBzIHqbNhk^4uxvFYJYFb-Ss0&V@XX~)fJW87t`bGCiX}g&$5%~T*1i|?-IiN zSG-ft^wOO-H#Z->$+1~?*0<04izaM}{_f`1FQ=R7zB%peCR?>4xlp%$d%7TX>F;Us~_xJk66D~S`SCcZ!(J09`aBP38kRW`juj9nuT{o9~to`w@{pqEp z-cAdXudWJRR{J|q#OP6Je$s^nj!xgzEG;AFRX&rv?RdaQq_;!ENB(oL^6!k8?`malZ>g5NUl+GmtMv7?t+FhCxLp;Lil%Fr94uS@ze7;D#VLHE zlB>_}ug6Y&-1SOqU(C)Tr+v+iHdj32wlz2C3kdFXcQcXiT(@F{2H(baOgl=FZ!JHr zaQyf7yodHb9xyB3w<>thAfgj-p-kX|pwglX(|L8b+dljL_xpYB)_wf;e=cmXmv5EP z)!wx(`bT{I-_R4^udR#Kj@*>8G1k0_S1|C!spf0S7pEGh`*n7A3m37^IcoU!e7#HG zx1PL%pP!w5eOx*y<7k)Yw#KGOfzd853zr+*YCEzezqh|%yomqL#++Nz-@EsjMQ(qP zHBI@yQqQNQZINcR1$m3y1q56Bf?g;H#j1KunQ(V^IrmQPW2X$?9?!S@$+_O6#B2M5 zZZTaUu2(rht6r}#EV5J5%KZINKYH658JmiL6SYA>K{>@tQ=I#*cx*o~(w-Bbh3p7^_@UJz8-_3FyX$DdZ# za4K75ZQncj{FAy>(GNgn0#o;{(${I$92RX}3k$-eWL+nn6S`=)g?Ft>@kNO%@}VZ7y=AKS{c!TAe3Qs#Lv z9==>x;#9Qo}8qr8oe#&pp}6|L)xP4fw|#6zg%`+47=U`AJpR5 zBOv$Q$-M$Db%(fmidM1}KJ)znUH zOg^4+dt2_NqNiRnt;^T-NE*BS`towJ)w@=!&q1p~G&}qHzCC9=Xe!cf=ia|Sr^CtJ z>^4Vz)~^!NkK(P*Tk@y9uMK-5!OPSC-}1#_?^nmU>^-*eUyTsa`}Fc!qm+l|-wnSf zNilvtF;RI_)z>UgXY0%R`}SYYI89dbRS91g^KZw)0?R7-Q1^4Lk{66rc4b{%rOL_4 zDYWmzrur2PGK<&eDPHYyJLd$dpq*N|Zq_;cT3ApRxt;IZo14mwOUgcFUt2SA{k~sb zv1I}5Z2R^cDUi~2FkHb=#Mb2yJmE#q=9+m{rCx`mBhTI1=Flg&KKjJN!|mOlCs?J< z1=U;q$9|vq%ky}(e)Kk~?p3fj&EP`Gu$}wh!2uzvv0Y{`~xW`rhjAT~1e4 z2CHBG{yq5#$J$cv74N2$nf-dV`+bi2in~t!%I2@vR=?NZ^P#DwYq5L(GC!uP8Q*W^Hw4JnBj)1G;tDBpbzqGa%vOIKs7wel#OS>)P&(5*De3_@o zUuk>Q6@!yrC;I;FsQq0AYU@^|1kQcv`Tn4TOqFP=+Y@Wk3!--GE1YW>9(-EXXpK44k=jH8u}=W5PxM-QidMe|eZtIrDx3KsqQQ^{HS>Skf7{o(5O zd)1$wn(BT2paYZC%gM_*S4_w)n!hr5IoHLz`~Lr{zFb}`%eCv#GFgrH3B0;{tG|CU z=`ApR;?`dBzVhd%r;p5Lo99oHv#nb4JwZWk@3eJ+%9@*Bx@BIq|NqnfqGHtcytyxb z?+|B=b-#Nkbaj}o#+L;56#0TRg!tFI z5O~-Y@OjHSJ_G0N1zB2AT)y(PUnVY}TmQFUhOmS0QAs_s+*>O0^?x>s=th~WEf&@J z`oqR(Z=;KN+w*OFAH7?=CvK}QT@(-?ds+9+qoduePUTV$x8JKez3uV-mUqs19~<7) zt~xmB$}SG|tRqfe@78`gsjjM}rKQWxynnIyzfI1I++HlpoBObn*Y36dy&m?Y-+Is7 z9fLi$2V^Dc$L-M&xy8=7e*eE+%V!_XQZ_%4cgyp!No54Tv~9uxhQk*w9^+fIJ@~lh za;FzNUiSUpnti>?yu-k(<>l`%N!GK`yIQj@ENGly-Dh)qYj*nWoAX_-PLTeysJefC z{lA?Y_UxY?_uG5DzP9!%|MczbOwR-4r!coJ_SnMIsb`uvWqXHK=&F=o^GplxoDH5| z^Qm)!wTim>YRAGH>tB;sG)2E>-tqt6@790vUsL?=@2fRE>>+L4pLDpO?U0;D$;#$e zTNJYH?AZA7_g5aSS(A6QMr}-Lolt#eSE={B>UWm6{r+iay>4QRdh*V|YtgeJvDjTD zo^1SbbEeH^>t84_g>h%BbBXtMxvXnzG|ltwOxU7O_3Pzw-}|et2LwzpkNv;D=xNu4 z-+WB-s$OZ{=KHsQg$Y+|n{<@8UW`Un$>(RjrVYJSZ?4~FZmfNgD$;pJL)RI{s zcXua+xy-dLH>;g*=j3?tZjbFuOArjhVT64rAyfKGVkr#nY(-+ zyQtejwdpT!y*)KmyY`hnN+flH; z_vLP5%?RNYOJ0b*cye;G)4TGww@gdh_v9|$C;QZSVcN!be@k9maMY+}=JuUq5!fZJ z|L$z#fy6I5T&~8x#fv^H%h(m3e7w)JHvQSchHAg<22W2<7w1}Ueem_w)##I;tc`qNIDWI;&zM7wVECqfT9+A_{ZFRXmJAa?1%lE8fJ(AD7GaLmRnbA$ooEjQYQ?&>m% z(*u6=38YJ|3)-sM@{TiONj3kg^94FsM?mD1713#? zRm;{3*G>d-tF+adtZoxJ7iB*_*6Z|d>Xa!e zwpCv~JiFK6so~A=|JVIx(S2!WXK_y4&lb12=AZGRhKzO54ToB}yZI*0^4gwwxNTmV zpicjstjT#h=T|NTwmus?`~{#)+m@9u=n#hYmf&PO#k!e`v0`M+4g@v9Cmu* zKg~GtXS3D4(*OVdww`!)YO40UXM7f&s}z=Zn)udyeblYb#X4^E;~9HKM~O`IlVG%OE9xMt9ZKjpAU!mZDm>3 zxUvRB)hzzK{nplOb(hAZnHg*CKJA{oOFVvi-dusZ-A|sRY&HH`BKy7Y2}|fj-MdBm z{(ieHRMVo_W_wn(K!f+O-xD{_UG?cdKRtC4(U|t~nzYjXQ^`_1Pd`09?ewI3|2?bn zcW*NNeoUVz%wujN_F}^GgPwP1%mmG(Jb$@my1D<}HNXFh>qeP;Jup=xKxc8HnN!`> zfbWMut>SpaLwB#tbF21te7`W^bgSRXX&b$!YOPGZ!7l&y_V)AN!Y98{%Ie8^_Tu0E z{Cz){39trTT@~s(|FN25CDVgOb~%A~WjU6bFBjeCt$WPpbnqHm=el{e)m)b8PFio4 z+nm+-u_5(OJImew`7bXmbrSKIcGK{^d)?QW?^>@q$hiD7$he^3&(63wK!s~re(7m3 zSy|oJ*Vl^|omCu=-+;r17$OVai-BrrFmjX0eqipK5PXH2<~!W%Z|< z>GMyva0;hM)80?ALphkFgOBAgaE1O>kr(+W9JCh)=w3k#it*2P%f_WQ-Ls-b43 zKouLW)9H(xD*rORzq{+yXk7cNxtIY1&BiI|YXyOZd52o0MhgzF0cJTDdSYBHF)}-=N3MZS=oS!_WavJ_$+xudP z=VX-`9qVFutAU1)mV36yIa|%VxH-dWSHltUm6uP>kPP5uOZoHusz+nDnC_(c_5UIt zJ%0SO-~QhN-mMD_e@p@8NFg4V)KgOoYxS~~_upJreQ|!>FVBuS2B)OgoxW9e%lu-u zN2d$_qLVL#CVg2p&m-g3mdsZfGZwq`di{M}dw!nn%F~NixF7w%((vv7?XB72g=(*E zZ(m=!JO9p(z^29(DJLf_JD=+N#Qb@w{;urndWuD-H1cJw%eK7T@qR(-3yDcvrfCMN zW!~Ab5!C11RPfNrvgk=iMe?zp|0nOoGNhMo;g-2CQoi=VJHFDRubOs8?>)HEe8-)t z?wC&(8z1mB@2-*CX{;HV(X`uGz;#~rx0-*Y=AMVE<2?WEpSk>A`S(4O-`J&>?kmiT z%>T(9SFkNJs$T5NugMM!T48H4e(%hA(W3t8);6=3mJtdw{3@l*a%P-w`xw0?W1%&Z ztxtXQ^L?*ZZrYT3de{8u4GE61?&~J}Y=jXfi@9wD#?w4x0;b?zhvF)z~%cjRwos3nP zF>jt8Bh#PHu7?Cn=YDWuzTK6oaN}KF{ok+GzlQD7DgX7WH)g$j#MZ2-DypiU6POx$ zZf)!Gt5~#j&oY(MkYPh zth>8Pr?vl-uXw;1xuYQQ#JT;<2d=ITH_m$g$?{?6cVE_hpH68r{kYt3|8Irxd7br- zt}kY;Vzp;z*;V}f+|66NrTr?76sbO25xAJ;L;GU){!~ zE{qLx9^KfOyshm0Ea7=S?}WT)m#@=kxSsy^b?pzo<@1($mmE5L`00<2kC_-O&+700 zla&4cob|(*|4l`$DnF$#?wK%Wj?U#}zLSHNdZpg_D6SoL=I;0UZ*L+Q8|Ivf+>?{d z?r-sMriQwW{V9$_r%(W5tS9d=Q-*?cEt z#XkGn;SILc-#iYt@owJIzQ6kWyGau!DC}fq`17&9e#_Qwd#i^tzb&NLFcq@~&aQVb8as7Fj$JhJM zy%Nm4Q9v=Fb@$idU~# zyEf+Scb0^gmzFa9x%Tj1+}^5Gt2^;qG6KuR9ipOUF)+B;{rwUgJ=^j+=lL8}#)kcE zzrVh${dFsb;lO?u7nd8i&g#$kaKQ%sHnZOxi-qnyMPDoL+yD8{{N~=?=tYYbr5tMEG)g%kQ2A_T`jWc8zn1+z zP%rxQ)YQqw>E}2a<{Y-ItO($H9h_2+r5>0C@CweD{YoDVQ2C4U9Y9v_~rHX zR)3$ie12V&lzHA8yZn25D!+dItpaW;u{Ze5wYph%zun^D%(=^)!q-G7N;1we%YC(& zPxo{6zps6awpTx#Q0_mm`MjO>-Cd=Z)mdLXEc|ZA_*c!g^wpL6Ho3xrGKoLNb6UdM z<8FVF|Nm#QzunL0|BdVZRQ!#!`Vz4F_s`hfWu>R9zg%=*>N#00Xm3?%ZOg``#^2*# zXiqNYV>oB2vF-l%Jjdw_48MH$*8Kcb_vQ!3-V2{TpSPbrhxNeU@Avb6@2x-9f16=* zoq)iES+id0y_;>A+_t;p>CWf#CeJd>PW#L|^TPev^P(;)^VwE^n^JzS^7!Ap>+9q7 ze}8*>dSSFWRjyooQU0Jx#d!eYkzEOeI}>3V<@c|BwPM`+!e9U2pcGZbo&#IV;4!NIt$> zet)Z;)Ro(xOM*6~ot4@y6ML_bnf*&wefiV<`iu>7e>a!>J9#Skvk&X*#ApVF2S1y# zqL~UjDs?V}Y^c*_Vqlne>2m8f7KNzFoLwsu_Nq%UFjTyroxg9RD#Pn3$L&l-|2%A$ z=VD;^aP7&-$+?^d-cLEMHk0d``a(tqhJ0RGt1HtOd_v@^uZMilUcX0)f#E>(uWkO` zOakj{zAamsP|GFB!0;h#b=cY*PKWZR8}}`1`l_1?Ru!<(L56uvse$O9Bf|b13=AL6 z^-7zo#P6%w#duiTG zt%9egL>UaF%TO`21@Z;X*^LE+Z3~|AA zS5Ag>y319%FfcT{4_y~?a~gxqvOh24f>pJ`)@U#=9N7NFu{tp^aU08mo==N+`%FDC zS-pSB^5xtN3?F1`&-E?+Y`^f2j*sTllvQUAHnX!bF#PDbmzM9%ux%y7kDDQqwV{d( z3?Jq?HnZInYVZ$X$T1F8)6((+*>+`h`1xrJB|(fItbusFdQ(~i`_NlqTm71 z5QdtBRX+d!{RNqLY?^L#&fNckq6)FTqE#Obf~|3LacR+Ij9A6AWa3IERqtt_AeZ*H z{W?XLQDPa>l7^sHZ7YM8`^}wno0)+j@9r+urCw7vsWR}dVDK^s&APrWwx}8uu=nfp zU;hc78pImHu+}^@=h>N=VDahkb(!7_|CTVlsrM1(=I5UdG6gi970qN2$9jVy_~@-| zx!O0`85kx_p1ic+;h}9T4-`cczR%VQTjnEq(vE>)L*`|*=;!r;np53bBOI58>{{8> z&L=zR4I=}?!-o&Iu_SbI34L6~wJu_#(hjJwG-!Uz5`TkVxeN>q`@)Y;V(A#O!9JQIN-W+ITW@TVV ziJfazn!|Y@L$t+emR9s)H(o{thRDy?_y4l}luUDntGX0prtO6z=XW7iVa= z3F_cKI@)b@hxv+-u<+A%`ML=^c35=w^-X(wd;9K&CUOnm6Vn5 z)~9z#8mFB&F;Q7nNy%xNUhJ#7Yv<-#-#!2T+wJ_jpZetO-%Xo8X_C^v#(#f*-?sX1 z>?abW_{{S1;VC+iK|#U6s_IM)+1JX+oN;l{yQ}YZ&AYlfeEPGqv%ODG(_QM^&i77I zf3aKdB+toeC(q0@PCYqEbyMnTG4sfa#kZcHn>$(BJg-Bx?%&V!le5j&zx^%0&MClA zecdd%jI*;$nHUy+39I|`#Iv)%e|oR9`KdcQi|_L3+t|eHDtY;+>L0>N2`?m$R>+=S7`|w}gS)9%(#sI1{_qFEU+jFzFTh_K} z%WXfz$XEwa+$A@B1Oe(Dq7LNGRp*uG0VK??pOz7V0MMP|PT3VpZRvqj>PHtw#a( zIkxE%EZf^%3(CJs2$*;@v6tU|aBkBMoef`K*)R9!oA7Sl%)1k({W|w^zRCvc?a#~Z z-`>9J-y%U}w}gqynOM0L+H!xf8m66@(PB}(%x5M?;kN|~6y`V_5SykIvVuYJ4nyGT zu(cW%780_LSEQex_m1miy+zygzdRL|+94|h9)5pzX6ED%mKUb5&DXB_@*+-J+b?8- z^1~7~KADV?xu-PD64qRMaB7;ax6^_N+Z|IZl$UjhvZL}!)?5am-)_CGVFbHtT%h6d4dYN((eDSuCA_|o6S)kvOX^Md+|dn zrHO(3cdUP$Io>C`c>lj&+_QBJz z_O7H)#?onH($P!5<)&$vEnIMoVdLyQB`<|I58d8V@sWvNa*ER5*}i*|kMrqV_;T6b zUh%ZVQa_WbFByBDg2voexcAFdC@)g;ofU9*SLw%XE$#gGQZ&4$=}gg!wc2y^f$r(W z=9_$Hn@y|~*j4(vZF^<3%+2IJc7x{!H9q#dy0WtQvWQU4_a5zt4GZpl-GAO|`Hha? zDCVPi7iW3g@md>rELuV=9(`Y}$ z)VtVsPws;m6N8rf^|Ib7IT`jN=9$BfZ@2Svh5sM3;s3()`^iaRneVUb-0o~|%71Zt z`}&K2IKpz=^4B&#is0z(eDGIVn%iW~(g`;92wV(W z;?g3$xA^%v7HO{|;(_yfSf%*eYkqzb6nhb}GAOaJEM}2VpYGYl1!~?moj8S56pRc0 z{wlrl?RA}>jXul!CYO+A@wsQ$WOSYNI9IjG^nq))nB^r66%&&$yzT4H&NdhJnow|f z;V}trlfLcjyizW?x3{UP7%7&8?I=iG6}DC?vGJI_^CAK8j70Dvm(H3G8-(ueC~R&y zFj?81@AetZAFMN2Y?@2v%ij3nz2aK+gUF^;!gDJN`=FMd;opv~J@bkBSUVL#+#-bZDl&qSMNpDyx{@0Ju9=wvX z;Fs$=#`}$vW11}uoeLSNx3cl;XLdIUv?Yr&}%k>pFQ%u7T&YeH5ERrVRw|EpQN z>8fO<&tijQciAgP|j&!l{#7D@#-*>@7n0?%lKri z5*ppq_Pv|U{OUpCp+?qU=jK{-I0rN|B=+4kXZVrFeCJ@0L%HSdv)Vap&T@R3`QhiH zdnbGkbWc5a>qAedQ=!D(uYQaV^irR`@%wV+SSLe~l;1oX&;Nfu^Y`gJ{Pgr=pv)VG zt?PmpyY-%MdEjzT@FD*WRyMxGXJ=+^n;k5!7h|yYw9={it#-w~zP#KT!^FxvO(!yG z%a8p@SHopIoWfRIb9EHzaxlrgWfJ>&g0Q;ZgieQ!gM!ixt=!^44+PqHB$IYqwq84w zmiqhK+g-=6b)-uxE3A2S=*pVOj}m^pKDt4$xU9-pSYlp;s-*AQ%&mJL92c-)`EmMo zuHVBg7tSo0IO*DRH_y+_?ED%*9?kMAwm&Km+IZ+l-KYI)Vs=jYQl&mahg-a`u)boG zw`xO!9KYEN_iJ6t7e`KuD^^tz;Qn7LcZmDg(eM9wy9L=^PMxJ__AKN<|N7EcP_Nra z+QX^Di&JIa^aF|^>tb$}6=z*r6B%Y(>1gyh`{Z$^UyF8VboM2brgLg}Mtt9@Cl*z0 zbyYbkpJ}1=yps;~jK^~r61K`%u$c62x;;nAuEt`ftV)`)WAy9Ki*HVM*phWsE2pDp z-|O@>$4=D?RK1$IYvK7VmoH?WkKB~vX{5|8rt{%+bI`5rTv>;uqEBiqJwMl~^wOU{ z8tG-5Tn$z!-dWMal{__+#W!i=xr|r~lf9iC9SX}CnECcr{93>NpO+d-p@VxaL&5|R z2^JNO+c|a%mt5C6etVbX+ZP6}TrTX;Eq-=p-M+_**R1JMbduf6&B3mkzTo}gUcQX9 zyQ$?bFC7h(W{@!8{P+Cj<>lMv_@|zlqPRL>Z&m48!z-)9`{x{adV2aw$7Z&7HT%0G zKZ+dG-Ifu1WJ~5{t3`KM{{9Y(T3pI|tXJAyjkUA0?-oOkjOC=314kCVwV1zQ=XMT@ z)+?nak9UEk3iIt%RMWI&ED8>6E9P2WAGR=lf8DHPjkrA)H+fB#zrMO!{MYs! zpKb32&;5HZutj4gbL_QU2Quulug?m;(fG<&=ZlDeVMX)DpUgo?+nBVP-dHU^H{aer z?BR!phj*!^8t`sno^6)9$g1>JM#YcU*S_heEDhSz6cGD9>F|U@jwkCa;>>ra8s^ow z=Q3pW}!RFIj zW}7pJ1>W6pYl-LN6K7i5+8z~Kd36e@Dk*;Wb|Z;h#$w;kXVPa2Lso@!uJJkECwuqr zxw6fxH0_)#`b(W(KU(fRy>CPCX6_96HKylg7$(oEoAdnK+{5Xmb1vM9{Gk8&+1br+ zYYw^H_j+)|>HHztxF2Cl>;C>)w{JD?nxd`;;#r$Kysxeb-Q4RK@cP?1LJZ6gPTchD$26Ttr?m9P$9ntjFv!?eO=0e$ZZ?!q+ zztlfJK5m=qzcuTs(&~?Yzu(X91I@Xo80KwwrM1lU#M!DPrZ+Dw@pLxNzo)XgY3}}O zJ1%^`!=)3y@6JSNh9|ik|5)>8l+E@3z_3y5*F$@W>8NhtGjV!N6ZWXOv zv~kkLq77afvQ|HA$d6QxcpPaQaXMoE>Zc9ABbG-huFBi|Zr?Hv+0zepOK}Bmo&VK5 zTRD60uis)T+bSPNI7h~BZi@UGIW^KXVrN8V#79x-MsB|-r*F%yMg_gQyF1+cx4n*z zkI`n?O9CDfcpcu{*r+@6O3apwz_TB9Vs=dM@jCMP`T6w1|C4N99lGa|>u%rpRrGEyGlgxxq7%Q*CbBhhbDCulvqADP9-%*{XBZ~u z*e-u}e}DdL0kt>9XD`IOeQ>b(#+t{G-K$m|pA%g=&;EX~m}S6gQRxY@N8lX;JO+V&F%`}Wvz@vlcZZ}c@UafaxxKAdKD2!Dc=MlCH#)S|h(|H|PE=wooYQ{hOdGGX$^IozPEL+i5Ytd+ zFjy-1hpWc0;O$cRhRz+OucyT&FL1DFo;c_A)b~ue^%p-g%km|jVB2igG9&PpMeVPW zsBJltYa=(eZOggow4%*n^(*h`dJA)Rhac-TWw7V=+n}hZSn}$M=ArjDHzuZ;If^MWmQZc+O9=;&n`elflJ;^*gNy{75Rd{}x+({Pq#=*pnhrsihOW3I)| z&mB$T%Pw9WC7FEoa&dZ#n5J3kjoZz+7ZxzioI6R?`_`k3%A;MPeRmkn%rtIi`M;_1 zb6WIy&5EoDfxFxNYT_FoJUKbJ#Z06VPZ#*T}eBetovy3a=tyyvr|6(io9zfT9q5!dB6Vu-HFl+Q!F_f^=EILET$9T z5Vj=i>Z)0fXWCYqasEquer~Q??#*`X{J?ppZKkcJGp^1IogV6RSMx})4v(N~vaiDA zCKda=eo;4MA~b&Zp))BAMU8#?J5A=r>op*lOb@j&P^nPV?h7Nb` ze@`zicHcHHxLZtDiMy#auGl7aSBc_%<(iL2#oa!yn)gX8(Qd|`@+)n&v#-9ZwO{qE z~scH+^*VP=)Whju*{ULiJ#XGLk^_20$l2_6!U-qty*}3WC z#r=FMBOXT8b8emZ^YioL>zH^m*OYv|lRh`)@5!iBQm0=X&N{j3+^-o^XYF0M-_V); zfJNb>jK0T@j&`TG8syK}@?&w6GY8Mv+2+&5E~_Q~{`Pj(ua(36j`A+r=$H9-f>r6OAA4LM+yDRL{K4dyAKTd!HXaFw3~kQyPnBG| z0)BmYS=xWHR`HKrJtKeS+VcUcLNqsN)&BZYc!iBY-Q6i+N5R7;-RB{1ZfxXy=%~#! zziRJ1ou=(_wJ7Ud}qJ-F`jwkCN3uCW+CQWB$JhLQB7R6L^o=SLdvE3 z9}nBV{QLdhedk+cKaD@EvrbgpV|JLe#p1&ej|(RkdQQ=p`1YB|uIG`W75}n(Ic49m zybq0jdV2c#3_jivnYTC*yf{clmNP-&qQ7 zyvtS2x^X%>IQCqVl&(5_C-1x5lpw;59&4qU! z)W%mac211CE?p@Q#`bivU&J3_bw3}cgrBe1?_VM~q0^%HSx=sS?ZM^U|0Bb=RJ&?c zedh)>E}QD3%#=(LQlqwJJ?-FSIAh*&plOxz)9mCttV%XTi5*kdVO0B zH$!~g&!ub48F;15R4yw%H1Xy>mL3LLATujjJ9?WA=Q}|uDK2A+@ce%}Mdh30Ke)VR zUeJ7Zu66l|-yPF;`rdhZA^hMqaPMnUr9gsh-dD@7r}g(wxH{7;SIYHPXjp@>-XT@S zh(B9jW;~hEZdIjtX@P&!v#qW{ldn1&D_a=f+WP1H$H&K0^jJ&`HouzFGL^=X;E!`rDg@Q#6C6&Q5;4YXAQDpONpGx8~fO)N*2T+F7ZyucJ03IBsILt^T&< zDI3Gd*-e(-7ecfPygBdQd6Ts5+V1lA9y6plUte2W9D1&*Z>ldR1LxOIj0^VF{+{&U z?j%W*$_>mLLboNGGUO~f+sPoEyZWrUiT!5ox3{-{->}JZhFz^y)B)+U6Jysr@nSf6 zVAsO$jO=_e9`lqzOH{x2KDfBpJ%!zCx?b+;qx%CEI;qUq%@S(swzb9X*9+z7*2!OZ zvL{F@{89Jmnk*PzoYFdLihRMR&2q16FDN>(v}vch>$k3tbU#@T!dD>8^D%I;7S-uacKY z&6QK##PQA0 z*@nq(i+_Hcbk)^R^J>KTh$YwUB-GfNs!Lv9^ZjhKsCHxQjU9!Hb>L6h3Av;ae!l7xU@OnRT(dORh7qH>b15$i<$WxOL5vuA>^Kb{$r-y`6CK zUrBGA&5P&r>(#6qgA_dfa0@)zASSR_VMgM@>?OiJm&J4<6wD6fZ_K)?~!Z^CWgshLV-N^TCPrY5zj56)&#^xn6{&6sVU8Ntepuzt+kKg+ZFBUSX z+1SjP)A)}~{vMBC&a=x~v%|yfH25P*MWjE-WzRk65I9?Vse;_QIl)W4T=nDksaQ9r zEGT(-DKhD!`#mNz-EYng&YRE8wO+h>@%6qRvrRIaK0Ed~!mt>iypDK6`&WUc!{- z^Ud9&`kPMTL${~AQ5(ecHSdUzqO(77zTUQa$Biyg?HBPZDKo8CcCrb%OpHlC zbyS|e^1RVjR>u=FjhC-mIrHv8H38j2u{P23Htf>mQxJV!E+)z8Y5AdBov|}*)^&}< zLoHt(9Aw_4e7s-Yy=}uvv3i;0D!J{VER2TvYcHJm{QUgMb2<0+{4`}&iIq)w8X)6h z62^W_c`>)Jc9@O@$Exl*#g(6)aEeu*%?6F%Zqh!%xgug?(gE?hl1E*8elJqsSW)6& zet<{PNWkcR;VMZXp`_R8W>)hSm3MdR{NK3dMwj!+6*Co9O#EP0`YJ?S+D(CNWo2%G z^G!=h-uplM?f-dve0-e$#H0Ql>v!{OISRDQwJulEKXP^RQ?=Dr-U+jIpWg)M(lM^lk0?ySv>B?jB)dQ=D4+`&%YgTksEK zas9ZSCu-3GEK|NeTr0nHp58ot>4^8*hon^k`<>%9oLCXHpziN4md||cjfL59lVvQ6 z9*7(;jJzppRkGknr*L)cMfWznQ(L#?-gZl4naW<^`{(KO_>5CiG+S?z9TrDNM@P_@_9knMUYEx*g;zJFS2%BF=Urixel91W zM1|wf#l`M-4Zq$zeQK$Tq@r%N*6XR(k+(f&Y&PDYc~z?V>@3rhyExeSWI8@Q>g8qe znIa(8=q;P${xH9PvOq=l1C=FVYomVr|1bEaw{TA7>ub7~+yz<~nb{=nwx5sK8)+zV zaJ5K6Zn3&OL%hHv<1!Zhj4%Eb)ps_hpI56^>YNvFX^H2`go902Rs<^RT;V8R5YFPa zFJWQNyw`Tzt(=E~*9q-Bu9~NRIBQS(CZ#pHpl51q1~h_y7GStr*Ve+0ZSnuXbZ;TU*;C1(v4gIVVcztWMrmtfaN2 zS-LFt(b?sffByM=KGyV$=Q0jEWwF=ZVG`XvA&cF3oq9Jba5O!zON`!jVV+Iph7bSU z`D-3LmOuFPO#h9|Oo#rP8C&E!TUS4pVTd>XCK$9SZL?C$RrB5Feu=R-3Md^q{L*H= zLvH>5+OtRHciGk3RZceecK^rk$Nm5R{;V&4cgp!(x1sTi)P_Hj&0Eta*RQE-P09*p zy>xj`<>xb-tDp20`JbD!u=@7)%WFlo3ylA+mX^7`cYn3{x#pAeIhqt~lI6P&UtOIn zXm;gl=H)$4zxz(F`_Z^RU_cyN32=unddv7tAt$ z;w;fsr5^+N-}X;C;wnCJ}@q=hY2mdtv_a8UEoL~1>W7D1c zyRUyxDRIBGrA1t0bz@rT`+dLHO|*B=bp2p;F(P}5p4BhI-@A5lCq+~Q-w$8Hp|(E! z>x1|EJq1_}irWK1T+R=kTeJ1&KeM<0el=W#^FvT`kkj4!?Jft{Ij%wk;&_r7_r z&(ZW@(%O0FOWtPv=s9$ZLApg-SUv0C@6GWw4_BUKjg>Gv^PyZW(fslU>+%z?K~YvN=zVrR+Cw{m@OYKiA9X@@{L&v&w-ky0c+WFB!1M>pj=Vp1_TR7fwx?ph#1-z2tybhX^wqLBBfX8M?YyoE zvyx^2>(jbf^?d3a?*!^zPfLtc+`|?Sm|&hD!Xj+d?0Y~))r;f)tJpga_nnaI?Py?K zcA8~>Z7cWXv#F===smQ)zIl1sB;Wu4o^T&>b`C7h-qE?!ESc>lv!g&)G!;TjzOt z{x#ob-d@`Id*@Dpy6s;DSs3+&+>XEJ2!6Em=w*SYE6d)NoL=}}(%`@aHwkH>67do) z>#{csZfs0`oy+uY#m=0j**yspr>XhR^SS5#Usv|2&JIVV_J8kw6>QB4{PtwUj@?yGN|s#?>(czuie?zGb?wd?eUB#-rRecR06 zUs%|DQ7vKRBcV*j8lTsXRQ=}6(2L#mtqwU_npaf3WAN)7J zZ2Gr4e0|>0y4$-_D>QZ+KKl9fwZ`M-zzMsL|M{`G;L9hSZ)zM(0)mXsgU+u#6TI9_ zb939y{tff};~pRBT)drg#~H6TIk!D)^7jba)6Yr@65d1}s{xwU(? z`C%)GUZXqvIQc`@cIiCuIDVJKQNV9o?(2(>`tAOGFMqFA+p;ovxl}9Dzku7fxqYPf za+~JevDl9xc8XN`8hj(-P-F73LG!kFLmT@y(lSio_9;O>{HLFy$!6g{}kHPGQ{0` z7EG7h8Y?ch(KC3SP30FehV>DmqV2}vuOA)hkqrL&Yr9BNTC z`t1rF`Jb+a$7k9ll)t;<`A&JkvH$OxSnpND$*v9Ow_^;f_{L$d&U=Qz!h32D)U=mA z3iz}+E;DvU+}^6lor>&v3p6srudVr@W^iJiD9ghqCnsm{Ec;myyQ4snbKZ34_T0N( zA9yRDZQYce`0~!y?^QQy_Y%2qq~)~AToPPwbFtv>rGSJVFO z3LM8wuX6}z**Z^B_xJn$?yhpTLWgHS`q4y_Yr7>*@3=hgD(B0)w{s8AOXiglc+(c& z(i#{d(4y?#Cm__n!NBZ6rRl8Q(eEC*1nW#ITbz8nZx{a+%{Ni%9BHRRIk~tl&E9-I zqEfW|1K;Z@*IGd{UvKJi1EafdNS^u?xBbPPsg}mFt72xJtNqNoaJJZ*+P#em{L}My zp0DnaFf@@jD13ZuY0#YotP8i^uef)2U+wHQXBId%mx$L}Y}{+K@aN?ajoONK$fhSZq1tn%(oHzYWkwp&kpdSW8;_X+N&=Gj{NaR;pLnau1R za%WG%{+_(MyI%HbW?ov-@@-9;tH7}y$>fswzGA1<_r0THCXx zX5>xPkDvEzlm5|Fp{sq$y$W7k(bS6Cvf|xyck64pYTu6uu*@l_|8!El>a)e6cS{=& zMlshvpIiRoNT=`lr4BD1Y(nMJd*Luw~T6(XBFY#!2jz`J0%(af&GcGpu2(l>l2)o|in%!P7^WmYt zACJpl=D*{=sPOTzDR#A0>+`sRHlGxYDy~0VslzR%(-7Z&eKOC+i!-dt^=f~;T)wN4 zS3tzRuI5l@YpVdulSdL~UvqZxu3Rqu+kRd2dp!=ONw?C@&GFO>T4E5xbFm@CV*6IN zHGfLi#q4Z~N@?KY?AIESHn+S&9E?>{~V?Z|fWbNct^XQ9%IZ=9^3#Mg8vnB?BN61cD-H>!DU=xVV{ zWez5>6HcvMJ7ahP9hsA5$}9f-FjS1QD|+IwDt5Qo-v9r8|B##}XvT5li~|3mQyfK$ zrmOi%?X9evH}!zu+dAbfY`bcIml;Vn-6+>f|DAed??*FPj&pOZ-Fc&Mwh zS(oKZ@xHGYv%>+@M%G#5+9h(a^al450ltiTdo1VL)y`r$$oJ>dY5l$xToNly9Zb9o zgquDb6^~E2So?TJC9`?qCvl5)@9*r~9L-&Dv`h5m{Q7^2@gI8r-Y+jc9X^HgP|0!? z^KQ>68i5XC|58p)3jF=;E$2cO$ASQj2coMt$WHpdE|XWlbYhyLz_)jISMTO9&Ai0Y zy;*AZqTjd2CnoGqxy_f`q!6+q!129g!ThOF8#Rt^ zVKc4#lwu^=)bKb>Inu03Uthaw z%5YJ8;@ZH)YzLiV1XzBn%RheV^t^IIz($46ubcjVTwtQz)bO)Y!d&d3!<3y1nZU!M z98JY9?(g4!ar43{NrqZ4zy8_I)U+Z0zMaMWpQ#W1=U5n)zP!}>K}~_9>GOe?ic+O7 zZIt;|cz&I>aQiifSJ&73HzjQ4VvGoT+;Q%<hiyOGk&dF8qrW3C13ad-(MAwdf_kU3$7mh1e#x8Uhw&uuTzoysXr6!zuc>S z@2Xn)gHwBM5~E)hZ^HF;v0(MwHyo$y#ol_V#1{Ql+B|QgE{q=RR zRq3k*Z|=^X>RiA1l!jR1^lJ)X>tZ~c6gZk{{}_Epd%f)N)2Ta)pXaG^e|~aO_>j~8 z&*$wg|Nr;hKI_T~K_}UL8H;P@m`=RfFg0kSMDbQO)0!Uzo9vntI6fWgZ}ZEuO1qc# zHRY)4q8DpErqxY$Z`LkZJjXbl@8OGmk(<*(_EZ$!sQ-P6N9WO2*8O(ct&5tM_BKeF z=jHtVWDs%k5PzHi%fY7&L zsO;XMey+ZyzOSC&(c)0#{yJOT=xse|=jZuG9B}WEaIF3HMN#L`izjV*xi|hMK1%qc z>N_iBKb!HSE_r*qhvkXiGeub(1)Q9nGfzxVoTB8)Bz&8zL7s8Hi|yveRXot`ub0e(>8PHvsm#caWpjqJiW3q_~qh$yH8Id%baU(`z~_n zW7aX6nYXcT0c+5_Lk1t>d$NbXGz$K-az52(VJFnwo6-@ zcr;{BUqkn-;In0K&Pkn*I&F2B%lxL&ze%O;rABvFr)B9S`6lp&+1D4B>KwgVxU?qw zkxP1Lif*Fq=Owl}LQxkij)f~SISR0(9P^)T#>>0frq(Vm{py#%{9iZLsH_UwY!@JU z@O6f6Xq``s4Yy z%df8gJC}1!#Z-B#{%h|rgVhsvbxaRYkFW}3I{I5B*qrxx#FKSNM>-s*YKJe2+?*B| z5h3Bq>L}2%+<*S1Pft&;EPH#4!?9}93;Wcw>7t=5jvXdHBZF;uI~N49oQe%-YyRZo zD8N$w`di|SX61h#6&L0we*Kd7-O^Fu(WY1K%UIO>=2)fJvA+h_Y)r*p z$sQHqXcCwk>U5XqPQt|HO{*2}u{~Jy!HKrF+T&I}tvrAt+i zMbT`vS@y-j3X_o;mGuK4*$btbc;K;FGQp55a5p!HXQ&(6$T{3u;$ zotk8M+R`8v#|^Qnj;vo(9t4F*i7q@Mu#@?QfI{;Pdyb}pUtcn3ndi%uzPmHCsj2Bg zwEZf%uiX*6k)0xr0y55dThq#SS3Pl`DEKQ;ImRIEjKra~1KAu+6>pV;n?iqET84kKpTO3Xo z&)r_#|1}~v=yPwBlMY8y!VL3(nWm1l(F;~+L~qM!FHf;FyYtl2@?c< zz1@C4<3Iyr%h{rJF*`ThsNQUT(r&BUekSccC5|S6)&R%wt<2#P-3wMc5tyPIJq@%@ zrGn$$uF`IngX$YQOtk_QFl^1eJ?&V(e1D5(aJiL8OY!q_fnQ!+ygT;gL^t6$`nt(IWmJ~idcJbHO*BcE5E-NV}sMbYq&s+NU z_xH<}m-~A@)mm+N+K79<0*8~YzRsoTk+ZKpK3DgOEs-zV^tDoV&BF5gwbMU6Jq>Cl zFZuWP_vJ;d-5k$cL9G)8MUL5#J4Lxc!Qx}T?Y(GhxHH$nHP3ZEwO_DUTJ!VM`uS1{ zZLj;!buzH+u0>|ozCoGDc+PSy3w3MxSvH0Hh{CKBW^IK~3ZL6=%mS%C> zaV#tC*#=OI3h!mzT=n%;OU~blkB=OIu{ii1fM#Zo^h%p& z{QmaVB>kMsp@~(GkM)Aa=BJos21VyF1x#(oex%maa9LS-{r_8D41z3<9&4vBF|YYi z(516*;leHD@8g`>{!LJH=9qgCw07a<=Jfit^KMlgV!j*8^6=f=-3I$F&Gz>Xt?zA6 zaGHnU%z9$)8q z@Zdqv#KNk`&1#8-=jPknCw`t_S6h`6r*PtFC$p9Gqw|g&wFjmO*t6UBKi(d)Hp=vg z{fcM$^OQN5+4)RnHHSz3Pk*o1yn5F+yFTIVb~~)E+>KTID&~|`aW~g%S>D3_ShiR1 z-sxJEH^m;ldv|W*l-n9&PXE4}R|enCc0XrXJ)iIX`7__YUfuiY{mtz4S0fo6G}?BR z9X~(E@-l9PIq?E4R0-N$g9>wdvu-a6+4I#ZW2C=~3S zTDf%o9bF@aFH$Gd6{~YTU?6J2kg>F^ zLf7Z)EYruv77AS3a&M>2wJQB2&GZhWM?((%)l-M6EY?u2a&7`*4gq5MuD(-Le%<#&}O2L0Z3=ZqBta0y`t8+eJ z&Bee}zV6oAGpm2U-*10Nk-;G|bLGnmy89I$@Ub#9?)G{c{4DhSy}imdx&jA|^-8Zz zJw2^%JNvwa3S5@_>DN7DtcCZ3NN%+%Kd#pa4 zP|iI$Nj0pVA+GLc>i%%X{{bh#c4~z@3k?gKR{Qts^{{$|yq!zI?nbvtreHhq>0}>#p)P z{P|P!xpG@v*g~d;#aCle*L|s+Z2R>}aOsXffddDd*>$b0Z|B=P__H!B^a^VZU1}7b zdwbi~^LD>`gjpJ+ZtW^vZJK}Y&R3tmOKxd0aNKRpnrgIPZ{Lrk+2;B4uJSlIIyS1R zsO*@x+*8Yw(c#6Vs|j1zxC?s>a+3_5xy*MqPs8@EE-vfeZ#KuCzsOiRtxK9=!h*bz+1bV%JTev+rs>6I)w3kLy|wk) zhD7J<##@|HSL|S7;Jq5KH9XRHJzG&xQO>a*$#2mNTRN}3|5@pIRFxrP{k`C+r?OuC z`Fwu6Ve+v*uU0cMT#v8c`+BD33cavGZic>a<V2tI5TXZ+^dK^L<9g(Hye-N+LU^FO&-IG4LYyy?cM$QrWWVxTL}yq%f&Q`ukNp}*VfiH zX85`}>#CNwzkj)Hvb`1q$CZ;=-A3y#UApwGxk^UwaE0FeX`a(4kf;GEGF_cGB_3Q zwpwv!^_@F0xA#_WXYA;mXIs6CtzmwsF)Kr0dHa3&|LyX1GyMNFNJQ^0Tbo(mo6S+- z%jght_wBD^@yDlz)!*k=km$Gjwcdpq9>JUcmi<1?&S3YQMJKeAiy`Z+X=+?- z@mbTb$jHo(j0e_4ZuVLKB*ysw11rPUqN&-(_un&*s;u03RGi^@T=m*)h8qilL>Yc$ zt*-kN`7g9{`Lj4#ftoZlt*2nmOfP|0S4)g75W0((w zOQk!Z~noS@b%TzX>;bhkz#t6^MH|I*3P%_UH5q>N_U{qvy>cZadSg;6bkf8fT-pj5Q(b=&^s^QulA+LV9a4s^h^ zsF;{k!>!XNPZshraECZCGfZGHJ)XVs#f^>0XY77zYiVs->OK9|j>5-pCi~lM6pyPo z_-^O(d9VCu`dK~|$-cVkYW}~yF$D)%w_DI>)?6`V$ zo^5r`=Vxclil6yNTNW+Z`|sE5Z%-!s-#XC9{C1MJ-p0lKcDIa-jsJ?Nr;EpyOk`Xk zYn#6={pEXJ28U%;x~p6KK|R*KYimD#+c99aj7XOJNm_VSN?vt z`#i&ydFOo_uqTCRVUN9+GYRzZ5LFn zG7gcR8Zlj(L)t7SV|UrxO}m&U%%A_hDsKBq5!MF+CF{=%1T5vc%4O=>8zR5re{l1a zv#+vBr@dOk7d-LBl5drNt1qfIu`Q@8X`H@v$&wvy4bmbF&LPrQy`Qe)zPfSMQm+ul zs>@qH@87cJ3d5E7_xJY3G9R!PWoTJ8_15F94tu{`@@7*o`qgv&{nfjkTntVh#n-p4 z%)GoTEG#UIL20@7-WcWst3efgfau3}@*Qi-@7G>8Wf0jUDc~S6?^D#2O`A3?+VNT5 zp|Eh{OB>$n0vCc=*%&Te{dQshZ}uBJ7BQ@B4DUWh^<27iDd+aKTsDPWTwGj#{Md5V zF)=cD?-5(P``xb73@-7hsY~ylY~a^m=-B!0)SjqKDV>ZRynEw{c^Ni~G90z0S-hS`XuvnDgh>v^efow)8+o~xDdhK^nP;=23zG&nyzkY`YzSFtFY z;Y2WlKxy(`vANOtd#^SzCwzEta2;d9ET)DPS&5Ph2o0Ue%6%ZvUG}LI)4Om60aNWq&#&1t_}l$llFjgAHB-Y1i|g47Jv}@? zhl59cVDOn~bkvk#3aHf~SbaQu;md1lXSXsRXk=zz6S&xIo#KMoObs0>E9b^_pGluz zoA!`#!tB|vr5OG#Vo*@Jxh}ij+sjMGhT&e_@3#s5tSkr4|F^WX6w_mPeSLj7FGJ|6 zrK`jlJVI{o6`P^I@5iA-><>DW`wDm&|Ay>kIH0<2{{QaoZrvJ&cl-a>U1#{Pag{hj z#p&$CmlqeeGj{MFZs#xOWmtVhk>!8ldp?D$T!#(%>WkmcO~{cr>oX;>Rggzbfw4T< zAcRw-nbG`!PLU_~BHoJ`tTPy|8MLvrA9 zJT68w=5x_PQSbft#myNa^rqMSXWo&^#MICpwNgf2{&dw|v2q3v6`^f{1zAi?4aRE& zjAr)iV0G9Sv4yvxn3;jG_A1xXiy0gY+e>!G-e&lb#-Pw39rrJ*)o8AtstLn6=J=|e zd3-Dk{#%VY-4@UJ$11bs_S--2m~4#LnHsi7O`PJTS}5EQqn9qtpns;3Az_{9$qW-A zbH)`{v$ipQI48rv@a|UL|Mg+og~AOF3o@h`?w@63c(5}}>10aK9o7W1**Dn^q}5+n zwqU6Fw>@ZO$8Lt4?a`esO4|er?sw}m{8%V@BEdjlJEO<)%i9<~ocY1f5FJ+*)uWT%3|G}zZtgN&b`g>Bcq1F!CAY%#!mkovw>WHF7t!w9~l|u zZ~gS5#Oje9!{?uO%ozT?@vmWSc(pxDZt_W&LyQkp51c&Nnags=kYT}&1)CPfYErufM8KGyF(maJU%A_4ttY zkrvK|*>TfOz5ltCk-_!I>DhmS51jsM&L}s-fayd2f<3$WI^r2Vx+ \ No newline at end of file diff --git a/flake.nix b/flake.nix index 217b7cc..a0ce7ed 100644 --- a/flake.nix +++ b/flake.nix @@ -65,6 +65,10 @@ # racket "*.rkt" "**/rashrc" + + # custom assets + "*.png" + "*.svg" ]; settings.on-unmatched = "fatal"; }; diff --git a/services/forgejo.nix b/services/forgejo.nix index 2f69a55..5e7be6f 100644 --- a/services/forgejo.nix +++ b/services/forgejo.nix @@ -37,6 +37,19 @@ }; }; + systemd.tmpfiles.rules = + let + cfg = config.services.forgejo; + imgDir = pkgs.runCommand "forgejo-img-dir" { } '' + cp -R ${../assets/forgejo} "$out" + ''; + in + [ + "d '${cfg.customDir}/public' 0750 ${cfg.user} ${cfg.group} - -" + "d '${cfg.customDir}/public/assets' 0750 ${cfg.user} ${cfg.group} - -" + "L+ '${cfg.customDir}/public/assets/img' - - - - ${imgDir}" + ]; + services.nginx = { enable = true; recommendedProxySettings = true; From 9dfdd8f49420c7533f86227794c34e16aa7daafc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nikodem=20Rabuli=C5=84ski?= Date: Sat, 22 Mar 2025 00:31:15 +0100 Subject: [PATCH 5/6] services/forgejo: use latest instead of lts --- services/forgejo.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/services/forgejo.nix b/services/forgejo.nix index 5e7be6f..84c34ef 100644 --- a/services/forgejo.nix +++ b/services/forgejo.nix @@ -3,7 +3,7 @@ host = "kazuki"; ports = [ 3000 ]; config = - { config, ... }: + { config, pkgs, ... }: { age.secrets.rab-lol-cf = { file = ../secrets/rab-lol-cf.age; @@ -12,6 +12,7 @@ services.forgejo = { enable = true; + package = pkgs.forgejo; settings = { server = { DOMAIN = "git.rab.lol"; From 4ae04f6c6d89d1621d9281fbd3b9d98918c857da Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nikodem=20Rabuli=C5=84ski?= Date: Sat, 22 Mar 2025 00:31:30 +0100 Subject: [PATCH 6/6] services/forgejo: enable git hooks --- services/forgejo.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/services/forgejo.nix b/services/forgejo.nix index 84c34ef..afb7b7c 100644 --- a/services/forgejo.nix +++ b/services/forgejo.nix @@ -18,6 +18,9 @@ DOMAIN = "git.rab.lol"; ROOT_URL = "https://git.rab.lol/"; }; + security = { + DISABLE_GIT_HOOKS = false; + }; oauth2_client = { REGISTER_EMAIL_CONFIRM = false; ENABLE_AUTO_REGISTRATION = true;